1

I am to provide a hardware+software solution. The software is an application in c++ running on windows. The hardware is motherboard+processor+disk+memory. In order to protect the solution, I need to develop a USB dongle.

I am planning on developing an application which will generate the USB Dongles by encrypting different data (customer data, hardware components...) mixed with a password.

The solution will check if this USB dongle is present every 60 seconds. If so, the solution will decrypt the USB dongle's content and compare it with what the solution has internally loaded (in code). If there is a match, the solution will keep on working until the next cycle (60 seconds later). If not, the solution will stop.

Questions:

  1. does is make sense ?

  2. Should I check hardware components' serial number (cpu...) every cycle ? how to make this check really fast ?

11
  • 2
    Is there some reason you're not using digital signatures?
    – Ella Rose
    Jul 31, 2018 at 16:53
  • Hi Ella Rose, yes you can. My only concern is that hashing is mostly for protecting data integrity. So, if someone copies the USB dongle could obtain the same signature from the second USB. And that is what I want to prevent from happening.
    – ekremer
    Jul 31, 2018 at 17:22
  • 4
    It seems this is not a toy project but for an actual product. And according to the question and its lack of depth this sounds like a terrible, terrible idea. The only suggestion I can come up with: Don't do crypto yourself - especially if you're not an expert (which is indicated by your questions). To give some hints for your actual question: No, it doesn't make sense. A challenge-response has to be based on proper random numbers. And secondly speed should be your least concern - get the security right first.
    – tylo
    Jul 31, 2018 at 17:46
  • @ekremer if someone copies encrypted data they get a perfect copy. This doesn't change anything. Look into how dongles work; the essentially use signatures, and get a number from the computer, sign it, and return it to the computer. The computer can verify the signature. They're not USB storage devices.
    – vidarlo
    Aug 1, 2018 at 6:05
  • @vidarlo say someone copies the USB and get a perfect copy. When they go use it in another board (remember I provide the hardware) it will not work because the binary internally checks the hardware serials (cpu, bios,...). So, unless you can get from Intel, Asus,... pieces of hardware with the same serials, making extra copies you will not get any further. Another option is that you do reverse engineering from a compiled executable (c++), but I do not think that's not easy.
    – ekremer
    Aug 1, 2018 at 14:36

3 Answers 3

2

does is make sense ?

No.

20+ years ago, every small, specialist software vendor was trying to protect their IP using hardware dongles. It was a turn-off for customers, a PITA for support and bypassed as frequently as they broke.

The world has moved on - so should you.

The solution will check if this USB dongle is present every 60 seconds. If so, the solution will decrypt the USB dongle's content and compare it...

So the solution will check if a file is present every 60 seconds. If so, the solution will decrypt the file and compare it. How hard would that be to subvert?

Should I check hardware components' serial number (cpu...) every cycle ?

Slightly more sensible than using a dongle. But if your product really requires such capability, then why not use a network HSM; either the customer's own or even one you host yourself.

how to make this check really fast ?

Reading back properties should be around the same speed as a RAM fetch - i.e. measured in nanoseconds for something which you propose doing every 60 seconds, and you are concerned about the performance?!

1

does is make sense ?

No. It relies on the application reading the content of the dongle and performing some action on it. This implies that the content is readable - and thus trivial to replicate. Just intercept all USB calls with wireshark, and write down the expected response.

Should I check hardware components' serial number (cpu...) every cycle ? how to make this check really fast ?

You don't need to make the check really fast. You can perform it for instance every ten seconds in a separate thread. But I suggest you look into commercial dongle systems, such as Flexeras offerings. Because I somehow doubt you will be able to make a good system yourself - based on the questions you ask.

0

I'd agree with vidarlo (previous answer). IMHO using an out of box solution would be faster and cheaper.

Maybe a simple cryptography token (USB token or a card) would suffice - you could let your software sign some random data and check the signature.

Regardless that - as soon as the code resides on the client side, you effecitely loose any control over it and you cannot prevent the client changing the code disabling the validation (ok - unless it runs on a hw explicitly designed to prevent access to its internal code, such as microcontrollers).

2
  • the application is actually a binary compiled executable. I could make it check some specific serial numbers (cpuid,...). If these pieces of hw are not present the software will not work. So, you can make as many copies of the USB as you want, but they will not work in other hw. Won't they ?
    – ekremer
    Aug 1, 2018 at 14:23
  • @ekremer I mean - you could provide a crypto dongle with a custom certificate (e.g. signed by your own custom CA certificate).. the idea is that software can check the certificate and the signature. The software would of couse work on another HW, but only with the dongle connected
    – gusto2
    Aug 1, 2018 at 14:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .