Sentinel Hardware Keys Developer's Guide - Customer Connection ...

Chapter 7 – Implementing Secure Licensing
Contents Glossary Index Troubleshooting
Implement Query-Response Protection
172 Sentinel Hardware Keys Developer’s Guide
The AES algorithm-based query/response protection is the primary method
of securing an application. Simply storing data in the key memory is relatively
easier to mimic because once the hacker knows what the memory
should contain, they can modify the application to return those values
instead of actually reading them from the Sentinel Key.
Query-response protection is a challenge-response like technique driven by
the AES algorithm programmed in the Sentinel Key. The application sends a
query to the Sentinel Key, which sends a response calculated using the AES
algorithm, for evaluation. If the response obtained matches the expected
response, the key is assumed to be present and application is allowed to run.
Using the SFNTQueryFeature API on an AES feature programmed into the
Sentinel Key allows your application to issue a nearly infinite amount of
unique challenges. This mechanism becomes the backbone of your protection
strategy since it is extremely difficult to duplicate the correct responses.
You can implement this protection by adding an AES feature to your template
and then using the SFNTQueryFeature API to challenge the algorithm
stored in the license.
However, just using the API once in your application is not enough; there
are many other tips, like given below, you should endeavor to employ.