Jestr Journal of Engineering Science and Technology Review 11 (4) (2018) 48 - 51

Research Article
JOURNAL OF
Engineering Science and
Technology Review

www.jestr.org
A Subtle Serial Key based Software Protection Scheme
Aderibigbe Israel Adekitan and Abidemi Orimogunje

Department of Electrical and Information Engineering, Covenant University, Ota, Ogun State, Nigeria

Received 11 March 2018; Accepted 19 September 2018

___________________________________________________________________________________________

Abstract

Software piracy is a modern day war between malicious software pirates and software developers. Annually, developers
lose billions of dollars in revenue to piracy, making it an industry bane that must be controlled by all means. The drive
for improved software protection systems has increased the complexity of both proposed and implemented schemes.
Some of the methods are cost intensive in terms of development, management and hardware requirement (smart card
tokens), while this may be justified for costly software applications, for low cost and basic applications by small scale
developers, implementing advanced protection schemes is often economically infeasible and largely an overkill. This
study presents a subtle software protection model using serial keys. The model implements a form of obfuscation by
using hidden codes, encrypted functions and uses a distraction technique by diverting the attention of potential hackers to
the serial key while trickily using coded strings for the actual user authentication.

Keywords: Application software protection, serial key authentication, function hiding, data and system security, unique signature,
encryption
____________________________________________________________________________________________

1. Introduction using it to generate a key. This creates a problem for the user
if the user replaces his hardware with a new one. The study
Software is vital for productivity virtually in all spheres of by [3] proposes the use of function hiding techniques that
life. Software are deployed for program driven machines in performs key checks without revealing the method applied,
industries, data processing applications and various but this is only limited to polynomial functions [1]. Code
simulation tools in different operations and research fields. obfuscation method is another method that tries to hide the
Software development requires a lot of resources and man- program behaviour making it hard for hackers to understand
hours, and as such, a sizable budget must be available to and manipulate [4-6]. Some network based protections
drive the software development project based on the project schemes have also been deployed, and this performs license
scope. After a successful software design and checks each time the application is run, making it
implementation, the developer needs to recoup on the challenging for users with irregular access to the internet [7].
investment, and this is done via sales of various licences for Further research on software protection led to the
the use of the developed application, but this is often development of tamper proof [8] and anti-debugging
challenged by software piracy. Annually, the software approaches, and the use of hardware for software protection.
industry loses billions of dollars to piracy [1], and this has According to [9], a perfect, only software based solution to
triggered efforts toward protecting software applications. software protection is not realistic. The use of program
A number of software applications are unprotected while specific hardware tokens or dongles such as smart cards that
others have weak protection. Software protection is a uses communication ports create card juggling issues for
daunting task particularly with the ever growing army of different applications [1]. The study by [10], proposed the
hackers, skilled at reverse engineering and windows data use of smart cards and digital certificates using a license
recovery [2]. This has made it compulsory to keep evolving management system. A robust protection scheme was
improved strategy using both software and hardware developed by [1] using smart cards and cryptographic
protection schemes, coupled with legal protection and techniques.
sanctions. At times illegal software use can also be in the Computer security and trust management is vital for
form of multiple installation of legally acquired single user online services [6, 11], and ultimately software protection
licence, and this may go unnoticed if not monitored. has become so complex and costly in terms of skill
Software protection may be in the use of license keys requirement and the use of hardware devices. For expensive
that are checked during installation. This requires that the software applications, these advance schemes may be cost
licence validation be embedded in the software creating an effective but for small size applications, particularly for low
opportunity for hackers. The use of hardware signatures is cost software and small scale software enterprises
also common and this entails extracting key information developing basic applications in developing countries some
from the hardware on which the application is installed and of these schemes are overkill due to the level of software
patronage and quality challenges [12, 13]. Hence, there is a
______________ need to develop a functional but easy to implement, and cost
*E-mail address: [email protected]
ISSN: 1791-2377 © 2018 Eastern Macedonia and Thrace Institute of Technology. All rights reserved. effective software protection scheme which does not require
doi:10.25103/jestr.114.06 an additional hardware token in the form of dongles and
 Aderibigbe Israel Adekitan and Abidemi Orimogunje/Journal of Engineering Science and Technology Review 11 (4) (2018) 48 - 51

specialized smart cards thereby reducing implementation continuous verification with alternative strings. The
cost and also eliminating the inconvenience for users to feasibility of the proposed scheme was demonstrated using
carry a smart card per software creating the problem of card windows form. After the protected software is installed, the
juggling. Also, there is a possibility of hardware token user data form will pop-up and the user must mandatorily fill
failure or for the user to misplace the hardware token. it to complete the installation process.
Instances where codes were developed to bypass the card The data collected is encrypted, processed on the user
verification have also been reported. PC and also sent to the software developer for saving on the
In this study, a tricky but effective serial key based database and for generating the user specific serial key.
software protection model is proposed which can be easily Figure 1 shows the generation of a unique serial key by the
deployed, even on low cost software, and it does not require developer using the decrypted data received from the filled
sophisticated computers or specialized tamper proof user registration form. A link is sent to the user to complete
processors, and expensive computation using asymmetric the transaction by making payment online to purchase a
cryptosystem to deploy, but the user authentication process unique serial key. Once the payment is successfully made
is tricky, thereby limiting the chances of the software being for the serial key, the software automatically picks the
hacked and used illegally. unique serial key and displays it to the user who then clicks
FINISH to complete the transaction. By displaying the serial
key, the user’s attention is drawn to it, and, may consider
2. Methodology writing it for possible re-use on another system. Also, a
potential hacker’s attention will also be drawn to the serial
To demonstrate the implementation of the subtle, serial key key and the hacker is being tricked to focus on how to re-use
based protection system; an interface was deployed using or re-generate valid serial keys using the purchased one.
Visual Basic for collecting vital information about the Unknown to any user attempting illegal tampering with
software user. The submitted data is encrypted, saved on the the serial key validation process, is the fact that the serial
PC and also uploaded online to the developer’s data base key is only useful at the point of purchase. Once the
with a unique identification for each specific user. A user’s software purchase is successful and validated, the serial key
email address can only be used for one registration, and becomes a dummy variable, and the application initiates the
users suspected of attempting multiple registrations can be subtle user verification process at each run. During
automatically identified for further investigation when the installation on the PC the application uses code obfuscation
same name or telephone number is submitted for different to develop three coded unique strings (String A, String B
email addresses. Using function hiding, the collected data is and String C) for data validation. Figure 2 shows the three
concatenated into strings and divided into multiple parts strings generated by performing input filtering, text
based on pre-classified specific attributes of the collected concatenation and encoding. Each of the three strings will be
data, using an encrypted function, a rule based selection of stored at different locations locally on the PC. The use of
data segment from each divided data part is done and then online payment and activation directs the attention of
data coding is performed to transform the processed data potential hackers to the online serial key activation and
portions into three visually meaningless validation strings validation process without being aware of the use of the
which will eventually be used for user verification after a three strings for the actual user verification as detailed in the
trigger is activated by the developer during online payment. flow chart in Figure 3.
At the developer’s end, a unique serial key is generated Each time the application is opened, the application will
for the user using the received encrypted user data. The run normally for a random amount of minutes and then the
software developer then sends a link to the user to purchase validity of string B is checked and if it is not valid the
the unique serial key via online payment. After a successful application will keep running for further random minutes
online payment, with the buyer’s attention drawn to the and then suddenly crash with an ambiguous error message.
displayed serial key, the subtle user verification process If the user restarts the application, the user will be
which is independent of the serial key is automatically automatically taken to the registration page as a new user.
activated. Also, if the initial post start-up check is successful; when the
user is now closing the application, before exiting, the
application will check the validity of String A and String C,
3. The proposed subtle software protection scheme and if either of the two strings are invalid a flag is set such
that at the next opening of the application the user is also
This study presents a basic software protection system that automatically taken to the user registration form as a new
combines a form of obfuscation with online verification. It user. A user that changes hardware can be re-authenticated
attempts to direct attention at the serial key but with after verification using the stored user data in the
subtlety, it actually uses a separate series of short strings for developer’s central database. The operational model of the
actual post registration software validation. Microsoft serial subtle serial key is shown in Figure 3.
keys typically use an alphabet base of 24 characters which
most people are quite familiar with. In this model, a 46
character base is implemented which makes the serial key 4. Results and Discussion
generated quite different and unfamiliar. For a 20 character
serial key, 110.47 bits of data (log 2 4620 ) will be required. The model demonstration using windows form confirms
the feasibility of the implementation on a commercial
The scheme is described in Figure 1. scale. Using sample user data, serial keys were generated
Although, according to [1] there is no absolutely secure using the serial key generator to depict the developer’s end
solution in software protection; in this study an attempt is of the process while the three verification strings were also
made to make a simple software authentication process successfully generated from the user data and verified
tricky and difficult to hack by subtly misdirecting the focus during operation. When an attempt was made to use the
of potential hackers to the serial key why performing

49
 Aderibigbe Israel Adekitan and Abidemi Orimogunje/Journal of Engineering Science and Technology Review 11 (4) (2018) 48 - 51

serial key for one user to validate the application form for
another user, an invalid serial key error was triggered
because the serial key supplied is not a coded equivalent
of the submitted user data. The non-use of the serial key
after payment, and the verification of String B few
minutes after startup, and String A and C when closing the
app creates a rear verification process that potential
hackers are not used to. Also, by performing the
verification checks only after running the application for a
random period of time at each run makes it difficult to
predict the operation, and it also prevents forming an easy Fig. 1. Generation of serial key by the software developer using the
user data
general conclusion of precisely saying that a tampered or
hacker modified installation keeps crashing after running
consistently for e.g. ten minutes which might make
targeted reverse code debugging easily possible.

Fig. 2. The three strings generated for user validation

User installs
application

User fills mandatory

Data Form and The encrypted data
submits. The actual is also sent online to
application remains the developer’s
inaccessible until it database
is activated

The developer loads At next app startup

The submitted data the data and the software
is locked, encrypted generates a unique activation is
and saved on the PC serial key that has a restarted
relationship with
the 3 data strings
The app works for
Three (3) sets of visually The serial key is some random
meaningless data strings saved with user minutes more and
(String A, B & C) are data profile on the crashes with an
generated using the developer’s ambigous error
submitted data by an database message
encrypted function
No
A link is sent via The program keeps
email to the user to is validity test
The data strings are saved on Yes running without any
purchase the serial OK?
the hard drive in three separate issues
key for automatic
hidden locations using
program activation
unobvious codes in different
sections of the program
When the user
At each startup no closes the program,
After online
check is performed. the software checks
activation, the 2nd
Some random STRING A and
part of the tricky
minutes after app STRING C for validity
User Authentication
startup, STRING B is
is activated
checked for validity.

On start-up again
is validity test the software
No
OK? activation process is
restarted
Yes
A flag is set that
allows the software
to start normally
next time
Fig. 3. Flow chart of the proposed software protection scheme

50
 Aderibigbe Israel Adekitan and Abidemi Orimogunje/Journal of Engineering Science and Technology Review 11 (4) (2018) 48 - 51

5. Conclusion validation is performed using three hidden coded strings

which is activated when a matching serial key is supplied.
In this study, a subtle easy to implement software
protection scheme was proposed and implemented using Acknowledgments
windows form. The proposed model takes the use of serial The Authors appreciate Covenant University Centre for
key as a means of protection, a step further by combining Research, Innovation and Discovery for supporting the
online activation with subtle obfuscation strategy as a publication of this research study.
distraction strategy that will make potential hackers spend
time effortlessly on breaking the serial key generation and This is an Open Access article distributed under the terms of the
validation process without being aware that actual user Creative Commons Attribution Licence

______________________________
References

1. Maña, A. and E. Pimentel. An Efficient Software Protection 9. Goldreich, O. Towards a theory of software protection. in
Scheme. in Trusted Information. 2001. Boston, MA: Springer US. Conference on the Theory and Application of Cryptographic
2. Olajide, F. and S. Misra, Forensic investigation and analysis of user Techniques. 1986. Springer.
input information in business application. Indian Journal of Science 10. Aura, T. and D. Gollmann. Software License Management with
and Technology, 2016. 9(25). Smart Cards. in Smartcard. 1999.
3. Sander, T. and C.F. Tschudin. On software protection via function 11. Govindaraj, P. and N. Jaisankar, A review on various trust models
hiding. in International Workshop on Information Hiding. 1998. in cloud environment. Journal of Engineering Science and
Springer. Technology Review, 2017. 10(2): p. 213-219.
4. Jiutao, T. and L. Guoyuan. Research of software protection. in 2010 12. Sowunmi, O.Y. and S. Misra. An empirical evaluation of software
International Conference on Educational and Network Technology. quality assurance practices and challenges in a developing country.
2010. in Proceedings - 15th IEEE International Conference on Computer
5. Wroblewski, G., General method of program code obfuscation and Information Technology, CIT 2015, 14th IEEE International
(draft). Citeseer, 2002. Conference on Ubiquitous Computing and Communications, IUCC
6. Osemwegie, O., et al., On issues, strategies and solutions for 2015, 13th IEEE International Conference on Dependable,
computer security and disaster recovery in online start-ups. Autonomic and Secure Computing, DASC 2015 and 13th IEEE
International Journal of Applied Engineering Research, 2017. International Conference on Pervasive Intelligence and Computing,
12(19): p. 8009-8015. PICom 2015. 2015.
7. Carlsson, K., Developing an efficient software protection and 13. Sowunmi, O.Y., et al., An empirical evaluation of software quality
licensing scheme, in Department of Computer Science and assurance practices and challenges in a developing country: A
Engineering. 2014, Chalmers University of Technology. comparison of Nigeria and Turkey. SpringerPlus, 2016. 5(1): p. 1-
8. Tan, G., Y. Chen, and M.H. Jakubowski. Delayed and controlled 13.
failures in tamper-resistant software. in International Workshop on
Information Hiding. 2006. Springer.

51