1

My company has a website product (ASP.NET) which is sold to customers. It means we don't host the website. They install it on their server and run it in the intranet.

I need to implement some sort of copy protection mechanism so that not everyone ends up installing the website. It has following aspects:

  1. It has to be completely software based (no dongles).
  2. Hiding usage information in registry or some folder in c:\ (basically outside virtual directory) is not an option for a website

Please can you suggest any scheme/method?

2
  • 3
    Good luck with this. This sort of thing is only a war of escalation; there is no guaranteed way you can win 100% of the time. My advice is to hire a lawyer, write a decent license agreement, and sue people who violate your license.
    – i_am_jorf
    Jun 22, 2009 at 5:48
  • 3
    You are right. I know it cannot be protected 100%. All I am looking for is protecting from 80% of cases. Is it too much to ask for? :)
    – Hemant
    Jun 22, 2009 at 5:50

4 Answers 4

3

One suggestion is to use some kind of web service running, of course you need to have a main server to do so. In this server you can have some of your clients servers data (IP of the authorized servers, CPU and Motherboard ID's, and other important data).

This web service has to run some important logic of the program and return a value to the authorized servers. If the data of autorization sent by the client doesn't match, the server do will not execute the routine.

Of course I assume that this side of the logic is included in a DLL in the application and not in plain code.

2

A technique that worked well for a buddy of mine was to install a web bug on an administrative page which would report back to their server. You can monitor when and where the application is installed. It could be easily removed, but won't by most customers.

Simple, easy to do, and works relatively well.

2
  • 1
    a) This is essentially spying on your users, which is ethically dubious at best, and in many countries actually illegal. b) It may not work if the software is deployed behind a firewall / in an isolated intranet.
    – sleske
    Nov 17, 2009 at 23:20
  • 1
    a) Yes, I agree. However, with properly defined licensing terms (again, yes, no one reads those), you could be in the clear. As well, how is this any different than a software package that checks for updates every time it launches? Same thing. For that matter, WordPress checks for updates regularly. Spying? For commercial software, yes. But rename it to "checking for updated version" and you've got the same solution. b) True, true.
    – razzed
    Dec 3, 2009 at 17:42
1

Something you could try. Compile binaries for each client, obfuscate the code, lock the site down to a single domain. If its an internal app the domain might be something like "productname.clientname.internal". The app checks the domain of all the incoming requests, refuses anything that doesn't match.

As already pointed out by jeffamaphone: people will find ways around it, but it's enough to 'slow down' those not super determined.

2
  • 1
    I think this is pointless. It's ridiculously easy to decompile CLR code with tools like Reflector. I'm with jeffamaphone that you should rely on the law, not obfuscation. Jun 22, 2009 at 7:32
  • 2
    not intended as a completely bullet-proof solution. why not go with obfuscation AND the law. it isn't mutually exclusive.
    – russau
    Jun 22, 2009 at 7:37
1

[disclaimer]I sell the product I am recommending.[/disclaimer]

Take a look at DeployLX. You can add licensing to your web based application to require one of a couple different options.

  1. Hardware based locking so it can only be used on one machine.
  2. Domain based locking so it's tied to a specific domain name.
  3. IP based locking to tie it to an IP address.
  4. License server locking to that your app checks in periodically with a centralized web service.

It's pretty flexible and should let you create a balance between protection and not frustrating your users.

Your Answer

Reminder: Answers generated by Artificial Intelligence tools are not allowed on Stack Overflow. Learn more

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.