Protecting containerized applications (e.g. in docker) is similar in many ways to non-containarized applications. The major difference is that, in most cases, there is no reliable way to uniquely identify an instance. And even if it would be possible to identify them, it might not be desirable since oftentimes containers spin up and down very frequently.
More specifically, the challenge from a software licensing perspective is to prevent end users from exceeding the maximum number of concurrent instances.
The general solution to restrict the number of concurrent users is to use a floating license model (allows to restrict how many instances can run concurrently) and generate a random identifier upon application start (i.e. not relying on any OS information).
If your clients will have an internet connection, your application can call the Cryptolens API directly as described here. In this case, Cryptolens will be responsible for keeping track of all active instances.
If your clients will be offline, they can install a local license server that will keep track of all instances. A tutorial on how it can be setup can be found here.
If you would have any questions or need advice on how to protect containerized applications, please reach out to us at [email protected].
This post is a continuation of Licensing software to customers with thousands of employees (B2B) where we talked about common issues that might arise when licensing software to larger clients. In this post, we will focus on the case when your clients do not have internet access (e.g. hospitals) or where you would like to have more control over who can use your software within the client company.
Specifically, we will explore the following cases:
Controlling who can activate: Typically, new devices are activated automatically, until the maximum number of machines is reached. However, you might not want that to happen, especially if you sell to a specific department in the company and don’t want users from other departments to use the software.
Companies with no internet access: When your clients don’t have internet access, the solution is to send them a license file where all devices are already activated. However, this quickly becomes problematic if there are thousands of employees whose device needs to be activated.
Both of the cases above share a common problem: gathering machine codes from a large number users and then activating them from your end.
Gathering machine codes from all employees
To gather machine codes (aka. hardware ids) from all employees, Customer IT needs to run a special batch script. We have prepare one that can be downloaded here. Typically, your client will use a system similar to Microsoft SCCM, which allows the customer IT to run a script on all computers and collect the result.
Activating multiple devices at once
Once the customer IT has collected all the machines, they can send the file with all the results to you. Our script will compute both the machine code and a device name (to make it easier for customers to differentiate between different activations). The can then be activated on the following page.
In this post, we would like to share several new tools and practical tips that are tailored to those of you that sell to larger companies. We will cover the common issues such as management of large number of activations, offline access and reporting.
When selling to larger companies, we recommend to issue one license key per client and keep track of the employees using activations. For those familiar with Flexera terminology, an activation is the same as a seat. There are two ways to restrict the number of active employees that you can your software:
Node-locked: in the node-locked model, once a device is activated, it needs to be manually deactivated if the customer wants to use that seat on a different machine.
Floating license: in this model, unused devices will automatically be deactivated when not in use, allowing your customers to install your application on any number of machines and use it concurrently on a limited number machines.
If you want to have different number of seats per feature, our recommendation is to issue a separate license per feature.
Typically, it’s more convenient to issue one license key per company and then restrict the number of end users (aka. machine codes/seats) to the number of workstations that will run the application. However, it can quickly become hard to manage all the end users, especially when employees leave and your customers want to free up unused seats.
To solve this problem, we have introduced the concept of “friendly name” and improved the license portal to allow your customers to query on it.
A friendly name is a way to add a human-readable name to each activated device, so that it is possible to tell which user it belongs to. Normally, machine codes are an unreadable string, and look similar to “9f86d081884c7d659a2feaa0c55ad015a3bf4f1b2b0b822cd15d6c15b0f00a08“. To make it easier to distinguish between these, you can add an optional paramater FriendlyName when activating/verifying a device. For example, if you have integrated our key verification script, you can add the friendly name as shown below:
var result = Key.Activate(token: auth, parameters: new ActivateModel()
Key = licenseKey,
ProductId = 3349,
Sign = true,
MachineCode = Helpers.GetMachineCode(),
FriendlyName = Environment.MachineName
Our recommendation is to use Environment.MachineName as the friendly name, since if your customers use Active Directory, they will be able to see it in the admin dashboard:
To make it easier for your customers to find unused devices and deactivate them, we have added new tools in the customer portal and a new permission to deactivate devices in the customer object. There’s also a new sign up link that you can use to allow your customers to sign up with deactivation permission.
Once they are logged in, they can click on the “manage licenses” tab, and they will see a pag similar to the one below:
Here they can either manage all the activations/used seats and remove unused ones. For example, to find all my activations, the admin could click on “manage activations globally” and search for “artem(at)cryptolens.io”:
Oftentimes, larger companies have strict constraints on internet connectivity. They may want to have their devices completely offline or without direct internet access. When your customer puts forward this constraint, our recommendation is to offer them to use our license server as a first step, which tends to be accepted in most cases. The idea behind the license server is to act as a reverse proxy, in other words, it allows devices on your customers’ network to communicate with Cryptolens through the license server, without the need of having a direct internet access by themselves. As a result, only the license server needs to be able to access the internet. Furthermore, your customers can restrict the internet access of the license server to only be able to access Cryptolens. Instead of having to do that for all their devices, they can focus on protecting one workstation running the license server. The license server is freely available on GitHub.
If your customers want to have their devices completely offline, you can use the idea of offline activation, by delivering the license file using eg. a USB stick. In simple terms: normally, when you call Key.Activate to verify a license key, you receive a signed JSON response that our client libraries convert into a language-specific object. For example, in .NET, it’s the LicenseKey object. Once you have this object you can check the status of the license, eg. features and expiration date. For devices that do not have the ability to call Key.Activate, you can instead send them the result from this method as a license file. The easiest way to enable your customers to receive these files on their own is by using our Activation Forms. Once they have provided the license key and machine code, a license file will be downloaded, which they can put on a USB stick, which is then used to activate the offline device. Under the hood, an activation form will call Key.Activate; in other words, if you want to control the user experience, you can create your own page that performs this call. Alternatively, you can manually create this file in the dashboard, by clicking on the yellow button next to the license key.
Another important feature that your customers can request is to have access to audit logs. For example, if the use the floating license model, they might want to know how many seats are used at any one time so that they can scale it up or down. We are actively working on improving the customer portal to allow your customers to analyse their usage. At the time of writing, we have created standalone scripts on GitHub that you can use to generate several common reports. If you need to generate a specific report, please let us know and we will add example code.
Many times your customers may have either restricted internet access or no internet access at all. Although Cryptolens is a cloud-based licensing solution, you can still use it to protect offline devices. In this post, we cover three ways internet access can be restricted and how license key verification can be performed.
Periodic internet access
If your users are connected to the internet on a regular basis, we can cache the response from the “Activate” method each time we are able to contact the server. If, at some point, internet connection would not be present, we would fallback on a cached version of the license object.
When using this approach, it’s important to define how long time your users can be offline. There is a field called “SignDate” in the license key object, which is the time when the response was signed by the server (i.e. the last time you successfully called Activate). So, if you only want to allow your users to be offline for 30 days, you can compare the current date with the “SignDate”.
License server (re-routing)
If your users have certain devices that have no direct internet access, one option is to use a license server, which will re-route all requests through a server hosted by the user. Only the server has internet access.
There is currently a Windows version of the server, freely available on GitHub.
Air gap (no internet)
If the devices have no internet access at all, we can use a similar idea that was described in periodic internet access, with the only difference that we always fallback on the license file.
In Cryptolens, there are three ways you can create such a file:
In the dashboard
Next to each license key, there is a yellow button which can be used to create license files: