RVN Token Implementation for Software Licenses… would this work?
(Long post, sorry, describing my company's SW licensing model and trying to work out how we could replace it with RVN)
I work for a small software company. Our current software licensing model is that we issue software keys that users install on their computers, which "check in" with our servers once a month. Users can "release" keys from the computer it's installed on, which frees the key so someone else can use it. It must be released from that computer, since it deletes a secure registration file. Without that registration file, the first thing the software does when open is query our server to see if it's key is available.
We do not allow users to reset keys through a web interface or anything, since a user could disconnect a computer from the internet, release the key, use it on a different computer, then effectively have two machines using the same license (at least until 30 days expires and the one machine must check in with our servers).
One of the most requested features we get though is that users would like the ability to have an external admin that can move licenses from one computer to another without having two do so through the computer itself, since users can often forget to log off or just forget to release the license. If a customer has multiple shift workers, for example, maybe all 3 shifts share the same license, and if someone forgets to release the key the next worker (who may be remote) cannot use the key, and they cannot resolve the issue without access to the machine or without contacting us (we can release keys remotely).
We could of course simply allow users to release keys and get rid of the 30 day check in, and have it always check in at start up… but that would require us guaranteeing 100% uptime of our validation server, since some of our customers work 24/7 with multiple shifts. We cannot guarantee this, usually our servers are down 1-2 times a year for a few hours. Some of our customers are large financial institutions and this is not acceptable. I'm starting to think a blockchain solution would be better. It would require internet connectivity for the users to run our software, but it would be decentralized so that no single server going down should stop it. Here's how I imagine this working on the RVN blockchain.
1) Each instance of our software, when installed, creates a new multisig wallet, with one key being hard coded into the application and encrypted that we have access to, and the other key being generated randomly for that computer. This would be set up for 1 of 2 keys required to send tokens.
2) The customer saves their private key generated by the software for admin use, along with one of the addresses generated by that wallet.
3) We issue a set of "LicenseTokens" to our customer's private key. They can distribute them to the multisig wallets described above. Each "LicenseToken" must have a unique ID.
4) When the software goes to start, it checks the multisig wallet associated with it, and if it has at least 1 "LicenseToken", it will allow the application to run.
5) When the software goes to start, it checks another address, hard-coded into it. If that address has a "BlackList" token in it, with an ID matching the "LicenseToken", the software will not start, and will present a user with an error message. This would allow us to "revoke" tokens if a user claims they lose their private key or if the user claims a license was stolen or something.
My question is, would this work? Are there any obvious holes that I'm missing that would allow a user to run multiple instances of our software off a single "LicenseToken"? This is mostly theoretical at this point, since I'd have to convince the rest of the Dev team this is a good idea, but it certainly seems like it would be a great way to solve a customer feature request and implement RVN at the same time.
submitted by /u/c0horst
[link] [comments]