Best Way to Protect Commercial AutoLISP Applications – High-Level Security and Licensing

[Sathar]

Hello everyone,

I am an AutoLISP developer, and I am developing several AutoCAD MEP applications that I plan to sell commercially.

My applications include:

Drainage Piping System

Chilled Water Piping System

fire fighting Piping System

Water Supply System

Other MEP automation tools

I want to protect my software professionally before distributing it to customers.

I already understand that compiling LISP into FAS/VLX provides some source-code protection, but I am looking for a much stronger commercial security solution.

My requirements:

Strong source-code protection against reverse engineering and decompilation.

Secure software licensing with unique activation keys for each customer.

Online/cloud-based license verification.

Trial management (7-day or 14-day trial).

License expiration and renewal management.

Ability to deactivate or revoke a license remotely.

Hardware or machine-based activation to prevent unauthorized sharing.

Protection against system date manipulation and trial resetting.

Offline usage with a secure grace period when there is no internet connection.

Protection against users copying the application to another computer or sharing it with others.

My questions:

What is the strongest protection method currently available for commercial AutoLISP applications?

Is FAS/VLX compilation sufficient, or should I use a combination of AutoLISP, .NET DLL and an external licensing system?

Is cloud-based licensing more secure than local license verification?

Are there any professional commercial protection tools or DRM solutions specifically suitable for AutoCAD plugins?

How do experienced AutoLISP developers protect and distribute their commercial applications?

I am looking for a professional, reliable and commercially suitable solution, not just basic password protection or simple computer-name checking.

I would really appreciate advice and recommendations from experienced developers who have successfully sold commercial AutoCAD applications.

Thank you!

[mhupp]

@VicoWang might have a solution.

[VicoWang]

Thanks for @mhupp recommendation.

 

@Sathar

 

These issues you raised, I should have solved them all on VedaCAD, but all the technologies are developed specifically, without using any mature commercial solutions or public libraries, so there is no way for me to provide you with my technical implementation.

But I have an idea that might be easier to achieve, perhaps it could provide you with some ideas:

 

Notion can actually be accessed through API, all operations in Notion are graphical, such as creating a table accessible through API, when your users verify through the client, check if there is corresponding authorization information in the table. At this point, the Notion table functions like a database, avoiding the trouble of creating a database (designing a database from scratch is really Trouble, the database in the development of vedacad has been adjusted for at least over 100 rounds).

 

You need a server (even a dedicated domain is not necessary, but it needs to connect the client and the Notion API, and storing the Notion token on the server instead of hardcoding it on the client is a safe isolation strategy), let your client access your server, let the server access your Notion table, and return true/false and time to the client, and set a reasonable reconnection time interval, which should be able to implement a certain degree of online authorization verification system.

 

As long as you master how to make the client connect to a specific server endpoint, the above pattern should be achievable, unlike VedaCAD, which also needs to transmit the file itself, which is the easiest part to crash.

 

Although protecting our intellectual property is our business strategy, this forum is more open to discussions on the open-source of some simple/free plugins, hoping the above ideas can help you.