Licenser - A Software license package

New Post: asp.net

eyall — Sun, 17 Aug 2008 09:56:27 GMT

Hi Adiazcan,

Again, from the security perspective, the best way for a web-based identification is by logged-in user and not by his computer. That is because users are working the web from anywhere and not from a particular computer, and also because the application is running on a server and not on the client machine. The solution I'd put in the last discussion item enables writing a Web-Based licensing (as long as the web-site serves subscribed users - i.e. users with accounts).

However, if you still need a non-standard solution here is what you can do.
The basic idea is to encode the host name, and write it in the license in the computerId field.
Then, to make GetComputerId to encode the requester host in the same manner and to compare it with the license.

Here is an example of encoding the userId:

Create a Project named Test1
Prepare a dialog box with a TextBox1, and an empty Label named lblHostName, a button named btnEncode and a button named btnExit.
Replace the Form1 class content with the following code:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Text;
using System.Windows.Forms;
using System.Net;
using System.Security.Cryptography;

namespace Test1
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
            lblHostName.Text = Dns.GetHostName();
        }

        private void btnExit_Click(object sender, EventArgs e)
        {
            Application.Exit();
        }

        private void btnEncode_Click(object sender, EventArgs e)
        {
            const string numDesc = "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ";
            textBox1.Text = "";
            SHA1 sha = new SHA1CryptoServiceProvider();
            byte [] decoded = System.Text.ASCIIEncoding.ASCII.GetBytes(lblHostName.Text);
            byte[] encoded = sha.ComputeHash(decoded);
            int i = 0;
            foreach (byte digit in encoded)
            {
                int d = (int)digit;

                byte b1 = (byte)((d & 240) / 16);
                byte b2 = (byte)(d & 15);

                char c = numDesc[b1+b2];
                string s = c.ToString();
                textBox1.Text += s;

                i++;
                if (i % 5 == 0 && i != encoded.Length)
                {
                    textBox1.Text += "-";
                }
            }
        }
    }
}

An application similar to the example should be downloaded to the customer that will e-mail his encoded computer-id to the application provider. The encoded computer-id will be inserted into the license. The Web-Application will call a GetComputerId with the
Page.Request.UserHostName attribute. That routine will be written exactly as the btnEncodeClick and will convert the Page.Request.UserHostName to it's encoded computer-id

Eyal

New Post: asp.net

adiazcan — Tue, 12 Aug 2008 13:10:26 GMT

Thanks Eyal,

I need a method like GetComputerID but on a web application. I can't use the login user to do it.

Any idea?

New Post: asp.net

eyall — Tue, 12 Aug 2008 12:17:05 GMT

Hi,

The answer is a bit complex and here is the reason for it:
IsValid() Function calls the GetComputerId() that seeks for the Network Interface Hardware ID of the executing computer (i.e. - the Web Server). That means that a license will be checked vs. the server - which causes a hugh security hole - every logged-in user will be able to execute the software.

That can be fixed by replacing the computerId in the user credentials. This is done in the following manner:

In the dotNet.ASP solution Add the LicenserApi.csproj Project as a secondary project.
Edit the Logic.cs file, Add a reference to System.Web namespace
At the top of file, bellow #using System.Security.Cryptography add #using System.Web
Add a method name GetComputerID(HttpRequest request) with the following code:

        public static string GetComputerID(HttpRequest request)
        {
            return request.LogonUserIdentify.User.ToString();
        }
    5.    Replace the line:
                    public bool IsValid(string licensePath, string featureName, string passCode, bool bThrow)
            with the following line
                    public bool IsValid(string licensePath, string featureName, string passCode, bool bThrow, HttpRequest request)
             then, replace the line
                    licenseInformation.computerID = Logic.GetComputerId();
             with the line
                    licenseInformation.computerID = Logic.GetComputerId(request);
    6.    Next, at your Asp.Net page, Add a reference to the licenserApi.
    7.    Protect your page so the user needs to login into the ASP.Net Web page
    8.     Make a call to the modified LicenserAPI.Logic.IsValid() with the Page.Request object as the Last argument

Another Application that should be written is a one (used by the person who produces the licenses) that creates the user-sid string. This string should be put in the ComputerId field of the license. This can be made as shown in the following console application example:

using System;
using System.Security.Principal;

class WindowsIdentityMembers
{
    [STAThread]
    static void Main(string[] args)
    {
        Console.Write("Enter Account: username@server.domaim: ");
        string account = Console.ReadLn();
        WindowsIdentity wi = new WindowsIdentity(account);
        WindowsImpersonationContext ctx = null;
        try
        {
               ctx = wi.Impersonate();
               Console.WriteLn(Account SID: " + wi.User.ToString();
        }
        catch()
        {
            Console.WriteLn("Error in account name - Exiting...");
        }
        finally
        {
            ctx.Undo();
        }
    }
}

Good luck,
-- Eyal.

New Post: asp.net

adiazcan — Thu, 07 Aug 2008 18:48:07 GMT

Hello,

can I use this api into an asp.net project?

Thanks

New Post: AddALicense: DataMember of licensesLicenseTypeEnumBindingSource

eyall — Sat, 26 Jul 2008 18:47:08 GMT

Hey,
I'm a bit confused for the reason you want to change the LicesnseTypeEnum enumeration - that is because this is a part of the business logic of the licenser, if you will set other values than the one already there you will also need massive changes in the code to make it work, and not to make bugs as well.
Anyway, if you want to set different values of LicesnseTypeEnum do as follow:
1. In the LicenserProduction project, double click the Resource1.resx object
2. In the strings tab, change/ add names and values.
3. Right Click Form1.cs and choose "view code"
4. In the InitializeData() method, set the row.code and row.description with all the new values
5. In case you'd changed the names, find all previous names in all code *.cs files, and replace it with the new ones. Note, if you want a different behavior you will need to set it in your code as well.

I hope that answers your question.
Cheers,
-- eyall

New Post: AddALicense: DataMember of licensesLicenseTypeEnumBindingSource

MyKey0815 — Tue, 22 Jul 2008 14:38:25 GMT

Hey,

I have try to translate your License-Manager to Framework 2 and VB.Net. All code is translated and most of them is now working.

My problem is that i cant figure out how you put the "DataMember"-Property of the "licensesLicenseTypeEnumBindingSource" in the AddALicense-Control. i have open it in VS2008 and when I compiled it than worked. But I open then Usercontrol - select the "licensesLicenseTypeEnumBindingSource" - I see you put in "Licenses_LicenseTypeEnum". But when I want change them, then I only find the possible value "Licenses_Feature". Then it is not possible to reselect/put in the text "Licenses_LicenseTypeEnum".

Please say me how to you put in the correct DataMember-Name

Thank you very much

MyKey0815

New Post: Sample Application(s)

shaund — Wed, 11 Jun 2008 18:40:06 GMT

Hi eyall,

I went through your release code, job well done!. Did you consider using the .NET control licensing component ? - Just a thought.

I like your Licenser production application. I might need to modify it so that it updates a SQL database.

Have you thought of a way to prevent time tampering ? I know of commerical tools that can determine whether or not the system clock has been changed. I am not sure how you would go about that though. Perhaps if you stored a "Last used" date in your license file which would record the date the program last ran. You could then throw a license validation error if the system date was earlier than the last run date.

NEW POST: Sample Application(s)

eyall — Thu, 05 Jun 2008 13:31:15 GMT

Shaund,

Actually, there is a build in example within the code.
To use it do as follows:

Create an empty project
Add a reference to LicenserAPI.DLL
From the LicenserProduction code (Latest Version), copy the following files into your project:
- TestLicenseForm.cs
- TestLicenseFormDesigner.cs
- TestLicenseForm.Resx
Set the main form (in program.cs) to be TestLicenseForm
Compile and run

You can also create a license with your computer ID, select the license and right click, there is a "TEST" option menu that activate the same form. You can set a breakpoint in the TestLicesnse constructor and click the TEST menu option. youw will be able to see how it is working.

-- eyall

NEW POST: Sample Application(s)

shaund — Mon, 02 Jun 2008 21:16:55 GMT

Hi

I was really excited to see your project as I need a simple yet effective licencing solution for my projects.

I had a look at your code pre-release and it looked good.

Please could you add a sample project which demonstrates how you envisage develeopers using your framework. I.e just a windows app that is licenced.

UPDATED WIKI: Home

eyall — Fri, 30 May 2008 13:46:07 GMT

Project Description
A package used by the software developers for licensing their products.
The produced license file is digitally signed. It is also specific for the licensed computer.
The developer may license any feature in his program separately. Each of the license features might be time depended (optional).

In order to enhance security, the application has to pass to the licenser a PASSCODE during run-time. The PASSCODE is a text known only to the software developer, but does not appear anywhere in the license file.

The feature information, as well as the licensed computer identification together with the PASSCODE are encrypted into a digital signature that is written in the license file.
Any trial to modify the license information will cause an inconsistency with its signature that will invalidate the license. That will be also the case if a feature expires or the computer identification is differ from the one that is licensed.

This package contains the following modules:
1. Licenser / Production – A license production tool
2. Licenser / API – An API for checking a license
3. Licenser / Identification – A tool that is used one-time by the end-user to display the computer id. The end-user e-mails the ID to the developer/license producer that will produce and return a license file to the client

UPDATED WIKI: Home

eyall — Fri, 30 May 2008 13:45:31 GMT

UPDATED RELEASE: Licenser Toolkit Source code (מאי 30, 2008)

Fri, 30 May 2008 13:35:48 GMT

!! General
The following *Licenser.Zip* is a Vistual Studio 2008 Solution, containing the source of all tree binaries in 3 projects.

!! Code version
The following release, match the Source Code version ends in ChangeSet 19391

!! Compilation order
Basically, compiling the solution should work well. However, should reference error occurs, compile the solution in the following order:
# LicenserAPI
# LicenserIdentification
# LicenserProduction

UPDATED RELEASE: Licenser Toolkit Source code (מאי 30, 2008)

Fri, 30 May 2008 13:34:55 GMT

!! General
The following *Licenser.Zip* is a Vistual Studio 2008 Solution, containing the source of all tree binaries in 3 projects.

!! Code version
The following release, match the Source Code version ends in ChangeSet 19391

!!Compilation order
Basically, compiling the solution should work well. However, should reference error occurs, compile the solution in the following order:
# LicenserAPI
# LicenserIdentification
# LicenserProduction

UPDATED RELEASE: Licenser toolkit Binaries (מאי 30, 2008)

Fri, 30 May 2008 13:33:28 GMT

Binary run-time files of the licenser toolkit
* *Licenser API* a library that is distributed together with the application, provides license checking services
* *LicenserProduction* A license prodution tool, this tool maintains customers and licenses databases and
* *LicenserIdentification* A Tool that enables the end-user to identify the computer to be licensed in a lock node mode.

*_Code version_*
The following release, match the Source Code version ends in ChangeSet 19391

*_Note_*
# dotNet 3.5 must be installed prior to toolkit installation.
# The customer who produces a license must have all 3 binaries installed on the same directory.
# The customer's end-user who is executing a licesned application, must have *_LicenserAPI.DLL_* as well as *_LicenserIdentification.EXE_* installed in the application directory. The *_LicenserProduction.EXE_* tool +must *NOT*+ be installed.

UPDATED RELEASE: Licenser toolkit Binaries (מאי 30, 2008)

Fri, 30 May 2008 13:32:31 GMT

Binary run-time files of the licenser toolkit
* *Licenser API* a library that is distributed together with the application, provides license checking services
* *LicenserProduction* A license prodution tool, this tool maintains customers and licenses databases and
* *LicenserIdentification* A Tool that enables the end-user to identify the computer to be licensed in a lock node mode.

!! Code version
The following release, match the Source Code version ends in ChangeSet 19391

*_Note_*
# dotNet 3.5 must be installed prior to toolkit installation.
# The customer who produces a license must have all 3 binaries installed on the same directory.
# The customer's end-user who is executing a licesned application, must have *_LicenserAPI.DLL_* as well as *_LicenserIdentification.EXE_* installed in the application directory. The *_LicenserProduction.EXE_* tool +must *NOT*+ be installed.

UPDATED RELEASE: Licenser Toolkit Source code (מאי 30, 2008)

Fri, 30 May 2008 13:26:24 GMT

!! General
The following *Licenser.Zip* is a Vistual Studio 2008 Solution, containing the source of all tree binaries in 3 projects.

!!Compilation order
Basically, compiling the solution should work well. However, should reference error occurs, compile the solution in the following order:
# LicenserAPI
# LicenserIdentification
# LicenserProduction

CREATED RELEASE: Licenser Toolkit Source code (מאי 30, 2008)

Fri, 30 May 2008 13:23:40 GMT

UPDATED RELEASE: Licenser toolkit Binaries (מאי 30, 2008)

Fri, 30 May 2008 13:09:39 GMT

Binary run-time files of the licenser toolkit
* *Licenser API* a library that is distributed together with the application, provides license checking services
* *LicenserProduction* A license prodution tool, this tool maintains customers and licenses databases and
* *LicenserIdentification* A Tool that enables the end-user to identify the computer to be licensed in a lock node mode.
produce license files.
*_Note_*
# dotNet 3.5 must be installed prior to toolkit installation.
# The customer who produces a license must have all 3 binaries installed on the same directory.
# The customer's end-user who is executing a licesned application, must have *_LicenserAPI.DLL_* as well as *_LicenserIdentification.EXE_* installed in the application directory. The *_LicenserProduction.EXE_* tool +must *NOT*+ be installed.

Source code checked in

eyall — Fri, 30 May 2008 12:23:39 GMT

Source code checked in

eyall — Fri, 30 May 2008 09:18:41 GMT