Hardware-Bound Offline Licensing

• Machine identity is a hash of the TPM endorsement key, the firmware UUID and the board serial, so a cloned drive on a different machine does not validate.
• The offline timer holds a monotonic high-water mark, anchored in production to the TPM monotonic clock and sealed storage, so rolling the clock back does not un-expire a seat.
• Authenticity is checked before policy: the signature verifies first, and only a validated licence is ever readable, so tampering breaks the signature.

The problem: licensing where there is no network to call home

Most licensing assumes a server on the other end of a connection. A client checks in, a server says yes or no, and expiry is whatever the server last reported. Take the network away and that whole model collapses. On an air-gapped machine there is nobody to phone, no clock to trust but the local one, and nothing stopping a determined operator from copying the disk, editing a file, or setting the date to last year.

SIOS runs offline by design, on-device and air-gap capable, so we had to solve this without a server in the loop. A per-seat licence has to prove three things entirely on the machine in front of it: that it was issued by us, that it belongs on this specific machine, and that it has not expired. All three checks happen locally, with no internet, and each one is built to fail closed rather than fall open when something is missing.

“On an air-gapped machine there is nobody to phone and no clock to trust but the local one.”

Hardware-rooted machine identity

Under the strict policy, the machine identity is a hash of three hardware facts: the TPM endorsement key, the BIOS or firmware UUID, and the board serial. Written plainly, machine_id = H(TPM_EK, BIOS_UUID, board_serial). The endorsement key is the anchor, the input rooted in the trusted platform module rather than in software, which is what makes the binding strong rather than cosmetic.

The TPM is required under strict policy. If it is absent, the check fails closed. We would rather refuse to run than pretend a soft identifier is a hardware root. For hardware with no TPM there is a firmware-only fallback, and we say plainly that it is weaker. TPM gives the strongest binding. Firmware-only is a fallback, not an equal.

“The TPM is required under strict policy. If it is absent, the check fails closed.”

Why a cloned drive fails but a swapped disk does not

This is the distinction that trips up naive schemes. Disk and network-card identifiers are advisory only in SIOS. They are not part of the machine identity, so they cannot be the thing an attacker copies to defeat it.

Swap a failing hard disk for a new one and the seat stays valid, because the TPM, the firmware UUID and the board serial are unchanged. That is normal hardware maintenance and it should not cost anyone a licence. Now clone the entire drive, licence and all, onto a different machine and it fails, because that machine computes a different machine identity. The licence was minted for one hardware root and it will only validate against that root. Copying the bits is easy. Copying the hardware identity is the part that does not come along for the ride.

The rollback-resistant offline timer

Time-bounding a licence with no network is the other half of the problem. A seat expires when the local clock passes its expiry, full stop, no connection needed. The obvious attack is to move the system clock backwards to un-expire a seat, so the timer is built to resist exactly that.

The licence enforces a monotonic high-water mark: it remembers the furthest point in time it has ever seen and will not accept a present that sits behind it. In production this high-water mark is anchored to the TPM monotonic clock and to sealed non-volatile storage, so it is not something you can edit in a file or reset by booting with a different date. Set the clock back and the seat stays expired, because the licence already knows the future happened.

“Set the clock back and the seat stays expired, because the licence already knows the future happened.”

Authenticity before policy, and encapsulation

Order matters. SIOS checks the signature before it reads any field of the licence. Authenticity comes before policy. A licence is never parsed for its entitlements and dates until it has proven it was signed by the correct organisation key, and a licence signed by a different organisation's key does not verify at all.

The verified licence is then encapsulated, so that only a validated licence is ever readable by the rest of the system. There is no code path that reads a licence field from an unverified blob. That closes the whole class of attacks where you tamper with the contents and hope something downstream trusts them. Editing a licence to extend its expiry, add an entitlement, or rebind it to the attacker's own machine all break the signature, and a broken signature never reaches policy.

Revocation and sealing to the audit ledger

Binding and expiry handle the machine and the clock. Revocation handles the human decision to pull a seat. Seats are revocable through a revocation set, so a licence that should no longer be honoured can be turned off without waiting for its natural expiry.

Every minted seat is sealed to the Open Audit Record, which means issuing and revoking a seat are themselves events written into the tamper-evident ledger. You get a record that is tamper-evident and cryptographically verifiable relative to a signed checkpoint held where an attacker cannot rewrite it. The honest boundary is worth stating: an attacker with the machine can still delete the record or refuse to run the verifier. Those acts are conspicuous. What they cannot do is quietly alter an issue or a revoke and have it pass verification.

“Issuing and revoking a seat are themselves events written into the tamper-evident ledger.”

How it is built

The licence and attestation code is written in Rust and forbids unsafe code, which removes an entire category of memory-safety mistakes from the part of the system that has to be trusted. It passed a four-lens adversarial security review, where the goal was to break it rather than to admire it.

The test suite covers the cases that matter and are easy to get wrong: the machine-binding, the offline expiry, rejection of a rolled-back clock, cross-machine failure of a cloned licence, rejection of a wrong organisation key, and the property that any tamper breaks the signature. These are the behaviours a customer is actually relying on, so they are the behaviours we test directly.

Where this sits in our filed estate

Hardware-rooted, offline-enforcing licensing with a rollback-resistant timer is part of MICKAI's filed patent estate. We have 104 filed patent applications carrying 2,340 claims in total, all patent-pending.

The strategy is deliberate. We patent the mechanism, how sovereignty, auditability, licensing and orchestration are enforced, not the AI models underneath. Machine-binding to a hardware root, a monotonic offline timer, authenticity-before-policy with an encapsulated licence, and the sealing of every issue and revoke to the audit ledger are exactly the class of enforcement mechanism we patent, rather than the models that run on top of it.

Questions people ask

Can a customer just copy the licence file to another machine?

No. The licence is bound to a hardware-rooted machine identity, a hash of the TPM endorsement key, the firmware UUID and the board serial. Copy the file, or clone the whole drive, onto a different machine and it fails to validate, because that machine computes a different identity than the one the seat was minted for.

What happens if I replace a failing hard disk?

Your seat stays valid. Disk and network-card identifiers are advisory only and are not part of the machine identity, so swapping a disk is normal maintenance and does not break the licence. Only a change to the TPM, firmware UUID or board serial changes the machine identity.

Does the licence still expire without an internet connection?

Yes. Expiry is enforced entirely offline. A seat expires the moment the local clock passes its expiry, with no network needed. There is no check-in step that an air-gapped machine could miss.

Can I roll the system clock back to keep a seat alive?

No. The licence enforces a monotonic high-water mark of the furthest time it has ever seen, anchored in production to the TPM monotonic clock and sealed non-volatile storage. Setting the clock backwards leaves the seat expired, because the licence will not accept a present behind the point it already recorded.

What if someone edits the licence to add an entitlement or a later expiry?

It stops verifying. Authenticity is checked before any field is read, so a tampered licence never reaches policy. Extending expiry, adding an entitlement, rebinding to another machine, or signing with a different organisation's key all break the signature, and only a validated licence is ever readable.

How strong is the binding without a TPM?

Weaker, and we say so plainly. Under the strict policy the TPM is required and the check fails closed if it is absent. For hardware with no TPM there is a firmware-only fallback, but that path gives a weaker binding, not an equal one, so the strict policy keeps the TPM in the loop.