Question

Use case: You have enabled VM detection using the API function, then ran a series of tests and proved that you can get a license for a feature without increasing your feature licensing count in FlexNet Operations by spoofing a Device ID like a MAC address.

The free license occurs because the regenerative factor, so when a second device with the same Device ID asks for a license, it grants it, but still only sees 1 license count in use (rather than 2 or more).

What is the suggested best practice to not permit VM's to spoof a Device ID? Would it be to make a VM device ID a combination of the virtual MAC Address as well as the UUID or similar GUID type ID that is assigned to each VM by the VM host manager software? If so, how would you prevent the UUID from being spoofed as well? The host manager programs (such as VMware and Mac Parallels) do not seem to allow the user to set the UUID, though it may be possible that it can be done.

What is the best practice to prevent a VM from spoofing a Device ID?

Answer

We have a contrib library for obtaining the VM_UUID for 32 and 64 bit Linux and Windows, called FlxContribVmUuid-<platform>-<version>.

As for the host ID, if you are using the XT kits, we provide API functions that return a list of the host Ids we detect on the system. For Java, it is ILicenseManager.getHostIds(). For C-XT, it is FlcGetHostIds(), etc?

Additional Information

A possible more-outside-the-box solution, you could perhaps create Producer-defined Hostids based on the Microsoft Generation ID which will change when a machine has been cloned.