Confidential data access and storage

A system is described for managing storage and access of confidential data downloaded from a server (e.g., an enterprise data server) onto a mobile device. The confidential data may be received over a network directly or be embedded as part of an email or other application. Instead of storing the data item locally, the data item may be communicated to a peripheral device that is communicatively coupled to the mobile device via a peripheral interface. The data item is encrypted and stored on the peripheral device.

BACKGROUND

A smart phone or other portable electronic device may be used to download confidential data and store the confidential data locally. For example, a user may access a corporate email account via a smart phone. In some cases, an email may include confidential data (e.g., as an attachment), and the user may download the confidential data to the smart phone. The confidential data may be stored to a memory module of the smart phone or to a removable storage device. While a password may be required to access the smart phone, the confidential data may still be accessible to another user in the event that the smart phone is lost or stolen. Further, in the event that the confidential data is stored to the removable storage device, the confidential data may be accessible via another device. Accordingly, there is a need to protect such confidential data when downloaded to a mobile device.

DETAILED DESCRIPTION

This disclosure includes techniques and arrangements for access to confidential data (e.g., confidential enterprise data, government data, personal data, educational data, etc.) and storage of confidential data. In some implementations, a peripheral device that is communicatively coupled to an electronic device (e.g., a smart phone) may provide additional security for confidential enterprise data. As one example, an enterprise data security application on the electronic device may disable local storage of confidential enterprise data and instead store the data in an encrypted format on the peripheral device. In some implementations, the peripheral device may provide network access security by generating a token that may be used along with one or more other credentials to authenticate a user requesting remote access to enterprise data.

As one non-limiting example, suppose that the user requests confidential enterprise data (e.g., an email attachment) from an electronic device (e.g., a smart phone) via a network (e.g., via a virtual private network). The user may be interested in downloading the confidential enterprise data to her smart phone in order to view or otherwise interact with the data. However, storing the confidential enterprise data locally may allow an unauthorized user to access the data. Further, storing the data locally on one device (e.g., on the smart phone) may prevent a user from accessing the data on another device (e.g., a tablet computing device). To address this challenge, the present disclosure describes providing secure peripheral storage and access to confidential enterprise data via a peripheral device. The peripheral device may allow the user to access confidential enterprise data and may reduce the security risk associated with local storage of the data on the electronic device.

Example Frameworks

FIG. 1illustrates an example framework100for securing confidential data provided to an electronic device102according to some implementations. In the example ofFIG. 1, the data includes enterprise data. However, it will be appreciated that the data can include government data, personal data, or educational data, among other alternatives. InFIG. 1, a user104may communicate a request for enterprise data via the electronic device102. When the enterprise data is determined to be confidential, the electronic device102may disable local storage of the confidential enterprise data. Instead, the confidential enterprise data may be stored in an encrypted format on a peripheral device106that is communicatively coupled to the electronic device102. Thus, as the confidential enterprise data is not stored locally on the electronic device102, the confidential enterprise data is inaccessible via the electronic device102when the peripheral device106is not communicatively coupled to the electronic device102. Further, as the confidential enterprise data is stored on the peripheral device106in an encrypted format, the confidential enterprise data is inaccessible via another electronic device without a peripheral device key associated with the peripheral device106.

The electronic device102may be implemented as any of a number of electronic devices, such as a smart phone, an eBook reader, a media player, a tablet computing device, a portable gaming device, a portable digital assistant, a laptop or netbook computer, and so forth. Furthermore, the electronic device102may not necessarily be a mobile or portable device, and thus, in some implementations may include a display of a desktop or other computing device, a gaming system, a television, other home electronics devices, and so forth.

In the example illustrated inFIG. 1, the electronic device102includes one or more processors108, computer-readable media110, a peripheral interface112and a network interface114. The electronic device102may communicate with one or more enterprise data servers116via at least one network118. For example, a virtual private network (VPN) connection may allow for secure communications between the electronic device102and the one or more enterprise data servers116. The computer-readable media110may include at least an operating system120and a data security module122. For example, the data security module122may include a data security application, illustrated inFIG. 1as separate from the operating system120. Alternatively, the data security module122may be implemented as part of the operating system120(e.g., at the kernel level). The data security module122may include a data identification module124, a storage disabling module126and an authentication module128.

The peripheral device106may include a token generation module130, an encryption module132and one or more encrypted data items134. In some examples, the one or more encrypted data items134may include multiple encrypted data items (e.g., an N number of encrypted data items). To illustrate, inFIG. 1, a first encrypted data item is identified as “Encrypted Data Item (1)” at136, while an Nth encrypted data item is identified as “Encrypted Data Item (N)” at138.

The one or more enterprise data servers116may store or otherwise have access to enterprise data140. For example, the enterprise data140may include multiple data items, including one or more confidential data items. The one or more enterprise data servers116may also include an authentication component142configured to authenticate the user104requesting access to the one or more enterprise data servers116via the network118.

In some implementations, the user104may communicate a request for a data item144to the one or more enterprise data servers116. For example, the user104may communicate a request for an email to an enterprise email server, and the data item144may include an attachment included with the email (e.g., an attached document, spreadsheet, presentation, etc.).

The data security module122of the electronic device102may be configured to prevent local storage of confidential data items received from the one or more enterprise data servers116. Disabling local storage may prevent unauthorized access to confidential enterprise data in the event that the electronic device102(or a removable storage device) is lost or stolen.

The data identification module124of the data security module122may be configured to determine whether the data item144is a confidential data item or otherwise includes confidential enterprise data. As one example, when the data item144is retrieved from the one or more enterprise data servers116via a VPN connection, the data identification module124may determine that the data item144is a confidential data item. As another example, the one or more enterprise data servers116may identify the data item144as a confidential data item and include a confidential data item identifier along with the data item144(seeFIG. 2). As a further example, the one or more enterprise data servers116may determine a list of confidential data items included in the enterprise data140and may periodically synchronize this list with the electronic device102(seeFIG. 3).

The storage disabling module126of the data security module122may be configured to disable local storage of the data item144on the electronic device102when the data item144is determined to be a confidential data item. For example, the storage disabling module126may disable storage of the data item144to the computer-readable media110of the electronic device102. Further, in the example illustrated inFIG. 1, a removable storage device146(e.g., a Flash memory device) may be communicatively coupled to the electronic device102. In this case, the storage disabling module126may also disable storage of the data item144to the removable storage device146. Disabling local storage of the data item144to the computer-readable media110of the electronic device102may prevent unauthorized access to confidential enterprise data in the event that the electronic device102is lost or stolen. Further, disabling local storage of the data item144to the removable storage device146may prevent unauthorized access to confidential enterprise data in the event that the removable storage device146is lost or stolen.

Instead of storing the data item144at the electronic device102, the data security module122may be configured to communicate the data item144to the peripheral device106via the peripheral interface112for encryption and storage on the peripheral device106. In the example illustrated inFIG. 1, the peripheral device106includes a universal serial bus (USB) device. In this case, the peripheral interface112may include a USB device interface, and the peripheral device106may be physically coupled to the electronic device102via the USB device interface. Alternatively, the peripheral device106may include an external storage device other than a USB device, and the peripheral device106may be communicatively coupled to the electronic device102in an alternative manner. For example, the peripheral device106may include a storage device that may be communicatively coupled to the electronic device102via an audio interface (e.g., a headphone jack) or via a wireless interface (e.g., via a WiFi connection, a Bluetooth® connection, etc.), among other alternatives.

The encryption module132of the peripheral device106may be configured to encrypt the data item144received from the electronic device102. Alternatively, the data item144may be encrypted by the operating system120of the electronic device102or by a separate encryption component (not shown inFIG. 1) that may be stored on the electronic device102. Further, in some examples, one or more encryption operations may be performed via the electronic device102and one or more encryption operations may be performed via the peripheral device106. Thus, whileFIG. 1illustrates that the encryption module132is stored on the peripheral device106, it will be appreciated that encryption may be performed by the peripheral device106, the electronic device102, or a combination thereof. After being encrypted, the data item144may be stored on the peripheral device106as an encrypted data item (e.g., stored as the first encrypted data item136of the one or more encrypted data items134). Thus, if the peripheral device106is lost or stolen, the encrypted confidential enterprise data may be inaccessible without a peripheral device key (seeFIG. 4).

In some examples, the peripheral device106may provide multiple forms of security. For example, in addition to providing data storage security via the encryption module132, the token generation module130may provide network access security. To illustrate, the token generation module130may be configured to generate the token148and communicate the token148to the electronic device102via the peripheral interface112. In some examples, in order to access the one or more enterprise data servers116via the network118(e.g., via a VPN connection), the authentication module128may communicate the token148and one or more other credentials (e.g., a username, a password, etc.) received from the user104to the one or more enterprise data servers116via the network interface114. In some implementations, the authentication component142of the one or more enterprise data servers116may authenticate the user104based on the token148and the one or more other credentials received from the user104. After the authentication component142authenticates the user104, the one or more enterprise data servers116may communicate the data item144to the electronic device102via the network118.

Thus,FIG. 1illustrates that disabling local storage of confidential enterprise data to the electronic device102(e.g., to the computer-readable media110or to the removable storage device146) may prevent unauthorized access to confidential enterprise data in the event that the electronic device102or the removable storage device146is lost or stolen. Instead, the data security module122communicates the confidential enterprise data to the peripheral device106for storage as an encrypted data item.FIG. 1further illustrates that the peripheral device106may provide network access security by generating the token148to be communicated to the one or more enterprise data servers116via the network interface114of the electronic device102. The one or more enterprise data servers116may utilize the token148and one or more other credentials received from the user104to authenticate the user104.

FIG. 2illustrates an example framework200for authenticating the user104and determining whether the data item144requested by the user104includes confidential enterprise data. In the example ofFIG. 2, the one or more enterprise data servers116may maintain a list of confidential data items that include confidential enterprise data. When the one or more enterprise data servers116determine that the data item144is a confidential data item, the one or more enterprise data servers116may indicate to the electronic device102that the data item144includes confidential enterprise data to be encrypted and stored on the peripheral device106.

In the example illustrated inFIG. 2, the one or more enterprise data servers116include a confidential data item identification component202, the enterprise data140, the authentication component142and token data204. The enterprise data140may include one or more confidential data items206. In some examples, the one or more confidential data items206may include multiple confidential data items (e.g., an N number of confidential data items). To illustrate, inFIG. 2, a first confidential data item is identified as “Confidential Data Item (1)” at208, while an Nth confidential data item is identified as “Confidential Data Item (N)” at210.

In some implementations, the authentication component142may determine whether the token148received from the electronic device102is valid based on the token data204. For example, the authentication component142may determine whether the token148received from the electronic device102is associated with the peripheral device106. Further, the enterprise authentication component142may authenticate the user104based on one or more other credentials received from the user104. In some examples, a VPN connection may be established between the electronic device102and the one or more enterprise data servers116in response to the user104being authenticated.

The one or more enterprise data servers116may be configured to receive a data item request212from the electronic device102via the network118(e.g., via a VPN connection established in response to the authentication component142authenticating the user104). The confidential data item identification component202may be configured to determine whether the data item144associated with the data item request212includes confidential enterprise data. For example, the confidential data identification component202may determine whether the data item144is one of the confidential data items206. To illustrate, the confidential data item identification component202may access the enterprise data140and determine that the data item144is the first confidential data item208. In response to determining that the data item144is a confidential data item, the one or more enterprise data servers116may communicate a confidential data item identifier214(e.g., along with the data item144) to the electronic device102.

The confidential data item identifier214may indicate to the data security module122of the electronic device102that the data item144includes confidential enterprise data and is to be encrypted and stored to the peripheral device106and not stored on the electronic device102or the removable storage device146.

FIG. 3illustrates an example framework300for identifying confidential enterprise data based on information stored on the electronic device102. In the example ofFIG. 3, the one or more enterprise data servers116may identify the one or more confidential data items206that include confidential enterprise data and may provide information identifying the one or more confidential data items206to the electronic device102. Thus, the electronic device102may determine whether the data item144includes confidential enterprise data based on a list of confidential data item identifiers304stored on the electronic device102.

In the example illustrated inFIG. 3, the data security module122of the electronic device102further includes a synchronization module302. The synchronization module302may be configured to store one or more confidential data item identifiers304received from the one or more enterprise data servers116. In some examples, the data identification module124may determine whether the data item144includes confidential enterprise data based on the one or more confidential data item identifiers304stored on the electronic device102.

In some implementations, a different confidential data item identifier may be associated with each confidential data item of the one or more confidential data items206. For example, a first confidential data item identifier may be associated with the first confidential data item208, and an Nth confidential data item identifier may be associated with the Nth confidential data item210. To illustrate, referring toFIG. 2, the data item144may represent the first confidential data item208, and the confidential data item identifier214may represent a confidential data item identifier associated with the first confidential data item208.

In some implementations, the confidential data item identification component202may determine whether the one or more confidential data items206have changed. For example, the confidential data item identification component202may periodically access the enterprise data140to determine whether one or more confidential data items have been added to the enterprise data140or removed from the enterprise data140. As another example, the one or more confidential data items206may be automatically updated in response to one or more confidential data items being added to the enterprise data140or removed from the enterprise data140. In some implementations, an updated list of the one or more confidential data item identifiers304may be communicated to the electronic device102in response to determining that the one or more confidential data items206have changed. In response, the synchronization module302of the electronic device102may store the updated list of the one or more confidential data item identifiers304.

Thus,FIG. 3illustrates that the electronic device102may determine whether the data item144includes confidential enterprise data based on a list of confidential data items stored on the electronic device102. That is, in contrast to the example illustrated inFIG. 2, the one or more enterprise data servers116may not provide the confidential data item identifier214in response to the data item request212, as the electronic device102may locally determine whether the data item144requested by the user104includes confidential enterprise data.

FIG. 4illustrates an example process400of accessing confidential enterprise data stored on the peripheral device106using a second electronic device402. Storing confidential enterprise data on the peripheral device106instead of the electronic device102may provide additional security for the confidential enterprise data and may allow a user to access the confidential enterprise data via the second electronic device402.

In some implementations, the data item144may be received via the electronic device102when the peripheral device106is communicatively coupled to the electronic device102via the peripheral interface112and may be stored on the peripheral device106as the first encrypted data item136. When the peripheral device106is no longer communicatively coupled to the electronic device102, the data item144may be inaccessible to the electronic device102, as the data item144was not stored locally on the electronic device102(e.g., on the computer-readable media110or on the removable storage device146).

In the example ofFIG. 4, the peripheral device106is communicatively coupled to the second electronic device402. A peripheral device key404may be provided to the peripheral device106via the second electronic device402in order to access the confidential enterprise data that was stored on the peripheral device106when the peripheral device106was communicatively coupled to the electronic device102.

Thus,FIG. 4illustrates that, by storing a confidential data item received via one electronic device (e.g., the electronic device102) on the peripheral device106as an encrypted data item, confidential enterprise data may be inaccessible via the second electronic device402without the peripheral device key404in the event that the peripheral device106is lost or stolen. Further, by storing information on the peripheral device106rather than the electronic device102, the user104may access the confidential enterprise data stored on the peripheral device106via another device (e.g., the second device402).

Example Electronic Device

FIG. 5illustrates select example components of an electronic device500(e.g., the electronic device102ofFIGS. 1-3) that may be used to implement the functionality described above according to some implementations. In a very basic configuration, the electronic device500includes, or accesses, components such as at least one processor502and a computer-readable media504. Each processor502may itself comprise one or more processors or cores. The processor(s)502can be configured to fetch and execute computer-readable instructions stored in the computer-readable media504or other computer-readable media.

Depending on the configuration of the electronic device500, the computer-readable media504may be an example of non-transitory computer storage media and may include volatile and nonvolatile memory and/or removable and non-removable media implemented in any type of technology for storage of information such as computer-readable instructions, data structures, program modules or other data. Such computer-readable media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other computer-readable media technology, CD-ROM, digital versatile disks (DVD) or other optical storage, magnetic cassettes, magnetic tape, solid state storage, magnetic disk storage, RAID storage systems, storage arrays, network attached storage, storage area networks, cloud storage, or any other medium that can be used to store information and which can be accessed by the processor502directly or through another computing device. Accordingly, the computer-readable media504may be computer-readable media able to maintain instructions, modules or components executable by the processor502.

The computer-readable media504may be used to store any number of functional components that are executable by the processor502. In some implementations, these functional components comprise instructions or programs that are executable by the processor502and that, when executed, implement operational logic for performing the actions attributed above to the electronic device500. Functional components of the electronic device500stored in the computer-readable media504may include the data security module122, as described above, which may be executed on the processor502for providing access to confidential enterprise data and preventing local storage of the confidential enterprise data. Additional functional components associated with the data security module122stored in the computer-readable media504may include the data identification module124, the storage disabling module126, and the authentication module128. In some examples, the data identification module124may also include the synchronization module302(illustrated inFIG. 3). Other functional components may include an operating system506for controlling and managing various functions of the electronic device500. In some examples, the operating system506may correspond to the operating system120ofFIGS. 1-3. In some examples, at least a portion of the functionality of the data security module122may be incorporated into the operating system120(e.g., at the kernel level). Depending on the type of the electronic device500, the computer-readable media504may also optionally include other functional components, such as other modules508, which may include applications, programs, drivers and so forth.

The computer-readable media504may also store data, data structures, and the like that are used by the functional components. For example, data stored by the computer-readable media504may include the one or more confidential data item identifiers304illustrated inFIG. 3. The electronic device500may also include other data510, which may include, for example, data used by the operating system506and the other modules508. Further, the electronic device500may include many other logical, programmatic and physical components, of which those described are merely examples that are related to the discussion herein.

FIG. 5further illustrates a display512, which may be passive, emissive or any other form of display. In one implementation, the display uses electronic paper (ePaper) display technology, which is bi-stable, meaning that it is capable of holding text or other rendered images even when very little or no power is supplied to the display. Some examples of suitable ePaper displays that may be used with the implementations described herein include bi-stable LCDs, MEMS, cholesteric, pigmented electrophoretic, and others. In other implementations, or for other types of devices, the display512may be an active display such as a liquid crystal display, plasma display, light emitting diode display, organic light emitting diode display, and so forth. These displays may comprise drive electronics, such as a display drive matrix configured to affect individual pixels within the display512. Additionally, in some implementations, the display512may be a 3D display capable of providing a 3D image. For example, the display512may produce a 3D image by providing alternating left-eye and right-eye images with or without the use of shuttering or filtering eyeglasses. Accordingly, in some implementations, the visual representations and other user interface components herein may be rendered in 3D.

In some implementations, multiple displays512may be present on the electronic device500. When multiple displays are present, these displays may be of the same or different types. For convenience only, the display512of the computing device102is shown in a generally rectangular configuration. However, it is understood that the display512may be implemented in any shape, and may have any ratio of height to width. Also, for stylistic or design purposes, the display512may be curved or otherwise non-linearly shaped. Furthermore, the display512may be flexible and configured to fold or roll.

One or more communication interfaces514may support both wired and wireless connection to various networks, such as cellular networks, radio, WiFi networks, short-range or near-field networks (e.g., Bluetooth®), infrared signals, local area networks, wide area networks, the Internet, and so forth. For example, the communication interface514may allow a user of the electronic device102ofFIGS. 1-3to access the World Wide Web, provide the token148to the one or more enterprise data servers116(e.g., via a VPN connection), and download the data item144, and the like. The communication interface514may further allow a user to access storage on another device, such as a user's computing device, a network attached storage device, or the like.

The electronic device500may further be equipped with various other input/output (I/O) components516. Such I/O components may include a touchscreen and various user actuatable controls (e.g., buttons, a joystick, a keyboard, a mouse, etc.), speakers, a microphone, a camera, connection ports, and so forth. For example, the electronic device500may include the peripheral interface112to communicate with the peripheral device106. As another example, the operating system506of the electronic device500may include suitable drivers configured to accept input from a keypad, keyboard, or other user actuatable controls and devices included as the I/O components516. For instance, the user actuatable controls may include page turning buttons, navigational keys, a power on/off button, selection keys, and so on. Additionally, the electronic device500may include various other components that are not shown, examples of which include removable storage, a power source, such as a battery and power control unit, a global positioning system (GPS) device, a PC Card component, and so forth.

Various instructions, methods and techniques described herein may be considered in the general context of computer-executable instructions, such as program modules stored on computer storage media and executed by the processors herein. Generally, program modules include routines, programs, objects, components, data structures, etc., for performing particular tasks or implementing particular abstract data types. These program modules, and the like, may be executed as native code or may be downloaded and executed, such as in a virtual machine or other just-in-time compilation execution environment. Typically, the functionality of the program modules may be combined or distributed as desired in various implementations. An implementation of these modules and techniques may be stored on computer storage media or transmitted across some form of communication media.

Example Processes

FIG. 6illustrates an example process600for disabling local storage of a data item, as described above. The process600is illustrated as a collection of blocks in a logical flow diagram, which represents a sequence of operations, some or all of which can be implemented in hardware, software or a combination thereof. In the context of software, the blocks represent computer-executable instructions stored on one or more computer-readable media that, when executed by one or more processors, perform the recited operations. Generally, computer-executable instructions include routines, programs, objects, components, data structures and the like that perform particular functions or implement particular abstract data types. The order in which the operations are described should not be construed as a limitation. Any number of the described blocks can be combined in any order and/or in parallel to implement the process, or alternative processes, and not all of the blocks need be executed. For discussion purposes, the processes are described with reference to the architectures and environments described in the examples herein, although the processes may be implemented in a wide variety of other architectures or environments.

At602, an electronic device receives a data item from one or more data servers (e.g., enterprise data servers) via a network interface. As an illustrative example, referring toFIG. 1, the electronic device102may receive the data item144from the one or more enterprise data servers116via the network interface114.

In some implementations, the peripheral device106may provide additional network access security via the token148. To illustrate, the electronic device102may receive the token148from the peripheral device106via the peripheral interface112. In some examples, the user104may provide one or more other credentials (e.g., a username, a password, etc.). In some examples, the electronic device102may communicate the token148and the one or more other credentials to the one or more enterprise data servers116in order to establish a VPN connection. In some implementations, the storage disabling module126may automatically disable local storage of the data item144in response to determining that the VPN connection has been established.

In the example illustrated inFIG. 6, the electronic device102may determine whether the data item144includes a confidential data item, at604. The electronic device102may disable local storage of the data item144in response to determining that the data item144includes confidential data. As an illustrative example, referring toFIG. 2, the one or more enterprise data servers116may include the confidential data item identifier214along with the data item144in response to the data item request212received from the user104. In this case, the data item144may be identified as including confidential enterprise data based on the confidential data item identifier214. As another example, referring toFIG. 3, the one or more enterprise data servers116may provide the list of confidential data item identifiers304to the electronic device102, and the electronic device102may store the list of confidential data item identifiers304. In this case, the electronic device102may determine that the data item144includes confidential enterprise data when the data item144is included in the list of confidential data item identifiers304. Further, in some examples, the list of confidential data item identifiers304may be updated by the one or more enterprise data servers116, and the updated list may be sent to the electronic device102.

At606, the electronic device102disables storage of the received data item144to the one or more computer-readable media110of the electronic device102. In some implementations, a removable storage device (e.g., the removable storage device146) may be communicatively coupled to the electronic device102via a removable storage device interface. In some examples, the electronic device102may further disable storage of the received data item144to the removable storage device146.

At608, the electronic device102communicates the data item144to the peripheral device106via the peripheral interface112to be stored on the peripheral device106as an encrypted data item (e.g., as the first encrypted data item136).

In some implementations, after communicating the data item144to the peripheral device106, the user104may request access to the data item144via the electronic device102. In response to the request, the electronic device102may determine whether the peripheral device106is communicatively coupled to the electronic device102via the peripheral interface116. When the peripheral device106is communicatively coupled to the electronic device102, the data item144may be accessible to the user104via the electronic device102. Further, a second encrypted data item (e.g., the Nth encrypted data item138) stored on the peripheral device106may be accessible when the peripheral device106is communicatively coupled to the electronic device102. When the peripheral device106is not communicatively coupled to the electronic device102via the peripheral interface116, the request from the user104may be denied and the data item144may be inaccessible via the electronic device102.

In some implementations, the peripheral device106may be decoupled from the electronic device102after the data item144has been encrypted and stored to the peripheral device106. To illustrate, referring toFIG. 4, the peripheral device106has been decoupled from the electronic device102. In order to access the one or more encrypted data items134stored on the peripheral device106via the second electronic device402, the peripheral device key404may be used. This may allow the user104to access the one or more encrypted data items134via another device (e.g., a tablet computing device). Further, without the peripheral device key404, an unauthorized user may be unable to access the one or more encrypted data items134via another device.

Thus,FIG. 6illustrates that disabling local storage of the data item144to the electronic device102may prevent access to confidential enterprise data when the peripheral device106is not communicatively coupled to the electronic device102. Further, the peripheral device106may provide additional network security by generating the token148to be used in establishing a VPN connection.

The example processes described herein are only examples of processes provided for discussion purposes. Numerous other variations will be apparent to those of skill in the art in light of the disclosure herein. Further, while the disclosure herein sets forth several examples of suitable frameworks, architectures and environments for executing the processes, implementations herein are not limited to the particular examples shown and discussed.

CONCLUSION