Offline authorization systems (VB, net)

See more:

VB

I've finalized my code - its currently running in a beta mode in a commercial environment, but it's time for the next step. Moving towards a commercial product.

Can anyone shed some insight.

the way I would like it to work is the following.

take unique ID's from the computer:
motherboard serial
cpu serial
windows serial
(I won't use Mac address or HDD serial numbers as these are allowed to change)

I also want to append additional information such as:
customer name
reseller name

All of the above information will be included within the authorization string.

I need to be able to construct a value to each serial/name of the hardware. This is so I can figure out what hardware/names have changed. (This will eventually sit on a web based database so the web page can discern the changes, rather than myself)

If I receive the auth string form a client the next process would be to create the code they would enter. My theory on this is
for each char in value, convert to byte, and then run that through a Fibonacci to come up with something obscure, multiply that by a prime number, and then MD5 that string?

if more than 2 of the above fields change, it should say that the hardware has changed 2 much, it now needs to be reauthed.

Which leads me to the next question. (This is further down the line, but is important)

Further on from this, would this be a good idea? If I ask them to send through an MD5 of their hardware this would be easy to find. Should I be removing certain characters.

I want as much information from the installed computer as possible, as I need to be able to discern whether the client has simply upgraded from win 7 to win 10, replaced a HDD or are trying to install on a new system.

I want to have a webpage which would accept a payment type.
It should be able to discern what has changed, and if too much has changed should prompt for payment (essentially a new customer)

What I have tried:

I've currently got a auth system that is just an MD5 of the serial numbers attached to the hardware being queried.

I passed this onto a friend, and within 2 hours, he had figured it out.
He has said I should move towards an online auth, and verification on startup system, but this isn't viable with my software.