Need Advice

[kleinma]

ok Im working on a project right now that is software that is sold on subscription basis...

so they buy the software and it can be used for a year from installation. I need a way to track this information, so I was thining of implimenting a client server type program, where we use a static IP and when users open the program, it connects to our IP via winsock to verify their subscription. This would also be useful for checking for product updates too.

The app itself collects data and submits it to a third parties website, so the computer HAS to be connected to the net for this app to work.. so that is not an issue

Our DSL carrier (Verizon) offers some business solutions including static IPs. So we could run a server and forward whatever port to my server side app when users connect. I would imagine it would only be a few hundred people who would purchase the software, and the connections to our server would be brief (only to transmit the data real quick, and then disconnect) so I don't think we would run into a bandwidth issue.

What kind of problems or limitations do you think I would encounter with this type of implimentation..

[techgnome]

The only thing that came to mind was what if the user only has a dialup and it's in use, or whatever....

It sounds like a sound plan though.

TG

[jdc2000]

They might have a firewall that blocks web access, or, they not have web access on the PC where the software is installed.

[kleinma]

Originally posted by jdc2000
They might have a firewall that blocks web access, or, they not have web access on the PC where the software is installed.

]Originally posted by kleinma
The app itself collects data and submits it to a third parties website, so the computer HAS to be connected to the net for this app to work.. so that is not an issue

they would just have to allow the application access to the net in any firewall software they are using i imagine...

[DiGiTaIErRoR]

I would suggest pointing it to a DNS first. Then if that fails try the IP.

I would then have the program download an encrypted file on this server.

I'd suggest using a custom CRC on all data. It should make it a bit harder to crack.

[kleinma]

Originally posted by DiGiTaIErRoR
I would suggest pointing it to a DNS first. Then if that fails try the IP.

I would then have the program download an encrypted file on this server.

I'd suggest using a custom CRC on all data. It should make it a bit harder to crack.

you mean have it connect to something like verify.mycompany.com and if that fails try the IP? how would I go about implimenting that?

and what do you mean by custom crc?

thx

[hellswraith]

What I would do is build in some fault tolarance (spell). Don't stop the app if it can't reach your web server. Let it keep working, but start having your app try to get a hold of the web server more frequently until:
A) it finally reaches it and verifies whether the app can still be used, or
B) a specified time frame has passed without contact to your web server. I would let it go for 5-10 days beyond the scheduled time to call home.

I would also only have the client app call home about once every couple weeks, or every n times the app is used. No matter what you do, this app will be easily cracked. All one has to do is monitor the traffic as a successful check is carried out, and they then know what to feed your app to make it believe it is good to go. So to limit it, do as suggested above, have it download an encrypted file that changes every so often, and the app should know what changes to expect based on date. If these values don't match up to what is supposed to be there, then either the user has played with their system time, or they are trying to feed in their own file to get past your security. Either way, your app would stop working.

[LabtroRob]

I would use DNS, in case something happens with Verizon, or something else beyond your control.

Also, depending on the critical nature of this app, I would consider a backup server on a different ISP.

eg. Tries to connect to primary server on Verizon, if it can't, tries to connect to the secondary server at second ISP.

Again, this will add cost, but if you have a few hundred subscribers, then it shouldn't be a problem. That way if your power goes down, or Verizon blips out for a few hours, customers won't even really notice.