Software registration ideas

[Wesley Baker]

Hello all -

I need to create a registration class (or framework, or whatever) that is implemented into the software we create and sell to clients. I am looking for some ideas on how it will work.

My initial idea was to have the client-side piece in the software itself and have it communicate with a MySQL server on our website that contains the registration info, but I thought that might be a little too insecure, with only a password that could be reverse engineered out of the software.

Any one know of any Java APIs that already do something like this, or have any ideas of how to build a framework like this?

[Sachin Joshi]

we did something similar for our software....
Here is what we created

Have a code piece which can generate a key based on user information.
Embed it inside your distribution.

Use same code at server side to generate the key and while communicating validate the two are same, based on the user information and key....

You may want to look at the java keytool... this should help you store your licensing information in a keystore....

[Wesley Baker]

Thanks for the info, Sachin.

Did you do much research into JMX? I'm curious if it could be useful for something like this.

[Sachin Joshi]

I have never used JMX .....

Here is text from JMX docs

JMX is a standardized means for providing a remotely accessible management interface and is an easy way to add a flexible and powerful management interface to an application.

What I understand from this is, its a application management API, so it should help you manage you application .....

What is your requirement? Do you want to manage application remotely ? or you want to keep track of licensing and make sure no piracy happens?

[Ulf Dittmer]

You're right that a client app should not contact your DB directly; that's a major security no-no. You could go through an HTTP proxy on your site, but the communication -which can be observed in traffic- should give away nothing that can be used to guess information used by other clients.
Also, with everything you do, keep in mind that Java apps can be decompiled and the security features patched out. It's not trivial to do, but won't put up unsurmountable obstacles to a determined attacker. So, whatever measures you put in place, may be circumvented by some people.

JMX isn't meant for managing remote client applications on machines; it would anyway have to make TCP/IP connections from afar, which generally isn't going to work.

keytool is meant for managing encryption keys and certificates, not for application keys; I'd go with a database for storing user and license information.

TrueLicense is an open source solution to some (or maybe all?) of the associated problems (not to deompilation, though).

[Wesley Baker]

Ulf -

TrueLicense looks like exactly what I am looking for. Thanks for all the good info!