Electronics > Projects, Designs, and Technical Stuff

What potting compound to use to protect from reverse engineering ?

(1/13) > >>

Arte:
Hello !

I'm developing my first commercial electronics product and I have reason to some believe some people will want to steal the contents of RAM (there is a history of IP theft in that domain). On top of that, I use the RP2040, which doesn't have an internal flash (and thus any form of security measure). Finally, patents are way too expensive for one random guy like me.

Given that, I'm still trying to make it very hard to reverse engineer the device. Aside from any software things like encrypting the firmware in place or making it hell to read the ASM, I was planning to use a potting compound to prevent access to the electrical components.

At first I tried some random epoxy off Amazon (meant to make fantasy jewelry & other mold-based things - Dr Crafty). That didn't work very well. I could scrape off the cured epoxy with a knife, and I could cut it too, and once there was enough of a dent, I could remove it by hand and it would separate from the PCB. So clearly, far from enough adherence to the PCB.

Fine then, maybe I should use something meant for potting compounds as my potting compound. So I got some MG Chemicals 8810 Black Rigid Urethane. Unfortunately that's not working out very well for me either.



Two observations here: I put what I would consider a "normal" amount of coating on the right PCB, and it would seem bubbles have formed as in, the volume at least tripled. ... In fact the PCB does not fit in its enclosure anymore.
In my subsequent tries, I put few droplets, and I get something that, while having significantly grown in volume, at least doesn't render the PCB unusable. That's a very annoying behavior I didn't expect, and I'm not sure is expected. Also, I would guess that these bubbles lower the resistance, I mean, I can pierce them with a knife...
Secondly, I find this not that hard to remove. It's not as easy as the epoxy I used previously, but I would expect someone determined to be able to remove enough of it to access the interesting parts without any need of resorting to hazardous chemicals, in other words, it doesn't do the job.

We're very far from what I can read about the efficiency of these compounds in places like https://www.eevblog.com/forum/repair/removing-black-little-rubbery-feel-potting-compound/ where people agree it's very difficult to remove, for instance I read
"To make a long story short: Theres no "chemical" way to remove it without damaging the parts or PCB that i know of.
If it's the soft stuff, you just remove it with a cutter piece by piece, hoping it does not stick to well to the plastic foils around caps etc.
The problem is, once you cleared the PCB, i may be impossible to tear the PCB from the resin underneath without breaking it.

If it's the hard resin: Forget about it. I'm not saying it can't be done, but it's a fools errand. "

So, what am I doing wrong here ? It should be noted that since I was mixing droplets (10 droplets of A, 5 droplets of B...) the 2:1 ratio may not be perfect.. but still. What is this "hard resin" ? Am I using the wrong chemical ? Or just doing things wrong ? On that note, if I could use a chemical that doesn't behave like yeast, that'd really make my life simpler.

Thanks !
Regards, JB

ataradov:
With RP2040, I'd say forget about it. It does not matter how you coat it, it would be always possible to get access to the traces, so extraction of the firmware is next to trivial. You don't need to remove it all, you don't even need to remove the devices, all you need it to get access to the traces. Using very hard epoxy actually plays into attacker's hand - it can just be milled out. Using a slightly gummy product is more annoying.

And especially if the IP theft is common in the area, then this would not be an obstacle to anyone.

Also, as an attacker, what is the problem with  breaking a PCB? The analysis can be destructive. You can buy multiple device for reverse engineering.

And for the traces you also have XRay, for which your epoxy won't do anything.

Here is how such things are removed in practice: https://youtu.be/Qk8Hg8uCRQE?t=123 The video is about removing the IC using a CNC mill for replacement, but the same principle applies for reverse engineering.

oz2cpu:
you can only slow the one person down, who WILL do it, no matter what,
in that work, you end up spending so much extra time and money into each unit you make..
is it really worth it ?

a good advice , call the epoxy coating you add, weather proof, and thermal improve, and vibration improve..
but dont belive it will secure your ip..

by the way :
eposy mixed with sand, is a pain to remove, it also wear hard on tools and patience

coppercone2:
and I don't think all those 'improvements' are true, potting compound can IMO make some stuff less reliable.

you can mail stuff in for circuit RE and depotting, they will have some guy go at it 0.1mm at a time till its nice and clean and then also x-ray it and ID all the chips for you. remember there are 195 countries in the world and most of them are poor and have willing people, you are likely wasting BOM and manufacturing cost. There are probably Chinese X-ray ID databases of IC right now lol

Conrad Hoffman:
IMO, a waste of time. Almost all epoxies will succumb to a bath of hot NMP. Those that won't can be removed in other ways. Even if you had money for patents, they're nearly useless. The best defense is to make your money and be on to something new before the device is copied.

Navigation

[0] Message Index

[#] Next page