We are using standard items such as Hard Disk and CPU ID to lock our software licenses to physical hardware. How can we reduce the risk of customers installing onto a virtual machine and then cloning the virtual machine, bypassing our licensing?
+1
A:
There's not a lot you can do AFAIK, except require periodic online activation.
We have problems with people Norton-ghosting physical machines. Apparently HDD serial numbers are ghosted too.
Blorgbeard
2008-09-26 07:08:50
A:
I know some virtual machine software (at least VMware) have features that allow software to detect virtualization. But there is no foolproof way, it's possible to patch such features away anyway. Mysteriously changing performance (due to CPU spikes in the host) could also be used, reliability is questionable. There is a plethora of "signs of being virtualized", but they tend to be not 100% reliable.
Elias Yarrkov
2008-09-26 07:18:46
A:
If your software runs under a VM, then it will run under any number of cloned VMs. Therefore, the only option seems to prevent it running under a VM at all. Here's an article about virtual machine detection: Detect if your program is running inside a Virtual Machine and one about thwarting it.
By the way, cloning a VM is usually enough of a hassle to deter casual users from bypassing your licensing and those hell bent on cracking will probably find a way to bypass it anyway.
Rafał Dowgird
2008-09-26 07:26:07
+5
A:
License. Tell your users, they may not run unlicensed copies.
We are actually failing to buy a license for a software at the moment, because the vendor is scared of virtual machines: The infrastructure for our department is being moved to a centralized virtualized sollution and we have to fight the vendor to be allowed to buy a license for his software!
Don't be afraid of paying users.
People too cheep to buy licenses are going to look for another sollution and will be too much hassle anyway.
(good luck telling your boss that, though...)
Daren Thomas
2008-09-26 07:34:58
I agree, pirates will be pirates - draconian licensing arrangements only hurt real end users.
Ycros
2008-09-26 07:38:29
Not quite -- good licensing schemes help keeping honest customer honest, as it helps management assess usage and thus pay you appropriately.
jakobengblom2
2008-10-07 17:57:29
@jake: ditto, license servers allow things like having more work stations that licenses.
BCS
2008-10-07 18:08:21
A:
It is a problem, and any savvy user will be able to defeat pretty much anything you do about it. Unsavvy users might get caught by behaviors like VmWare's player that changes MAC and other IDs of the virtual machine when you move it, presumably in a nod to this kind of issue.
The best solution is likely to use a license server instead, since that server will count the number of active licenses. Node locking is easier to defeat, and using a server tends also to push responsibility onto an IT department that is more sensitive to not breaking license agreements compared to individual users who just want to get their job done as quickly as possible.
But in the end, I agree that it all falls back to proper license language and having customers you trust somewhat. If you think that people are making a fool of you in this way, you should not be selling your software to them in the first place...
jakobengblom2
2008-10-07 17:55:56
+2
A:
There is no good reason to lock to a physical machine. Last I checked computers can break down, and then the user is probably going to be inconvenienced not only by a dead computer, but by having to call you to get the software locked to a new machine. If you must do draconian license management use a (local) management server and have running copies verify that they have a license every few minutes. Just realize that whatever you do if someone really wants to use your software without paying you they will find a way.
tloach
2008-10-07 18:03:31
A:
"Don't bother" is the short version. It's non trivial enough for your clients to do it that if they are doing that, then either they won't pay for what they use no matter what (they will not use it unless they can get it for free) or you are just flat charging to much (as in you are gouging.)
The "real" customer will generally pay for the stuff. From what I've seen, places like businesses will generally consider it not worth the effort.
BCS
2008-10-07 18:05:53
A:
You need something outside the computer "hardware" to authenticate against. Most companies choose hardware keys (dongles) in for software with a high ocst where users will put up with it.
Other companies use online methods - if more than one user with CPUID and other hardware is concurrently using a given license, then disallow another instantiation, or close the existing instantiation.
You have to choose protection according to your needs and the consumer's willingness to jump through your anti-piracy hoops.
Adam Davis
2008-10-07 18:08:03
Presumably if a dongle will work on one virtual machine it will work on multiple. Therefore, unless you intend to ban virtualization (which is a sales-limiting move these days), I don't think dongles will work.
David Thornley
2010-05-04 21:18:03
@david - Dongle devices, especially USB, can't be shared simultaneously by cloned virtual machines, which is what the OP is referring to.
Adam Davis
2010-05-07 03:09:58
A:
Two further options: lock to invariant logical parameters of the virtual session, or (as was suggested above) use leased licensing, where each license is periodically revalidated against the license server.
Dominic
2010-05-04 20:40:53