How do software companies ensure that their product or app can only run in a given number of bare-metal or VM instances? I'm curious about the cryptography behind the scenes. What prevents a user from cloning the application indefinitely in a cloud environment?
In a virtualized environment, since the application could move around datacenters (with VM migration) binding the license to attributes like the IP or MAC could invalidate the license, which isn't the right behavior either.
One system I've seen is to use dynamic license codes.
Each time the software is run, it connects back to the vendor's server. It submits the current license code, and is issued a new one. The old license code is invalidated. If the VM is cloned, then only one clone will have the new license code.
Drawbacks with this system:
In the example I saw, the need for Internet access and vulnerability to cracking were considered acceptabe. However, the System Restore issue was not, and led to them stopping using this approach.
How do software companies ensure that their product or app can only run in a given number of bare-metal or VM instances?
They don't!
Software companies start with some half-a**ed technologies that are incomplete solutions. These are then watered down so they don't break the user model too badly. In the end, the only thing that software licensing does is discourage honest users from cheating. Simply search for the string cracked <your-favorite-application> and see all of the hits. (Note that cracked software is a notorious source of malware and illegal in most jurisdictions.)
The root of the problem is that the software is run on hardware not controlled by the software vendor. As such, anything can be cracked given enough time. The only solution that works reasonably well is to keep all or part of the application on hardware owned by the software vendor. This is one of the reasons why the cloud is so attractive to software vendors.
