[net.micro] software protection - dongles & othe

slerner@sesame.UUCP (Simcha-Yitzchak Lerner) (08/05/85)

> 
>       Dongles are this year's solution to last year's problem.  What do I do
> with our network of SUNs?  Most of them are diskless and run off a common file
> server.

I assume that your workstations have some type of port on them? (RS-232,
paralell, or in worst case keyboard).  An ADAPSO keyring could be
connected to each station.  By each user of a package having a key,
one central copy of a program could be shared by all authorized users. 

The advantage of this over one fixed price for a network licence (the
above artivle mentioned a price = 7x single copy for a net) is that
small nets don't pay a penalty and a large network pays an appropriate
fee (presumably discounted steeply...)


-- 
Opinions expressed are public domain, and do not belong to Lotus
Development Corp.
----------------------------------------------------------------

Simcha-Yitzchak Lerner

              {genrad|ihnp4|ima}!wjh12!talcott!sesame!slerner
                      {cbosgd|harvard}!talcott!sesame!slerner
                                slerner%sesame@harvard.ARPA 

jbn@wdl1.UUCP (08/05/85)

      Dongles are this year's solution to last year's problem.  What do I do
with our network of SUNs?  Most of them are diskless and run off a common file
server.  Now that we've got a file server (as opposed to the old disk server) 
all the stations are functionally interchangable, and you can sit down at any 
one that's free and use your files.  It's just like having one giant 
time-sharing system.
      Except for the licenced software.  Ideally, if we buy N copies of an
Ada compiler, we should be entitled to do N Ada compiles at once, anywhere
on the net.  But no one has a good way to enforce this, so vendors want to tie
the programs to the CPU serial number on the CPU board.  This destroys
the interchangability of the stations.  Yet we don't want to buy everything
for every station; our user community has very diverse needs.  Some people
are reducing instrumentation data with DataViews, others are drawing structure
charts with SCE, some are designing ICs, others PC boards, and some want to 
do Ada compiles.  There are lots of packages worth having one or two copies 
of, but only a few of general applicability are justified for every station.
And you can't move them around at all with CPU board serial number oriented 
protection.
      Apollo deals with this by offering a ``network licence'' for most
packages; such a licence typically costs about 7x the single unit price and
covers up to 100 stations on a single net.  SUN hasn't dealt adequately with
this problem, nor have their third-party vendors, and needs to.
      One minor misery; if you ever have to replace a CPU board, it may be
WEEKS before you get all the software updates needed to bring all the
purchased software up on the new board serial number.
      Any good ideas?

					John Nagle

Fischer.pa@XEROX.ARPA (08/05/85)

Howzabout serializing by machine and by organization (shades of
registries).  Then a software manufacturer can sell versions which look
for either number depending on the licensing agreement.  If these
numbers can be in a "keyring" device then better.  If you're in an
organization that doesn't care you can leave them plugged into your
machines all the time.  If divisions share a pool of machines the
employees can check them out like library cards or whatever.

All you need do is indent the machine serial numbers one level in the
serial number outline...

(ron)

rlk@wlcrjs.UUCP (Richard L. Klappal) (08/08/85)

In article <411@brl-tgr.ARPA> Fischer.pa@XEROX.ARPA writes:
>Howzabout serializing by machine and by organization (shades of
>registries).  Then a software manufacturer can sell versions which look


Fortune Systems uses this system (approximately).  Each machine has
a PAL that contains a machine ID and a group ID.  Software installed
on a given machine can be backed up and reinstalled as often as you
wish, but will never run on another machine.  When I was RIFed, the group
protection implementation wasn't complete, but they intended to set
up site licensing by machine groups to handle upgrades and the like
for companies like FORD where there are several hundred machines.



Richard Klappal

UUCP:		..!ihnp4!wlcrjs!uklpl!rlk  | "Money is truthful.  If a man
MCIMail:	rklappal		   | speaks of his honor, make him
Compuserve:	74106,1021		   | pay cash."
USPS:		1 S 299 Danby Street	   | 
		Villa Park IL 60181	   |	Lazarus Long 
TEL:		(312) 620-4988		   |	    (aka R. Heinlein)
-------------------------------------------------------------------------

johnl@ima.UUCP (08/12/85)

/* Written  3:27 pm  Aug  8, 1985 by che@ptsfb in ima:net.micro */
> Hmm, still doesn't take care of the "black box" boys who hang a
> passive, intelligent device onto the RS-232 and monitor the data stream.

I suspect that a typical dongle for an expensive (say $700) program would
have an 8051 in it, which could do some fairly complex logic.  Remember, the
dongle doesn't have to be impossible to break -- it just has to be hard
enough to break that it's easier to get the program legitimately than to
break it.  You can break anything with $50,000 worth of lab equipment.

This doesn't mean that I think the dongle as currently proposed is a good
idea.  The thought of plugging stuff in and out of the DB25 on the back of
your PC several times a day disturbs me; it's not designed for that heavy a
duty cycle without breaking prematurely.  And the keyring sounds like
it'll simultaneously be logically too small for the number of programs a
serious user uses, and physically too big to fit in the 2 inches behind my PC.

John Levine, Javelin Software, Cambridge MA 617-494-1400
{ decvax!cca | think | ihnp4 | cbosgd }!ima!johnl, Levine@YALE.ARPA

The opinions above are solely those of a 12 year old hacker who has broken
into my account, and not those of my employer or any other organization.