Implement piracy prevention system for a Java desktop application

Question

I am trying to create a desktop application in Java,

1. It should not run in another machine than which I prefer.
2. It should not run after a particular expiry data.

Is there any good idea to do so. Please help me. Thanks in advance.

---

According to my knowledge(very less) I have some suggestion:

For Point1: By Hard-coding my application's startUp to check for the ProcessorId(because it is unique one) If it is a valid one it should execute else show a "Expired" alert. But for doing this i should give a separate jar setUp to each user which i dont mind.

For Point2: Should maintain a encrypted file which will store the current date. During each startup of the application. I will update the date field in the file if the current date is greater than the one in the file. If not i will display a "Expired" alert.

This may look funny but this is what I can think.

Answer 1

Whatever you do, you'll need to obfuscate your code (at least) and encrypt/mangle any string literals you use. If you read processorId, you'll get angry calls from customers whose laptop just came in from service where they replaced the whole motherboard (very common practice today).

Any encrypted file can simply be deleted by a freeriding user. You must hide it somewhere good. On Windows people like playing this hide-and-seek game inside the Registry, especially its classid part.

Just some random ideas...

Answer 2

For requirement 1:

You could maintain a database filled with generated keys for your users. Upon start-up of your application it could request a key and then make a call to the database to change the key to used. You could give each user a unique key to enter upon start-up. This system would require online access to use your application so that checks against the database could be made.

For Requirement 2:

You could maintain keys and the dates associated with them and make checks against the proper date at start-up as well. if the date has passed the user gets the expired notice.

The user only needs to enter the key once...after that point your software would remember that key and only ask for a new one after the old one has expired.

Here the tradeoff against Marko's idea is that this kind of system requires internet access to check a database.

---

EDIT:

This method as described above would not prevent someone from simply copying the JAR and moving it to a different machine. You could generate the keys based on MAC address of machines and then check the systems address at start-up nut this would cause the same problem Marko described above in that a motherboard replace would change the MAC address.

EDIT 2:

The more I think about this problem the more it becomes clear to me that you need to have and maintain a serverside connection for your requirements. In addition I don't think Java is your best choice as someone could just decompile your JAR.