I'm working on a bike with Shimano Di2 (electronic shifting with servo motors in the derailleurs), and I use the e-tube software on a laptop to configure it. What I would like to do is be able to password protect the derailleurs setup so it is not able to be changed unless the owner wants it changed. So it's not able to be changed by someone else without the owners permission.
The edit from freiheit did change the question. He removed the word firmware.
I am a software developer and did system support for many years.
Including highly secure systems.
In my world firmware and software are not the same.
Software is compiled - firmware is a raw set of instructions to specific hardware.
Yes it is possible to password protect firmware but it is not a common practice.
Not something you would simply add with a firmware update - there is typically hardware involved.
Firmware rarely has a password.
Even if firmware does have a password you can typically defeat it by just removing the battery.
Putting a password on a firmware is problematic at best.
Password is a point of failure.
This is device that is designed for reliability and weight.
I seriously doubt they have security / authority on the firmware.
Unless the product came with a default password that you had the option to reset the firmware does not have a password.
You must have physically access to attach the device.
Physical security does protect the firmware.
It is not something that can be changed without physical access.
If gold medals are at stake then I suggest physical security.
Really there are so many things on a bike you could sabotage.
If they got to the bike and you had a password on the firmware they would find something else to sabotage.
If someone wanted to sabotage the device the easiest hack would be to scramble the password.
If you are worried about tampering while the bike was out of your control then you should inspect all component including the e-tube.
A router is a great example of firmware and physical security.
(the answer from ewwite that firmware devices are relatively dumb is naive at best)
If you connect directly to the router you can set anything.
The assumption is that if you can touch the box you are trusted.
Gamers is the closest example to your use case.
You can password protect the BIOS (firmware) with a password.
In a money tournament the PCs will typically have BIOS passwords.
While you are on break you don't want someone to boot to a floppy and trash your system.
This is an odd question. The sentiment that the only security here is physical security is correct. Think about the following:
- The Shimano Di2 components are not mated/matched to a specific computer or instance of E-Tube software. So there's no 1:1 relationship.
- Therefore, any computer equipped with the SM-PCE1 or SM-BCR2 programming cables can be used to modify the configuration and firmware of the Di2 componentry.
- This has to be done via the junction box/charging port.
- Firmware can only be downloaded from Shimano and applied through this interface. And while the application has comprehensive logging, it's unique to the computer. There's no audit trail on the devices themselves.
- Since this is the case, where or when would there be an opportunity to password-protect anything? You could protect your computer, but any computer can be used. The devices are relatively dumb, and the firmware is likely overwritten during updates.
- E-tube is basically used to apply firmware and manage custom settings. You can save presets and load from a configuration file, but firmware is not revved very often.
Given all of this, use common sense. You can just keep the bike secured or limit access to the bike's junction box (think low-tech, like duct-tape or hot-glue). Or you can inspect settings and check firmware revisions.
In the end, the Di2 junction box is the brain of the system. Someone with ill-intent (and physical access) could just replace the entire module in 30 seconds or so. You're seeking a technological solution to a people problem.
Perhaps instead of password protecting it, you might want to think of ways you could detect that the device was tampered with. I'm not certain how often you would change settings or plug into it, but you may want to cover the port with security tape or something similar so that you are aware when somebody has been messing with the equipment. This may not be the best solution, but perhaps someone more familiar with the hardware could offer a solution to detect tampering with the hardware that would work better. Or perhaps you should just have your desired settings and firmware backed up and reload them before each ride or race.
If you have a bike with Shimano Di2, physical security should be paramount - I'm not sure why an unsavory person should even be physically near enough to the bike to be able to make those changes. And they'd have to be carrying the right cable and everything.
It seems like a highly implausible situation to occur, and certainly which should not occur provided the bike is physically secured so someone can't connect the e-tube software to begin with.
That being said, the software is likely proprietary, so it isn't clear if that functionality could be added - you'd have to probably reverse engineer it and see if you could mod it to do that.