Tamper Detect Circuit (2020) | Hacker News Reader

Tamper Detect Circuit (2020)

ibex.tech

15 pointswalterbell8 comments

I was involved in making a server that bricked itself if you opened the cover, for added FIPS security. So let me tell you all of the things that can go wrong:

Is the switch mounted on sheet-metal? Well you will discover that sheet metal bending is an imprecise process. You need to generate a mechanical tolerance stack-up that accounts for the worst-case opening. What happens if the server flexes a little?

How precise is the open point of the switch?

The sense side of the circuit is high impedance. The wire will act as an antenna and detect any noise in your device.

How can a user replace the battery without triggering the tamper detect?

How sensitive is your switch to shipping vibrations?

Anyway, the experience gave me a good appreciation for those who make landmine triggers :-)

There are also RTC chips out there that will monitor a tamper-detection switch [1] and keep a timestamped record of the switch changing.

Which is nice because the manufacturers have made sure it'll run for years on end from a coin cell battery.

[1] https://www5.epsondevice.com/en/products/rtc/rx8901ce.html

That circuit uses CMOS gates, which is good to keep current draw minimal since it's battery powered, but their high input impedance make them sensitive to static discharges and other electrical noises that in digital appliances are everywhere. There would be some risk of of false positives.

If I had to implement such a protection, I would use a switch in series with a micro step relay that uses a couple of NC contacts in series with its coil so it disconnects itself as soon as it's activated, preventing further activations. This way the power requirement to keep its state is zero. Step relays can be really compact; I've used in the past one whose coil was rated only 2V and it was as large and just a bit taller than a 8 pin DIL integrated circuit. There are also step relays containing two different coils, one for activation and one for deactivation, so a single momentary switch in series with the coil can effectively work as non resettable indicator.

I had thought from a cursory glance that this managed to detect tamper with power removed. It does not, it just uses a different power domain. If you remove and replace the battery then the tamper detection is reset. Since the output is in the 3V domain presumably you can do this without triggering a detection in whatever processor/smarts are off-page.

There are situations where this functionality is useful but unless I’ve missed something significant they are more in the realm of extending battery life than increasing security.

This function could probably generally be better (and more cost-effectively) performed by properly using the features of whatever microcontroller you have in the device.

Removing the battery is the same as opening the switch in this circuit: they both will indicate that the device has been tampered with (output will be low).

I had presumed that there was only one battery for the whole system though, in which case there is nothing awake to detect its removal and the tamper circuit will reset once the battery is reconnected.

I guess there is not enough context but it doesn’t seem particularly novel to me.

Would you recommend a better circuit or specific microcontroller?

Integrating with the microcontroller in low-cost settings is usually pretty specific to a given implementation.

If cost isn’t a big factor and you wanted to go big on security then something like this Maxim part would do it. https://datasheets.maximintegrated.com/en/ds/MAX32558.pdf

However if that’s overkill or you’re allergic to Maxim then searching on AVR, PIC, MSP430, Cortex M0 + tamper detect application note should get you a lot of examples.

Depending on the product, microcontroller and mode of operation you might come in on a battery monitor input, a more robust but “digital” external interrupt, a comparator, just an ADC, or something else. Even creative use of built-in voltage regulation can sometimes work.

If you wanted to know if the battery was removed you have simple options like cap up your supply, rapidly switch power modes, save off a bit somewhere before BOD kicks in. Alternatively in some cases you could just use the BOD if your hardware is set up correct.

The linked circuit is fine as a jelly-bean circuit in low volume/low security products and allows you to tick the “tamper detection” box on the cut sheet.

Reply on news.ycombinator.com