in my firm, most of the software is secured by a couple of different antiquated licensing systems. For example, after setup the user has to start another program that tells him his calculated machine id. He needs to send us this id, which is embedded in a file, encrypted and shipped with another setup, that just copies the file in the relevant folder. Not only does this generate a lot of workload and a hurdle for the user, the decryption key needs to be embedded in our software and can easily be extracted, allowing the user to circumvent this "security" measure.
After developing my first application for this company, I would like to develop a prototype for a more advanced licensing system with my own service. I'm looking to run my general plan by you, I'm sure I've overlooked some things and would like to have them pointed out before bringing it to management..
- Client automatically receives a license key after registration
- Client enters this license key into my application
- Application sends this key with machine information and sends a
GET_LICENSErequest to our server
- Server checks if license key is in our system and returns a pgp encrypted message to client
- Client uses its embedded public key to check the license file and the sign date (which should be secure, (as long it was signed on our side](http://www.pgp.net/pgpnet/pgp-faq/pgp-faq-message-signatures.html))
- If there is no internet connection, start the application if license file is available and sign date is not older than n days
- Update the license file every time a internet connection is made
Now I realize there is no complete safety, but this should give us a lot more security and benefit our honest customers with a more comfortable experience than before. A internet connection would only be required on first start and then every other day, but our application already needs a connection for most tasks. We would save the man hours for the manual license creation and communication with the customer while allowing him to sign up and use our application no matter of our office hours and availability. No credential information could be extracted from our application.