STM32 - can cloning be prevented?

[ali_asadzadeh]

Everything can be cloned! so add it to your business model   When they can hack every software out there, like windows,altium,keil,solidworks,ISE,matlab, Vivado , quartus,3d max,visual studio etc... and some hardware like J-link have clones too! So you can make your product more complicated to replicate, by adding more complex mechanical case, more layers to PCB, use finer pitch parts, add encryption to your software, add battery backed up encryption keys, add tamper protection, you can make it harder, but if it's worth cloning they would clone it!

Also I have found making a product opensource, prevents many from cloning it! take linux as an example

The best hardware way is to use ASiCs, you can rollout your own M0 for 40K USD ARM license and prevent anybody to copy it easily!

[SiliconWizard]

Actually, having one's product cloned is a very good sign of success.

Now if you keep giving your customers relevant updates and add value by other means (tech support, good after-sales service, ...), your clone competition won't be able to put up. So it will only reach a market share you wouldn't have gotten anyway, and it helps making your product popular. Think of the J-link for instance. Most people buying the clones wouldn't have bought the real deal. (And I can tell you from testing one that they're not nearly as robust either!)

Of course if you don't do any of those things and just never give anything to your customers once the sale is done, the clones will kill you. But you would die sooner or later anyway (unless maybe your product is SO good that it's self-sufficient forever, but that rarely happens).

[ataradov]

The best hardware way is to use ASiCs, you can rollout your own M0 for 40K USD ARM license and prevent anybody to copy it easily!

This is absolutely the worst way to go. First of all, you need to add at least $5-10 million until you get first working parts. And then, what stops clonners from decapping your parts, jut like any other MCU out there? Are you sure you can get the security right on your first try?

[Peabody]

Actually, having one's product cloned is a very good sign of success.

Now if you keep giving your customers relevant updates and add value by other means (tech support, good after-sales service, ...), your clone competition won't be able to put up. So it will only reach a market share you wouldn't have gotten anyway, and it helps making your product popular. Think of the J-link for instance. Most people buying the clones wouldn't have bought the real deal. (And I can tell you from testing one that they're not nearly as robust either!)

Of course if you don't do any of those things and just never give anything to your customers once the sale is done, the clones will kill you. But you would die sooner or later anyway (unless maybe your product is SO good that it's self-sufficient forever, but that rarely happens).

In this case the company provides significant ongoing customer support, including firmware updates.  But it doesn't want to expend resources providing support to clone owners.  The problem is that the clones look identical to the original, and claim to be the original, so the customer has no idea he is buying a clone.  Firmware updates don't work on clones, and may leave the clone bricked, although that's not the intention.  So they are trying to figure all this out with respect to new products.  The irony is that this is a Chinese company.  I guess the counterfeiters don't discriminate based on nationality.

[SiliconWizard]

The problem is that the clones look identical to the original, and claim to be the original, so the customer has no idea he is buying a clone.  Firmware updates don't work on clones, and may leave the clone bricked, although that's not the intention.  So they are trying to figure all this out with respect to new products.  The irony is that this is a Chinese company.  I guess the counterfeiters don't discriminate based on nationality.

I understand your point, and I guess it would all depend on a few factors.

Unless we are talking about a very low-cost product (even the genuine one), the customer usually knows, or at least should reasonably know, that  they are buying a clone. Clones are usually much cheaper - that's the whole point. Now if some clones are sold at prices in the same ballpark as the genuine product, this is another problem: this is just plain rip-off, and the customer would be entitled to get back at the reseller. But it's pretty rare, unless you like buying from very suspect sources. Usually the clones are way cheaper, and a moderately-educated customer should figure out this can't be a genuine product, and if in doubt, testimonies are usually not hard to find before you decide to buy.

If a customer is silly enough to believe they can actually buy a genuine product for 10 times less than the market price, they are living in a fairy world. And if on the other hand, they understand they are buying a clone and still think they will get full support and equivalent quality - again they are fooling themselves. So I personally think this is the customer's responsibility, and in some cases, the reseller's (if they really advertise some product as a genuine one and sells it at equivalent prices). One of the two is not being honest IMO.

Now for very low-cost products, you may not notice the difference, and you can get fooled easily - but it won't matter much, it's cheap.

This is a consideration for end-products. For semi-finished products or components, this is a slightly different story. The responsibility shifts from the customer (or reseller) to the manufacturer using said components. Let's take the FTDI case. A few manufacturers may have bought what they thought were genuine parts, and they weren't. But that's their responsibility. If you care for your business, selecting reputable suppliers is a big part of the story. If you don't, well, you know what to expect. And for the huge majority of manufacturers that were fully aware they were using cloned FTDI chips in their products to lower costs, this is all the more their responsibility: if anything goes wrong, they should fully refund their customers. Plain and simple. In this FTDI case, you may or may not agree with FTDI's move (bricking fake chips) which admittedly was pretty inept, but that doesn't change the fact that the full responsibility lies on the manufacturers' heads.

Anyway, just my opinion.

But just to get back to this "not-aware customers" thing: again apart from plain and obvious rip-off, customers should really get educated regarding their consuming habits in general, especially in this now completely world-wide market. Some people are gullible enough to think that they can get products that are overpriced in the western world, at barely manufacturing costs just because the reseller is from China. This is very rarely the case. Most of those products are either clones, or in some cases, indeed genuine products coming from the plants that manufacture them, but just the ones that got rejected at QC control, so they may present various issues, including being DOA.

[Kjelt]

I have seen cloned products going through proper retail channels because they had no idea they were fakes. That is how good the copycats are these days. The only way the engineers could tell they were fakes was because they used chinese inductors instead of the german branded ones but the rest was identical.
So the customers are not always to blame or should be aware of this.

[C]

The whole PC industry is based on legal cloning.

Start with the legal clone of the IBM PC bios program.
Then you have clones of video CGA, EGA & VGA.

Now from this list is it proper to call these clones or functional work-a-likes.
Does not take much searching that each of these were most likely far better them the original.

So is it proper to call the FTDI a clone or a functional work-a-like?
From what I have seen they are work-a-like. 
So the only problem here is the use of the FTDI software driver unless you can legally protect how a chip works and it's pin-out.
If FTDI did not want their software driver working with NON-FTDI functional chips, Fine make it not work.
They did not have right to harm what they did not create.

That last sentence if important, No one has a right to harm what is not theirs or that they did not create!!

If FTDI could not prevent their driver functioning with a work-alike with out harming work-alike then they had a choice.continue shipping the software & chip or stop shipping these.
A simple live with it or move on to newer software & chip.

Now a simple look at history and you find that IBM tried to take back control of PC with it's PS2 line of computers. A fail for many reasons.

Now I have problems with sellers not stating it is a FTDI Clone or FTDI work-a-like. Would be even better if the chip was better then original like has happened with PC's.

Your customer wants the best hardware & software for a cheap as passable price.

The higher the price for what is received, the more likely a clone or work-a-like will happen.

You should build what you can easily, quick and cheap and start designing/making a better model.

Some micro-controllers come with a built-in serial number. Most have some ways to protect firmware.
Do the best you can with out high expense and call it good.
The higher the cost the more likely someone will start looking for a security hole in what is created.
A tiny hole can bring down the mighty.

The result could be legal or not legal.

C

[ataradov]

They did not have right to harm what they did not create.

They had the right to write their drivers however they feel like. If "work-alikes"  reused USB VID/PID numbers, but are not fully compatible, then it is work-alikes problem, not FTDI's.

[C]

They did not have right to harm what they did not create.

They had the right to write their drivers however they feel like. If "work-alikes"  reused USB VID/PID numbers, but are not fully compatible, then it is work-alikes problem, not FTDI's.

Simple then show where FTDI can buy simple numbers as that is what they are. No body can buy numbers, someone can grant their use but they are not owned.

C

[ataradov]

Simple then show where FTDI can buy simple numbers as that is what they are. No body can buy numbers, someone can grant their use but they are not owned.

Technically yes, but the potential problems of releasing USB devices with colliding IDs are known, so it is on the clonners. And it is pretty clear what they were trying to do here (save money on engineering and supporting driver and marketing), so that position is really indefensible.

[Kjelt]

You can not compare ftdi with the cga/ega/vga clones simply because the latter supported their hardware by writing and releasing software drivers for their products.
In fact hardware is half the job, supporting software, getting the software MS approved and regular updates esp. when new OS's are released is the second part where many modern cloners fail to deliver.

[ataradov]

I was mostly factoring in having to hire people to do the work, and likely having to scrap first set of masks. There is absolutely no way that rolling your own chip is the best way to go, unless you are Google or Apple.

[matseng]

...With MPW, you don't have your own mask. The $5k service fee includes all shared cost and fab's and broker's profit. You pay $5k, you send the GDSII, you get a few tens of sample chips.

How much will the required design/verify software set me back?  It is *almost* tempting to spend 5K and a lot of time for my own chip just for the sake of self-accomplishment.

[C]

Kjelt

Again a look through history will show that hardware using someone else's ID numbers has been very common.
This was common a long time before the first PC.

Just a simple look back and you would find many clones of DEC's VT terminals, these were not true clones but "work-a-likes"
You would find all kinds of hardware that ID's as something else.

Clones or more properly work-a-likes have existed for a very long time.

Until USB most or all keyboards IDed as a IBM XT or IBM PS2 keyboards.
IBM did not have the right to harm a clone PS2 keyboard when plugged into a IBM PS2 computer.
Just like FTDI had no rights doing what they did.
In fact it could be shown that FTDI acted with a criminal intent to harm with their drivers.

As for the cga/ega/vga all start using default drivers. The special drivers were to enable more feathers then original IBM versions.

And not everything is Windows.
And Microsoft does not OWN your or my computer. Microsoft also not allowed to harm hardware or software.
And when Microsoft learned something they supplied was harming hardware they had some responsibility to remove the code causing the harm.

Clone work-a-likes cam be better or worse then original.
Some work-a-likes clones as the PC industry shows can win over the original and be legal.

C

[Kjelt]

Again a look through history will show that hardware using someone else's ID numbers has been very common.
This was common a long time before the first PC.

What happened in the past does not make it right today. In the not so far past countries invaded other countries and took ownership, does that make it right to do this today?
In the beginning of the PC where you are talking about software was illegally copied more often than bought originally, there were no laws against that either back then, does that make it right today?
And so on.

What the real problem in this situation is: there are customers that bought ic's that they thought were original ones but they were not.
This even happened to major companies that put a fake chip in their products.
If it was clear that the chips were fake no-one would have given a damn about a driver not working anymore (they did not kill the chip they just did not work with their drivers anymore), that is the risk you take buying fakes.

[Kjelt]

With MPW, you don't have your own mask. The $5k service fee includes all shared cost and fab's and broker's profit. You pay $5k, you send the GDSII, you get a few tens of sample chips. Period.

So how does this work exactly. I heard pricing of a set of reticles going up to several hundreds of thousands of $. That's right multiple 100k$ for a reticle set (20+ layers or so on 16nm) How can they get their money back with a $5k service like that? There must be a big catch somewhere.

[ataradov]

Again a look through history will show that hardware using someone else's ID numbers has been very common.

That's fine, but it comes with a foot note that whoever wrote the software controls you. That's all. Clonning is fine as long as you accept responsibility.

That's FTDI drivers, they can do whatever they want with them. There is nothing criminal about it.

[ataradov]

How can they get their money back with a $5k service like that? There must be a big catch somewhere.

It is a shuttle service. You get 10 pieces of silicon, hundreds of others on the same wafer also get 10.  If you want real quantities, you will have to pay for the real masks.

The primary cost driver is still engineering. You need to either know what you are doing, or hire people who know. Neither option is cheap.

[Kjelt]

Now I have problems with sellers not stating it is a FTDI Clone or FTDI work-a-like. Would be even better if the chip was better then original like has happened with PC's.

Well it would have also helped tremendously if they had not marked the chips with the FTDI logo 

Hey but you are right, they should not have rendered the ic inoperational.
What they should have done is
- on driver init test the ic with their "illegal check" for authenticity, so check if it is genuine FTDI, and roll it back so also clones remain in the same state as before.
- If it is an authentic chip continue as usual.
- if it is not an authentic chip then display an annoying message onscreen that you have the wrong driver for this unknown IC and you should contact your seller or company for the correct driver, and abort.

That is how it should have been done.

[ataradov]

- on driver init test the ic with their "illegal check" for authenticity, so check if it is genuine FTDI, and roll it back so also clones remain in the same state as before.

The check procedure itself was destructive. I'm sure their new designs will have a better one, but for now we have what we have.

- if it is not an authentic chip then display an annoying message onscreen that you have the wrong driver for this unknown IC and you should contact your seller or company for the correct driver, and abort.

Drivers can't display messages, they don't have access to the GUI. FTDI tried the best they could - inject a message into the COM port.

[ataradov]

The undocumented ExRaiseHardError function from ntddk can trigger a CPU hard error, which then gets processed by csrss and csrss will pop up a message box. Text and icon can be customized.

Yes, using undocumented functions is what you want to do in a driver installed on millions of machines. That does however sound like something drivers for clonned devices would do.

[C]

ataradov

You are missing a major point.

FTDI did not even have the right to harm the chip they created.

They do not own the chip any longer as it has been SOLD.

That test that harms others property is a showing of Malice.

That a driver is limited in what it can do is not a right to do more then the chip was intended to do.
That chip was intended to be a USB connected UART.
A device that exchanges any type of data. Could be Ascii or Binary. They did not have the right to send any data but what was sent to the driver.
Work or not work with the chip is the two options here.
Other ways that a normal driver could commutate would be fine.
A log entry or a driver error message for example.
It's not that hard for a driver to create a Baud rate error or other error for a non FTDI Chip.

I do not see a Work-A-Like clone as having a legal problem, Unless there is legal way that FTDI has legal protection on how the chip communicates, I see none. Here some might show that how the USB side works is a industry default standard.

If chip had a FTDI logo then that is not legal unless fair use in the USA can be shown.

But this tread is supposed to be preventing a STM32 clone.
From software/firmware side a small security hole allows this to happen. It is a little hard to have encrypted firmware when the CPU runs UN-encrypted software/firmware.
If you can get access to UN-encrypted startup then this is a security hole.
The more cost spent adding security, the higher the price and this increases chance of a clone or work-a-like.

You might be able to create something not hackable, but if the resulting cost is high then expect the work-a-likes.

The best idea I can think of is protected code that runs an interrupter that understands the encrypted source. Even here all UN-encripted code must stay protected at all times and not have any security holes.

C

[ataradov]

FTDI did not even have the right to harm the chip they created.

But they did not harm their chip, not at all. Furthermore, the software is supplied as is with no warranties. It is obviously not in FTDI's interest to kill their own chips, but they could legally do so, if they wanted to.

If chip had a FTDI logo then that is not legal unless fair use in the USA can be shown.

But they did, and that's why it was so hard to tell them apart.

[ali_asadzadeh]

This is absolutely the worst way to go. First of all, you need to add at least $5-10 million until you get first working parts. And then, what stops clonners from decapping your parts, jut like any other MCU out there? Are you sure you can get the security right on your first try?

These prices are for owning the machines to etching lower tech IC's for you! the point is to prevent others to copy your product, if you have a custom MCU in your heart and nobody have the blueprint to produce it, they can not clone it directly, because they do not have the chip mask! Also there are lot's of freelances willing to do the job for you if you do not have the required skills to design the chip. I have talked to cadance before about designing a M0 for us, they charged around 100K for the whole part,and it would run for the first run, also they would teach us the process of designing the chip in this price, if you go with freelancer approach you can get it done way bellow that.

[Kjelt]

if you have a custom MCU in your heart and nobody have the blueprint to produce it, they can not clone it directly, because they do not have the chip mask! 

designing a M0 for us,

A custom MCU with a standard processorcore ? So only the peripherals are custom? And you are going to create peripherals that the big uCs producers did not think of ?
You still have the code that is easily reverse engineered or are you going to obfuscate that as well?
If you have a processor where all (internal or external) instructions are de-encrypted in hardware and on chip just before execution you might have an interesting product.