因此，您可以通过提供与用户绑定的密钥（如 Microsoft 产品密钥）来实现此目的（您可以拥有一个存储用户 <-> 密钥关系的数据库）。您可以在用户登录的每台计算机上存储“每个用户”的密钥缓存，因此每次用户登录时，您都会检查他是否拥有有效的密钥，如果没有，您将“激活”它并存储密钥（或者最好是哈希值）。如何定义密钥以及如何存储它们（信用卡、USB 密钥等）取决于您。
Facts you'll have to think about:
The machine or workstation notion is not really usable, now with Virtual Machines, Remote Sessions, Hypervisors, etc... the "hardware" does not exists anymore. Everything becomes "virtualware" :-)
New Windows versions (aka Vista, 7) security have been considerably strenghened, including the UAC. This is good for users but not that good for developers. It means your users may not be able to read hardware information, or write on the disk outside of their environement (c:\users\john\...)
Users simply move from machine to machine (roaming). And this is getting more and more true every day with the generalization of portables, pdas, etc...
It means, you'll have to think about a system more tied to users than to machines.
I would avoid installing drivers, dongles or hardware stuf, or special processes or services with elevated priviledges because this may not support every scenario, from now on.
So you can implement this by giving keys (like Microsoft product keys), tied to users (you can have a database that store user <-> key relations). You could store a key cache "per-user" on every machine where the user logs on, so every time a users logs in, you check if he has a valid key, and if he hasn't you "activate" it and store the key (or a hash preferrably). How you defined keys and how you store them (credit card, usb key, etc...) is up to you.
I work for a company in the license management business (Agilis Software), where these issues have already been met and dealt with in the Orion License Manager (products from other companies such as Flexera or Safenet may also do so). Your requirements can readily be met by a software-only system (no dongles required), but for it to be effective and transparent to your legitimate users you do need to pay some attention to the details and think about the possible deployment scenarios.
First of all, while it is widely used I don't recommend the MAC address as the locking parameter. Many OSs allow the administrator to specify the MAC address, making this an insecure approach. It is better to use other hardware and software parameters, but the ones available will depend on the operating system and hardware platform. Obviously using more than just one parameter increases security, but then you probably want to provide some resiliency when people make minor changes to their system.
Virtual systems do preclude the use of these hardware parameters for locking, but each virtual session does still have invariant parameters you can use. For further security you can require each such session to periodically revalidate its license against the server (we call this a 'leased license').
Another issue you would need to think about is how users can reclaim and relocate a license if one of the workstations crashes.
If your customers are like many of the end-users Agilis's ISV customers sell to, you should also consider how the company can obtain their license if they don't have an Internet connection (perhaps they have an isolated internal network, or you can't get past their firewall). How will your on-site server obtain its license, and how can you be sure the customer doesn't replicate your server, so doubling their license entitlement?
(Needless to say, Agilis's systems do of course include solutions to these and other challenges).
It has information on the basics of network based floating licenses and how these are implemented by our licensing system CryptoLicensing. If you can use a commercial off the shelf system, I suggest you take a look at CryptoLicensing - it meets most of your requirements based on the scenario you have described.
Disclaimer: I work at LogicNP Software, the developers of CryptoLicensing.
发布评论
评论（4）
您必须考虑的事实：
这意味着，您必须考虑一个与用户比与机器更紧密联系的系统。
我会避免安装驱动程序、加密狗或硬件东西，或者具有提升权限的特殊进程或服务，因为从现在开始，这可能不支持所有场景。
因此，您可以通过提供与用户绑定的密钥（如 Microsoft 产品密钥）来实现此目的（您可以拥有一个存储用户 <-> 密钥关系的数据库）。您可以在用户登录的每台计算机上存储“每个用户”的密钥缓存，因此每次用户登录时，您都会检查他是否拥有有效的密钥，如果没有，您将“激活”它并存储密钥（或者最好是哈希值）。如何定义密钥以及如何存储它们（信用卡、USB 密钥等）取决于您。
Facts you'll have to think about:
It means, you'll have to think about a system more tied to users than to machines.
I would avoid installing drivers, dongles or hardware stuf, or special processes or services with elevated priviledges because this may not support every scenario, from now on.
So you can implement this by giving keys (like Microsoft product keys), tied to users (you can have a database that store user <-> key relations). You could store a key cache "per-user" on every machine where the user logs on, so every time a users logs in, you check if he has a valid key, and if he hasn't you "activate" it and store the key (or a hash preferrably). How you defined keys and how you store them (credit card, usb key, etc...) is up to you.
使用USB 加密狗看起来是唯一的选择。
检查此链接：http://www.answers.com/topic/dongle
但它可能是让它在虚拟机上工作很棘手。这里的银弹是使用网络连接的 USB 集线器（例如 AnywhereUSB)
这意味着您的公司需要额外的硬件成本，加上愤怒的客户。
Using a usb dongle looks like the only alternative.
Check this link: http://www.answers.com/topic/dongle
But it may be tricky to make it work on virtual machines. The silver bullet here is using a network-attached USB hub (such as AnywhereUSB)
This means extra hardware cost to your company, plus angry customers.
我在一家从事许可证管理业务的公司（Agilis Software）工作，这些问题已经在 Orion 许可证管理器（Flexera 或 Safenet 等其他公司的产品也可能这样做）。纯软件系统可以轻松满足您的要求（无需加密狗），但为了使其对合法用户有效且透明，您确实需要注意细节并考虑可能的部署方案。
首先，虽然它被广泛使用，但我不建议将 MAC 地址作为锁定参数。许多操作系统允许管理员指定 MAC 地址，这使得这是一种不安全的方法。最好使用其他硬件和软件参数，但可用的参数取决于操作系统和硬件平台。显然，使用多个参数可以提高安全性，但是当人们对其系统进行微小更改时，您可能希望提供一些弹性。
虚拟系统确实禁止使用这些硬件参数进行锁定，但每个虚拟会话仍然具有可以使用的不变参数。为了进一步提高安全性，您可以要求每个此类会话定期针对服务器重新验证其许可证（我们称之为“租赁许可证”）。
您需要考虑的另一个问题是，如果其中一个工作站崩溃，用户如何回收和重新定位许可证。
如果您的客户与 Agilis 的 ISV 客户销售的许多最终用户一样，您还应该考虑如果他们没有互联网连接（也许他们有一个隔离的内部网络，或者您可以），公司如何获得他们的许可证不要越过他们的防火墙）。您的现场服务器将如何获得其许可证，以及如何确保客户不会复制您的服务器，从而将其许可证权利加倍？
（不用说，Agilis 的系统当然包含针对这些和其他挑战的解决方案）。
希望这有帮助，
多米尼克
I work for a company in the license management business (Agilis Software), where these issues have already been met and dealt with in the Orion License Manager (products from other companies such as Flexera or Safenet may also do so). Your requirements can readily be met by a software-only system (no dongles required), but for it to be effective and transparent to your legitimate users you do need to pay some attention to the details and think about the possible deployment scenarios.
First of all, while it is widely used I don't recommend the MAC address as the locking parameter. Many OSs allow the administrator to specify the MAC address, making this an insecure approach. It is better to use other hardware and software parameters, but the ones available will depend on the operating system and hardware platform. Obviously using more than just one parameter increases security, but then you probably want to provide some resiliency when people make minor changes to their system.
Virtual systems do preclude the use of these hardware parameters for locking, but each virtual session does still have invariant parameters you can use. For further security you can require each such session to periodically revalidate its license against the server (we call this a 'leased license').
Another issue you would need to think about is how users can reclaim and relocate a license if one of the workstations crashes.
If your customers are like many of the end-users Agilis's ISV customers sell to, you should also consider how the company can obtain their license if they don't have an Internet connection (perhaps they have an isolated internal network, or you can't get past their firewall). How will your on-site server obtain its license, and how can you be sure the customer doesn't replicate your server, so doubling their license entitlement?
(Needless to say, Agilis's systems do of course include solutions to these and other challenges).
Hope this helps,
Dominic
看看这篇文章：为您的软件添加网络浮动许可证功能
它包含有关基于网络的浮动许可证的基础知识以及我们的许可系统如何实施这些信息加密许可。如果您可以使用商业现成的系统，我建议您看一下 CryptoLicensing - 它根据您所描述的场景满足您的大部分要求。
免责声明：我在 LogicNP Software 工作，该公司是 CryptoLicensing 的开发人员。
Take a look at this article : Add Network Floating License Capability To Your Software
It has information on the basics of network based floating licenses and how these are implemented by our licensing system CryptoLicensing. If you can use a commercial off the shelf system, I suggest you take a look at CryptoLicensing - it meets most of your requirements based on the scenario you have described.
Disclaimer: I work at LogicNP Software, the developers of CryptoLicensing.