TL;DR How do you build an airtight license control system for your onprem application, which revokes access once subscription ends?
I am building this application in Python that needs to be deployed on premise of the client. This application runs constantly like a service spewing out stats. This application is based on a subscription model.
- Ensuring the IP is intact as the application resides on the client.
- Achieving this by building a binary using Cython
- When subscription ends the application should not run.
- Thinking of using HOTP(HMAC based OTP) so each client will have a seed baked into the executable. HOTP uses a seed and time to generate a symmetric key. So for every time slot say 1 month, a new key should be given to the executable.
- Is there a better way to achieve this?
- How can the application keep time in tamper-proof way? (As OS time is not reliable).
How do I store the count of time slots in a secure way such that it cannot be hacked?
- As this is a service that is always running, how do I enforce a check at the end of a time slot like 1 month? Also as the application is on-prem, it can be shut down.
One ugly way is encrypting and storing an timer.txt which is constantly updated by a separate python process. Is there a better way?
The above is with consideration of no-internet.
But even if internet exists, it does not guarantee a fool-proof solution, because the network can be monitored and calls to an API can be redirected to a local service with the same name. Does this mean there should be two-way SSL here?