2
\$\begingroup\$

I designed a USB dual host based on a FTDI's VNC2-32L1B. I'd want to protect its firmware from being read/copied cause it contains pretty sensitive data (private keys, etc.), but the VNC2 has no read out protection option at all - everyone who has a debugger interface is able to download the flash image.

So my question is wheter is there any hardware or software possiblity to protect the chip from readout? I've thought about cutting out the programming pins and writing my own bootloader, but I'd prefer a simpler or (perhaps) better solution. Thanks in advance for any ideas.

\$\endgroup\$
1
\$\begingroup\$

How you approach this depends, of course, on who your adversary is and how valuable the information would be to them. Is your adversary the Mossad, or your neighbor's kid? Storing nuclear launch codes clearly requires a different level of protection than storing the password for your lawn sprinkler automation system :)

Cutting the programming pins will only make the task slightly harder; even a moderately-determined attacker could etch away the plastic and connect to the pins. I realize cost is an issue here, but you may consider putting the code on a microcontroller that does support readout protection, which will protect you against a casual adversary, but of course not against a well-funded one.

The problem of how to protect secrets (keys etc.) on hardware devices that are not always under the owner's physical control is a very large topic, with solutions ranging in price over several orders of magnitude. Perhaps if you gave some more detail I could point you to the right information, but as it stands, all I can say really is "it depends".

| improve this answer | |
\$\endgroup\$
  • \$\begingroup\$ Thanks for your post. The main goal of the protection is to prevent the firmware to be copied and uploaded to a similar or even cloned device, that wasn't produced by the company I work for. There were many cases that our devices were counterfeited and sold without our knowledge and permission. \$\endgroup\$ – Adam May 24 '16 at 6:31
  • \$\begingroup\$ well, welcome to the real world :) If you provide good service and support to your customers, you'll find that they would rather pay your higher price and get support, than get the cheap knock-off and be left out in the cold when things break. You should not be storing keys that do not "share fate" with the user on such a device anyway. \$\endgroup\$ – JayEye May 25 '16 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.