Runtime identity confirmation for restricted server communication control

The present disclosure provides computing systems and techniques for providing a certificate to sue to securely connect to a server. More particularly, the present disclosure provides a computing device certificate rotation server arranged to provide certificates to the computing device for use by an application executing on the computing device to securely connect to a server.

TECHNICAL FIELD

Examples described herein are generally related to certificates for secure communication over a network and particularly to managing rotation or replacement of certificates.

BACKGROUND

Certificates are often used to create secure connections to a server over an unsecured network, such as, the Internet. For example, certificates allow connections to a secure website via secure browsing protocols, such as, for example, hypertext transfer protocol secure (HTTPS), or the like. As another example, mobile applications can use certificates to verify the mobile application is connected to the correct server. As a specific example, a mobile banking application may use certificates to ensure that the mobile application is indeed connected to the servers associated with the mobile banking application provider.

In the mobile application example, certificates are statically incorporated into the mobile application. That is, the certificates are embedded into, or compiled with the application itself. This requires the certificate to be distributed with the application. As such, a user will need to update the application to effect a change in the certificates. Thus, whenever there is a change in the certificate, the developer or mobile application provider must update the application and redistribute the updated application. This often requires significant advance planning as well as a period of overlap where multiple certificates might need to be valid.

DETAILED DESCRIPTION

The present disclosure provides for rotation or updating of certificates, without redistribution of an application. In general, the present disclosure provides a system including an application requiring certified server access and a certificate rotation server. Upon launch of the application, a request will be made to the certificate rotation server to obtain the list of certificates deemed trusted by the application owner. With some examples, the request can be encrypted, for example, using a public key of a previously agreed upon asymmetric keypair that is distributed with the application.

The certificate rotation server can decode the request using the corresponding private key of the asymmetric keypair, validate the request and/or identify the requesting application. Upon validation of the request, the certificate rotation server can obtain the list of valid certificates for the application, sign the list of certificates using the private key, and send the signed list of certificates to the application.

The application can validate the signature of data received from the server using the previously agreed upon public key and validate the data to obtain the list of trusted certificates. Given the list of trusted certificates, the application can restrict further network-based communications to servers identified from the list of trusted certificates.

FIG. 1illustrates an example certificate rotation server100. The certificate rotation server100can include, at least in part, a processor110, a memory120, input/output (I/O) component(s)130, and interface140. Memory120may store instructions122, which are executable by processor110. Instructions122can correspond to a certificate rotation application. Memory120may further store certificates123, asymmetric keypair124including private key125and public key126, encrypted metadata127, application metadata128and signed certificates129.

Certificates123can be a single certificate or a list of multiple certificates. In general, certificates123can be used to securely connect to a server over a network, such as, the Internet. During operation, certificates123can be updated on certificate rotation server100, for example, to replace an expiring certificate, to replace a compromised certificate, to change a location or other characteristics of the secured server to be connected to via the certificates123. With some examples, the certificates123are secure certificates, or public key certificates provided according to any of a number of public key certificate standards, such as, for example, the X.509 standard promulgated by the International Telecommunications Union (ITU-T).

In general, asymmetric keypair124can be any keypair where the private key125is maintained privately (e.g., by the owner of the asymmetric keypair124) and the public key126can be widely distributed, even publicly. With some examples, asymmetric keypair124can be provided according to any of a variety of cryptographic techniques. For example, asymmetric keypair124can be provided according to the Diffie-Hellman key exchange protocol, the digital signature standard (DSS), elliptic curve techniques, password-authenticated key agreement techniques, the Paillier cryptosystem, the RSA encryption algorithm, the Cramer-Shoup cryptosystem, or the like.

Encrypted metadata127can be metadata associated with an application requesting certificates123, encrypted using public key126from asymmetric keypair124. Certificate rotation server100can receive encrypted metadata127from a computing device (seeFIG. 2for example) executing an application requesting certificates123for use by the application. This metadata is described in greater detail below. Certificate rotation server100can decrypt encrypted metadata127using the private key125from asymmetric keypair124. More specifically, processor110in executing instructions122can receive encrypted metadata127and can decrypt encrypted metadata127using private key125. Metadata128can correspond to the encrypted metadata127decrypted using the private key125.

Certificate rotation server100can validate the requesting application based on the metadata128. More specifically, processor110in executing instructions122can validate the requesting application based on metadata128associated with the application. Furthermore, metadata128can be used to identify certificates123needed by the requesting application.

Certificate rotation server100can sign certificates123, resulting in signed certificates129using private key125and can send the signed certificates to the requesting application. More specifically, processor110in executing instructions122can sign certificates123using private key125to generate signed certificates129and can send the signed certificates129to the computing device associated with the application requesting the certificates123(e.g., the application associated with metadata128).

In some examples, processor110, in executing instructions122, can assemble (or package) a number of certificates123and any associated metadata for certificates123into an information element (or binary blob) and “sign” the package. That is, processor110in executing instructions122can apply a hash (e.g., Rivest-Shamir-Adleman (RSA) encryption algorithm) to the package to generate a digital signature (e.g., standard Digital Signature scheme of RSA2048with Secure Hash Algorithm 256 (SHA256) and Public Key Cryptography Standard (PKSC) Version 1 (PKSC1) padding, or the like). With some examples, processor110, in executing instructions122can generate signed signatures129using a Java Script Object Notation (JSON) Web Signature. The binary blob and the signature are transmitted as signed certificates129.

With some examples, the processor110may include circuitry or processor logic, such as, for example, any of a variety of commercial processors. In some examples, the processor110may include multiple processors, a multi-threaded processor, a multi-core processor (whether the multiple cores coexist on the same or separate dies), and/or a multi-processor architecture of some other variety by which multiple physically separate processors are in some way linked. Additionally, in some examples, the processor110may include graphics processing portions and may include dedicated memory, multiple-threaded processing and/or some other parallel processing capability.

The memory120may include logic, a portion of which includes arrays of integrated circuits, forming non-volatile memory to persistently store data or a combination of non-volatile memory and volatile memory. It is to be appreciated, that the memory120may be based on any of a variety of technologies. In particular, the arrays of integrated circuits included in memory120may be arranged to form one or more types of memory, such as, for example, dynamic random access memory (DRAM), NAND memory, NOR memory, or the like.

The I/O component(s)130may include one or more components to provide input to or to provide output from the server100. For example, the I/O component(s)130may be a keyboard (hardware, virtual, etc.), mouse, joystick, microphone, track pad, button, touch layers of a display, haptic feedback device, camera, microphone, speaker, or the like.

Interface140may include logic and/or features to support a communication interface. For example, the interface140may include one or more interfaces that operate according to various communication protocols or standards to communicate over direct or network communication links. Direct communications may occur via use of communication protocols or standards described in one or more industry standards (including progenies and variants). For example, the interface140may facilitate communication over a bus, such as, for example, peripheral component interconnect express (PCIe), non-volatile memory express (NVMe), universal serial bus (USB), system management bus (SMBus), SAS (e.g., serial attached small computer system interface (SCSI)) interfaces, serial AT attachment (SATA) interfaces, or the like.

FIG. 2illustrates an example computing device200arranged to execute an application and rotate certificates used by the application according to the present disclosure. In general, computing device200can be any of a variety of computing devices, such as, a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart television, a streaming media device, a smart home appliance, or the like.

Computing devices200can include, at least in part, processor210, memory220, I/O components230, interface240, and display250. Memory220may store instructions222, which are executable by processor210. Instructions222can correspond to an application to connect to a secure service using a certificate, and particularly to rotate the certificates as described herein. As a specific example, instructions222can correspond to a mobile banking application, for example, executed on a smart phone. Instructions222can include, can have associated therewith, or derivable therefrom, application metadata123. It is noted, that although application metadata123is depicted included in instructions222, in some examples, application metadata123can be generated by processor210in executing instructions222. Memory220can further store public key126of the asymmetric keypair124, encrypted metadata127, signed certificates129, certificates123and cached certificates224.

In some examples, application metadata123can include indications of a name of the mobile application associated with instructions222(e.g., a package name, or the like), an identifier for the mobile application associated with instructions222, a version number for the mobile application associated with the instructions222, an indication of a type of connection or level of connection requested by the mobile application associated with the instructions222.

During operation, computing devices200can connect to a certificate rotation server (e.g., server100ofFIG. 1, or the like) to update cached certificates224. Computing device200can use cached certificates224to securely connect to a server. More particularly, processor210in executing instructions222can use cached certificates224to securely connect to a server.

Additionally, computing device200can replace or update cached certificates224from a certificate rotation server (e.g., certificate rotation server100ofFIG. 1). Processor210in executing instructions222can encrypt application metadata123using public key126and send encrypted metadata127to a certificate rotation server. With some examples, processor210in executing instructions222can send encrypted metadata127to a certificate rotation server along with a request to receive a list of certificates (e.g., certificates123, or the like). Responsive to the request, computing device200can receive signed certificates129. Processor210in executing instructions222can receive signed certificates129from the certificate rotation server. Processor210in executing instructions222can verify the signature of the signed certificates129using public key126to determine certificates123. Processor210in executing instructions222can determine whether cached certificates224need to be updated based on certificates123. If certificates123differ from cached certificates224, cached certificates224can be updated based on certificates123. Accordingly, instructions222(e.g., mobile application) can be executed using certificates that are updated without requiring redistribution of the instructions222.

With some examples, the processor210may include circuitry or processor logic, such as, for example, any of a variety of commercial processors. In some examples, processor210may include multiple processors, a multi-threaded processor, a multi-core processor (whether the multiple cores coexist on the same or separate dies), and/or a multi-processor architecture of some other variety by which multiple physically separate processors are in some way linked. Additionally, in some examples, processor210may include graphics processing portions and may include dedicated memory, multiple-threaded processing and/or some other parallel processing capability.

The memory220may include logic, a portion of which includes arrays of integrated circuits, forming non-volatile memory to persistently store data or a combination of non-volatile memory and volatile memory. It is to be appreciated, that memory220may be based on any of a variety of technologies. In particular, the arrays of integrated circuits included in memory220may be arranged to form one or more types of memory, such as, for example, dynamic random access memory (DRAM), NAND memory, NOR memory, or the like.

The I/O component(s)230may include one or more components to provide input to or to provide output from the computing device200. For example, the I/O component(s)230may be a keyboard (hardware, virtual, etc.), mouse, joystick, microphone, track pad, button, touch layers of a display, haptic feedback device, camera, microphone, speaker, or the like.

Interface240may include logic and/or features to support a communication interface. For example, the interface240may include one or more interfaces that operate according to various communication protocols or standards to communicate over direct or network communication links. Direct communications may occur via use of communication protocols or standards described in one or more industry standards (including progenies and variants). For example, the interface240may facilitate communication over a bus, such as, for example, peripheral component interconnect express (PCIe), non-volatile memory express (NVMe), universal serial bus (USB), system management bus (SMBus), SAS (e.g., serial attached small computer system interface (SCSI)) interfaces, serial AT attachment (SATA) interfaces, or the like.

Display250can be based on any of a variety of display technologies, such as, for example, a cathode ray tube (CRT), a liquid crystal display (LCD), plasma display, light emitting diode (LED) display, or an organic light emitting diode (OLED) display. With some examples, display250can be a touch sensitive display. It is noted, display250may be external to the computing device200, such as, for example, embodied as a computer monitor or television and coupled to the computing device200via any of a variety of display data interfaces.

FIG. 3illustrates an example technique300to update certificates for use by an application, according to embodiments of the present disclosure. Technique300is described with reference to certificate rotation server100depicted inFIG. 1and computing device200depicted inFIG. 2. However, technique300could be implemented by a system having a different configuration than depicted. Examples are not limited in this context.

Technique300can begin at circle3.1. At circle3.1, computing device200can generate encrypted metadata127. For example, computing device200can generate encrypted metadata127associated with instructions222(e.g., an application package installed on computing device200, or the like). Processor210, in executing instructions222, generate encrypted metadata127from application metadata128and public key126.

Continuing to circles3.2, computing device200can send an information element310-1to certificate rotation server100. For example, in executing instructions222, processor210can connect to certificate rotation server100via interface230. At circle3.2, certificate rotation server100can receive information element310-1. For example, in executing instructions122, processor110can establish a connection with computing device200via interface130and can receive information element310-1. Information element310-1can include an indication of encrypted metadata127and a request to obtain a certificate list for connection to a secure server. With some examples, information element310-1can be formatted according to the javascript object notation (JSON).

Continuing to circle3.3, certificate rotation server100can authenticate or validate the computing device200, and particularly instructions222. Said differently, certificate rotation server100can determine whether the application executing on computing device200is authorized to receive certificates123. For example, processor110in executing instructions122can decrypt encrypted metadata127using private key125and determine whether the application associated with application metadata128is authorized to receive certificates123. In some examples, at circle3.3, processor110in executing instructions122can determine which certificates123to send to computing device200.

Continuing to circle3.4, certificate rotation server100can generate signed certificates129. Processor110, in executing instructions122, can generate signed certificates129from certificates123and private key125. Continuing to circles3.5, certificate rotation server100can send an information element310-2to computing device200. For example, in executing instructions122, processor110can send, via interface130, information element310-2including signed signatures129(e.g., certificate payload and payload signature as described above) to computing device200. At circle3.5, computing device200can receive information element310-2. For example, in executing instructions222, processor210can receive, via interface230, information element310-2. Information element310-2can include an indication of signed certificates129. With some examples, information element310-2can be formatted according to the javascript object notation (JSON). As a specific example, information element310-2can include indications of the certificates123formatted as a JSON web signature (JWS) data structure. With some examples, certificates123can be formatted as Dir files.

Continuing to circle3.6, computing device200can verify the signature of the signed certificates129. Processor210, in executing instructions222, can verify the signature of the signed certificates129using public key126. Continuing to circle3.7, computing device200can determine whether certificates123match cached certificates224. For example, processor210can execute instructions222to determine whether certificates indicated in cached certificates224are the same as the certificates123.

Technique300can optionally include circle3.8. For example, technique300can include circle3.8based on a determination (e.g., at circle3.7) that cached certificates224does not match certificates123. At circle3.8, computing device200can update cached certificates224based on certificates123. Processor210in executing instructions222can store or cache certificates123as cached certificates224. Accordingly, certificates used by an application (e.g., instructions222) can be updated without redistribution of the application.

With some examples, computing device200can be arranged to implement technique300each time instructions222are executed. In other examples, computing device200can be arranged to implement technique300on a daily, weekly, monthly or other periodic basis.

FIG. 4illustrates a logic flow400to update certificates used by an application, according to embodiments of the present disclosure. A computing device, executing an application, could update certificates used by the application to connect to a secure server using logic flow400. For example, computing device200ofFIG. 2can update cached certificates224using logic flow400. Logic flow400is described with reference to certificate rotation server100depicted inFIG. 1and computing device200depicted inFIG. 2. However, logic flow400could be implemented by a system having a different configuration than depicted. Examples are not limited in this context.

Logic flow400may begin at block410. At block410“generate, at a computing device, metadata associated with an application executing on the computing device” computing device200can generate metadata associated with an application executing on the computing device200. Processor210, in executing instructions222, can generate application metadata128.

Continuing to block420“encrypt the metadata with a public key from an asymmetric keypair” computing device200can encrypt application metadata128using public key126from asymmetric keypair124. For example, in executing instructions222processor210can encrypt application metadata128resulting in encrypted metadata127.

Continuing to block430“send, to a certificate rotation server, a first information element comprising an indication of the encrypted metadata and a request for certificates for the application to use to securely connect to a server” computing device200can send an information element (e.g., information element310-1) to a certificate rotation server (e.g., server100) comprising an indication of encrypted metadata127and a request for certificates123. For example, processor210in executing instructions222can send the information element.

Continuing to block440“receive, from the certificate rotation server, a second information element comprising an indication of the certificates and a digital signature based on a private key of the asymmetric keypair” computing device200can receive an information element (e.g., information element310-2) from the certificate rotation server (e.g., server100) comprising an indication of signed certificates129. For example, processor210in executing instructions222can receive the information element.

Continuing to block450“validate the digital signature of the second information element with the public key” computing device200can validate the signature of second information element310-2(e.g., signed certificates129) with the public key. For example, in executing instructions222, processor210can validate signed certificates129using public key126. Continuing to decision block460“received certificates different from cached certificates?” computing device200can determine whether the certificates received from the certificate rotation server are different from certificates cached at computing device200. For example, processor210in executing instructions222can determine whether certificates123are different from cached certificates224. Based on the determination at decision block460, logic flow400can continue to block470or can end. Logic flow400can continue from decision block460to block470based on a determination that the certificates123do not match cached certificates224while logic flow400can end after decision block460based on a determination that the certificates123do match cached certificates224.

At block470“update the cached certificates based on the received certificates” computing device200can update certificates cached at the computing device based on certificates received and decrypted at blocks440and450. Processor210in executing instructions220can update cached certificates224with certificates123.

FIG. 5illustrates a logic flow500to update certificates used by an application, according to embodiments of the present disclosure. A certificate rotation server, executing a certificate rotation application, could provide update certificates to a computing device to be used by an application executing on the computing device (e.g., to facilitate connecting to a secure server) using logic flow500. For example, certificate rotation server100ofFIG. 1can facilitate updating cached certificates224at computing device200using logic flow500. Logic flow500is described with reference to certificate rotation server100depicted inFIG. 1and computing device200depicted inFIG. 2. However, logic flow500could be implemented by a system having a different configuration than depicted. Examples are not limited in this context.

Logic flow500may begin at block510. At block510“receive, at a certificate rotation server, a first information element comprising an indication of encrypted metadata and a request for certificates for an application to use to securely connect to a server” server100can receive an information element (e.g., information element310-1) from a computing device (e.g., computing device200) comprising an indication of encrypted metadata127and a request for certificates123. For example, processor110in executing instructions122can receive the information element.

Continuing to block520“decrypt the metadata with a private key from an asymmetric keypair” certificate rotation server100can decrypt the encrypted metadata127using private key125from asymmetric keypair124. Processor110, in executing instructions122, can decrypt encrypted metadata127using private key125. Continuing to block530“authenticate the request based on the metadata” certificate rotation server100can authenticate the request for certificates received at block510using the metadata decrypted at block520. Processor110in executing instructions122, can authenticate the application. For example, processor110can determine whether the application package type and version number are authorized to receive certificates123.

Continuing to block540“identify certificates for use by the application based on the metadata” certificate rotation server100can determine which certificates (e.g., certificates123, or the like) that application (e.g., application222) is to use to securely connect to a server. Processor110in executing instructions122can determine which certificates to use based on the application metadata128. Continuing to block550“sign the certificates with the private key” certificate rotation server100can sign certificates123using private key125from asymmetric keypair124. For example, in executing instructions122processor110can sign certificates123using private key124resulting in signed certificates129.

Continuing to block560“send, to a computing device executing the application, a second information element comprising an indication of the signed certificates” certificate rotation server100can send an information element (e.g., information element310-2) to a computing device (e.g., computing device200) comprising an indication of signed certificates129(e.g., a digital signature and certificates). For example, processor110in executing instructions122can send the information element310-2.

In general, certificate rotation server100can be used to update certificates for instructions (e.g., application packages) installed on multiple computing devices or even provide different certificates123to different instruction.FIG. 6illustrates a system600including certificate rotation server100and a number of computing devices200coupled to the certificate rotation server via network601. Network601could be, for example, a local area network (LAN), a wide area network (WAN), or a cellular network (e.g., LTE, 3GPP, or the like). In some embodiments, network601could include the Internet. During operation, certificate rotation server100can accept connections from various computing devices200to update certificates used by instructions (e.g., applications) on the computing devices. Likewise, computing devices200can connect to certificate rotation server100to update certificates used by instructions (e.g., applications) executing on the computing device200.

System600is depicted including computing devices200-1,200-2,200-3, and200-4. It is noted that the number of computing devices200is given for purposes of clarity of presentation only and not to be limiting. Embodiments can be provided with more of less computing devices than depicted in this figure. Furthermore, it is noted that this figure only depicts portions of certificate rotation server100and computing device200for purposes of clarity. For example, processors and interfaces are omitted. Furthermore, a number of data structures stored in memory are also omitted. Lastly, it is noted that computing devices200from system600need not be homogenous.

Certificate rotation server100could be arranged to provide a number of certificates123to computing devices as described herein. For example, certificate rotation server100could provide certificates123to computing devices200-1to200-4such that computing devices200-1to200-4could use the certificates123to securely connect to a server. In some examples, certificate rotation servers100can be arranged to provide a selected certificate123based on which computing device200of computing devices200-1to200-4requests the certificate. For example, computing devices200can be arranged to execute a number of different applications (e.g., instructions222, or the like) where each application may have an associated certificate123. As a specific example, computing devices200-1to200-4may execute a mobile banking application or a mobile investing application. Each application may query certificate rotation server100to receive a list of certificates123as described herein. However, certificate rotation server100may provide a specific certificate to the computing device based on which application requests the certificate. For example, certificate rotation server100could provide a certificate to the mobile banking application and a different certificate to the mobile investing application. Examples are not limited in this context.

To illustrate such a system, memory120of certificate rotation server100stores first signed certificates129-1and second signed certificates129-2where first and second signed certificates129-1and129-2indicate different certificates. Memory120of certificate rotation server100also stores encrypted metadata127-1to127-4, corresponding to application metadata128of applications (e.g., instructions222) executing on computing devices200-1to200-4, respectively. Responsive to receiving encrypted metadata127from a one of computing devices200, certificate rotation server100can determine which certificate(s) to send to the computing device based on the metadata. For example, certificate rotation server100can send signed certificates129-1to computing devices200-1,200-2and200-4and signed certificates129-2to computing device200-3, responsive to receiving encrypted metadata127from the computing devices200. Said differently, certificate rotation server100can determine to send a different certificate (e.g., signed certificates129-2) to computing device200-3than to the other computing devices, for example, if computing device200-3were executing a different application from the other computing devices200, it might require a different certificate.

FIG. 7illustrates an embodiment of a storage medium2000. Storage medium2000may comprise any non-transitory computer-readable storage medium or machine-readable storage medium, such as an optical, magnetic or semiconductor storage medium. In various embodiments, storage medium2000may comprise an article of manufacture. In some embodiments, storage medium2000may store computer-executable instructions, such as computer-executable instructions to implement one or more of techniques, logic flows, or operations described herein, such as with respect to300,400, and/or500ofFIGS. 3 to 5. The storage medium2000may further store computer-executable instructions for the certificate rotation application122and/or application222. Examples of a computer-readable storage medium or machine-readable storage medium may include any tangible media capable of storing electronic data, including volatile memory or non-volatile memory, removable or non-removable memory, erasable or non-erasable memory, writeable or re-writeable memory, and so forth. Examples of computer-executable instructions may include any suitable type of code, such as source code, compiled code, interpreted code, executable code, static code, dynamic code, object-oriented code, visual code, and the like. The embodiments are not limited in this context.

FIG. 8illustrates an embodiment of an exemplary computing architecture3000that may be suitable for implementing various embodiments as previously described. In various embodiments, the computing architecture3000may comprise or be implemented as part of an electronic device. In some embodiments, the computing architecture3000may be representative, for example, of a computing device that implements one or more components of server100. The embodiments are not limited in this context.

As shown in this figure, the computing architecture3000comprises a processing unit3004, a system memory3006and a system bus3008. The processing unit3004can be any of various commercially available processors, including without limitation an AMD® Athlon®, Duron® and Opteron® processors; ARM® application, embedded and secure processors; IBM® and Motorola® DragonBall® and PowerPC® processors; IBM and Sony® Cell processors; Intel® Celeron®, Core (2) Duo®, Itanium®, Pentium®, Xeon®, and XScale® processors; and similar processors. Dual microprocessors, multi-core processors, and other multi-processor architectures may also be employed as the processing unit3004.

The computer3002may include various types of computer-readable storage media in the form of one or more lower speed memory units, including an internal (or external) hard disk drive (HDD)3014, a magnetic floppy disk drive (FDD)3016to read from or write to a removable magnetic disk3018, and an optical disk drive3020to read from or write to a removable optical disk3022(e.g., a CD-ROM or DVD). The HDD3014, FDD3016and optical disk drive3020can be connected to the system bus3008by a HDD interface3024, an FDD interface3026and an optical drive interface3028, respectively. The HDD interface3024for external drive implementations can include at least one or both of Universal Serial Bus (USB) and IEEE interface technologies.

The drives and associated computer-readable media provide volatile and/or nonvolatile storage of data, data structures, computer-executable instructions, and so forth. For example, a number of program modules can be stored in the drives and memory units3010,3012, including an operating system3030, one or more application programs3032, other program modules3034, and program data3036. In one embodiment, the one or more application programs3032, other program modules3034, and program data3036can include, for example, the various applications and/or components of the wire-free charging system100.

A user can enter commands and information into the computer3002through one or more wire/wireless input devices, for example, a keyboard3038and a pointing device, such as a mouse3040. Other input devices may include microphones, infra-red (IR) remote controls, radio-frequency (RF) remote controls, game pads, stylus pens, card readers, dongles, finger print readers, gloves, graphics tablets, joysticks, keyboards, retina readers, touch screens (e.g., capacitive, resistive, etc.), trackballs, trackpads, sensors, styluses, and the like. These and other input devices are often connected to the processing unit3004through an input device interface3042that is coupled to the system bus3008but can be connected by other interfaces such as a parallel port, IEEE 994 serial port, a game port, a USB port, an IR interface, and so forth.

A monitor3044or other type of display device is also connected to the system bus3008via an interface, such as a video adaptor3046. The monitor3044may be internal or external to the computer3002. In addition to the monitor3044, a computer typically includes other peripheral output devices, such as speakers, printers, and so forth.

The computer3002may operate in a networked environment using logical connections via wire and/or wireless communications to one or more remote computers, such as a remote computer3048. The remote computer3048can be a workstation, a server computer, a router, a personal computer, portable computer, microprocessor-based entertainment appliance, a peer device or other common network node, and typically includes many or all of the elements described relative to the computer3002, although, for purposes of brevity, only a memory/storage device3050is illustrated. The logical connections depicted include wire/wireless connectivity to a local area network (LAN)3052and/or larger networks, for example, a wide area network (WAN)3054. Such LAN and WAN networking environments are commonplace in offices and companies, and facilitate enterprise-wide computer networks, such as intranets, all of which may connect to a global communications network, for example, the Internet.

When used in a LAN networking environment, the computer3002is connected to the LAN3052through a wire and/or wireless communication network interface or adaptor3056. The adaptor3056can facilitate wire and/or wireless communications to the LAN3052, which may also include a wireless access point disposed thereon for communicating with the wireless functionality of the adaptor3056.

When used in a WAN networking environment, the computer3002can include a modem3058, or is connected to a communications server on the WAN3054, or has other means for establishing communications over the WAN3054, such as by way of the Internet. The modem3058, which can be internal or external and a wire and/or wireless device, connects to the system bus3008via the input device interface3042. In a networked environment, program modules depicted relative to the computer3002, or portions thereof, can be stored in the remote memory/storage device3050. It will be appreciated that the network connections shown are exemplary and other means of establishing a communications link between the computers can be used.