java 如何通过系统时钟篡改防止过期License的使用？

How to prevent usage of expired license through system clock tampering?

提问by Lalchand

I am currently working on a license manager using java, I will be specifying a start and end date for my application so I can force a licensed user to re-license the program after a certain amount of time.

我目前正在使用 java 开发许可证管理器，我将为我的应用程序指定开始和结束日期，以便我可以强制许可用户在一定时间后重新许可程序。

But the problem I am facing is that any one can roll-back their system date and time in order to maintain the validity of license. Is there any way in Java to detect the system date and time is changed. I have already tried Network Time Protocol to get the current date and time from a time server.

但是我面临的问题是任何人都可以回滚他们的系统日期和时间以保持许可证的有效性。Java 中是否有任何方法可以检测系统日期和时间是否已更改。我已经尝试过网络时间协议从时间服务器获取当前日期和时间。

回答by Ira Baxter

You likely are storing a license file on the system. a) include the time that the software was registered in the license file, b) digitally sign the file.

您可能正在系统上存储许可证文件。a) 在许可证文件中包括软件注册的时间，b) 对文件进行数字签名。

The digital signature will tell you if the license file was tampered with. If not, the time will tell you when the software was registered; if the "current time" is less than the registered time, your license manager knows something funny is going on and it can respond according (refuse to run, delete the license, ...

数字签名会告诉您许可证文件是否被篡改。如果没有，时间会告诉你软件是什么时候注册的；如果“当前时间”小于注册时间，您的许可证管理器就会知道发生了一些有趣的事情，它可以做出相应的响应（拒绝运行、删除许可证、...

If you really want to enforce the date range, write the current time on each program execution to a separate digitially signed file, verifying that time always goes monotonically up.

如果您真的想强制执行日期范围，请将每个程序执行的当前时间写入一个单独的数字签名文件，验证时间总是单调递增。

You can also check your last recorded time against any files your application writes-then-reads. Such a file with a date later than your last recorded time indicates some kind license-file rollback.

您还可以根据您的应用程序写入然后读取的任何文件检查您上次记录的时间。这种日期晚于您上次记录时间的文件表明某种许可证文件回滚。

These wont stop the user from setting the clock back some, but it will make it pretty hard for him to do this in an organized way.

这些不会阻止用户将时钟调回一些，但这会使他很难以有组织的方式做到这一点。

回答by aioobe

It is basically impossible to do anything about. A user could "restore" his entire computer so that the software thinks its running at any particular date.

基本上不可能做任何事情。用户可以“恢复”他的整个计算机，以便软件认为它在任何特定日期运行。

You could make it harder by letting the program ask some time-server for the time. (Still though, if someone really wanted to use an old license he could reroute any such traffic to a local time server.)

您可以通过让程序向某个时间服务器询问时间来增加难度。（不过，如果有人真的想使用旧许可证，他可以将任何此类流量重新路由到本地时间服务器。）

Related questions / answers:

相关问题/答案：

• Using Java to Query a Server for the Time

• 使用Java查询服务器时间

回答by rsp

As @aioobe said, applications have no control over the environment in which they are running.

正如@aioobe 所说，应用程序无法控制它们运行的​​环境。

What you can do (if your program also maintains data that is important to your users) is to record what it knows about the date/time and the passing of time. For instance you can store the current time at a regular interval after checking that it did not rollback (when a rollback is detected, output a message with an encrypted code to pass on to you for relicensing so you know that that happened).

您可以做的（如果您的程序还维护对您的用户很重要的数据）是记录它对日期/时间和时间流逝的了解。例如，您可以在检查它没有回滚后定期存储当前时间（当检测到回滚时，输出带有加密代码的消息以传递给您进行重新许可，以便您知道发生了这种情况）。

You can also keep a "counter" that is incremented every hour your program runs giving you another way to estimate the usage of your license.

您还可以保留一个“计数器”，它会在您的程序运行每小时增加一次，从而为您提供另一种估算许可证使用情况的方法。

Using all three your license would run out after a year, a rollback or x hours runtime.

使用所有三个许可证将在一年、回滚或 x 小时运行时间后用完。

回答by Dominic

You have a couple of scenarios to combat:

你有几个场景需要战斗：

1. The user who turns back their system clock before they install your product, and
2. The user who rolls back their system clock after it has been installed.

1. 在安装您的产品之前调回系统时钟的用户，以及
2. 安装后回滚系统时钟的用户。

There are several levels of security you can apply, and if this is a major concern then you may want to use all of them.

您可以应用多种安全级别，如果这是一个主要问题，那么您可能希望使用所有级别。

The most secure is to check the time against an external reference e.g. your server. If there is no network access, you can then use the local methods described above, of using local (hidden) files to keep track of the time on the system, so you can detect rollback. By using more than one such file in more than one location, and having them cross-check each other, you can make this arbitrarily hard to rollback without detection (and you can always keep periodically trying to connect to the external server).

最安全的是根据外部参考（例如您的服务器）检查时间。如果没有网络访问，则可以使用上述本地方法，即使用本地（隐藏）文件来跟踪系统上的时间，以便检测回滚。通过在多个位置使用多个这样的文件，并让它们相互交叉检查，您可以任意地使其难以在不被检测的情况下回滚（并且您可以始终定期尝试连接到外部服务器）。

回答by jorge sampaio

Code your app to send you emails with user's session use and check arrival times. Automate the email monitoring! Otherwise you yill become a slave of your success.

编写您的应用程序以向您发送包含用户会话使用情况的电子邮件并检查到达时间。自动化电子邮件监控！否则你将成为你成功的奴隶。

Jorge

乔治