Wireflow WF 2007 User manual

WireFlow AB, 2013
WireFlow Security Suite
User’s Manual
AC0045-002 rev C

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 1
Contents
Support information ...................................................................................................................2
Technical support and Product information ...........................................................................2
WireFlow headquarters...........................................................................................................2
Introduction................................................................................................................................3
How it works ..........................................................................................................................4
Using asymmetric keys...........................................................................................................6
The components......................................................................................................................7
The dongles.........................................................................................................................7
The Security Suite Programming application.....................................................................7
The LabVIEW drivers.........................................................................................................7
The technology behind the Security Suite..................................................................................8
SHA-256.................................................................................................................................8
Hash functions........................................................................................................................8
The implementation in the Security Suite ..............................................................................8
Symmetric keys...................................................................................................................8
Asymmetric keys ................................................................................................................9
The USB Hardware..................................................................................................................10
Dimensions........................................................................................................................... 10
Electromagnetic Compatibility.............................................................................................11
CE Compliance.....................................................................................................................11
The WF 2007........................................................................................................................11
The WF 2008........................................................................................................................11
Security Suite Programming Application ................................................................................12
Requirements........................................................................................................................12
Installation and licensing......................................................................................................12
Description of the front panel objects...................................................................................13
Using the program ................................................................................................................15
Factory setting...................................................................................................................15
Managing a dongle............................................................................................................15
Configuration files ............................................................................................................16
The WF USB Security dongle driver .......................................................................................16
Requirements........................................................................................................................16
Installation ............................................................................................................................16
Device driver for Windows...............................................................................................17
Installed items...................................................................................................................17
The basic VIs........................................................................................................................17
The intermediate VIs ............................................................................................................19
The WF Authentication module...............................................................................................20
Requirements........................................................................................................................21
Installation ............................................................................................................................21
Installed items...................................................................................................................21
The VIs .................................................................................................................................22

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 2
Support information
Technical support and Product information
www.wireflow.se
[email protected]
WireFlow headquarters
WireFlow AB
Theres Svenssons gata 10
SE-417 55 Göteborg
Sweden
© WireFlow AB, 2014

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 3
Introduction
This chapter gives a brief introduction to all parts included in the WireFlow Security Suite. If
you prefer hands-on practice, you may skip this and instead go directly to the Quick guide
document: “AC0045-003 WF Security Suite - Quick Guide”
The WireFlow Security Suite is a comprehensive solution that ends IP protection issues
relating to unlawful copying of LabVIEW code. Not only does the Security Suite prohibit
theft of code, the system also enables user identification and system feature control.
The WF Security Suite uses dongles, "hardware keys" to protect the LabVIEW applications.
Software protection dongles have been used since late 1970s, and is a well-proven, intuitive
and robust method to handle software licensing.
The WF Security Suite uses hardware dongles and LabVIEW software drivers based on the
industry standard SHA-256 hash algorithm with 256 bit keys, guaranteeing a rock solid
solution.
The WF Security Suite is fully compatible with all LabVIEW platforms, including LabVIEW
for Windows, LabVIEW for Mac, LabVIEW Real-Time and LabVIEW FPGA.
The WireFlow dongles may thus be used to protect all LabVIEW hardware targets such as
desktop PCs, PXI, Compact RIO and Compact DAQ chassis.

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 4
It is easy to protect a LabVIEW application by adding security routines to the code using the
WF Security Suite LabVIEW driver. The security functionality can be anything from a simple
license key check at the start-up of the application, to a complex set of functions to handle
user identification and privileges or to handle demo expiration timers.
How it works
The security dongles may be thought of as an ordinary USB flash memory which cannot be
read, written or duplicated by anyone that doesn't know the secret master code of the dongle.
The LabVIEW developer can use this to implement a variety of security functions in the
LabVIEW application. One basic security function is to make sure that the application does
not start in case there is no dongle with the correct key present in the system. The flow chart
and LabVIEW code for such an application would look something like this:
End
Dongle
Key ok?
Main
program
Yes
No
Start
Flow chart LabVIEW implementation
In the example above it is the LabVIEW VI CheckCryptoKey.vi (the one with the key symbol
on the icon) that checks that the Key 5 memory in the dongle has the correct value. The
communication between this LabVIEW VI and the dongle is encrypted to avoid the system
being hacked. Please see chapter The technology behind the Security Suite for more details
regarding this encrypted communication.
Before shipping the LabVIEW application to the end customer, the application must be built
into an .exe file (or .rtexe or .lvbit etc) to make sure that the end user cannot find the secret
key by analysing the source code. (Or use asymmetric keys to prevent end user to find out the
secret key even if he can analyse the source code. Please see the chapter Using asymmetric
keys for more information).
A mentioned before the dongle may be thought of as an ordinary USB flash memory that
holds secret keys and data. The WireFlow dongles have a memory structured like this:

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 5
Master Key Key 1
Key 2
Key 3
Data Field 1
Data Field 2
Data Field 3
Key 4
Key 5
Key 6
Read Key
Write Key
Arrows indicate parent
Key for a specific operation
Key 7
Key 8
Each rectangle represents a 32 byte (256 bits) memory cell. The 9 keys can be written and
"queried for match" but cannot be read. The data fields can be both written and read.
When doing a "query" it is checked if a key has a specific value. The result of this query is
True or False.
To read a data field, the value of its parent key must be specified.

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 6
To write a new value to a key or data field, the value of its parent key must be specified.
Using asymmetric keys
There is a more advanced way of protecting the secret key, by using asymmetric keys.
By using asymmetric keys you never have to store the actual key in your application.
This means that even if someone looks in the source code they can’t manufacture their own
dongles using that information.
To use this function the secret key must first be run through a hash algorithm. This can be
done using the VI CreateHashFromKey.vi in the Dongle Authentication driver or the hashed
key can be seen in the Security Suite Programming Application (see more in the chapter on
the Security Suite Programming Application).
After a hashed key is created (either in the Security Suite Programming Application or by
using the authentication driver), the check should be implemented by setting the input
“hashed key? (FALSE)” to true and to use the hashed key as key value.

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 7
By doing this the real key will never be present in your application.
The components
The WireFlow security suite provides a complete set of components used to add software
security to LabVIEW applications.
The dongles
Two types of dongles are currently available:
The WF 2008 is an USB dongle for standard LabVIEW for Windows, Mac and Linux.
The WF 2007 is an USB dongle for LabVIEW RT (Real Time) platforms.
The Security Suite Programming application
The programming application is a Windows application used to program and manage the
dongles. It is with this application you program the secret keys into the dongles.
The LabVIEW drivers
The LabVIEW drivers are used to add software protection into your applications. There are
actually two sets of drivers
The WF USB Security dongle driver is the basic driver to communicate with the USB
dongles and to do key validation etc.
The WF Authentication module contains low level functions used by the WF USB
Security dongle driver. It can be used by itself by advanced users that need advanced
security functions, such as separating the dongle communication from the
authentication control into separate targets etc.

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 8
The technology behind the Security Suite
This chapter will go through the basic functions of the technology that is used in the Security
suite. After you read this chapter you will have a better understanding of the functions that the
Security Suite offers.
SHA-256
The key functionality in the Security Suite is built around the SHA-256 algorithm. This
algorithm is part of the SHA 2 family which is used throughout many different applications
today.
The SHA-2 hash function is implemented in some widely used security applications and
protocols, including TLS and SSL, PGP, SSH, S/MIME, Bitcoin and IPsec.
Hash functions
The SHA 2 family is based upon the use of hashes.
A hash function is an algorithm that transforms (hashes) an arbitrary set of data elements,
such as a text file, into a single fixed length value (the hash). The computed hash value may
then be used to verify the integrity of copies of the original data without providing any means
to derive said original data.
As the name implies the SHA 256 is built upon hashes with the internal length of 256 bits (32
bytes).
The implementation in the Security Suite
The WireFlow Security Suite uses SHA-256 in conjunction with random numbers to make the
password comparison. Two slightly different sequences are used depending on the type of key
that is used, i.e. symmetric or asymmetric keys. (Note that this is a schematic picture and may
not exactly represent every input and output of every step in the process.)
Symmetric keys
1. Both the dongle and the LabVIEW driver generate a random number and these
numbers are sent to each other. The use of random numbers will make the SHA-
256 result different every time it’s run, thus making sniffing on the interface
between the dongle and the LabVIEW code useless as there will be a different
result every time.
2. Both the dongle and the LabVIEW code combine the secret key and the two
random values created in step 1.
3. A SHA-256 calculation is made on the result from step 2.
4. The driver gets the result from the SHA-256 from the dongle and compares this
to its own SHA-256 result. If the secret key has the same value in both dongle
and driver, then the SHA-256 results will match.

WireFlow AB, WireFlow Security Suite
© WireFlow AB, 2014 AC0045-002 rev C 9
LabVIEW
software
Random
SHA-256
X=Y?
Pass/Fail
SHA-256
Security
dongle
Random
SHA-256 SHA-256
Secret keySecret key
Asymmetric keys
The difference here compared to the symmetric keys is that the hash of the secret key is done
offline in advance for the LabVIEW part. Since only the hashed key is stored in the LabVIEW
software the secret key cannot be obtained even if studying the LabVIEW source code.
LabVIEW
software
Random
SHA-256
X=Y?
Pass/Fail
SHA-256
Security
dongle
Random
SHA-256
Secret key
SHA-256
Secret key
Hashed key
Offline
preparation