SaaS for Software Publishers

SaaS for Software Publishers Publisher Documentation v1.0a 1/24/2011

Table of Contents Introduction..4 WHMCS for client management, billing and support.5 Setting up your WHMCS portal.6 Enabling the affiliate system..9 Setting up support departments 10 Setting up fraud protection Setting up payment gateways.11 More WHMCS settings, skins and advanced customization Creating software titles..11 Custom fields/variables....15 Configurable options Understanding the backend of CNS Licensing..16 Integrating the DLL in your code..16 How to determine if a license key is authorized..18 Reading custom variables.18 Reading configurable options...18 DLL_CHECK 19 Obfuscating your code.19 2

Using the CNS WHMCS Licensing module..20 Create Suspend Unsuspend Terminate Reissue license Sync Record FROM CNS licensing servers Syncing data TO CNS licensing servers Pushing global updates of custom variables to all licenses 22 Reselling CNS Virtual Servers Custom VM images Create Suspend Unsuspend Terminate Getting support..22 CNS Support WHMCS Support CNS Billing Information.23 3

Introduction SaaS for Software Publishers Publisher Documentation Software as a service (SaaS) by CNS allows independent software publishers to offer their products as an online service utilizing CNS for end-customer automated provisioning, billing, license enforcement and management. The CNS solution leverages the WHMCS client management, billing & support system to allow the publisher to process transactions through their own merchant account utilizing their choice of many different payment gateways. It includes feature rich support ticket, affiliate and digital download distribution systems. SaaS by CNS utilizes our proprietary licensing technology, which is easily called from your application by utilizing a Windows DLL. SaaS by CNS is compatible with all Windows (x86 & x64) applications and MetaTrader Expert Advisors. Our licensing technology limits each license to one single machine. Custom data structures can be passed through it to the WHMCS system to support tiered subscription levels and/or further restrict license usage to a single user, account number, etc., at no additional cost to the publisher. SaaS by CNS can be utilized on all Windows PC's and servers, including full support for virtual servers - even servers not hosted by CNS. An always-on Internet connection is required by the users PC in order to reach the CNS license servers. Integrating the licensing code into your software is easy, with samples provided in C++, VB and MQL. The SDK is available free with a test license. To order the SDK and a test license, please go here: https://cp.commercialnetworkservices.net/cart.php?a=add&pid=67 SaaS by CNS also allows the publisher to resell and bundle a custom CNS VPS image with their offerings. The solution is made of three distinct parts. They are WHMCS, the CNS WHMCS modules and the CNS Licensing installer for end-subscriber PC s and VPS s. The licensing installer for end-subscriber PC s and VPS s can be downloaded here: http://helpdesk.commercialnetworkservices.net/index.php?_m=downloads&_a=viewdownload&downl oaditemid=109 It is only necessary for an end-subscriber to install CNS Licensing on their PC once. Multiple titles, including from different publishers, will utilize the same CNS Licensing DLL. The CNS WHMCS modules are responsible for provisioning and management of licensing and CNS VPS subscriptions. These services can be setup as a bundle or separately. WHMCS is a feature rich system for hosting companies. Publishers are able to utilize any of its other features without additional charges by CNS, and are not limited to only CNS licensing or CNS VPS subscriptions. 4

WHMCS for client management, billing and support SaaS by CNS utilizes WHMCS, the complete client management, billing & support solution. WHMCS is initially setup by CNS with default settings and is intended for the publisher to customize further. CNS will deliver to the publisher a WHMCS admin URL and login credentials, and also SSH credentials to upload new templates to the WHMCS server for customizing the WHMCS skin. The WHMCS server is a linux VM, hosted by CNS. WHMCS is a separate product bundled by CNS, and the publisher is fully supported by WHCMS support. CNS will manage all periodic updates to publishers WHMCS installation. WHMCS and its hosting is included in the SaaS by CNS service. Detailed WHMCS documentation can be reviewed at the following WHMCS support page: http://wiki.whmcs.com/main_page If you have any questions about your new WHMCS installation, feel free to bounce it off CNS Support. We may have a quick answer for you. In some cases, you will be required to contact WHMCS support for more in-depth answers. Further configuration is required to WHMCS before it can be used for the first time. At a bare minimum, this includes the payment gateway(s) to process new orders, the service plan(s), general settings such as company name, etc., localization information, TOS URL, anti-fraud and automation settings. Other optional configuration steps include customizing the HTML template to change the look and feel of the subscriber portal and activating the support ticket and affiliate systems. A SSL certificate is also required for secured client transactions. CNS support will install this for you but you will need to participate in the issuance process by verifying your identity to the SSL issuer. Free SSL certificates are available from StartSSL.com, who is our preferred SSL vendor. StartSSL.com also offers the new EV SSL certificates, which display a green bar in the browser for an additional fee. EV certificates require extended validation before issuance. We highly recommend them to promote a higher level of confidence between you and your subscribers. 5

Setting up your WHMCS portal Login to your WHMCS portal through the admin URL provided to you by CNS. Select setup->general settings Enter the company name, email address, logo URL, pay to text (for mail in payments). Click the localization tab and edit as needed. 6

Click the ordering tab SaaS for Software Publishers Publisher Documentation It is recommended that you post your Terms of Service (TOS) at a page on your web site and enable it in WHMCS as illustrated above. Autoredirect on checkout should typically be configured to forward the end-user to your payment gateway, so they can pay for the new subscription. The domains tab can be configured if you also intend to sell domain registration services. Please refer to the WHMCS documentation for more information on configuring domain registrars and TLD s. 7

Click the Mail tab The Mail SMTP settings will be pre-set by CNS. You should not change the default settings. Enter the signature to be applied to all automated email messages. Also enter the friendly name in the System Email From Name field. Next, click the Invoices tab and configure as desired. 8

Click the affiliates tab SaaS for Software Publishers Publisher Documentation The WHMCS affiliate system is a powerful marketing tool. To activate it, check the enable/disable checkbox. You can specify specific payouts per product when the product is setup. If you instead would like to offer commissions based on a percentage of the sales amount, enter it here. The Affiliate links section should contain the HTML code necessary for your affiliates to display your banners. The above illustration is from the CNS affiliate system. Notice the HTML code references banners stored on a web server. Next, click the security and other tabs. Set as needed and click Save Changes. Do not forget to click Save Changes! Click setup->automation settings Configure as desired and click Save Changes 9

Setting up support departments Setting up support departments is required if you intend to use the integrated support ticket system. Click setup->support departments, and then add new department Setting up security questions We recommend you setup security questions with the initial configuration. Security questions allow the subscriber to enter answers to questions, so your support department can authenticate subscribers in the case of a password reset, etc.. To setup security questions, from the WHMCS admin portal select setup->security questions Setting up fraud protection Fraud protection is extremely important. CNS does not issue credits for sales that are deemed to be fraud. You should be sure that you are comfortable with an order before provisioning it. MaxMind Fraud Protection is included in the WHMCS service. MaxMind offers up to 1000 free checks each month. There is also an optional telephone verification service available from MaxMind. From the WHMCS admin portal, click setup->fraud Protection Select MaxMind in the drop-down box and click GO If you do not already have a MaxMind account then click the link to establish an account. You will be issued a MaxMind License Key, which is required to complete the rest of the configuration. Check the box to enable MaxMind and enter the MaxMind license key. We recommend that you check the box to reject anonymous proxy servers. There is no legitimate reason for someone to use an anonymous proxy server. The remainder of the boxes are up to you, keeping in mind your intended subscriber base. We recommend you start with loose settings and increase it as you learn the MaxMind scoring system. Note that MaxMind considers countries like Indonesia, Malaysia and Nigeria as high-risk countries. If you have many subscribers from these areas then you should not check the box to reject high risk countries. Please ask CNS if you require any assistance with your initial settings. 10

Setting up payment gateways Payment gateways are processing networks for your subscribers to pay you through. WHMCS supports a large variety of payment gateways. Please refer to the WHMCS documentation on payment gateways for detailed setup information. http://wiki.whmcs.com/payment_gateways More WHMCS settings, skins and advanced customization WHMCS is a highly advanced billing, support and client management system. These setup instructions only cover the absolute minimum to get WHMCS operational. We highly recommend you explore the complete WHMCS setup instructions: WHMCS Setup/Configuration: http://wiki.whmcs.com/setup/configuration Customizing the look of WHMCS: http://wiki.whmcs.com/customising_whmcs Using WHMCS: http://wiki.whmcs.com/using_whmcs_and_howtos Creating software titles A software title is a specific package for which a license can be issued. Besides simple active/inactive status, licenses can include additional data with them called custom fields and configurable options. Custom fields can be both visible to the end-subscriber and specified at order time, or completely hidden and used only to pass data to your software from the WHMCS portal. Custom fields setup as text boxes can also be changed globally in the WHMCS system, and used to pass fresh data to the endsubscriber software. (see Reading Custom Variables in the section Integrating the DLL in your code) Note it can take up to four hours before the end-subscriber software receives updated custom fields data through the licensing service. Configurable Options on products allow you to offer your clients variables which alter the price of that product. For example, Configurable options can be used to allow the software title to offer multiple levels of service, such as basic and pro versions. Configurable options can be made available for additional fees to the end-subscriber, while custom variables cannot. To setup a software title, you will need a unique Package ID to be assigned by CNS. Contact CNS and provide the name of your title before proceeding. 11

In the WHMCS admin portal, select setup->products/services It is a good idea to keep your products organized into sections (groups). Click to create a new group and name it. You can select the available payment gateways per group. In the WHMCS admin portal, select create new product Product type: other Assign to a group and give your new software title a name. Click Continue to enter the configuration page. Enter a product description. This will be viewable from the shopping cart. A welcome email can be selected. You can create custom welcome emails to send to new subscribers. To setup an email template, please see the Email Templates section of the WHMCS instructions. http://wiki.whmcs.com/messages/emails#email_templates For software subscriptions, you should generally uncheck require domain and stock control. Click on the Pricing tab and setup your retail pricing. Please note: CNS bills licenses monthly, regardless of term sold to the end-subscriber. For example, a one year subscription will be billed to the publisher each month by CNS while the publisher will bill the subscriber the full amount in advance. Click on the module settings tab 12

Set the Module Name to CNS_Licensing The Package ID value is a unique number, assigned to you by CNS for every software title. No two software titles will ever share the same Package ID. Check Allow Reissue if you would like subscribers to be able to reissue their license in the control panel, without raising a support ticket. Reissuing a license will unglue the license from the machine running the software and glue it to the next machine that calls the licensing server with the same license key. Licenses may need to be reissued if the subscribers machine is upgraded. In no case will this option license two different machines to run the same software each license is always restricted to one single machine. Note: it is possible for the losing machine to continue to run for a maximum of four hours and your software should be coded to periodically recheck the validity of the license. See the section Integrating the DLL in your code for more information. The next step is for automatic setup/provisioning options. You can select if you would like the system to issue the license automatically on first payment, or wait until you manually approve it. 13

Select the Custom Fields tab Custom fields can be entered by the subscriber at order time and/or hidden from the subscriber and passed from WHMCS to the licensed software for further processing. Custom fields which are setup as text boxes (strings) can be updated by the publisher in WHMCS and passed to all active subscriptions through the global update feature. In the example above, the custom field Account_Number is entered by the subscriber at the time of ordering. The other two fields, custom1 and custom2 are hidden from the subscriber. They are passed straight through to the licensing DLL, where it can be read by the subscription software. Hidden custom fields can be used by your software to update key data and/or to further protect your code. This will be discussed in the section integrating the DLL in your code Add the required custom fields and click the other tab 14

This tab allows you to specify the affiliate payout and upload your software installer for subscribers to download after purchase. The license key will be generated in real-time and made available to them in the control panel for pasting into your software to activate it. Enter the desired settings and click save changes Don t forget to click save changes! Configurable Options Configurable Options on products allow you to give your clients variables which alter the price of that product. To create configurable options, please refer to the Configurable Option section of the WHMCS documentation: http://wiki.whmcs.com/addons_and_configurable_options After the configurable option is created, you will need to go back to the product and assign it. setup- >products/services, and click to edit the service. 15

Understanding the backend of CNS Licensing technology Having some knowledge of how the backend of SaaS works is helpful for effectively integrating the licensing DLL in your software and minimizing chances of piracy. CNS Licensing is more than just a simple is it active or not system. The publisher can pass custom defined values to the licensed software in order to further restrict license usage (for example to a single account number or user) and to hide key variables used to initialize your software or change its operation. Hiding key initialization variables in your software will result in the decompiled software being incomplete and unable to run. When a license is initially issued or subsequently reissued, it is not attached to any PC. The license is glued to a machine when it is first authorized. After a license is successfully authorized, it will not reauthorize until four hours has passed. Subsequent calls to authorize within the four hour window will return the same data as the previous authorization. Another encrypted key, transparent to the user, is passed between the end-subscriber PC and CNS Licensing servers. This key is always changing, and so two different machines are unable to operate from the same license. Integrating the DLL in your code Integrating the licensing scheme into your software is relatively easy, but it may require you to build menus to accept the licensing key. MetaTrader EA s can simply accept the license key as a EA setting. Think of the license as a data structure, from which your software can read and respond by deactivating itself (in the case of an invalid license) or activating enhanced features sold at a premium by you, etc.. The CNS Licensing SDK includes examples in MQL, C++, C# and VB. All languages are all very much the same. 16

The licensing DLL is comprised of the following functions, which can be called by your software to determine license status: void Authorize(int PackageID, string LicenseKey ) This function actually completes the licensing check. It requires the PackageID (assigned by CNS) and the LicenseKey entered by your subscriber into your software. This function should be called prior to any other. string ReadStatus() string ReadRegisteredName() string ReadCompanyName() string ReadEmail() string ReadErrorField() string ReadTest() string ReadProductID() int ReadCustomFieldsCount() string ReadCustomFieldName(int) string ReadCustomFieldValue(int) string ReadCustomVariable(string) int ReadConfigOptionsCount() string ReadConfigOptionName(int) string ReadConfigOptionValue(int) string ReadConfigOption(string) returns Active if the license is active. NOTE: Do not rely on only the result of ReadStatus(). You should also verify ReadErrorField() = 0 and the DLL_CHECK value is valid before considering the software licensed. Returns the name of the registered subscriber Returns the registered company name of the subscriber Returns the registered email address of the subscriber Friendly text output of the error condition, if any Returns the product ID of the licensed software Returns the number of custom fields Returns the name of the custom field at index int Returns the value of the custom field at index int Returns the value of a custom variable by name Returns the number of configurable options Returns the name of the configurable option at index int Returns the value of the configurable option at index int Returns the value of the configurable option by name. Note: checkboxes will return 0 or 1 17

How to determine if a license key is authorized The sample code used in these examples is MQL. The same general structure should be used in all languages. Please refer to the SDK samples for a more complete working example. Authorize(PackageID, LicenseKey); // send the authorization request to CNS Licensing servers Status = ReadStatus(); // read the result ErrorField = ReadErrorField(); // read the result DLLVerificationValue = ReadCustomVariable("DLL_CHECK"); // verify DLL integrity if (Status=="Active" && ErrorField == "0" && DLLVerificationValue == "testdllvalue") // If this statement is true then the license is authorized. Note the value testdllvalue is just for example purposes. It will typically be a random string. Reading custom variables Custom variables are stored on the license servers and can be read by the licensed software. Custom variables setup by text boxes can also be updated by the publisher in WHMCS and pushed to one or all active subscriptions. Reading a custom variable is easy - string ReadCustomVariable(string) In the example above, notice the custom variable named DLL_CHECK is read from the licensing server. You can setup custom variables at the time the product is setup in your WHMCS deployment. Reading configurable options Configurable options are utilized just like custom variables. The only real difference between the two is that you can charge additional fees for configurable options, and no global update option is possible from the publishers WHMCS. The function is string ReadConfigOption(string) 18

DLL_CHECK DLL_CHECK is a custom (static) variable setup by CNS at the time your new software title is established. It is utilized to verify the authenticity of the licensing DLL, by comparing the returned value against an expected result. Without DLL check, it might be possible for a cracker to replace the licensing DLL on the end-subscribers PC with one that returns authorized all of the time. Obfuscating your code You should protect your code further by initializing some static variable assignments from a custom variable and generally obfuscating your code as much as possible. This will render decompiled code useless and keep the software from operating in the event the DLL is replaced by a dummy version. For example, consider the following statement in the original code: int point=2;... if(v==7) { } y=2; g=9; The above code declares an integer named point as equal to the number two. Later in the code is a simple if statement. Each of these static assignments is an opportunity to read these numbers from the license, instead of static in the code where it is waiting for anyone to decompile and read it. 19

Assume the following custom variables are setup: Blue 1 Donald 2 Melissa 3 Joshua 4 Norma 5 Marry 6 John 7 Alice 8 Tracy 9 The protected code could then be written as: int point; point = StrToInteger(ReadCustomVariable("Donald")); if(v== StrToInteger(ReadCustomVariable( John"))) { y= StrToInteger(ReadCustomVariable("Donald")); g= StrToInteger(ReadCustomVariable("Tracyl")); } By using key (static) variables in the license and not placing them in the code, decompiled software will not have enough information to operate. You should protect your code further by obfuscating it. There is an excellent article on the subject in the MQL4 forum. Although this article is referring to Meta Trader expert advisors, the general theory should be applied to all software for best protection from decompilers. Read Protect Yourselves, Developers! Here: http://articles.mql4.com/934 Using the CNS WHMCS Licensing module License subscriptions will appear as an Order in WHMCS. After an order has been accepted, you will need to create the license if automatic setup has not been enabled in WHMCS. This is a good place to start while you learn the system. To view or manage a license, go to the order in WHMCS. This can be completed by searching for the subscriber in the search box at the top right (a very powerful search box) or selecting orders->view active, and clicking on the order. 20

Note in the above illustration the account number entered by the subscriber at order time (a custom variable) can be edited by the publisher in WHMCS. Custom1 and custom2 (also custom variables) can also be edited for this specific license, and these values cannot be displayed by the subscriber. Create Suspend Unsuspend Terminate Reissue license Send the license data to CNS and create the license subscription. Suspend the subscription Unsuspend the subscription Terminate the subscription. Note: a terminated subscription can not be unterminated it must be recreated. Unglue the license from the subscribers PC or VPS and reissue it to the next machine that attempts 21

authorization. Sync Record FROM CNS licensing servers Only data on CNS licensing servers is sent to the subscriber license. This button will retrieve the active information from CNS. Syncing data TO CNS licensing servers To update a subscriber record on the CNS licensing servers, edit it on this page and click the save button at the bottom of the page. Pushing global updates of custom variables to all licenses It is possible to update a custom variable text box globally, to all issued licenses. To perform a global update, go to ANY active subscription of the same type of license (package ID). Edit the custom field as required. Preface the data with \G For example: If in the above example, the Publisher wants to update all licenses Custom1 variable with the value newcustom1 then they should enter \Gnewcustom1 and click save. The \G switch in a custom field will update all licenses globally. It can take up to four hours before the data can be read by end-subscriber PC s, depending on the time of the last license check. Note that the licensing software in the end-subscriber PC s will only test every four hours, after the last successful check. This is to prevent flooding of the licensing server by buggy software. Getting support CNS Support : Please login to your CNS control panel and click helpdesk to open a new support ticket. WHMCS Support : https://www.whmcs.com/members/submitticket.php?step=2&deptid=13 Please be sure to include your WHMCS License Key and WHMCS admin URL. Your WHMCS license key will be issued to you when your WHMCS admin portal is setup. 22

CNS Billing Information Invoices are generated in the Publishers CNS account as new orders are created or renewed. Publishers should be sure to have deposited enough funds to cover new orders using the add funds feature. New invoices will automatically be paid against the Publishers deposit. We do not generally issue net terms. We accept all major credit cards, Paypal, Liberty Reserve and Money Bookers. Please contact your CNS account representative if you have any questions. 23