How to implement runtime licensing?

Question

I need to implement runtime licensing in the built-in protocol stack.

I already have an idea on how to achieve this, but I'm interested in hearing any alternative approaches or any pitfalls that need to be followed. You can assume that each device running on the stack will have a unique hard-coded identifier (equivalent to a MAC address) and access to some non-volatile storage.

My planned approach is to provide a license key generated using a hash function from the device identifier that the manufacturer must store in non-volatile storage. The stack will have a hash identifier using the same hash function and make sure it matches the stored key before it starts.

Answer 1

You must make sure that the license cannot be easily redistributed by the attacker. The most obvious way to do this is to provide a device ID signing license using your private key, and ask the application to verify it with your public key, which will be embedded in the software.

You also need to make sure that the software is not tampered with, but this is a completely different story.