views:

93

answers:

1

I have a C# .NET app. This application is tightly coupled to a piece of hardware. Think ATM, drive up kiosk kinda thing. I want a way for my application to assure it is being run on our hardware. Our initial plan was to get the serial number of the CPU, OS, HD, or other hardware with WMI, digitally sign that, and ship that signature with the software. The application would then have the public key in it to verify the signature. Is there a better way to do this?

Update 1

We dont want a dongle or a hasp. Nothing external to the system.

+1  A: 

We do something similar for software licensing by signing an XML file, although ours isn't tied to any hardware. The same concept applies. It works well.

You will also need to protect your .NET code using some kind of obfuscation tool, we use {smartassembly} but there are several others out there.

Keep in mind that no matter what you do, given enough time and resources, someone can bypass it.

That doesn't mean you should not protect your intellectual property, but there is a point where you get diminishing returns and cause more trouble to you and your customers that it's worth.

Dana Holt