How steganography improves security

Steganography is the science of concealing information in plain sight, and it applies to software licensing in a powerful way. This article explains the general concepts of steganography and how a licensing system can use the technique to make your licensed applications more secure.

What is steganography?

Steganography is the science of concealing information in plain sight. The word combines the Greek words steganos, meaning "covered, concealed, or protected," and graphein, meaning "writing." A simple example is a secret message written with invisible ink on paper. Throughout history, citrus fruit was used as invisible ink, because once it dried the written message was undetectable. Applying heat to the paper caused the citrus ink to reappear, and the message became readable again.

Computers and steganography

With modern computers, steganography has become much more complex. This makes the hidden message difficult to detect and decipher unless you know it is there and you also know the method that was used to hide it.

A common computer technique is to hide data or text (the payload) inside the data of an image (the carrier) without any noticeable change when viewing the image. By slightly adjusting each pixel of the image in accordance with a bit of the payload data, the payload is placed within the image data, and to the eye the image appears unaltered.

Besides images, other possible carriers include the lowest bits of audio data, video data, and hidden characters in text files.

Why use steganography to hide license files?

Most licensing systems use license files, which contain all of the license data or parameters needed by an application. This includes data such as the type of license being issued, expiration dates, which application features or modules may be used, which system is authorized to use the license, additional data about the customer for whom the license is registered, and any custom data required.

The primary reason to use steganography with a licensing system is to hide the license files "in plain sight" to help prevent tampering with the license data. Encrypted information attracts attention. Someone trying to tamper with a license may also be more inclined to look for the application's license information in the Windows registry or other hidden folders rather than in an image file, such as the application's splash screen. Hiding the license in a location that does not attract attention provides yet another layer of protection.

How does PLUS5 use steganography?

With Protection PLUS 5 SDK, API functions are available to store both primary license files and what we call "alias license files." Alias license files are simply hidden, synchronized copies of the primary license file.

Alias files make it more difficult for users to do things like back-dating their system and restoring old copies of license files. They are especially important when issuing time-limited licenses (such as evaluation/trial or periodic/lease licenses) and when allowing transfer and deactivation of licenses. If a license is deleted or altered, an alias file may restore the license to its previous state.

How do I use steganography with PLUS5?

The Protection PLUS 5 SDK makes it easy to implement steganography with the license file and alias files. The basic approach is:

1. Set the license file name to point to a supported image file.
2. PLUS5 then automatically uses steganography to encode the license into the image data.

There is nothing more you need to do. The same applies to alias license files, so you can hide synchronized backup copies of the license inside images as well.