How can I license networked applications?

Question

I have five applications residing on server(s). Some of these applications are socket (C/C++) based, others are web based (Java, PHP). I need to give licenses to these applications on the basis of the number of users that can access, the type of functionalities and type of users. What kind of business model should I use? I have a few in mind:

1. Create a java webservice that will be mounted on a license data, and all the servers will communicate with it when a user logins to any of the above applications.
2. Do a socket based server.
3. Mount a license file on each server and make each one communicate with its file individually and act as the license rules.

If you have other solutions please shoot.

Answer 1

Use a local digitally signed license file encoding business rules

I've split my answer to cover generally accepted requirements, a matching business strategy and the technical aspects of the problem.

General requirements

Few things annoy users more than having their work interrupted as a result of a license issue. To that end you want to have a system that:

• is resilient against network and hardware failure (no single point of failure)
• scales well (new servers and more users arrive as the business grows)
• is resilient against forgery of licenses
• warns administrators when they are approaching the limits of their license
• doesn't ever present a false positive (if unsure allow access is the rule for customer-friendly licensing behaviour)

to name but a few.

Business strategy

Your company will want total control over the license, otherwise the customer will manipulate the values to their advantage. However, the customer will not want your company looking over their shoulder and so the system will need to be self-contained on their site.

The customer will not want their entire system to fail if a license is unable to be verified. This obvious demand rules out a networked cental authentication approach because it could fail for a multitude of reasons (network, poor coding, power outage, hardware failure etc). While the central license authenticator is being repaired (could be days to get that done) the customer is unable to do anything - totally unacceptable.

With the above in mind, the strategy to keep your customer happy is to take a bit of a hit in terms of maintenance by using a local license file containing the rules for the given server.

Technical implementation

To achieve that goal, and minimise the hit, I would suggest that you will need to do the following:

1. Write a license configuration tool for your company. This file defines the user limit, allowed functions, and user types for each product in the form of a digitally signed license file issued by your company using a private key.

2. The servers must load the license file and verify the digital signature using your public key which is hosted on a well-known public key site (pgp.mit.edu) or embedded directly in the code on startup or after maintenance

3. Each server verifies it's current user load, type and tasks against the signed license file as traffic occurs. Loading approaching the limit of the license should trigger an email or message to the system administrators.

4. Servers can update their license file in response to a socket-based PUT request that has a suitable digital signature (again verified by the remote key site). This will allow an automated script to provide license changes when one of your guys is on site providing maintenance.

Answer 2

Are you sure that you want to write this?

Have you looked into existing license control applications/services?

If the cost is not prohibitive, this sounds like a classic not-worth-inventing-here application.

Answer 3

I think you should look at the FlexLm.

For awhile SUN was using it to provide distributed licence services for their products.