Serial Number and Registration

[scriptx]

Hello Everyone,

I have a little program which I want to put some limitations on. I never thought having a serial number could be so hard or preventing people from installing on more than one system can be such a daunting task. Anyhow, basically my program will have full access to internet and can contact a server to verify the serial number. I am just not sure what the standard procedures are for assigning serial numbers, registering a software and how to tie it with a specific system hardware, or how to securely authenticate the serial number.

Any feedback will be appreciated.

[scriptx]

That's an amazing idea. It cuts down on the internet need but on the same token I would not know how much of the software is being pirated since there is no inquiry to my server. I guess I can accept that for the customer's interest. However, I am still looking for the commands for CPU ID and HDD ID. Thanks for the great input again.

[archonmagnus]

C++ nor C nor any other language (that I can think of this late at night) has a built-in command for performing a hardware inventory scan. You might want to look into the use of the 'system' command to attempt to parse hardware information from files stored at a "standard" or "known" location on the disk (such as /dev or C:/Windows), but that could lead to other problems. For one, depending on the access permissions of the user running the application, those directories may be inaccessible.

Most authentication routines (that ultimately fail, but do provide the illusion of control) use a user-input value and create a hash token based on that input. The trouble is "simply" developing (or implementing a pre-existing) hashing algorithm. You code a hashing algorithm into your application that calculates a one-way hash on the user-input. You provide the key to the user based on her user-input string. The user enters the user-input string (such as a username, etc.) and the key that was received from you into the application. The application computes the one-way hash of the user-input string and does a byte comparison of the computed hash and the input key. If the two values match, a registration flag could be set in a datafile (but ultimately the user could just create a datafile with this byte set in the first place).

It's really a slippery-slope. You'll have to be the judge to decide whether the trouble of developing a one-way hashing function and implementing it is really worth the cost. In short, most control/restriction schemes only serve to keep the "honest" people honest.

[scriptx]

In short, most control/restriction schemes only serve to keep the "honest" people honest.

:) I like your analogy on this. I am not going to use the one way hash. I am thinking for using the "system" command in Linux and /dev to actually register a computer via internet. I think this is the only option that I have. I should also manually include a serial number to every copy of the software. Again, this is not a highly sensitive money making program but the nature of the program is so that people tend to install on several computers and Virtual Machines which is unfair use of the program.

Thanks for the inputs. I will post back with some snippets of the code and ask for more help if any needed.

[Studlyami]

I guess you could manually add a cd key to each program and then add that key to your server database. This is going to require work for you to do on each purchase of your software. You will also need to offer some sort of support or method of support for people who do change their system configuration which is quite common to do every couple of years or so.

From a user perspective if i buy a piece of software, especially a rather cheap piece of software and I find it sending information going to the web, I'm going to be very upset. If this software is going to sell a limited number of copies. My suggestion is to make a simple serial number algorithm as someone suggested above and just take the hit on the multiple system installs. If I bought your software and I tried to install it on multiple computers or I changed my computer hardware and I couldn't install the software again, I wouldn't purchase another program from you nor would i buy from you again in the future. Oler1s made a good point when he stated that the protection shouldn't "annoy your paying customers or clients". If you annoy your paying customers they will one not come back and two will be encourage to crack and share your program.