We plan to build a GPS device for our local community which will act like an electronic guide. The chip inside will contain GPS coordinates of important sites in our region as well audio guides.

Now, copyright is not respected or punished in our country. We are scared that someone may take our product, disassemble it and copy our device. Is this possible? Can someone steal data we flash into the chip?

I saw that some people scratch chip type and ID from its surface. Is this to prevent stealing or something?

  • 5
    \$\begingroup\$ If someone has the knowledge to reverse-engineer a device they usually also have the knowledge to build that device from scratch. \$\endgroup\$
    – m.Alin
    Mar 24 '13 at 20:27
  • \$\begingroup\$ Can this be done easily? Or someone needs to make a special tool just for this purpose? \$\endgroup\$
    – sandalone
    Mar 24 '13 at 20:41
  • 2
    \$\begingroup\$ What are you trying to protect exactly? The logical design (schematic), the physical design (pcb/enclosure/look-and-feel), or the intellectual design (contents of the flash chip/programming)? \$\endgroup\$ Mar 24 '13 at 20:56
  • 1
    \$\begingroup\$ @sandalone This question might work better on the specialized reverse engineering board within SE. It should go into public beta soon. Keep an eye on it. \$\endgroup\$ Mar 24 '13 at 21:51

If you're trying to protect the circuit itself, you might as well give up. It is possible to copy, but as m.Alin said, it's usually not worth the effort. It's much easier to design a similar device from scratch.

If you're trying to protect the data in a flash chip, your best bet is to encrypt the on-chip data, then decrypt it inside a programmable device — I'm assuming your design uses a microcontroller, CPLD, or FPGA. What decryption options you have (and whether or not the decryption mechanism itself can be protected) depends on the type of device you're using.

There are reasonable protection mechanisms inside most microcontrollers, but they'll also limit your options for decryption mechanisms to fast, software-implemented methods. CPLDs with built-in configuration memory are good for this, and many have code ‘protection’ fuses. FPGAs would be even better, but most FPGAs have external configuration memory and that could get copied too.

That having been said, if someone is hell-bent on copying your device configuration and data, even really good encryption techniques can often be attacked. There are lots of cases of this happening in recent years. What you're trying to do is make duplicating the device more expensive and time consuming than building a similar device from scratch.


First step you need to make is to decide against who are you going to try to protect the device and to try to estimate potential impact on your business plan if protection is broken. Next you should determine how big impact various protection schemes will make on the normal use of the device and how much protection are your users willing to take. This will allow you to determine how much energy you need to spend protecting the device.

After that step, you can try to implement the protection itself. For software you have the already mentioned fuse bits which can prevent reading of data from the chip (but there are companies which specialize in recovering fuse protected data from microcontrollers). Another option, should you determine it is needed, is to keep all sensitive data in volatile memory and to destroy it if device is tampered with. For example some sensitive devices will have numerous sensors inside and if they detect that the device has been opened, important data will be destroyed. On the other hand, there's always risk that user may accidentally trigger some of the protection mechanisms and disable the device. Also there's the problem of what are you going to do when the battery powering the volatile memory dies. It could be difficult to replace it, but on the other hand it could good quality batteries could last longer than the device's lifetime.

As for the physical circuit itself, you can try make it more difficult to get exact part numbers by removing component markings. There are numerous ways to do that, from manually sanding off the part numbers to using special laser part number erasers. This however does not protect you from those who are capable of designing very similar device since by component sizes and placement it's possible to make an educated guess of the function of the device and even the manufacturer and family of the device.

Next you can try to use some sort of potting compound to make device harder to access. You could even try to combine potting with sensors. Some devices have a sort of enclosure made from thin conductive wires around the PCB. Device can detect if wire of broken and if that's the case, destroy any sensitive data on the device. After the device is assembled, you can pour potting compound over the wire "enclosure". If anyone tries to remove the compound, there will be a high chance that one of the wires will be broken and the device will detect tampering.

Even in case of potted circuits, it may be possible to use X-ray machines to determine internal construction, so you may need to incorporate some sort of protection against that as well.

Finally there's the look and feel. That part may be the most difficult to protect, since you can't hide it. Best thing you can do here is to make sure that there's some extra value that you yourself bring to the device that your competition won't be able to make. This is especially true in case of your particular device since it's susceptible to low tech attacks. Your users will need to be able to hear the audio guide and if they can hear it, they can record it. Same thing goes for GPS coordinates. So what you must do is make such business model that others won't be able to easily copy. For example you could provide data updates for your devices for some time, have good technical support, listen to feedback of your users and implement good ideas in future revisions and so on.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.