tags:

views:

29

answers:

1

I'm trying to figure out how to implement my licensing policy technically. I'm guessing there are typical approaches, but it seems hard to find something online.

My approach would be to look at authentication, signing and encryption topics. I'm currently thinking along the lines of having the software get permission for certain actions from a central module over some channel that provides mutual proof of identity.

I charge for my licenses by the capacity (how much data, how many users) of the software rather than by the number of instances that are installed. I'm aiming for a solution that customers can install on as many machines as their load balancing and failover scenarios require.

One problem with this scenario is that I can't really lock down anything to a specific hardware item on installation. This is very much what I want as far as the user experience goes, but I'm a little at loss as to what alternatives there are.

Of course, there's always the easy way, which is to simply store the number of users etc still available somewhere and make tampering with that number a violation of the licensing terms. This would give me legal leverage and as I deal with enterprise customers, it might be sufficient.

+1  A: 

It sounds as if a simple license server (that installations would contact to get permission do do something, etc. and would enforce the policy), would be enough - especially if you don't expect it to be hacked for legal reasons (license, etc.).

Ofir
That sounds reasonable. Are there any good examples? Open Source projects naturally don't have this kind of stuff and commercial products hardly show off the technical details. It seems weird to me that it looks like everybody has to make up their own thing from scratch. In encryption, for example, the available technologies and basic architecture questions are much, much better documented.
Hanno Fietz
I doubt there will be, for the very reasons that you mentioned, and to prevent reverse engineering. But this is simple, just define a policy, add accounting and some encryption.
Ofir