Patent Application
20070222589
This application is related to U.S. patent application Ser. No.______ (Attorney Docket # 38481.8027), filed concurrently and entitled “Method and System for Processing Intelligence Information”, and to U.S. patent application Ser. No.______ (Attorney Docket # 38481.8029), filed concurrently and entitled “Disseminating Information About Security Threats”, both of which are hereby incorporated by reference in their entirety.
The following disclosure relates generally to analyzing information related to security threats, and more particularly to identifying possible security threats in order to enable notification of appropriate personnel, such as to alert appropriate personnel so that they can prevent identified terrorism threats.
As the security of governments, organizations (e.g., businesses) and individuals is increasingly threatened by various groups and individuals (e.g., terrorist groups and their members), it is increasingly important to identify future security threats (e.g., planned attacks) before they occur so that they can be prevented. In many cases, security personnel (e.g., law enforcement officials) whose job it is to prevent or address such security threats do not have access to the necessary information to identify the security threats before they occur (e.g., information about attack preparation activities of terrorist groups). In other situations, security personnel may have access to the necessary information, but that information may be obscured in an over-abundance of other irrelevant information of various types and/or it may be in an unanalyzed form from which it is difficult to identify the security threats.
Accordingly, it would be beneficial to provide techniques to analyze various types of information related to possible security threats in an automated manner, such as to assist security personnel in identifying future security threats.
I. Introduction
A software facility is described below that provides various techniques for analyzing information to assist security personnel in identifying security threats. Various types of information analyses can be performed in various embodiments, and in some embodiments the information analyses vary by user (e.g., based on a current role of the user). Similarly, the types of information that are analyzed can vary in various embodiments, such as information about recent activities of individuals or groups that are suspected of being involved in previous and/or future security threats, or information about diseases or other health risks (e.g., chemical or biological) that may be naturally spread or otherwise disseminated.
In particular, in some embodiments various types of threat trend analyses can be used to identify trends in one or more types of security-related information. A threat trend analysis may use one or more measurement criteria to calculate threat values for a type of security-related information over a period of time, such as for each of multiple time units within that period of time (e.g., each week in a month, or each day in a year). Trends over that period of time in the calculated threat values can then be identified using various automated and/or manual techniques. Information about the threat values and the corresponding trends may be presented to users that have requested the information or are otherwise associated with the information in various ways, such as via graphical charts presented on a computing device. Such information can also be provided to other appropriate users, such as security personnel (e.g., law enforcement, military, intelligence gathering, health, government, business, etc.) in affected geographical locations or that have capabilities related to preventing or addressing threats.
For example, a significantly increasing trend in activities of a particular terrorist group in a particular geographic location may indicate that an attack by that group will soon occur in the geographic location. The threat values that are calculated for such terrorist group activities may use a variety of types of measurement criteria, such as based on a total number of activities, by weighting some activities more highly than others, by correlating different types of activities that may be related in various ways (e.g., in time, in geographical location, by the individuals involved, etc.), etc. Similarly, increasing trends in the number of reported cases of a communicable disease that simultaneously occur in multiple disparate geographic locations may indicate an intentional dissemination of that disease.
In addition, in some embodiments various types of threat alerts can be used to notify appropriate personnel when current conditions trigger the alert. A threat alert may be triggered by the satisfaction of a variety of types of alert criteria, such as a threshold for a particular type of security-related information, a specified combination of multiple types of security-related information, etc. In some embodiments, a threat alert may be associated with a threat trend analysis in such a manner that one or more calculated threat values or corresponding trend information for that threat trend analysis may trigger the alert. Information about a triggered threat alert may be provided to one or more users in various ways, such as in a real-time or near-instantaneous manner (e.g., via a pop-up message on a computing device, an instant message, a phone call or SMS message, an email, via a paging device, etc.). Appropriate security personnel to receive such information can be selected in a manner similar to that for threat trend analysis information.
II. System Overview and Overall Architecture
In one embodiment, a computing system with which the facility is integrated can be logically structured as a multi-layered architecture as shown in
In particular, the logical multi-layered architecture as shown in
The user interface layer 110 may provide a variety of high-level GUI elements such as applets, views, charts and reports that are associated with one or more applications. In one embodiment, various types of clients can be supported via the user interface layer 110. These various types of clients may include traditional connected clients, remote clients, thin clients over an intranet, Java thin clients or non-Windows-based operating systems, HTML clients over the Internet, etc.
The object manager layer 120 may be designed to manage one or more sets of business rules or business concepts associated with one or more applications and to provide the interface between the user interface layer 110 and the data manager layer 130. In one embodiment, the business rules or concepts can be represented as business (or “business process”) objects. The business objects may also be designed as configurable software representations of various business rules or concepts, such as accounts, contacts, opportunities, service requests, solutions, etc.
The data manager layer 130 may be designed to maintain logical views of the underlying data and to allow the object manager to function independently of underlying data structures or tables in which data are stored. In one embodiment, the data manager 130 may also provide certain database query functions such as generation of structure query language (SQL) in real-time to access the data. In one embodiment, the data manager 130 is designed to operate on object definitions in a repository file 160 that define the database schema. The data storage services 170 provide the data storage for the data model associated with one or more applications.
The data exchange layer 140 may be designed to handle the interactions with one or more specific target databases and to provide the interface between the data manager layer 130 and the underlying data sources.
In one embodiment, the system environment illustrated in
In one embodiment, the database 290 is designed to store various types of data including predefined data schema (e.g., table objects, index objects, etc.), repository objects (e.g., business objects and components, view definitions and visibility rules, etc.), and users' and customers' data. Dedicated Web clients and server components, including those that operate in conjunction with the other types of clients, may connect directly to the database 290 and make changes in real-time. In addition, mobile Web clients may download a subset of the server's data to use locally, and periodically synchronize with the server database through the system server to update both the local and the server database.
In some embodiments, various tables included in the database 290 may be logically organized into the following types: data tables, interface tables, and repository tables, etc. In addition, data tables may be used to store user business data, administrative data, seed data, and transaction data, etc. In one embodiment, these data tables may be populated and updated through the various applications and processes. Data tables may also include the base tables and the intersection tables, etc. In one embodiment, base tables may contain columns that are defined and used by the various applications. In one embodiment, the base tables are designed to provide the columns for a business component specified in the table property of that business component. In one embodiment, intersection tables are tables that are used to implement a many-to-many relationship between two business components. They may also hold intersection data columns, which store information pertaining to each association. In one embodiment, intersection tables provide the data structures for association applets.
In one embodiment, interface tables are used to denormalize a group of base tables into a single table that external programs can interface to. In one embodiment, they may be used as a staging area for exporting and importing of data.
In one embodiment, repository tables contain the object definitions that specify one or more applications regarding:
In one embodiment, the file system 295 is a network-accessible directory that can be located on an application server. In one embodiment, the file system 295 stores the physical files created by various applications, such as files created by third-party text editors, and other data that is not stored in the database 290. In one embodiment, physical files stored in the file system 295 can be compressed and stored under various naming conventions. In one embodiment, dedicated Web clients can read and write files directly to and from the file system 295. In one embodiment, mobile Web clients can have a local file system, which they synchronize with the server-based file system 290 periodically. In one embodiment, other types of client such as the wireless clients and the Web clients can access the file system 290 via the system server.
In one embodiment, the enterprise server 250 is a logical grouping of the system servers 255 that share a common table owner or a database, point to a common gateway server, and can be administered as a group using server manager 260. In one embodiment, the connection to the gateway server can be established via TCP/IP. In one embodiment, the enterprise server 250 can be scaled effectively by deploying multiple system servers 255 in the enterprise server 250, thus providing a high degree of scalability in the middle tier of applications.
In one embodiment, the server 255 runs one or multiple server programs. It handles the incoming processing requests and monitors the state of all processes on the server. In one embodiment, server programs are designed and configured to perform one or more specific functions or jobs including importing and exporting data, configuring the database, executing workflow and process automation, processing to support mobile Web clients for data synchronization and replication, and enforcing business rules, etc. In one embodiment, the server 255 can be an NT Service (under Windows NT operating system) or a daemon (e.g., a background shell process) under UNIX operating system. In one embodiment, the server 255 supports both multi-process and multi-threaded components and can operate components in batch, service, and interactive modes.
In one embodiment, the server manager 260 is configured as a utility that allows common control, administration and monitoring across disparate programs for the servers 255 and the enterprise server 250. In one embodiment, the server manager 260 can be used to perform the following tasks: start, stop, pause, and resume servers 255, components, and tasks; monitor status and collect statistics for multiple tasks, components, and servers within an enterprise server; and configure the enterprise server, individual servers, individual components, and tasks, etc.
In one embodiment, the gateway server can be configured as a logical entity that serves as a single entry point for accessing servers. In one embodiment, it can be used to provide enhanced scalability, load balancing and high availability across the enterprise server. In one embodiment, the gateway server may include a name server and a connection brokering component. In one embodiment, the name server is configured to keep track of the parameters associated with the servers. For example, the availability and connectivity information associated with the servers can be stored in the name server. The various components in the system can query the name server for various information regarding the servers' availability and connectivity. In a Windows NT environment, the name server can be run as a NT service. In a UNIX environment, the name server can run as a daemon process. In one embodiment, the connection brokering component is used to perform load balancing functions such as directing client connection requests to an appropriate server (e.g., the least-busy server).
In one embodiment, as illustrated in
In one embodiment, dedicated Web clients (also called connected clients) are connected directly to a database server for data access via a LAN or WAN connection. In one embodiment, these connected or dedicated Web clients do not store data locally. These dedicated Web clients can also access the file system directly. In one embodiment, the user interface, the object manager, and the data manager layers of the multi-layered architecture reside on the dedicated Web client.
In one embodiment, the mobile Web clients are designed and configured for local data access and thus can have their own local database and/or local file system. In one embodiment, mobile Web clients can interact with other components within the system via the gateway server. Through synchronization, the modifications from the local database and the server database can be exchanged.
In one embodiment, a Web client runs in a standard browser format from the client's machine. In one embodiment, the Web client can connect to a system server 255 through a Web server. In one embodiment, the system server 255 is designed and configured to execute business logic and access data from the database 290 and file system 295. In one embodiment, the Web client described herein is designed and configured to operate in an interactive mode. In one embodiment, the interactive Web client framework as described herein utilizes dynamically created objects implemented in JavaScript on the browser side that correspond to objects on the server side. In one embodiment, these dynamically created objects on the browser side may include the current view and its corresponding applets, the current business object and the corresponding business components, etc.
In one embodiment, wireless clients are essentially thin clients enabled on wireless devices. The wireless clients can use a wireless application protocol (WAP)-based user interface to communicate and exchange information/data with the system server.
In one embodiment, the presentation services may be designed and configured to support various types of clients and may provide them with user interface applets, views, charts, and reports, etc. As described above, a large variety of clients may be supported including wireless clients, handheld clients, Web clients, mobile Web clients, and dedicated (connected) clients, etc.
In one embodiment, the application services may include business logic services and database interaction services. In one embodiment, business logic services provide the class and behaviors of business objects and business components. In one embodiment, database interaction services may be designed and configured to take the user interface (UI) request for data from a business component and generate the database commands (e.g., SQL queries) necessary to satisfy the request. For example, the data interaction services may be used to translate a call for data into DBMS-specific SQL statements.
In one embodiment, data storage services may be designed and configured to provide the data storage for the underlying data model which serves as the basis of the various applications. For example, the data model may be designed and configured to support various software products and applications including call center, sales, services, and marketing, etc., as well as various industry vertical products and applications such as eFinance, eInsurance, eCommunications, and eHealthcare, etc.
In one embodiment, the core services are designed and configured to provide the framework in which the applications execute. In one embodiment, the core services may include the following:
In one embodiment, application integration services may be designed and configured to allow the various applications built in accordance with this framework to communicate with the external world. In one embodiment, the various types of services in this logical grouping may be designed and configured to provide for real-time, near-real-time, and batch integration with external applications. For example, these integration services may be used to enable communications between external applications and the internal applications using available methods, technologies, and software products. In one embodiment, application integration services allow the systems or applications to share and replicate data with other external enterprise applications. Accordingly, these services allow a particular application or system to be both a client requesting information and a server having information requested from it.
In one embodiment, business processes services are designed and configured to allow the client to automate business processes through the application. In one embodiment, these various business process services may include the following:
In one embodiment, creation of these business processes can be done through Run-Time tools such as Personalization Designer, Workflow Designer, SmartScript Designer, Assignment Administration Views, the Model Builder, etc.
In one embodiment, integration services may be designed and configured to provide the client with user interface and thin client support. In one embodiment, these may include capabilities for building and maintaining Web-based applications, providing Web support facilities such as user Profile Management, Collaboration Services and Email and Fax services, as well as advanced Smart Scripting, etc.
In one embodiment, design time tools may be designed and configured to provide the services to customize, design, provide integration points, and maintain the application. These various tools provide one common place to define the application.
In one embodiment, admin services are designed and configured to provide one place to monitor and administer the application environment. In one embodiment, these services allow the user to administer the application either through a graphic user interface (GUI) or from a command line.
III. Examples and Additional Details
For illustrative purposes, some embodiments of the software facility are described below in which specific types of security-related information is analyzed in specific types of ways, and in which the results of the analyses are provided to various specific types of users in various specific ways. However, those skilled in the art will appreciate that the techniques of the invention can be used in a wide variety of other situations, and that the invention is not limited to use with the illustrated types of analysis and notification techniques or with the illustrated types of security-related information or users.
In the illustrated embodiment, the information is presented as one or more Web pages, such as with a Web browser executing on the user's computing device.
The user interface includes a variety of displayed informational tabs 510, with the “Home” tab 510a currently selected. As is shown, various information 515 that is personalized to the user may be displayed, and a variety of security-related information related to the current role of the user is also displayed in the current embodiment (e.g., information relating to individual terrorism suspects, terrorism groups, and terrorism cases with which the user is associated). Other users may instead receive other information via a similar user interface (e.g., another counter-terrorism user might receive information about other suspects, groups and terrorism cases, while a health professional might receive information about diseases, symptoms, and medical cases).
Another of the displayed informational tabs is the “Analytics” tab 510b, and
In the illustrated embodiment, the user can also interactively drill-down on illustrated information in order to refine the analyses being performed in various ways. For example,
While not illustrated, the user in the illustrated embodiment can continue to refine and/or modify the analyses that are presented in various ways, such as to view information for other periods of time and to view other types of information.
In addition, in some embodiments indications of current values and/or changes in values for various types of security-related information over specified periods of time (e.g., to show current values and trends) may also be displayed.
For example, an investigative user such as the current counter-terrorism user may in some embodiments be able to view analyses that include the following:
As is shown, each of the listed example types of analyses includes at least one measurement criteria for a type of security-related information being measured, and includes a time period for which the security-related information will be analyzed. The last example analysis type also includes a time unit within the time period (e.g., a month within 6-month time period), and the security-related information for each of the time units within the time period will be combined and measured individually, such as to show a trend within the time period. In some embodiments, such time units may also be specified for any analysis with a time period.
As an example of types of analyses for a user acting in a different role, a health care professional may be able to view analyses that include the following:
As with the analyses for the investigative agent role, in some embodiments any of the illustrated analyses with a time period may also allow a time unit within the time period to be specified and used.
While not illustrated here, a variety of other data analysis techniques could similarly be used. For example, in some embodiments the performance of a first data analysis could trigger other the performance of other data analyses, such as regularly monitoring threat information to detect when a trend reaches a threshold, which triggers one or more additional analyses (e.g., that are not performed regularly). Such data analysis triggering can continue for multiple levels, such as if one of the additional analyses that is triggered identifies a possible threat in such a manner as to trigger other analyses to be performed.
The computing system 600 includes a CPU 605, various I/O devices 610, storage 620, and memory 630. The I/O devices include a display 611, a network connection 612, a computer-readable media drive 613, and various other I/O devices 615. The computing device and the functionality it provides can be accessed by users in a variety of ways. For example, some users may have physical access to the computing system 600, and if so may use the I/O devices 610 to interact with the computing system. Alternatively, other users may use the remote client computing devices 650 to remotely access the computing system 600 (e.g., via the World Wide Web, such as over an intranet and/or the Internet).
An embodiment of a Threat Identifier system facility 640 is executing in memory 630, and it includes a Threat Trend Analyzer component 642 and a Threat Alert Generator component 644. The Threat Trend Analyzer component identifies trends in various security-related (or “threat-related”) information and the Threat Alert Generator component provides alerts when triggered by current conditions, as discussed in greater detail below.
In particular, the Threat Trend Analyzer component uses various trend analysis definitions from database 625 on storage to analyze various threat-related information in database 621 on storage in order to detect trends in the threat-related information, such as in response to requests from a user and/or to provide appropriate information to a user (e.g., based on a current role of the user). In some embodiments, the Threat Trend Analyzer component will also use various user information 623 from storage when performing an analysis for a user and/or providing analysis information to a user, such as to verify authority of the user to receive the information and/or to specialize the analysis performance or information providing in accordance with a role of the user and/or preferences of the user. The threat-related information used by the component can be retrieved from various sources, such as network-accessible data sources 690 and/or accessible computing systems 670 having data 677 on storage 675, whether instead of or in addition to having that information stored locally in database 621. In the illustrated embodiment, the accessible computing systems also include a CPU 673, various I/0 devices 674, and a memory 671.
In addition, the Threat Alert Generator component uses various alert criteria from database 627 on storage to determine when current conditions (e.g., of threat-related information in database 621) trigger the alert, such as in response to requests from a user and/or to provide appropriate information to a user (e.g., based on a current role of the user). In some embodiments, the Threat Alert Generator component will also use user information 623 when determining whether an alert is triggered for a user and/or when providing alert information to a user, such as to verify authority of the user to receive the information and/or to specialize the alert triggering determination or alert information providing in accordance with a role of the user and/or preferences of the user.
After a trend analysis is performed or an alert is triggered, an appropriate user (e.g., a user that defined or previously selected the trend analysis or alert, or instead a user having an appropriate current role) can be notified in various ways.
For example, in some embodiments the components 642 and 644 may directly notify the appropriate users, such as by sending messages to the users or by providing information to be presented to the users. In other embodiments, reports may be generated that include information about the trend analyses and/or triggered alerts, such as directly by the components 642 and 644 or instead in conjunction with an optional report generator component 632 executing in memory, and those reports can then be provided to the appropriate users.
In addition, in some embodiments users may request and/or retrieve information about trend analyses and/or triggered alerts, such as via a Threat Identifier Accessor component 652 (e.g., software specialized for the Threat Identifier system, or instead non-specific software such as a Web browser) executing in memory 651 of a client computing devices. The client computing devices also include a CPU 653, various I/O devices 654, and a storage 655 that may include various user information 657 (e.g., user preference information, information about a current role of the user, various authorization or access information to indicate types of information for which the user is appropriate, etc.) for one or more users of that computing device.
In addition, the components 642 and 644 may also interact with one or more other executing components based on trend analysis information or the triggering of an alert, such as an optional threat deterrer component 634 executing in memory 630, whether instead of or in addition to notifying appropriate users. Such interactions with other executing components may provide a variety of functionality and other benefits, such as to allow identified future threats to be quickly addressed in a proper manner.
Those skilled in the art will appreciate that in other embodiments the described functionality may be provided in other manners, such as by a single computing device of a user that performs analyses of information and notifies the user as appropriate. More generally, computing systems 600 and 650 are merely illustrative and are not intended to limit the scope of the present invention, and may be connected to other devices that are not illustrated (e.g., through one or more networks such as the Internet or via the World Wide Web). In addition, a “client” or “server” may comprise any combination of hardware or software that can interact as described, including computers, network devices, internet appliances, PDAs, wireless phones, pagers, electronic organizers, television-based systems and various other consumer products that include inter-communication capabilities. Moreover, the functionality provided by the illustrated components may in some embodiments be combined in fewer components or distributed in additional components. Similarly, in some embodiments the functionality of some of the illustrated components may not be provided and/or other additional functionality (e.g., other types of analyses) may be available.
Those skilled in the art will also appreciate that, while various items are illustrated as being stored in memory or on storage while being used, these items or portions of them can be transferred between memory and other storage devices for purposes of memory management and data integrity. Alternatively, in other embodiments some or all of the software modules and/or components may execute in memory on another device and communicate with the illustrated computing device via inter-computer communication. Some or all of the system components and data structures may also be stored (e.g., as instructions or structured data) on a computer-readable medium, such as a hard disk, a memory, a network, or a portable article to be read by an appropriate drive. The system components and data structures can also be transmitted as generated data signals (e.g., as part of a carrier wave) on a variety of computer-readable transmission mediums, including wireless-based and wired/cable-based mediums. Accordingly, the present invention may be practiced with other computer system configurations.
The routine begins at step 705 where an indication as received to specify a new threat trend analysis definition or instead to perform a trend analysis. An indication to perform a trend analysis may have a variety of forms, such as an indication to perform a periodic analysis as specified (e.g., once a day), an explicit user instruction, a receipt of appropriate threat information (e.g., a sufficient amount to reach an analysis threshold or of a type that triggers an analysis), etc. The routine then continues the step 710 to determine whether the received indication was to specify a new threat trend analysis definition, and if so continues to step 715 where a definition is received of a type of threat information and of various parameters for the analysis. The parameters for an analysis can be of various types, such as a time period for the analysis (e.g., the previous week or month), a report format for presenting analysis information, a threshold for a total amount or an amount of change that is considered significant, etc. While not illustrated here, in other embodiments a variety of other types of threat information analyses could also be defined, such as correlations between different types of threat information or between threat information and non-threat information, automated techniques to analyze various threat information to identify patterns and/or unusual information that varies from normal (e.g., based on data mining techniques), etc. After step 715, the routine continues to step 720 to store the supplied threat trend analysis definition.
If it was instead determined in step 710 that the received indication was to perform a threat trend analysis, the routine continues to step 725 to select the next indicated type of trend analysis, beginning with the first. In some embodiments, the specific types of trend analyses to be performed may be specified in step 705, while in other embodiments the analyses to be performed may be determined in other ways (e.g., based on a role of a user of the routine, on a predetermined schedule, on a type of threat information that has become available, etc.). The routine then continues to step 730 to retrieve a stored definition for the selected trend analysis, and then continues to step 735 to retrieve appropriate threat-related information indicated by the definition. In other embodiments, definitions may instead not be specified and stored in advance, such as when a user interactively specifies a trend analysis to be performed. The routine then continues to step 740 to analyze the retrieved threat information as indicated by the definition.
In step 745, the routine next determines whether to generate a report about the trend analysis that was performed, such as based on the threat trend analysis definition and/or in a manner specific to a user. If so, the routine continues to step 750 to generate a report that reflects the analysis, and if not the routine continues to step 755 to store the analysis information temporarily while the other analyses are performed (and optionally on a longer-term basis, such as for later use). After steps 750 or 755, the routine continues to step 760 to determine whether there are more analyses to perform, and if so returns to step 725. If not, the routine continues to step 765 to determine whether to present the analysis information to the user, and if so continues to step 770 to present the generated reports and/or the temporarily stored analysis information to the user, such as in a manner based on user preferences and/or the analysis definitions. After step 770 or 720, or if it was instead determined in step 765 not to present information to the user, the routine continues to step 795 to determine whether to continue. If so, the routine returns to step 705, and if not the routine continues to step 799 and ends.
The routine begins at step 805 where an indication is received to define an alert type or of a change to threat information. The routine continues to step 810 to determine whether an alert is to be defined, and if so continues to step 815 to receive in the illustrated embodiment a definition of a type of threat information, of a criteria that when satisfied by threat information will trigger an alert (e.g., a threshold for a specified aspect of the information), and of a type of alert response. The routine then continues to step 820 to store the definition.
If it was instead determined in step 810 that a change to threat information has occurred, the routine continues to step 825 to retrieve alert definitions that are associated with the type of changed threat information. In other embodiments, alerts can be selected to be evaluated against current conditions (or other conditions, such as past conditions or predicted future conditions) in a variety of ways, such as based on an indication to perform a periodic evaluation as specified (e.g., once a day), an explicit user instruction, a receipt of appropriate threat information, etc. In step 830, the routine then selects the next retrieved alert definition, beginning with the first. In step 835, it is then determined whether that alert is triggered by the change to threat information, and if so continues to step 840 to generate an alert and to step 845 to perform the alert response for that alert definition (e.g., generating a pop-up window on the screens of one or more users, generating an instant communication to one or more users such as a phone call, page, instant message or SMS text, etc.).
After step 845, or if it was instead determined in step 835 that the selected alert was not triggered, the routine continues to step 850 to determine whether there are more alert definitions, and if so returns to step 830. If not, the routine continues to step 855 to determine whether to present alert information to a user (e.g., a summary of one or more current alerts), and if so continues to step 860 to present information about the generated alerts to the user. After steps 860 or 820, or if it was instead determined in step 855 not to present information, the routine continues to step 895 to determine whether to continue. If so, the routine returns to step 805, and if not the routine continues to step 899 and ends.
Those skilled in the art will also appreciate that in some embodiments the functionality provided by the routines discussed above may be provided in alternative ways, such as being split among more routines or consolidated into less routines. Similarly, in some embodiments illustrated routines may provide more or less functionality than is described, such as when other illustrated routines instead lack or include such functionality respectively, or when the amount of functionality that is provided is altered. In addition, while various operations may be illustrated as being performed in a particular manner (e.g., in serial or in parallel) and/or in a particular order, those skilled in the art will appreciate that in other embodiments the operations may be performed in other orders and in other manners. Those skilled in the art will also appreciate that the data structures discussed above may be structured in different manners, such as by having a single data structure split into multiple data structures or by having multiple data structures consolidated into a single data structure. Similarly, in some embodiments illustrated data structures may store more or less information than is described, such as when other illustrated data structures instead lack or include such information respectively, or when the amount or types of information that is stored is altered.
From the foregoing it will be appreciated that, although specific embodiments have been described herein for purposes of illustration, various modifications may be made without deviating from the spirit and scope of the invention. Accordingly, the invention is not limited except as by the appended claims and the elements recited therein. In addition, while certain aspects of the invention are presented below in certain claim forms, the inventors contemplate the various aspects of the invention in any available claim form. For example, while only some aspects of the invention may currently be recited as being embodied in a computer-readable medium, other aspects may likewise be so embodied.
