0

I'm trying to "hardware-lock" some software written for the Pi and ensure that even if someone clones the SD card, they're unable to run a particular piece of code if it's not on an "acceptable" Pi. To make a Pi acceptable, I'm thinking of writing a value to a register somewhere on the Pi, and have the software read that value before it starts. If the particular register reads what it should, then the software will run. It doesn't matter which register, nor what the value is - could even be as simple as whether a bit is HIGH or LOW.

Is there a register I can write to that will maintain that state even through power cycling? (Or is there another, better way to do this that I'm completely overlooking?)

2

Using openssl and public private keys,

You could get the pi serial number and encrypt it with a private key, place it on the sd card along with the public key.

If you decrypt the file with the public key and the serial numbers don't match then you stop it running.

The serial numbers may not be unique but it's a good place to start.

5
  • I like this answer - I'm keeping this in my back pocket as an option if the register-writing doesn't work out.
    – crypto
    Aug 4 '21 at 17:22
  • 1
    This is a much, much more secure option than the "hidden register" concept, which is just pure security through obscurity. While keeping it a secret where you keep your secrets is not a bad thing, relying on it exclusively is, equivalent to putting your money under your mattress -- once someone knows where it is, that's it.
    – goldilocks
    Aug 4 '21 at 18:44
  • WRT "openssl and public private keys", public/private key asymmetrical encryption is not unique to openssl, you will find libraries to do this in whatever language you want (again, look for "asymmetrical encryption"). The weakness of this is that you now must hide whatever you use to verify the public key, ie., unless this is a mechanism that can work over a network (eg. to verify the key), it is vulnerable to straight forward hacks (by substituting a different public key).
    – goldilocks
    Aug 4 '21 at 18:53
  • 1
    @golidilocks Good point about the replacement of the key :) It really depends on why it needs to be an "acceptable pi'. if this is an attempt at software licensing then I think we agree that it is going to fail. If it is to ensure that the pi is suitable, then it is probably ok; if the user changes the keys, any problems are down to them. You already pointed out that the software should perform the decryption using a library, if the public key is embedded in the application then the user would also need to change the application and take responsibility for the consequences. Aug 5 '21 at 10:36
  • So the reason for the question is to prevent an outside organization from pirating a piece of equipment (that includes a Pi). I wanted to "mark" the Pis that come from our organization as acceptable (as discerned from another piece of equipment) without using software, since they can clone the SD card. Based on my particular system architecture, I can use the solution suggested by @SEWTGIYWTKHNTDS while keeping the private key inside our organization. Thank you all for your comments and suggestions.
    – crypto
    Aug 6 '21 at 2:23
1

All Pi SOC have a One-Time Programmable (OTP) memory block, indeed this is where the Serial Number resides.

See OTP register and bit definitions although as goldilocks pointed out security through obscurity has its limits.

0

You could add some EEPROM or flash, it can be found in many formats such as a temperature probe, clock chip, etc. Then the code you do not want somebody to run should check that memory to be sure it is the proper code, if not do whatever else you want it to do.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.