My current business model takes a loss upfront on hardware in the hopes that the service will be paid for continuously. When service is not paid for the instructions are sent to the client hardware to stop functioning.
I want to find a way to decrease the chances that someone sets up a rouge server to keep the client hardware functioning even though it has not been paid for. This has the added benefit of ensuring that rouge servers are not setup to simply take over client machines for malicious purposes.
In a very simple attempt to get the ball rolling I have setup the following "system":
Hardware based serial numbers are collected from the client machine before deployment and are combined through encryption with 2 pieces of information known to the server.
The encrypted value is stored on the client machine. 2a. The 2 pieces of information are always known to the server.
When the client first connects to the server it passes the hardware serial to the server.
The serial is combined with the information and encrypted.
The encrypted value is passed back to the client to see if it matches the stored value.
This system seems to work, but I would not be here asking if it is valid if I thought it was the best solution to my problem.