I am improving one of the DRMs that I'm using for my software, and I have a few questions about how to best implement transferable licenses for offline computers. But first, a disclaimer - I am very well aware that a perfect DRM does not exist, that they all can be cracked, and that there are off-the-shelf DRMs available. I am implementing my own because I want to learn, it's an interesting challenge, and I am willing to accept less than perfect result. And above all, user convenience is more important than perfect security. I just want to create a DRM that is reasonably secure, and can't be beaten accidentally or with some basic registry tweaking.
My current implementation is this:
Distribution:
- Application executable is public to download. A license key is issued to the client, valid for a single machine, for a certain time period.
- When that license key is generated, it is also added to the license server database, along with the information of the license expiration date, client name, etc.
Activation on client computer:
- Client enters the key into the application. Application connects to the license server, and checks if the entered key exists on the server database. If it exists, application sends unique hardware ID of that computer to the license server to be paired with that license key.
- Server adds the hardware ID to the database, then takes the hardware ID, appends the license and the expiration date, creates a RSA signature for it, and also adds it to the database. The license is now registered to that specific computer on the server database.
- If the user tries to activate the license on another computer, server responds that another hardware ID is already registered, and must be deactivated first.
Deactivation on client computer:
- Client clicks "deactivate". Application connects to the license server, and sends the license key for identification, along with the request to unregister that computer.
- Server clears the hardware ID and the RSA signature from the database, allowing the client to activate this license on another computer.
Validation:
- Again, application sends the license key and hardware ID to the server.
- If the hardware ID registered on the server matches the hardware ID sent by the application for that license key, server sends the RSA signature to the application, with the license expiration date appended to it.
- Application then takes the license key, along with the hardware ID and the expiration date (the combo that was used to generate signature on the server), and then does a RSA verification of it against the received signature to make sure it is valid.
- If valid, and the current date (pulled from the server) is less than the expiration date, the application is unlocked. All these steps are automatic and require no input from the user.
Problems:
- Some users want to activate license on an offline computer. Meaning the activation/deactivation can be done online, but validation must be performed offline when the application is launched. This implies that the RSA signature received from the server must be stored on a computer (in a file, on Windows registry, etc). So, if the user wants to use his license on another computer, he can simply save that signature manually before deactivating the license, and then restore it afterwards. As long as the application cannot check in with the license server, it won't be able to see that the license is being used on another computer.
- Complicating the matters further, some users want to do activation/deactivation offline as well. Meaning I would send them the activation key via e-mail. This way, I have absolutely no idea how to implement license moving from one computer to another, as any information about the license state saved by the application on the computer can easily be saved/restored by the user.
- Also, if the computer is kept offline, the application cannot check the current date from the server, and so it cannot make a valid comparison with the license expiration date. Then it has to check date from Windows, and that date can be easily changed via Windows Settings.
Questions: Is there any way to implement offline activation/deactivation/validation with this kind of DRM so the license can be moved from one offline to computer to another?
If not, I can simply advertise that only the online licenses can be moved between computers, while offline licenses are non-movable, and are issued for one computer only per license term (one year). But perhaps there is some way I haven't thought of. The current DRM works pretty fine, and there have been no complaints from the clients about the convenience. But the offline requirement complicates things a bit. I would appreciate if anyone could share any thoughts as to how this can be implemented... If at all possible. Again, I don't need the perfect system, just something that cannot be overcome by simple file/registry copying/editing or changing date via Windows Settings.
