Migration Guide HASP4 To Sentinel LDK
Migration Guide HASP4 To Sentinel LDK
Disclaimer
We have attempted to make this document complete, accurate, and useful, but we cannot guarantee it to be perfect. When we discover errors or omissions, or they are brought to our attention, we endeavor to correct them in succeeding releases of the product. SafeNet, Inc. is not responsible for any direct or indirect damages or loss of business resulting from inaccuracies or omissions contained herein. The specifications contained in this document are subject to change without notice. . July 2013 Version 7.0 Revision 1306-1
Contents
Contents .......................................................................................................... 3 Introduction ..................................................................................................... 4
About Sentinel License Development Kit ........................................................................................................ 4 About This Guide ............................................................................................................................................. 4 About Sentinel HL Keys .................................................................................................................................. 5 Requirements for Run-time Environment ........................................................................................................ 5 Migration Use Cases ....................................................................................................................................... 7 Compatibility With HASP4 ............................................................................................................................... 7 Shortcut to Enhanced Protection..................................................................................................................... 8
Appendix ....................................................................................................... 16
Table 1: Comparison of HASP4 With Sentinel HL Keys .............................................................................. 16 Table 2: HASP4 Net Keys and Equivalent Sentinel HL Net Keys ................................................................ 17 Table 3: HASP4 Tools and Functions and Their Sentinel LDK Counterparts .................................................... 18 Table 4: Comparison of HASP4 API and Sentinel Licensing API Functions ....................................................... 21
Introduction
About Sentinel License Development Kit
Sentinel License Development Kit (Sentinel LDK) is a Software Digital Rights Management (DRM) solution that delivers strong copy protection, protection for Intellectual Property and secure and flexible licensing. Sentinel LDK is an all-in-one Software DRM solution that enables you to choose a hardware- or software-based protection key, based on business considerations. Sentinel LDK software engineering and business processes are completely separate to ensure: Effective and efficient product development Quick time to market Immediate addressing of customer and market needs Comprehensive support throughout the software products protection and licensing life cycle The level of protection for your software is determined by the locking type you choose hardware-based or software-based. Sentinel LDK hardware-based protection, which utilizes Sentinel HL keys, provides the safest and strongest level of protection. The backward compatibility of Sentinel HL keys to HASP4 keys enables you to migrate to Sentinel LDK in stages.
Note: The procedures and terminology employed in this guide are based on the assumption that you want to migrate from HASP4 to Sentinel HL keys. However, since Sentinel HL and Sentinel SL keys are supported by the same set of tools and APIs, the procedures for migrating to Sentinel SL keys are similar (migrating to SL keys requires an activation process). If you want to migrate to Sentinel SL keys, refer to the Sentinel LDK Software Protection and Licensing Guide or contact SafeNet Technical Support.
Sentinel HL Net and NetTime (Driverless configuration) keys. The Run-time Environment is required on the computer where the key is attached when the protected application is executed on different computers.
The standalone Sentinel HL (Driverless configuration) keys do not require the Run-time Environment. For more information, see Protection Keys That Require Sentinel LDK Run-time Environment in the Sentinel LDK Software Protection and Licensing Guide.
1 HASP4orHASP
Providesbetterbackend, bettersecurity Providesbettersecurity Providesbetterbackend, bettersecurity. Nobackwardcompatibility inLDK;newkeysareusable byexistingapplicationsand canbeappliedwithlegacy H4licensesvialegacy backend Providesbettersecurity Providesbetterbackend, bettersecurity Nobackwardcompatibility Providesbettersecurity Nobackwardcompatibility
HASP4 HASP4
SentinelLDK SentinelLDK
HASP4 HASP4
SentinelLDK SentinelLDK
6 Basickeys: HASP4orHASP
HASP4
SHL(Driverless) Basickey
SentinelLDK
Table Legend:
HASP4 HASP SHL(HASP) SHL(Driverless) HASP4protectionkey HASPHLprotectionkey SentinelHL(HASPconfiguration)protectionkey SentinelHL(Driverlessconfiguration)protectionkey
You can begin supplying Sentinel HL (HASP configuration) keys to new customers immediately, with no change to your existing software. When you decide to migrate your entire customer base to Sentinel HL (Driverless configuration) keys, it will not be necessary to replace the HASP configuration keys that have already been deployed. These keys can be upgraded to Sentinel HL (Driverless configuration) keys at the customer site.
1 RemainsHASP4
2 + RemainsHASP4orSentinelHL (HASPconfiguration)keys
10
HASP4
Sentinel LDK protection implemented, including access to items protected with Sentinel LDK
11
Implementing Stage 2
You can maintain your legacy HASP4 protection simultaneously with the added protection and licensing capabilities of Sentinel LDK. This is possible because the Sentinel HL (HASP configuration) key is divided into two segments, each of which functions as a separate key. The legacy key segment provides full HASP4 functionality. The Sentinel LDK key segment provides the advanced Sentinel LDK capabilities. When you combine HASP4 and Sentinel LDK functionality, the two separate key segments require a dual process in the production phase and may also require a dual process at the end-user site, depending on the functionality applied. Following is a breakdown of the required steps when you choose to retain legacy HASP4 protection in your code concurrently with Sentinel LDK functionality. Where relevant, you are pointed to additional information in the Sentinel LDK Software Protection and Licensing Guide. 1. Installing Sentinel LDK and Introducing your Vendor Keys If you have not already done so, install Sentinel Vendor Suite and Sentinel EMS, and introduce your Sentinel Vendor keys. As part of the Vendor key introduction process, Sentinel LDK generates customized Sentinel Licensing API libraries for your Vendor Code. For more information, see the Sentinel LDK Installation Guide. (Sentinel EMS is not required for Sentinel HL Basic keys.) 2. Linking to Sentinel Licensing API Libraries Link the customized Sentinel Licensing API libraries to the protected files as follows: If you link to your customized Sentinel Licensing API .lib files: Remove the existing link to the HASP4 library files. Replace any hasp () call with the corresponding hasp_* call (for example, hasp_login, hasp_logout). You can use Sentinel LDK ToolBox to simplify this process.
(The Sentinel Licensing API .lib files contain both Sentinel LDK and HASP4 functionalities, but the names of the Sentinel LDK and HASP4 functions are not identical.) 3. If you link to your customized Sentinel Licensing API .dll files, do not remove the link to the HASP4 library files. Include your customized Sentinel Licensing API header files in your project. Do not remove included HASP4 headers.
Enabling Your Software to Work With HASP4 or Sentinel LDK Protection To enable your software to work with HASP4 or Sentinel LDK protection, implement the decision tree illustrated on page 10 of this document, as follows: a. Use the Sentinel Licensing API hasp_get_info() function to identify a key. If a Sentinel HL (HASP configuration) key is identified, invoke Sentinel LDK protection; if a Sentinel HL key is not identified, invoke HASP4 protection. (See the help system for the Sentinel Licensing API.)
12
b. c.
If both a Sentinel HL (HASP configuration) key and a HASP4 key are not detected, invoke the behavior of the application when no key is detected. To increase security, SafeNet recommends that you envelope your application. In Stage 2 of the migration process, the protected software must be able to run with either HASP4 or Sentinel HL (HASP configuration) keys. Therefore, you cannot use Sentinel LDK Envelope to wrap the entire application. Wrap your application using the latest HASP4 Envelope.
4.
Protecting Selected Items With Sentinel LDK Optionally, you can enhance the security of selected items in your software by protecting them with Sentinel LDK. You can protect individual files using Sentinel LDK Envelope or Sentinel Licensing API. You can protect code snippets and other data using the Sentinel Licensing API. These protected items are only accessible when a Sentinel HL (HASP configuration) key is connected. When using the Sentinel Licensing API, note the following: For 32-bit applications, you can leave the existing HASP4 API calls in your code. If you migrate your application to 64-bit, remove the HASP4 API calls and replace them with corresponding Sentinel Licensing API calls where necessary.
(See the help system for the Sentinel Licensing API.) 5. Licensing, Production and End-User License Management The Sentinel LDK and legacy HASP4 segments in a Sentinel HL (HASP configuration) key are managed separately, and the licensing, production and updating of each segment are implemented using the relevant tools. The following table details the tools and definitions you must use to manage each of the key segments.
Managementof Licensing SentinelLDKSegment SentinelEMS LegacyHASP4Segment HASPEdit
ProductionandCreation SentinelEMS ofRemoteUpdateFiles RemoteUpdateat EndUserSite KeyMonitoring LicenseManagementat EndUserSite SentinelRemoteUpdateSystem(RUS) SentinelLicensingAPIhasp_update() function SentinelAdminControlCenter(partofthe SentinelLDKRuntimeEnvironment)
13
6.
Replacing HASP4 Drivers With Sentinel LDK Run-time Environment Replace the HASP4 drivers that are included in your application setup with Sentinel LDK Run-time Environment. (See Sentinel LDK Software Protection and Licensing Guide, chapter Distributing Sentinel LDK with Your Software.)
7.
Distributing Your Software Sentinel LDK Run-time Environment is compatible with HASP4 keys, therefore there is no need to distribute HASP4 drivers in addition to the Sentinel LDK Run-time Environment. (See Sentinel LDK Software Protection and Licensing Guide, chapter Distributing Sentinel LDK with Your Software.)
8.
Distributing End-User Keys The new version of your software can still run with HASP4 keys, so that you do not need to recall your entire install base. a. If you have protected selected modules with Sentinel LDK, you must supply customers who will be using these modules with Sentinel HL (HASP configuration) keys. Existing customers who will not be using these modules can continue using HASP4 keys. It is recommended that you supply all new customers with Sentinel HL (HASP configuration) keys.
b.
Implementing Stage 3
Fully implement the advanced Sentinel Licensing API by integrating Sentinel LDK functionalities into your code. 1. Installing Sentinel LDK and Introducing Your Vendor Keys If you have not already done so, install Sentinel Vendor Suite and Sentinel EMS, and introduce your Sentinel Vendor keys. As part of the Vendor key introduction process, Sentinel LDK generates customized Sentinel Licensing API libraries for your Vendor Code. See Sentinel LDK Installation Guide. (Sentinel EMS is not required for Sentinel HL Basic keys.) 2. Linking to Sentinel Licensing Libraries If you have not already done so, link the customized Sentinel Licensing API library to the protected files, as described in step 2 of Stage 2.
14
3.
Defining Sentinel LDK Feature IDs If you used program numbers in HASP4, define new Feature IDs in Sentinel LDK Business Studio to replace the HASP4 program numbers. (See Sentinel LDK Software Protection and Licensing Guide, chapter Implementing Your Sentinel LDK Licensing Plan.)
4.
Protecting Your Software With Sentinel LDK a. Insert calls to Sentinel LDK in your code. Refer to Table 4 on page 21 for a comparison of HASP4 API and Sentinel Licensing API functions. (See the help system for the Sentinel Licensing API.) Remove all existing HASP4 API calls. Wrap the software using Sentinel LDK Envelope. (See Sentinel LDK Software Protection and Licensing Guide, chapter Sentinel LDK Envelope Protection.)
5.
Upgrading to Sentinel HL (Driverless Configuration) Keys Define an Update Product or Base Product that includes the Upgrade to Driverless attribute. This upgrades existing Sentinel HL (HASP configuration) keys to Sentinel HL (Driverless) keys. The attribute is ignored when applied to protection keys for which the attribute is not relevant (that is, Sentinel HL (Driverless configuration) keys). This Product should be applied to Sentinel HL keys that exist at the customer sites. For more information, see the appendix How to Upgrade a Sentinel HL Key to Driverless Configuration in the Sentinel LDK Software Protection and Licensing Guide.
6.
Encrypting Data In HASP4, a single proprietary encryption key was used to encrypt all data. Sentinel LDK applies a unique AES encryption key for each Feature ID, providing much stronger protection. In order to implement this protection, you must replace all data that was encrypted using HASP4 with data that is encrypted using Sentinel LDK as follows: a. b. c. Decrypt the data using HASP4, or locate the original unencrypted data. Encrypt the data using Sentinel LDK, using the Feature ID relevant to that data segment.
Ensure that the hasp_login()call for the data segment is defined with the same Feature ID that you used to encrypt the data. Replace the HASP4-encrypted data in your code with the Sentinel LDK-encrypted data. (See Sentinel LDK Software Protection and Licensing Guide, chapter Protection Strategies.)
15
7.
Writing Data to the Sentinel HL Key Write your existing data to one of the following Sentinel LDK memory files: Data in the HASP_FILEID_RW memory file enables you to write to, or read from, a keys memory during run-time. Data in the HASP_FILEID_RO memory file enables you to read from a keys memory during run-time. Data may be written to this memory file: During your production process When updating the key using the Sentinel RUS When updating the key using the Sentinel Licensing API hasp_update() function
(See Sentinel LDK Software Protection and Licensing Guide, chapters Implementing Your Sentinel LDK Licensing Plan and Sentinel Remote Update System.) 8. Wrapping Your Software With Sentinel LDK Envelope Wrap the software using Sentinel LDK Envelope. (See Sentinel LDK Software Protection and Licensing Guide, chapter Sentinel LDK Envelope Protection.) 9. Replacing HASP4 Drivers With Sentinel LDK Run-time Environment Replace the HASP4 drivers that are included in your application setup with Sentinel LDK Run-time Environment. (See Sentinel LDK Software Protection and Licensing Guide, chapter Distributing Sentinel LDK with Your Software.) 10. Licensing Your Software With Sentinel LDK Use Sentinel EMS (or Sentinel License Generation API) to license your software. (See Sentinel LDK Software Protection and Licensing Guide, Part 3: Licensing.) 11. Distributing Your Software Follow the instructions in the Sentinel LDK Software Protection and Licensing Guide to distribute your software (chapter Distributing Sentinel LDK with Your Software). 12. Distributing or Upgrading End-User Keys Ensure that all customers who are still working with HASP4 keys and who receive the Sentinel LDK-protected software also receive Sentinel HL (Driverless configuration) keys. The Sentinel HL (HASP configuration) keys that newer customers received will be upgraded to Sentinel HL (Driverless configuration) keys by the Product that you defined in step 5 above. 13. Using Sentinel HL Net Keys When Sentinel LDK is fully implemented and there are no HASP4 calls in your code, you do not need to have HASP4 license management tools installed (Sentinel License Manager or Aladdin Monitor). The Sentinel LDK Run-time Environment installation includes the Sentinel LDK Admin Control Center and the Sentinel License Manager that manages Sentinel HL Net and Sentinel HL NetTime keys.
16
Appendix
Table 1: Comparison of HASP4 With Sentinel HL Keys
HASP4 Keys Key Type Standard M1 Memory Size 112 Bytes Sentinel HL Keys Key Type Sentinel HL Basic Sentinel HL Pro Memory Size 112 Bytes backward-compatible memory* 112 Bytes Read/Write memory 112 Bytes ROM 4 KB backward-compatible memory* 4 KB Read/Write memory 2 KB ROM 4 KB backward-compatible memory* 4 KB Read/Write memory 2 KB ROM 2 GB / 4 GB Flash memory 4 KB backward-compatible memory* 4 KB Read/Write memory 2 KB ROM 4 KB backward-compatible memory* 4 KB Read/Write memory 2 KB ROM
M4
496 Bytes
Sentinel HL Max
Time
512 Bytes
Sentinel HL Time
Sentinel HL Drive
Net
496 Bytes
Sentinel HL Net
4 KB backward-compatible memory* 4 KB Read/Write memory 2 KB ROM *Backward-compatible memory is available in HASP configuration only. Sentinel HL NetTime
For more specification data regarding Sentinel HL keys, see the Sentinel HL Data Sheet.
17
18
Table 3: HASP4 Tools and Functions and Their Sentinel LDK Counterparts
HASP4 Application / Functionality Passwords Envelope (automatic protection tool) API HASPDemo ( GUI-driven sample demonstrating API calls) Sentinel LDK Application / Functionality Vendor Code Sentinel LDK Envelope (part of the Sentinel LDK Vendor Suite) Sentinel Licensing API Sentinel LDK ToolBox (part of the Sentinel Vendor Suite) provides the following functionality: Interactive GUI that demonstrates the various Licensing API calls Code generator Sentinel LDK Run-time Environment Sentinel License Manager, interfaced through the Sentinel Admin Control Center (part of the Sentinel LDK Run-time Environment) Sentinel Admin Control Center Sentinel Admin Control Center Sentinel Remote Update System (RUS) hasprus.exe Sentinel EMS (part of the Sentinel Vendor Suite, generates V2C files) Sentinel RUS (hasprus.exegenerated by Sentinel EMS and shipped to end users) hasp_update(), part of Sentinel Licensing API
Aladdin Monitor Aladdin DiagnositX Aladdin DiagnostiX Memory Beamer RUScreate remote update files: DOS RUSVendor Utility Win32 RUSAPI sample DOS RUSVendor Utility Win32 RUSAPI sample
19
HASPEdit HASPEditString encryption/decryption Sentinel LDK ToolBoxEncrypt/Decrypt functions HASPEditFAS (generating licenses) Sentinel EMSEntitlements screen HASPEditProgramming the user memory area Sentinel EMSdefine the data on the Memory tabbed page when creating a new Product. The data is written to the key during entitlement production. Sentinel LDK ToolBoxhasp_write() function
HASPEditProgramming the memory Sentinel EMS define and manage license related area reserved for licensing (FAS area) information. Note that Sentinel HL keys employ Read-only memory which does not allow direct R/W access using Sentinel Licensing API. Only V2C updates created by Sentinel EMS or Sentinel License Generation API can overwrite or update this memory segment. HASPEditsetting the real-time clock Key time set to UTC during key manufacture HASPEditprogramming licenses to a key HASPEditreading the key memory HASPEditreading the HASP ID Number HASPEditCreate programming utility for mass production of keys Sentinel EMSCatalog > Products and Entitlements Sentinel EMS Studiounder Entitlements, Check In C2V or Check In Key Sentinel EMSview the connected key under Entitlements, Check In C2V or Check In Key Sentinel EMS Entitlements > New > Number of Keys Envelope Support for Demo key Sentinel LDK EnvelopeDemo key is default, change to non-demo in Sentinel Batch Code screen
DataHASP Tabdata file configuration Sentinel LDK EnvelopeProtection Details pane, Enable data file encryption
Using FAS Sentinel LDK Protect OnceDeliver Many licensing technology. Sentinel LDK Envelope protects per Feature ID. Business logic and license production are implemented in Sentinel EMS. Sentinel LDK Envelope optionsProtection Details pane, Advanced, Enable Custom Protection Key Login Scope Sentinel LDK EnvelopeUser Messages pane Sentinel LDK Envelope Search modeProtection Details pane Advanced search optionsProtection Details pane, Advanced, Enable Custom Protection Key Login Scope
Enhanced security Envelope switches Sentinel LDK EnvelopeProtection Details pane, Advanced
20
HASP4 Application / Functionality hinstall.exe (command line) hdd32.exe (GUI driven) Driver installation API lmsetup.exe LM applicationnhsrvw32.exe
Sentinel LDK Application / Functionality Driver haspdinst.exe (command line) HASPUserSetup.exe (GUI driven) Sentinel LDK Run-time Environment Installation API
License Manager, Monitor, DiagnostiX Sentinel LDK Run-time Environment installers Sentinel LDK Run-time EnvironmentSentinel License Manager Service (LMS) hasplms.exe Sentinel LDK Run-time EnvironmentSentinel License Manager Service (LMS) hasplms.exe Sentinel LDK Run-time Environment installers install the Sentinel LDK Admin Control Center
Monitor Setupaksmon.exe
nethasp.iniclient configuration file Sentinel Licensing API hasp_login_scope() Sentinel Admin Control Center hasplm.ini nhsrv.iniLM configuration file DiagnostiX setup aksdiag32_setup.exe Sentinel Admin Control Center hasplm.ini Sentinel LDK Run-time Environment installers
21
Sentinel Licensing API Function hasp_get_info() hasp_get_size() hasp_encrypt() hasp_decrypt() hasp_get_info()(Format Template: Accessible Keys) hasp_read() hasp_read() hasp_write() hasp_write() Not relevant in Sentinel LDK. Key time is set to UTC during key manufacture. hasp_get_rtc(), hasp_hasptime_to_datetime() Not relevant in Sentinel LDK. Key time is set to UTC during key manufacture. hasp_get_rtc() hasp_hasptime_to_datetime() hasp_login() hasp_login_scope() Not relevant in Sentinel LDK. Sentinel Licensing API functions return all necessary data hasp_logout() Sentinel License Manager automatically detects idle sessions and releases them.