How can I protect my robot code?

Question

I want to build a robot using some mini-computers like Raspberry-Pi, and using Linux OS upon. I think those boards (RPi, NanoPi, etc) have external SD card to boot OS from, and my code will go there (on SD card). So, how can I protect my code from someone who wants to copy it?

From my code, I mean my programs that are written using CMUsphinx, Opencv, etc.

Are there anyways to specify each SD card for one specified board? I mean the SD card nom.1 only runs on board nom.1.

Or maybe put a hidden code on boards and SD cards that use one algorithm and should be match to run?

Answer 1

You can't protect someone who has physical access to the device from copying your code. If the board can read your code then so can anyone else.

To protect the code from copying, you would need to use a device which has some tamper-resistant storage. Such hardware exists, but it's in a higher price range.

You can put a test in your code to verify some hardware identifier and refuse to start if running on a different hardware device. This makes it impossible to run an exact copy directly, but it's still easy to either change the code to bypass the check or run it in a virtualized environment which feeds your code the hardware identification that it expects. Basically, it's a way to keep honest people honest but it won't deter anyone who wants to copy the code.

Answer 2

To protect your data you have to have key, of any sort, which you can guard and control physically and be separately from your secret data. Password in your brains is example of such solution - it is physically guarded by owner, by memorizing it.

As password there might be some visual token for your super robot, like piece of paper with barcode which decrypts your software and allows it to run that way. It may worth to consider, as same piece of paper might be used to shutdown your creation, with help of openvc and scripts of course.

Less practical but easier way to implement, is to have 2 sd cards, one contains key and is used to boot the system and waits until you change sdcard and will continue to boot after that.

you should look in to how initramfs is used to boot whole system. You should look how to create custom initramfs, and be able to modify init script for waiting and decrypting mounting your second card with main system.

System is not perfect, but dirty and cheap.

It also do not have to be initramfs solution, you might use solutions like copying your executable codes to ramdisk from some usbdrive, which you insert just for purposes to launch your creation, and remove it when it begins to be alive.

When you have secret and key on one media(is that smart trick, hidden something etc) it can be reversengineered.

As for me initramfs solution needs less effort to make, plenty of information how to make custom initramfs's.