5

I am developing software in Window 10 and Visual Studio in C++. I would like to restrict the use of the software to a set of computers, by implementing a license control.

My thought is to query a few key parameters from the system such CPU Type, Harddrive Serial Number, MAC address, and create a hash. I would then take the hash on my own computer and encrypt it using a private key and then when the software is used regenerate the hash and compare it to the decrypted value using a public key distributed with the system.

What would a valid (and easy to access) set of values to uniquely identify the system? Ideally, I'd like it to be flexible enough to allow a reformat of the OS but not allow copying the code to another system without permission.

  • 2
    A lot of commercial software licensing checks (e.g. using the popular "flexlm" license management system) just use MAC address. Unless you need something particularly secure against attempts to subvert it, this should be good enough for most cases, IMO. – Jules Oct 1 '17 at 7:07
10

Realistically, there are none. If you make a hash based on the user's hardware, then when they upgrade a hard drive or CPU or network card, or heaven forbid buy a new computer, the software stops working. Users will get pretty angry about that. If I were a business and ran into software like this, I'd stop buying from that developer. If I were a home user and ran into software like this, I'd return it to wherever I bought it from and never buy from them again.

Depending on the type of software, a dongle might be a better solution. Then the user can move it to whatever system they want, but can only run it on the system that has the dongle installed. However, if this is software intended for mobile users, many will not like having to carry the dongle around with them. You'll also have to deal with users losing their dongle.

Another solution is to have a license server that users can connect to. If a license for a particular user is in use, no other user can use the software with that same license. This allows the user to move it to a new computer without worrying about it continuing to work. You could even recognize that it's a new computer and disallow its use from the old one when this happens and have some reasonable policy about how often it can be moved. This suffers from the problem of needing a running server, and the possibility that users will be left in the lurch if the server goes down or your company goes out of business.

  • In this case the code is prototype code to be run on the hardware provided for them to run it on. They should not and will not be modifying the system as I own the system it will run on. – Steve Oct 1 '17 at 2:08
  • 7
    If you are selling software with hardware your approach looks good - but you have to think how to protect yourself against virtualization hack - I mean it is rather easy to clone the existing system into the VM and start cloning this VM. – Artemy Vysotsky Oct 1 '17 at 5:24
  • 5
    How sophisticated is the user of this software? If you own the hardware, would something as simple as checking for a particular registry key that only exists on that machine suffice? It seems like if you control the hardware, then you could check whatever aspects of it you want. – user1118321 Oct 1 '17 at 5:31
  • except this is exactly what windows does – Ewan Oct 1 '17 at 9:01
  • @user1118321 I don't think the user will be willing to do hardcore cracking in order to subvert the system. – Steve Oct 1 '17 at 16:13
0

For cloud-based licensing (e.g. online license activation), I built Keygen, a software licensing and distribution API, exactly for this purpose. You can set up a license policy which allows a single machine to be associated with a license i.e. a "node-locked" policy, and you can associate a machine with the current user's license by making a request that goes something like this:

curl -X POST 'https://api.keygen.sh/v1/accounts/example/machines' \
  -H 'Content-Type: application/vnd.api+json' \
  -H 'Accept: application/vnd.api+json' \
  -H 'Authorization: Bearer {TOKEN}' \
  -d '{
        "data": {
          "type": "machines",
          "attributes": {
            "fingerprint": "{MAC_ADDRESS_FINGERPRINT}",
            "platform": "Windows",
            "name": "Office Laptop"
          },
          "relationships": {
            "license": {
              "data": {
                "type": "licenses",
                "id": "4097d726-6cc5-4156-8575-3a96387e19b4"
              }
            }
          }
        }
      }'

The easiest way to "fingerprint" a machine would be to use the MAC address, and if that value ever changes (e.g. they bought a new PC), it's easy to prompt the user to remove their old machine association and replace it with their new machine.

Now you can validate their license key within the scope of the current machine's fingerprint; the validation will return invalid if the machine fingerprint doesn't match.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.