Question

I’m required to implement a license management and i could not understand the difference between an online and offline license verification. Could you please try to help me?

Regards,

Answer 1

Speaking in general terms, with offline verification, all the details are stored locally, while online verification, some or all the details are stored on the license server. Choosing offline or online verification has these main implications.

Control

Offline verification typically offers only indirect control over the license. For example, revoking a license is either not possible or requires adding the license to a license Blacklist that is included in next release of your app.

Online verification offers more immediate control. When a license is revoked, the change becomes apparent as soon as the license is checked, typically when the user next launches the application. The same is true for other changes to the license, such as allowing more usages, extending the expiration date, With offline use, you would have to send the customer a new license to effect this changes.

Security

Offline activation is in principle the less secure of the two. With offline verification, all the secrets are stored locally. That is, the key and the lock are in the same place, and can eventually be compromised. With online verification, the "secrets" maintained by the license server are separate, and inaccessible. An attacker cannot get to them, and so the system cannot be compromised in that way.