8

I created a somewhat unique IIR filter and I want to protect the filter from being reverse-engineered

I think you all know it is quite easy to get all the different weights of an IIR by using impulse signals.

The filter is programatically encapsulated in a bigger program, so I can add some tricks to protect the filter coefficients.

But what would be the best method to protect my IIR filter ?

Rodrigo de Azevedo
  • 1
  • 6
  • 16
Jeff
  • 89
  • 5

3 Answers3

7

Short answer:

You can't. If an attacker can insert a signal that covers the whole bandwidth (e.g. a white signal, or at least one that has no spectral zeros) into the system (and he can do that over an arbitrarily long time, or add up observations), they will get an output, and can through the magic of correlation get the impulse response.

Marcus Müller
  • 30,525
  • 4
  • 34
  • 58
3

Long answer:

Let's model the information flow from your "hidden" IIR $X$ to your observable output $Y$ as

$$ X \longrightarrow Y$$

Then, we call the amount of information you get per observation the *mutual information $I(X;Y)$; that information is the reduction of uncertainty about $X$ to be achieved by observing $Y$.

We call the expected uncertainty of something the entropy, in your case, the uncertainty about $X$ is its entropy and typically denoted as $H(X)$.

Now, the nice and thing about all this is that $H(X|Y)$, i.e. the "uncertainty about $X$ that remains when you know $Y$", is actually just the entropy of $X$ minus the information you get, so:

$$H(X|Y) = H(X) - I(X;Y)\text.\label{equiv}\tag1$$

The attacker's goal is to reduce the uncertainty he still has about $X$ to $0$.

Now, since any signal that "excites" all the eigenfunctions of a system can fully characterize the system, that means we only need to send the full set of eigenfunctions through your IIR. And since your IIR is an LTI system, that just happens to be the vector containing all oscillations of any representable frequency.

You can reduce the amount of information an attacker can get about your system by artificially inserting noise. Information theoretical, this increases your irrelevance $H(Y|X)$ (even if you knew $X$, you wouldn't 100% know $Y$, because noise is added).

The mutual information $I(X;Y)$ as used in $\eqref{equiv}$ is symmetric, i.e. $I(X;Y)=I(Y;X)$; hence follows

\begin{align} H(Y|X) &= H(Y) - I(X;Y)\label{irr}\tag2\\ &\overset{\eqref{equiv}}= H(Y) - (H(X)-H(X|Y))\\ &= H(Y) - H(X) + H(X|Y)\\ H(X|Y) &= H(Y|X) + H(X)- H(Y) \end{align}

Your objective was to stop a reverse engineer, i.e. to maximize $H(X|Y)$.

Since $H(X)$ is fixed (you've got some coefficients that might take some values, so it's some amount of bits), your only way of tuning this objective function is to increase $H(Y|X)$. And the only way to do so is by inserting truly random variations in your output.

Marcus Müller
  • 30,525
  • 4
  • 34
  • 58
  • thanks, any hint on the randomize algoithm to use? or any will do ? – Jeff Mar 02 '19 at 12:32
  • anything that is as uncorrelated as possible (white) will do – so pretty much anything but a short LFSR implementation of a noise generator. The more uniform the sample distribution, the better. In a DSP system, you don't want to be limited by the speed of your random generator, so don't go for something like Mersenne Twister RNGs – these are high quality, but slow. Personally, I'm pretty happy with XOROSHIRO128+, which I use as a RNG in DSP applications. – Marcus Müller Mar 02 '19 at 12:50
  • 1
    By the way, don't expect wonders – through arbitrarily long observation, an arbitrary high degree of $H(X|Y)$ can be eliminated; so, noise really just increases the "IIR reverse engineering estimator"'s variance, it doesn't make reconstruction impossible. – Marcus Müller Mar 02 '19 at 12:55
1

Convolution is a linear operator. As such, it can be, at least theoretically, inverted. But it is infinite in length, and in coefficient amplitude precision. Which, in real world practice, cannot be reached.

So the balance resides in what you call "protecting", and there might be some "privacy by design" possibilities:

  • if the algorithm is a mere convolution, you cannot avoid adversarial attempts at getting "as close as possible" approximations of your filter.

  • you can limit this possibility, for instance, by adding non-linearities to your output, like quantization or truncation (or just displaying the result, not the values), to constrain inverse attempts, or by adding fingerprints to your coefficients, so that you can "claim" somebody else used it.

  • under some legislation, you can (try to) protect algorithms or methods (patents, etc.), with some cost.

In the past, I did some reverse-engineering of a noise-measuring system. It was a shoe-size box, with documentation, and a high price. It was supposed to filter pressure sensor data (linear), integrate its absolute value (non-linearity) and output a dB value (dimension reduction). With a wave generator, we could redraw the absolute spectrum, invert it, and get the output with $\pm$ 0.8 dB precision, enough for the purpose. And we checked that the documentation diagrams were inaccurate (I suspect "privacy by design" here), and there was huge variability between two "copies" of the noise-measuring systems.

Laurent Duval
  • 31,850
  • 3
  • 33
  • 101