×
INTELLIGENT WORK FORUMS
FOR ENGINEERING PROFESSIONALS

Log In

Come Join Us!

Are you an
Engineering professional?
Join Eng-Tips Forums!
  • Talk With Other Members
  • Be Notified Of Responses
    To Your Posts
  • Keyword Search
  • One-Click Access To Your
    Favorite Forums
  • Automated Signatures
    On Your Posts
  • Best Of All, It's Free!
  • Students Click Here

*Eng-Tips's functionality depends on members receiving e-mail. By joining you are opting in to receive e-mail.

Posting Guidelines

Promoting, selling, recruiting, coursework and thesis posting is forbidden.

Students Click Here

Jobs

Envelope penetration detection
4

Envelope penetration detection

Envelope penetration detection

(OP)
Hi,

I have one PCB with electronics that I want to protect from ouside world probing! I use on Flat for the interface.

I am considering the use of a sheet to enclose the PCB.
It would be great to measure the tin sheet and if some hole is made on it this resistance measurent should be different in order to trigger some action.

Any Idea on how to measure correctly this!?

Please note that this must be working on all circustances so probably whatever design idea is brought it must work properly powered by a lithium battery.

Thanks 2 All

RE: Envelope penetration detection

How about a seald box with positive pressure.  An absolute pressure sensor could monitor it.  Another option is to epoxy a circuit board on the inside of the case with a line pattern etched on it.  Then you just detect a break in the circuit.  Protection schemes are almost always a waste of effort. I worked with an owner who went through all sorts of eforts to protect designs I would be ashamed to show to someone.  Hey, maybe that's why he did it.

RE: Envelope penetration detection

Why not simply pot the darned thing?

Any external scheme can be defeated within 2 or 3 copies.  A potted circuit board, particularly if critical jumpers or parts are near the outside, cannot be readily penetrated without destroying the functionality of the overall circuitry.  

There are basically only two ways of penetrating potting material, mechanical grinding or solvents or etching.  You can make parts of the circuit more susceptible to those types of actions, so that any attempt would cause destruction of the sacrifice components or non-functionailty of the overall circuit.

Additionally, this approach requires no power at all and is not subject to false alarms.

TTFN

RE: Envelope penetration detection

(OP)
Thanks for your answers.

1) Both talk about EPOXY. This is nice but I have seen EPOXY being removed without damaging the board!

How can I real make a part susceptible to etch!?

2) "How about a seald box with positive pressure"
The box can not be completed sealed because I need to make connections with outside. Even using a flat I think it can change the pressure with time!

RE: Envelope penetration detection

As I mentioned, if you are that paranoid, you'll need to design parts of the circuit itself that can be readily damaged by the de-potting process.  For example, if the circuit card itself were made out of the potting material, it could make it extremely difficult to properly reverse- engineer the circuit.  Alternately, you can place major portions of the circuit within an EPLD that cannot be directly read out.

Ultimately, you should be clear that there are very few circuits worth protecting this way and that given sufficient cause, any means of protection can be defeated.

TTFN

RE: Envelope penetration detection

Place bare die devices instead of packaged parts....

RE: Envelope penetration detection

(OP)
I believe I am was unable to explain correctly my problem.
What I need is something to protect SRAM critical data and not to protect reverse engineering!
Basically I need to know when a penetration happens and then short the VCC-GND SRAM pins.

"For example, if the circuit card itself were made out of the potting material," - What potting material were you thinking?

"Place bare die devices instead of packaged parts...."
Hard to find and very expensive...

From what I have read from all it seems that the best is to use EPOXY covering one black box.This blck box will have the PCB(with the SRAM data) covered by some special membrane with lost of tiny conductors that are easily broken when someone tries to remove the EPOXY by any means!
The problem: Where to find this special membrane!!!!???

I am also considering Flex circuits and then extend the PCB to make one envelope around itself! But I really do not know if this will be sufficiently damaged!

Any news!

Thanks 2 all





RE: Envelope penetration detection

But you haven't really indicated what level of determination you expect the intruder to have.  If you think that an intruder will probe an SRAM and figure out something from that, it implies a high level of determination.

If you're concerned about casual intruders, simply erase or otherwise remove the part numbers from the parts on the board.  Use FPGA's with internal RAM to hide the data.  Use ball grid array packages to hide the I/O pins.  Encrypt the data.

The medium level intrusion protection is potting the board

The high level is all of the above plus hybridization of components, using flip-chip mounting of bare die.

The options are endless.  You need to explain clearly why you think it's necessary to hide your data and how much you're willing to pay and how much you think the intruder is willing to pay.

TTFN

RE: Envelope penetration detection

(OP)
I use DS5002 from Dallas which has BUS encryption.
In the SRAM there are security KEYS that I must protect.
Even encrypted with some effort it can be broken.
The idea of using some special enclosure is at least to increase the time for the attack as much as possible.

About the money that I can use: About 50€ at most for this special enclosing!

RE: Envelope penetration detection

Given these constraints:
>  pot the board
>  remove part numbers from parts
>  try to use FPGA embedded SRAM to store keys
>  use secondary PCB as top layer interconnect and as cover for QFP leads on processor and other parts, e.g., have pbc ~0.1" thick with one or two layers of interconnect and ground plane that is soldered/mounted over top of populated pcb.  
>  use the two layers in the cover PCB as capacitors to monitor for intrusion by change in capacitance
>  use BGA wherever possible
>  bury traces wherever possible

TTFN

RE: Envelope penetration detection

Could also put dummy parts on board to make it more difficult to determine functionality.

TTFN

RE: Envelope penetration detection

A company copied a logic board's layout, bought IC-s and built a few hundred, hoping that they can sell at least
part of them which work.  Not one single one was working...

Just before they ran out of money, they found out the company mis-marked a custom IC with the number of a standard
of the shelf TTL IC...

<nbucska@pcperipherals.com>

RE: Envelope penetration detection

Or if you are that paranoid about this, provide an on-site respresentative with the box.

RE: Envelope penetration detection

Another quite simple way of making it just a little bit harder is to mix up all the address and data lines going to your RAM.

RE: Envelope penetration detection

(OP)
First thanks for all comments/suggestions

Warpspeed:
Nice idea but I have the problem that the SRAM will have DATA as well as CODE! This means that I can not change data lines and I must be carefully with Addr lines change.
Even if I change some addr lines is not relevant because it is just a question of probe the RAM. Nevertheless I have marked your post because if the RAM was only for DATA it would be a very good idea.

Melone:
Sorry but I am not understanding what you mean with "...an on-site respresentative with the box...."Probably is because of my weak English. If could state it other way...

nbucska:
I hope it was not your company:) As I say my problem is not design protection but rather internal data protection.

IRstuff:
Dummy parts are not relevant because any attacker will go directly to SRAM! Unless I put 1000 SRAMs:)
"...try to use FPGA embedded SRAM to store keys.." Nice but i still have to connect it to the uC so...

All are ideas are good. The idea of measuring capacitor is cool but I have some doubts if I will always get the same capacitor for each product and if the change is relevant for a small hole! nevertheless this could be a means of preventig PCB disassembly to get to internal traces/protection mask. Of course this PCB CAP measurement circuit must be always active(bat powered!) and must give one digital signal for ok/attack!


RE: Envelope penetration detection

If the circuit is not powered up, then there is nothing t probe.  

The capacitance would be based on the thickness of the cover and can be controlled reasonably well, and or be laser trimmed for tighter tolerances.  This prevents the attacker from altering the circuit configuration of the cover, as that would change the overall capacitance.

You seem to want a lot of protection for very little money.  You might also wish to review the protection of the processor itself for what is accomplishable within the processor that you can readily duplicate.  Presumably, Dallas Semi has app notes on how to protect the external data.  It would be rather foolish to provide such protection on the processor  and yet leave vulnerable bits of data lying around.

After all these posts, I've yet to get a clear idea from you what the expected attack looks like.  This should be the primarily requirement; defining the attack scenario and the methodologies employed.  If you do not have this explicitly defined, you get what you gotten so far, a bunch of random ideas without any notion of what the true attack looks like.

Additionally, once you define the scenario, you need to identify the probability of occurrence and the potential downside.  Only then can you correctly establish what the allowable cost of protection is and whether your budget is at all realistic.


TTFN

RE: Envelope penetration detection

It seems to me that he has external memory that stores security codes or sensitive data and the concern is that these codes or data could be read out.  I would think the best protection is for the processor to encode the data going into memory.  Each processor would be programmed with a different key so this data couldn't be loaded into a like machine and the data used.  This would be effective because most processors have a pretty good protect mode for the program. Even site specific programs could use use this translator method.  Like the STAMP that you load their "basic" into. Only cost is added memory and slower running.  

RE: Envelope penetration detection

The processor in question uses encrypted instructions and is specifically designed for this application.

TTFN

RE: Envelope penetration detection

(OP)
Again thanks for your comments:

The uP DS5002 does BUS encryption and the CODE and DATA store are encrypted. And yes, different boards will have different encryption keys on the uC.

I need a PCB board that can run security algorithms and keep security keys inside.
This can be used for instance for PC secure communications across internet for individuals as well as for companies.
let me call it (no name yet) secBoard.

On the secBoard there will be session keys as well as master keys and it is meant to work for 10 years (the usual figure although I do not why always this number:) )

The DS5002 is not the TOP security! It is a nice uC but can be broken. It is not easy and not everyone can do it of course.

Security is more a matter of trust. Every system might be broken someday and of course when I say 10 years I must take this in consideration!

Tipically when designing security hardware we must think like the comment from IR stuff and we have to look for the security criteria to follow.

From my research on the internet and from what I have heard here I come to the following conclusions:
1) Software if extremely important!
2) EPOXY with special characteristics is very good for tamper detection and attack delay
3) Envelope detection is "the cool feature:)"


Why it is important to make the attack longer!? Well because if one secBoard disappears or has tamper attack evidence the the master key must be changed as quickly as possible! By keeping the session keys changing often will prevent recorded messages to be broken!

"If the circuit is not powered up, then there is nothing t probe." remember that if no protection on power off someone can get to the PCB and broke the protection! Then it is easy to turn off the power!

"You seem to want a lot of protection for very little money."
:)) Yes  but that is the life of someone that wants to do soemething:) if I was IBM probably any security product less that 10000€ would be considered very strange:)

So in conclusion I am looking for "nice" solutions.
For the envelope I haven´t found anything!
Also I do not know if it is very feasible to disassembly one PCB to reach the inner tracks!?

One cool solution can be tilt sensors but this must be used carefully or else.....

RE: Envelope penetration detection

The bottomline line here is tnat anything that you or anyone here can come up with can be broken given enough time and money.

It is completely irrelevant how "nice" or "cool" a solution is if the upside is worth the effort.  

Your tilt sensor can only be applicable during operation, since there are plenty of valid reasons for moving equipment.  Tilt sensing during operation is irrelevant, since there may be no reason to tilt the equipment during an attack.

TTFN

RE: Envelope penetration detection

There are many microprocessors which have internal, unaccessible RAM. If part of the circuit is on FPGA,
someone may copy it but without understanding, couldn't manufacture and maintain it ...

<nbucska@pcperipherals.com>

RE: Envelope penetration detection

I like the epoxy as a slow down deterrent, but I think you should use a box inside a box approach where the second box must be in place before data is stored.  Then, if the outside box (with epoxy) is disturbed or removed, the destruct circuit will fire, destroying the data.
Some small wiring embedded in the epoxy would also make entry by epoxy removal difficult.  
A magnet and hall sensor are one approach, with circuit that senses the hall current or other and etc.

RE: Envelope penetration detection

How about randomly chop up chunks of encrypted data and store them in different physical RAM's?

It would add to the complexity of the PCB.

It would slow down puzzling together the shreds of data to something interpretable.

If a pro really wants the data, he will stop at nothing.

And if someone wanted to get the data for the sport of it, he won't stop at anything either ...

RE: Envelope penetration detection

(OP)
"How about randomly chop up chunks of encrypted data and store them in different physical RAM's?
"
I believe that the uP does this! By encrypting the addresses you do not know where is the vector table for instance.

"but I think you should use a box inside a box approach where the second box must be in place before data is stored."
why? I haven´t understand yet what is best! Place the EPOXY covering the components or covering another internal box where the secBoard is?!

RE: Envelope penetration detection

Why is this worth all of this trouble?

RE: Envelope penetration detection

No single scheme will provide the protection you are looking for. FET probes can be made microscopic and guided to the desired circuits by Xray with extremely fine drills. As for raw die, I have personally probed working raw die and have even modified them by cutting metal traces. I do not doubt that some partical beam could be employed to probe a working circuit as well. What might be one of the best schemes is a soldered metal cover where alternating conductive and non conductive layers are deposited on the cover after the soldered cover is attached. Virtually any effort to probe the inside would result in a short and/or change in capacitance erasing the data. The test circuit would also monitor the capacitance of the cover coating from inside the cover. All the traces to and from inside the cover would be inner traces of the PCB allowing a complete seal all around. Similar monitoring of traces in the PCB would check for any effort to delaminate the PCB. A very low power CMOS processor with a lithium battery would be running the testing. Using a few resistors it could constantly test the layers from the time the unit is assembled. Any time the parameters went out of a predetermined range, the SRAM power would be cut until the parameters were back in range. The AC signals from the micro, used to test the capacitance/resistance, would vary with time according to a randomization scheme in the micro. Such algorithms could easily be made to not repete for many decades making it difficult to syncronize some system to defete it. Cost of this scheme would be fairly low as such microcontrollers are cheap. How long that would delay determined engineers is still a gamble. Many would simply see it as a challenge.

RE: Envelope penetration detection

(OP)
Hi Heydave,

I have two questions:
1) The C is not temperature and pressure dependent?
2) "The AC signals from the micro, used to test the capacitance/resistance, would vary with time according to a randomization..." why is random necessary?

RE: Envelope penetration detection

The C is variable but we are not talking precision, just a range. The value of the capacitance is small making it difficult the physically switch out and switch in a dummy. Multiple contact points to the detection coating can make the switching difficult and allow for an added continuity test.
A switched state from an output pin through a resistor to an input pin and the capacitance being tested will produce time delay to reach a given level. This would be capable of detecting a short or change in capacitance by having a time window around this delay. Using a randomized PWM scheme can complicate this measurement but make it difficult to defete.
A device driven by a fet probe could record the waveform virtually without detection by the intrusion detection circuit. Later, this device would force the waveform during removal of the barrier. Randomization of the test signal defetes this intrusion scheme. A possible scheme to defete this could include a focused radiation on the control circuits for the power switch making it permanently active. Perhaps this could be bolstered by redundant power switches that cycle between each other. If a switch does not quit, then a crowbar circuit steps in......................
It does not matter what scheme you come up with, it can be broken given enough effort. The point is to make that effort unreasonable without making the protection unreasonable. The more diciplines needed to defete a protection, the more unlikely it will be that such skills can be assembled.

Red Flag This Post

Please let us know here why this post is inappropriate. Reasons such as off-topic, duplicates, flames, illegal, vulgar, or students posting their homework.

Red Flag Submitted

Thank you for helping keep Eng-Tips Forums free from inappropriate posts.
The Eng-Tips staff will check this out and take appropriate action.

Reply To This Thread

Posting in the Eng-Tips forums is a member-only feature.

Click Here to join Eng-Tips and talk with other members!


Resources