-1

I want the user to temporarily have full access to the software, after which a permanent license would be required.

Assuming every build has only one user (and different builds are binarically different), what approach can be taken for securing unlicensed access, using a product key?

I'm targeting a niche market in which it's unlikely for competitors to share the software.

(There's no limit to the length of the product key, as it can be sent as a text file.)

4

There is no way to do this. You simply can't verify the software is not used on a million other devices with the same key without online connectivity. That is why DRM is a waste of time and money.

  • I'm targeting a niche market in which it's unlikely for competitors to share the software. – Sparkler Apr 20 '18 at 17:08
  • 1
    @Sparkler then why are you concerned about key sharing in the first place? – Adonalsium Apr 20 '18 at 17:41
  • @Adonalsium I'm not, the only function of the key is to grant permanent license after the customer paid in full. – Sparkler Apr 20 '18 at 18:56
  • 1
    @Sparkler It is hard to make something work only certain amount of time, because the users can manipulate the clocks, reinstall the software and so on, but doing what you want is sort-of possible assuming they will not attempt to crack it. Either just hardcode the key into the program in a hashed form, so it can't be easily retrieved, or use public key cryptography. Put a public key into the SW and sign something like "PRODUCT::ACTIVAE" with the private key. – Peter Harmann Apr 21 '18 at 10:33
  • @Sparkler Yes, both methods can be easily cracked, but then again, the user can just share the bought key in the first place. Doing anything more fancy would be difficult, as the program needs to function without the key for a period of time, so you can't really encrypt it or anything like that. – Peter Harmann Apr 21 '18 at 10:37
1

If you are willing to put a lot of money at it, you can use hardware tokens with an integrated clock.

How secure it will be? Depends on your users, the price of the full license, and the safety mechanisms on the token. If the users are not much skilled and the full version costs less than the computer it runs on, few users will bother breaking the software to remove the lock. In this case, any cheap hardware token with basic security will be enough.

But if the software costs way more than the computer it will run and you have specialized users, you will be better to use a high security hardware token, with trusted execution environment and anti-tampering technology.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.