I have a software product. it will probably run on VMs that have no network connection at all.

I want the user to pay for each VM the user runs.

I thought to ask the user for some kind of hardware ID and provide him with serial that is unique for his machine.

But user can just copy the VM image and than have two machines running?

So I thought of having a security dongle. But how can I prevent user from running two VM's on the same machine both connected to the same dongle?

This should be only basic defense so that actual hacking will be required to breach the license and not only spinning one more VM.

  • 2
    This is pretty difficult but not impossible. I would suggest looking at commercial alternatives who have gotten this solved. – Pieter B Aug 19 '14 at 11:34
  • @PieterB thank you for answering Im not going to invent anything new. but do I have to use dongle in my case? I don't see any other way solving the problem of perfectly cloned machines. – Nahum Aug 19 '14 at 11:50
  • @NahumLitvin - As already suggested. There already exists solutions for the problem you describe. It might not be a perfect solution but thats what you get if you want to support stand-alone virtual machines. – Ramhound Aug 19 '14 at 14:45

A security dongle can easily do what you want, as this is a commonplace requirement. The dongle gives out a sequence of values according to a predetermined pattern. Two copies of your software running consecutively will see two sequences, each valid. Two copies running concurrently will see sequence breaks, where accesses by one copy interrupt the sequence for the other. Talk to your dongle provider for details. That's what they charge money for.

Thinking somewhat laterally, you don't have to solve this problem right away as long as your software expires. Make sure it can only run for some weeks or months and that it needs to be re-activated and/or updated at intervals. It should be easy to ensure that only one copy per licence key can be updated, and that the user would have to then re-clone all VMs. As you learn more about whether you actually have a problem and what shape it is, you can update the software to take increasingly aggressive counter-measures.

It may never be needed. Customers who come to depend on your software but are not paying enough yet are just future sales prospects.


The security dongle is a good idea.

Your software can run handshakes every minute (or second) with the device. If the device fails to respond then your program terminates.

Your dongle, on the other hand, keeps an internal counter and gives out unique hashes every time a session request is made, and has an internal timer that maintains active sessions. Every time a continuation request is made the dongle tracks whether the hash returned matches the expected hash, and if it doesn't, then the continuation request is denied and the program is forced to terminate.

sequence diagram

Now the continuation request response could be in the form of a mutating hash too to make emulation a little more difficult.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.