I develop a license server and a license client system (Java based applications).
The flow is the following:
- The license is stored on the license server
- The client application includes a license client component.
- The license client connects to the license server via HTTPS to retrieve the license information.
- The license is not passed to the license client – only the information if the license enabled.
- If the license is enabled the license client returns to the client application the licensed status and it is possible to use the client application.
- If the license is not enabled, the license client starts the evaluation period (for example 30 days). During this period we recommend to our customers to purchase the license.
- If the evaluation period is passed, the license client returns to the client application the unlicensed status and it is not possible to use the client applications.
I have dilemma how to persist the start evaluation time, since if a customer can compromise it and the evaluation period will start once again. I store the license status in the database using AES-256 algorithm, so I do not think a customer will be able to decrypt the information. Also, if a customer will remove the license status from the database it is not possible to use the client application, so I do not care about it.
Similar, I store the start evaluation time in the database using AES-256 algorithm, so I do not think a customer will be able to decrypt the information. But I have a problem if a customer will remove the start evaluation time from the database. In this case I will start the evaluation period from the beginning.
I do want to store the information in the database (to be able in the future to scale up using database replication). Also, I do not want to store start evaluation time on the license server – since it is client issue. More detailed: in the future we want to support the license (and the evaluation time) for different type of permissions. For example, license to execute a job or license to edit a document. Therefore, the customer can be fully licensed to execute a job, but can be in the evaluation period to edit a document.
Any suggestions are more than welcomed.