System and method for incorporating quality-of-service and reputation in an intrusion detection and prevention system

An intrusion prevention system includes a processor, processing engines, buffers that are associated with a different range of reputation scores, and a storage device having a database and an application. The processor executes the application to determine that a firewall has admitted a packet, determine a reputation score for the packet from the database, provide the packet to a buffer that has a reputation score range that includes the reputation score of the packet, provide the packet from the buffer to a processing engine, process the packet by in the processing engine to determine if the packet includes an exploit, and forward the packet to the protected network if the first packet does not include the exploit.

FIELD OF THE DISCLOSURE

The present disclosure generally relates to information handling systems, and more particularly relates to incorporating quality-of-service and reputation in an intrusion detection and prevention system.

BACKGROUND

DETAILED DESCRIPTION OF THE DRAWINGS

In a particular embodiment, secure network100includes an external network102and a protected network104. External network102includes a network cloud110that provides connectivity to protected network104, to a reputation database120and to resources130of the external network. The resources include a website131, an electronic mail (e-mail) system132, an individual messaging or chat service133, a voice-over-Internet protocol (VoIP) service134, and a content and application service135. Resources130can include other websites, services, or systems as needed or desired.

Protected network104includes a protection system106and a functional system108. Protection system106includes a firewall140, an intrusion detection/prevention system (IDPS)150, and protection utilities160. Functional system108includes network attached devices170, a user network180, and network servers190. Firewall140operates to permit or deny network transactions based upon a set of rules, including packet filtering rules, application filtering rules, stateful packet inspection rules, identity based rules, or other rules, as needed or desired. Firewall140also operates to provide network address translation (NAT) to hide the identities of the other elements of protected network104. IDPS150operates to monitor activities within protected network104for malicious activities or policy violations, to report and log information about such activities, and to prevent the malicious activities and policy violations. As such, IDPS150examines transactions on protected network104, identifies heuristics and patterns of known attacks (called malicious signatures), alerts an operator of protected network104of the attacks, and terminates the attacks on the protected network. Thus IDPS150can operate to receive transactions from external network102and that have been screened by firewall140, and make further determinations as to whether to admit the transaction onto protected network104or to drop the transactions. IDPS150further receives transactions from functional system108and determines whether to admit the transaction onto external network102or to drop the transactions. Note that the transactions evaluated by IDPS150can also be internal transactions, such as transactions with destination addresses that are within protected network104. Protection utilities160include anti-virus software162, anti-spyware software164, anti-spam software166, and a transport layer security/secure socket layer (TLS/SSL)168. Protection utilities160can also include other protection systems as needed or desired.

Network attached devices170include a network attached printer172, a network attached camera174, and a network attached uninterruptible power supply176. Network attached devices170can also include other network attached devices, such as one or more additional printers, cameras, or uninterruptible power supplies, or other network attached devices as needed or desired. User network180includes a network system182, and user systems184,186, and188. Network system182can include a local area network, a wide area network, a wireless area network, or another network system. User systems184,186, and188can include information handling systems, such as desktop or laptop computers, thin clients, mobile devices, smart phones, other user systems, or a combination thereof. Network servers190include an electronic commerce (e-commerce) server191, an e-mail server192, a file server193, a web server194, a proxy server195, and a media server196. Network servers190can include other network servers, as needed or desired. In a particular embodiment, network servers190represent different functions that are performed on one or more information handling systems, and can include virtual servers in a managed environment. Moreover, one or more of e-commerce server191, e-mail server192, file server193, web server194, proxy server195, and media server196can be implemented in a de-militarized zone that includes a sub-network that is exposed to external network102, and that is isolated from protected network104.

In operation, protection system106ensures that the operations performed in functional system108are reliable, safe, and free from external and internal threats, and that access to the resources of protected network104is granted only to authorized users and according to established access rules. For example, firewall140can include rules to block user systems184,186, and188from accessing certain Internet protocol (IP) addresses or from using certain transmission control protocol (TCP) and user datagram protocol (UDP) ports, and rules to prevent such IP addresses and ports from accessing the elements of protected network104. Such rules can be established based upon the existence of known threats that emanate from such IP addresses or that use such ports. IDPS150can include signatures of known exploits, and can monitor transactions that are permitted onto protected network104by firewall140. For example, a file received from an IP address that is deemed to be safe by firewall140may nevertheless include a known exploit, such as a virus or Trojan. When IDPS150detects transactions that match a signature associated with a known exploit, then the IDPS blocks the transaction from reaching its destination, such as by dropping the network packets associated with the transaction. In a particular embodiment, IDPS150provides hardware functionality, such as the ability to monitor transactions, in combination with software functionality such as signature based anti-virus, anti-malware, anti-spam, and TLS/SSL functionality. As such, anti-virus software162, anti-spyware software164, anti-spam software166, and TLS/SSL168can represent capabilities that are included in IDPS150. In another embodiment, anti-virus software162, anti-spyware software164, anti-spam software166, and TLS/SSL168provide functionality complimentary to IDPS150.

The elements of protected network104include hardware, such as one or more information handling systems, dedicated peripheral devices, or other hardware, as needed or desired, and also include software, such as stand-alone software products, firmware or middleware products associated with particular hardware devices, basic functional software of an information handling system, such as a platform basic input/output system (BIOS) or an extensible firmware interface (EFI), or other software, as needed or desired. The landscape of hardware and software in protected network104is constantly changing, as hardware devices are added or replaced, firmware and middleware for the hardware devices is added or updated, software products are added or updated, or other hardware and software of the protected network are added, removed, or updated. As a result of the changing landscape of protected network104, the functions of protection system106need to be updated and modified to ensure that all aspects of the changing landscape continue to be protected. In addition to the changing landscape of protected network104, the threat environment is constantly changing as weaknesses are discovered in the protection offered by protection system106, and as security holes are found in the hardware and software of protected network104and are exploited. For example, new viruses, Trojans, malware, spyware, and other exploits are constantly being developed to take advantage of any weakness or security hole. In addition, hacking activity can also be targeted at weaknesses and security holes.

As new IP addresses are identified with known exploits, the operator can update the rules in firewall140to block access to these IP addresses, new signatures can be provided to IDPS150to detect and prevent newly discovered exploits, and new definition files can be added to anti-virus system162to detect newly discovered viruses and Trojans. Also, hardware and software settings can be updated within functional system108to provide greater security.

In a particular embodiment, IDPS150provides for host intrusion prevention through behavioral based protection, which guards against unknown threats by analyzing behavior before software code executes. Behavioral based protection monitors code when it runs and intervenes if the code is deemed to include an exploit. As such, behavioral based protection deletes code that includes an exploit before the code reaches the elements of functional network108. In another embodiment, IDPS150provides for quality-of-service (QoS) based protection, which utilizes various QoS information in the headers of packets and frames received by protected network104to determine the scope and timing of screening and analysis of the associated network flows. In another embodiment, IDPS150provides reputation based filtering, which targets sources of known exploits for more rigorous screening and analysis, based upon a reputation score received from reputation database120. For example, reputation database120can include lists of universal resource locators (URLs) of known sources of exploits, known suspicious IP addresses or domains, sources of spam, malware, viruses, or other known exploits that have been received from different sources in the past. When packets from a source with a lower reputation score are received, IDPS150may take some action to protect protected network104. Further, IDPS150can block outgoing packets from functional system108from being sent to URLs, IP addresses, domains, sources of spam, malware, viruses, or other known exploits that have a low reputation score.

Reputation database120can represent a facility operated by the manufacturer of IDPS150, by the operator of protected network104, by a third party reputation database vendor, or by another person or entity, as needed or desired. In a particular embodiment, reputation information is sent from IDPS150back to reputation database120, based upon reputation analysis done by the IDPS for information received by protected network104, thereby improving the performance of the reputation database. For example, the types, times, and number of virus interactions that are experienced by protected network104can provide useful information for the prevention of future threats. This type of feedback may be useful for any aspect of threat detection. Feedback of information may also be associated with behaviors of individuals within protected network104, such as behaviors that are with common violations of policy, network access, unauthorized application loading, unauthorized external device use, and the like. In another embodiment, this type of information feedback may enable the evaluation or profiling of client actions within protected network104that are violations of policy that may provide a predictive model for the improvement of enterprise policies. Examples of such enterprise policies include a black list, an allowed list, a white list, or the like that provide lists of external network102locations/applications that may or may not be accessed by client in protected network104.

FIG. 2illustrates an IDPS200that is similar to IDPS150, and includes a classification block210, a buffer block220, a scheduler230, and a processing block240. Classification block210includes a classifier212and a database214. Database214is shown here as a part of IDPS200. However, in a particular embodiment, database214is external to IDPS200, similar to reputation database120. In another embodiment, database214is an extension of reputation database120, including a subset of the reputation information that is found in the reputation database. For example, the subset of reputation information can include information on websites, IP addresses, email servers, and the like, that are frequently encountered and that have a reputation for being the source of frequent exploits. Here, reputation database120can include a more extensive listing that includes less commonly encountered sources of exploits.

Buffer block220includes buffers222,224, and226. Processing block240includes processing engines242,244, and246. In operation, IDPS200receives packets at classification block210. The packets are classified by the classifier, based upon information in the packet and information associated with the reputation of the source of the packets, as determined by database214. If the packet is associated with a source that has a reputation that is below a bottom threshold, the packet is immediately dropped as indicated by arrow216. If the packet is associated with a source that has a reputation that is above the bottom threshold, the packet is provided to one of buffers222,224, or226to be further processed. Buffers222,224, and226operate on a first-in-first-out basis. When a packet is at the head of its respective buffer222,224, or226, scheduler230schedules the packet for processing by a next available processing engine242,244, or246.

Processing engines242,244, and246provide for the analysis of the packets to determine a response to the packets. For example, processing engines242,244, and246can determine that packets include known exploits and that the packets should be dropped. Processing engines242,244, and246can also determine that packets include potential exploits and that a network administrator should be notified of the packets to make a determination as to how to handle them. Processing engines242,244, and246can further determine that packets include no exploits and that the packets can be safely forwarded to their destination.

The information received by classifier212includes packets, frames, network flows, or other information as needed or desired, and is received from external network102after being passed through firewall140, or from other elements of protected network104. In a particular embodiment, classifier212determines a QoS level for the packets received by classification block210. For example, classifier212can inspect a type-of-service (ToS) field of an IPv4 header to determine if the packet is a network control packet that receives a highest priority, a routine packet that receives a lowest or best-effort priority, or is a packet with a priority level in between network control and routine. In another example, classifier212can inspect for a QoS level according to another QoS protocol, such as IP Differentiated services (DiffServ), IP Integrated services (IntServ), Multi-Protocol Label Switching (MPLS), another type of QoS protocol, or a combination thereof, as needed or desired. Here, one or more of buffers222,224, and226are associated with different QoS levels, and packets with the associated QoS level are queued into the associated buffer. For example, buffer222can be associated with network control packets and internetwork control packets that have a ToS level of seven and six, respectively, and buffer226can be associated with routine packets that have a ToS level of zero. Here further, scheduler230can schedule packets in the buffers222,224, and226according to a scheduling algorithm such as weighted fair queuing (WFQ), weighted round robin (WRR), hierarchical fair service curve (HFSC), or another scheduling algorithm, as needed or desired. In this embodiment, processing engines242,244, and246each provide a uniform analysis of the packets, and priority of analysis is based upon the action of scheduler230to schedule the packets from buffers222,224, and226into the processing engines. In this way, packets with a higher QoS level can be given priority by scheduler230, thus ensuring that higher priority packets are preferentially processed through IDPS200.

In another embodiment, classifier212provides source information for the received packets to database214to determine a reputation level for the source of the received packets. As described above, if a packet is associated with a source that has a reputation that is below the bottom threshold, the packet is immediately dropped as indicated at216, and otherwise the packet is provided to one of buffers222,224, or226to be further processed. In addition, the packet may be classified as having a reputation level that is in one or more ranges that are above the bottom threshold. For example, a source of packets can be given a reputation score between zero and ten, and the bottom threshold can be set at a reputation score of three. Here any packets with a reputation score of less than three can be immediately dropped. A second threshold can be set at a reputation score of nine, such that packets with reputation scores between four and eight are deemed to be questionable, and packets with reputation scores of nine or ten are deemed to be trusted. With the reputation level determined by database214, classifier212queues the packets into a particular buffer222,224, or226that is associated with each reputation level. For example, buffer222can be associated with trusted packets with a reputation score of nine or ten, and buffer224can be associated with questionable packets with a reputation score between four and eight. Here, as in the above embodiment, scheduler230can schedule packets in the buffers222,224, and226according to a scheduling algorithm such as WFQ, WRR, HFSC, or another scheduling algorithm, as needed or desired, and processing engines242,244, and246each provide a uniform analysis of the packets, and priority of analysis is based upon the action of scheduler230to schedule the packets from buffers222,224, and226into the processing engines. In this way, packets with a higher reputation score can be given priority by scheduler230, thus ensuring that more highly trusted packets are preferentially processed through IDPS200. It should be understood that the above description of threshold levels is exemplary, and that more threshold levels or fewer threshold levels can be utilized as needed or desired, and that the number of buffers222,224,226, and of processing engines242,244, and246can be increased or decreased as needed or desired.

In another embodiment packets are processed based upon the packets' QoS level and the packets' source reputation. Here classifier212can queue packets into buffers222,224, and226based upon both the QoS level of the packets, and the source reputation of the packets. For example, classifier212can queue control packets and internetwork control packets that have a ToS level of seven and six, respectively, and that are also received from a source that has reputation score of nine or ten into buffer222, and can queue control packets and internetwork control packets that have a ToS level of seven and six, respectively, and that are also received from a source that has reputation score between four and eight into buffer224.

FIG. 3illustrates an IDPS300that is similar to IDPS150and IDPS200, and includes a classification block310, a buffer block320, and a processing block340. Classification block310includes a classifier312and a database314. Database314is similar to database214. Buffer block320includes buffers322,324, and326. Processing block340includes processing engines342, and344, and proxy346. In receiving packets and classifying the packets into buffer block320, IDPS300operates similarly to IDPS200, and buffers322,324, and326operate on a first-in-first-out basis. However, in IDPS300, classifier312can also provide a bypass318to processing for selected packets. For example, classifier312can provide that packets that are received from sources that have a reputation score of ten are directly forwarded to their destination, thereby bypassing further processing by IDPS300, and also freeing up processing resources for the analysis of packets from sources with lower reputation scores. Moreover, in IDPS300, when a packet is at the head of its respective buffer322,324, or326, the packet is provided to an associated processing engine342or344, or proxy346. As such, processing engines342and344each provide different levels of analysis of the packets provided thereto. For example, classifier312can provide that packets that are received from sources that have a reputation score of nine are queued into buffer322, and associated processing engine342can provide for a reduced analysis. Packets that are received from sources that have a reputation score between six and eight can be queued into buffer324, and associated processing engine344can provide for a more extensive analysis. Packets that are received from sources that have a reputation score of four or five can queued into buffer326, and can be directed to proxy346for separate handling, such as a more in-depth but computationally expensive analysis.

In another embodiment, classifier312determines a QoS level for the packets received by classification block310, and one or more of buffers322,324, and326are associated with different QoS levels, and packets with the associated QoS level are queued into the associated buffer. In this embodiment, processing engines342and344, and proxy346each provide analysis of the packets with the associated QoS level. In another embodiment packets are processed based upon the packets' QoS level and the packets' source reputation. Here classifier312can queue packets into buffers322,324, and326based upon both the QoS level of the packets, and the source reputation of the packets. In another embodiment, processing engines342and344, and proxy346can be made up of two or more similar processing engines or proxies, and IDPS300can include a scheduler similar to scheduler230for each of buffers322,324, and326. Here, a packet that is at the head of a buffer can be provided to a next available processing engine or proxy. As noted above, it should be understood that IDPS300can utilize reputation score thresholds, and that the number of buffers322,324,326, of processing engines342and344, and proxy346can be increased or decreased as needed or desired. As such, IDPS300can implement a quality of security analysis (QoSA) for packets received by classification block310, such that packets received are classified into reputation levels, or QoSA levels, that are associated with respective buffers322,324, and326.

FIG. 4illustrates a method of incorporating quality-of-service and Internet protocol reputation in an intrusion detection and prevention system, beginning at block402where a packet is received at a firewall. For example, firewall140can receive a packet from external network102. A decision is made at the fire wall as to whether or not to admit the packet onto a network protected by the firewall at decision block404. Thus firewall140can include rules to screen out packet that have a specified source address or other rules. If the packet is not admitted onto the protected network by the firewall, the “NO” branch of decision block404is taken, and the packet is dropped from the protected network in block412. For example, the packet can be from a source address that is associated with a blacklist of firewall140. If the packet is admitted onto the protected network by the firewall, the “YES” branch of decision block404is taken, and the packet is sent to an IDPS in block406, and a reputation score is determined for the packet in block408. For example, the packet can be from a source address that is associated with a whitelist of firewall140, and the firewall can forward the packet to an IDPS such as IDPS150. IDPS150can retrieve a reputation score from reputation database120, or from a database similar to databases214or314.

A decision is made as to whether or not the reputation score of the packet is less than a first threshold value in decision block410. For example, classifier212can deter mine if the reputation score for the packet is greater than or less than the bottom threshold. If so, the “YES” branch of decision block410is taken, and the packet is dropped from the protected network in block412. Thus classifier212can drop216the packet when the reputation score is less than the bottom threshold. If the reputation score of the packet is not less than the first threshold value, the “NO” branch of decision block410is taken, and a decision is made as to whether or not the reputation score of the packet is greater than a second threshold value in decision block414. For example, classifier312can determine if the reputation score for the packet is greater than or less than the top threshold. If so, the “YES” branch of decision block414is taken, and the packet is admitted to the protected network in block426. Thus classifier312can bypass318further processing of the packet when the reputation score is greater than the top threshold. If the reputation score of the packet is not greater than the second threshold value, the “NO” branch of decision block414is taken, and a QoS level for the packet is determined in block416. For example, classifier212can determine the QoS level for the packet. The packet is provided to a buffer that is associated with a range of reputation scores and a range of QoS levels in block418, based on the reputation score and the QoS level of the packet. Here the packet can be provided by classifier212to one of buffers222,224, or226, based upon the reputation score and the QoS level of the packet. The packet is scheduled into a processing engine when the packet is at the head of the buffer in block420. For example, scheduler230can schedule the packet to the next available of processing engines242,244, or246. In an alternative embodiment, the packet is provided to a processing engine that is associated with the buffer with the range of reputation scores and the range of QoS levels that includes the reputation score and the QoS level of the packet. For example, when the packet reaches the head of one of buffers322,324, or326, the packet can be provided to the respective processing engines342or344, or proxy346.

The processing engine processes the packet to determine if the packet includes an exploit in block422. For example, processing engine242can process the packet to determine if the packet includes an exploit. A decision is made as to whether or not the packet includes an exploit in decision block424. If so, the “YES” branch of decision block424is taken and the packet is dropped from the protected network in block412. If the packet does not include an exploit, the “NO” branch of decision block424is taken and the packet is admitted to the protected network in block426. Here processing engine242can drop the packet or admit the packet based upon whether or not the packet includes an exploit. It should be understood that the method describe herein is exemplary, and that more than two threshold values (i.e., the first threshold value and the second threshold value) can be incorporated into the method as needed or desired. In a particular embodiment, the decisions made in decision blocks410and414can be based upon a determination of a QoSA level of the received packet, and can represent multiple decision blocks that classify the received packet into a buffer associated with the QoSA level of the received packet.

FIG. 5is a block diagram illustrating an embodiment of an information handling system500, including a processor510, a chipset520, a memory530, a graphics interface540, an input/output (I/O) interface550, a disk controller560, a network interface570, and a disk emulator580. In a particular embodiment, information handling system500is used to carry out one or more of the methods described herein. In another embodiment, one or more of the systems described herein are implemented in the form of information handling system500.

Chipset520is connected to and supports processor510, allowing the processor to execute machine-executable code. In a particular embodiment (not illustrated), information handling system500includes one or more additional processors, and chipset520supports the multiple processors, allowing for simultaneous processing by each of the processors and permitting the exchange of information among the processors and the other elements of the information handling system. Chipset520can be connected to processor510via a unique channel, or via a bus that shares information among the processor, the chipset, and other elements of information handling system500.

Memory530is connected to chipset520. Memory530and chipset520can be connected via a unique channel, or via a bus that shares information among the chipset, the memory, and other elements of information handling system500. In another embodiment (not illustrated), processor510is connected to memory530via a unique channel. In another embodiment (not illustrated), information handling system500includes separate memory dedicated to each of the one or more additional processors. A non-limiting example of memory530includes static random access memory (SRAM), dynamic random access memory (DRAM), non-volatile random access memory (NVRAM), read only memory (ROM), flash memory, another type of memory, or any combination thereof.

Graphics interface540is connected to chipset520. Graphics interface540and chipset520can be connected via a unique channel, or via a bus that shares information among the chipset, the graphics interface, and other elements of information handling system500. Graphics interface540is connected to a video display542. Other graphics interfaces (not illustrated) can also be used in addition to graphics interface540as needed or desired. Video display542includes one or more types of video displays, such as a flat panel display, another type of display device, or any combination thereof.

I/O interface550is connected to chipset520. I/O interface550and chipset520can be connected via a unique channel, or via a bus that shares information among the chipset, the I/O interface, and other elements of information handling system500. Other I/O interfaces (not illustrated) can also be used in addition to I/O interface550as needed or desired. I/O interface550is connected via an I/O interface552to one or more add-on resources554. Add-on resource554is connected to a storage system590, and can also include another data storage system, a graphics interface, a network interface card (NIC), a sound/video processing card, another suitable add-on resource or any combination thereof I/O interface550is also connected via I/O interface552to one or more platform fuses556and to a security resource558. Platform fuses556function to set or modify the functionality of information handling system500in hardware. Security resource558provides a secure cryptographic functionality and includes secure storage of cryptographic keys. A non-limiting example of security resource558includes a Unified Security Hub (USH), a Trusted Platform Module (TPM), a General Purpose Encryption (GPE) engine, another security resource, or a combination thereof.

Disk controller560is connected to chipset520. Disk controller560and chipset520can be connected via a unique channel, or via a bus that shares information among the chipset, the disk controller, and other elements of information handling system500. Other disk controllers (not illustrated) can also be used in addition to disk controller560as needed or desired. Disk controller560includes a disk interface562. Disk controller560is connected to one or more disk drives via disk interface562. Such disk drives include a hard disk drive (HDD)564, and an optical disk drive (ODD)566, and can include one or more disk drive as needed or desired. ODD566can include a Read/Write Compact Disk (RJW-CD), a Read/Write Digital Video Disk (R/W-DVD), a Read/Write mini Digital Video Disk (RIW mini-DVD, another type of optical disk drive, or any combination thereof Additionally, disk controller560is connected to disk emulator580. Disk emulator580permits a solid-state drive584to be coupled to information handling system500via an external interface582. External interface582can include industry standard busses such as USB or IEEE 1394 (Firewire) or proprietary busses, or any combination thereof Alternatively, solid-state drive584can be disposed within information handling system500.

Network interface device570is connected to I/O interface550. Network interface570and I/O interface550can be coupled via a unique channel, or via a bus that shares information among the I/O interface, the network interface, and other elements of information handling system500. Other network interfaces (not illustrated) can also be used in addition to network interface570as needed or desired. Network interface570can be a network interface card (NIC) disposed within information handling system500, on a main circuit board such as a baseboard, a motherboard, or any combination thereof, integrated onto another component such as chipset520, in another suitable location, or any combination thereof Network interface570includes a network channel572that provide interfaces between information handling system500and other devices (not illustrated) that are external to information handling system500. Network interface570can also include additional network channels (not illustrated).

Information handling system500includes one or more application programs532, and Basic Input/Output System and Firmware (BIOS/FW) code534. BIOS/FW code534functions to initialize information handling system500on power up, to launch an operating system, and to manage input and output interactions between the operating system and the other elements of information handling system500. In a particular embodiment, application programs532and BIOS/FW code534reside in memory530, and include machine-executable code that is executed by processor510to perform various functions of information handling system500. In another embodiment (not illustrated), application programs and BIOS/FW code reside in another storage medium of information handling system500. For example, application programs and BIOS/FW code can reside in HDD564, in a ROM (not illustrated) associated with information handling system500, in an option-ROM (not illustrated) associated with various devices of information handling system500, in storage system590, in a storage system (not illustrated) associated with network channel572, in another storage medium of information handling system500, or a combination thereof. Application programs532and BIOS/FW code534can each be implemented as single programs, or as separate programs carrying out the various features as described herein.

In the embodiments described herein, an information handling system includes any instrumentality or aggregate of instrumentalities operable to compute, classify, process, transmit, receive, retrieve, originate, switch, store, display, manifest, detect, record, reproduce, handle, or use any form of information, intelligence, or data for business, scientific, control, entertainment, or other purposes. For example, an information handling system can be a personal computer, a consumer electronic device, a network server or storage device, a switch router, wireless router, or other network communication device, a network connected device (cellular telephone, tablet device, etc.), or any other suitable device, and can vary in size, shape, performance, price, and functionality. The information handling system can include memory (volatile (e.g. random-access memory, etc.), nonvolatile (read-only memory, flash memory etc.) or any combination thereof), one or more processing resources, such as a central processing unit (CPU), a graphics processing unit (GPU), hardware or software control logic, or any combination thereof. Additional components of the information handling system can include one or more storage devices, one or more communications ports for communicating with external devices, as well as, various input and output (I/O) devices, such as a keyboard, a mouse, a video/graphic display, or any combination thereof. The information handling system can also include one or more buses operable to transmit communications between the various hardware components. Portions of an information handling system may themselves be considered information handling systems.

When referred to as a “device,” a “module,” or the like, the embodiments described herein can be configured as hardware. For example, a portion of an information handling system device may be hardware such as, for example, an integrated circuit (such as an Application Specific Integrated Circuit (ASIC), a Field Programmable Gate Array (FPGA), a structured ASIC, or a device embedded on a larger chip), a card (such as a Peripheral Component Interface (PCI) card, a PCI-express card, a Personal Computer Memory Card International Association (PCMCIA) card, or other such expansion card), or a system (such as a motherboard, a system-on-a-chip (SoC), or a stand-alone device). The device or module can include software, including firmware embedded at a device, such as a Pentium class or PowerPC™ brand processor, or other such device, or software capable of operating a relevant environment of the information handling system. The device or module can also include a combination of the foregoing examples of hardware or software. Note that an information handling system can include an integrated circuit or a board-level product having portions thereof that can also be any combination of hardware and software.