On the anti-piracy beat with Cryptography Research

By Angela Gunn | Published January 23, 2009, 5:07 PM

Psst! Hey buddy! Wanna buy a Snoy TV, an Appel Mic, or a bottle of Vaigra? Probably not -- not only are counterfeit products inferior, they can be downright hazardous. Paul Kocher wants to help ensure you never do.

Kocher, known well to security geeks as one of the architects of the SSL 3.0 protocol (and one of the theorists behind differential power analysis as a crypto-cracking strategy), is working these days to quash piracy and counterfeiting. He was at CES with Cryptography Research Inc. earlier this month to talk about tech that integrates anti-counterfeiting technology into systems such as computers, televisions, and set-top boxes.

What gets counterfeited? Kocher says that the most commonly knocked-off items are those that are inexpensive to manufacture and make good money in the marketplace. For instance, DVDs or printer cartridges are counterfeited at far higher rates than airplane components; Kocher estimates that fake printer cartridges make up 20-30% of the market worldwide, while aeronautics gear has maybe a 2% fake rate.

In Kocher's vision, there's no reason a authentic product can't prove its provenance, revealing its point of origin and even its supply chain of custody to other gear or to sensors listening for its particular ping. CryptoFirewall, the custom silicon core that the company's offering, does that (depending on the application) either by adding a chip to the system or as part of a circuit already in the system. The latter approach lessens the potential for tampering and cuts costs; the former approach leads to components capable of authenticating other components.

Spooky stuff, perhaps, if you're wondering about the implications of gear that listens for a ping that never comes. (If I plug a non-Expensiva ink cartridge into my Expensiva printer, will I void the warranty, cause the printer to stop working altogether, or just cause das blinkenlights?) But -- leaving that debate aside for now -- for businesses focusing on fighting back counterfeiters, a system such as CryptoFirewall kneecaps the problem by making the would-be fakes infeasible to convincingly create.

The nitty-gritty details are, of necessity, a secret. As Kocher notes, in his line of work you never know, in any absolute sense, "whether your system is unbreakable or just stronger than that of your competition." After eight hack-free years in a business where "everything we do is in the line of fire," he notes that a lot of the company's business comes from manufacturers who have already experienced a counterfeiting episode.

It's not much fun to have your intellectual property stolen, he says, whether you're selling DVDs, automotive gear or highly specialized equipment. "The first thing that happens [to these companies] when they realize they've got a problem is an irrational feeling -- 'I'm being victimized, this is awful.'" Most firms will attempt to deal with the problem internally and, that failing, turn to professionals. Companies such as Cryptography Research are paid to solve problems; there are performance metrics, and for any given anti-counterfeiting tech, "you don't know if it'll break or not, but if you go five years and there's no counterfeit, you're successful."

Success comes in part from understanding whom you're up against -- something a specialized security firm is likely to do better than a manufacturer who'd really rather just think about how to build a better TV or computer. Kocher points out that counterfeiters have millions of dollars at stake in their "businesses," just as real manufacturers do. Pay-television gear (e.g., set-top boxes) are particularly attractive targets right now, and Kocher jokes that he's "got some beautiful pictures of designs [Cryptography Research has] built, made by people trying to reverse-engineer them." His adversaries "know their stuff and do a good job."

The good news for consumers is that as far as Kocher's concerned, none of this should ever come into their line of sight. "If an end-user ever encountered [anti-counterfeiting tech], somebody did something wrong behind the scenes," he says. That goes for a lot of security solutions, including some of the highest-profile popular-crypto efforts of yore. "You shouldn't have to deal with things like managing a keyring" to authenticate communications, let alone your gear, Kocher says. "A good piece of tech is the one that takes your problem from you and solves it."

Comments

View comments by with a score of at least

Muhahha yeah right! Wont ever happen!! Counterfeiting has been happening since man first took a breath.

Score: 0

|

Yeah, but you know the joke about the two hunters and the bear, right?

Two hunters are tramping around deep in the woods when they're ambushed by a seriously angry bear. First hunter drops everything -- his gun, his pack, all his gear -- and takes off running. Second hunter knows how fast a bear can move and yells to the first: "ARE YOU CRAZY! YOU CAN'T OUTRUN A BEAR!" First hunter yells back: "I DON'T HAVE TO RUN FASTER THAN THE BEAR! I JUST HAVE TO RUN FASTER THAN YOU!!!"

Same deal. Let's say Joe the Counterfeiter wants to specialize in flat-panel TVs and think he could fake-make Brand A, B, and/or C -- three name-brand choices. Let's say Brand A invests in good anti-counterfeiting tech, Brand B cheaps out on the anti-counterfeiting, and Brand C doesn't bother at all. Assuming that all three brands are desirable brands to consumers, Joe's apt to fake Brand C, simply because it's not worth his time to try to get around Brand A's protections. (Brand B might be worth a bit of reverse-engineering effort, depending on the resources at Joe's disposal.)

Brand A probably can't move faster than a Joe with unlimited counterfeiting resources and extreme determination, but Kocher points out that there are very very few targets that would merit that level of pirate attention. (Military targets, maybe. Perhaps the formula for Coke. Almost nothing shipping to consumers.) Good anti-counterfeiting protections, however, make Brand C and even Brand B much more likely targets for Joe the Bear... um, Counterfeiter.

Score: 0

|

Not-so-mobile battery life: Time to force the issue

Carmi Levy | Wide Angle Zoom: If power efficiency is important when you buy a car or even a motorcycle, why shouldn't it matter for a smartphone?

Microsoft 'worked with Apple' for Silverlight on iPhone, says Goldfarb

By not making such a big deal out of trying to stream video to the iPhone, Microsoft got a big deal out of it, revealed the Silverlight product manager.

Microsoft's Ray Ozzie: 'Nobody's going to be 100% open'

The mobile apps ecosystems of the world may converge over time, led by apps being ported over across platforms, according to the Chief Software Architect.

Without its own 'iTablet' yet, is Apple missing the boat?

Steve Jobs is on record as dissing "single-purpose" devices like e-readers. But given their recent popularity, was that a mistake?

Apple invokes DMCA, claims Psystar is 'trafficking in circumvention devices'

In trying to close the book on possibly the last attempt at a Mac clone, Apple cites from its own landmark case...but may actually be misinterpreting it.

The fallacy of Facebook privacy

Carmi Levy | Wide Angle Zoom: If an insurance company learns something interesting about its client through the Internet, is that snooping?

Clicker.com cuts through the Web video chaos

In a world where homemade video and Hollywood movies travel the same pipeline, it's good to have a real search engine to cut through the clutter.

A case study in improving software: What Office 2010 can learn from Notion 3

A music composition product gambles with a complete overhaul, in an effort to make headway against two well-known competitors in a tough market.

Kindle 2 update adds battery life, native PDF reader

Amazon has pushed out an update to the Kindle 2 e-reader that lengthens battery life and adds a native PDF viewer.

Safari on iPhone gets competition from a $1 browser app

Apple likes to say it gives iPhone users a full browsing experience, but a new competitor tries to incorporate more desktop browser features.