Need a means to license an app by the hour

Question

I would like to license one of our (Windows desktop or sever) applications so that it can be used (with a pre-paid key) for a specific number of hours. It should be possible for it to be stopped and restarted and the periods of running chosen by the user. The time does not need to be recorded to the second, minutes would be fine; and though it needs to be proof against fraud by a technically competent user, it does not need to resist attack at the level of government agencies! The app can remain installed (just prevented from being used) until the user later purchases another key. The 'key' must be software only, dongles are not appropriate for this application.

Ideally I would like some ideas about how to implement this securely in our own Delphi (XE) code, but it could equally be done in a separate application in any language, and we could just require that app to be running whenever ours is. I am open to purchasing a component to implement this, but I do not want to pay big money for a licencing tool that does a whole lot more than just this requirement. We already have a license mechanism that can prevent use after a specific date.

Answer 1

I would suggest Software Passport which is built on Armadillo protection engine. It has served me very well for several years.

At one stage you needed an Armadillo pro license to be able to create certificates from which keys can be created that expire by x minutes, but I think that with the advent of Software Passport (Armadillo used to be separate product), it comes standard, though the site isn't very clear about it.

As Software passport is from Digital River, an added advantage is the easy integration with all digital river backed software portal sites as your "shopping cart".

Another advantage, if I understand them correctly (haven't used it), is that you can use something called automatic key delivery in which case the security envelope wrapped around your software contacts the digital river servers and they key is delivered straight into your software. Meaning the user never gets to see the actual key... (pretty handy to prevent key copying by your end users).

Authors: http://www.siliconrealms.com/

Answer 2

When the user buys a few hours of use, you could give the user a (unique) license key, and also store this key on your own web server, licensing.yourdomain.com, together with the amount of hours purchased and the number of minutes spent (the so-called "minute counter") so far (that is, 0). Now, in the application, there is a function CheckLicensed: boolean that is run, by means of a TTimer, for instance, once a minute. This makes a light-weight POST request to licensing.yourdomain.com, sending the license key. The server then increases the minute counter by one. If the minute counter is less then the number of minutes purchased, the function CheckLicensed returns true. If the license has expired, on the other hand, it returns false, and you can disable features or even terminate the application (depending - of course - on the nature of the application).

Of course, when the application is not running, the minute counter will not be increased, and so the license will not be wasted. Also, you might be able to give the user an option to pause the TTimer, but of course, this would also disable a few buttons (as appropriate) in the program.

This approach requires constant Internet access, but that might not be a problem for you. It is very safe. For instance, the end user cannot cheat by changing his system time, or altering the minute counter (since it resides on your server, and only a (US) government agency could access that one).

How to send a POST request? I have given an answer to that question previously at How to send a HTTP Post Request in Delphi 2010 using WinInet

Answer 3

I suggest you look into WinLicense from Oreans: http://www.oreans.com/winlicense.php

Their trial licensing does exactly what you want to do. You can easily set a license to expire after so many cumulative minutes.

Winlicense integrates easily into Delphi and has numerous configuration options. I've been using it for the past year and have been very happy with the software and their support.

Answer 4

Have a web service callable from your e-commerce store that generates a key based on: UserName + Email + DateTime + NumHoursPurchased Use a simple algorithm such as encrypting that string with AES256.

In your app, they'd enter their name, and e-mail. Then they'd paste in the key that they receive from the e-commerce store. Now you know when they purchased it, and how many hours. If the purchase date/time is recent (within the past 30 min?), unlock the app and start your clock. You'll need to track the time yourself, store it somewhere safe, ideally encrypted or obscured.