You're somewhat on the right track. A standard way to do this would be using an RSA sign/verify scheme.

On the server, user-specific and license-specific data is concatenated into a string and signed with the private key.

In the software, the signature is verified with the public key. The public key can not be used to create valid signatures, it can only verify them (this is the beauty of asymmetric cryptography).

Of course, as pointed out by Thomas, there's nothing to stop someone decompiling your software and modifying the source code, but that can't be avoided.

If you're going to use RSA, be sure to use a secure padding scheme like RSA-PSS.

You're somewhat on the right track. A standard way to do this would be using an RSA sign/verify scheme.

On the server, user-specific and license-specific data is concatenated into a string and signed with the private key.

In the software, the signature is verified with the public key. The public key can not be used to create valid signatures, it can only verify them (this is the beauty of asymmetric cryptography).

Of course, as pointed out by Thomas, there's nothing to stop someone decompiling your software and modifying the source code, but that can't be avoided.

If you're going to use RSA, be sure to use a secure padding scheme like RSA-PSS.