Security key

[Alisa]

Since this message board doesn't have a security forum yet I will just post this here:
Does anyone know if there is a windows or system event I can check for to find out if something has been removed from a USB or parallel port? My program reads the code from the key at startup (there are USB and parallel versions of the key), and the program quits if the key is not found or the code is expired, but what if the user puts in the key, starts the program, and then removes the key? I thought of putting the keycode checking module on a timer that runs every minute or so, but that seems like a rather painful way of doing it. I thought maybe I could just run the code if a system change is detected . . . any ideas?

 

[Moniker]

You answered your own question. The only way to detect if a USB key or parallel port dongle is removed is to scan the ports at regular intervals. The removal of USB keys does send a message to Windows letting it know, but I don't know what hooks you'd need to be able to monitor that. (A Google search will probably handle it.) However, if you go in that direction, then you'll have one set of code for USB keys and another set for parallel ports. Twice the maintenance is never fun. If you just scan every few minutes, you should be fine.

It sounds like you're trying to force some sort of product key to be omnipresent. It's almost paranoia. A better solution overall, IMO, would be either encrypting the key and throwing it in the registry, or, if your users have Internet access 24/7, have the program compare a local key to a foreign key on the web each time the program starts. It's more complicated than how I'm describing it, but it's more convenient for users.

The easiest examples I can think of involve games. Everytime I start up a round of Luxor, it verifies that I have a legitimate copy before the game starts. A small splash screen comes up and there's a "Play Game" link. when I click on that, the program gets my local key, goes out on the Internet somewhere and verifies that key, and then starts the game. If it can't verify the key (mismatches, for example), it won't start. A pitfall is that the Internet is not 100% on all the time (or at least your servers may not be), so you would need some redundancy to account for that.

 

[Alisa]

I don't get to pick how to do it, I just have to make sure it gets done

The only way to detect if a USB key or parallel port dongle is removed is to scan the ports at regular intervals.

Do you know what sort of code to use to scan the ports or any pointers on where to find it?

 

[Moniker]

I'm really not sure where to direct you as I've never had a need to scan the ports. I know you'll probably end up using MSCOMM at some point. See if this is useful at all. Otherwise, perhaps someone else knows more than I do on this topic.

 

[Bat17]

Do you know what sort of code to use to scan the ports or any pointers on where to find it?

Seems to be the hard way to do it. Why not just reread the code from the key at regular intervals? Not necessarily with a timer, you could use an event to trigger it, such as when a record is saved.


HTH

Peter

 

[Alisa]

You are right - the security code runs in less than 1 second, so I am just going to put it on a timer. Thanks for the suggestions.