How strong is software license security based on reading the computer specifications such as Windows installation ID, hard disk serial number, size and so forth?
I'm researching software licensing security strategies to implement in an enterprise product. It consists of several systems, one of which is a Qt/C++ app run as a Windows Service that captures equipment data and stores them inside a database. We want to provide our clients with the means for them to install the entire system without the need of assistance, but we want a controlled number of instances to be installed per client, so we need a license security system (and focused on the Windows service).
The system is Internet-independent, so some of our clients may want their "main" installation to be in a fully offline environment. Therefore no solution that counts with accessing outside online databases are acceptable. Moreoever, no "Pentagon level" protection is needed: we only need something strong enough to convince our non-technical customers it's better to purchase an official second copy instead of making an illicit one themselves.
With this in mind, it seems there are only two strategies that can be used: either I create a system that stops an unauthorized copy to work, or I use one which doesn't allow two copies to work simultaneously. The second strategy can be applied using dongles and similar, which I want to avoid (extra costs, 3rd party dependency, extra hardware), while the first needs some system to identify if the running app copy is legitimate or not.
It seems to me the only way to implement the first strategy is by linking a product key or similar to the single computer the proper installation is supposed to occur. And the only way of doing things without appealing to obviously weak means such as Windows Registry changes is by locking onto the PC's configurations. The problem is that I read that this approach is a weak one, that such information can easily be spoofed. I'd like to know how strong exactly this solution is. In the meantime, any suggestions of other security models without dongles are also welcomed.