What is a good way to make a "software activation code" system?

Question

I have a software product I am going to release soon. It is built with Java/Spring/Tomcat and will be installed on the customer's local network.

I plan to sell this to corporate customers and I want them to buy an annual renewing license to run it.

I am imagining something like the customer provides me with their company and contact name and they will receive a code in email. They enter the three piece of info ...

Company Name: Vance Refrigeration Inc.
Contact Name: Bob Vance
License Code: A2B2-A3B3-A4B4-A5B5

... and the application is licensed and works for them. Either by "phoning home" or by decrypting the code and activating itself locally.

The license will permit the application to run on X number of servers, for X number of users, with X number of features activated, and it will have an expiry date.

THOUGHTS AND QUESTIONS:

Should I encapsulate all of the license feature details (# servers, # users, expiry date) in that license code and decrypt it locally without having to "phone home" to a verification server?

Is there a way to link the three piece of info so all three have to be entered correctly for it to work? My thinking is, that way the name of the licensed owner is always accurately displayed.

If I require the software to hit a verification server, how often should I have it "phone home" ... and how would you handle deployments that are on internal networks with no outside internet access (I've worked in environments like this).

Is there a good product out there already does of this for me? Don't necessary want to re-invent the wheel.

Answer 1

A good friend of mine once kept an expensive 12-string guitar in a cardboard case locked with the flimsiest padlock imaginable. It was there, he quipped, "to keep the honest people out."

For more than twenty-four years – believe it or not I still sell a copy now and then – I sold an internationally-successful software system (at >$150(USD) a pop ...) which was protected by a scheme just as simple as my friend's padlock. I never lost any sleep over the notion that anyone was stealing copies: yes, I found codes on the Internet sometimes. But the sales kept coming, and so I just kept focused on my customers. (I even freely answered support-questions from people who I knew had not yet bought it ... and, more often than not, they did.)

I never tried to implement a license-server, a "dongle" or anything else of that sort because I did not want to stand in the way of my customers. ("My product puts out fires. If you, dear customer, have a fire, the only thing I want to do is to let you put it out. Thank you for your business. I trust you.")

I did learn one thing: that governments in many parts of the world (and I did sell to "governments in many parts of the world" as well as many other parties ...) by law cannot spend public money on anything that can be obtained "for free." There must be something that they can "buy." And, if the terms of the license call for annual renewal, or anything else, the software must "enforce it." (They don't care how.) They must buy "something" that confers to them the exact thing that they bought. There must be some kind of code, and it must be "unique to them." To satisfy their government auditors ...

Therefore, find a simple and well-accepted scheme that you don't have to write from scratch, and which satisfies the requirements that I just spoke of. But please don't think that "your revenues depend on its 'security.'" If your product is worth paying for, people will do it. Focus your attention on keeping them so happy that they tell their friends. (In all these years, I never "advertised.")

(Of course it goes without saying that you must register your copyright as is appropriate for your country, and include properly visible copyright notices as required by your law. "As always, Mind your P's and Q's.")