How to protect an offline proprietary software from being stolen

Question

We are currently developing a software that is supposed to run on every computer of a world wide company which has many domains. We are thinking about security as we want the software to be used only on a company computer.

A particular remark is that we don't want any online security measure, as the software may be run offline only.

Thinking about serial key is nearly useless as a client who leaves the company may take with him the software (with an already validated serial key) with him and use it in another context.

We thought about checking certificate issuer for a specific certificate in the store each time the software is launched (as for all computers of the company, this specific certificate issuer will be the company name). However, using a fake certificate issuer from a non-company computer will also work...

We know that there is no perfect solution, but we just want the most effective solution.

Thanks !

Answer 1

With hardware, a TPM or hardware security token would be a possible solution, provided that an employee couldn't simply take it with him when he left the company (e.g. a TPM that was part of the processor, or soldered onto the mainboard)

If you want to work only in software and you can't connect to a network, the only way I see is some kind of serial numbers which expire. Let's say that you require the user of the software to enter a serial number. The software then stores the date at which the serial number was entered and works until two weeks later, when the next valid serial number must be entered. If the user deletes the file that stores the date, you require immediate entry of a new serial number. You'll have to consider that a user could reset the date on his computer to avoid having to enter a new serial number, so you'll have to protect your software against that (e.g. make sure that every time you start the application, time has moved forward from the last time you started it, make sure time doesn't move forward in steps that are too small, etc). This is hard and won't ever be foolproof, but should give you some protection, e.g. raise the bar a bit for thiefs.

As Tensibai said in his comment, ultimately this is all pointless, because if there is enough motivation, someone will circumvent all the safeguards you put in place to keep your software from being stolen, and once that's done, it'll probably be downloadable from somewhere on the internet like every other piece of software that does something worthwile.

Maybe a better solution to your problem would be to make it more attractive for the majority of possible thiefs to pay you to legally use the software?

Answer 2

First of all, there is no way to do this in a manner that is invulnerable to someone who knows how to use a debugger and modify your program's behavior. There are some basic mitigations you can do, for example checking to see if a debugger is running and shutting down if it is. But there are ways around that, too, if the hacker is determined. You can program the most fancy validation check in the world, but a hacker can just delete that part of the code. This is true of network-based verification schemes too, by the way.

That being said, if you are looking for a modicum of protection against the software moving to unauthorized boxes, you can use a mechanism like this:

1. Create a flat file that only you can edit and only your program can read (e.g. by using encryption).

2. When a company wishes to install the software on a computer, ask them to provide the CPU serial number, MAC address, or other immutable data item from the host machine. You might even add a feature to your program that will generate this for them and put it in a .txt file so they can attach it to an email. Call this a "machine signature."

3. Back at your home office, add the machine signature to the file. The file can contain several delimited records if you need to support more than one machine. Send the file to the customer to drop into your program's root folder on each machine where it is authorized to run.

4. When the program starts, decrypt the file and check each machine signature in the file against the current hardware environment. If a match is not found, shut down.

Naturally, a determined hacker can find the part of your program that checks the file and replace it with bytes that don't check anything (this would be easier than cracking the crypto). But if you're OK with that, the above mechanism will work.