USER CERTIFICATE WITH USER AUTHORIZATIONS

In embodiments, a user device stores a certificate that both identifies the user and indicates what the user is authorized to access. When access is desired, the certificate is provided. Instead of a user login and password, the signed certificate functions to identify the user (and also the user device). Instead of separately accessing an administrator table to verify whether the user is authorized to access the website or program or other resource, the certificate on the user device is consulted.

BACKGROUND OF THE INVENTION

The present invention relates to user certificates and access authorizations.

Currently, access control to a computer system or website is a two-step process. First, a user login and password is required at a server or other computer. Two factor authentication may also be used. Second, for access to particular resources, the user must be listed in an access database typically controlled by an administrator. The increase in working remotely has vastly increased the use of such remote log-ins and the concurrent security risks.

Websites and user devices communicate using certificates that identify and authenticate the website or device. A device typically has its certificate entered at the factory. Websites can be authenticated by third party certificate authorities. For example, one common type of certificate is an X.509 certificate, which has a digital signatory. The signatory itself must also have a certificate, which has a second signatory, or be self-signed. And that second signatory possesses a certificate with a third signatory, and so forth, leading to a chain of certificates. Starting with a root signatory, each certificate signs the next until reaching the server's (end entity) certificate, which is the last (“leaf”) certificate (the certificate used to access a website server). A leaf certificate cannot be used to sign other certificates. According to the TLS protocol, this chain starts with a self-signed certificate, which is from a single, universally-trusted root. This trusted root certificate has been included in a select group of root Certificate Authority (CA) certificates. Any CA in this select group can sign other certificates. The select group can vary in size, but membership is determined by a consortium of browser vendors, Operating Systems vendors, and Certificate Authorities called the CAB Forum.

BRIEF SUMMARY OF THE INVENTION

In embodiments, a user device stores a certificate that both identifies the user and indicates what the user is authorized to access. When access is desired, the certificate is provided. Instead of a user login and password, the signed certificate functions to identify the user (and also the user device). Instead of separately accessing an administrator table to verify whether the user is authorized to perform an action in or access a controlled digital asset (e.g., a program, website or database), the certificate on the user device is consulted.

In embodiments, the credential with the authorizations is written to Hardware Security Module (HSM) on the user device and locked, so it cannot be exported and thus cannot be tampered with. This means that it cannot be changed, so when an authorization changes, a new certificate is simply generated and added to the HSM. The new certificate in one embodiment overwrites the old one. In another embodiment, a revocation list can also be used to invalidate certificates in use cases where the update process is not trusted In one embodiment, multiple authorizations are written to the same certificate. In another embodiment, a separate certificate is used for each authorization. Alternately, a mix of single and multiple authorizations could be used.

In embodiments, multiple types of certificates are supported. A normalization engine converts all authorizations into a standard set of fields. Those fields are then mapped to different types of certificates, depending up which type of certificate is supported to a particular website or application or other resource the user is trying to access. For example, certificates including X.509, SSH, OpenPGP, SPKI, and other certificate formats that support “authorizations” or “extensions”/“options,” are supported.

DETAILED DESCRIPTION OF THE INVENTION

In embodiments, a certificate is created for a user that both (1) uniquely identifies the user without the need for a logon or password, and (2) indicates what systems the user is authorized to access. The actions that the user on the device is authorized take on an asset, and the obligations or conditions that must be met by the user and device, enforced by a platform authenticator (PA) and the accessing service, for those authorizations to remain valid. The certificate can be signed by (a) the computer system being accessed, (b) a 3rdparty certificate authority, or (c) can be a self-signed certificate by the user device. The user device stores the certificate, and stores the associated private key in the HSM, where it cannot be retrieved. When access is desired, the certificate is provided along with proof of ownership of the key via a challenge by the service and a signed assertion response from the HSM. Authorizations can include privileges, roles (one role can define a set of privileges), profiles and resource limitations (e.g., amount of memory usable).

In embodiments, the obligations are proof obligations that require the return of proof attestations showing that the user device and user are indeed the ones that have been given the relevant authorizations.

Examples of Proof Obligations are the following:The user can demonstrate control of a cryptographic credential.The user can demonstrate control of a cryptographic credential protected by a ping and/or biometric.The cryptographic credential is protected by TPM2 hardware, and SGX enclave, etc.The cryptographic credential is an AA1|2|3 credential.the registry/plist key X has value Y, the registry/plist key X exists/does not exist.The process/file name X, or filehash X, exists or does not exist.The enumerated disks available and their encryption status.The network security state, presence/absence of certain rules/hooks.The operating system, bootloader, bios, application are official builds (unmodified).The OS (Operating System) and applications have no known unpatched or configuration vulnerabilities.The system meets a high level of trust as defined by compliance regime X.

A modern worker seamlessly works across device types whether they are desktops, servers, mobile devices, corporate assets or BYOD (Bring Your Own Device). The only guarantee is they will use a device. A modern worker could be nomadic, working from home, the office or on the road. They are often Internet connected. Workers get work done by using applications whether they are local applications, cloud hosted applications, SaaS applications or premise hosted applications. The application access can be gated by an Identity Provider.

FIG.1is a diagram illustrating a typical prior art user work environment. A user or worker device102attempts to access SaaS (Software as a Service) or Cloud Applications104. The access is referred to an identity provider106to verify that the user has access rights. The access rights can be simply checking the user name and password, or also determining whether the user has been granted access rights by an administrator.

The following security functions are typically provided. Identity—knowing assets and relationships. Protect—ensuring assets are protected (up to date patches, best common practice configurations, etc.). Ensuring relationships are authorized (principle of least privilege, etc.). Detect—knowing when a security incident first begins, or knowing when an incident that could lead to a security incident begins. Respond—being able to take corrective action when incidents are detected. Repair—resolving any damage caused by the incident as well as fix any root cause problems that lead to the incident.

FIG.2Ais a diagram illustrating a remote user work environment with an added platform authenticator according to an embodiment. In this embodiment, the Identity Provider106sits in the middle of every worker transaction whether they are accessing a program or retrieving data. The Identity provider doesn't mind the variability in device, network, location or service accessed. A Platform Authenticator110is added to check the access authorization in the user device certificate. The Platform Authenticator110enables the following security features:1. Identity Verification. Verify the Identity and authenticate the user driving the transaction.2. Security Posture. Report on the current security posture of the device being used by the worker to access the application and/or retrieve data.3. Authorization. Determine if the level of trust in identity and authentication along with the security posture of the device is sufficient to carry out the requested application access or data retrieval.4. Log. Record a tamper proof log of the entire event that represents this transaction for future forensics, audit and data science applications.5. Passwordless. Disaggregate risk and eliminate the movement and storage of shared secrets. Eliminate the primary vector of most security incidents.6. Hardware Protection. Leverage modern hardware's ability to protect asymmetric crypto keys. Ensure keys are pinned to devices.7. Credential Integrity. Cryptographically guarantee key relationships with identities, devices and their authorizations. Eliminate the potential of Insider data manipulation.8. Flexible Policy. Tailor identity and device authentication mitigations to the specific risk of your environment.9. Diagnostics & Incident Prevention. Provide analytics insights that help administrators quickly diagnose problems and suggest new policies that would result in incident prevention.

In embodiments, the following operations are supported:1. Simple Identity Integration. Integrate with existing applications using standard authentication delegation protocols: SAML, OAUTH, OIDC, WS-FED, etc.2. Automated Directory Integration. Integrate with common directory solutions using standard automation interfaces: SCIM, API(s), etc.3. Data Export Integration. Integrate with standard data warehousing, log stores and SIEM: AWS S3, Snowflake, Kafka, Splunk, etc.

In embodiments, the following benefits are provided:1. Low Friction. No user interaction necessary, unless desired by security administrators. No usage of legacy passwords or shared secrets.2. Low Risk. No usage of shared secrets that can be exploited against the user (ATO, credential stuffing, etc.).3. Seamless Operation. Work seamlessly across all platforms a modern worker uses: Windows, MacOS, iOS, Android, ChromeOS and Linux. Additionally work across all workloads: physical machines, local virtual machines and cloud virtual machines.

FIG.2Bis a diagram illustrating the remote user work environment ofFIG.2with a Single Sign-On (SSO) provider according to an embodiment. SaaS/Cloud Applications104are applications used by a workforce and protected by an SSO/IdP (Identity Provider)114. The SSO/IdP114is a single sign on provider serving delegated authentication and authorization for 3rdparty applications. A Beyond Identity IdP112is a cloud native delegate identity provider SSO(s) that can federate/delegate authentication. A Beyond Identity Platform Authenticator110is an authenticator program downloaded to be local to a workers device, that provides security posture, identity verification and authentication services.

The process followed by the embodiment ofFIG.2Bis as follows, with the numbers of the steps corresponding to the lines onFIG.2B.1. End user accesses and application and is redirected for authentication to the SSO.2. SSO determines the end user is served by Beyond Identity and delegates authentication.3. Beyond Identity determines security risk of the device, trust level of identity claimed, criticality of application accessed and renders an authorization.4. SSO obtains the identity and authorization from Beyond Identity.5. Application obtains identity from the SSO.

FIG.3is a flowchart illustrating the assignment of authorizations to a user certificate according to an embodiment. The first step is to download a device authenticator program to a user device (step302). There is a certificate signing process where the ID, authorizations and obligations certificate is signed by the signing authority (the CA or a relying application). The certificate that will be signed by a CA (Certificate Authority) or a trusted service, is generated by the PA (Platform Authenticator) and submitted along with proof of ownership of the private key. This certificate is augmented with the ID, authorizations and obligations in the certificate extension fields and is signed by the CA. The ID, authorizations and obligations are requested by the Platform Authority in the CSR (Certificate Signing Request) in one embodiment. The signing authority verifies and possibly modifies those prior to issuing a signed certificate. The result is the downloaded certificate which is stored in the device HSM (304). The user can thereafter log into the local authenticator program (306), and then log into the desired website or program or database (308). The user credential is provided to the website or program or database by the authenticator program on the user device (310). The credential is examined for an authorization for the website or program or database (312). Access is provided if the certificate contains the required authorization (314).

FIG.4is a diagram illustrating the components of platform authenticator110according to an embodiment. The platform authenticator provides a simple and intuitive user interaction. It manages the lifecycle of user identities and provides application access. It provides a range of identity and authentication trust levels. It manages all credentials using hardware to guarantee protection of cryptographic material. It provides security posture reporting. In particular, it proves the security posture of the device is adequate for the criticality of the application being accessed or data being retrieved. It also provides seamless operation since it runs on the diverse hardware and operating system options used by modern workers.

Platform Authenticator110has a group of trusted execution environment (TTE) adapters402. The trust model is based on anchoring asymmetric crypto keys in hardware enclaves or TEE(s)402. Additionally, the TEEI can help in making trusted assertions. In devices where no hardware TEE is available, TPM2 semantics can be emulated, but without hardware trust. This is useful for development, testing and certain low trust production scenarios.

The specifics of the various TEE semantics are abstracted through a Hardware Abstraction Layer (HAL)404. This provides a stable library for development. Extending capabilities to new TEE models involves writing an adapter for the specific TEE. Examples of adaptors supported are: TPM, vTPM and Apple T2.

A thin library of keys in a crypto key library406uses the TEE HAL404to provide simple full life cycle management for cryptographic key material. This includes the typical operations: create, delete, sign, verify, encrypt and decrypt.

A certificate library408is a thin library which uses the TEE HAL404and the Keys library406to provide simple life cycle management for different types of credentials and their operations. The types of credentials include: x.509, ssh-certificate, JWT and PGP. The operations include: create, delete, endorse and verify.

Operating System (OS) security posture adaptors410provide security posture attestations over a wide distribution of system types.

OS Security Posture Abstraction Layer412provides a common interface for querying specific operating system properties.

Trust assertions library414leverages the underlying systems to make trusted assertions about both security posture and key usage authorizations.

An Authentication Protocol Client library416implements the specifics of the authentication and authorization protocol exchanges with the cloud.

The Authenticator SDK418is a library that uses both the Authentication Protocol Client Library416and the Trust SDK414to provide for common workflows a user may wish to authenticate.

The authenticator application420is a standalone program that is used to authenticate and gain authorization to access services and retrieve data. It may be run as a command line program or as an interactive program with a UI from a desktop environment.

Authenticators on Virtual Machines

In one embodiment, an authenticator is implemented on a virtual machine. For a local virtual machine, this involves local development but remote administration. The development and integration testing is done with authenticator libraries. Examples of VM Vendors are VMWare, VirtualBox, Parallels, Xen, Hyper-V and QEMU.

In one embodiment, an authenticator is implemented on a remote/cloud virtual machines. This involves remote development, remote administration and a remote desktop (VDI). This also involves development and integration testing with authenticator libraries. Examples of VM Vendors are Amazon AWS EC2, Microsoft Azure Virtual Machines, Google Cloud Compute Engines, IBM Cloud Virtual Servers and Oracle Cloud Virtual Machines.

Certificate

FIG.5is a diagram illustrating the fields of a standard X.509 certificate according to an embodiment. Standard certificate fields are used in one embodiment, but are populated differently. Certificate510contains a version field512, a certificate serial number514, and a Certificate algorithm identifier field516(describing how the certificate contents were hashed, and the algorithm used to sign the hash). An issuer field518is for a copy of the subject field of the certificate that signed.

Field520is a validity period, which would set forth the expiration date of the certificate. A subject field522is used to describe a company or organization, with its location, phone number, address, email, etc. Field524contains the public key information, with an algorithm identifier and a public-key value. This will be a different public key for each certificate. Optional and extension fields526can include a variety of data, including identifying whether the certificate is an intermediate certificate or a leaf certificate. Field528includes the Certification Authority's Digital Signature. Extensions530contains a series of optional extension fields532. Embodiments of the invention use these fields to store the various authorizations.

FIG.6is a diagram of the certificate extension fields storing authorizations and other organization data. A user name is provided in extension field602. The organization name can be provided in extension field604. If subject field522is used for this, extension field can be used for a sub-group of the organization to which the user belongs, or other information used to tag and identify the type of user (e.g., IT, human resources, etc.) which would affect the type of authorizations granted. Extension fields606,608and610can provide additional authorizations. Although three are shown, many more can be used. In embodiments, for certificate implementations that have practical limits on the number of fields, multiple certificates can be provided for the roles that a user is taking on and the correct certificate (or the entire set) is provided.

Because a user name is provided in extension field602, the certificate provides identity protection in addition to authorizations. The challenge/response attestation proves that the user holds the private key associated with the certificate and thus attests to the claimed identity. While a device key presumably is associated with a user, a certificate according to the present invention can tie a user identity to a device ID in the certificate, and thus in the certificate key. Additionally, the relationship between the identity and the authorizations is protected by the certificate.

In one embodiment, a certificate is created by either the entity administrator or the authenticator identity provider. The administrator can provide a list of authorizations to the identity provider, along with the user name and other identifying information. This process is rooted in the policy engine in one embodiment:P({device profile}, {identity}, [requested authorizations])->{allow, [granted authorizations], [obligations]}|{deny, reason}

The decision flow is provided by an ID. This can be triggered via an authentication flow or via an administrative action that launches the CSR (Certificate Signing Request) process with the PA (Platform Authenticator).

In one embodiment, a single certificate could have authorizations for multiple assets. Alternately, each authorization can have its own certificate. In another embodiment, a single certificate is used for a single digital asset, which may have multiple authorizations (access, write authorization, download authorization, copy authorization, etc.). Also, single use certificates can be issued, or the certificate could have a fixed termination date, or no real termination date (by writing a very distant date in the validity period field520ofFIG.5).

In one embodiment, certificate holder could be authorized to create additional certificates. The authorization could be limited in many ways, such as to a subset of the authorizations the certificate holder has, or to issuing only single use sub-certificates. In one embodiment, the holder would sign another certificate (new key) adding to the chain.

The normalization and the unification of credential types is done as follows in one embodiment. The authorizations are mapped into the specific certificate formats via extensions and/or options. The specific authorizations and obligations formats contained within these fields are mapped into and out of the extensions via translation layers (shim libraries) that abstract the details of the certificate format (carrier) from the content.

Change of Authorization.

Since, once written, the certificate cannot be changed without causing a tampering flag, authorizations are not revised in the certificate. If a user no longer has authorization to access an asset, the certificate is canceled and a new certificate is issued. In a trusted PA situation, the certificate is essentially overwritten. In an untrusted PA situation or when an overwrite is not feasible a revocation list can be employed. A single certificate could have authorizations for multiple assets, and thus all the unchanged authorizations need to be rewritten as well.

Types of Controls.

In addition to access controls, authorizations may be used for certain actions. For example, no access control may be needed for a database, but the ability to write, copy, download, change, etc. may require authorization.

Computer Systems for Media Platform and Client System

Various operations described herein may be implemented on computer systems.FIG.7shows a simplified block diagram of a representative computing system702and client computing system704usable to implement certain embodiments of the present invention. In various embodiments, computing system702or similar systems may implement the server or website computing system or other verifying party, or any other computing system described herein or portions thereof. Client computing system704or similar systems may implement user devices such as a smartphone, tablet, computer, smart watch, or other devices.

Computing system702may include processing subsystem710. Processing subsystem710may communicate with a number of peripheral systems via bus subsystem770. These peripheral systems may include I/O subsystem730, storage subsystem768, and communications subsystem740.

Bus subsystem770provides a mechanism for letting the various components and subsystems of server computing system704communicate with each other as intended. Although bus subsystem770is shown schematically as a single bus, alternative embodiments of the bus subsystem may utilize multiple buses. Bus subsystem770may form a local area network that supports communication in processing subsystem710and other components of server computing system702. Bus subsystem770may be implemented using various technologies including server racks, hubs, routers, etc. Bus subsystem770may be any of several types of bus structures including a memory bus or memory controller, a peripheral bus, and a local bus using any of a variety of bus architectures. For example, such architectures may include an Industry Standard Architecture (ISA) bus, Micro Channel Architecture (MCA) bus, Enhanced ISA (EISA) bus, Video Electronics Standards Association (VESA) local bus, and Peripheral Component Interconnect (PCI) bus, which may be implemented as a Mezzanine bus manufactured to the IEEE P1386.1 standard, and the like.

Processing subsystem710controls the operation of computing system702and may comprise one or more processing units712,714, etc. A processing unit may include one or more processors, including single core processor or multicore processors, one or more cores of processors, or combinations thereof. In some embodiments, processing subsystem710may include one or more special purpose co-processors such as graphics processors, digital signal processors (DSPs), or the like. In some embodiments, some or all of the processing units of processing subsystem710may be implemented using customized circuits, such as application specific integrated circuits (ASICs), or field programmable gate arrays (FPGAs). In some embodiments, such integrated circuits execute instructions that are stored on the circuit itself. In other embodiments, processing unit(s) may execute instructions stored in local storage, e.g., local storage722,724. Any type of processors in any combination may be included in processing unit(s)712,714.

In some embodiments, processing subsystem710may be implemented in a modular design that incorporates any number of modules (e.g., blades in a blade server implementation). Each module may include processing unit(s) and local storage. For example, processing subsystem710may include processing unit712and corresponding local storage722, and processing unit714and corresponding local storage724.

Local storage722,724may include volatile storage media (e.g., conventional DRAM, SRAM, SDRAM, or the like) and/or nonvolatile storage media (e.g., magnetic or optical disk, flash memory, or the like). Storage media incorporated in local storage722,724may be fixed, removable or upgradeable as desired. Local storage722,724may be physically or logically divided into various subunits such as a system memory, a ROM, and a permanent storage device. The system memory may be a read and write memory device or a volatile read and write memory, such as dynamic random access memory. The system memory may store some or all of the instructions and data that processing unit(s)712,714need at runtime. The ROM may store static data and instructions that are needed by processing unit(s)712,714. The permanent storage device may be a nonvolatile read and write memory device that may store instructions and data even when a module including one or more processing units712,714and local storage722,724is powered down. The term “storage medium” as used herein includes any medium in which data may be stored indefinitely (subject to overwriting, electrical disturbance, power loss, or the like) and does not include carrier waves and transitory electronic signals propagating wirelessly or over wired connections.

In some embodiments, local storage722,724may store one or more software programs to be executed by processing unit(s)712,714, such as an operating system and/or programs implementing various server functions such as functions of UPP system102, or any other server(s) associated with UPP system102. “Software” refers generally to sequences of instructions that, when executed by processing unit(s)712,714cause computing system702(or portions thereof) to perform various operations, thus defining one or more specific machine implementations that execute and perform the operations of the software programs. The instructions may be stored as firmware residing in read-only memory and/or program code stored in nonvolatile storage media that may be read into volatile working memory for execution by processing unit(s)712,714. In some embodiments the instructions may be stored by storage subsystem768(e.g., computer readable storage media). In various embodiments, the processing units may execute a variety of programs or code instructions and may maintain multiple concurrently executing programs or processes. At any given time, some or all of the program code to be executed may be resident in local storage722,724and/or in storage subsystem including potentially on one or more storage devices. Software may be implemented as a single program or a collection of separate programs or program modules that interact as desired. From local storage722,724(or nonlocal storage described below), processing unit(s)712,714may retrieve program instructions to execute and data to process in order to execute various operations described above.

Storage subsystem768provides a repository or data store for storing information that is used by computing system702. Storage subsystem768provides a tangible non-transitory computer-readable storage medium for storing the basic programming and data constructs that provide the functionality of some embodiments. Software (programs, code modules, instructions) that when executed by processing subsystem710provide the functionality described above may be stored in storage subsystem768. The software may be executed by one or more processing units of processing subsystem710. Storage subsystem768may also provide a repository for storing data used in accordance with the present invention.

Storage subsystem768may include one or more non-transitory memory devices, including volatile and non-volatile memory devices. As shown inFIG.7, storage subsystem768includes a system memory760and a computer-readable storage media752. System memory760may include a number of memories including a volatile main RAM for storage of instructions and data during program execution and a non-volatile ROM or flash memory in which fixed instructions are stored. In some implementations, a basic input/output system (BIOS), containing the basic routines that help to transfer information between elements within computing system702, such as during start-up, may typically be stored in the ROM. The RAM typically contains data and/or program modules that are presently being operated and executed by processing subsystem710. In some implementations, system memory760may include multiple different types of memory, such as static random access memory (SRAM) or dynamic random access memory (DRAM). Storage subsystem768may be based on magnetic, optical, semiconductor, or other data storage media. Direct attached storage, storage area networks, network attached storage, and the like may be used. Any data stores or other collections of data described herein as being produced, consumed, or maintained by a service or server may be stored in storage subsystem768.

By way of example, and not limitation, as depicted inFIG.7, system memory760may store application programs762, which may include client applications, Web browsers, mid-tier applications, relational database management systems (RDBMS), etc., program data764, and one or more operating systems766. By way of example, an example operating systems may include various versions of Microsoft Windows®, Apple Macintosh®, and/or Linux operating systems, a variety of commercially-available UNIX® or UNIX-like operating systems (including without limitation the variety of GNU/Linux operating systems, the Google Chrome® OS, and the like) and/or mobile operating systems such as iOS, Windows® Phone, Android® OS, BlackBerry® 10 OS, and Palm® OS operating systems.

In certain embodiments, storage subsystem768may also include a computer-readable storage media reader750that may further be connected to computer-readable storage media752. Together and, optionally, in combination with system memory760, computer-readable storage media752may comprehensively represent remote, local, fixed, and/or removable storage devices plus storage media for storing computer-readable information.

In certain embodiments, computing system702may provide support for executing one or more virtual machines. Computing system702may execute a program such as a hypervisor for facilitating the configuring and managing of the virtual machines. Each virtual machine may be allocated memory, compute (e.g., processors, cores), I/O, and networking resources. Each virtual machine typically runs its own operating system, which may be the same as or different from the operating systems executed by other virtual machines executed by computing system702. Accordingly, multiple operating systems may potentially be run concurrently by computing system702. Each virtual machine generally runs independently of the other virtual machines.

Communication subsystem740provides an interface to other computer systems and networks. Communication subsystem740serves as an interface for receiving data from and transmitting data to other systems from computing system702. For example, communication subsystem740may enable computing system702to establish a communication channel to one or more client computing devices via the Internet for receiving and sending information from and to the client computing devices.

Communication subsystem740may support both wired and/or wireless communication protocols. For example, in certain embodiments, communication subsystem740may include radio frequency (RF) transceiver components for accessing wireless voice and/or data networks (e.g., using cellular telephone technology, advanced data network technology, such as 3G, 4G or EDGE (enhanced data rates for global evolution), WiFi (IEEE 802.11 family standards, or other mobile communication technologies, or any combination thereof), global positioning system (GPS) receiver components, and/or other components. In some embodiments communication subsystem740may provide wired network connectivity (e.g., Ethernet) in addition to or instead of a wireless interface.

Communication subsystem740may receive and transmit data in various forms. For example, in some embodiments, communication subsystem740may receive input communication in the form of structured and/or unstructured data feeds, event streams, event updates, and the like. For example, communication subsystem740may be configured to receive (or send) data feeds in real-time from users of social media networks and/or other communication services such as Twitter® feeds, Facebook® updates, web feeds such as Rich Site Summary (RSS) feeds, and/or real-time updates from one or more third party information sources.

Communication subsystem740may also be configured to output the structured and/or unstructured data feeds, event streams, event updates, and the like to one or more databases that may be in communication with one or more streaming data source computers coupled to computing system702.

Communication subsystem740may provide a communication interface742, e.g., a WAN interface, which may provide data communication capability between the local area network (bus subsystem770) and a larger network, such as the Internet. Conventional or other communications technologies may be used, including wired (e.g., Ethernet, IEEE 802.3 standards) and/or wireless technologies (e.g., WiFi, IEEE 802.11 standards).

Computing system702may operate in response to requests received via communication interface742. Further, in some embodiments, communication interface742may connect computing systems702to each other, providing scalable systems capable of managing high volumes of activity. Conventional or other techniques for managing server systems and server farms (collections of server systems that cooperate) may be used, including dynamic resource allocation and reallocation.

Computing system702may interact with various user owned or user operated devices via a wide area network such as the Internet. An example of a user operated device is shown inFIG.7as client computing system702. Client computing system704may be implemented, for example, as a consumer device such as a smart phone, other mobile phone, tablet computer, wearable computing device (e.g., smart watch, eyeglasses), desktop computer, laptop computer, and so on.

For example, client computing system704may communicate with computing system702via communication interface742. Client computing system704may include conventional computer components such as processing unit(s)782, storage device784, network interface780, user input device786, and user output device788. Client computing system704also includes a Hardware Security Module (HSM)789. Client computing system704may be a computing device implemented in a variety of form factors, such as a desktop computer, laptop computer, tablet computer, smart phone, other mobile computing device, wearable computing device, or the like.

Processing unit(s)782and storage device784may be similar to processing unit(s)712,714and local storage722,724described above. Suitable devices may be selected based on the demands to be placed on client computing system704; for example, client computing system704may be implemented as a “thin” client with limited processing capability or as a high powered computing device. Client computing system704may be provisioned with program code executable by processing unit(s)782to enable various interactions with computing system702of a message management service such as accessing messages, performing actions on messages, and other interactions described above. Some client computing systems704may also interact with a messaging service independently of the message management service.

Network interface780may provide a connection to a wide area network (e.g., the Internet) to which communication interface740of computing system702is also connected. In various embodiments, network interface780may include a wired interface (e.g., Ethernet) and/or a wireless interface implementing various RF data communication standards such as WiFi, Bluetooth®, or cellular data network standards (e.g., 3G, 4G, LTE, etc.).

User input device786may include any device (or devices) via which a user may provide signals to client computing system704; client computing system704may interpret the signals as indicative of particular user requests or information. In various embodiments, user input device786may include any or all of a keyboard, touch pad, touch screen, mouse or other pointing device, scroll wheel, click wheel, dial, button, switch, keypad, microphone, and so on.

User output device788may include any device via which client computing system704may provide information to a user. For example, user output device788may include a display to display images generated by or delivered to client computing system704. The display may incorporate various image generation technologies, e.g., a liquid crystal display (LCD), light emitting diode (LED) including organic light emitting diodes (OLED), projection system, cathode ray tube (CRT), or the like, together with supporting electronics (e.g., digital to analog or analog to digital converters, signal processors, or the like). Some embodiments may include a device such as a touchscreen that function as both input and output device. In some embodiments, other user output devices788may be provided in addition to or instead of a display. Examples include indicator lights, speakers, tactile “display” devices, printers, and so on.

Some embodiments include electronic components, such as microprocessors, storage and memory that store computer program instructions in a computer readable storage medium. Many of the features described in this specification may be implemented as processes that are specified as a set of program instructions encoded on a computer readable storage medium. When these program instructions are executed by one or more processing units, they cause the processing unit(s) to perform various operation indicated in the program instructions. Examples of program instructions or computer code include machine code, such as is produced by a compiler, and files including higher level code that are executed by a computer, an electronic component, or a microprocessor using an interpreter. Through suitable programming, processing unit(s)712,714and782may provide various functionality for computing system702and client computing system704, including any of the functionality described herein as being performed by a server or client, or other functionality associated with message management services.

It will be appreciated that computing system702and client computing system704are illustrative and that variations and modifications are possible. Computer systems used in connection with embodiments of the present invention may have other capabilities not specifically described here. Further, while computing system702and client computing system704are described with reference to particular blocks, it is to be understood that these blocks are defined for convenience of description and are not intended to imply a particular physical arrangement of component parts. For instance, different blocks may be but need not be located in the same facility, in the same server rack, or on the same motherboard. Further, the blocks need not correspond to physically distinct components. Blocks may be configured to perform various operations, e.g., by programming a processor or providing appropriate control circuitry, and various blocks might or might not be reconfigurable depending on how the initial configuration is obtained. Embodiments of the present invention may be realized in a variety of apparatus including electronic devices implemented using any combination of circuitry and software.

While the invention has been described with respect to specific embodiments, one skilled in the art will recognize that numerous modifications are possible. Embodiments of the invention may be realized using a variety of computer systems and communication technologies including but not limited to specific examples described herein.

Embodiments of the present invention may be realized using any combination of dedicated components and/or programmable processors and/or other programmable devices. The various processes described herein may be implemented on the same processor or different processors in any combination. Where components are described as being configured to perform certain operations, such configuration may be accomplished, e.g., by designing electronic circuits to perform the operation, by programming programmable electronic circuits (such as microprocessors) to perform the operation, or any combination thereof. Further, while the embodiments described above may make reference to specific hardware and software components, those skilled in the art will appreciate that different combinations of hardware and/or software components may also be used and that particular operations described as being implemented in hardware might also be implemented in software or vice versa.

Computer programs incorporating various features of the present invention may be encoded and stored on various computer readable storage media; suitable media include magnetic disk or tape, optical storage media such as compact disk (CD) or DVD (digital versatile disk), flash memory, and other non-transitory media. Computer readable media encoded with the program code may be packaged with a compatible electronic device, or the program code may be provided separately from electronic devices (e.g., via Internet download or as a separately packaged computer readable storage medium).