应用程序的激活数据保存在哪里？
在我的应用程序中，我将使用在线激活来控制盗版。但问题是，一旦用户激活软件，我如何检测该应用程序已激活。是否有任何方法来存储该应用程序激活的数据。不要告诉我注册表，因为这种方式不安全。任何与在线激活相关的信息都会对我有所帮助。我决定在系统驱动器中创建文件，我的应用程序每次启动时都会检查该文件。如果找到文件，则应用程序启动，如果没有启动，则要求输入密钥。这样安全吗？任何建议都会很好！
In my application I am gonna use online activation to control piracy.but the problem is that once user activates the software, how do i detect that that application is activated.is there any way to store the data that this application is activated. don't tell me registry because this way is not secure.Any information related to online activation will be helpful to me.i have decided to create file in system drive and my application check for that file every time it starts.If file found then application starts and if it doesn't then it ask for the key. is that secure ?any suggestion will be good!!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您提到的问题是您需要考虑的一个问题，但还有很多其他问题：
只是根据多年在该领域的经验需要考虑的一些事情。
The issue you mentioned is one you need to consider, but there are many others:
Just some things to think about based on years of experience in the field.
我可以看到对“保护激活数据”有两种不同的看法：
1）如果您试图保护用户的激活数据，以便用户无法将数据复制到另一台计算机并在那里使用该软件另外，我提出以下协议：
在激活期间，用户环境的唯一标识特征被散列并发送到激活服务器。激活服务器生成使用密钥签名的激活。产品启动时，您的产品会验证激活是否已由您的服务器签名（使用服务器的公钥），并且本地环境哈希为激活中包含的相同签名值。如果失败，则说明环境已更改（新安装了操作系统？），或者数据已迁移到新环境（听起来）需要新的许可证/激活。无论哪种方式，用户都需要重新激活。
2) 如果您试图保护激活数据免遭损坏，请考虑用以下逻辑补充以前的协议：如果客户尝试使用相同的 UID 重新激活，则允许再次激活，这应该会导致相同的激活实例被发送回客户。
这些都是即兴的，我不保证其中任何一个都是防弹的。另外，请记住，盗版者只需绕过激活验证即可成为一个有争议的问题。
另外，我认为值得注意的是，使用此方案的想法是您不必在任何地方隐藏激活信息。您可以将其存放在方便的地方。
There are two different takes on "securing the activation data" that I can see:
1) If you are trying to secure the activation data from the user, so that the user can not copy the data to a different computer and use the software there as well, I propose the following protocol:
During activation, uniquely identifying features of the user's environment are hashed and sent to the activation server. The activation server generates an activation that is signed using a secret key. On product start, your product verifies that the activation was signed by your server (using the server's public key) and that the local environment hashes to the same signed value contained in the activation. If it fails, then the environment has either changed (new installation of the operating system?) or the data has migrated to a new environment requiring (by the sounds of it) a new license / activation. Either way, the user requires a new activation.
2) If you're trying to protect the activation data from corruption then consider supplementing the former protocol with logic that, if the customer tries to re-activate with the same UID, allow the activation to go through again, which should result in an identical activation instance being sent back to the customer.
These are off the cuff, I don't guarantee either of these to be bulletproof. Also, remember, a pirate only has to bypass verification for activation to be a moot point.
Also, I feel it's important to note that, with this scheme the idea is that you don't have to hide activation information anywhere. You can store it wherever is convenient.