What Is A Dongle?

"Dongle" – nobody really knows where this funny word actually comes from. Is it a derivative of colloquial expressions like "whatchamacallit" e.g. "dangle"? Who invented it? No, it was not invented by a software programmer named Don Gall, this is fiction. On top of this, the term "dongle" is often not used precisely, denoting a range of different hardware components. Sometimes it is used for USB stick or other small USB devices that slide into the USB port of a computer. Sometimes dongle is used synonymously with hardlock, key, or hardware token, giving rise to confusion. Hardware token, for instance, usually denotes a hardware-based identification device. This can be a chip card, USB devices etc. which are used to identify a person.

Dongle, however, is most commonly used for hardlocks which protect software from being copied. Such dongles come with licensed software. The first dongles were for serial and parallel ports. Today there are more and more dongles for USB interfaces. It is such dongles we are looking at in this article.

What Does a Dongle Do and How Does It Work?

A dongle is to protect licensed software from unwanted distribution. Strictly speaking it cannot prevent copying the software – that is relatively easily done. But without the required dongle this software will not function. If the software is started on the computer it checks first whether the required dongle is inserted, too. Should this not be the case, it refuses to operate or runs with limited functional range only. The unlimited range of the software is only available in conjunction with the dongle. The dongle makes sure that a user can only access the licenses he bought for a certain software at a time.

As dongles are difficult to copy this is considered a safe security measure. Dongles are mostly used for expensive software worth several thousand US dollars, whereas the actual cost of production per dongle is about ten dollars. Software typically protected by dongles include CAD/CAM software, digital audio workstation applications, prepress and printing software, and software for enterprise resource management, finances, payroll accounting etc.

All dongles need to electronically exchange data with the host (e.g. the computer to which they are locally attached). The most simple mode of operation of dongles is a "passive" one. In such cases, the software includes a function which checks whether the dongle is attached or not, allowing for only two values (true/false). The information checked may be a serial number, information about the users etc.

Sticking Point Security: Modern Dongles Are Active

"Passive" dongles are no insurmountable obstacles for hackers. They can extract certain informations from dongles or modify the software so that it always yields the value "true" when checking for the dongle. Current dongle generations are "active", i.e. they include stronger security functions. Here are just some examples:

Code Porting: Dongles utilizing code porting mechanisms include parts or functions of the software they are to protect. These functions are outsourced to the dongle. Without them, the software will not run.

Public-Private-Key encryption: If a dongle utilizes this mechanism, the software includes data which is encrypted with the public key of the dongle. In order to decrypt this data and access the software the dongle must be attached. Such a dongle offers a very high degree of protection as it can hardly be simulated.

Smart Cards in Dongles: Smart card technology provides very strong security features for identification and authentication. Also, it offers data storage (e. g. for code porting, s. a.) and even application processing. Such dongles are used in environments with highest security demands (finance sector, government institutions, and defense organizations).

Dongles Are a Nuisance And Not Fit For All Environments ...

Dongles are not popular with users as these small devices are easily lost, damaged by fatigue, mishandling, or stolen. Additional problems of a technical nature arise when users want to run dongle-protected software in server-based computing infrastructures or environments with desktop virtualization (Citrix XenApp, VMware, Microsoft Hyper V). Dongles are designed for local usage. Terminals, however, do not have USB interfaces and virtualized environments do not provide for the local utilization of USB devices, either.

Accessing Dongles Via the Network?

Because of these problems some software vendors gave up the concept of dongles and developed methods of regulating the access of licensed software available across the network, e.g. via license servers.

A simple way to safely store dongles and make them available via the network is the SEH dongle server myUTN-80, which will be available in September. You will find information on this device on www.dongle-server.com.