3

I would like to license one of our (Windows desktop or sever) applications so that it can be used (with a pre-paid key) for a specific number of hours. It should be possible for it to be stopped and restarted and the periods of running chosen by the user. The time does not need to be recorded to the second, minutes would be fine; and though it needs to be proof against fraud by a technically competent user, it does not need to resist attack at the level of government agencies! The app can remain installed (just prevented from being used) until the user later purchases another key. The 'key' must be software only, dongles are not appropriate for this application.

Ideally I would like some ideas about how to implement this securely in our own Delphi (XE) code, but it could equally be done in a separate application in any language, and we could just require that app to be running whenever ours is. I am open to purchasing a component to implement this, but I do not want to pay big money for a licencing tool that does a whole lot more than just this requirement. We already have a license mechanism that can prevent use after a specific date.

frogb
  • 2,040
  • 15
  • 22

4 Answers4

2

I suggest you look into WinLicense from Oreans: http://www.oreans.com/winlicense.php

Their trial licensing does exactly what you want to do. You can easily set a license to expire after so many cumulative minutes.

Winlicense integrates easily into Delphi and has numerous configuration options. I've been using it for the past year and have been very happy with the software and their support.

alt text

RobertFrank
  • 7,332
  • 11
  • 53
  • 99
  • But this doesn't connect to the publisher's server, right? This means that a sufficiently competent end-user can bypass the restriction. – Andreas Rejbrand Jan 20 '11 at 14:35
  • 4
    A 'sufficiently competent end-user' will easily intercept client / server communication and bypass or simulate this dialog. You should stay simple in your protection, as far as it stay simple for the user. – TridenT Jan 20 '11 at 15:19
  • The topic of whether adding this kind of security code is worth the effort, or is unbreakable leads to somewhat of a religious war. Yes, all security can be broken by a "sufficiently competent end-user." Most of us, however, IMO, sell niche products that never get the attention of the professional crackers... – RobertFrank Jan 20 '11 at 19:34
1

Have a web service callable from your e-commerce store that generates a key based on: UserName + Email + DateTime + NumHoursPurchased Use a simple algorithm such as encrypting that string with AES256.

In your app, they'd enter their name, and e-mail. Then they'd paste in the key that they receive from the e-commerce store. Now you know when they purchased it, and how many hours. If the purchase date/time is recent (within the past 30 min?), unlock the app and start your clock. You'll need to track the time yourself, store it somewhere safe, ideally encrypted or obscured.

Chris Thornton
  • 15,620
  • 5
  • 37
  • 62
  • Thanks for your response, but I prefer the similar, but slightly simpler solution suggested by Andreas so I marked that one. – frogb Jan 20 '11 at 21:38
1

When the user buys a few hours of use, you could give the user a (unique) license key, and also store this key on your own web server, licensing.yourdomain.com, together with the amount of hours purchased and the number of minutes spent (the so-called "minute counter") so far (that is, 0). Now, in the application, there is a function CheckLicensed: boolean that is run, by means of a TTimer, for instance, once a minute. This makes a light-weight POST request to licensing.yourdomain.com, sending the license key. The server then increases the minute counter by one. If the minute counter is less then the number of minutes purchased, the function CheckLicensed returns true. If the license has expired, on the other hand, it returns false, and you can disable features or even terminate the application (depending - of course - on the nature of the application).

Of course, when the application is not running, the minute counter will not be increased, and so the license will not be wasted. Also, you might be able to give the user an option to pause the TTimer, but of course, this would also disable a few buttons (as appropriate) in the program.

This approach requires constant Internet access, but that might not be a problem for you. It is very safe. For instance, the end user cannot cheat by changing his system time, or altering the minute counter (since it resides on your server, and only a (US) government agency could access that one).

How to send a POST request? I have given an answer to that question previously at How to send a HTTP Post Request in Delphi 2010 using WinInet

Community
  • 1
  • 1
Andreas Rejbrand
  • 105,602
  • 8
  • 282
  • 384
  • 1
    Thanks, I really like this simple idea. It also gets around the issue of tying a key and software to a physical machine, because if a user were to duplicate the software and the key, the counter would run down twice as fast (and we could also check the sending IP address). My only reservation is whether our webserver's robustness and availability is up to it, but we could probably find somewhere which addresses this issue. I will accept this answer if nothing even better shows up! – frogb Jan 20 '11 at 14:59
  • 2
    I would also probably want to return an answer computed each time from the key, rather than just 'true', to ensure that the response came from us and had not been diverted. – frogb Jan 20 '11 at 15:15
  • Even though we don't license our application by the hour, this is roughly the way we check if a user-license is valid. Its very lightweight and takes almost no time to execute on the client side. We also provide for a grace-period so the application can be used without internetconnection, but that wouldn't be appropriate for your situation. It also allows us to revoke an already outstanding license from our licensedatabase on the server. – Bascy Jan 21 '11 at 08:12
0

I would suggest Software Passport which is built on Armadillo protection engine. It has served me very well for several years.

At one stage you needed an Armadillo pro license to be able to create certificates from which keys can be created that expire by x minutes, but I think that with the advent of Software Passport (Armadillo used to be separate product), it comes standard, though the site isn't very clear about it.

As Software passport is from Digital River, an added advantage is the easy integration with all digital river backed software portal sites as your "shopping cart".

Another advantage, if I understand them correctly (haven't used it), is that you can use something called automatic key delivery in which case the security envelope wrapped around your software contacts the digital river servers and they key is delivered straight into your software. Meaning the user never gets to see the actual key... (pretty handy to prevent key copying by your end users).

Authors: http://www.siliconrealms.com/

Marjan Venema
  • 19,136
  • 6
  • 65
  • 79
  • Thanks for the response, but not appropriate in this case. The app is one part (which we need to restrict by time) of a bigger product not sold in this way. – frogb Jan 20 '11 at 21:25