Product Activation: Fingerprints, Copy Protection, Disconnected Computers

Not all protected applications require internet access in order to run. When yours does not, you will likely encounter customers who want to run your software on a disconnected computer. This article explains how product activation works, what a computer fingerprint is, and how customers can activate computers that have limited or no internet access.

For the most control, protected applications typically rely on some form of product activation process. A good licensing system offers solutions for computers that are directly connected to the internet as well as for those that are not.

During application startup, the protected software opens and reads its license file. This file can contain many license parameters that govern the features the customer is allowed to use. It may also read a computer fingerprint.

What is a computer fingerprint and when is it used?

A computer fingerprint works much like a human fingerprint that uniquely identifies a person. The licensing system reads one or more hardware identifiers to identify a physical computer as accurately as possible.

To avoid passing around potentially user-identifiable information, the computer fingerprint is often hashed. With some licensing systems (such as the SoftwareKey System), fingerprinting is not limited to computer hardware information. Some applications have their own unique data that can be used for fingerprinting during activation, for example:

• A tax ID in the case of medical billing software.
• A database connection string for a client/server application.
• Other custom information, such as the serial number of an attached piece of hardware.

Most developers use a licensing system for copy protection, to make sure the customer is using the software within the limits of their license agreement. To do this, a computer fingerprint is stored in the license file. During application startup, the software opens and validates the license file, then compares the fingerprint of the current computer's hardware to the fingerprint stored in the license file (which was previously approved).

Copy protection through product activation

Product activation typically involves communication between your software running on the customer's computer and an authoritative body that has the privileges needed to approve activation requests. This authoritative body can be a customer service representative at your office, or a central licensing server on the internet (such as SOLO Server).

The software can be activated with a simple two-step process, request and response:

1. The computer being activated generates a secure request. This challenge request includes a computer fingerprint along with other information that identifies which license is being activated on the computer.
2. The authoritative body or server generates the secure activation response. The response creates an encrypted license file on the computer being activated, containing the license parameters along with the approved computer fingerprint.

What happens if the license file is copied?

Because the encrypted license file contains a computer fingerprint bound to the specific computer that was previously activated, copying the file to a different computer will not allow the customer to use the license there. The fingerprint of the second computer will not match the fingerprint stored in the copied license file, so validation fails.

Why can't the user activate on a second computer?

You can set parameters with the central authoritative body that control how many times a specific customer's license can be activated. Typically, each time the user completes the request/response process, an activation counter is decremented. Once the counter reaches zero, the customer can no longer activate the software on a new computer until they deactivate a computer first or contact you for a license reset.

If you grant only one activation, the customer can activate on only one computer.

How do you activate disconnected computers?

The activation process is straightforward when both the computer being activated and the central licensing server are connected to the internet. Activating a disconnected computer still requires a request/response process, because:

1. The license file needs to have a computer fingerprint securely stored within it.
2. The authoritative body needs to confirm that the number of activated computers has not exceeded the license agreement.

When internet access is not available on the computer being activated but is available through a nearby computer, you can use an indirect request/response process:

1. The request is generated by the computer to be activated and copied to a thumb drive.
2. The thumb drive is taken to the nearby computer that has internet access.
3. The nearby computer passes the request file to the central licensing server for approval.
4. After validating the license and the request, the central licensing server returns a response.
5. The thumb drive is used to copy the response back to the disconnected computer.

The disconnected computer now has an encrypted license file approved with the fingerprint matching the hardware that was submitted in the request.

What happens if internet access is not available at all?

It is still possible to securely activate disconnected computers in very remote locations if telephone access is available. A volume license file (described below) containing all of the license parameters can be taken to the remote site along with the software installer. A simple exchange of numeric codes over the telephone can then approve the volume license file for use on that specific computer.

In this case, two license files are used on the activated computer. During application startup, the software opens and validates both license files to make sure everything matches.

Volume license distribution

When you trust your customer and want to allow their IT department to mass distribute your software across the company's network, or when you already know the unique data to bind a license to, a volume license file can be distributed ahead of time. The volume license file carries the license parameters with it, so individual computers do not each need to reach the central licensing server during installation.

Volume license distribution is well suited to large deployments and to environments where the target computers are disconnected or remote. Combined with the telephone approval process described above, it allows you to license computers that would otherwise be unable to complete a standard online activation.