5

I've recently implemented a hardware-locked licensing system with fuzzy-matching to handle changes in hardware without requiring a re-activation, but i need more hardware pieces to match to be more secure / create more reliable fuzzy-matching.

Right now I'm matching against the following:

  • Physical mac address
  • Hard-drive serial number
  • RAM part number / manufacturer / size
  • Processor ID

What are some other machine-specific non-changing hardware serial numbers that would be good to use in this situation, and can be retrieved easily from C#.

Code examples of retrieving such hardware information would be appreciated as-well.

CLARIFICATION

When I said "Non-changing", I mean hardware serials or information that will not change without modifying the hardware in the machine directly. (IE, will not change on their own, or by software)

caesay
  • 16,932
  • 15
  • 95
  • 160
  • 1
    Perhaps the Windows Product ID, which should only change if Windows needs to be reactivated. Why not piggyback on an already existing semi-working activation check? – Joachim Isaksson Sep 23 '12 at 19:29
  • I cant use that because if the user re-installs windows, i still need to allow them to re-activate on that machine. – caesay Sep 23 '12 at 19:31
  • 1
    I'd love an explanation on the downvote. – caesay Sep 30 '12 at 04:48

1 Answers1

6

Having worked at a company that does this kind of hardware fingerprinting, I can tell you that the commercial alternatives are generally pretty solid, but they will all fail in some legitimate cases.

Be aware that some patents in this space are very actively enforced. Some large, successful companies (like Microsoft) who came up with hardware locking algorithms have been successfully sued. If you are very successful in what you do, that may unfortunately happen to you.

If you feel that you need hardware locking, select a company that will make it easy for you to provide customer service to those customers who perform a legitimate upgrade to their system that ends up breaking the fuzzy matching rules. And, be prepared to provide that service quickly and efficiently.

For most use cases, I would warn against hardware locking. It places limitations on your software that will tend to hamper your legitimate customer's legitimate desires to use the software.

Update

Here are a few metrics that can be used in addition to the ones you list. I have not looked into which are particularly easy to get from C#, as most of the code I dealt with at this level was portable C++ with some platform-specific assembly as needed.

  • BIOS checksum
  • Number and type of of processors (Processor ID is not available for all processors)
  • Graphic Card details (often-upgraded part, but provides a little bit of added entropy)
  • Number of attached monitors, screen resolution(s), brands (varies often, but again a little added entropy).
  • Installed fonts that are unusual and highly differentiating (e.g. ignore ones you get from Office, etc.)
  • Mac addess of all installed NICs (e.g. WiFi, wired)
  • Serial of all installed HDs
  • Enumerate other devices (e.g. DVD, CD, built-in card readers)

Keep in mind that laptops plug into docking stations and may get a number of additional ports, new monitors, etc...

Eric J.
  • 147,927
  • 63
  • 340
  • 553
  • While nice advice, given experience, have any more examples of hardware eligible/used for this task? –  Sep 23 '12 at 19:26
  • Added a few other things to look at. – Eric J. Sep 23 '12 at 19:33
  • I have no need for a commercial product, but thanks for the recommendation. I am quite satisfied with how well my own system works, I just need more points of reference to make it more accurate, and fail in less cases. It also integrates with my silent update system. – caesay Sep 23 '12 at 19:34
  • @Caesay: Take it from someone who did it... getting it right 90% of the time is easy. Getting that last 10% right is very hard. Good luck with getting it done. – Eric J. Sep 23 '12 at 19:35
  • 1
    PCI IDs of all installed peripherals may also be useful. They're very seldom changed more than one or a few at a time. – Joachim Isaksson Sep 23 '12 at 19:35
  • @JoachimIsaksson: (and others) feel free to edit my answer if you want to add something like this. – Eric J. Sep 23 '12 at 19:36