Search code examples
springdrm

DRM for spring application


What are the possibilities to add digital right managment to a java spring application?

The war file should be shipped for free usage with limited features. The customer should have the choice to buy an unlimited version.

Are there standards for this?


Solution

  • Additional JAR with new features (spring profiles and @ConditionalOn)

    You could provide paying customer with additional jar that will enable new features. That jar could be loaded using spring boot autoconfiguration features (@ConditionalOnClass for example). Do you really need war? you could use executable jar instead (jar with bundled Tomcat http://docs.spring.io/spring-boot/docs/current/reference/html/build-tool-plugins-maven-plugin.html#build-tool-plugins-maven-plugin).

    End result is the same- web application. But with jar, it is very easy to add your another jar (with additional features) to classpath and application will pick it up.

    See http://docs.spring.io/spring-boot/docs/current/reference/html/boot-features-developing-auto-configuration.html for details.

    OSGi

    You could also enable new features using OSGi modules.

    But this is not really DRM, just customization. One customer could still copy feature-specific jar from another customer.

    You could build jar per-customer (hardcode customer details in jar) and obfuscate it, but I think it will be still super-easy to break. Java had very easy debuging, and no protection against debuging, side-loading patched code, etc.

    You may start your application with SecurityManager (to block some sensitive operations) https://docs.oracle.com/javase/tutorial/essential/environment/security.html but I think it will still be very easy to bypass.

    Cloud model

    Final note: you deployment model is war (web application). Do you really need to provide customer with that war? maybe you could use cloud model: host software on your own and just give customer access. Specific features could be unlocked only for some (paying customers). Examples: Github or even Stackoverflow (Stackoverflow unlocks more features for users with more reputation, not those who paid, but general rule is the same).