5

I'm curious about how time-limited (e.g. 30-day trial) software works.

I know how serial keys are generated and designed, but the time-limiting part is more complicated to understand, because it is not simple to ensure that the system's time is correct (e.g. user change it manually).

Full or "perfect" protection is impossible, but I'm curious to see some proof-of-concept or any suggestions.

I guess that used a trusted NTP server is an early solution, but it's not perfect (required Internet connection).

From my own experience, I have seen software with very robust time-limiting mechanism (impossible to cheat, even if we shut down network, change time manually or so)!

Improve this question
3
  • 4
    @LucasKauffman If DRM is off-topic, why is there a DRM tag with many questions? I think this is a valid IT Security question.
    – Matrix
    Oct 2, 2013 at 10:38
  • @LucasKauffman How is DRM off-topic? It's a security measure. Security measures are on-topic whether they work or not — dissecting how efficient they are is a big part of what we do here.
    – Gilles 'SO- stop being evil'
    Oct 2, 2013 at 12:43
  • I don't care much either way concerning the on/off topicness of DRM. But IMO 1) @Matrix 16 isn't "many". 2) DRM is only obscurity, not security.
    – CodesInChaos
    Oct 2, 2013 at 14:50

1 Answer 1

Reset to default
11

There is no cryptography in there. It is all a matter of state. The application can access the system time, also the hardware clock (that's the clock with a battery which keeps time when the computer is off). The application can also look at the modification dates of various files to try to detect foul play with the system clock; and it can measure elapsed time while it runs and accumulate it (in one of its files).

IF you install the software in a virtual machine, then snapshot the whole VM, and, later on, restore that snapshot completely, taking care to set back the (virtual) hardware clock back to the date of the snapshot and to deactivate the network, then you will be able to fool the time limit. The economic efficiency of this kind of time limit relies on the idea that VM snapshots and clock games are too cumbersome for most customers to use them on a regular basis.

Improve this answer
3
  • Does hardware clock keeps you safe in this scenario: When trial ends format the system, manipulate the system time, then install the software again.
    – Kerim Oguzcan Yenidunya
    Oct 2, 2013 at 11:29
  • 1
    For the time-limit to resist a format, it must store some state information somewhere else. This can be on a server (contacted through network) or maybe in some format-resistant piece of hardware (which would be quite "invasive"). It is technically feasible to store data in the first sectors of a disk, which resists formatting of partitions, but not the complete wipe of a disk (which takes hours and is not recommended for SSD, therefore rarely done).
    – Tom Leek
    Oct 2, 2013 at 11:40
  • @TomLeek An unusual solution might be to construct some of the (product-unique) core business logic circuits from proof-of-work equations; but with an off-site product server having a PoW shortcut. This way the program can run fully without an internet connection but will be slower (perhaps much slower) than if it routinely authenticates against a product server. This means less business logic needs to be run "Diablo 3 style" on a remote server, while achieving a scalable disincentive to exceeding the re-authentication objectives such as trial time-limits.
    – LateralFractal
    Oct 3, 2013 at 2:35

Not the answer you're looking for? Browse other questions tagged .