I wrote an application that verifies that a user's license key is valid. The method I use is that I have a private key on the server that takes the host ID, se

I wrote an application that verifies that a user's license key is valid. The method I use is that I have a private key on the server that takes the host ID, serial number, username, then digitally signs the data with the private key and sends back the signature. When the software is reading the key, it verifies the signature (with the same data as sent to the server), then verifies that the host ID in the license file matches the actual host ID from the machine. If anyone attempts to change the host ID to match their computer, then the signature becomes invalid. Dropbox could generate a signature based on their host-ID + a calculated hardware or OS installation value, then use the signature to validate the host-id in the database plus the calculated value. If the signature is valid, then the machine must be the machine that was originally validated.