1

My company has a website product (ASP.NET) which is sold to customers. It means we don't host the website. They install it on their server and run it in the intranet.

I need to implement some sort of copy protection mechanism so that not everyone ends up installing the website. It has following aspects:

  1. It has to be completely software based (no dongles).
  2. Hiding usage information in registry or some folder in c:\ (basically outside virtual directory) is not an option for a website

Please can you suggest any scheme/method?

Hemant
  • 19,486
  • 24
  • 91
  • 127
  • 3
    Good luck with this. This sort of thing is only a war of escalation; there is no guaranteed way you can win 100% of the time. My advice is to hire a lawyer, write a decent license agreement, and sue people who violate your license. – i_am_jorf Jun 22 '09 at 05:48
  • 3
    You are right. I *know* it cannot be protected 100%. All I am looking for is protecting from 80% of cases. Is it too much to ask for? :) – Hemant Jun 22 '09 at 05:50

4 Answers4

3

One suggestion is to use some kind of web service running, of course you need to have a main server to do so. In this server you can have some of your clients servers data (IP of the authorized servers, CPU and Motherboard ID's, and other important data).

This web service has to run some important logic of the program and return a value to the authorized servers. If the data of autorization sent by the client doesn't match, the server do will not execute the routine.

Of course I assume that this side of the logic is included in a DLL in the application and not in plain code.

backslash17
  • 5,300
  • 4
  • 31
  • 46
2

A technique that worked well for a buddy of mine was to install a web bug on an administrative page which would report back to their server. You can monitor when and where the application is installed. It could be easily removed, but won't by most customers.

Simple, easy to do, and works relatively well.

razzed
  • 2,653
  • 25
  • 27
  • 1
    a) This is essentially spying on your users, which is ethically dubious at best, and in many countries actually illegal. b) It may not work if the software is deployed behind a firewall / in an isolated intranet. – sleske Nov 17 '09 at 23:20
  • 1
    a) Yes, I agree. However, with properly defined licensing terms (again, yes, no one reads those), you could be in the clear. As well, how is this any different than a software package that checks for updates every time it launches? Same thing. For that matter, WordPress checks for updates regularly. Spying? For commercial software, yes. But rename it to "checking for updated version" and you've got the same solution. b) True, true. – razzed Dec 03 '09 at 17:42
1

Something you could try. Compile binaries for each client, obfuscate the code, lock the site down to a single domain. If its an internal app the domain might be something like "productname.clientname.internal". The app checks the domain of all the incoming requests, refuses anything that doesn't match.

As already pointed out by jeffamaphone: people will find ways around it, but it's enough to 'slow down' those not super determined.

russau
  • 8,928
  • 6
  • 39
  • 49
  • 1
    I think this is pointless. It's ridiculously easy to decompile CLR code with tools like Reflector. I'm with jeffamaphone that you should rely on the law, not obfuscation. – Matthew Flaschen Jun 22 '09 at 07:32
  • 2
    not intended as a completely bullet-proof solution. why not go with obfuscation AND the law. it isn't mutually exclusive. – russau Jun 22 '09 at 07:37
1

[disclaimer]I sell the product I am recommending.[/disclaimer]

Take a look at DeployLX. You can add licensing to your web based application to require one of a couple different options.

  1. Hardware based locking so it can only be used on one machine.
  2. Domain based locking so it's tied to a specific domain name.
  3. IP based locking to tie it to an IP address.
  4. License server locking to that your app checks in periodically with a centralized web service.

It's pretty flexible and should let you create a balance between protection and not frustrating your users.

Paul Alexander
  • 31,970
  • 14
  • 96
  • 151