Maxtree Licensing System
Cryptographic License Verification & Authorization Service
The Engineering Challenge
The licensing service needed to authenticate desktop plugin clients securely without exposing master private keys, while gracefully handling flaky client connections and preventing replay attacks.
A secure authorization backend and client verification module for desktop 3D CAD/3ds Max plugins, enforcing license validity while supporting offline grace periods and tamper resistance.
Core Architectural Responsibilities
- Formulated an asymmetric key-pair signing architecture (Ed25519) for tamper-evident license tokens.
- Constructed a hardened Laravel REST API with strict rate limiting and hardware-fingerprint binding.
- Wrote a lightweight Python verification bridge for native integration with the desktop 3ds Max runtime.
- Implemented a secure offline grace-period validator with monotonic local timestamp checking.
System Architecture
The desktop plugin collects machine fingerprints and submits a signed challenge to the Laravel API. The API validates entitlements, generates an Ed25519-signed JWT containing valid feature flags, and returns it. The plugin verifies the signature using the embedded public key.
Desktop Host (3ds Max)
Plugin environment running Python client verification runtime.
Hardware Fingerprinter
Obfuscated CPU, motherboard, and disk identifier hashing.
Licensing API Gateway
High-availability endpoint with mTLS and token issuance.
Entitlement Database
Customer licenses, active activations, and seat allocations.
Cryptographic Signer
Isolated signing module utilizing asymmetric Ed25519 keys.
Key Technical Decisions & Trade-Offs
Asymmetric Ed25519 Signatures
Allows the desktop client to verify license validity offline using only a public key, without risking secret compromise.
Fail-Closed with Capped Leeway
Strikes the optimal balance between customer continuity during internet dropouts and piracy resistance.
Seat Allocation Leases
Heartbeat renew leases automatically, freeing seats when workstations shut down without explicit logout.
Technologies Deployed
Lessons Learned & Retrospective
- Observation #1: Virtual machine environments require multi-factor hardware hashing to avoid duplicate activation spoofing.
- Observation #2: Clock-skew mitigation is mandatory when desktop system times drift relative to NTP servers.
- Observation #3: Public keys must be embedded with integrity checks to prevent binary patching.
CONTINUE EXPLORING ARCHITECTURE CASE STUDIES
SkillUp Platform
High-Concurrency Growth & Performance Platform
SmartPOS ERP
Mobile Retail Point-of-Sale & Inventory System
Tanqia Skills
Employee Task Management System