Problem with license authentication system

[Bot]

We have our own license management system based on IPB for our desktop software application. In order to prevent interception of the network traffic, which could be used for software piracy, we encrypt requests and responses between the desktop application and a PHP script on our server. The PHP script then uses the IPB web API to retrieve information about the user's license. The response to the user is encrypted, so they cannot intercept the response to spoof a fake valid license.

The system works really well, except for one problem. If any automatic security actions kick in, the entire user base can be blocked from accessing their license info. If one user tries to log in too many times with a bad password, IPB bans the IP address where the requests are coming from, which happens to be its own server! This means all requests from the PHP script hosted on the same server are blocked. The solution is to manually un-ban the IP address. Since there is no whitelist of IP addresses NOT to ban, I have to do this manually any time it happens.

The other error I have seen is a message "TOO_MANY_REQUESTS_WITH_BAD_KEY". I do not know how to resolve this problem. Our entire user base is currently blocked from using the software because of this error.

How do you advise I deal with these issues?

 

View the full Question