The present disclosure relates to communicating between computing devices, and in particular accessing a protected service, such as an application, from multiple computing devices.
Users generally use multiple computing devices like desktop, laptop, tablet, mobile phones etc. to use the same application. At times, a user may uses these computing devices simultaneously or in tandem. Typically, the user may be expected to login into the application from each computing device separately. When a user chooses to log out from an application they may have to perform the log out action in each computing device separately.
For example, a user may use three computing devices in a typical bring your own device (BYOD) system. An application server may have to maintain triple the number of sessions in the system when one computing device may be typically used at a time. Since the sessions are separate, a user typically may not save temporary work in the session and switch to another computing device.
According to an aspect of the disclosure, a method to access an application comprises outputting, by a first computing device, a request to access the application by the first computing device. The first computing device also receives a request for information used to determine a first machine identification associated with the first computing device and a user identification. The first computing device outputs the information used to determine the first machine identification and the user identification. The first computing device receives an authentication token to access the application. The authentication token is used by a second computing device to access the application. The first computing device receives a session identification to access the application. The session identification identifies a session used by the second computing device to access the application. The first computing device accesses the application using the authentication token and session identification.
According to another aspect of the disclosure, an apparatus comprises a processor and a computer readable storage medium to store computer readable program code. The processor executes the computer readable program code to: 1) receive a first information used to determine a first machine identification of a first computing device and a user identification; 2) calculate the first machine identification of the first computing device in response to the first information; 3) store the first machine identification of the first computing device and the associated user identification; 4) receive a second information used to determine a second machine identification of a second computing device and the user identification; 5) calculate the second machine identification of the second computing device in response to the second information; 6) store the second machine and the associated user identification; 7) output a first authentication token and a first session identification to the first computing device so that the first computing device accesses an application; and 8) output the first authentication token and first session identification to the second computing device so that the second computing device accesses the application.
According to another aspect of the disclosure, a computer program product comprises a computer readable storage medium having computer readable program code embodied therewith. The computer readable program code comprises: 1) computer readable program code configured to receive information used to determine a machine identification associated with a computing device and an associated user identification; 2) computer readable program code configured to calculate the machine identification associated with the computing device in response to the information used to determine the machine identification associated with the computing device; 3) computer readable program code configured to store and retrieve the machine identification and the associated user identification; 4) computer readable program code configured to provide an authentication token to the computing device to accesses an application as well as provide the same authentication token to another computing device to access the application; and 5) computer readable program code configured to provide a session identifier to the computing device and provide the same session identifier to the another computing device.
This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features or essential features of the claimed subject matter, nor is it intended to be used as an aid in determining the scope of the claimed subject matter. The claimed subject matter is not limited to implementations that solve any or all disadvantages noted in the Background.
Single sign on technology described herein enables shared access to a protected service or resource, such as an application, from a plurality of dynamically associated computing devices. After logging into the application from one of the computing device, a user may access the application from the other computing devices without re-authentication (for example, providing a username and password). A user may also log out from the application from any of the computing device. Unique machine identifications, such as device DNA, for identifying each of the computing devices are used in, for example, a method, apparatus (such as a login server) and computer program product. A single session may be shared across multiple computing devices. The same authentication token, such as a security assertion markup language token (SAML) token, may also be used for all of the computing devices having the same user session.
In embodiments, single sign on technology across multiple dynamically associated computing devices may increase user convenience, reduce the number of session used and/or increase security. For example, a user may sign on to an application on one computing device and then switch between computing devices in accessing the application in the single shared session. Similarly, a user may logout from any of the computing devices that may further enhance convenience and security. Since a single shared session across multiple session may be used, a server may not have to create separate sessions of each computing device. A single session identifier (or id, identification) may be generated and provided to the multiple computing devices used by (or belonging to) the same user. In an embodiment, security may be increased by reducing a threat of session based attacks. A device profile used to identify a computing device, that may include device type, Internet Protocol (IP) address and/or host name, may be spoofed while unique machine identifications identify a particular computing device associated with a user (or user identifier, user identification or user name) may not.
As will be appreciated by one skilled in the art, aspects of the present disclosure may be illustrated and described herein in any of a number of patentable classes or context including any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof. Accordingly, aspects of the present disclosure may be implemented entirely hardware, entirely software (including firmware, resident software, micro-code, etc.) or combining software and hardware implementation that may all generally be referred to herein as a “circuit,” “module,” “component,” or “system.” Furthermore, aspects of the present disclosure may take the form of a computer program product embodied in one or more computer readable media having computer readable program code embodied thereon.
Any combination of one or more computer readable media may be utilized. The computer readable media may be a computer readable signal medium or a computer readable storage medium. A computer readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of the computer readable storage medium would include the following: a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an appropriate optical fiber with a repeater, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. In the context of this disclosure, a computer readable storage medium may be any tangible medium that can contain, or store a program for use by or in connection with an instruction execution system, apparatus, or device.
A computer readable signal medium may include a propagated signal with computer readable program code embodied therein, for example, in baseband or as part of a carrier wave.
Propagated signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable signal medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, Radio Frequency (RF), etc., or any suitable combination of the foregoing.
Computer (readable) program code for carrying out operations for aspects of the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, Scala, Smalltalk, Eiffel, JADE, Emerald, C++, CII, VB.NET, Python or the like, conventional procedural programming languages, such as the “c” programming language, Visual Basic, Fortran 2003, Perl, COBOL 2002, PHP, ABAP, dynamic programming languages such as Python, Ruby and Groovy, or other programming languages. The program code may execute entirely on the user's computer (or computing device), partly on the user's computer, as a stand-alone software package, partly on the user's computer and partly on a remote computer or entirely on the remote computer or server. In the latter scenario, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or the connection may be made to an external computer (for example, through the Internet using an Internet Service Provider) or in a cloud computing environment or offered as a service such as a Software as a Service (SaaS).
Aspects of the present disclosure are described herein with reference to flowchart illustrations, sequence diagrams and/or block diagrams of methods, apparatuses (systems) and computer program products according to embodiments of the disclosure. It will be understood that each block of the flowchart illustrations and/or block diagrams, and combinations of blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. Similarly, each arrow of a sequence diagram may likewise be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer (or computing device), special purpose computer, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable instruction execution apparatus, create a mechanism for implementing the functions/acts specified in the flowchart, sequence diagram and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer readable storage medium that when executed can direct a computer, other programmable data processing apparatus, or other devices to function in a particular manner, such that the instructions when stored in the computer readable storage medium produce an article of manufacture including instructions which when executed, cause a computer to implement the function/act specified in the flowchart and/or block diagram block or blocks. The computer program instructions may also be loaded onto a computer, other programmable instruction execution apparatus, or other devices to cause a series of operational steps to be performed on the computer, other programmable apparatuses or other devices to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide processes for implementing the functions/acts specified in the flowchart and/or block diagram block or blocks.
As illustrated in
When a user 120 chooses to log out from an application, user 120 may have to perform the log out action in each of computing devices 106-109 separately. This redundant logout (or logoff) action also may add to inconvenience of user 120. User 120 may forget to logout from the application from one of the computing devices leaving a session active and open for attacks.
The number of inactive sessions on a particular application may also increase by the number of computing devices used by user 120. For example, when a user logins to an application from three separate computing devices, an application server (or other server) may have to maintain triple the number of sessions when one may be used at a time by user 120.
Furthermore, since the sessions are separate, user 120 may not be able to save temporary work in the session and switch to another computing device.
In embodiments, single sign on technology across multiple dynamically associated computing devices may increase user convenience, reduce the number of session used and/or increase security. In an embodiment, single sign on technology includes at least one or more computing devices illustrated in
In an embodiment, single sign on 104 is computer readable program code executed by computing device 102 that at least partially provides single sign on technology described herein. In an embodiment, computing device 102 is embodied as a login server that, at least, provides requests for information to determine machine identifications, calculate and store machine identifications and associated user identifications, provide authentication tokens and provide session identifiers to one or more of computing devices 106-109. In an embodiment, computing device 102 performs an authentication function of a computing device attempting to access protected service 103a. In an embodiment, computing device 102 requests login information, such as user identification and a password, from a computing device attempting to access protected service 103a for the first time. Computing device 102 compares received login information to stored login information before providing an authentication token to the computing device attempting access. In an embodiment, re-authentication is not performed for other computing devices used by user 120 that attempt to access the same protected service 103a. Computing device 102 also stores and retrieves relational information including machine identifications and associated user identifications as well as a session and authentication information for respective computing devices.
In an embodiment, computing device 101 is embodied as a reverse proxy server to receive requests from computing devices 106-109 to access or login to a protected service 103a of computing device 103. In an embodiment, computing device 101 forwards such requests to computing device 102. In an embodiment, computing device 101 allows access (in a gatekeeper or gateway manner) to computing device 103 in response to the proper authentication token and/or session identification. In an alternate embodiment, computing device is coupled directly to network 105.
In an embodiment, protected service 103a is an application including computer readable program code that when executed by computing device 103 provides a service and/or information to one or more of computing devices 106-109 in response to a request. In an embodiment, computing device 103 is embodied as an application server. In an embodiment, a separate computing device 101 is not used.
In embodiments, computing devices 106-109 may include computer readable program code as described herein to, at least partially, allow single sign on technology across multiple computing devices as described herein. For example, each of the computing devices 106-109 may have computer readable program code to output information to determine respective machine identifications and user identifications as well as receive and store authentication tokens and session identifiers to access protected service 103a. In embodiments, computing devices 106-109 may include a desktop computer, laptop computer, cellular smartphone and/or tablet. In other embodiments, computing devices may include wearable computers, embedded system, mainframe and/or other computing devices having processors executing or reading computer readable programmable code. In embodiment, one or more computing devices illustrated in
In embodiments, computing devices illustrated in
In embodiments, system 100 includes many more or less computing devices. In an embodiment, computing devices 101 and 102 are combined into a single computing device. In another embodiment, computing devices 101, 102 and 103 are combined into a single computing device. In embodiments, functions described herein are distributed to other or more computing devices.
In embodiments, one or more computing device illustrated in
Computing devices illustrated in
In embodiments, computer readable program code illustrated in
In embodiments, computing device 201 includes, one or more of, a browser 201a, authentication token 201b, machine identification (id) 201c, session identification (id) 201d and input/output 201e software components.
Browser 201a is responsible for accessing and/or retrieving information or a service in an embodiment. In an embodiment, browser 201a accesses protected service 103a after obtaining at least an authentication token and session identification (id). In an embodiment, browser 201a is computer readable program code with a graphical user interface for displaying Hyper Text Markup Language (HTML) files, used to navigate an Internet or intranet.
Authentication token 201b, in an embodiment, is responsible for interfacing with a computing device performing an authentication function, such as computing device 102. In an embodiment, authentication token 201b requests, receives and stores an authentication token, such as a SAML token, in order to access a protected service 103a. In an embodiment, authentication token 201b provides login information in response to a request.
Machine identification 201c, in an embodiment, is responsible for providing information used to determine a unique machine identification (id) associated with a particular computing device, such as computing device 201. In an embodiment, machine identification 201c provides information used to determine a unique identification in response to a request. In an embodiment, information used to determine an machine identification may include session information or machine information. Machine information may include, for example, machine attributes such as “cpu speed,” “address capacity” “operating system version,” “processor family” “keyboard delay” and/or “maximum resolution.” Session information may include how long a particular computer readable program code may take to execute on or the number of times the computer readable program code completes an iteration in a particular period of time.
Technology (or portions thereof) to determine machine identifications (or machine identities or machine signatures) is used in embodiments herein as described in World Intellectual Property Organization (WIPO) International Patent Application having International Publication Number WO 2011/056533 and International Application Number PCT/US2010/054023 entitled “Method and System for Machine Identification,” with an International Publication date of May 12, 2011 (“WO 2011/056533”).
Session identification (id) 201d, in an embodiment, is responsible for obtaining, storing and/or using session details or a session identification (id or identifier) in accessing a protected service 103a.
Input/output 201e, in an embodiment, is responsible for outputting and receiving information, such as requests, authentication tokens and session ids, to and from other networked computing devices, such as computing devices 101-103. In embodiments, other computing devices 101-103 has similar have similar input/output 101a, 102e and 103b. For example, input/output 102e may output a request for information used to determine machine identification, authentication tokens and session ids. For example, input/output 101a may forward requests from computing devices 106-109 to access protected service 103a to computing device 102. Similarly, input/output 103b may output requested information and/or a service in response to a request from computing devices 106-109.
In embodiments, computing device 102 includes, one or more of, database 102a, authentication 102b, machine identification (id) interface 102c, session 102d and input/output 102e software components. In an embodiment, database 102a, authentication 102b, machine identification (id) interface 102c, session 102d are included in single sign on 104.
Database 102a, in an embodiment, is responsible for storing and retrieving unique machine identifications of computing devices used by a user and associated user identifications as illustrated in
Authentication 102b is responsible for performing authentication of a computing device in an embodiment. In an embodiment, authentication 102b queries a computing device for login information. In an embodiment, authentication 102b outputs authentication tokens, such as SAML tokens, in response to a comparison of received login information and stored login information. Authentication 102b may also keep track of which computing device used by user 120 is accessing protected service 103a and provide a same or duplicate authentication token to another computer device of user 120 requesting concurrent access to protected service 103a.
Machine identification interface 102c may request information used to determine a machine identification from a computing device 106-109 and store a calculated machine identification in database 102a. In an embodiment, a request may be output at power-on or initialization of a computing device or when a particular computing device requests a protected service.
In an embodiment, a method for calculating a machine identification is illustrated in
In alternate embodiments, machine identification interface 102c may include software components such as fingerprint code, machine identity database, machine identity comparator and/or machine identity generator as described in WO 2011/056533.
Session 102d is responsible for keeping (storing) track of session details or session ids used by computing devices of user 120 in accessing protected service 103a. Similarly, session 102d is responsible for creating a new session when a computing device of user 120 is not accessing protected service 103a. Session 102d provides the same session details or id to a computing device of a user 120 that attempts to access protected service 103a when another computing of user 120 is accessing protected service 103a.
Logic block 501 represents requesting access to a protected service, such as an application, by a computing device. In an embodiment, one of computing devices 106-109 outputs a request to access protected service 103a to computing device 101 via network 105.
Logic block 502 represents forwarding the request, by a reverse proxy server, to a login server. In an embodiment, computing device 101 forwards the request to computing device 102 via network 105. In an embodiment, input/output 101a executed by computing device 101 performs this function.
Logic block 503 represents requesting, by the login server, information used to determine a machine identification (id) from the requesting computing device. In an embodiment, machine identification interface 102c executed by computing device 102 performs this function.
Logic block 504 represents outputting the information used to determine a machine identification (id). In an embodiment, machine identification 201c executed by the requesting computing device performs this function.
Logic block 505 represents calculating, by the login server, the machine identification in response to the information used to determine a machine identification (id). In an embodiment, machine identification interface 102c executed by the requesting computing device performs this function.
Logic block 506 represents determining whether a machine identification is stored in a database, such as database 102a. In an embodiment, database 102 executed by computing device 102 performs this function. When the machine identification is stored in the database, control transitions to logic block 511. Otherwise, control transitions to logic block 507.
Logic block 507 represents performing authentication by the login server. In an embodiment, authentication 102b executed by computing device 102b performs this function. For example, authentication 102b queries the requesting computing device for login information, such as a user identification (user name) and password.
Logic block 508 represents storing, by the Login Server, user identification and associated machine identification pair in a database, such as database 102a. In an embodiment, database 102a executed by computing device 102 performs this function.
Logic block 509 represents storing, by the login server, machine identification in requesting computing device. In an embodiment, machine identification 102c executed by computing device 102 performs this function, such as storing the machine identification as a browser cookie in browser 201a.
Logic block 511 represents determining whether a valid session is available for the associated user. In an embodiment, session 102d performs this function. When a user has a current session with a request application, control transitions to logic block 512 where session details or a current session id is obtained and control passes to logic block 515.
Otherwise, control transitions to logic block 513 and 514 where a user is authenticated and a new session is created. In an embodiment, authentication 102b and session 102d perform these functions, respectively. Control then passes to logic block 515.
Logic block 515 represents forwarding requesting computing device to reverse proxy server, such as computing device 101. In an embodiment, input/output 102e executed by computing device 102 performs this function.
Logic block 516 represents forwarding an authentication token, such as a SAML token, from a login server to a requesting computing device. In an embodiment, the same or duplicate SAML token used in another active session of another computing device of a user is forwarded. In an embodiment, authentication 102b and input/output 102e executed by computing device 102 performs this function to forward the authentication token to computing device 101.
Logic block 517 represents forwarding session details or a session identification (new or already existing) from a login server to the requesting computing device. In an embodiment, session 102d and input/output 102e executed by computing device 102 performs this function. In an embodiment, computing device 101 embodied as a reverse proxy server receives the above identified authentication token and session id (new or existing).
Logic block 518 represents validating authentication token by reverse proxy server. In an embodiment, input/output 101a executed by computing device 101 performs this function.
Logic block 519 represents allowing requesting computing device access to protected service, such as protected service 103a, by a reverse proxy server, such as computing device 101. In an embodiment, input/output 101a executed by computing device 101 performs this function.
Logic block 601 illustrates outputting a request to access an application by a first computing device. In an embodiment as illustrated in
Logic block 602 illustrates receiving a request for information used to determine a first machine identification associated with the first computing device and a user identification. In an embodiment, computing device 106 receives this request from computing device 102 embodied as a login server. In an embodiment, input/output 201e, machine identification 201c and/or browser 201a of computing device 106 performs this function.
Logic block 603 illustrates outputting the information used to determine the first machine identification and the user identification. In an embodiment, input/output 201e and machine identification 201c of computing device 106 performs this function. In an embodiment, the information used to determine the first machine identification may include session information and/or machine information. In an embodiment, a machine identification 201c in computing device 102 calculates the machine identification that uniquely identifies a computing device in response to the information used to determine the first machine identification from computing device 106. In an embodiment, exemplary machine identifications that are calculated and user identifications may be stored as illustrated in
Logic block 604 illustrates receiving an authentication token to access the application, wherein the authentication token is used by a second computing device to access the application. In an embodiment, computing device 107 is concurrently accessing protected service 103a using the same authentication token that is provided to computing device 106. In an embodiment, authentication token 201b and input/output 201e executed by computing device 106 perform this function.
Logic block 605 illustrates receiving a session identification to access the application, wherein the session identification identifies a session used by the second computing device to access the application. In an embodiment, computing device 107 is concurrently accessing protected service 103a using the same session that is provided to computing device 106. In an embodiment, session 102d and input/output 201e executed by computing device 106 perform this function.
Logic block 606 illustrates accessing the application using the authentication token and session identification. In an embodiment, computing device 106 accesses or uses protected service 103a embodied as an application using the same authentication token and session identification that is used by computing device 107 that is concurrently accessing protected service 103a. The same session (session id or session details) used to access the protected service 103a by computing device 107 is used by computing device 106.
Logic block 701 illustrates receiving a first information used to determine a first machine identification of a first computing device and an associated user identification. In an embodiment, computing device 102 receives the first information and associated user identification from one or more computing devices 106-109 shown in
Logic block 702 illustrates calculating the first machine identification of the first computing device in response to the first information. In an embodiment, machine identification interface 102c executed by processing device 102 performs this function. In an embodiment, a machine fingerprint code or computer readable program code is executed by computing device 102 as described in WO 2011/056533.
Logic block 703 illustrates storing the first machine identification of the first computing device and the associated user identification. In embodiment, computing device 102 executing computer readable program code, such as software components shown in computer device 102 in
Logic block 704 illustrates receiving a second information used to determine a second machine identification associated with a second computing device and the associated user identification. In an embodiment, computing device 102 receives a second machine identification and associated user identification from one or more computing devices 106-109 shown in
Logic block 705 illustrates calculating the second machine identification of the second computing device in response to the second information. In an embodiment, machine identification interface 102c executed by processing device 102 performs this function. In an embodiment, a machine fingerprint code or computer readable program code is executed by computing device 102 as described in WO 2011/056533.
Logic block 706 illustrates storing the second machine identification and the associated user identification. In embodiment, computing device 102 executing computer readable program code, such as software components shown in computer device 102 in
Logic block 707 illustrates outputting a first authentication token and a first session identification to the first computing device so that the first computing device accesses an application. In an embodiment, a first authentication token, such as a SAML token, is output from computing device 102 to computing device 106 that allows computing device 106 access to a protected service 103a, or application, provided by computing device 103. In an embodiment, a session identification or identifier is also output from computing device 102 to computing device 106 that allows computing device access to a protected service, such as an application, provided by computing device 103.
Logic block 708 illustrates outputting the first authentication token and first session identification to the second computing device so that the second computing device accesses the application. In an embodiment, the first authentication token (the same authentication token output to computing device 106 in logic block 707) is output from computing device 102 to computing device 107 that allows computing device 107 (while computing device 106 may also access the same session) shared access to a protected service 103a, or application, provided by computing device 103. In an embodiment, a session identification or identifier (the same session identifier output to computing device 106 in logic block 707) is also output from computing device 102 to computing device 107 that allows computing device access to a protected service, such as an application, provided by computing device 103.
Logic block 801 illustrates receiving information used to determine a machine identification associated with a computing device and an associated user identification. In an embodiment, computing device 102 receives information used to determine a machine identification and an associated user identification from one or more computing devices 106-109 shown in
Logic block 802 illustrates calculating the machine identification associated with the computing device in response to the information used to determine the machine identification associated with the computing device. In an embodiment, machine identification interface 102c executed by processing device 102 performs this function. In an embodiment, a machine fingerprint code or computer readable program code is executed by computing device 102 as described in WO 2011/056533. In an alternate embodiment a “Hash (Device DNA)=Machine ID’ function illustrated in Table I of
Logic block 803 illustrates storing and retrieving the machine identification and the associated user identification. In embodiment, computing device 102 executing computer readable program code, such as software components shown in computer device 102 in
Logic block 804 illustrates providing an authentication token to the computing device to accesses an application and the authentication token to another computing device to access the application. In embodiment, computing device 102 executing computer readable program code performs at least a portion of this function. In an embodiment, the authentication token is provided to at least two of computing devices 106-109.
Logic block 805 illustrates providing a session identifier to the computing device and provide the session identifier to another computing device. In an embodiment, the session identifier or identification is provided to at least two of computing devices 106-109.
The disclosed technology may be used with various computing systems or computing devices.
Components of computer 2210 may include, but are not limited to, a processing unit (or core (s)) 2220, a system memory 2230, and a system bus 2221 that couples various system components including the system memory 2230 to the processing unit 2220. The system bus 2221 may be any of several types of bus structures including a memory bus, a peripheral bus, and a local bus using any of a variety of bus architectures. By way of example, and not limitation, such architectures include Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus.
Computer 2210 typically includes a variety of computer readable media or processor readable memory. Computer readable media can be any available media that can be accessed by computer 2210 and includes both volatile and nonvolatile media, removable and non-removable media. By way of example, and not limitation, computer readable media may comprise computer readable storage media. Computer readable storage media includes both volatile and nonvolatile, removable and non-removable media implemented in any method or technology for storage of information such as computer readable instructions, data structures, program modules or other data. Computer readable storage media includes, but is not limited to, random access memory (RAM), read only memory (ROM), electrically erasable programmable read only memory (EEPROM), flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can accessed by computer 2210. Combinations of the any of the above should also be included within the scope of computer readable media.
The system memory 2230 includes computer readable storage media in the form of volatile and/or nonvolatile memory such as ROM 2231 and RAM 2232. A basic input/output system (BIOS) 2233, containing the basic routines that help to transfer information between elements within computer 2210, such as during start-up, is typically stored in ROM 2231. RAM 2232 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit 2220. The system memory 2230 may store operating system 2234, application program(s) 2235, other program module(s) 2236, and program data 2237. In an embodiment, computer program code as described herein may be at least partially stored in application program(s) 2235. In an embodiment, protected service 103a shown in
The computer 2210 may also include other removable/non-removable, volatile/nonvolatile computer readable storage media. The computer 2210 may include a hard disk drive 2241 that reads from or writes to non-removable, nonvolatile magnetic media, a magnetic disk drive 2251 that reads from or writes to a removable, nonvolatile magnetic disk 2252, and an optical disk drive 2255 that reads from or writes to a removable, nonvolatile optical disk 2256 such as a CD ROM or other optical media. Other removable/non-removable, volatile/nonvolatile computer storage media that can be used in the exemplary operating environment include, but are not limited to, magnetic tape cassettes, flash memory cards, digital versatile disks, digital video tape, solid state RAM, solid state ROM, and the like. The hard disk drive 2241 is typically connected to the system bus 2221 through a non-removable memory interface such as interface 2240, and magnetic disk drive 2251 and optical disk drive 2255 are typically connected to the system bus 2221 by a removable memory interface, such as interface 2250.
The drives and their associated computer readable storage media described above provide storage of computer (processor) readable instructions, data structures, program modules and other data for the computer 2210. Hard disk drive 2241 is illustrated as storing operating system 2244, application program(s) 2245, other program module(s) 2246, and program data 2247. Note that these components can either be the same as or different from operating system 2234, application program(s) 2235, other program module(s) 2236, and program data 2237. Operating system 2244, application program(s) 2245, other program module(s) 2246, and program data 2247 are given different numbers here to illustrate that, at a minimum, they are different copies.
A user may enter commands and information into computer 2210 through input devices such as a keyboard 2262 and pointing device 2261, commonly referred to as a mouse, trackball, or touch pad. Other input devices (not shown) may include a microphone, joystick, game pad, satellite dish, scanner, or the like. These and other input devices are often connected to the processing unit 2220 through a user input interface 2260 that is coupled to the system bus, but may be connected by other interface and bus structures, such as a parallel port, game port or a universal serial bus (USB). A monitor 2291 or other type of display device is also connected to the system bus 2221 via an interface, such as a video interface 2290. In addition to the monitor, computers may also include other peripheral output devices such as speakers 2297 and printer 2296, which may be connected through an output peripheral interface 2295.
The computer 2210 may operate in a networked environment using logical connections to one or more remote computers, such as a remote computer 2280. In embodiments, computer 2210 includes input/output software and hardware to output and receive information from other computers on a network. For example,
When used in a LAN networking environment, the computer 2210 is connected to the LAN 2271 through a network interface or adapter 2270. When used in a WAN networking environment, the computer 2210 typically includes a modem 2272 or other means for establishing communications over the WAN 2273, such as the Internet. The modem 2272, which may be internal or external, may be connected to the system bus 2221 via the user input interface 2260, or other appropriate mechanism. In a networked environment, program modules depicted relative to the computer 2210, or portions thereof, may be stored in the remote memory storage device. For example, remote application program(s) 2285 may reside on memory device 2281. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers may be used.
The flowchart, sequence diagrams and block diagrams in the Figures illustrate the architecture, functionality, and operation of possible implementations of systems, methods and computer program products according to various aspects of the present disclosure. In this regard, each block in the flowchart or block diagram (or arrow in sequence diagram) may represent a module, segment, or portion of code, which comprises one or more executable instructions for implementing the specified logical function(s). It should also be noted that, in some alternative implementations, the functions noted in the block may occur out of the order noted in the figures. For example, two blocks (or arrows) shown in succession may, in fact, be executed substantially concurrently, or the blocks (or arrows) may sometimes be executed in the reverse order, depending upon the functionality involved. It will also be noted that each block of the block diagrams or arrows and/or flowchart illustration, and combinations of blocks in the block diagrams or arrows and/or flowchart illustration, can be implemented by special purpose hardware-based systems that perform the specified functions or acts, or combinations of special purpose hardware and computer instructions.
The terminology used herein is for the purpose of describing particular aspects only and is not intended to be limiting of the disclosure. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises” and/or “comprising,” when used in this specification, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof.
The corresponding structures, materials, acts, and equivalents of any means or step plus function elements in the claims below are intended to include any disclosed structure, material, or act for performing the function in combination with other claimed elements as specifically claimed. The description of the present disclosure has been presented for purposes of illustration and description, but is not intended to be exhaustive or limited to the disclosure in the form disclosed. Many modifications and variations will be apparent to those of ordinary skill in the art without departing from the scope and spirit of the disclosure. The aspects of the disclosure herein were chosen and described in order to best explain the principles of the disclosure and the practical application, and to enable others of ordinary skill in the art to understand the disclosure with various modifications as are suited to the particular use contemplated.