2

I'm looking for a simple methodology for licensing custom ArcGIS extensions with an installation key or license file. When the user attempts to enable the extension I want to check that they have a valid license before enabling the tools. I’m not sure if this is the best forum for this question but I bet some of my fellow GIS developers have tackled this before.

Using an installation key would be the preferred approach because it seems less hassle, both for me and for the user. I’m sure there are many of ways to accomplish this, but I’m trying to work out the basic process and I have a number of questions about it.

  1. I’m assuming that once the user enters the key during the installation a value gets written to the registry. The registry value is then checked to enable the extension. Is there a better way?

  2. What are the options for generating the installation key? What rules can you create to determine a valid installation key vs. an invalid installation key?

  3. What value should you write to the registry? Perhaps encrypt the installation key and write the encrypted value to the registry. Then when checking that key to enable the extension, decrypt the registry key, and then make sure it meets the same requirement of a valid installation key? I’m not looking for Fort Knox here, but it seems you want the registry key value to be something not completely apparent to someone snooping around.

I've written extensions for ESRI software for years, (back to ArcView 3), without concern for validating licensing. Usually the extension goes to a handful of clients with an associated license agreement text file, and that was it. And, honestly, I prefer it that way. If someone wants to break a licensing agreement they will find a way, so why waste time and energy trying to stop it. However, for a variety of reasons I now need to apply a basic licensing scheme on a few extensions. So, any suggestions or guidance would be greatly appreciated.

Improve this question
4
  • 1
    maybe see this thread: stackoverflow.com/questions/109997/…
    – Kirk Kuykendall
    Apr 22, 2011 at 16:26
  • Interesting discussion. Basically confirms how I view the issue. Extreme investment in securing your app is rarely worth the effort. Making a simple licensing check before enabling the applications at least identifies the application as being a paid for, licensed product, and thus makes the honest people behave honestly. It will get cracked if someone wants it.
    – Jeff Berry
    Apr 22, 2011 at 17:15
  • After a bit of thought, and discussion I'm voting to close this since it is off topic. Besides, it's in your best interest: people in some other forum are likely much less interested in cracking a GIS extension than those who read here.
    – Kirk Kuykendall
    Apr 22, 2011 at 20:21
  • Appologies if it's the wrong forum.
    – Jeff Berry
    Apr 22, 2011 at 20:44

3 Answers 3

Reset to default
2

Jeff; the question is do you feel there is enough interest in your tool to warrant security. At my last company the system I designed had two elements. One, a key generated by the software installed, and then a accepted/approval key we replied to the user. This was then written to the registry of that PC. This prevented the software from being copied and moved to other machines.

We setup a web-page that would allow a company/client to enter there key, and the appropriate counter key would be emailed back. We had logic in place that if the user was of a certain type that the key extension would talk to our server for updates but to also check if the license was still valid. This helped us do license managment as well.

There are some good examples of basic protection logic on CodeProject; but you do want to think seriously about your need; if you have software that you will sell for $50.00 a seat then you may view it differently from software you sell for $500.00

Improve this answer
1
  • I've found explanations of similar approaches online, along with 3rd party solutions that facilitate this approach, along with web based authentication services. At this point, I'm nowhere near needing this level of sophistication, and don't want the extra overhead of administering a confirmation server. For now, the simpler the better. I'll check out CodeProject and hopefully find a simple solution.
    – Jeff Berry
    Apr 22, 2011 at 20:32
2

I guess this is a bit off topic, but you could just use an encrypted license file/registry entry.

The user enters a valid key. The application hashes that key with say the CRC checksum of the application's binary, and stores that in a one-way encrypted license file. Every time the user starts the extension, it hashes and encrypts the same as before and checks it against the license file. If either the key, the binary, or the license file are changed then something dubious is going on.

Then to tie the license to a machine, you can use the MAC address and/or the processor ID and/or the hard-drive ID, and use that as part of the hashing function.

I have a book called "Crackproof Your Software" published by No Starch Press that covers quite a lot of this stuff, and there are bound to be other books out there.

At the end of the day, as I'm sure you're aware, no form of licensing is crackproof, so it is up to you to decide whether the cost of developing and supporting a license system is worth the value of the software.

Improve this answer
1
  • Thanks MerseyViking. That approach makes sense. Don't think I need to go as far as linking it to the machine. Do you have a suggestion for how to generate and check a "valid" key? I just started looking into this and haven't reviewed any books yet, but I'll take a look the one you recommended. I am hoping to find a quick and easy solution, but I lack some basic understanding of the entire issue so a book is probably where I should start. But, as you suggest, there is point of diminishing returns on how much effort I should put into this.
    – Jeff Berry
    Apr 22, 2011 at 16:24
1

You could also use a solution such as Sentinel Protection and Licensing by SafeNet. They offer hardware, cloud and other solutions. http://www.safenet-inc.com/Products/Software_Rights_Management/Sentinel_Protection_and_Licensing.aspx

Improve this answer
1
  • Yes, but that is a incredibly expensive path to go down; so if you are looking at a small shop that has a cool tool but not much overhead you will find it prices you out of use.
    – D.E.Wright
    Apr 24, 2011 at 21:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.