Role-based resource access control

Systems and methods for role-based access control to computing resources are presented. In an example embodiment, a request to perform a type of access of a computing resource is received via a communication network from a process executing on a client device. Using a data store storing process identifiers and associated access control information, access control information associated with the requesting process is identified based on a process identifier of the requesting process. Based on the access control information associated with the requesting process, a determination is made whether the requesting process is allowed to perform the requested type of access of the computing resource. The request is processed based on the requesting process being allowed to perform the requested type of access of the computing resource.

TECHNICAL FIELD

Embodiments of the present disclosure relate generally to data processing and, more particularly, but not by way of limitation, to a method and system for role-based access control for cloud (e.g., Internet-based) resources and services.

BACKGROUND

The advent of cloud computing resources has greatly benefited small and large organizations alike due to reduced capital expenditures in computer equipment, flexibility in adjusting to changes in processing bandwidth requirements, enhanced disaster recovery ability, and the like. As a result, the use of cloud, computing has extended beyond the traditional computing system paradigm to service other important tasks. One example of many is the collection and analysis of data to and from sensors, switches, valves, and other devices associated with industrial systems, such as manufacturing machinery, power plant equipment, aircraft engines, and the like. Such data is typically voluminous, and may employ any of several specialized data transfer protocols, such as MQTT (Message Queuing Telemetry Transport), CoAP (Constrained Application Protocol), and many others. Consequently, while network firewalls employed by cloud computing systems are adept at providing security for typical HTTP (Hypertext Transfer Protocol) communications over the Internet, these firewalls often do not support alternate protocols employed to transfer large data streams, often leading to reduced protection of cloud resources. Complicating the operation of the firewall is the use of multiple such alternate protocols from the same client device that may be receiving data from, or sending data to, multiple smaller devices.

DETAILED DESCRIPTION

In the following description, for the purposes of explanation, numerous specific details are set forth in order to provide an understanding of various example embodiments of the present subject matter. It will be evident, however, to those skilled in the art, that example embodiments of the present subject matter may be practiced without these specific details.

FIG. 1is a block diagram of a cloud computing system101including a resource access controller104for controlling access to one or more resources116provided on infrastructure106of the cloud computing system101by one or more client devices120via a communication network130. As illustrated inFIG. 1, the cloud computing system101may also include a device manager102. In other example embodiments, the cloud computing system101may include more or fewer modules or components than that shown inFIG. 1. In example embodiments, the cloud computing system101may operate as software-as-a-service (SaaS), platform-as-a-service (PaaS), or another type of system accessible via the communication network130.

In example embodiments, the infrastructure106may include computing-related devices or systems such as, but not limited to, one or more servers, operating systems executing on one or more servers, virtual machines operating on one or more servers, data storage systems (e.g., magnetic and/or optical disk drive systems, flash data storage systems, and so on), and communication networks coupling servers, data storage systems, and other components.

The resources116provided on the infrastructure106may be any application or other executable system that may communicate with one or more of the client devices120to perform one or more operations at the request of the client devices120, such as transmitting, receiving, storing, and/or retrieving data between the client devices120and the cloud computing system101; processing such data on the cloud computing system101; receiving or sending messages (e.g., messages indicating alert or emergency conditions) between the client devices120and the computing system101; and so on. Example embodiments of the resources116may include, but are not limited to, databases, webservers, message queuing systems (e.g., RabbitMQ™), and data streaming services (e.g., Apache Kafka™, such as for transmitting or receiving industrial time-series data).

One or more of the client devices120may be communicatively coupled with the cloud computing system101by way of the communication network130, such as a wide area network (WAN) (e.g., the Internet), a local area network, (LAN), a wireless WAN (WWAN), a wireless LAN (WLAN), a cellular telephone network (e.g., a third-generation (3G) or fourth-generation (4G) network), another communication network or connection, or some combination thereof.

The client devices120may include, but are not limited to, an industrial sensor, an industrial actuator (e.g., a value, switch, or the like), a communication router coupled to multiple such sensors, a desktop computer, a laptop computer, a tablet computer, a smart phone, or any other computing device or communication device capable of communicating with the cloud computing system101over the network130via messages, data packets, data streams, or other communication data structures. In an example embodiment, the client device120may communicate with the cloud computing system101using specialized protocols, such as MQTT and CoAP, as indicated above. However, other, more standard communication protocols, such as HTTP for communicating with a web server (not explicitly depicted inFIG. 1), may be employed in other embodiments.

Each process122executing on a client device120, in an example embodiment, may be a single instance of a program or application executing on the client device120, possibly executing within its own memory space and having its own identifier. One or more processes122may execute concurrently on the same client device120. Moreover, in some example embodiments, a process122may employ one or more separate execution threads that may execute within the memory space of the process122.

In an example embodiment of the cloud computing system101, the device manager102may be configured to enroll or register one or more of the client devices120with the cloud computing system101to allow the processes122executing on the client devices120to access the resources116under the control of the resource access controller104. In an example embodiment, the device manager102may also be configured to provision one or more of the client devices120with software that initiates and executes the processes122.

The resource access controller104may be configured to control access to the resources116hosted on the infrastructure106of the computing system101by one or more client devices120. In example embodiments, such access may be based on a particular “role” associated with each process122or client device120Each role, in turn, may identify or limit the particular resources116, as well as one or more particular types of access to those resources116, allowed for the process122or client device120assigned that role. Consequently, the resource access controller104may closely control access of each process122or client device120to the various resources116of the cloud computing system101, thus enhancing the security of the cloud computing system101, as well as the client devices120. In some example embodiments, the roles associated with one or more of the processes122or client devices120may be changed at the cloud computing system101on a virtually permanent basis (e.g., by a system operator or administrator) or temporarily (e.g., via the resource access controller104) to adjust to changes (e.g., alert conditions) in the operating environment of the client devices120. Other aspects of the resource access controller104are discussed in greater detail below.

FIG. 2is a block diagram of an example of the resource access controller104ofFIG. 1. As depicted therein, the resource access controller101may include one or more of a process data store202, a role data store204, and an access request processor206. The resource access controller101may include other modules or components, but such modules and components are not depicted inFIG. 2to simplify the following discussion.

In an example embodiment, the process data store202is configured to associate identifiers corresponding to each client device120or process122with information indicating which resources116the identified client device120or process122may access, and possibly what specific types of access (e.g., create, read, write, update, delete, and so on) in which the client device120or process122may engage with each of those resources116. In the example embodiment in which each client device120, possibly including all processes122executing thereon, are identified by a single identifier, a client digital certificate used for authentication of the client device120may be employed as such an identifier. In another example embodiment, in which the resource access controller104may control access to the resources116at the process122level, each process122may be identified with a combination of the client certificate for the client device120upon which the process122executes, and a process122identifier that is at least unique among all processes122that execute on the client device120.

FIG. 3is a block diagram of an example of the process data store202ofFIG. 2. In this example embodiment, access control is process-specific, with each process122being identified by the client certificate302of the client device120upon which the process122executes, in combination with a process identifier304for the process122. Also in an example embodiment, each process122may be identified directly with one or more access control tags306that may indicate which resources116the process122may access, as well as the types of access for each resource116in which the process122may engage. In another example embodiment, each process122may be identified indirectly with one or more access control tags306by way of a role identifier308for a particular role that the corresponding process122currently fills. Role identifiers308are discussed in greater detail with respect toFIGS. 5 and 6.

FIG. 4is a block diagram of an example of the access control tags306of the process data store202ofFIG. 3. In an example embodiment, the access control tags306may include a resource identifier402for each resource116accessible by the process122associated with this particular set of access control tags306. In addition, in some example embodiments, each resource identifier402in this set of access control tags306may be associated with one or more particular access types404(e.g., read-only, write-only, read-write, update, create, delete, and so on) that the associated process122may employ when accessing that resource116. In example embodiments, the access control tags306depicted inFIG. 4may represent a single set of access control tags306for one particular process122, as illustrated inFIG. 3.

In an example embodiment, the access control tags306associated with a particular process122may represent the various resource identifiers402and access types404using any representation that allows multiple resources402and access types404to be represented simultaneously. Example representations may include a bitwise representation of each possible resource/access type combination, textual representations of the various resource/access type combinations, and others.

As indicated above, each set of access control tags306associated with a particular process122, in an example embodiment, may represent a particular “role” for the process122associated with the set of access control tags306. In an example embodiment, a process122may indirectly refer to a set of access control tags306, such as by way of a process role identifier assigned to the process112.FIG. 5is a block diagram of an example of a role data store202of the resource access controller104ofFIG. 1. In an example embodiment, each process122noted in the process data store202may be associated with a role identifier308, as indicated above in conjunction withFIG. 3. In turn, as shown inFIG. 5, each role identifier308may refer to a particular set of access control tags306, such as those depicted inFIG. 4. Such an embodiment may be useful in circumstances in which only certain combinations of access control tags306are available for any of the processes122, thus resulting in a limited number of roles, and thus role identifiers308.

In some example embodiments, each process122may be associated with exactly one role (e.g., indicated by a role identifier308) and/or set of access control tags306. In other example embodiments, one or more of the processes122may be associated with a single role and/or set of access control tags306at any particular time, but may be associated with other roles and/or sets of access control tags306at other times. In these latter example embodiments, the possible roles associated with one or more processes122, and hence process identifiers304, may be related to each other hierarchically. For example,FIG. 6is a block diagram of an example role hierarchy600exhibited by process roles, as identified by various role identifiers308A,308B,308C, and308D. In an example embodiment, each role identifier308that resides in a higher level of the role hierarchy600is associated with greater, or higher-level, access to one or more resources116. For example, as depicted inFIG. 6, role identifier308A is associated with a higher-level role than role identifiers308B through308D, while role identifier308B is associated with a higher-level role than both role identifier308C and role identifier308D. In an example embodiment, a higher-level role identifier308(e.g., role identifier308B) includes all of the resource116access granted to roles associated with the lower-level role identifiers308(e.g., role identifiers308C and308D) of the higher-level role identifier308(e.g., role identifier308B), plus at least one additional access type404associated with a resource identifier402that may or may not be associated with the lower-level role identifiers308. In example embodiments, the role hierarchy600ofFIG. 6may be represented by way of pointers or other referential data in the role data store202ofFIG. 5.

In an example embodiment, a particular process122, as indicated by a process identifier304(FIG. 3), may be associated in the process data store202with a single role identifier308of a role hierarchy600during one period of time, and then associated with a higher-level or lower-level role identifier308at another period of time based on one or more factors or events. These embodiments are discussed below in connection withFIGS. 8 and 9.

While the example embodiments discussed above indicate that the process data store202ofFIGS. 2 and 3and the role data store204ofFIGS. 2 and 5may be distinct and separate, the information contained therein may be stored in a single data store in other example embodiments. In yet other example embodiments, the information described above regardingFIGS. 3-6may be stored in other data formats not specifically discussed above.

FIG. 7is a flow diagram of an example method700of the resource access controller104ofFIG. 1to control access by processes122to computing resources116. While the method700, as well as other methods presented herein, is described in view of the environment of the cloud computing system101ofFIG. 1and its various components ofFIGS. 2-6, other systems or devices not specifically discussed herein may perform the same or similar operations in other embodiments.

In the method700, the resource access controller104may receive and store access policy rules (operation702), which may include, in an example embodiment, receiving the access control tags306, role identifiers308, and possibly associated information described above in conjunction withFIGS. 2-6. This information may be provided to the resource access controller104from a system operator or administrator system associated with the cloud computing system101ofFIG. 1, a supervisory computing system associated with one or more of the client devices120ofFIG. 1, or another source.

Also, the device manager102of the cloud computing system101ofFIG. 1may enroll, register, and/or provision one or more of the client devices120(operation704) to facilitate access of the processes122of the client devices120to one or more of the resources116of the infrastructure106of the cloud computing system101. In an example embodiment, enrolling or registering a client device120may include receiving the client certificates302and process identifiers304associated with one or more of the client devices120at the device manager102, such as from a system operator or administrator associated with the cloud computing system101ofFIG. 1, or a supervisory computing system associated with one or more of the client devices120ofFIG. 1, as indicated above. In an example embodiment, provisioning one or more of the client devices120may include the device manager102providing (e.g., via the network130) the software to be executed on the client devices120, possibly including software configured to execute the processes122on the client devices120.

Also during the method700, the resource access controller104may authenticate one or more of the processes122to enable the processes122to access the resources116of the cloud computing system101(operation706). In an example embodiment, the resource access controller104and a client device120may engage in a two-way certificate-based authentication process (e.g., two-way TLS (Transport Layer Security) authentication) over the network130by employing the client certificate302of the client device120and a server certificate associated with the resource access controller104. Other certification methods may be employed to authenticate the one or more client devices120in other example embodiments.

After authentication of a client device120, the resource access controller104may receive, from a process122executing on the client device120via the network130, a request to access one of the resources116of the cloud computing system101(operation708). In an example embodiment, the request may include a type of request (e.g., read, write, update, create, delete, and so on), along with a process identifier304associated with the requesting process122.

In response to the request, the resource access controller104, in an example embodiment, may determine whether the requested access is allowable based on a role associated with the requesting process122(operation710). In example embodiments, the resource access controller104may determine the particular role associated with the requesting process122by way of determining particular access control tags306associated with the requesting process122. For example, the resource access controller104may compare the digital certificate302received during the authentication of the client device120and the process identifier304received in conjunction with the request against the digital certificates302and the process identifiers304stored in the process data store202to determine the process role identifier308or the access control tags306associated with the requesting process122. In the scenario in which the digital certificate302and process identifier304are associated with a particular role identifier308in the process data store202, the resource access controller104may then compare the particular role identifier308against the role identifiers308stored in the role data store204to determine the access control tags306associated with the requesting process122.

Once the access control tags306associated with the requesting process122have been determined, the resource access controller104compares the determined access control tags306to the requested access to determine if the requested access to the particular resource116is allowed. In response to the requested access not being allowed, the resource access controller104may deny the request (operation712). In an example embodiment, the resource access controller104may return a message to the requesting process122via the network indicating that the request is denied. If, instead, the requested access is allowed, the resource access controller104may cause the requested access to be processed (operation714). In causing the request to be processed, the resource access controller104may forward or direct the request to the particular resource116to which the request is to be directed, in an example embodiment.

In some example embodiments, the role assigned to, or associated with, the requesting process122may be altered or modified so that the request to access a particular resource116that is not allowed for the requesting process122given its current role may be allowed under a different role. To that end, one or both of the methods depicted inFIGS. 8 and 9may be employed to facilitate a role change. For example,FIG. 8is a flow diagram of an example method800of the resource access controller104to handle an explicit process122request to change a role of the process122. In method800, the resource access controller104may receive a request from a process122to change the role of the process122(operation802), such as to a higher-level role indicated in a role hierarchy600, an example of which is depicted inFIG. 6. In an example embodiment, the requesting process122may transmit such a request in response to the resource access controller104denying a previous request for access to a particular resource116(e.g., operation712of method700).

In example embodiments, the request may indicate a particular desired role identifier308for the requesting process122, or may just indicate a general request for a higher-level role. In response to a request for a particular higher-level role, the resource access controller104, in an example embodiment, may determine whether the requesting process122may be assigned the higher-level role, such as by consulting the associated role hierarchy600, which may or may not be specifically associated with the requesting process122. If the requested role is not reflected in the role hierarchy600, the resource access controller104may determine that the requested role change is not allowable (operation804) and deny the change in role (operation806). If, instead, the requested higher-level role is one indicated by way of an associated role identifier308in the role hierarchy600, the resource access controller104may determine that the requested role change is acceptable (operation804) and allow the role change (operation808), such as by assigning the role identifier308associated with the requested higher-level role to the requesting process122. In an example embodiment, the role change may only be effective for some limited period of time, or until a particular event, such as the completion of the request for access (e.g., the completion of a data transfer, or the transfer of a message), has occurred.

In an example embodiment in which the role change request does not indicate a specific role or role identifier308, the resource access controller104may consult the appropriate role hierarchy600to determine if a higher-level role is available (operation804). If a higher-level role is indicated in the role hierarchy600, the resource access controller104may allow the role change (operation808). If, instead, a higher-level role is not available (e.g., the current role assigned to the requesting process122is the highest in the role hierarchy600associated with the requesting process122), the request to modify the role of the requesting process122may be denied (operation806).

FIG. 9is a flow diagram of a method900of the resource access controller104to control access of processes122to computing resources116by facilitating an implicit change of role for the requesting process122. In the method900, the resource access controller104may receive a request to access a resource116(operation902), in a fashion similar to that shown in the method700ofFIG. 7(e.g., operation708). In response to the request, the resource access controller104may determine whether the requested access is allowable based on the current role for the requesting process122(operation904), in a manner similar to that shown in the method700(e.g., operation710). If the access is allowable based on the current role, the resource access controller104may cause the request to be processed (operation912), such as by forwarding the request to the particular resource116to be accessed.

If, instead, the requested access is not appropriate or allowed for the requesting process122in its current role (operation904), the resource access controller104may determine whether a change of role that facilitates processing of the request is allowable (operation906), such as based on a role hierarchy600associated with the requesting process122, as discussed above. If such a role change is not allowable, the resource access controller104may deny the request (operation908). If, instead, such a role change is allowable for the requesting process, the resource access controller104may assign the requesting process the new (e.g., higher-level) role (operation910) and cause the request to be processed by the requested resource116(operation912).

In an example embodiment, the role change instituted by the resource access controller104may be in effective for a limited period of time, or only until some event occurs, after which the requesting process122may revert to its original or previous role prior to the role change. For example, the newer role may be effective for a second, five seconds, ten seconds, or some other period of time, possibly to allow multiple requests from the requesting process122to be received and serviced before the requesting process122is reverted to its previous role. In another case, the newer role may be effective until the access of the resource116requested by the requesting process122has been completed. For example, presuming that the requested access from the requesting process122involves transferring a stream of data from the client device120to a data streaming resource116, the resource access controller104may assign the requesting process122the new role to facilitate the data stream transfer. Once the requested data stream transfer has completed, the resource access controller104may then revert the requesting process122to its previous role.

In some example embodiments described above, the resource access controller104may adjust the roles and/or associated access control tags306of the various processes122of the client devices120. Further, the resource access controller104may make these adjustments automatically based on detected access levels and/or other operational characteristics of the various resources116provided by the cloud computing system101. The resource access controller104, in some example embodiments, may adjust the roles and/or access control tags306in response to input received from a system operator or administrator.

In at least some of the example embodiments described above, the use of access roles assigned to the processes122of one or more client devices120at the resource access controller104facilitates centralized control over access to the particular resources116provided by the cloud computing system101. Thus, changes to such privileges may be facilitated on a real-time basis for all client devices120and their associated processes122, as opposed to making such changes at each of the client devices120individually, which may number in the thousands. In addition, dynamic and adaptive control of access to the resources116, as described herein, may result in improved security of the cloud computing system101; as the principle of “least privilege,” in which each client device120or associated process122is allowed access to only those resources116that the client device120or process122employs for efficient operation at any particular time, may be implemented dynamically. This capability may enhance overall network security while dynamically facilitating enhanced performance of the cloud computing system101in response to changing operational conditions at the cloud computing system101and/or the various client devices120.

In an example embodiment, a method for role-based control of access to computing resources comprises receiving, via a communication network from a process executing on a client device, a request to perform a type of access of a computing resource; identifying; from a data store storing process identifiers and associated access control information, access control information associated with the requesting process based on a process identifier of the requesting process; determining, based on the access control information associated with the requesting process, using at least one hardware processor of a machine, whether the requesting process is allowed to perform the requested type of access of the computing resource; and based on the requesting process being allowed to perform the requested type of access of the computing resource, causing the request to be processed.

In another example embodiment, including all previous example embodiments, the access control information associated with the requesting process indicates one or more computing resources that the requesting process is allowed to access.

In another example embodiment, including all previous example embodiments, the access control information associated with the requesting process further indicates, for at least one of the indicated one or more computing resources, a type of access to the at least one of the indicated one or more computing resources allowed for the requesting process.

In another example embodiment, including all previous example embodiments, the method further comprises receiving, via the communication network, at least one text file comprising the process identifiers and the associated access control information; and storing the process identifiers and the associated access control information in the data store.

In another example embodiment, including all previous example embodiments, the at least one text file comprises at least one of a JavaScript Object Notation (JSON) file and an Extensible Markup Language (XML) file.

In another example embodiment, including all previous example embodiments, the method further comprises based on the requesting process not being allowed to perform the requested type of access of the computing resource, denying the request.

In another example embodiment, including all previous example embodiments, each process identifier and its associated access control information describe a role corresponding to the process identified by the process identifier; the requesting process corresponds to more than one role; the access control information associated with the requesting process corresponds to a first role of the requesting process; and the method further comprises based on the requesting process not being allowed to perform the requested type of access of the computing resource in the first role, determining whether a second role is available for the requesting process that allows the requested type of access of the computing resource to be performed; and based on a second role being available for the requesting process that allows the requested type of access of the computing resource to be performed, assigning the second role to the requesting process and causing the request to be processed.

In another example embodiment, including all previous example embodiments, the method further comprises reverting the requesting process from the second role to the first role after a predetermined event has occurred.

In another example embodiment, including all previous example embodiments, the predetermined event comprises the processing of the request.

In another example embodiment, including all previous example embodiments, the method further comprises reverting the requesting process from the second role to the first role after a predetermined period of time has elapsed.

In another example embodiment, including all previous example embodiments, the second role corresponds to the access control information corresponding to the first role, and to additional access control information allowing the requested type of access of the computing resource.

In another example embodiment, including all previous example embodiments, the determining whether a second role is available for the requesting process depends on whether the second role is specified in a role hierarchy associated with the requesting process.

In another example embodiment, including all previous example embodiments, the method further comprises receiving, prior to the receiving of the request, a digital certificate corresponding to the client device and the process identifier for the requesting process; and authenticating, prior to the receiving of the request, the requesting process based on the received digital certificate and the received process identifier.

In another example embodiment, including all previous example embodiments, the method further comprises performing a two-way authentication with the client device, the performing of the two-way authentication comprising the receiving of the digital certificate and the authenticating of the requesting process.

In another example embodiment, including all previous example embodiments, the computing resource comprises a data streaming service.

In another example embodiment, including all previous example embodiments, the computing resource comprises a messaging queue.

In another example embodiment, including all previous example embodiments, the computing resource comprises a database.

In another example embodiment, including all previous example embodiments, the computing resource comprises a webserver.

In an example embodiment, a system comprises one or more hardware processors; and a memory storing instructions that, when executed by at least one of the one or more hardware processors, cause the system to perform operations comprising receiving, via a communication network from a process executing on a client device, a request to perform a type of access of a computing resource; identifying, from a data store storing process identifiers and associated access control information, access control information associated with the requesting process based on a process identifier of the requesting process; determining, based on the access control information associated with the requesting process, whether the requesting process is allowed to perform the requested type of access of the computing resource; and based on the requesting process being allowed to perform the requested type of access of the computing resource, causing the request to be processed.

In an example embodiment, a non-transitory computer-readable storage medium stores instructions that, when executed by at least one hardware processor of a machine, cause the machine to perform operations comprising receiving, via a communication network from a process executing on a client device, a request to perform a type of access of a computing resource; identifying, from a data store storing process identifiers and associated access control information, access control information associated with the requesting process based on a process identifier of the requesting process; determining, based on the access control information associated with the requesting process, whether the requesting process is allowed to perform the requested type of access of the computing resource; and based on the requesting process being allowed to perform the requested type of access of the computing resource, causing the request to be processed.

FIG. 10is a block diagram illustrating components of a machine1000, according to some example embodiments, able to read instructions1024from a machine-readable medium1022(e.g., a non-transitory machine-readable medium, a machine-readable storage medium, or a computer-readable storage medium) and perform any one or more of the methodologies discussed herein, in whole or in part. Specifically,FIG. 10depicts the machine1000in the example form of a computer device (e.g., a computer) within which the instructions1024(e.g., software, firmware, a program, an application, an apples, an app, or other executable code) for causing the machine1000to perform any one or more of the methodologies discussed herein, in whole or in part.

For example, the instructions1024may cause the machine1000to execute the flow diagrams ofFIGS. 7-9, as well as all example embodiments associated therewith. The instructions1024can transform the general, non-programmed machine1000into a particular machine (e.g., specially configured machine) programmed to carry out the described and illustrated functions in the manner described. Also, in example embodiments, the machine1000may operate as one or more of the modules or components of the cloud computing system101ofFIG. 1(including the device manager102, the resource access controller104, and the resources116hosted on the infrastructure106), or any other computing system or device described herein.

In example embodiments, the machine1000operates as a standalone device or may be connected (e.g., networked) to other machines. The machine1000may be a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), a cellular telephone, a smartphone, a web appliance, a network router, a network switch, a network bridge, a power adapter, or any machine1000capable of executing the instructions1024, sequentially or otherwise, that specify actions to be taken by that machine1000. Further, while only a single machine1000is illustrated, the term “machine” shall also be taken to include a collection of machines that individually or jointly execute the instructions1024to perform any one or more of the methodologies discussed herein.

The machine1000includes a processor1002(e.g., a central processing unit (CPU), a graphics processing unit (GPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a radio-frequency integrated circuit (RFIC), or any suitable combination thereof), a main memory1004, and a static memory1006, which are configured to communicate with each other via a bus1008. The processor1002may contain microcircuits that are configurable, temporarily or permanently, by some or all of the instructions1024such that the processor1002is configurable to perform any one or more of the methodologies described herein, in whole or in part. For example, a set of one or more microcircuits of the processor1002may be configurable to execute one or more modules (e.g., software modules) described herein.

The machine1000may further include a graphics display1010(e.g., a plasma display panel (PDP), a light-emitting diode (LED) display, a liquid crystal display (LCD), a projector, a cathode ray tube (CRT), or any other display capable of displaying graphics or video). The machine1000may also include an alphanumeric input device1012(e.g., a keyboard or keypad), a cursor control device1014(e.g., a mouse, a touchpad, a trackball, a joystick, a motion sensor, an eye tracking device, or other pointing instrument), a storage unit1016, a signal generation device1018(e.g., a sound card, an amplifier, a speaker, a headphone jack, or any suitable combination thereof), and a network interface device1020.

The storage unit1016includes the machine-readable medium1022(e.g., a tangible machine-readable storage medium) on which is stored the instructions1024embodying any one or more of the methodologies or functions described herein. The instructions1024may also reside, completely or at least partially, within the main memory1004, within the processor1002(e.g., within a cache memory of the processor1002), or both, before or during execution thereof by the machine1000. Accordingly, the main memory1004and the processor1002may be considered machine-readable media1022(e.g., tangible and non-transitory machine-readable media).

Furthermore, the machine-readable medium1022is non-transitory in that it does not embody a propagating or transitory signal. However, labeling the machine-readable medium1022as “non-transitory” should not be construed to mean that the medium is incapable of movement; the medium should be considered as being transportable from one physical location to another in some example embodiments. Additionally, since the machine-readable medium1022is tangible, the medium may be considered a machine-readable device.

The instructions1024may further be transmitted or received over a communications network1026using a transmission medium via the network interface device1020and utilizing any one of a number of well-known transfer protocols (e.g., Hypertext Transfer Protocol (HTTP)). Examples of communication networks1026include a local area network (LAN), a wide area network (WAN), the Internet, mobile telephone networks, plain old telephone service (POTS) networks, and wireless data networks (e.g., Wi-Fi®, LTE®, and WiMAX™ networks). The term “transmission medium” shall be taken to include any intangible medium that is capable of storing, encoding, or carrying instructions1024for execution by the machine1000, and includes digital or analog communications signals or other intangible medium to facilitate communication of such software.

Similarly, the methods described herein may be at least partially processor-implemented, a processor being an example of hardware. For example, at least some of the operations of a method may be performed by one or more processors or processor-implemented modules.

Although an overview of the inventive subject matter has been described with reference to specific example embodiments, various modifications and changes may be made to these example embodiments without departing from the broader scope of embodiments of the present disclosure. For example, various embodiments or features thereof may be mixed and matched or made optional by a person of ordinary skill in the art. Such embodiments of the inventive subject matter may be referred to herein, individually or collectively, by the term “invention” merely for convenience and without intending to voluntarily limit the scope of this application to any single inventive concept if more than one is, in fact, disclosed.