Executing unprotected mode services in a protected mode environment

Disclosed herein is a method for executing unprotected mode services in a protected mode computing environment includes initiating a protected mode service that is configured to execute in a protected mode. Further, the method includes verifying an integrity of one or more unprotected mode services configured to execute in an unprotected mode. The one or more unprotected mode services is registered with the protected mode service. The method also includes initiating an unprotected mode service of the one or more unprotected mode services in response to the integrity of the unprotected mode service being verified.

FIELD

This disclosure relates to executing services in a protected mode computing environment, and more particularly to cryptographically securing unprotected mode services for executing in a protected mode computing environment.

BACKGROUND

In general, computing systems can execute in various modes of operation. Some examples of different computing modes include protected mode, unprotected mode, supervisor mode, user mode, kernel mode, etc. In a protected mode environment, the operating system limits the set of functions of the computing system available to processes running on the system. For example, the operating system may not allow protected mode processes to access the networking capabilities of the system. However, it may be desirable to access functions of a computing system running in protected mode that are not usually available to protected mode processes.

SUMMARY

The subject matter of the present application has been developed in response to the present state of the art, and in particular, in response to the problems and needs of executing unprotected mode services in a protected mode environment to securely communicate with systems running in a protected mode environment that have not yet been fully solved by currently available systems. For example, although conventional computing systems may require specific hardware and software components to connect to systems running in protected mode, they do not allow devices using commercial off-the-shelf (“COTS”) hardware and software components to connect to the protected mode system because they are not trusted by the system. In general, the subject matter of the present application has been developed to provide a system that uses COTS hardware and software components to securely communicate with services running in protected mode computing systems that overcomes at least some of the above-discussed shortcomings of the prior art.

According to one embodiment, a method for executing unprotected mode services in a protected mode computing environment includes initiating a protected mode service that is configured to execute in a protected mode. Further, the method includes verifying an integrity of one or more unprotected mode services configured to execute in an unprotected mode. The one or more unprotected mode services is registered with the protected mode service. The method also includes initiating an unprotected mode service of the one or more unprotected mode services in response to the integrity of the unprotected mode service being verified.

In some implementations, the method additionally includes registering the one or more unprotected mode services with the protected mode service. A unique identifier associated with an unprotected mode service of the one or more unprotected mode services can be registered with the protected mode service. The method may also include generating the unique identifier, where the unique identifier includes a digital signature associated with the unprotected mode service. The digital signature can include a cryptographic hash of one or more of an executable representing the unprotected mode service and a predefined digital certificate associated with the unprotected mode service.

According to some implementations of the method, verifying the integrity of the one or more unprotected mode services includes checking if a unique identifier associated with an unprotected mode service matches a previously registered unique identifier associated with the unprotected mode service. The integrity of the unprotected mode service can be verified by the protected mode service. In some implementations, an unprotected mode service not having a unique identifier matching the previously registered unique identifier associated with the unprotected mode service is not initiated.

In certain implementations of the method, the protected mode service initiates the verified unprotected mode services such that the verified unprotected mode services are child processes of the protected mode service. The protected mode service and the one or more unprotected mode services can be initiated at boot time.

According to some implementations, the method further includes initiating a secure boot process at boot time. The secure boot process can include initiating the protected mode service in response to the protected mode service being registered with the secure boot process. The secure boot process may include an early launch anti-malware driver.

In certain implementations of the method, the one or more unprotected mode services includes one or more of a graphical user interface, a backoffice service, a trusted platform module service, and an access control service. The protected mode service and the one or more unprotected mode services can be executed on a mobile device.

According to another embodiment, an apparatus for executing unprotected mode services in a protected mode computing environment includes a processor and memory. The memory stores machine readable code executable by the processor. The machine readable code includes a protected mode module, an integrity module, and an unprotected mode module. The protected mode module initiates a protected mode service that is configured to execute in protected mode. The integrity module verifies the integrity of one or more unprotected mode services that are configured to execute in unprotected mode. The one or more unprotected mode services are registered with the protected mode service. The unprotected mode module initiates an unprotected mode service of the one or more unprotected mode services in response to the integrity of the unprotected mode service being verified.

In some implementations, the machine readable code further includes an enlisting module that registers the one or more unprotected mode services with the protected mode service. A unique identifier associated with an unprotected mode service of the one or more unprotected mode services is registered with the protected mode service. The machine readable code may also include an identifier module that generates the unique identifier. The unique identifier can include a digital signature associated with the unprotected mode service. The digital signature may include a cryptographic hash of one or more of an executable representing the unprotected mode service and a predefined digital certificate associated with the unprotected mode service.

According to certain implementations of the apparatus, the integrity module verifies the integrity of the one or more unprotected mode services by checking if a unique identifier associated with an unprotected mode service matches a previously registered unique identifier associated with the unprotected mode service. The integrity of the unprotected mode service can be verified by the protected mode service. An unprotected mode service not having a unique identifier matching the previously registered unique identifier associated with the unprotected mode service is not initiated in some implementations.

In some implementations of the apparatus, the protected mode service initiates the verified unprotected mode services such that the verified unprotected mode services are child processes of the protected mode service. The protected mode service and the one or more unprotected mode services can be initiated at boot time. In certain implementations, the machine readable code also includes a secure boot module that initiates a secure boot process at boot time. The secure boot process includes initiating the protected mode service in response to the protected mode service being registered with the secure boot process.

According to yet another embodiment, a system for executing unprotected mode services in a protected mode computing environment includes a mobile device that has a processor and a memory that stores machine readable code executable by the processor. The machine readable code includes a secure boot module that initiates a secure boot process at boot time of the mobile device. The secure boot process includes initiating a protected mode service configured to execute in protected mode in response to the protected mode service being registered with the secure boot process. The machine readable code also includes an integrity module that verifies an integrity of one or more unprotected mode services configured to execute in unprotected mode. The one or more unprotected mode services is registered with the protected mode service. Additionally, the machine readable code includes an unprotected mode module that initiates an unprotected mode service of the one or more unprotected mode services in response to the integrity of the unprotected mode service being verified.

DETAILED DESCRIPTION

FIG. 1illustrates one embodiment of a system100for executing unprotected mode services in a protected mode environment. The system100, in certain embodiments, includes information handling devices102, service modules104, digital communication networks106, and servers108, which are described in more detail below.

The information handling devices102, in one embodiment, includes mobile devices, such as smart phones, tablet computers, laptops, optical head mounted displays, smart watches, and/or the like. In another embodiment, the information handling devices102include desktop computers, servers, and/or the like. In some embodiments, the information handling devices102include operating systems, such as various versions of mobile and desktop operating systems provided by Microsoft®, Apple®, Linux, Android, and/or the like. For example, the information handling devices102may include a tablet running a version of Apple® iOS, a smart phone running a version of Windows® Mobile, and a laptop running a distribution of Linux.

In a further embodiment, the information handling devices102are configured to execute various services and/or programs, such as productivity applications, Internet applications, email clients, and/or the like. In one embodiment, the information handling devices102include various execution modes, such as protected mode, unprotected mode, safe mode, kernel mode, user mode, supervisor mode, and/or the like. For example, an information handling device102running in protected mode may only provide certain functionality to programs, e.g., graphical user interface, networking, and/or the like functionality may not be available to programs running in protected mode. Alternatively, an information handling device102running in unprotected mode may provide a full range of functionality to programs running in unprotected mode. Similarly, certain programs may be configured to execute in one or more modes. For example, an email client configured to only run in unprotected mode may not be initiated by an information handling device102running in protected mode.

In another embodiment, the system100includes a service module104. The service module104, in one embodiment, initiates a protected mode service at boot time, verifies the integrity of one or more unprotected mode services registered with the protected mode service, and initiates the verified unprotected mode services. In certain embodiments, the service module104includes a plurality of modules that perform the operations of the service module104. The service module104, with its accompanying modules, is described in more detail with reference toFIGS. 2 and 3.

The system100, in a further embodiment, includes a data network106. The data network106, in certain embodiments, is a digital communication network106that transmits digital communications between the information handling devices102and/or the servers108. The digital communication network106may include a wireless network, such as a wireless telephone network, a local wireless network, such as a Wi-Fi network, a Bluetooth® network, and the like. The digital communication network106may include a wide area network (“WAN”), a storage area network (“SAN”), a local area network (“LAN”), an optical fiber network, the internet, or other digital communication network known in the art. The digital communication network106may include two or more networks. The digital communication network106may include one or more servers, routers, switches, and/or other networking equipment. The digital communication network106may also include computer readable storage media, such as a hard disk drive, an optical drive, non-volatile memory, random access memory (“RAM”), or the like.

In another embodiment, the system100includes servers108. The servers108, in one embodiment, include main frame computers, desktop computers, laptop computers, cloud servers, smart phones, tablet computers, and/or the like. In one embodiment, the information handling devices102are communicatively coupled to the servers108through the data network106. In another embodiment, the information handling devices102access data stored on the servers108through the data network106.

FIG. 2illustrates one embodiment of a module200for executing unprotected mode services in a protected mode environment. In one embodiment, the module200includes an embodiment of a service module104. In certain embodiments, the service module104includes a protected mode module202, an integrity module204, and an unprotected mode module206, which are described in more detail below.

In one embodiment, the protected mode module202initiates a service configured to execute in protected mode. In certain embodiments, the protected mode module202initiates the protected mode service at boot time, start-up, and/or the like, of the information handling device102. In one embodiment, the protected mode module202initiates a plurality of protected mode services. In another embodiment, a protected mode service is provided with a limited set of functionalities available on the system. In some embodiments, the protected mode service adheres to a rigorous and restrictive set of system supplied and trusted APIs and libraries. For example, a protected mode service may not be allowed to access the networking capabilities of the information handling device102, the graphical user interface capabilities of the information handling device102, and/or the like.

In certain embodiments, the protected mode service initiates one or more child processes. In some embodiments, the child processes include protected mode services and/or unprotected mode services. Unprotected mode services may not be constrained to the restrictions of the protected mode service. Thus, unprotected mode services may be allowed, in one example, to access the networking capabilities of the information handling device102, the graphical user interface functionality or the information handling device102, and/or the like.

In some embodiments, a protected mode service initiates one or more child processes in response to the child processes being registered with the protected mode service. In one embodiment, the protected mode module202receives registration information from services that are initiated as child processes by the protected mode service. In some embodiments, the registration information includes a unique identifier associated with a service, such as a hash value, or the like. In this manner, the protected mode service knows which services to initiate as child processes. In some embodiments where the information handling device102is running in protected mode, the protected mode service initiates unprotected mode services that have registered with the protected mode service because the protected mode service knows that the unprotected mode services are trusted. This creates a chain-of-trust from the protected mode service to the unprotected mode services because, even though the unprotected mode services would generally not be allowed to execute in protected mode, the protected mode service knows the unprotected mode services are trusted because they have registered with, and have been verified by, the protected mode service as trusted services.

In another embodiment, the service apparatus includes an integrity module204that verifies the integrity of one or more unprotected mode services that are registered with the protected mode service. In certain embodiments, the integrity module204verifies the integrity of the unprotected mode services by checking if a unique identifier associated with the unprotected mode service matches a previously registered unique identifier associated with the unprotected mode service. Thus, the integrity module204, in some embodiments, verifies that the registered unprotected mode service has not been modified since the last time it registered with the protected mode service. If the unprotected mode service has been modified, the unique identifier associated with the unprotected mode service may be different, which would signal to the protected mode service that the unprotected mode service is different and should not be trusted. If the integrity module204, in one embodiment, determines the unique identifiers do not match, the protected mode service ignores the unprotected mode service and does not initiate it as a child process.

In some embodiments, the integrity module204performs an audit of the system to get the current unique identifiers associated with the unprotected mode services that have registered with the protected mode service. In another embodiment, the integrity module204receives registration information, e.g., a unique identifier, from unprotected mode services requesting initiation by the protected mode service and stores the information with the protected mode service. In some embodiments, unprotected mode services that register with the protected mode service include digital certificates verifying that the unprotected mode services have been granted permission to be initiated in the protected mode environment. The registration process is described below with reference to the index module302.

In certain embodiments, the integrity module204maintains a list of registered services with their unique identifiers. As described below, in some embodiments, the unique identifier comprises a generated hash based on information specific to the unprotected mode service. For example, a hash associated with an unprotected mode service may be generated using a hash function that takes certain parameters, such as the service's name, an identifier for the executable, a digital certificate associated with the service, and/or the like. By using a hash of service-specific information, the integrity module204can easily determine whether the unprotected mode service has been modified because any changes in the information associated with the unprotected mode service would change the generated hash value.

In some embodiments, the integrity module204maintains a hash table comprising key-value pairs, where the hash value is the key and the unprotected mode service, or a value that identifies the unprotected mode service, is the value. In this manner, the integrity module204may quickly lookup a hash value in the hash table to determine if the unprotected mode service has been registered, has been modified, and/or the like. In some embodiments, if no value is returned for a given hash value key, i.e., there is not an unprotected mode service associated with the given hash value, the unprotected mode service associated with the given hash value is ignored or not allowed to be executed.

In another embodiment, the service module104includes an unprotected mode module206that initiates an unprotected mode service of the one or more unprotected mode services in response to the integrity module204verifying the integrity of the unprotected mode service. In some embodiments, the unprotected mode module206initiates the unprotected mode services at boot time, start-up, or the like, of the information handling device102. In one embodiment, the unprotected mode services initiated by the unprotected mode module206include a BackOffice service, a trusted platform module service, an access control service, a graphical user interface service, and/or the like.

As described above, the unprotected mode module206initiates services that are not configured to execute in protected mode. In some embodiments, the unprotected mode services require functionality that is generally not available in protected mode, such as networking capabilities, graphical user interface capabilities, and/or the like. Thus, an information handling device102running in protected mode would usually not initiate an unprotected mode service because the unprotected mode service may attempt to access particular functions or features that could compromise the integrity of the information handling device102.

However, as long as the unprotected mode services register with the protected mode service, the unprotected mode services may be initiated as child processes of the protected mode service without compromising the integrity of the system. The integrity of the system is not compromised because the protected mode service, which is a trusted service, initiates the unprotected mode services as child processes, which indicates the protected mode service trusts the unprotected mode services that have registered with the protected mode service. For example, the BackOffice service, which may be an unprotected mode service because the BackOffice executable may require networking capabilities, may be initiated by the protected mode service and allowed to access the networking capabilities of the system because the trusted protected mode service trusts the unprotected BackOffice service. In this manner, the unprotected mode services may perform various activities that are outside the scope and restrictions of protected mode processes while ensuring the integrity of the system.

FIG. 3depicts another embodiment of a module300for executing unprotected mode services in a protected mode environment. In some embodiments, the module300includes an embodiment of a service module104. The service module104includes a protected mode module202, an integrity module204, and an unprotected mode module206, which are substantially similar to the protected mode module202, the integrity module204, and the unprotected mode module206described above with reference to the module200ofFIG. 2. The service module104of the module300, in one embodiment, also includes an index module302, an identifier module304, and a secure boot module306, which are described in more detail below.

In one embodiment, the index module302registers one or more unprotected mode services with the protected mode service. In some embodiments, the index module302registers with the protected mode service a unique identifier associated with the unprotected mode service. In some embodiments, the index module302inserts the unique identifier into a data structure accessible by the protected mode service, such as a lookup table, a database, and/or the like. In another embodiment, as described above, the integrity module204receives the unique identifier and registers the unique identifier with the protected mode service. The unique identifier, in certain embodiments, identifies the unprotected mode service without identifying another unprotected mode service. The unique identifier, in some embodiments, includes a hash value, a digital signature, a fingerprint, a checksum, and/or the like, which may be based on one or more characteristics of the unprotected mode service, such as the name of the service, an identifier of the executable, a digital certificate associated with the service, and/or the like.

The service module104of the module300, in another embodiment, includes an identifier module304that generates the unique identifier. In some embodiments, the unique identifier generated by the identifier module304includes a digital signature associated with the unprotected mode service. In another embodiment, the digital signature includes a cryptographic hash generated using the executable representing the unprotected mode service, a predefined digital certificate associated with the unprotected mode service, the name of the service, a unique process identifier, and/or any combination of the above.

For example, using a predetermined hash function, the identifier module304may use a combination of the executable representing the unprotected mode service and a digital certificate assigned to the service to generate the hash value associated with the unprotected mode service. In one embodiment, the digital certificate includes a digital certificate published and signed by Boeing®. In this manner, the hash value will uniquely identify the unprotected mode service. The hash value, in some embodiments, is stored in the protected mode service such that it is accessible to the protected mode service—in particular the integrity module204. For example, the hash value or digital signature can be bundled (e.g., compiled) with the executable of the protected mode service. Accordingly, when the protected mode service needs access to the hash value or digital signature, the hash value or digital signature is read from the executable of the protected mode service and stored in memory. As described above, the integrity module204maintains a list of hash values and their associated unprotected mode services in order to verify the integrity of the unprotected mode service that is attempting to be initiated as a child process of the protected mode service.

In some embodiments, if the hash value associated with an unprotected mode service that has been registered with the protected mode service does not match a current hash value associated with the same unprotected mode service, the protected mode service determines the unprotected mode service has been modified because the hash value has changed. Thus, the unprotected mode service is no longer a trusted unprotected mode service and the protected mode service does not initiate the unprotected mode service as a child process.

In a further embodiment, the service module104of the module300includes a secure boot module306that initiates a secure boot process at boot time. In some embodiments, the secure boot process initiates the protected mode service in response to the protected mode service being registered with the secure boot process. In another embodiment, the secure boot process checks the integrity of the protected mode service and allows it to be initiated. In certain embodiments, the secure boot process includes an Early Launch Anti-malware (“ELAM”) driver that protects certain configurations and components during boot time by evaluating drivers/services that attempt to startup. In some embodiments, the secure boot module306launches the ELAM driver as one of the first drivers loaded during boot time such that the ELAM driver can evaluate each driver that is registered to be initiated at boot time.

The ELAM driver, in some embodiments, determines the protected mode service is a trusted service and allows the protected mode service to be initiated. In certain embodiments, the ELAM driver initiates the protected mode service. Subsequently, the protected mode service, in one embodiment, initiates one or more unprotected mode services that have registered with, and have been verified by, the protected mode service. In some embodiments, the ELAM driver does not know about the unprotected mode services initiated as child processes of the protected mode service. In this manner, the unprotected mode services are able to execute in a protected mode environment because they have been cryptographically signed and verified that they are trusted services by the protected mode service. In one embodiment, this creates a “chain of trust” between the secure boot process, e.g., the ELAM driver, the protected mode service, and the unprotected mode services that are initiated as trusted child processes of the protected mode service.

In one example embodiment, an airplane system running in protected mode may only communicate with devices running in protected mode to ensure the devices it is communicating with are trusted devices. In traditional airplane systems, the devices comprise specialized hardware and software that follow a rigorous configuration procedure. The problem with these devices, however, is that they can be expensive to purchase, manage, and maintain. Moreover, the hardware and software may rapidly become obsolete. These devices also may compromise the security of the airplane system because they are allowed to connect to the system based on a simple identity certificate.

The subject matter of the present disclosure, however, allows devices comprised of commercial off-the-shelf (“COTS”) or general purpose computing components to verify the integrity of services that communicate with the protected mode airplane system. Thus, if an application running on a mobile device wishes to communicate with the airplane system to upload/download data, for example, the airplane system needs to verify the mobile device, and the applications running on the mobile device, are trusted and will not compromise the security of the airplane system. By utilizing a secure boot driver, e.g., an ELAM driver, to verify protected mode services are trusted, which in turn verifies the unprotected mode services are also trusted, the mobile device may utilize the expanded functionality of the mobile device while running in protected mode. This allows the mobile device to securely communicate with the protected mode airplane system to perform functions not usually permitted in a protected mode environment using COTS components.

FIG. 4depicts one embodiment of a system400for executing unprotected mode services in a protected mode environment. In one embodiment, the system400includes an ELAM driver402, which is a secure boot process that launches at the beginning of the boot process, i.e., before other boot-start drivers. The system400, in some embodiments, also includes a protected mode service404, unprotected mode services406a-d, and a hash table408comprising key-value pairs.

In the depicted embodiment, the ELAM driver402is launched first by the kernel, before any other drivers, including third-party software drivers in order to prevent unauthorized programs that may compromise the integrity of the system from executing. The ELAM driver402, in certain embodiments, verifies the protected mode service404is an authorized service and, if so, initiates the protected mode service404. In some embodiments, the protected mode module202initiates the protected mode service404.

Upon being launched, in one embodiment, the protected mode service404checks if there are unprotected mode services406a-dregistered with the protected mode service to be initiated. In one embodiment, the protected mode service404, in particular the integrity module204, receives a digital signature (e.g., a hash value) from the unprotected mode services406a-dand looks in a table408for the unprotected mode service associated with the received digital signature. If the integrity module204determines a value is returned for the given digital signature, then the unprotected mode service is determined to be a trusted service and will be initialized as a child process of the protected mode service.

If no value is returned for the given digital signature, such as when the provided digital signature does not match any digital signatures in the table408, the unprotected mode service associated with the digital signature is ignored. For example, if a hash value410bassociated with the GUI Application406ddoes not match a previously registered hash value410ain the table408, the integrity module204determines the integrity of the GUI Application has not be verified. Thus, because the GUI Application has been modified (as evidenced by the difference in the provided hash value410band the hash value410ain the table), it is no longer a trusted unprotected mode service and the unprotected mode module206will not initiate the process as a child process of the protected mode service404.

FIG. 5depicts one embodiment of a method500for executing unprotected mode services in a protected mode environment. In one embodiment, the method500begins and a protected mode module202initiates502a protected mode service. In another embodiment, an integrity module204verifies504the integrity of one or more unprotected mode services that have registered with the protected mode service. In a further embodiment, an unprotected mode module206initiates506an unprotected mode service of the one or more unprotected mode services in response to the integrity module204verifying the integrity of the unprotected mode service, and the method500ends.

FIG. 6depicts one embodiment of another method600for executing unprotected mode services in a protected mode environment. In one embodiment, the method600begins and a secure boot module306initiates602a secure boot process. In some embodiments, the secure boot process includes an ELAM driver that is launched at boot time before other boot-start drivers and programs. In a further embodiment, a protected mode module202initiates604a protected mode service. In some embodiments, the protected mode module202initiates604the protected mode service in response to the secure boot module306determining the protected mode service is registered to be initiated. In another embodiment, the ELAM driver initiates604the protected mode service. In some embodiments, the ELAM driver allows the protected mode service to be initiated.

In another embodiment, an integrity module204determines606if there are any unprotected mode services registered to be initiated. If the integrity module204determines606that there are unprotected mode services registered, the integrity module204receives608a digital signature/hash value from a registered unprotected mode service and verifies610the integrity of the unprotected mode service. In order to verify610the integrity, in one embodiment, the integrity module204determines612if the received digital signature/hash value matches the previously registered digital signature/hash value. If the integrity module204determines612the received digital signature/hash value does match the previously registered digital signature/hash value associated with the unprotected mode service, an unprotected mode module206initiates614the unprotected mode service as a child process of the protected mode service. In such an embodiment, this creates a “chain of trust” between the secure boot process, the protected mode service, and the unprotected mode service.

If the integrity module204determines612the received digital signature/hash value does not match the previously registered digital signature/hash value associated with the unprotected mode service, the unprotected mode service associated with the received digital signature/hash value is not initiated. If the integrity module204determines606that there are no more registered unprotected mode services, the method600ends.

FIG. 7depicts one embodiment of a method700for executing unprotected mode services in a protected mode environment. In one embodiment, the method700begins and the identifier module304receives702an executable identifier associated with an unprotected mode service. In another embodiment, the identifier module304also receives704a digital certificate associated with the unprotected mode service. In one embodiment, the digital certificate includes a digital certificate published and signed by Boeing®. The identifier module304, in certain embodiments, using the received executable identifier and the received digital certificate, generates706a unique digital signature/hash value for the associated unprotected mode service. In one embodiment, the identifier module304uses a predetermined hash function to generate the digital signature/hash value using the executable identifier and the digital certificate.

In a further embodiment, an index module302registers708the digital signature/hash value generated706by the identifier module304with a protected mode service such that the unprotected mode service associated with the digital signature/hash value will be initiated by the protected mode service. In certain embodiments, the integrity module204receives the digital signature/hash value from the index module302in response to a performed audit of the system. Thus, during the audit, the integrity module204may determine the unprotected mode service requests to be initiated by the protected mode service and receives the generated digital signature/hash value from the index module302, and the method700ends.

The computer readable medium may also be a computer readable signal medium. A computer readable signal medium may include a propagated data signal with program code embodied therein, for example, in baseband or as part of a carrier wave. Such a propagated signal may take any of a variety of forms, including, but not limited to, electrical, electro-magnetic, magnetic, optical, or any suitable combination thereof. A computer readable signal medium may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport program code for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a computer readable signal medium may be transmitted using any appropriate medium, including but not limited to wire-line, optical fiber, Radio Frequency (RF), or the like, or any suitable combination of the foregoing

The computer program product may be shared, simultaneously serving multiple customers in a flexible, automated fashion. The computer program product may be standardized, requiring little customization and scalable, providing capacity on demand in a pay-as-you-go model.

The computer program product may be stored on a shared file system accessible from one or more servers. The computer program product may be executed via transactions that contain data and server processing requests that use Central Processor Unit (CPU) units on the accessed server. CPU units may be units of time such as minutes, seconds, hours on the central processor of the server. Additionally the accessed server may make requests of other servers that require CPU units. CPU units are an example that represents but one measurement of use. Other measurements of use include but are not limited to network bandwidth, memory usage, storage usage, packet transfers, complete transactions etc.

The terms “including,” “comprising,” “having,” and variations thereof mean “including but not limited to” unless expressly specified otherwise. An enumerated listing of items does not imply that any or all of the items are mutually exclusive and/or mutually inclusive, unless expressly specified otherwise. The terms “a,” “an,” and “the” also refer to “one or more” unless expressly specified otherwise.