如何使用硬件解决方案来创建“牢不可破”的应用程序？加密或复制保护？
我想讨论两类问题：
假设您编写了一个出于版权目的而想要加密的程序（例如：拒绝未经许可的用户读取某个文件，或禁用该程序的某些功能），但大多数软件-基于加密的加密可以被黑客破解（只需看看可用于 HACK 程序的程序数量即可成为“完整版本”。）
说你想要将软件推送给其他用户，但想要防止盗版（即其他用户复制该软件并将其作为自己的软件出售）。有什么有效的方法可以防止这种情况（类似于 CD 上的音乐保护，如 DRM）？无论是从软件角度还是从硬件角度？
或者这两个属于同一类问题？ （加密狗是基于硬件/芯片的解决方案，如下所述）？
那么，可以使用基于芯片或硬件的加密吗？如果是的话，到底需要什么？您是否购买特殊类型的CPU、特殊类型的硬件？我们需要做什么？
任何指导表示赞赏，谢谢！
Two types of problems I want to talk about:
Say you wrote a program you want to encrypt for copyright purposes (eg: denying unlicensed user from reading a certain file, or disabling certain features of the program), but most software-based encryption can be broken by hackers (just look at the amount of programs available to HACK programs to become "full versions". )
Say you want to push a software to other users, but want to protect against piracy (ie, the other user making a copy of this software and selling it as their own). What effective way is there to guard against this (similar to music protection on CD's, like DRM)? Both from a software perspective and a hardware perspective?
Or are those 2 belong to the same class of problems? (Dongles being the hardware / chip based solution, as many noted below)?
So, can chip or hardware based encryption be used? And if so, what exactly is needed? Do you purchase a special kind of CPU, special kind of hardware? What do we need to do?
Any guidance is appreciated, thanks!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
除非您以每份数千美元的价格出售该程序，否则几乎肯定不值得付出努力。
正如其他人指出的那样，您基本上谈论的是加密狗，它除了是开发人员难以修复的错误的主要来源之外，也是用户烦恼的主要来源，并且有很长的历史这些被认为“无法破解”的加密狗被破解。 AutoCAD 和 Cubase 是我想到的两个例子。
最重要的是，一个有足够决心的破解者仍然可以破解加密狗保护；如果您的软件对于破解者来说不是一个足够有吸引力的目标来执行此操作，那么它可能从一开始就不值得花费。
只是我的两分钱。
Unless you're selling this program for thousands of dollars a copy, it's almost certainly not worth the effort.
As others have pointed out, you're basically talking about a dongle, which, in addition to being a major source of hard-to-fix bugs for developers, is a also a major source of irritation for users, and there's a long history of these supposedly "uncrackable" dongles being cracked. AutoCAD and Cubase are two examples that come to mind.
The bottom line is that a determined enough cracker can still crack dongle protection; and if your software isn't an attractive enough target for the crackers to do this, then it's probably not worth the expense in the first place.
Just my two cents.
正如其他人所建议的那样，硬件加密狗是实现此目的的常见方法。但这仍然不能解决您的问题，因为聪明的程序员可以修改您的代码以跳过加密狗检查 - 他们只需根据检查是否通过在代码中找到分支的位置，然后修改它测试总是通过。
您可以通过混淆代码来使事情变得更加困难，但您仍然回到软件领域，并且同样聪明的程序员可以找出混淆并仍然实现他想要的目标。
更进一步，您可以使用存储在加密狗中的密钥加密部分代码，并要求引导代码从加密狗中获取它。现在，攻击者的工作有点复杂 - 他们必须拦截密钥并修改您的代码，以认为它是从加密狗获取的，而实际上它是硬编码的。或者您可以让加密狗本身进行解密，传递代码并取回解密的代码 - 所以现在您的攻击者也必须模拟这一点，或者只是获取解密的代码并将其永久存储在某个地方。
正如您所看到的，就像软件保护方法一样，您可以将其变得任意复杂，从而给攻击者带来更多负担，但历史表明，形势向有利于攻击者的方向倾斜。虽然破解您的方案可能很困难，但只需完成一次，之后攻击者就可以将修改后的副本分发给每个人。盗版用户现在可以轻松使用您的软件，而您的合法客户则需要承担繁重的复制保护机制。为盗版者提供比合法客户更好的体验是将合法客户转变为盗版者的一个非常好的方法（如果这就是您的目标）。
解决这个问题的唯一方法（很大程度上是假设的）称为可信计算，并且依赖于向计算机添加硬件。用户的计算机将其可以执行的操作限制为已批准的操作。您可以在此处查看硬件支持的详细信息。
由于我在上面详述的原因，我强烈建议您不要采用这种方法：您最终为合法客户提供的体验比使用盗版副本的客户更糟糕，盗版副本会积极鼓励人们不购买您的软件。盗版是生活中的事实，即使您可以提供无懈可击的保护，有些用户也根本不会购买您的软件，而是很乐意使用非法副本。您能做的最好的事情就是为合法客户提供最好的体验和客户服务，使正版副本比盗版副本更具吸引力。
Hardware dongles, as other people have suggested, are a common approach for this. This still doesn't solve your problem, though, as a clever programmer can modify your code to skip the dongle check - they just have to find the place in your code where you branch based on whether the check passed or not, and modify that test to always pass.
You can make things more difficult by obfuscating your code, but you're still back in the realm of software, and that same clever programmer can figure out the obfuscation and still achieve his desired goal.
Taking it a step further, you could encrypt parts of your code with a key that's stored in the dongle, and require the bootstrap code to fetch it from the dongle. Now your attacker's job is a little more complicated - they have to intercept the key and modify your code to think it got it from the dongle, when really it's hard-coded. Or you can make the dongle itself do the decryption, passing in the code and getting back the decrypted code - so now your attacker has to emulate that, too, or just take the decrypted code and store it somewhere permanently.
As you can see, just like software protection methods, you can make this arbitrarily complicated, putting more burden on the attacker, but history shows that the tables are tilted in favor of the attacker. While cracking your scheme may be difficult, it only has to be done once, after which the attacker can distribute modified copies to everyone. Users of pirated copies can now easily use your software, while your legitimate customers are saddled with an onerous copy protection mechanism. Providing a better experience for pirates than legitimate customers is a very good way to turn your legitimate customers into pirates, if that's what you're aiming for.
The only - largely hypothetical - way around this is called Trusted Computing, and relies on adding hardware to a user's computer that restricts what they can do with it to approved actions. You can see details of hardware support for it here.
I would strongly counsel you against this route for the reasons I detailed above: You end up providing a worse experience for your legitimate customers than for those using a pirated copy, which actively encourages people not to buy your software. Piracy is a fact of life, and there are users who simply will not buy your software even if you could provide watertight protection, but will happily use an illegitimate copy. The best thing you can do is offer the best experience and customer service to your legitimate customers, making the legitimate copy a more attractive proposition than the pirated one.
它们被称为加密狗，安装在 USB 端口（现在）中，并包含自己的小型计算机和一些加密存储器。
您可以使用它们通过测试硬件加密狗是否存在来检查程序是否有价值，您可以在加密狗中存储加密密钥和其他信息，或者有时您可以在加密狗中运行一些程序功能。它基于加密狗比您的软件更难复制和逆向工程。
请参阅 deskey 或 hasp（好像已经被接管了）
They are called dongles, they fit in the USB port (nowadays) and contain their own little computer and some encrypted memory.
You can use them to check the program is valud by testing if the hardware dongle is present, you can store enecryption keys and other info in the dongle or sometimes you can have some program functions run in the dongle. It's based on the dongle being harder to copy and reverse engineer than your software.
See deskey or hasp (seem to have been taken over)
以前我在并行端口上看到过硬件加密狗。今天，您使用像这个这样的USB加密狗。 维基百科链接。
Back in the day I've seen hardware dongles on the parallell port. Today you use USB dongles like this. Wikipedia link.