1

I have the requirement that I have to distribute software in SD card. And this application should work without internet. I can share the installation key through SMS.

Since application and installation key are distributing through offline (without internet). Is there anyway to track application installation and restrict users to share software package themselves?

I would expect that the software should not be installable or in-accessible, even they are sharing SD-Card and SMS.

Please suggest right direction on this.

  • If people can read data, they can copy data - doesn't matter if it's an executable, bunch of secret information. In this case, you can't prove that software hasn't been installed reliably, and you can't prove that a given key hasn't been used before (no internet connection, so no central store). You could potentially have a dongle requirement, but that adds a lot of complexity and cost, so it may not be economically sound. There are a few questions about similar situations around on the site. – Matthew Nov 1 '16 at 16:06
  • @Matthew Please can you explain more in dongle based protection? or any other cost effective method. The goal is everything should work in offline. – HILARUDEEN ALLAUDEEN Nov 1 '16 at 16:17
  • Basically, you need some kind of active device which can determine when a single installation has happened. This can't rely on the host computer (which can be tampered with) and has to respond in a way which can't be faked, such as by signing a value sent by the application. Might be viable if your application is really expensive (e.g. $10ks+), otherwise, it's likely to wipe out any profit margin... – Matthew Nov 1 '16 at 16:22
  • @Matthew Is there any possibility in customised device level software? – HILARUDEEN ALLAUDEEN Nov 1 '16 at 17:00
1

Here is an approach that partially solves the problem: Probabilistic encryption to generate installation keys.

When a user wants to install the software, they call you and give you their MAC address. You append the MAC address with the current UTC timestamp and encrypt it with a probabilistic encryption(PCBC or something similar) scheme and send the installation key using SMS.

The computer decrypts the installation keys and verifies the MAC and timestamp. IF the timestamp is of upto a tolerable time before current time (you neeed to factor in slow typing), then the software installs otherwise not.

Please keep in mind that this is not a completely foolproof mechanism. There can be multiple machines installing the software together and doing a MAC spoof. Also, you will have a challenge in keeping the generated installation key to human readable characters.

  • 1
    MAC addresses can be spoofed ... you can also install on a VM and set the physical MAC address to whatever you want. – CaffeineAddiction Nov 1 '16 at 16:25
  • 1
    That is what I wrote in my answer... "Please keep in mind that this is not a completely foolproof mechanism. There can be multiple machines installing the software together and doing a MAC spoof. Also, you will have a challenge in keeping the generated installation key to human readable characters." – Limit Nov 1 '16 at 16:27
  • @Limit Make sense. If I understand clearly, it is like OTP. And end user is novice or normal user, is there any other way to improve transactions? – HILARUDEEN ALLAUDEEN Nov 1 '16 at 16:28
  • Your ultimate purpose is to avoid the same key being used twice. Since the machine cannot talk to others, the onus of generating a fresh token is on you. And in order to make sure that the token is not replayed, the machine has to know the timestamp of the token. That is why you encrypt the timestamp along with the token. – Limit Nov 1 '16 at 16:31
  • 1
    Along with MAC spoofing, I don't see why you couldn't change the clock on your computer as well. So as @Limit mentioned, this is easy to work around if the user knows how the local installer checks the key. – Steve Nov 1 '16 at 20:45
0

If the SD card is just a standard SD card then there is no way to accomplish your end goal. The person installing could just make a backup of the SD card as many times as they want and use the same key.

  • is there any way to restrict user to copy software from SD card? That might helpful to accomplish end goal. – HILARUDEEN ALLAUDEEN Nov 1 '16 at 16:19
  • 1
    No, the whole point of giving your client media is so that there computer can read it for the install ... if the data can be read it can be copied. – CaffeineAddiction Nov 1 '16 at 16:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.