1
\$\begingroup\$

Is there such thing as permanent EEPROM storage?

The data written should be un-deletable.

Once written it should be there as long as the chip is not destroyed or damaged.

Any other alternatives to EEPROMs are welcome.

I use DVD drives for PC. But I need a similar chip or system for microcontrollers.

Important: I don't want this to be implemented in my microcontroller Software by custom code. The Chip or IC or System it self should have that by default.

Link on Security.SE:

https://security.stackexchange.com/questions/128160/undeletable-logging-or-file-writing/128161#128161

\$\endgroup\$
  • \$\begingroup\$ The second "E" in "EEPROM" stands for "erasable", so whatever it is, it won't be called an EEPROM. \$\endgroup\$ – The Photon Jun 25 '16 at 4:54
  • \$\begingroup\$ How much storage do you need? \$\endgroup\$ – ThreePhaseEel Jun 25 '16 at 6:11
  • \$\begingroup\$ As you are thinking about inside attacks and keylogging, it may be better to migrate this question to the Information Security SE board, where there are people far more expert in these topics. \$\endgroup\$ – Neil_UK Jun 25 '16 at 8:24
  • 2
    \$\begingroup\$ EPROM (without the "EE" for Electrically Erasable". Technically it is still erasable, but you need to shine an UV light on it for several minutes or more. And that's difficult in an OTP EPROM because there is no window in the package... Programming requires high voltage (12 or 13.5 in "newer" ones, up to 21 or 28V in really old ones) \$\endgroup\$ – Brian Drummond Jun 25 '16 at 11:53
  • 2
    \$\begingroup\$ Many microcontrollers have OTP versions, just look at the available options for you favorite part or vendor. \$\endgroup\$ – old_timer Jun 25 '16 at 14:24
5
\$\begingroup\$

Yes -- what you are after exists, at least for small sizes. While most OTP EPROMs are parallel devices designed to be "burned" in dedicated EPROM programming hardware, Maxim makes exactly the part you're after in the form of the DS2505 -- 16kbits of in-system programmable OTP EPROM, with a unique serial number lasered into the chip as well that can be used to thwart chip replacement attacks.

You'll need a wee bit of drive circuitry as well as some bit-banging code to talk 1-Wire as the DS2505 requires its Vpp pulse to be muxed onto the 1-Wire interface along with normal power and data.

\$\endgroup\$
  • 1
    \$\begingroup\$ The serial number would presumably prevent copying partial or modified data into another DS2505 and passing it off as the original to someone who can then examine the hardware. But I'm not seeing any feature in the DS2505 summary which would rule out substitution of an MCU programmed to emulate the original DS2505 including serial number to the confusion of someone who can only then examine the system through software. So this only seems to provide protection in the case where the hardware can be examined for substitution... and there may be MCUs in similar enough (or custom?) packages... \$\endgroup\$ – Chris Stratton Jun 25 '16 at 16:36
  • \$\begingroup\$ @ChrisStratton -- you'd need to do an awful lot of work to emulate the DS2505 with a MCU considering it's a) a 1-wire device and b) takes 12V Vpp pulses multiplexed onto that 1-wire interface. \$\endgroup\$ – ThreePhaseEel Jun 25 '16 at 17:53
  • \$\begingroup\$ You mean like a resistor and a zener diode, and maybe a capacitor? Of course the result is not unlike someone copying and replacing the DVD in the poster's desktop setup. \$\endgroup\$ – Chris Stratton Jun 25 '16 at 19:00
  • \$\begingroup\$ @ChrisStratton -- that takes care of b) but leaves a) -- you'd need to do more work still to get a) going (you might be able to pull it off by abusing the ESD diodes on the micro as rectifiers -- but good luck getting all that past even a cursory visual inspection of the insides -- neither the TSOC-6 (tiny SMT) nor the TO-92 (...when was the last time you met a micro in TO-92?) would lend itself well to this attack in the way say a DIP would) \$\endgroup\$ – ThreePhaseEel Jun 25 '16 at 19:02
  • \$\begingroup\$ Black epoxy should not be hard to source. Used older wire bond machines aren't that expensive. It all depends on what your concern is. The irony is that the more the original is covered in gunk, the easier it is to disguise a substitution. \$\endgroup\$ – Chris Stratton Jun 25 '16 at 19:05
2
\$\begingroup\$

One of your comments suggests it has to be resistant to an 'inside attack'. Which will be difficult.

What do you actually want to achieve?

a) 100% reliable access to your data? If so, a denial of service attack, damage of the data or the chip would be a lose for you.

b) 100% reliable trust in the veracity of your data, so no alteration without detection? As you mention data valid until damaged in your OP, this could be sufficient, depending on whether 'destroyed' means the physical chip (or system it's embedded in) or the data on it.

If a) then you have an insurmountable problem if the attacker has physical access to the system. If he can zap the chip, or the system, or hit it with a hammer, really all bets are off if he has access.

If b) then you don't need any physical controls at all. A sufficiently strong cryptographic checksum stored with the data will tell you whether it has been altered in any way since writing.

So OTP and write bits are neither necessary (for b) nor sufficient (for a). Make sure you pick a solution that meets your real needs, and understand what you really need.

\$\endgroup\$
  • \$\begingroup\$ I have no solution for DOS. I need to know if the data has been altered. Cryptography is not an option as the attacker may be a police state keylogging everything the user types. I need b) with hardware not software as software can be backdoored. \$\endgroup\$ – Wally Jun 25 '16 at 7:27
  • \$\begingroup\$ I need both hardware and software with b) if possible. Hardware is mandatory. \$\endgroup\$ – Wally Jun 25 '16 at 7:27
  • \$\begingroup\$ If you have been keylogged, then all bets are off. Kiss your security, and the thing you sit on, goodbye. \$\endgroup\$ – Neil_UK Jun 25 '16 at 8:12
  • \$\begingroup\$ That is why I use storage like DVD/CD discs for PC. I need logging for Microcontrollers now. I don't want security through obscurity. I want Hardware level security. \$\endgroup\$ – Wally Jun 25 '16 at 9:15
  • 1
    \$\begingroup\$ The level of discourse you're providing suggests you're out of your depth here... \$\endgroup\$ – Daniel Jun 25 '16 at 14:41
1
\$\begingroup\$

Yes, it's called a ROM, read only memory. A One Time Programmable (OTP) ROM is what you want. Alternatively an EEPROM with a Write Protection or Write enable pin that you can tie to VCC or GND to prevent rewriting. It's a less than 100% solution, if you have physical access, though you could just pour epoxy or potting compound over the EEPROM afterwards to make it really hard to write enable.

\$\endgroup\$
  • 1
    \$\begingroup\$ There are issues about how long memory chips can retain data, and nothing beats the old 'platinum fuse' IC's, but I think ROM's so far have better data retention, with large memory cells and a long track record. EEPROMS have a quoted but unproven long life. \$\endgroup\$ – Sparky256 Jun 25 '16 at 4:35
  • \$\begingroup\$ I need it be un-deletable from an inside attack perspective. So, write enable pin is not an option. I'll have to look into epoxy. \$\endgroup\$ – Wally Jun 25 '16 at 4:40
  • 1
    \$\begingroup\$ @wally which is why I recommend the epoxy solution. If this is a one off and you have an EEPROM already, it's simple. If this is for production a OTP ROM is better. But even ROM arnt 100%. Only about 99%. Proof. They could always glitch it, or replace it. \$\endgroup\$ – Passerby Jun 25 '16 at 4:44
1
\$\begingroup\$

Other people have asked you to cover your ground rules already, so we know that whatever you put on can be damaged or removed if the aggressor has access to the components.

I don't know how much ROM data you need. But looking at what can be programmable by you and then stay 'tamper-proof', I'd suggest using a Lattice iCE40 FPGA such as an iCE40LP1K. It contains OTP configuration Flash, so you alone can programme it but no-one can read it or reprogramme it.

As per p6 of Lattice TN1248 'iCE40 Programming And Configuration':

"The NVCM contents are entirely contained within the iCE40 device and are not readable once protected by the one-time programmable Security bits. Furthermore, there is no observable difference between a programmed or un-programmed memory cell using optical or electron microscopy. The NVCM memory has a programming interface similar to a 25-series SPI serial Flash PROM. Consequently, it can be programmed using Diamond Programmer (version 2.2 or later) before or after circuit board assembly or programmed in-system from a microprocessor or other intelligent controller."

You then design an FPGA circuit to implement a ROM of your data and your communications port. That circuit is then loaded into the FPGA configuration from the internal OTP memory.

Your ROM communications port protocol is of your choice. It can be to a standard (e.g. SPI, I2C) or a made-up one that's difficult to understand by an intruder with a 'scope. I appreciate that obfuscation of data will not save you in your application but it will slow those intruders down a bit and its a cheap option.

Which device you need and whether an iCE40 can hold all your data depends how much you've got and I don't know that. Oh, and I think the iCE40 also has an internal oscillator but I'd need to check that.

Putting a conformal coating on to make it very difficult to observe pin activity seems a cheap option afterwards, if its of use. You can either have it done professionally or get medieval with a packet of Araldite.

\$\endgroup\$
0
\$\begingroup\$

Some chips have OTP areas that are for serialization information etc. It depends on the manufacturer and product line as to whether that is available on-chip though.

But EEPROM can be 'permanent' if you write your program so that it can't be overwritten!

\$\endgroup\$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.