How to implement copy protection in website product?

Question

My company has a website product (ASP.NET) which is sold to customers. It means we don't host the website. They install it on their server and run it in the intranet.

I need to implement some sort of copy protection mechanism so that not everyone ends up installing the website. It has following aspects:

1. It has to be completely software based (no dongles).
2. Hiding usage information in registry or some folder in c:\ (basically outside virtual directory) is not an option for a website

Please can you suggest any scheme/method?

Answer 1

Something you could try. Compile binaries for each client, obfuscate the code, lock the site down to a single domain. If its an internal app the domain might be something like "productname.clientname.internal". The app checks the domain of all the incoming requests, refuses anything that doesn't match.

As already pointed out by jeffamaphone: people will find ways around it, but it's enough to 'slow down' those not super determined.

Answer 2

One suggestion is to use some kind of web service running, of course you need to have a main server to do so. In this server you can have some of your clients servers data (IP of the authorized servers, CPU and Motherboard ID's, and other important data).

This web service has to run some important logic of the program and return a value to the authorized servers. If the data of autorization sent by the client doesn't match, the server do will not execute the routine.

Of course I assume that this side of the logic is included in a DLL in the application and not in plain code.

Answer 3

A technique that worked well for a buddy of mine was to install a web bug on an administrative page which would report back to their server. You can monitor when and where the application is installed. It could be easily removed, but won't by most customers.

Simple, easy to do, and works relatively well.

Answer 4

[disclaimer]I sell the product I am recommending.[/disclaimer]

Take a look at DeployLX. You can add licensing to your web based application to require one of a couple different options.

1. Hardware based locking so it can only be used on one machine.
2. Domain based locking so it's tied to a specific domain name.
3. IP based locking to tie it to an IP address.
4. License server locking to that your app checks in periodically with a centralized web service.

It's pretty flexible and should let you create a balance between protection and not frustrating your users.