[libvirt-users] How to securely license guests?

[David Knierim]

Hi,
   I have been asked to research and recommend a method to securely license
guests on RHEL/KVM 6.2+ hosts.   The guests will be running CentOS or RHEL
(5.X or 6.2+).

   The primary driver to license the software is that we will be selling
Telecommunications software in countries where it is common to pirate
software.   As such, we are worried about the software being purchased one
time and then multiple instances of the software being used.

We plan to use a USB security dongle (I hate that word!) of some kind.   If
we were running without virtualization, the solution is pretty straight
forward.   We would install the security dongle on the server and compile
the licensing library which accessed the dongle into our code.   We
understand that this could be circumvented by a dedicated foe, but it would
be reasonably secure.

However, as soon as the licensed code is running in a guest, things get a
lot more complicated.   My first thought was that we could use PCI
passthrough to map the USB controller to one guest.   Unfortunately, they
want to have multiple guests access the same security dongle concurrently.

I could see using a bridge that is only on the host to allow the guests to
communicate with the host which proxies the requests to the security
device.   However, it would be pretty easy to connect a network tunnel to
the bridge which could allow guests at remote sites to access the security
dongle and this would allow the licensed software to be replicated.


Can anyone recommend a solution or partial solution to this issue?

Any thoughts are welcome,
   David
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/libvirt-users/attachments/20120204/c095f528/attachment.htm>