Slashdot Mirror
New Lock Aims To End Chip Piracy
Stony Stevenson writes "Pirated microchips based on stolen blueprints could soon be a thing of the past thanks to computer engineers at Rice University and the University of Michigan. The engineers have devised a way to head off this costly infringement by giving each chip its own unique lock and key. The patent holder would hold the keys, and the chip would securely communicate with the patent holder to unlock itself. The chip could operate only after being unlocked. The Ending Piracy of Integrated Circuits (Epic) technique relies on established cryptography methods, and introduces subtle changes into the chip design process without affecting performance or power consumption. With Epic protection enabled, each integrated circuit would be manufactured with a few extra switches that behave like a combination lock."
Great.
Presuming that there's a constant internet connection, that the manufacturer's server is incapable of being cracked and maintains at least 5-9's uptime, and that anyone's stupid enough to buy a crippled chip with this on it.
In Xanadu did Kubla Khan
A stately pleasure dome decree
Hardware that locks up when it can't call the mothership? And I though Microsoft Genuine Advantage was bad!
Support the 30 Hour Work Week!!!
Wow, I havn't heard of chip piracy in a long time. Maybe it is because, like other forms of piracy, it isn't a big problem. I have problems with piracy when it involves safety equipment, and large purchases from reputable dealers ... but most of the time, you get what you pay for, and you're not being deceived, you're willingly purchasing counterfeit 'stuff'.
Isn't it sad when people think of piracy in terms of music, when the REAL piracy problems (counterfeiting) are those which involve fake electrical/safety/baby equipment (or food)?
In a number of countries that this chip is aimed for, what will happen is that some knockoff fab will disassemble the chip, figure out the masks, and just make and sell the same IC minus the locking circuitry.
This type of locking mechanism also brings up other points. Once the IC is "unlocked", is it unlocked for good, or just for a time period? Could some criminal organization figure out the method of re-locking it, then lock the machines who belong to the patent holder's customers? This would result in some decent havoc especially in embedded circuitry (HVAC systems, railroad switches.)
The article seems to be lacking substance as well.
...wouldn't it be pretty straightforward to replace the hardware circuit that does
...?
if(bignastyDRM(uniqueDRMkey)==TRUE){}
with
if(TRUE){}
Yes, I know circuits are usually either designed with a capture program or modeled in VRML/Verilog -- but the logic still holds. Find out what part of the circuit locks the functionality -- and replace it with a wire to Vcc.
(Unless, of course, they will require the chip to communicate with the mothership every time it has to blow its little digital nose etc...)
Paleotechnologist and connoisseur of pretty shiny things.
Giving new meaning to your CPU locking up.
But my pirated copy of Windows only works on my pirated CPU chip!
Okay, show of hands, who has a pirated processor? Anyone? Anyone? Buehler? Is this really a huge problem? Doesn't it cost more to produce a pirate CPU than the potential profits from selling it? Methinks the issue is overstated, either that or the chip industry should contact the RIAA & MPAA's media moguls about an advertising deal (which is the same thing, overstatement but loud).
Laughter is the Spackle of the Soul.
If I read the original article correctly:
If someone gets the chip design and is copying it to be built in another fab, it'd be possible (difficult, but much less difficult than a complete chip redesign or re-engineering) to remove this part of the chip (and increase the profit margin, since A: no investment on research and B: more die per unit silicon.)
What this is going to affect is people who run a fab making legitimate parts, but also run the same parts from the same masks but keep them off the books and sell them independently of the company that owns the design -- OEM ripoffs.
Nostalgia's not what it used to be.
Dark Helmet: "So the combination is one, two, three, four, five? That's the stupidest combination I've ever heard in my life! The kind of thing an idiot would have on his luggage!"
...
President Skroob: "1 2 3 4 5? That's amazing! I've got the same combination on my luggage!"
"They said I probly shouldn't fly with just one eye," "I am Bender. Please insert girder."
While it sounds promising, it still raises the little hairs on the back of my neck. Danger Will Robinson, danger!
Dream as if you'll live forever.
Live as if you'll die tomorrow.
~Anonymous~
Perhaps its unlocked once and good to go. I don't think its the consumer that is guilty of pirated chips, but computer companies that purchase elicit copied chips cheaper than from the OEM. This shouldn't affect us that much, besides a perceived increase in quality.
Nothing to see here, move along.
Hi, I Boris. Hear fix bear, yes?
I guess this means I'll have to buy genuine Ruffles and Doritos from now on!
--
How many mod points will this bad pun cost me?
Patents are rarely detailed enough to fully implement in practice; usually they cover only a subset of the design, and are written broadly enough that several different paths could be taken to implement them. Looking up a patent would show you the concept, but not an exact design such as a blueprint provides.
If fabless companies are so worried about overseas manufacturing, then why not use a fab that is inside the country your company resides in? That way, you can sue the living hell out of them when they do sell / steal your plans.
I would think that building the Chips in the US or Europe where the fabs are more reputable would be a better cost effective solution than sending it to an orient fab and watch it pump out pirate chips left and right, or relying on some sort of activation scheme that these pirate hardware companies would most likely reverse engineer out of them anyway.
In Soviet Russia, Trojan exploits YOU!
If I am copying the chip, I'll just remove those stupid extra "locks" during the manufacturing process. Just remove them from my pirated copy before I make the chip. Seems like a dumb idea.
Mike @ The Geek Pub. Let's Make Stuff!
...will be cost. A 'few extra circuits' may not sound like much, but with chip manufacturers engaged in a protracted price war, every cent counts - especially when multiplied by the chip numbers we are talking here.
The Mothership
EPIC FAIL!
- None can love freedom heartily, but good men; the rest love not freedom, but license. -- John Milton
Wrong crypto key?
EPIC FAIL.
As I see it, this has two major problems with it. The first, of course, is that copy protection in any form is childish, stupid, and ultimately ineffective.
The second is a bit more down to earth -- this will become the bottleneck on the manufacturing line. Chips are manufactured in the millions, with hundreds of thousands falling off the line each day. These nimrods propose to authenticate every last one of them, using computationally non-trivial crypto, uniquely before they roll off the line.
Let's generously assume it takes one second to authenticate and activate a chip (not, that's not a ridiculously long time -- between crypto compute time and network latency to the Pacific Rim, this is entirely realistic). This means you can activate a maximum of 86400 chips per day. Maybe you can parallelize the process, and maybe you can't (depends on whether the people who wrote the authentication server were idiots or not). And if your OC-3 to the Internet gets a backhoe through it, "accidentally" or otherwise, all production in your facility stops dead. Wonderful idea.
This stunning idea also seems to assume only one patent holder will be interested in a given chip. The most cursory inspection of even a "simple" memory chip will reveal several patent holders, all of whom will doubtless insist on "activation" which, again, may or may not be parallelizeable.
Like all copy protection "solutions" presented throughout history, this is a really, really stupid idea. I can't think of any fab that would willingly sign on to this.
Schwab
Editor, A1-AAA AmeriCaptions
There was a time when half the USB flash media readers on the market were based on the same pirated designs -- at least according to hardware folks I used to work with who'd be in a better position to know than I am (or, most likely, you are). I'm fairly sure this is a bigger problem than many people realize.
The research paper describing EPIC http://www.eecs.umich.edu/~imarkov/pubs/conf/date08-epic.pdf will be presented next week in Munich http://date-conference.com/
I know this is /. but I took the time to find the actual paper, they cover the typical attacks on the security mechanism quite thoroughly. Apparently its very difficult to scan a mask, especially at the small scales the industry deals in today - they suggest it would be cheaper to simply design the chip yourself.
(Off-topic: the anti-spam mechanism atm gives an interesting result for my email address..."'poo' in gap" oO)
I think the [MS Word] paperclip is a great idea. - Miguel de Icaza
I mean, these guys are good enough to steal the design and have the knowledge to manufacture the device. What prevents them from modifying the IC to remove the lock? I mean, they are the ones actually making it. I am sure they have someone smart enough to be able to find the "added" authentication portion in the design docs, since the design docs probably have it named exactly what it is (i.e. the Epic lock circuit)....
We were all warned a long time ago that MS products sucked, remember the Magic 8 Ball said, "Outlook not so good"
Hundreds of thousands personal (and not so personal) computers locked themselves today after rogue group of Mongolian hackers stole keychain from, as evidence shows, not so secure vaults at "EPIC Security Ltd.". EPIC security guards went high alert, but they failed to act in time before Mongols (riding bareback and yelling) departed.
EPIC Security Ltd. issued security update and instructions for unlocking targeted computers. Users just have to bring their computers (or if it's easier for them only their CPU's - very small chips with very many pins underside)to EPIC Security Ltd.'s premises or nearest servicing outlet.
List of outlet's is sent directly by email to every user targeted.
http://opencm3.net, http://www.nongnu.org/gm2/
Unless the fab has unused capacity / lines to produce these chips based on other dies/masks separately, they're going to have to swap dies / masks out when they want to produce their 'pirate' copies. This swap-out takes time. Calibration takes time. It also increases the likelihood of errors; not just in the 'pirate' copies but also in the originals when they switch back. A fab is going to explain this odd higher failure rate to their customer, how?
At best somebody within the company could take the design and contract manufacture of it out to a smaller fab or sister fab that isn't booked by the same customer, and have them manufacture it during the same time the originals are produced. That'd be less noticeable, but it would also be more expensive - as the customer isn't footing part of the bill for that shadow fab.
Hurries and puts bleeding child in car. Turns key...
"I'm sorry sir, your patent offenders registry status prevents you from starting this car."
But car, I need to get to the emerg... "I'm sorry sir, your patent offenders registry status prevents you from starting this car."
Oh fuck it!
Dials phone
"I'm sorry sir, your patent offenders registry status prevents you from dialing this phone. Please seek the assistance of a non-offender in...
Look where all this talking got us, baby.
I read the paper (thanks for the link.) I wouldn't say they cover this thoroughly. In fact, I'd argue that they handwaved this, even though it is the most likely and most important attack vector.
They argue that modifying masks is a problem, which may be true. However, there are several stages of design data before the masks, and I would expect that a corporate-level pirate could have access to something early enough in the process that it could be modified by someone skilled in the art. Design data is probably transfered to the FAB as a flattened layout, with no circuit/design hierarchy. However, it should be possible for someone who knows the chip interfaces related to this unlocking mechanism to work backwards from them and find where to tie things off to make the chip work. The labor cost would probably be pretty low compared to the cost of prepping a second mask to manufacture the modified chips.
atleast until the people with the hundred million$ plans, and the billion $ chip plant spend a few hundred thousand on analyzing the plans to find the few transistors that do this and take them out, making pre-unlocked chips. - if a bunch of random hackers can do over current DRM, there's not much chance that this would last.
*Add* something instead. Add in a fusible link that would disable the protection scheme.
It would have to be subtle enough to pass inspection by the original mask creators.
Instead of creating a bogus, complicated and expensive DRM scheme, just introduce a watermark onto the mask. Use the watermark to identify which manufacturer is selling the extra chips.
The counter of course is the good ole compare blueprints trick. However then we're back to what you mentioned before, the calibration expense issue.
They ARE out to get you simply because They are in it for themselves and they don't care about you.
You do it every day. Do you manufacture your own bread? Butter? Do you manufacture your own hardware components? No, because someone else can do it better and cheaper.
Deleted
My company got burned by it a few years ago. We had an 8 channel DAC (the MAX5308) in our design which didn't have a drop in replacement from another vendor. We needed some parts, and the lead times from Maxim were too long, so we contacted some distributors and found someone who had these parts.
We had a bunch of boards built, and we started getting a high failure rate, which we traced back to the DAC. A closer inspection of the part revealed it had a date code that was before the actual release date of the chip! We contacted Maxim and stopped payment on the parts. Maxim took some parts for evidence (and I believe sent us a few samples to tide us over).
We were building $14000 units that were being deployed in military communications systems.
It turns out the counterfeits were coming from Asia. The distributor in question probably knew that the chips were counterfeit and looked the other way.
Semiconductor companies put a lot of effort in making sure there products are reliable. (If a PC board has 100 parts, what failure rate is acceptable in your chips before you start to have very bad yield issues? What if it's 1000 parts?). We, as a society, have come to count on things being reliable, and real danger can result when their not. It's not as bad as counterfeit pharmaceuticals, but it's not so far off either.
I don't know if this scheme will work or not. But it's a real problem, with real consequences.
It's not wasting time, I'm educating myself.