Sentinel LDK is the Thales toolkit that software vendors use to protect an application and to enforce its licence terms, and Sentinel EMS (the Entitlement Management System, called Sentinel LDK-EMS in LDK documents) is the back-office system that records customer orders and produces the licences. Sentinel is therefore unusual in a software asset manager’s inventory: the licensee usually buys a third-party product, such as an engineering or media application, and meets Sentinel only as a key, a service or a licence file on the machine. Thales describes the platform as turning orders into entitlements, entitlements into licences, and licences into enforced and measurable usage.[15]
How end users see Sentinel licences
On a customer machine, Sentinel appears in four places.
- A protection key. Thales describes a Sentinel key as a secure container that stores licence terms and permissions. Keys are hardware-based (Sentinel HL) or software-based (Sentinel SL), and software-based licences can be cloud-based.[12] Hardware keys need a physical connection, software keys a local or network connection, and cloud-based keys an internet connection.[12]
- The Sentinel License Manager. It is installed on every machine where a protected application runs and where a protection key is connected, and lets the application locate and query the key.[16] In basic configurations no customisation is needed at the customer site.[16]
- Admin Control Center. A browser-based tool on port 1947 that lets an administrator see which protection keys are on the network, how many users are logged in to each key against its maximum, which Features each key allows and which users are logged in.[13] It is the practical source for a licence inventory of a Sentinel-protected product.
- The activation experience. Customers receive Product Keys and activate them online or offline, described below.
SL UserMode keys are displayed only for the local Windows machine in Admin Control Center.[13] Key status values include Enabled, Disabled for HL keys where tampering was detected, Blocked for migrated keys and Cloned for SL keys where cloning was detected; a cloned key stops the end user logging on until the vendor updates it.[12]
Editions and what a vendor can choose
Sentinel LDK is sold to the vendor, and the vendor’s choices define the end-user model. The platform lists eight categories of licensing business model: evaluation, component-based, metered, locked, mobile, network, sales boosting and perpetual.[3] Within them are named models such as trialware, module-based and feature-based, time-limited rental, subscription, pay-by-peak, standard counter, capacity (CPU, memory or disk), token-based, machine-locked, user-locked, portable, commuter and site licences.[3]
Licence terms are attached to each Feature of each Product. A Feature licence can be perpetual, limited to a number of days from first use, set to expire on a date, or limited by an execution count.[4] A start date can be set for SL AdminMode and SL UserMode keys, and expiration-date licences run from 00:00:00 UTC on the start date to 23:59:59 UTC on the expiration date unless other times are specified.[4] For a Feature used on a network or remote desktop, the vendor can also set the number of concurrent instances and how they are counted; basic keys do not support concurrency or remote desktops.[4]
Unlocked trialware products are not locked to a machine and need no activation for a limited period, typically 30 to 90 days or 30 executions, counted from first use or from licence generation.[1] An unlocked unlimited product lets a vendor use Sentinel for protection while licensing by another mechanism.[1] Catalog: Sentinel LDK unlocked trialware.
Metrics: network seats and concurrency
Concurrency lets a single protection key on one machine be used by several instances of the protected application on other machines. It is defined separately for each Feature, and each simultaneous instance is a network seat, also called a floating licence.[1] Seats are not assigned to specific users: the attributes specify how many instances of the Feature may run at the same time within the customer’s network.[1] Thales gives the example of 10 seats for a Basic Feature and 5 for an Advanced Tools Feature, which lets ten users run the application and five of them use the advanced Feature at once.[1] Catalog: Network seat; rules seats are not assigned to users.
The vendor’s seat pool
A second counting layer sits between Thales and the software vendor. The vendor’s Sentinel LDK Master licence contains pools of network seats: an SL pool drawn on each customer activation and an HL pool drawn each time a key is burned or updated.[2] Where a Product has Features with different seat counts, only the highest count is deducted.[2] Thales illustrates this with 12, 5 and 6 seats on three Features, which deducts 12.[2] On a later upgrade the deduction is the difference between the new highest accumulated Feature total and the previous highest, so adding seats to a different Feature can cost less than its face value.[2]
Unlimited concurrency is charged as a configured number of seats, typically 100.[2] When a vendor purchases seats, Thales adds 10% to the number provided, and seats consumed from a pool are not returned, apart from limited restoration cases.[2] If a new licence needs more seats than remain in the pool and the plan requires seats, the customer cannot activate it.[2] Catalog rules: highest Feature count, 10% uplift, no return to pool, unlimited concurrency.
Detached, cloud and multi-level licences
Detaching. A network seat on an SL AdminMode key with concurrency can be detached and attached to a local machine for a limited time. While detached it is deducted from the available seats on the SL key and it returns automatically when it expires.[5] Detaching works on Windows, Linux and macOS and requires that both the product licence and the License Manager allow it.[5] On-demand detach is done online or through an H2R file produced by an administrator, and automatic detach attaches a licence when the application starts for an Allowed Offline Duration set in the License Manager; a renewed detach can last up to 1.5 times that duration.[5]
Cloud licences. A cloud licence for device-based access must use the SL AdminMode locking type with concurrency, and the vendor needs a Master licence with a valid Cloud Licensing module.[6] When defining a client identity a vendor can limit it to one key ID; without a key ID it is valid for all cloud licences on the license server machine.[6] Catalog rule: cloud licences.
Multi-level servers. For a customer with several sites the vendor defines the total number of seats and the customer decides how to divide them among second-level license servers.[7] Seats cannot be detached from a Product whose Features all have unlimited concurrency, and a detached licence with seats cannot be partially cancelled.[7] Catalog rule: multi-level licence servers.
Entitlements and activation in Sentinel EMS
An entitlement defines the right to use a software package or service: it is an order that specifies the product details, who can use the products and the period for which the order is valid.[9] Each entitlement identifies the quantity that can be consumed, the validity period, whether it may be activated and whether the whole quantity must be activated at once.[9] The customer portal lists the activated quantity and the available quantity for each product.[9] Catalog: Entitlement quantity.
When an entitlement includes customer information, Sentinel EMS emails Product Keys and a link to the customer portal.[8] The customer signs in with a Product Key, may be asked or required to register, and sees the status of the key including activations remaining.[8] From the target machine the customer uses online activation; otherwise offline activation downloads the RUS utility, which generates a C2V file for manual processing.[8] Activation locks an SL key to a specific computer.[1]
Activation of a line item follows an activation method, Fixed, Partial or Full; for Partial the remaining quantity is the available quantity minus the quantity activated.[10] Revoking an activation returns the quantity to the entitlement once the revocation is confirmed or synchronised.[10] The available quantity of an entitlement can be split and the resulting entitlement assigned to another customer or user.[9] The Product Key mechanism for SL keys requires a Product Activation module in the vendor’s Master licence.[11] Catalog rules: Product Activation module, activation and offline activation, revocation, split and transfer.
Packaging variants
Sentinel LDK-EMS can be Thales-hosted or installed on-premises by the vendor, and a vendor with its own licensing infrastructure can use the Sentinel License Generation API instead, which cannot be used in parallel with Sentinel LDK-EMS to update licences for a given customer.[14] The Admin API gives programmatic access to the functions available in Admin Control Center.[14]
Practical notes for licence inventories
- Record the product that embeds Sentinel, not Sentinel itself: the vendor’s agreement governs the commercial terms.
- Use Admin Control Center on the license server machine to list keys, Features, seats and current sessions.[13]
- Treat detached licences as seats in use for the detach period.[5]
- Keep the Product Keys and entitlement identifiers, since activations are limited and revocations return quantity to the entitlement.[10]
Out of scope
This article does not cover the Sentinel Envelope anti-tamper features, Sentinel Software Usage Intelligence, the Sentinel RMS toolkit (see Thales Sentinel RMS licensing) or the commercial price of a vendor’s Sentinel LDK Master licence, which Thales does not publish.