Re: Remote licensing system

From: Richard (rh86_at_azglobal.com)
Date: 12/24/03 

Date: Tue, 23 Dec 2003 23:31:05 -0700

Jim wrote:
> For our new unit (lab test kit) we want to be able
> to remotely enable/disable options (up to10 options)
> on-site, as/when the customer buys them. The units
> are equipped with an RS232 port.

A simple scheme (hardly hacker-proof):
Customer provides serial number.
Internal ID# is extracted from a list using serial number.
XOR a multi-bit feature code with the internal ID# = your key

By not revealing the internal ID#, it's harder for someone to observe
patterns in the keys, particularly a reseller who sees a lot of them.
The step below would complicate enough that S/N and ID# could be the
same value.

Some complicators:
Make only some of the feature code bits valid (say, 4 bits, distributed
across the key), and make the rest of the bits random before the XOR
step when the key is genned. Again, thwarts obvious patterns. Simply
AND in the device to filter them out after XOR.

Consider:
The key needs to be long enough to thwart sequential keying attempts.
With 8 digits, I can just code something that steps through all the
combinations and activates all the features. Of course, you could have
some land mine codes that lockout the device for factory reset. :-)

Any danger of getting stiffed on payment? If so, key immediately with
an expiring key (time, uses) that gives enough time for funds to clear,
when you re-issue a permanent key.