System and method of protecting a network

There is provided a network appliance, methods and systems which intercept web and email traffic, extract executables, compare the executables with a policy and wrap the executables. Then, the wrapped executables are delivered to a client system in a manner to protect the network and end point devices, where the wrapped executables are run in a sandbox with all file system, registry accesses, communication and traffic isolated.

CLAIM OF PRIORITY

This application claims priority from Provisional Application No. 62/061,403 filed on Oct. 8, 2014 which is incorporated herein by reference in its entirety.

This invention relates to the field of cyber security and more particularly to the delivery of executable files in a secure manner to a client endpoint in order to protect a network.

BACKGROUND

Traditional signature-based security solutions cannot defend against Zero-day and Advanced Persistent Threat (APT) attacks effectively. As a result, some vendors are now providing an appliance based solution. These solutions run threats in a virtual machine in an appliance, then the solution analyzes the threats in signature-less, behavior based way. There are, however, numerous drawbacks of a virtual machine based appliance. First, all threats are executed and analyzed in the appliance, which makes the appliance the performance bottle neck. Second, virtual machine based analysis can be bypassed easily by virtual machine detection and malware may behave differently when running in a virtual machine versus a physical machine. Third, users have to wait until analysis completes before they can actually use these executable files on their client systems. Fourth, some threats may infect a system with a delay of time, even after several hours—a virtual machine based appliance cannot detect the threats in this case. Additionally, when an analyzer fails to detect a threat, the threat will compromise the client system directly.

There is a need therefore, to overcome these and other drawbacks so that threats may be eliminated and executable files delivered in an effective manner which protects networks and end points thereof.

SUMMARY OF THE INVENTION

The present invention describes a system and method to deliver executables to network endpoints in a secure manner from an appliance so as to protect the network from potentially malicious executable files. The appliance of the present invention acts as a gateway where it can sniff all the network traffic, analyze the traffic and prevent external threats which could infect local systems. All executable applications, both known and unknown, are wrapped in a protective manner before delivery to a client system or end point. With the present invention, threats are run in a sandbox environment in client systems and behavior analysis is performed while the threats are running.

The present invention is a system for protecting a network from executables which comprises a network appliance having an interceptor that receives network traffic from a network and analyzes the network traffic for any and all executable application(s). The system has a packer which produces a wrapped executable application by wrapping the executable application and a data transmission connection to deliver the wrapped executable application to a client system. The client system includes at least one computer or handheld device connected to the network with the Trapped executable application running in a sandbox on the client system.

The system for protecting a network further includes an embodiment where at least one predefined policy or rule or rule set is applied to the network traffic to separate an unknown executable application, with the packer then wrapping only the unknown executable application to produce the wrapped executable application. The system of the present invention provides for behavior analysis to be performed on the wrapped executable application in said sandbox. In this way, any suspicious behaviour can be determined and the network, along with the end points, is made more secure and protected.

With the system of the present, invention, the wrapping of the executable application(s) includes a sandbox and the executable application(s) is placed inside the sandbox to produce the wrapped executable application. The wrapping can also include providing at least one executable script with the executable application and delivering the at least one executable script with the executable application as the wrapped executable application. The system of the present invention then runs the at least one executable script on the at least one computer or handheld device of an end user.

In an embodiment of the system of the present invention wrapping the executable application includes determining if a sandbox exists on the computer or handheld device of an end user and then extracting the executable application from the wrapped application if a sandbox exists. In this case, the system sends only the executable application to the sandbox on the at least one computer or handheld device of the end user.

The present invention includes a network appliance which comprises an interceptor for receiving network traffic and analyzes the network traffic for executable applications or at least one executable application at a time. The network appliance also has a packer which produces a wrapped executable application by wrapping the executable applications or at least one executable application, and a data transmission connection to deliver the wrapped executable application to a network client system or an end point. The network appliance further includes at least one predefined policy or rule or rule set applied to the executable applications or at least one executable application to separate an unknown executable application. The packer then wraps only the unknown executable application to produce the wrapped executable application which is delivered to the client system or end point.

In the network appliance of the present invention, the wrapping includes a sandbox and at least one executable application is placed inside the sandbox to produce the wrapped executable application. In the network appliance of the present invention, in an embodiment, the wrapping includes providing at least one executable script with the at least one executable application and delivering the at least one executable script with the at least one executable application as the wrapped executable application. The at least one executable script is run on a computer or handheld device of an end user.

Further, the network appliance of the present invention includes an embodiment wherein wrapping the at least one executable application includes determining if a sandbox exists on a computer or handheld device of an end user and extracting the at least one executable application from the wrapped application if a sandbox exists. In this embodiment, the network appliance sends only the at least one executable application to the sandbox on the computer or handheld device of the end user.

The present invention includes a method to protect end points of a network which comprises monitoring network traffic of a network and extracting at least one executable application from the network traffic. The method then wraps the at least one executable application and sends the wrapped executable application to an end user of the network. The method further includes identifying an unknown executable application based on at least one rule or policy after extracting at least one executable application from the network traffic. The method then wraps the unknown executable application and sends the wrapped unknown executable application to an end user of the network.

In the method of the present invention, the wrapping step includes placing the at least one executable application inside a sandbox and delivering the at least one executable application and the sandbox to the end user. In an embodiment, the wrapping step comprises including at least one executable script with the at least one executable application and delivering the at least one executable script with the at least one executable application to the end user. Then, running the at least one executable script on a computer or handheld device of the end user.

The present invention also includes a method to protect a network. This comprises monitoring the network traffic of a network and wrapping at least one executable application found within and on the network traffic. The method of protecting a network then determines if a sandbox exists on a computer or handheld device of an end user and, if a sandbox exists, then extracting the at least one executable application from the wrapped application and sending only the at least one executable application to the sandbox on the computer or handheld device of the end user.

The method further includes an embodiment of identifying an unknown executable application based on at least one policy after monitoring network traffic and wrapping the unknown executable application. The method again determines if a sandbox exists on the end point, and if so, the unknown executable application is extracted from the wrapped unknown executable application. In this embodiment, the method sends only the unknown executable application to the sandbox on the computer or handheld device of the end user via data transmission connection.

The present invention also includes a method to protect an end user of a network where an agent or piece of mal are already exists on the end user's device and is waiting to be activated by a second file or code(s). The method comprises monitoring network traffic of the network and sending an alert to the end user to run an executable application in a sandbox. Then, the method sends the executable application to a computer or handheld device of an end user and prevents the executable application from communicating instructions with an agent which exists on the computer or handheld device of the end user.

The method further includes identifying an unknown executable application based on at least one rule or policy after the step of monitoring network traffic and sending an alert to the end user to run the unknown executable application in a sandbox. Then the unknown executable application is sent to a computer or handheld device of an end user, which can be run in a sandbox. Thereby, the method prevents the unknown executable application from communicating instructions with an agent which exists on the computer or handheld device of the end user.

The method to securely deliver executables to an endpoint includes monitoring network traffic, extracting executable applications from the network traffic, identifying an unknown executable application based on a set of rules or policies, wrapping the unknown executable application and sending the wrapped unknown executable application to an end user operating a computer or handheld device as the endpoint. By wrapping the unknown application prior to delivery to a client system and hence end points, the unknown application is securely delivered to an end point without infecting the local system.

In the method of the invention, the wrapping step includes placing the unknown executable application inside a sandbox and delivering the unknown executable application and the sandbox to the end user.

In an embodiment of the invention, the wrapping step comprises the inclusion of at least one or more executable scripts with the unknown executable application and delivering the at least one or more executable scripts with the unknown executable application to the end user. The at least one or more executable scripts are then run on a computer or handheld device of the end user.

The present invention provides a method to securely deliver executables to an endpoint which includes monitoring network traffic, identifying an unknown executable application based on a set of rules or policies, wrapping the unknown executable application. In this embodiment, the invention determines if a sandbox exists on a computer or handheld device of an end user and then extracts the unknown executable application from the wrapped application if a sandbox exists. The method then sends only the unknown executable application to the sandbox on the computer or handheld device of the end user. In this manner, the size of the files which are transmitted to the endpoint are reduced significantly.

The present invention also includes end point security where an existing suspicious, malicious or information tracking agent is already on the end point and is awaiting instructions or activation by a second portion of code. The present invention can overcome this cybersecurity issue by a method to securely deliver executables to an end user by monitoring network traffic and identifying an unknown executable application based on a rule set or policies. The invention sends an alert or message to the end user to run the unknown executable application in a sandbox. The invention sends the unknown executable application to a computer or handheld device of an end user. Once at the end point, the invention prevents the unknown executable application from communicating instructions with an existing agent on the computer or handheld device of the end user which is a malicious, suspicious, or information tracking agent. This could include various viruses, malware, widgets, beacons, trackers, botnets, malvertising networks (malicious advertising networks), codes, scripts, multimedia content files or any other file or code which could be activated by or receive instructions from a second file or code.

The present invention includes a network appliance. The appliance has an interceptor which receives network traffic, such as internet, http/https downloads, email traffic and attachments, instant message transferring messages. The interceptor analyzes the network traffic for executable applications and a set of predefined rules or policies are applied to the executable applications to separate any and all unknown executable application(s). The network appliance includes a packer, which produces a wrapped executable application by wrapping the unknown executable application and a data transmission connection to deliver the wrapped executable application to an endpoint on a client in a secure manner.

In the network appliance of the present invention, the wrapping includes a sandbox and the unknown executable application is placed inside the sandbox to produce the wrapped executable application.

In an embodiment of the network appliance of the present invention, the wrapping includes providing at least one or more executable scripts with the unknown executable application. The at least one or more executable scripts are delivered with the unknown executable application as the wrapped executable application. The at least one or more executable scripts are then run on a computer or handheld device of an end user.

The network appliance of the present invention also has an embodiment where wrapping the unknown executable application includes determining if a sandbox exists on a computer or handheld device of an end user. If a sandbox already exists, the unknown executable application is extracted from the wrapped application, and then the present invention sends only the unknown executable application to the sandbox on the computer or handheld device of the end user.

The present invention also includes a system for securely delivering executables to an endpoint. The system comprises a network appliance and a client system. The network appliance has an interceptor which receives network traffic from a network and analyzes the network traffic for executable applications. The system applies a set of predefined policies or rules applied to the executable applications to separate each unknown executable application. A packer then produces a wrapped executable application by wrapping the unknown executable application. The network appliance of the system of the present invention has a connection for data transmission to deliver the wrapped executable application to a client system. The client system includes a computer network and comprises at least one computer or handheld device connected to the network, normally receiving internet, web traffic, and email traffic. The wrapped executable application is run in a sandbox on the client system. The system of the present invention includes behavior analysis performed on the wrapped executable application in the sandbox.

In the system of the present invention, the wrapping of the unknown executable application includes a sandbox and the unknown executable application is placed inside the sandbox to produce the wrapped executable application.

The system of the present invention also provides for the wrapping of the unknown executable applications to include providing at least one or more executable scripts with the unknown executable application. The one or multiple executable scripts are delivered with the unknown executable application as the wrapped executable application. The at least one or more executable scripts are then run on the at least one computer or handheld device of the end user.

The system of the present invention includes an embodiment where wrapping the unknown executable application is accomplished by first determining if a sandbox exists on a computer or handheld device of an end user. If a sandbox exists, the unknown executable application is extracted from the wrapped application and only the unknown executable application is sent to the sandbox on the at least one computer or handheld device of the end user.

The present invention and method has several advantages and features. The present invention is an effective protection against zero-day attacks and advanced persistent threats. With the present invention, the analysis is performed in the client systems, which reduces the workload of the appliance. Additionally, unlike a virtual machine solution, it cannot be bypassed by virtual machine detection. By executing threats in the client system, the present invention can retrieve the threat's precise and actual behavior(s). Further, by analyzing threats while using them, the invention provides a seamless user experience. Another feature of the present invention is that even if the analyzer of the present invention fails to detect threats, no intrusion happens in client systems because the threats are running in a sandbox environment.

DETAILED DESCRIPTION

When a user browses the internet or opens emails and attachments with their computer or handheld device, the users are also opening themselves and their computers, devices, and systems to numerous cybersecurity risks, such as malware, viruses, and phishing attacks to identify only a few. The present invention enhances the user's cybersecurity and overcomes the disadvantages of prior solutions mentioned previously. In the present invention, there is provided a network appliance for intercepting web and email traffic and downloads, then extracting executables, comparing them with a policy and wrapping it. Then, the wrapped executables are delivered to a client system where they run in a sandbox with all file system, registry accesses, communication and traffic isolated.

Referring toFIG. 1, the system and process of the present invention10is shown. The system and process includes an appliance20in communication with a client system40. Within the appliance process, internet22and web traffic24are intercepted by interceptor function26which extracts the executable files28from the traffic24. The executable files28are compared with policies30to identify suspicious executable files(s)32. These suspicious executable file(s)32are sent to a packer tool34which wraps the suspicious executable32to create a wrapped executable36which can be delivered to the client system40. The wrapped executable36is run inside a sandbox42at the client system40. At this time, behavior analysis44of the wrapped files36is also performed. This is stored at isolated storage area46, separate from communication and email or internet traffic on the client system40.

By monitoring web access and traffic, the appliance20of the present invention10extracts executable files from an HTTP/HTTPS download request, email traffic and IM transferring messages. At least one or various policies or rule sets (e.g. digital signatures, file sources, file attributes, etc.) are used to determine whether they should be wrapped. All potential suspicious executables are sent to the packer tool for sandbox wrapping. Additionally, all of the executables can be sent to the packing tool for wrapping.

Referring toFIG. 2, there is shown the packing process60used with the present invention. The packing process60includes a wrapper or wrapping function62, a target application64having unknown executable files. The target application64includes an icon66and a user account control manifest68. The process includes a packer70to pack the target application64and wrapper62together, creating wrapped application72with overlay icon74.

The packer is a tool to generate the wrapped application. It takes the following parameters as input when wrapping an application: 1.) download location to get Sandbox installer if it is not installed—this location can be either a file server or remote HTTP/HTTPS server; 2.) the path of the target application which will be wrapped; and 3.) a wrapper application which performs the main logic of the wrapper.

The process for a packer to wrap an application is as follows and also shown inFIG. 2. First, the packer70embeds a target application64into the wrapper62as a resource with fixed resource identification. Next, the packer extracts the icon66of the target application64, and adds an overlay icon74to indicate that it is secured by the sandbox and then applies it to wrapper. Next, the packer extracts the user account control (UAC) manifest68of the target application64and applies it to the wrapper62so that the wrapped application72has same UAC behavior with the target application64. In order to make the packer70independent of platforms, resource changes are performed by raw binary modification without using resource API of Windows SDK.

The wrapper sets up, a sandbox environment and runs the target application in the sandbox. As shown inFIG. 3, the wrapper process100works in the following manner: First, when the wrapper starts, it checks for a sandbox installation110. If sandbox is not installed, the wrapper gets the sandbox installer from a predefined location112(described above) and installs it with a certain configuration114. A progress bar is displayed to show the entire progress of downloading and installation. If there is a problem with downloading or installation116, the wrapper will simply exit118, thus the application will not run in this case. When the sandbox environment is ready120, it extracts the executable file(s) from the resource122, drops it on a disk124and run it in the sandbox using a sandbox launcher, e.g. sblauncher.exe [path of dropped app]126. The wrapper finally removes the dropped executable when it exits128.

The system and process of wrapping can occur in different methods. First, as described and shown inFIG. 4(a), the wrapping200is accomplished by placing the application204inside the sandbox202and delivering the entire package (sandbox202and application204) to the client system/endpoint206. InFIG. 4(b), there is shown a second method of wrapping220which includes at least one or more executable script(s)224with the unknown application222, both of which are then delivered to the client system/endpoint226. In this manner, when the application222with the script(s)224lands on the endpoint226, such as the user's computer or handheld device, the executable scripts224can be run. InFIG. 4(c), a third method of wrapping230is disclosed if there is already a sandbox236on the endpoint234. If the end user already has a sandbox application236on their device or computer, the present invention can send only the unknown application file232to the sandbox236in order to conserve data and space while securely delivering the unknown file232.

With the present invention, an alternative embodiment300is shown inFIG. 5where the appliance identifies an executable file or even a suspicious portion of a file32and sends an alert320to the client system to run the executable file in a sandbox42. This is particularly critical for security of the endpoint if an agent or agents310are currently running or exist on the client system already and the second file32is code which sends instructions330to the agent. With the monitor sending the alert320to run the file in a sandbox, it prevents the instructions330from the second file32reaching the malicious agent310. A wrapper is not necessary if there is a sandbox on a system.

During the sandboxing process, file system modifications (including creation, deletion, write, and rename) are redirected to an isolated storage area. Similarly, registry modifications (including key/value creation and deletion) are redirected to an isolated storage area. Additionally, all communication between the sandboxed application and the outside application is blocked, for example, process open, DCOM/RPC communication, etc.

The present invention also performs behaviour analysis while threats are running. For behaviour analysis of the files, all potential suspicious and dangerous behaviours are recorded and analysed. This includes: 1.) process creation and termination; 2.) file system changes; 3.) registry changes; 4.) URL access and DNS query; 5.) inter-process communication; and 6.) named objects creation.

The system and method of the present invention may be used with computer systems and devices as shown inFIGS. 6 and 7.FIG. 6illustrates a system500of a computer or device which includes a microprocessor520and a memory540which are coupled to a processor bus560which is coupled to a peripheral bus600by circuitry580. The bus600is communicatively coupled to a disk620. It should be understood that any number of additional peripheral devices are communicatively coupled to the peripheral bus600in embodiments of the invention. Further, the processor bus560, the circuitry580and the peripheral bus600compose a bus system for computing system500in various embodiments of the invention. The microprocessor520starts disk access commands to access the disk620. Commands are passed through the processor bus560via the circuitry580to the peripheral bus600which initiates the disk access commands to the disk620. In various embodiments of the invention, the present system intercepts the disk access commands which are to be passed to the hard disk.

As shown generally byFIG. 7, there is a user1000of a computer1010or handheld device1012who accesses an Internet website1020with network connections to a server1050and database1040. The computer1010or handheld device is compatible with operating systems known in the art, such as Windows, iOS or android devices or android type operating systems. The user1000is potentially exposed to many malicious or unsafe applications located on the web or a particular website1020due to lack of security and validation with the source, even though the website1020itself may be known as reliable and trusted. The website may be an application store or directory which includes other software applications for downloading. Similarly, receiving email may introduce unsafe internee links, applications and attachments to the user's computer or device. Those of skill in the art would recognize that the computer1010or hand held devices1012aor1012beach has a processor and a memory coupled with the processor where the memory is configured to provide the processor with executable instructions. A boot disk1030is present for initiating an operating system as well for each of the computer1010or hand held devices1012. It should also be noted that as used herein, the term handheld device includes phones, smart phones, tablets, personal digital assistants, media and game players and the like. It should also be understood that the user's computer or device may be part of an internal network or system which is communicating with the Internet. As used throughout the specifications, the term “query” or “queries” is used in the broadest manner to include requests, polls, calls, summons, queries, and like terms known to those of skill in the art.

FIG. 8shows an example of a generic computer device1400and a generic mobile computer device1450, which may be used to implement the processes described herein, including the mobile-side and server-side processes for installing a computer program from a mobile device to a computer. Computing device1400is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. Computing device1450is intended to represent various forms of mobile devices, such as personal digital assistants, cellular telephones, smartphones, and other similar computing devices. The components shown here, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed in this document.

Computing device1400includes a processor1402, memory1404, a storage device1406, a high-speed interface1408connecting to memory1404and high-speed expansion ports1410, and a low speed interface1412connecting to low speed bus1414and storage device1406. Each of the components1402,1404,1406,1408,1410, and1412are interconnected using various busses, and may be mounted on a common motherboard or in other manners as appropriate. The processor1402can process instructions for execution within the computing device1400, including instructions stored in the memory1404or on the storage device1406to display graphical information for a GUI on an external input/output device, such as display1416coupled to high speed interface1408. In other implementations, multiple processors and/or multiple busses may be used, as appropriate, along with multiple memories and types of memory. Also, multiple computing devices1400may be connected, with each device providing portions of the necessary operations (e.g., as a server bank, a group of blade servers, or a multi-processor system).

The memory1404stores information within the computing device1400. In one implementation, the memory1404is a volatile memory unit or units. In another implementation, the memory1404is a non-volatile memory unit or units. The memory1404may also be another form of computer-readable medium, such as a magnetic or optical disk.

The storage device1406is capable of providing mass storage for the computing device1400. In one implementation, the storage device1406may be or contain a computer-readable medium, such as a floppy disk device, a hard disk device, an optical disk device, or a tape device, a flash memory or other similar solid state memory device, or an array of devices, including devices in a storage area network or other configurations. A computer program product can be tangibly embodied in an information carrier. The computer program product may also contain instructions that, when executed, perform one or more methods, such as those described above. The information carrier may be a non-transitory computer- or machine-readable storage medium, such as the memory1404, the storage device1406, or memory on processor1402.

The high speed controller1408manages bandwidth-intensive operations for the computing device1400, while the low speed controller1412manages lower bandwidth-intensive operations. Such allocation of functions is exemplary only. In one implementation, the high-speed controller1408is coupled to memory1404, display1416(e.g., through a graphics processor or accelerator), and to high-speed expansion ports1410, which may accept various expansion cards (not shown). In the implementation, low-speed controller1412is coupled to storage device1406and low-speed expansion port1414. The low-speed expansion port1414, which may include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet), may be coupled to one or more input/output devices, such as a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, e.g., through a network adapter.

The computing device1400may be implemented in a number of different forms, as shown in the figure. For example, it may be implemented as a standard server1420, or multiple times in a group of such servers. It may also be implemented as part of a rack server system1424. In addition, it may be implemented in a personal computer such as a laptop computer1422. Alternatively, components from computing device1400may be combined with other components in a mobile device (not shown), such as device1450. Each of such devices may contain one or more of computing device1400,1450, and an entire system may be made up of multiple computing devices1400,1450communicating with each other.

Computing device1450includes a processor1452, memory1464, an input/output device such as a display1454, a communication interface1466, and a transceiver1468, among other components. The device1450may also be provided with a storage device, such as a microdrive or other device, to provide additional storage. Each of the components1450,1452,1464,1454,1466, and1468are interconnected using various busses, and several of the components may be mounted on a common motherboard or in other manners as appropriate.

The processor1452can execute instructions within the computing device1450, including instructions stored in the memory1464. The processor may be implemented as a chipset of chips that include separate and multiple analog and digital processors. The processor may provide, for example, for coordination of the other components of the device1450, such as control of user interfaces, applications run by device1450, and wireless communication by device1450.

Processor1452may communicate with a user through control interface1458and display interface1456coupled to a display1454. The display1454may be, for example, a TFT LCD (Thin-Film-Transistor Liquid Crystal Display) or an OLED (Organic Light Emitting Diode) display, or other appropriate display technology. The display interface1456may comprise appropriate circuitry for driving the display1454to present graphical and other information to a user. The control interface1458may receive commands from a user and convert them for submission to the processor1452. In addition, an external interface1462may be provided in communication with processor1452, so as to enable near area communication of device1450with other devices. External interface1462may provide, for example, for wired communication in some implementations, or for wireless communication in other implementations, and multiple interfaces may also be used.

The memory1464stores information within the computing device1450. The memory1464can be implemented as one or more of a computer-readable medium or media, a volatile memory unit or units, or a non-volatile memory unit or units. Expansion memory1474may also be provided and connected to device1450through expansion interface1472, which may include, for example, a SIMM (Single In Line Memory Module) card interface. Such expansion memory1474may provide extra storage space for device1450, or may also store applications or other information for device1450. Specifically, expansion memory1474may include instructions to carry out or supplement the processes described above, and may include secure information also. Thus, for example, expansion memory1474may be provide as a security module for device1450, and may be programmed with instructions that permit secure use of device1450. In addition, secure applications may be provided via the SIMM cards, along with additional information, such as placing identifying information on the SIMM card in a non-hackable manner.

The memory may include, for example, flash memory and/or NVRAM memory, as discussed below. In one implementation, a computer program product is tangibly embodied in an information carrier. The computer program product contains instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer- or machine-readable medium, such as the memory1464, expansion memory1474, memory on processor1452, or a propagated signal that may be received, for example, over transceiver1468or external interface1462.

Device1450may communicate wirelessly through communication interface1466, which may include digital signal processing circuitry where necessary. Communication interface1466may provide for communications under various modes or protocols, such as GSM voice calls, SMS, EMS, or MMS messaging, CDMA, TDMA, PDC, WCDMA, CDMA2000, or GPRS, among others. Such communication may occur, for example, through radio-frequency transceiver1468. In addition, short-range communication may occur, such as using a Bluetooth, Wi-Fi, or other such transceiver (not shown). In addition, GPS (Global Positioning System) receiver module1470may provide additional navigation- and location-related wireless data to device1450, which may be used as appropriate by applications running on device1450.

Device1450may also communicate audibly using audio codec1460, which may receive spoken information from a user and convert it to usable digital information. Audio codec1460may likewise generate audible sound for a user, such as through a speaker, e.g., in a handset of device1450. Such sound may include sound from voice telephone calls, may include recorded sound (e.g., voice messages, music files, etc.) and may also include sound generated by applications operating on device1450.

The computing device1450may be implemented in a number of different forms, as shown in the figure. For example, it may be implemented as a cellular telephone1480. It may also be implemented as part of a smartphone1482, personal digital assistant, or other similar mobile device.

These computer programs (also known as programs, software, software applications or code) include machine instructions for a programmable processor, and can be implemented in a high-level procedural and/or object-oriented programming language, and/or in assembly/machine language. As used herein, the terms “machine-readable medium” or “computer-readable medium” refers to any computer program product, apparatus and/or device (e.g., magnetic discs, optical disks, memory, Programmable Logic Devices (PLDs)) used to provide machine instructions and/or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The “computer readable storage medium” may be any tangible medium (but not a signal medium—which is defined below) that can contain, or store a program. The terms “machine readable medium,” “computer-readable medium,” or “computer readable storage medium” are all referencing non-transitory mediums in their nature and definition.

The term “machine-readable signal” refers to any signal used to provide machine instructions and/or data to a programmable processor. A “computer readable signal medium” may be any computer readable medium that is not a computer readable storage medium and that can communicate, propagate, or transport a program.

Elements of different implementations described herein may be combined to form other implementations not specifically set forth above. Elements may be left out of the processes, computer programs, Web pages, etc. described herein without adversely affecting their operation. Furthermore, various separate elements may be combined into one or more individual elements to perform the functions described herein.