One time password with Hardware Token

Question

I am researching software authentication methods that are easy yet secure to implement in my own projects.

IDEAS: Steps to authenticate apps

The application is running from a USB drive as it is never installed on any one computer.

1. Upon each run, the software starts up Information such as USB Hardware ID and perhaps an ID unique to the app is gathered and somehow securely hashed into an activation key-like string.
2. This string is then passed as a parameter into a PHP function where it is reversed (server-side) and content checked against a database to verify that the application was run from an 'authorized' USB key and not copied from one to another (as H/W ID would change and not match the one in the database) - effectively this would minimise the chance that a client gets two working 'software licenses'.

Questions

The idea is to be able to retrieve the columns for the row in the database, which matches that particular HW ID and unique app secret will locate the correct row. The PHP is used to check if further entries in that row are also matching other values such as whether the HW key is expired or not. However, to prevent the user from using that same string parameter every time, it should be random and near impossible to calculate/guess, yet link to the same location in the database.

I am now considering encryption instead of hashing (for the benefit of maintaining the data), as it can be decrypted using a master key at the server. I understand that hashing only converts in one direction and perhaps I wasn't expressing the scenario correctly before this edit so I hope things have become a little clearer. Could someone guide me in the right direction? How is this done?

I'd really appreciate any feedback and ideas on how to make this happen properly.

Answer 1

You want a string that is unique every time the registration key is checked and something that the user will not be able to easily reverse engineer (and thereby bypass your DRM restrictions).

One way to do this is to have the application store your crypto key. You concat/combine the software keys, IDs, and whatever other data you want, along with a random string that changes every time this data is accessed/requested. You encrypt this with the crypto key and pass to your server. The server decrypts with its crypto key, extracts the decrypted data and dumps the random string.

1. The use of the random string means that the resulting cyphertext string is unique each time, making it difficult to reverse engineer.
2. Encrypting means that you can read the plaintext data even though the cyphertext is different each time (a feature that a straight hash cannot provide).

The downside is that the cyphertext might get large (depending on how you do it). You should also make sure that the random text is of a variable length to further make it difficult to guess the component strings.

The other problem you will have is the proper handling of the key in your app. Once a user gets that, then they can craft their own strings that will pass your tests.

In general, you are asking about how to devise a DRM solution. There are lots of established ways to do this, and I recommend you look at their design patterns.

The common struggle is that once you place your app in the hands of a user, then you lose a lot of control. It is better to design your solution so that it does not matter if a user copies your software, or design a framework upon which your app runs instead of locally (which is way web-based apps are so popular). You also have to weigh the cost/benefits of all this design work against the work a user will have to go through to defeat it. Are you placing your efforts in the right place?