Sentinel Hardware Keys Developer's Guide - Customer Connection ...

Scatter the Security Checks
Tips and Tricks
Contents Glossary Index Troubleshooting
Security checks typically consist of multiple steps: calling the key, evaluating
the returned value, and acting on the evaluation results. Instead of putting
the entire strategy at one place in your code, you should disperse the check
all over to make the relation between them not obvious. A security check is
harder to break if its code components are physically separated into different
sections of the application instead of being located together.
Use Multiple Threads to Your Advantage
If the work of an individual security check happens over multiple threads,
then tracing through the operation can be complicated. This makes debugging
the code very difficult.
Use Returned Values as Variables
One effective technique to hide security checks in a high-level language is to
use returned values to control application flow. With this method, a value
returned by the key becomes a logical pointer or selection key to the next
execution step or subroutine. This makes analysis of your code more
difficult.
Another way to use a returned value is to add it to the value of a variable so
the sum is the desired value of the variable. If the variable is used in other
parts of the code, then that code is dependent on the call to the hardware
key.
For example, suppose that at some point in your application you want a
variable to contain the floating value 13.0. Assume that one of the query
strings you send to the key returns the decimal number 12,345.
Set the floating variable to -12,332.0.
Send the query.
Add the response to the variable.
Sentinel Hardware Keys Developer’s Guide 179