Is it possible to "hash" a circuit board?

Question

I'll preface this by saying I'm a software engineer by trade and have very little EE knowledge.

In the software world, one can take all the bits that make up a file and generate a hash for a file. When the same hash algorithm is used, the hash of a file with identical contents is always the same.

I've always wondered whether or not something like this would be possible for physical circuit boards (not design files).

It seems to me that some combination of electrical/physical measurements ought to generate a unique identifier.

• This identifier could be used to make sure the board wasn't tampered with.
• One could independently verify the components of the board by reconstructing it and making sure the "hashes" match.

Is there any fundamental reason why something like this isn't possible? Is there any work being done in this area?

Answer 1

It is not possible to do a unique hash like you suggest, however there are test methods to verify a PCB functions as it is supposed to be, this is to ensure components are all there and aren't swapped around during manufacture. Normally used to factory test a board.

It is possible to get signatures from a digital board, we used to do that in the 80's mainly for primitive computers back then, you would pull the CPU , plug it into a "NOP" fixture, and the CPU would cycle through all 65536 addresses, then you would take a probe, and it would show a different 4digit number when you poked in different places , if the signature was wrong you were close to the fault. This wasn't as useful as originally thought and has fallen out of favour.

What we do now is use JTAG , and you would generally plug the board into some sort of fixture. JTAG allows you to chain many digital IC's together with only 4wires, and you can program any device, verify it , or read and write to any physical pin. See https://en.wikipedia.org/wiki/JTAG , but there is no "Unique hash" , but there will be a unique signature for each test file that is run, about as close as we can get.

Answer 2

Many processors do provide unique serial number identifiers, including 128 or 256 bit encryption of the firmware based on the serial number. But this is mainly for the purpose of securing the firmware. If you tried to run firmware that was encrypted with another serial number it would fail to boot etc. However to do this for every component is going to be difficult, costly and practically impossible for the actual physical PCB. You could embed and RF ID chip in the PCB and verify it's a particular PCB, but more difficult to ascertain if somebody, say, had cut a signal line, or had added a short-circuit on a pin, somewhere on a chip externally ... So in brief, you can secure the core components and uniquely identify them (mostly), such as microprocessors that support unique identifiers and encryption/decryption of application code, but generally to extend this to all other components on a PCB will not be possible unless the component manufacturer provides the means for digitally identifying a component on a PCB (via some UI system), and allowing for probing for a UI via a simple bus system, so that eventually all components on a board could be accounted for by each of their UIs ... Doing this for every resistor, capacitor, transistor, diode etc would be possible, but beyond the scope of most consumer or even industrial / medical electronics...

Answer 3

A standard method to check both populated PCAs and unpopulated PCBs is to use a flying probe machine.

This is a sort of robot that has two or more spring loaded, pointed probes that can be moved independently in multiple axis under software control.

This generates a matrix of complex impedances vs frequency (some machines can also measure voltages and apply currents) between node to N x node connections.

The input to this is a map of test point/pad locations and expected result from a 'golden' (i.e. known good) sample.

If you do this for an unpopulated board you get a form of hash as any changes in the internal tracing or external pad locations would cause a different impedance map, i.e. a different hash.

Such a test would necesserily not be very good at picking up subtle changes, e.g. different materials, silkscreen changes, material batch and process variations. Such a hash would be considered functional, grey or fuzzy.

For a populated board this is more complicated.

The board can be powered or unpowered but any impedance map or voltage map will very much depend on the type of circuit and any parasitics will complicate the answer.

Some machines can even perform signal analysis and JTAG but even that may not be enough.

I have used this to some success in the past to do end of line testing on assembled PCAs but any failures (or any passes for that matter) have to be taken with a pinch of salt.

For that reason I'd not really consider it a true 'hash'.

Answer 4

I'm going to go out on a limb and say that this is not feasible.

1. Circuit boards can have many layers, sometimes a dozen or more. Some of those layers will be solid metal ground planes. Even with an X-ray camera, I don't think you could get a good image of the inner layers. So physical measurement of all the traces on a finished board is out.

2. Integrated circuits have the same problem, but more so. It is not possible to fully map out a complex IC without destroying it in the process.

3. Even if we ignore #2, IC manufacturers do not want customers to rely on an exact hardware revision of a product. Products are sold to meet datasheet specs. Manufacturers are (and should be) free to implement minor quality and yield improvements without forcing customers to know which silicon revision(s) they're getting in their next order.

4. For similar reasons, manufacturers of assembled products usually do not want to publish a bill of materials. Without one, it is often difficult or impossible to even identify every IC on a board, which would rule out any hashing scheme.

5. By the same logic as #3, even electrical "hashing" of a bare circuit board could be problematic. The exact resistances, inductances, and capacitances of the traces may vary from board to board. Doing a full DC test probably wouldn't be too hard (although there are N^2 possible hole combinations to consider if you want to look for extra traces). AC testing seems much harder.

So if you want to test design integrity (as opposed to datasheet functionality), I think you're out of luck. You could probably make something like a hash for individual layers of a circuit board, but I can't think of a viable way to test for deliberate alterations performed at the factory.

Answer 5

I like the idea of a QR code or something similar that carries an image of the board and you could potentially use image recognition software or AR to overlay the board and validate the traces and components for a % match. It'd have to be relatively low definition to be compatible with most PCB manufacturers silk screening tech.

There's an Aussie startup called Laava that create unique, serial number like images that allow a user to validate that a product is real and not counterfit. Perhaps something like that would make sense? https://www.laava.id

Answer 6

It is possible to generate a unique identifier using a device's electrical characteristics?

Physical Unclonable Function (PUF) has attract some attention recently, specifically in Hardware Security field. A PUF can generate digital output (IDs or keys) by leveraging inherent physical variations from the manufacturing process. The are several types of PUF suggested on several research papers, such as Arbiter PUF, SRAM PUF and others.