Alan B. Pearce wrote:
> The catch(es), of course:
>     - Firmware is not secure, anyone can eavesdrop on the download to 
>         copy your IP ...

True.
But in this case, the firmware is basically a protocol converter -- all 
the interesting stuff is in the FPGA. You're welcome to dig into the 
firmware but all you'll see is USB init, a bit of FPGA init and some 
protocol translation logic. The Verilog code for the FPGA, on the other 
hand, is much more interesting...

If I wanted to be really nasty, I'd get a bunch of Dallas DS2432 SHA-1 
Authenticator chips, solder one to each board, and add an IFF (Identify, 
Friend or Foe) module to the FPGA logic. If the IFF doesn't detect a 
valid 2432, then it holds the FPGA logic in reset. If the IFF check 
passes, the RESET line is released and the FPGA logic starts running.

I think there's a Xilinx appnote on this...

There are also other sneaky things that can be done in (PC) software, 
like checking serial numbers. Hide the hardware serial number somewhere 
in EEPROM, and keep an encrypted/scrambled/hashed copy elsewhere (maybe 
in flash). Don't check it AT ALL in the firmware, just let the device 
run. Then when the software boots, check the serial number against a 
blacklist. For best results, implement multiple layers of checking, and 
add one check per software release.

Apparently this is what CADSOFT did with the EAGLE licenses -- v4.00 
keyfiles had a few "unused" words. Someone released a keygen, then CS 
released EAGLE 4.01 which enabled an additional check on one of those 
"unused" words. Rinse, repeat.

If you want to be really sneaky, run the licence-checking logic inside 
an internal virtual machine. Then anyone that wants to bypass the serial 
number blacklist will need to reverse engineer the VM first. This type 
of system is working (reasonably) well for the Blu-Ray platform (google 
BD+). As soon as someone cracks Security Module V1, you turn on a few 
more security checks and release Security Module V2.

Then there's the option of keeping software releases "private" to 
customers. Log in with serial number and a corresponding "service tag" 
number that's stuck to each unit. Again, the blacklist comes into play...

It's like a game of Whack-a-Mole.... or possibly GLOBAL-THERMONUCLEAR-WAR.

-- 
Phil.
piclist@philpem.me.uk
http://www.philpem.me.uk/
-- 
http://www.piclist.com PIC/SX FAQ & list archive
View/change your membership options at
http://mailman.mit.edu/mailman/listinfo/piclist