How to avoid of application running on Oracle 10g to be copied?

Question

I am a newbie to the security issues, so I need your help, please, where to start / what to read:
I have an application running across many customers on Oracle 10g. I have faced lately that our users
can use their daily backups to establish a totaly new database on a same / different server
and point our application to use it as well.
Is there any way to avoid it? F.e. I thought to use SELECT * FROM v$instance; to get the server instance details, and
in result with some other function to obtain, let say, local server's (WIN2003) details,
such as HD Serial Number, MAC number or so and then to check these values each time user runs the application.
Is it the correct way? What are the basics here at all?
Many thanks in advance to all!

Answer 1

A lot of enterprises, however, actively avoid systems which are locked down to a particular server for very legitimate reasons. If my data center dies in the middle of the night, I sure don't want to have to call your mobile phone so that you can get to a computer, log in to the office network, and get me a new key so that I can finish my emergency failover. If I've got dozens of applications, I absolutely don't want to do that with dozens of different vendors.
It sounds like your problem, though, isn't that users are installing your software on multiple computers it's that they are accessing functionality they haven't licensed. That is generally a much easier problem to solve and doesn't require you to lock anything down to a particular machine. You can create a table LICENSED_CONTENT, for example,
CREATE TABLE licensed_content (
  client_id    NUMBER,
  content_type VARCHAR2(30),
  key          RAW(128)
)In this case, KEY is, say, a hash (using the DBMS_CRYPTO or DBMS_OBFUSCATION_TOOLKIT packages if you'd like) of the client_id, content_type, and a bit of salt (i.e. a fixed string that only you know). When you sell a license to manage diamond content, you provide a script that inserts the appropriate row in the LICENSED_CONTENT table. When your application starts up, it reads the LICENSED_CONTENT table and verifies the hash before allowing users to access that type of content. This allows legitimate customers to move the software from one system to another but prevents them from accessing new functionality without a new license.
Justin