SS-68BB USB USER MANUAL
DOC. NO: SS-68BB USB-14 (REV 04)
Page
15
of
16
APPENDIX A:
USING SS—68BB USB AS A SECURITY DONGLE
INTRODUCTION
With the proliferation of software solutions it is becoming commonplace for software to be
pirated or used without authorisation.
A fairly standard solution is to provide a 'dongle' (hardware device) that attaches to the PC
and the software will not run if the device is not present. This obvious lock is often a
source of irritation to the end user.
A more elegant solution is to provide a 'useful' device that acts as the security dongle. The
data buffer is an obvious candidate for the task where a Telephone Management System
is the application.
SS Telecoms have developed a simple protocol that will allow software to verify that it is
attached to a matching buffer.
DISCUSSION ON SECURITY ISSUES
There is a simple level of security provided by having a data buffer in the first place.
Pitfalls can be identified such as
Another hardware manufacturer can develop a buffer with a similar protocol. This means
that it will be possible to hijack the software package by using these alternate buffers
Another software vendor can adapt his software to work with the buffers and thus take
over the installed base of buffers allowing this vendor a much cheaper entry to this
customer than the original vendor
Solution to issues
The basic solution to the problems outlined above has already needed addressing in the
GSM arena. Authentication of users is vital to ensure that billing is accurate, for example.
How do they do this? It is done using a system known as 'Challenge / Response'
authentication. This will be outlined briefly below.
Challenge Response Description
The PC software and the Buffer have both loaded with a secret key. This key can be up to
16 characters
The PC sends the buffer a challenge consisting of a short randomly generated message
of up to 10 characters.
The Buffer performs a 'hashing' function on this message using the secret key as part of
the process. It is not possible using a small number of messages to determine what the
key is.
The buffer then sends the result of the 'hashing' function to the PC.
The PC then compares this to the result of internally generating the 'hash' result
If the results match, then the buffer is authenticated and the software will run.
IMPLEMENTATION
Setting the key
Use the command '~ nnkk<enter>' where '~' is the tilde character, followed by a space
character and then the 2 digit hexadecimal offset ('nn') for the key character which is also
sent hexadecimal ('kk') and <enter> is the Carriage Return character 0x0D. The sequence
to set the secret code to 'TEST' is shown below:
~ 0054
~ 0145
~ 0253
~ 0354
