Software protection dongle or copy protection plugs, also known as dongles, or hardware keys, are used to protect software from unauthorized copying. For example, the software comes with a copy protection plug that is plugged into an interface of the computer (parallel port, USB, etc.). The “donated” software then checks once or regularly whether the copy protection plug is present during use, and refuses service if it is not available or, for example, only releases program functions to a limited extent.
However, other forms of hardware dongles are also possible, for example using public-private key encryption methods. In this case, the specific (encrypted) dongle information is not contained in a USB stick, but in the flash ROM of the target platform, for example. In addition, there are also network variants of the dongling, in which the program searches for a license server in the network and debits or releases a license from it. For example, the dongling is either against the MAC address of the requesting computer or against the plugged-in hardware dongle. It is also possible to generate a special license number based on the internal serial number of a connected drive. This opens up the possibility of obtaining software online, as the hardware for the dongle can be easily purchased locally or used directly.
Dongles are mainly found in conjunction with software in the upper price range with prices of several thousand dollars per license. A dongle is considered one of the safest copy protection measures, as the dongle usually cannot be copied or can only be copied with considerable effort. Nevertheless, it is possible to remove the call of the dongle from the application software or to simulate a suitable dongle. The manipulation of the application software or the dongle simulation can be made more difficult by the software manufacturer who wants to use a dongle by various measures:
---
- Do not use standardized code libraries from the dongle manufacturer
- Protect security-relevant routines with cryptographically strong checksums
- Have parts of the program code decrypted by the dongle at runtime
- Execute random dongle queries through background processes (software watchdogs)
This makes it difficult to analyze the data stream (chronological sequence of I/O requests) and thus to simulate the dongle. In principle, the same applies to the removal of the queries (distribution of the queries to as many places as possible in the program code).
Psychologically, too, a dongle is used to assign a piece of hardware and thus something tangible to an abstract license for the end user.
Latest dongles use public keys and a secure tunnel from the driver to the dongle. With the public key infrastructure, the software can now have arbitrary values signed and verify them with the public key. This makes it impossible to simulate the dongle, as was often the case in the past. With the new generation of dongles, there is currently only one known way to bypass the dongle. To do this, the application must be decompiled, and the dongle queries must be removed from the application in such a way that the actual function is not affected. If, for example, the application stores encrypted data with the dongle’s public key and then decrypts it with the help of the dongle when it is reloaded, the reprogramming of these functions can only be handled with great effort. Therefore, the copy protection of the new dongle generation is currently difficult to circumvent while at the same time implementing well.
The copy protection connector does not prevent copying of the software itself, but only the use of more than the number of licenses purchased.
As a measure to make it more difficult to steal dongles, interface cards are offered with inward-facing parallel or USB interfaces, allowing dongles to work inside locked computer enclosures. Colloquially, other devices are also referred to as dongles, insofar as they are connected to the USB port.
Tagged With matterzt8