How Sentinel LDK Protects Time-based Licenses With V-Clock

This appendix describes the technology used in Sentinel LDK to prevent a user from extending the duration of a software license that is locked to the V‑Clock in a Sentinel protection key by adjusting the computer’s system clock.

V‑Clock is a virtual clock that is available in Sentinel SL keys and in all types of Sentinel HL (Driverless configuration) keys except for Sentinel HL Basic keys. For Products that are licensed with Sentinel SL keys, V‑Clock is always available. For Products that are licensed with Sentinel HL (Driverless configuration) keys, V‑Clock must be specifically enabled for each Product.

NOTE   The use of V‑Clock in Sentinel HL Pro keys is only available if your Sentinel LDK Master license contains the V‑Clock module.

V‑Clock does not provide the same level of control as the real-time clock in Sentinel HL Time keys and Sentinel HL NetTime keys. However, V‑Clock prevents the end user from setting the system time back to an earlier date and time, and thus tampering with time-based licenses.

The expiration period or date for a time-based license is initially calculated according to the system clock of the end user's machine.

Sentinel License Manager reads the system time at Sentinel License Manager startup (by default, part of the machine startup). Sentinel License Manager subsequently uses its internal running time to calculate the time. When an application that is protected with V‑Clock is executed for the first time, Sentinel License Manager queries its internal clock to determine the start time of the software’s license duration.

>If the license duration is a fixed period (for example, 30 days or 1 year), Sentinel License Manager calculates the actual date on which the license must stop working and the information is stored in the secure storage area of the protection key. The secure storage for a Sentinel SL key is on the hard drive of the end user's computer. The secure storage for a Sentinel HL key is in the HL key.

>If the license is to expire on a specific date, Sentinel License Manager records that date.

Expiration time is determined using the formula:

[current Sentinel License Manager time] + number of seconds to expiration

The information is stored in the secure storage area of the protection key.

NOTE   The V‑Clock time is not automatically updated by the License Manager if you are using only Sentinel Licensing API to protect your application. To update the V‑Clock time for a given protection key with Sentinel Licensing API, you must establish a session for the key. The V‑Clock time is updated for the Login function, and then for each of the following additional functions: Logout, Read, Write, Encrypt, Decrypt.

Tampering with the System Clock

If a user resets the system clock of the machine to which the software license is locked:

>As long as Sentinel License Manager remains active, the changed time does not affect the expiration time of the license, since the calculations are all made within the License Manager, which uses the time of its last startup.

>If Sentinel License Manager is stopped and restarted (for example: if the machine is rebooted), the License Manager compares its last recorded internal time with the time of the system clock. When Sentinel License Manager detects that the time on the system clock is earlier than that of its internal clock, protected applications with time-based licenses are deactivated. The applications are reactivated automatically when the system clock is equal to or later than the time in the License Manager.

NOTE   Sentinel License Manager allows the system clock to run up to 24 hours earlier than its internal clock. This accommodates situations where the protected application is used across different time zones.

Re-enabling a Blocked Protected Application

As indicated above, a blocked protected application is automatically re-enabled when the time on the system clock is no longer earlier than the V‑Clock time. The application will be accessible if the license for the application has not yet expired.

Under certain circumstances, you may want to re-enable a blocked application by changing the V‑Clock time. This can be accomplished by receiving a C2V file for the protection key from the customer and then returning a V2C file that provides an update to the V‑Clock time.

NOTE    Before applying a V2C file to reset the V-Clock using the system clock, the user should ensure that the system clock is set to the current date and time.

Setting Fallback to V‑Clock If the RTC Battery in a Sentinel HL key is Depleted

If the battery for the real-time clock on a Sentinel HL (Driverless configuration) Time or NetTime key is depleted, the key is no longer accepted for time-based licenses.

You can configure a Sentinel HL Time or NetTime key to switch automatically to the V‑Clock if the battery becomes depleted. If the real-time clock on the Sentinel HL key stops operating, protected applications, including those with time-based licenses, will continue to run.

In Sentinel License Generation API, you can implement fallback to V‑Clock for a Sentinel HL key by including the tag <fallback_to_vclock> in a license definition. In Sentinel LDK-EMS, you can select the global configuration parameter Fallback to V‑Clock in the Administration Console in order to implement fallback to V‑Clock in all generated licenses.