Easy Licensing enforcement techniques for C++ Program in Windows

Question

I am developing software in Window 10 and Visual Studio in C++. I would like to restrict the use of the software to a set of computers, by implementing a license control.

My thought is to query a few key parameters from the system such CPU Type, Harddrive Serial Number, MAC address, and create a hash. I would then take the hash on my own computer and encrypt it using a private key and then when the software is used regenerate the hash and compare it to the decrypted value using a public key distributed with the system.

What would a valid (and easy to access) set of values to uniquely identify the system? Ideally, I'd like it to be flexible enough to allow a reformat of the OS but not allow copying the code to another system without permission.

Answer 1

Realistically, there are none. If you make a hash based on the user's hardware, then when they upgrade a hard drive or CPU or network card, or heaven forbid buy a new computer, the software stops working. Users will get pretty angry about that. If I were a business and ran into software like this, I'd stop buying from that developer. If I were a home user and ran into software like this, I'd return it to wherever I bought it from and never buy from them again.

Depending on the type of software, a dongle might be a better solution. Then the user can move it to whatever system they want, but can only run it on the system that has the dongle installed. However, if this is software intended for mobile users, many will not like having to carry the dongle around with them. You'll also have to deal with users losing their dongle.

Another solution is to have a license server that users can connect to. If a license for a particular user is in use, no other user can use the software with that same license. This allows the user to move it to a new computer without worrying about it continuing to work. You could even recognize that it's a new computer and disallow its use from the old one when this happens and have some reasonable policy about how often it can be moved. This suffers from the problem of needing a running server, and the possibility that users will be left in the lurch if the server goes down or your company goes out of business.

Answer 2

For cloud-based licensing (e.g. online license activation), I built Keygen, a software licensing and distribution API, exactly for this purpose. You can set up a license policy which allows a single machine to be associated with a license i.e. a "node-locked" policy, and you can associate a machine with the current user's license by making a request that goes something like this:

curl -X POST 'https://api.keygen.sh/v1/accounts/example/machines' \
  -H 'Content-Type: application/vnd.api+json' \
  -H 'Accept: application/vnd.api+json' \
  -H 'Authorization: Bearer {TOKEN}' \
  -d '{
        "data": {
          "type": "machines",
          "attributes": {
            "fingerprint": "{MAC_ADDRESS_FINGERPRINT}",
            "platform": "Windows",
            "name": "Office Laptop"
          },
          "relationships": {
            "license": {
              "data": {
                "type": "licenses",
                "id": "4097d726-6cc5-4156-8575-3a96387e19b4"
              }
            }
          }
        }
      }'

The easiest way to "fingerprint" a machine would be to use the MAC address, and if that value ever changes (e.g. they bought a new PC), it's easy to prompt the user to remove their old machine association and replace it with their new machine.

Now you can validate their license key within the scope of the current machine's fingerprint; the validation will return invalid if the machine fingerprint doesn't match.

Answer 3

Like user1118321 mentioned, it's difficult to uniquely identify a device, since not all operating systems give access to the same hardware variables. As this user mentioned, there is also a challenge to move a license to a new device or allow multiple devices to share a license, and if you take a license server approach, server uptime is critical.

My company built a licensing server that works with C/C++ applications by using our SDKs. There is a C++ SDK for Windows / Mac and several Linux distributions that can uniquely identify a device with a device fingerprint, used when activating or performing license checks. You can also transfer licenses to new devices or allow multiple uniquely identified devices to use the same license, depending on how you configure the entitlements. Concerning service availability, we are hosted on AWS and have over 99.9% uptime, and our SDK also generates a local license file once activated to fall back on in case there is no internet connection or a service outage, for example. There are free and paid tiers available for our licensing enforcement mechanism.

Dislaimer: I am a co-founder of LicenseSpring