Users and CmCloudContainers

CodeMeter License Central was Wibu-Systems’ first foray into the world of cloud licensing: The system creates and delivers licenses through the cloud, and the users import them to a secure hardware CmDongle or a CmActLicense file, bound to a known device. Since early 2020, licenses can now be kept in a special container in the cloud, the CmCloudContainer, that is bound not to a specific computer, but to a known user. This article shows how CmCloudContainers work and what purpose they serve.

Simple setup with WOPS

The server that is home to the CmCloudContainers is provided by Wibu-Systems through the cloud. The costs for operating that service depend on its usage, especially for cryptographic functions. Wibu-Systems offers three attractive hosting packages with three expansion packs. To make their move into the cloud, software developers simply need to order the package that best meets their needs, and the Wibu Operating Services (WOPS) team takes care of the rest. A few working days later, the CodeMeter Cloud Server is ready for action.

No need to change the software

CmCloudContainers are fully compatible with CmDongles and CmActLicenses. Any software protected with CodeMeter can be used immediately and without any adjustments with a CmCloudContainer, as long as CodeMeter Runtime 7.0 or newer is used. It does not even matter whether the software is protected automatically by CodeMeter Protection Suite or by CodeMeter Core API.

The only restrictions that apply between the different CmContainer types (as of Q1 2020) are:

• Executable code can only be moved into and run in CmDongles. This function is not available in CmActLicenes or CmCloudContainers.
• Licenses can be moved and borrowed offline between CmDongles and CmActLicenses, but not CmCloudContainers. This is no restriction in practice, because anyone using a CmCloudContainer would be online when accessing the license. These licenses can be returned to CodeMeter License Central and moved from there to a CmDongle or CmActLicense. Checkpoint licenses can be used for the same purpose as usual borrowed licenses, even if the local device on which they are used is not always connected to the Internet.
• CmDongles and CmActLicenses can be activated simply and directly with the license portal and WebDepot. The process for CmCloudContainers relies on a file exchange; a direct activation is, however, possible with the Software Activation Wizard. The Software Activation Wizard alone needs to be adjusted, since the processes for creating empty CmCloudContainers or using existing CmCloudContainers from other computers are new or differ slightly from the usual approach with other CmContainer types.

The path to a new CmCloudContainer

CmDongles are delivered either blank or preloaded with licenses. After plugging the CmDongle into the computer, the CmContainer is available for transferring licenses.

With CmActLicenses, the software developer would create a template for all users, which defines how the soft license is bound to the users’ machine. This template is imported onto the users’ computer, making the CmContainer available in the same manner as a plugged-in CmDongle.

When using a CmCloudContainer, the template contains the access details for each user, requiring one template per user – the socalled credential file. Typically, this file is created automatically for the user when a license is first activated; otherwise, credential files can be created and sent to their intended users manually.

The standard workflow begins with the user launching their software for the first time on their computer. The software recognizes that no license is yet available on the device and starts the Software Activation Wizard. The wizard allows the user to create an account in the license portal, an extension of CodeMeter WebDepot that is either hosted by Wibu-Systems on behalf of the software developer or run on the developer’s own server. In the background, the license portal then connects with the CodeMeter Cloud Server operated by Wibu-Systems, where a credential file is created for the user in question and placed on the license portal. The Software Activation Wizard receives this file in response to the creation of the new account, and the file is automatically imported onto the user’s local system. Next, the user enters a ticket; in response, the requested licenses are imported into the CmCloudContainer and immediately made available for the user. From the user’s point of view, all that needs to be entered is a user name (typically an email address), a new password, and the ticket. All of the rest happens automatically and transparently, but in the background.

New computer – Same CmCloudContainer

One of the inherent advantages of a CmCloudContainer is its location in the cloud, which enables users to access it on the go. The process is also easy when users install software on a new computer. Upon launch, the software will see that there is no license on the new system, and the Software Activation Wizard springs into action. Alongside the option of creating a new account, the wizard can also use an existing account if the user enters their username and password. The Software Activation Wizard logs onto the license portal with this information and retrieves the credential file to be imported onto the local computer. All activated licenses are now immediately available on that device as well, as the system has accessed the CmCloudContainer again.

There is no need to worry about licenses being used more than they are meant to be: Even a CmCloudContainer does not allow users to use more licenses than they paid for. They can import the CmCloudContainer they own to any number of devices, but the license in the container can only ever be used one at a time. The system resembles network servers using floating licenses. Users that own two licenses can use them either concurrently on one computer or separately on two computers. This works because the licenses are not accessed on the local computer, but in the cloud – which is why users need to be online when using a CmCloudContainer.

Adding more licenses

Adding more licenses to an existing CmCloudContainer is easy and the same as the process used with CmActLicenses and CmDongles: The users enter their tickets and pick their CmCloudContainer.

Since CmCloudContainers are always online by nature, software developers can pre-activate them. Licenses can be bound to the CmContainer already upon creation in CodeMeter License Central, if the target CmContainer is known at that point. When the software is launched, the Software Activation Wizard can check with CodeMeter License Central whether any license updates are waiting for this CmContainer and activate them automatically if there are any. This process works with all types of CmContainers, but CmCloudContainers even allow software developers to activate licenses immediately with an auto-update trigger and without the Software Activation Wizard coming into the picture.

Dealing with lost passwords or credential files

What happens when things go awry? The license portal includes a set of standard options for resetting a lost password, which require the user’s email address.

A lost credential file can be replaced by downloading it again from the license portal or Software Activation Wizard. If the lost credential file “turns up again” with another user, that “user” would be able to access the licensed software, instead of the rightful owner. In such a scenario, the original owner would have to request a new credential file from the license portal, which would invalidate the previous file and prevent the “finder from accessing the licenses, giving exclusive access back to their true owner. If that user works with several devices, they would have to replace the credential file on all affected devices. All of this happens automatically without any manual intervention required from the software vendor.         

KEYnote 39 – Edition Spring 2020