How strong is software license security based on reading the computer specifications such as Windows installation ID, hard disk serial number, size and so forth?

I'm researching software licensing security strategies to implement in an enterprise product. It consists of several systems, one of which is a Qt/C++ app run as a Windows Service that captures equipment data and stores them inside a database. We want to provide our clients with the means for them to install the entire system without the need of assistance, but we want a controlled number of instances to be installed per client, so we need a license security system (and focused on the Windows service).

The system is Internet-independent, so some of our clients may want their "main" installation to be in a fully offline environment. Therefore no solution that counts with accessing outside online databases are acceptable. Moreoever, no "Pentagon level" protection is needed: we only need something strong enough to convince our non-technical customers it's better to purchase an official second copy instead of making an illicit one themselves.

With this in mind, it seems there are only two strategies that can be used: either I create a system that stops an unauthorized copy to work, or I use one which doesn't allow two copies to work simultaneously. The second strategy can be applied using dongles and similar, which I want to avoid (extra costs, 3rd party dependency, extra hardware), while the first needs some system to identify if the running app copy is legitimate or not.

It seems to me the only way to implement the first strategy is by linking a product key or similar to the single computer the proper installation is supposed to occur. And the only way of doing things without appealing to obviously weak means such as Windows Registry changes is by locking onto the PC's configurations. The problem is that I read that this approach is a weak one, that such information can easily be spoofed. I'd like to know how strong exactly this solution is. In the meantime, any suggestions of other security models without dongles are also welcomed.

  • 1
    Depends on how "non-technical" your customers really are. While it may be possible to spoof hardware info, are your customers savvy enough to make it happen? There's also a 3rd option: a licensing server that the client runs on their own network that knows all of the approved license keys. It would still require the client devices to be networked (the inability to connect would be considered a license failure), but at least it wouldn't be reaching across the internet. – Mr. Llama Jul 9 '18 at 16:26
  • 4
    How are you going to deal with virtualization? A very large amount of software works today via running on VMs. Also consider that copy protection is an anti-feature. People change hardware around all the time, and you'd only be pissing off legitimate customers if you took this approach. – Steve Sether Jul 9 '18 at 16:29
  • 2
    Anyways, any HW check like you want doesn't need to have faked HW info to be circumvented. Changing your program is much easier. The same is true for any dongle requirement - I'd just remove it from the program instead of trying to make a fake dongle. (Sure, it can be made hard, but never impossible. And most likely the time would be useful for other things.). – deviantfan Jul 9 '18 at 16:40
  • 1
    @SteveSether How do you check IP on network not connected to the internet? Local IP changes all over the place because of DHCP and internet public IP is not a thing. Also, dynamic IPs. Also the same problem as with HW ids, how do you keep track without internet? – Peter Harmann Jul 9 '18 at 16:49
  • 2
    @SteveSether Have fun with more than half of the customers calling every day. And how this prevents multiple installs anyways? Thousands of computers with the same IP is easy, and the usual situation in big companies. – deviantfan Jul 9 '18 at 16:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.