Abstract:
A hardware device architecture is described that improves security and flexibility in access to hardware device settings. A device management proxy service is digitally signed and granted access to device settings. Applications are then digitally provisioned by the proxy service and only validated signed requests from applications are permitted to change hardware device settings. Further granularity over hardware device settings is achieved through user accounts and groups established by the applications.

Description:
FIELD OF THE INVENTION 
       [0001]    The present invention relates to the security of hardware devices running applications. 
       BACKGROUND 
       [0002]    Recent years have seen a worldwide proliferation of electronic devices. Hardware manufacturers have been able to use standard operating systems such as, for example, popular smartphone operating systems like Google Android™, Apple iOS™, and Microsoft Windows Embedded 8 Handheld™ to create a new generation of products to enhance productivity and address various challenges in both the personal and commercial realm. Further, a robust software ecosystem has emerged around many of these devices to enhance their functionality and utility and to leverage the vast amount of information and services available from the Internet. The development of applications for these devices has undeniably been a significant factor in the market adoption of many of these devices. However, this development has also driven a need for enhanced security, as it is common nowadays for the hardware manufacturer, operating system provider, and application developer to be separate entities. 
         [0003]    In the interest of increased security, the operating systems of many devices, now regularly restrict or eliminate the ability for applications to interact with hardware device settings. A current solution to this problem involves the elevation of the privileges of the application. However, the privilege rights offered by the operating systems are typically not specific enough to provide access only to the hardware settings that the application desires. The result is a different kind of security risk in that applications with elevated privileges have access to critical functionality that exceeds their needs. 
         [0004]    Therefore, there is a need for further advances in hardware device architectures that allow for operating systems to provide applications with secure and specific access to hardware device settings. 
       SUMMARY 
       [0005]    Accordingly, in one embodiment of the present invention, access to the hardware device settings are controlled by a device management proxy service (DMPS) that is digitally signed and that only accepts requests to change the hardware device settings from applications that have been provisioned on the device and send validated signed requests. 
         [0006]    In another embodiment of the present invention, access to the hardware device settings are controlled by a device management proxy service (DMPS) that is digitally signed but runs on a server as a separate service and that only accepts requests to change the hardware device settings from applications that have been provisioned on the device and send validated signed requests. 
         [0007]    In yet another exemplary embodiment of the present invention, access to the hardware device settings are controlled by a device management proxy service (DMPS) that is digitally signed but runs on a server as a separate service and that only accepts requests to change the hardware device settings from applications that have been provisioned on the device and operated with account and group privileges sufficient to send validated signed requests. 
         [0008]    The foregoing illustrative summary, as well as other exemplary objectives and/or advantages of the invention, and the manner in which the same are accomplished, are further explained within the following detailed description and its accompanying drawings. 
     
    
     
       BRIEF DESCRIPTION OF THE DRAWINGS 
         [0009]      FIG. 1  is a block diagram of the elements of the system in accordance with one embodiment of the disclosed subject matter. 
           [0010]      FIGS. 2A-2C  graphically depict different embodiments of the disclosed subject matter involving applications on the device. 
           [0011]      FIGS. 3A-3B  are schematics outlining the flow of information according to different embodiments of the disclosed subject matter involving applications on the device. 
           [0012]      FIGS. 4A-4B  are schematics outlining the initial provisioning of the device with applications according to different embodiments of the disclosed subject matter. 
           [0013]      FIGS. 5A-5D  graphically depict different embodiments of the disclosed subject matter involving device management solutions on the device. 
           [0014]      FIGS. 6A-6B  are schematics outlining the flow of information according to different embodiments of the disclosed subject matter involving device management solutions applications on the device. 
           [0015]      FIG. 7  is a schematic outlining the initial provisioning of the device with a device management solution according to one embodiment of the disclosed subject matter. 
       
    
    
     DETAILED DESCRIPTION 
       [0016]    The present invention involves the concept of applications or device management solutions using digitally signed communications to interact with operating system services in order to provide secure and managed access to hardware settings on a device. In the present disclosure, “digitally signed” is meant in the context of public/private key cryptography, i.e. digitally signed communications are messages, data, or documents that are sent with a digital certificate or identity certificate issued by a certificate authority meant to demonstrate the authenticity of the sender. In the present disclosure, “applications” refer to software applications that are offered by independent software vendors, and “device management solutions” refer to commercial mobile device management software technology applications, such as applications offered by vendors including but not limited to SOII™, LANDESK™, CITRIX™, AIRWATCH™, and the like. 
         [0017]    In the specification and/or figures, typical embodiments of the invention have been disclosed. The present invention is not limited to such exemplary embodiments. The use of the term “and/or” includes any and all combinations of one or more of the associated listed items. The figures are schematic representations and so are not necessarily drawn to scale. Unless otherwise noted, specific terms have been used in a generic and descriptive sense and not for purposes of limitation. 
         [0018]      FIG. 1  illustrates an exemplary system  100  for one embodiment of the present invention. In general, the system  100  includes a device  110  and one or more servers  130 ,  140 , and  150 . The servers  130 ,  140 , and  150  and the device  110  are connected via a network  160 . The network  160  may be any type of Wide Area Network (WAN), such as the Internet, Local Area Network (LAN), or the like, or any combination thereof, and may include wired components, such as Ethernet, wireless components, such as LTE or Wi-Fi, or both wired and wireless components. Note that while the servers  130 ,  140 , and  150  are illustrated as individual single servers, each may be alternatively be distributed across multiple servers having the respective functionality of the single servers  130 ,  140 , and  150  shown in  FIG. 1 . And still in other embodiments, the servers  130 ,  140 , and  150  may also be combined into one single server or distributed across multiple servers having the overall combined functionality of servers  130 ,  140 , and  150 . 
         [0019]    In general, the server  130  includes at least one processor  131  and associated memory  132  and a communication interface  134 . The server  130  may also include additional components such as a storage component  133 , a Device Management Proxy Service (DMPS)  220 , and a DMPS Download Service  135 , as described below. The components of server  130  may be interconnected using one more buses (not shown) and may be mounted on a motherboard (not shown) or some other appropriate configuration. 
         [0020]    In general, the server  140  includes at least one processor  141  and associated memory  142  and a communication interface  144 . The server  140  may also include additional components such as a storage component  143  and an application download service  145  and an application certificate service  146 , as described below. The components of server  140  may be interconnected using one more buses (not shown) and may be mounted on a motherboard (not shown) or some other appropriate configuration. In one embodiment, the device  110  may download digitally signed and provisioned applications  210  from the app download service  145  of server  140 , or may obtain new or updated provisioning certificates for applications  210 , user accounts  270 , and/or groups  275  from the app certificate service  146  on server  140 . In another embodiment, the device  110  may side load applications and/or certificates directly. 
         [0021]    In general, the server  150  includes at least one processor  151  and associated memory  152  and a communication interface  154 . The server  150  may also include additional components such as a storage component  153  and the server component of a device management solution, as described below. The components of server  150  may be interconnected using one more buses (not shown) and may be mounted on a motherboard (not shown) or some other appropriate configuration. 
         [0022]    In general, the device  110  includes a processor  118  and associated memory  117  as well as a communication interface  119 . The device  110  may include additional components such as a storage component  114  such as a hard drive or solid state drive, a location determination component  111  such as a Global Positioning System (GPS) chip, audio input component  112  such as a microphone, audio output component  113  such as a speaker, visual input component  115  such as a camera or barcode reader, visual output component  116  such as a display, and a user input component  120  such as a touchscreen, navigation shuttle, soft keys, or the like, an external storage component  121  such as a smart media card, micro Secure Digital card or the like, a hardware security module (HSM)  122 , application settings  123  which are used to configure applications installed on the device  110  and may be stored in the storage  114  or memory  117  or a combination of both, and system settings which are used to configure the device  110  and may be stored in the storage  114  or memory  117  or a combination of both. The components of device  110  may be interconnected using one more buses (not shown) and may be mounted on a motherboard (not shown) or some other appropriate configuration. Examples of device  110  include, but are not limited to, consumer electronics such as smartphones, tablets, televisions, media players, smart watches, personal navigation devices, and health/activity trackers, and commercial electronics such as rugged mobile computers, vehicle mount computers, wearable scanners, barcode scanners, radio frequency identification (RFID) scanners, intelligent sensors, and tracking devices. 
         [0023]      FIG. 2A  illustrates one embodiment of the present invention. Application  210  is installed on device  110  in its own trust level, an application trust level, which is separate and distinct from the operating system trust level. The separate trust levels offer security on the device  110  so that applications cannot make changes to the hardware settings of the device  110  except through the mechanisms described in the present invention. At the operating system trust level, device  110  has a DMPS  220 , a storage repository for storing digital certificates, i.e. a certificate repository  250 , and an operating system driver  230  that interacts and controls the hardware elements  240  of the device. 
         [0024]    The DMPS  220  is signed and provisioned by the operating system. In some embodiments, the DMPS  220  is included in the operating system image installed on the device by the manufacturer. In other embodiments, the DMPS  220  is loaded on the device  110  after manufacture, such as from a DMPS download service  135 , but is still digitally signed and provisioned using the operating system vendor certificates. 
         [0025]    The DMPS  220  is used on the device  110  to install and manage application certificates. The DMPS  220  may be implemented as a lightweight service, such as a daemon, that runs in the background or may be implemented as a device driver. In some embodiments, the DMPS  220  and storage repository for storing digital certificates  250  run on the hardware security module  122 . The combination of the DMPS  220  and the certificate repository  250  on the HSM  122  ensure tamper-proof handling of the certificates. 
         [0026]    The operating system driver  230  interacts with the DMPS  220  to relay hardware setting changes to the hardware elements  240  of the device. Settings that may be altered using the operating system driver  230  include, but are not limited to display settings, network settings, power management settings, global positioning system (GPS) settings, audio settings, user account settings, user personalization settings, time settings, file management settings, system settings, security settings, camera settings, and barcode scanner/reader settings. In some embodiments, the operating system driver is provisioned by the operating system vendor by inclusion in the operating system image installed on the device. 
         [0027]    The application  210  and the DMPS  220  interact through a cross process communication, such as remote procedure calls (RPC) or system calls such as input/output control (ioctl) using a device management application programming interface (API)  290  over a protocol. 
         [0028]    The DMPS  220  and the operating system driver  230  interact through a device driver API over a protocol. The operating system driver  230  has the ability to directly change the settings of the hardware element  240 . 
         [0029]      FIG. 3A  illustrates the communication flow between the application  210  and the DMPS  220 . The application  210  first generates a digitally signed request to the DMPS  220  to change a hardware setting in a hardware element  240  (step  3 A- 1 ). The request is digitally signed using the application&#39;s digital certificate. The DMPS  220  retrieves the application&#39;s digital certificate from the certificate repository  250  (step  3 A- 2 ). The DMPS  220  then validates the digitally signed request using the retrieved application certificate (Step  3 A- 3 ). If validated, then the DMPS  220  sends the request to change the hardware setting to the operating system driver  230  (Step  3 A- 4 ) which then changes the setting of the hardware element  240  (step  3 A- 5 ). 
         [0030]      FIG. 2B  illustrates another embodiment of the present invention. The embodiment in  FIG. 2B  is similar to  FIG. 2A  with the exception that user accounts  270  and/or groups  275  have been included in the application  210 . In this embodiment, the application  210  has user and/or group privileges defined that control the functions of the application that are available to particular users or groups of users of the application. 
         [0031]      FIG. 3B  is similar to  FIG. 3A  in that it illustrates the communication flow between the application  210  and the DMPS  220 , but  FIG. 3B  further illustrates the involvement of the user accounts  270  and/or groups  275 . A user first logs into the application  210  on the device  110  (Step  3 B- 1 ). The application  210  then validates the user&#39;s login (Step  3 B- 2 ). If the user is validated, then the application  210  controls the application functions with which the user may interact according to the user&#39;s login and/or group credentials. The applications functions controlled by the credentials include the ability of the user to generate hardware changes with the application. If permitted, the application  210  then generates a digitally signed request to the DMPS  220  to change a hardware setting in a hardware element  240  (step  3 B- 3 ). The request is digitally signed using the application&#39;s digital certificate. The DMPS  220  retrieves the application&#39;s digital certificate from the certificate repository  250  (step  3 B- 4 ). The DMPS  220  then validates the digitally signed request using the retrieved application certificate (Step  3 B- 5 ). If validated, then the DMPS  220  sends the request to change the hardware setting to the operating system driver  230  (Step  3 B- 6 ) which then changes the setting of the hardware element  240  (step  3 B- 7 ). 
         [0032]      FIG. 2C  illustrates another embodiment of the present invention. The embodiment in  FIG. 2C  is similar to  FIG. 2B  with the exception that in  FIG. 2C  the DMPS  220  is no longer running on the device  110  as in  FIG. 2B  but is now running on server  130  as a service over the network  160 . 
         [0033]      FIG. 4A  illustrates the initial provisioning process according to one embodiment of the present invention. In this embodiment, the DMPS  220  utilizes an open API that accepts incoming connections from any application  210  (Step  4 A- 1 ). An application  210  is installed on the device  110  and attempts to communicate with the DMPS  220 . Once the communication has been established between the DMPS  220  and the application  210 , the application  210  sends its application certificate to the DMPS (Step  4 A- 2 ). Once the application certificate has been received, the DMPS  220  stores it in the certificate repository  250  (Step  4 A- 3 ). In this embodiment, the DMPS  220  has been programmed to close the open API once an application certificate has been provisioned and receive only incoming communications from that point on if they have been digitally signed with the application certificate (Step  4 A- 4 ). In other embodiments, the DMPS  220  is programmed to accept digital certificates from a pre-programmed number of different applications before closing the open API. For example, in one embodiment, the DMPS  220  could be programmed to accept digital certificates from up to 3 applications. In this instance, the DMPS  220  accepts application certificates from the first three unique applications with which it communicates. The very next unique application that tries to communicate with the DMPS  220  and send its digital certificate is not provisioned. 
         [0034]      FIG. 4B  illustrates the initial provisioning process according to another embodiment of the present invention. In this embodiment, the certificate repository  250  on the device  110  is first provisioned with a certificate from the provider of the DMPS  220 , i.e. a DMPS certificate (Step  4 B- 1 ). The DMPS certificate could be installed in the certificate repository  250  as part of the operating system image used to manufacture the device or could be downloaded to the device  110  after manufacture from a DMPS download service  135  from server  130 . The DMPS  220  utilizes a proprietary API that accepts incoming connections from any application  210  that is provisioned with the DMPS certificate (Step  4 B- 2 ). An application  210  that has been signed with the DMPS certificate (Step  4 B- 3 ) is installed on the device  110  and attempts to communicate with the DMPS  220  by sending its application certificate in a communication request that is digitally signed using the DMPS certificate (Step  4 B- 4 ). The DMPS  220  then retrieves the DMPS certificate from the certificate repository  250  (Step  4 B- 5 ). The DMPS  220  then validates the signature of the application message using the DMPS certificate (Step  4 B- 6 ). If validated, the DMPS  220  then stores the application&#39;s certificate in the certificate repository  250  (Step  4 B- 7 ). In this embodiment, the DMPS  220  has been programmed to close the proprietary API once an application certificate has been provisioned and receive only incoming communications from that point on if they have been digitally signed with the application certificate. In other embodiments, the DMPS  220  may keep the proprietary API open and accept incoming communications and digital certificates from any application that has been digitally signed using the DMPS certificate. 
         [0035]      FIG. 5A  illustrates one embodiment of the present invention. In this embodiment, a device management solution is installed on the device  110 . The device management solution may involve a device management server  260  component and a device management client  265  component. Again, the device management solution  260  and  265  is installed on device  110  in its own trust level, a device management trust level, which is separate and distinct from the operating system trust level. The separate trust levels offer security on the device  110  so that device management solutions cannot make changes to the hardware settings of the device  110  except through the mechanisms described in the present invention. At the operating system trust level, device  110  has a DMPS  220 , a storage repository for storing digital certificates, i.e. a certificate repository  250 , and an operating system driver  230  that interacts and controls the hardware elements  240  of the device. 
         [0036]    The DMPS  220  is signed and provisioned by the operating system. In some embodiments, the DMPS  220  is included in the operating system image installed on the device by the manufacturer. In other embodiments, the DMPS  220  is loaded on the device  110  after manufacture, such as from a DMPS download service  135 , but is still digitally signed and provisioned using the operating system vendor certificates. 
         [0037]    The DMPS  220  is used on the device  110  to install and manage the device management client certificates. The DMPS  220  may be implemented as a lightweight service, such as a daemon, that runs in the background or may be implemented as a device driver. In some embodiments, the DMPS  220  and certificate repository  250  run on the hardware security module  122 . The combination of the DMPS  220  and the certificate repository  250  on the HSM  122  ensure tamper-proof handling of the certificates. 
         [0038]    The operating system driver  230  interacts with the DMPS  220  to relay hardware setting changes to the hardware elements  240  of the device. Settings that may be altered using the operating system driver  230  include, but are not limited to display settings, network settings, power management settings, global positioning system (GPS) settings, audio settings, user account settings, user personalization settings, time settings, file management settings, system settings, security settings, camera settings, and barcode scanner/reader settings. In some embodiments, the operating system driver is provisioned by the operating system vendor by inclusion in the operating system image installed on the device. 
         [0039]    The device management server  260  and the device management client  265  communicate using a proprietary protocol from the provider of the device management solution. The device management client  265  and the DMPS  220  interact through a cross process communication, such as remote procedure calls (RPC) or system calls such as input/output control (ioctl) using a device management application programming interface (API)  290  over a protocol. 
         [0040]    The DMPS  220  and the operating system driver  230  interact through a device driver API over a protocol. The operating system driver  230  has the ability to directly change the settings of the hardware element  240 . 
         [0041]      FIG. 6A  illustrates the communication flow between the device management client  265  and the DMPS  220 . The device management client  265  first generates a digitally signed request to the DMPS  220  to change a hardware setting in a hardware element  240  (step  6 A- 1 ). The request is digitally signed using the device management client&#39;s digital certificate. The DMPS  220  retrieves the device management client&#39;s digital certificate from the certificate repository  250  (step  6 A- 2 ). The DMPS  220  then validates the digitally signed request using the retrieved device management client certificate (Step  6 A- 3 ). If validated, then the DMPS  220  sends the request to change the hardware setting to the operating system driver  230  (Step  6 A- 4 ) which then changes the setting of the hardware element  240  (step  6 A- 5 ). In some embodiments, the device management client  265  is authorized to access the operating system driver  230  directly (Step  6 A- 6 ) to effect a change in the setting of the hardware element (Step  6 A- 7 ). In this embodiment, the device management solution has the ability to change some hardware settings directly, i.e. native support to change some hardware settings, but has its abilities augmented to change additional hardware settings through the DMPS  220  that may not be natively supported. 
         [0042]      FIG. 5B  illustrates another embodiment of the present invention. The embodiment in  FIG. 5B  is similar to  FIG. 5A  with the exception that user accounts  280  and/or groups  285  have been included in the device management server  260 . In this embodiment, the device management server  260  has user and/or group privileges defined that control the functions of the device management client  265  that are available to particular users or groups of users of the device management client  265 . 
         [0043]      FIG. 6B  is similar to  FIG. 6A  in that it illustrates the communication flow between the device management client  265  and the DMPS  220 , but  FIG. 6B  further illustrates the involvement of the user accounts  280  and/or groups  285 . A user first logs into the device management client  265  on the device  110  (Step  6 B- 1 ). The device management client  265  then communicates with the device management server  260  to authenticate the login (Step  6 B- 2 ). If the user is validated, then the device management client  265  controls the device management client with which the user may interact according to the user&#39;s login and/or group credentials set at the device management server  260 . The device management client functions controlled by the credentials include the ability of the user to generate hardware changes through the device management client. If permitted, the device management client  265  then generates a digitally signed request to the DMPS  220  to change a hardware setting in a hardware element  240  (step  6 B- 3 ). The request is digitally signed using the device management client&#39;s digital certificate. The DMPS  220  retrieves the device management client&#39;s digital certificate from the certificate repository  250  (step  6 B- 4 ). The DMPS  220  then validates the digitally signed request using the retrieved device management client certificate (Step  6 B- 5 ). If validated, then the DMPS  220  sends the request to change the hardware setting to the operating system driver  230  (Step  6 B- 6 ) which then changes the setting of the hardware element  240  (step  6 B- 7 ). In some embodiments, the device management client  265  is authorized to access the operating system driver  230  directly (Step  6 B- 8 ) to effect a change in the setting of the hardware element (Step  6 B- 9 ). In this embodiment, the device management solution has the ability to change some hardware settings directly, i.e. native support to change some hardware settings, but has its abilities augmented to change additional hardware settings through the DMPS  220  that may not be natively supported. 
         [0044]      FIG. 5C  illustrates another embodiment of the present invention. The embodiment in  FIG. 5C  is similar to  FIG. 5B  with the exception that in  FIG. 5C  the DMPS  220  is no longer running on the device  110  as in  FIG. 5B  but is now running on server  130  as a service over the network  160 . 
         [0045]      FIG. 5D  illustrates another embodiment of the present invention. The embodiment in  FIG. 5D  is similar to  FIG. 5C  with the exception that in  FIG. 5D  the device management server  260  is no longer running on the device  110  as in  FIG. 5C  but is now running on server  150  as a service over the network  160 . 
         [0046]      FIG. 7  illustrates the initial provisioning process according to one embodiment of the present invention. In this embodiment, the DMPS  220  utilizes an open API that accepts incoming connections from any device management client  265  (Step  7 - 1 ). A device management client  265  is installed on the device  110 , retrieves the device management client certificate from the device management server  260  (Step  7 - 2 ) which may be running on its own server  150  over the network  160 , and attempts to communicate with the DMPS  220 . Once the communication has been established between the DMPS  220  and the device management client  265 , the device management client  265  sends the device management client certificate to the DMPS (Step  7 - 3 ). Once the device management client certificate has been received, the DMPS  220  stores it in the certificate repository  250  (Step  7 - 4 ). In this embodiment, the DMPS  220  has been programmed to close the open API once a device management client certificate has been provisioned and receive only incoming communications from that point on if they have been digitally signed with the device management certificate (Step  7 - 5 ). In other embodiments, the DMPS  220  is programmed to accept digital certificates from a pre-programmed number of different device management clients before closing the open API. In yet other embodiments, the DMPS  220  may continue to utilize the open API to accept incoming connections from any device management solution that may be installed on the device  110 . 
         [0047]    Several implementations have been described herein. However, it will be understood that various modifications may be made without departing from the spirit and scope of the invention. 
         [0048]    Additionally, the communication flows in the schematics of the figures do not require the particular order shown or sequential order to achieve the specified results. Further, other steps may be provided or eliminated from the schematics and other components may be added to or removed from the described systems. These other implementations are within the scope of the claims. 
         [0049]    To supplement the present disclosure, this application incorporates entirely by reference the following commonly assigned patents, patent application publications, and patent applications:
   U.S. Pat. No. 6,832,725; U.S. Pat. No. 7,128,266;   U.S. Pat. No. 7,159,783; U.S. Pat. No. 7,413,127;   U.S. Pat. No. 7,726,575; U.S. Pat. No. 8,294,969;   U.S. Pat. No. 8,317,105; U.S. Pat. No. 8,322,622;   U.S. Pat. No. 8,366,005; U.S. Pat. No. 8,371,507;   U.S. Pat. No. 8,376,233; U.S. Pat. No. 8,381,979;   U.S. Pat. No. 8,390,909; U.S. Pat. No. 8,408,464;   U.S. Pat. No. 8,408,468; U.S. Pat. No. 8,408,469;   U.S. Pat. No. 8,424,768; U.S. Pat. No. 8,448,863;   U.S. Pat. No. 8,457,013; U.S. Pat. No. 8,459,557;   U.S. Pat. No. 8,469,272; U.S. Pat. No. 8,474,712;   U.S. Pat. No. 8,479,992; U.S. Pat. No. 8,490,877;   U.S. Pat. No. 8,517,271; U.S. Pat. No. 8,523,076;   U.S. Pat. No. 8,528,818; U.S. Pat. No. 8,544,737;   U.S. Pat. No. 8,548,242; U.S. Pat. No. 8,548,420;   U.S. Pat. No. 8,550,335; U.S. Pat. No. 8,550,354;   U.S. Pat. No. 8,550,357; U.S. Pat. No. 8,556,174;   U.S. Pat. No. 8,556,176; U.S. Pat. No. 8,556,177;   U.S. Pat. No. 8,559,767; U.S. Pat. No. 8,599,957;   U.S. Pat. No. 8,561,895; U.S. Pat. No. 8,561,903;   U.S. Pat. No. 8,561,905; U.S. Pat. No. 8,565,107;   U.S. Pat. No. 8,571,307; U.S. Pat. No. 8,579,200;   U.S. Pat. No. 8,583,924; U.S. Pat. No. 8,584,945;   U.S. Pat. No. 8,587,595; U.S. Pat. No. 8,587,697;   U.S. Pat. No. 8,588,869; U.S. Pat. No. 8,590,789;   U.S. Pat. No. 8,596,539; U.S. Pat. No. 8,596,542;   U.S. Pat. No. 8,596,543; U.S. Pat. No. 8,599,271;   U.S. Pat. No. 8,599,957; U.S. Pat. No. 8,600,158;   U.S. Pat. No. 8,600,167; U.S. Pat. No. 8,602,309;   U.S. Pat. No. 8,608,053; U.S. Pat. No. 8,608,071;   U.S. Pat. No. 8,611,309; U.S. Pat. No. 8,615,487;   U.S. Pat. No. 8,616,454; U.S. Pat. No. 8,621,123;   U.S. Pat. No. 8,622,303; U.S. Pat. No. 8,628,013;   U.S. Pat. No. 8,628,015; U.S. Pat. No. 8,628,016;   U.S. Pat. No. 8,629,926; U.S. Pat. No. 8,630,491;   U.S. Pat. No. 8,635,309; U.S. Pat. No. 8,636,200;   U.S. Pat. No. 8,636,212; U.S. Pat. No. 8,636,215;   U.S. Pat. No. 8,636,224; U.S. Pat. No. 8,638,806;   U.S. Pat. No. 8,640,958; U.S. Pat. No. 8,640,960;   U.S. Pat. No. 8,643,717; U.S. Pat. No. 8,646,692;   U.S. Pat. No. 8,646,694; U.S. Pat. No. 8,657,200;   U.S. Pat. No. 8,659,397; U.S. Pat. No. 8,668,149;   U.S. Pat. No. 8,678,285; U.S. Pat. No. 8,678,286;   U.S. Pat. No. 8,682,077; U.S. Pat. No. 8,687,282;   U.S. Pat. No. 8,692,927; U.S. Pat. No. 8,695,880;   U.S. Pat. No. 8,698,949; U.S. Pat. No. 8,717,494;   U.S. Pat. No. 8,717,494; U.S. Pat. No. 8,720,783;   U.S. Pat. No. 8,723,804; U.S. Pat. No. 8,723,904;   U.S. Pat. No. 8,727,223; U.S. Pat. No. D702,237;   U.S. Pat. No. 8,740,082; U.S. Pat. No. 8,740,085;   U.S. Pat. No. 8,746,563; U.S. Pat. No. 8,750,445;   U.S. Pat. No. 8,752,766; U.S. Pat. No. 8,756,059;   U.S. Pat. No. 8,757,495; U.S. Pat. No. 8,760,563;   U.S. Pat. No. 8,763,909; U.S. Pat. No. 8,777,108;   U.S. Pat. No. 8,777,109; U.S. Pat. No. 8,779,898;   U.S. Pat. No. 8,781,520; U.S. Pat. No. 8,783,573;   U.S. Pat. No. 8,789,757; U.S. Pat. No. 8,789,758;   U.S. Pat. No. 8,789,759; U.S. Pat. No. 8,794,520;   U.S. Pat. No. 8,794,522; U.S. Pat. No. 8,794,526;   U.S. Pat. No. 8,798,367; U.S. Pat. No. 8,807,431;   U.S. Pat. No. 8,807,432; U.S. Pat. No. 8,820,630;   International Publication No. 2013/163789;   International Publication No. 2013/173985;   International Publication No. 2014/019130;   International Publication No. 2014/110495;   U.S. Patent Application Publication No. 2008/0185432;   U.S. Patent Application Publication No. 2009/0134221;   U.S. Patent Application Publication No. 2010/0177080;   U.S. Patent Application Publication No. 2010/0177076;   U.S. Patent Application Publication No. 2010/0177707;   U.S. Patent Application Publication No. 2010/0177749;   U.S. Patent Application Publication No. 2011/0202554;   U.S. Patent Application Publication No. 2012/0111946;   U.S. Patent Application Publication No. 2012/0138685;   U.S. Patent Application Publication No. 2012/0168511;   U.S. Patent Application Publication No. 2012/0168512;   U.S. Patent Application Publication No. 2012/0193423;   U.S. Patent Application Publication No. 2012/0203647;   U.S. Patent Application Publication No. 2012/0223141;   U.S. Patent Application Publication No. 2012/0228382;   U.S. Patent Application Publication No. 2012/0248188;   U.S. Patent Application Publication No. 2013/0043312;   U.S. Patent Application Publication No. 2013/0056285;   U.S. Patent Application Publication No. 2013/0070322;   U.S. Patent Application Publication No. 2013/0075168;   U.S. Patent Application Publication No. 2013/0082104;   U.S. Patent Application Publication No. 2013/0175341;   U.S. Patent Application Publication No. 2013/0175343;   U.S. Patent Application Publication No. 2013/0200158;   U.S. Patent Application Publication No. 2013/0256418;   U.S. Patent Application Publication No. 2013/0257744;   U.S. Patent Application Publication No. 2013/0257759;   U.S. Patent Application Publication No. 2013/0270346;   U.S. Patent Application Publication No. 2013/0278425;   U.S. Patent Application Publication No. 2013/0287258;   U.S. Patent Application Publication No. 2013/0292475;   U.S. Patent Application Publication No. 2013/0292477;   U.S. Patent Application Publication No. 2013/0293539;   U.S. Patent Application Publication No. 2013/0293540;   U.S. Patent Application Publication No. 2013/0306728;   U.S. Patent Application Publication No. 2013/0306730;   U.S. Patent Application Publication No. 2013/0306731;   U.S. Patent Application Publication No. 2013/0307964;   U.S. Patent Application Publication No. 2013/0308625;   U.S. Patent Application Publication No. 2013/0313324;   U.S. Patent Application Publication No. 2013/0313325;   U.S. Patent Application Publication No. 2013/0341399;   U.S. Patent Application Publication No. 2013/0342717;   U.S. Patent Application Publication No. 2014/0001267;   U.S. Patent Application Publication No. 2014/0002828;   U.S. Patent Application Publication No. 2014/0008430;   U.S. Patent Application Publication No. 2014/0008439;   U.S. Patent Application Publication No. 2014/0025584;   U.S. Patent Application Publication No. 2014/0027518;   U.S. Patent Application Publication No. 2014/0034734;   U.S. Patent Application Publication No. 2014/0036848;   U.S. Patent Application Publication No. 2014/0039693;   U.S. Patent Application Publication No. 2014/0042814;   U.S. Patent Application Publication No. 2014/0049120;   U.S. Patent Application Publication No. 2014/0049635;   U.S. Patent Application Publication No. 2014/0061305;   U.S. Patent Application Publication No. 2014/0061306;   U.S. Patent Application Publication No. 2014/0063289;   U.S. Patent Application Publication No. 2014/0066136;   U.S. Patent Application Publication No. 2014/0067692;   U.S. Patent Application Publication No. 2014/0070005;   U.S. Patent Application Publication No. 2014/0071840;   U.S. Patent Application Publication No. 2014/0074746;   U.S. Patent Application Publication No. 2014/0075846;   U.S. Patent Application Publication No. 2014/0076974;   U.S. Patent Application Publication No. 2014/0078341;   U.S. Patent Application Publication No. 2014/0078342;   U.S. Patent Application Publication No. 2014/0078345;   U.S. Patent Application Publication No. 2014/0084068;   U.S. Patent Application Publication No. 2014/0097249;   U.S. Patent Application Publication No. 2014/0098792;   U.S. Patent Application Publication No. 2014/0100774;   U.S. Patent Application Publication No. 2014/0100813;   U.S. Patent Application Publication No. 2014/0103115;   U.S. Patent Application Publication No. 2014/0104413;   U.S. Patent Application Publication No. 2014/0104414;   U.S. Patent Application Publication No. 2014/0104416;   U.S. Patent Application Publication No. 2014/0104451;   U.S. Patent Application Publication No. 2014/0106594;   U.S. Patent Application Publication No. 2014/0106725;   U.S. Patent Application Publication No. 2014/0108010;   U.S. Patent Application Publication No. 2014/0108402;   U.S. Patent Application Publication No. 2014/0108682;   U.S. Patent Application Publication No. 2014/0110485;   U.S. Patent Application Publication No. 2014/0114530;   U.S. Patent Application Publication No. 2014/0124577;   U.S. Patent Application Publication No. 2014/0124579;   U.S. Patent Application Publication No. 2014/0125842;   U.S. Patent Application Publication No. 2014/0125853;   U.S. Patent Application Publication No. 2014/0125999;   U.S. Patent Application Publication No. 2014/0129378;   U.S. Patent Application Publication No. 2014/0131438;   U.S. Patent Application Publication No. 2014/0131441;   U.S. Patent Application Publication No. 2014/0131443;   U.S. Patent Application Publication No. 2014/0131444;   U.S. Patent Application Publication No. 2014/0131445;   U.S. Patent Application Publication No. 2014/0131448;   U.S. Patent Application Publication No. 2014/0133379;   U.S. Patent Application Publication No. 2014/0136208;   U.S. Patent Application Publication No. 2014/0140585;   U.S. Patent Application Publication No. 2014/0151453;   U.S. Patent Application Publication No. 2014/0152882;   U.S. Patent Application Publication No. 2014/0158770;   U.S. Patent Application Publication No. 2014/0159869;   U.S. Patent Application Publication No. 2014/0160329;   U.S. Patent Application Publication No. 2014/0166755;   U.S. Patent Application Publication No. 2014/0166757;   U.S. Patent Application Publication No. 2014/0166759;   U.S. Patent Application Publication No. 2014/0166760;   U.S. Patent Application Publication No. 2014/0166761;   U.S. Patent Application Publication No. 2014/0168787;   U.S. Patent Application Publication No. 2014/0175165;   U.S. Patent Application Publication No. 2014/0175169;   U.S. Patent Application Publication No. 2014/0175172;   U.S. Patent Application Publication No. 2014/0175174;   U.S. Patent Application Publication No. 2014/0191644;   U.S. Patent Application Publication No. 2014/0191913;   U.S. Patent Application Publication No. 2014/0197238;   U.S. Patent Application Publication No. 2014/0197239;   U.S. Patent Application Publication No. 2014/0197304;   U.S. Patent Application Publication No. 2014/0203087;   U.S. Patent Application Publication No. 2014/0204268;   U.S. Patent Application Publication No. 2014/0214631;   U.S. Patent Application Publication No. 2014/0217166;   U.S. Patent Application Publication No. 2014/0217180;   U.S. patent application Ser. No. 13/367,978 for a Laser Scanning Module Employing an Elastomeric U-Hinge Based Laser Scanning Assembly, filed Feb. 7, 2012 (Feng et al.);   U.S. patent application Ser. No. 29/436,337 for an Electronic Device, filed Nov. 5, 2012 (Fitch et al.);   U.S. patent application Ser. No. 13/771,508 for an Optical Redirection Adapter, filed Feb. 20, 2013 (Anderson);   U.S. patent application Ser. No. 13/852,097 for a System and Method for Capturing and Preserving Vehicle Event Data, filed Mar. 28, 2013 (Barker et al.);   U.S. patent application Ser. No. 13/902,110 for a System and Method for Display of Information Using a Vehicle-Mount Computer, filed May 24, 2013 (Hollifield);   U.S. patent application Ser. No. 13/902,144, for a System and Method for Display of Information Using a Vehicle-Mount Computer, filed May 24, 2013 (Chamberlin);   U.S. patent application Ser. No. 13/902,242 for a System For Providing A Continuous Communication Link With A Symbol Reading Device, filed May 24, 2013 (Smith et al.);   U.S. patent application Ser. No. 13/912,262 for a Method of Error Correction for 3D Imaging Device, filed Jun. 7, 2013 (Jovanovski et al.);   U.S. patent application Ser. No. 13/912,702 for a System and Method for Reading Code Symbols at Long Range Using Source Power Control, filed Jun. 7, 2013 (Xian et al.);   U.S. patent application Ser. No. 29/458,405 for an Electronic Device, filed Jun. 19, 2013 (Fitch et al.);   U.S. patent application Ser. No. 13/922,339 for a System and Method for Reading Code Symbols Using a Variable Field of View, filed Jun. 20, 2013 (Xian et al.);   U.S. patent application Ser. No. 13/927,398 for a Code Symbol Reading System Having Adaptive Autofocus, filed Jun. 26, 2013 (Todeschini);   U.S. patent application Ser. No. 13/930,913 for a Mobile Device Having an Improved User Interface for Reading Code Symbols, filed Jun. 28, 2013 (Gelay et al.);   U.S. patent application Ser. No. 29/459,620 for an Electronic Device Enclosure, filed Jul. 2, 2013 (London et al.);   U.S. patent application Ser. No. 29/459,681 for an Electronic Device Enclosure, filed Jul. 2, 2013 (Chaney et al.);   U.S. patent application Ser. No. 13/933,415 for an Electronic Device Case, filed Jul. 2, 2013 (London et al.);   U.S. patent application Ser. No. 29/459,785 for a Scanner and Charging Base, filed Jul. 3, 2013 (Fitch et al.);   U.S. patent application Ser. No. 29/459,823 for a Scanner, filed Jul. 3, 2013 (Zhou et al.);   U.S. patent application Ser. No. 13/947,296 for a System and Method for Selectively Reading Code Symbols, filed Jul. 22, 2013 (Rueblinger et al.);   U.S. patent application Ser. No. 13/950,544 for a Code Symbol Reading System Having Adjustable Object Detection, filed Jul. 25, 2013 (Jiang);   U.S. patent application Ser. No. 13/961,408 for a Method for Manufacturing Laser Scanners, filed Aug. 7, 2013 (Saber et al.);   U.S. patent application Ser. No. 14/018,729 for a Method for Operating a Laser Scanner, filed Sep. 5, 2013 (Feng et al.);   U.S. patent application Ser. No. 14/019,616 for a Device Having Light Source to Reduce Surface Pathogens, filed Sep. 6, 2013 (Todeschini);   U.S. patent application Ser. No. 14/023,762 for a Handheld Indicia Reader Having Locking Endcap, filed Sep. 11, 2013 (Gannon);   U.S. patent application Ser. No. 14/035,474 for Augmented-Reality Signature Capture, filed Sep. 24, 2013 (Todeschini);   U.S. patent application Ser. No. 29/468,118 for an Electronic Device Case, filed Sep. 26, 2013 (Oberpriller et al.);   U.S. patent application Ser. No. 14/055,234 for Dimensioning System, filed Oct. 16, 2013 (Fletcher);   U.S. patent application Ser. No. 14/053,314 for Indicia Reader, filed Oct. 14, 2013 (Huck);   U.S. patent application Ser. No. 14/065,768 for Hybrid System and Method for Reading Indicia, filed Oct. 29, 2013 (Meier et al.);   U.S. patent application Ser. No. 14/074,746 for Self-Checkout Shopping System, filed Nov. 8, 2013 (Hejl et al.);   U.S. patent application Ser. No. 14/074,787 for Method and System for Configuring Mobile Devices via NFC Technology, filed Nov. 8, 2013 (Smith et al.);   U.S. patent application Ser. No. 14/087,190 for Optimal Range Indicators for Bar Code Validation, filed Nov. 22, 2013 (Hejl);   U.S. patent application Ser. No. 14/094,087 for Method and System for Communicating Information in an Digital Signal, filed Dec. 2, 2013 (Peake et al.);   U.S. patent application Ser. No. 14/101,965 for High Dynamic-Range Indicia Reading System, filed Dec. 10, 2013 (Xian);   U.S. patent application Ser. No. 14/150,393 for Indicia-reader Having Unitary Construction Scanner, filed Jan. 8, 2014 (Colavito et al.);   U.S. patent application Ser. No. 14/154,207 for Laser Barcode Scanner, filed Jan. 14, 2014 (Hou et al.);   U.S. patent application Ser. No. 14/165,980 for System and Method for Measuring Irregular Objects with a Single Camera filed Jan. 28, 2014 (Li et al.);   U.S. patent application Ser. No. 14/166,103 for Indicia Reading Terminal Including Optical Filter filed Jan. 28, 2014 (Lu et al.);   U.S. patent application Ser. No. 14/200,405 for Indicia Reader for Size-Limited Applications filed Mar. 7, 2014 (Feng et al.);   U.S. patent application Ser. No. 14/231,898 for Hand-Mounted Indicia-Reading Device with Finger Motion Triggering filed Apr. 1, 2014 (Van Horn et al.);   U.S. patent application Ser. No. 14/250,923 for Reading Apparatus Having Partial Frame Operating Mode filed Apr. 11, 2014, (Deng et al.);   U.S. patent application Ser. No. 14/257,174 for Imaging Terminal Having Data Compression filed Apr. 21, 2014, (Barber et al.);   U.S. patent application Ser. No. 14/257,364 for Docking System and Method Using Near Field Communication filed Apr. 21, 2014 (Showering);   U.S. patent application Ser. No. 14/264,173 for Autofocus Lens System for Indicia Readers filed Apr. 29, 2014 (Ackley et al.);   U.S. patent application Ser. No. 14/274,858 for Mobile Printer with Optional Battery Accessory filed May 12, 2014 (Marty et al.);   U.S. patent application Ser. No. 14/277,337 for MULTIPURPOSE OPTICAL READER, filed May 14, 2014 (Jovanovski et al.);   U.S. patent application Ser. No. 14/283,282 for TERMINAL HAVING ILLUMINATION AND FOCUS CONTROL filed May 21, 2014 (Liu et al.);   U.S. patent application Ser. No. 14/300,276 for METHOD AND SYSTEM FOR CONSIDERING INFORMATION ABOUT AN EXPECTED RESPONSE WHEN PERFORMING SPEECH RECOGNITION, filed Jun. 10, 2014 (Braho et al.);   U.S. patent application Ser. No. 14/305,153 for INDICIA READING SYSTEM EMPLOYING DIGITAL GAIN CONTROL filed Jun. 16, 2014 (Xian et al.);   U.S. patent application Ser. No. 14/310,226 for AUTOFOCUSING OPTICAL IMAGING DEVICE filed Jun. 20, 2014 (Koziol et al.);   U.S. patent application Ser. No. 14/327,722 for CUSTOMER FACING IMAGING SYSTEMS AND METHODS FOR OBTAINING IMAGES filed Jul. 10, 2014 (Oberpriller et al,);   U.S. patent application Ser. No. 14/327,827 for a MOBILE-PHONE ADAPTER FOR ELECTRONIC TRANSACTIONS, filed Jul. 10, 2014 (Hejl);   U.S. patent application Ser. No. 14/329,303 for CELL PHONE READING MODE USING IMAGE TIMER filed Jul. 11, 2014 (Coyle);   U.S. patent application Ser. No. 14/333,588 for SYMBOL READING SYSTEM WITH INTEGRATED SCALE BASE filed Jul. 17, 2014 (Barten);   U.S. patent application Ser. No. 14/334,934 for a SYSTEM AND METHOD FOR INDICIA VERIFICATION, filed Jul. 18, 2014 (Hejl);   U.S. patent application Ser. No. 14/336,188 for METHOD OF AND SYSTEM FOR DETECTING OBJECT WEIGHING INTERFERENCES, Filed Jul. 21, 2014 (Amundsen et al.);   U.S. patent application Ser. No. 14/339,708 for LASER SCANNING CODE SYMBOL READING SYSTEM, filed Jul. 24, 2014 (Xian et al.);   U.S. patent application Ser. No. 14/340,627 for an AXIALLY REINFORCED FLEXIBLE SCAN ELEMENT, filed Jul. 25, 2014 (Rueblinger et al.);   U.S. patent application Ser. No. 14/340,716 for an OPTICAL IMAGER AND METHOD FOR CORRELATING A MEDICATION PACKAGE WITH A PATIENT, filed Jul. 25, 2014 (Ellis);   U.S. patent application Ser. No. 14/342,544 for Imaging Based Barcode Scanner Engine with Multiple Elements Supported on a Common Printed Circuit Board filed Mar. 4, 2014 (Liu et al.);   U.S. patent application Ser. No. 14/345,735 for Optical Indicia Reading Terminal with Combined Illumination filed Mar. 19, 2014 (Ouyang);   U.S. patent application Ser. No. 14/336,188 for METHOD OF AND SYSTEM FOR DETECTING OBJECT WEIGHING INTERFERENCES, Filed Jul. 21, 2014 (Amundsen et al.);   U.S. patent application Ser. No. 14/355,613 for Optical Indicia Reading Terminal with Color Image Sensor filed May 1, 2014 (Lu et al.);   U.S. patent application Ser. No. 14/370,237 for WEB-BASED SCAN-TASK ENABLED SYSTEM AND METHOD OF AND APPARATUS FOR DEVELOPING AND DEPLOYING THE SAME ON A CLIENT-SERVER NETWORK filed Jul. 2, 2014 (Chen et al.);   U.S. patent application Ser. No. 14/370,267 for INDUSTRIAL DESIGN FOR CONSUMER DEVICE BASED SCANNING AND MOBILITY, filed Jul. 2, 2014 (Ma et al.);   U.S. patent application Ser. No. 14/376,472, for an ENCODED INFORMATION READING TERMINAL INCLUDING HTTP SERVER, filed Aug. 4, 2014 (Lu);   U.S. patent application Ser. No. 14/379,057 for METHOD OF USING CAMERA SENSOR INTERFACE TO TRANSFER MULTIPLE CHANNELS OF SCAN DATA USING AN IMAGE FORMAT filed Aug. 15, 2014 (Wang et al);   U.S. patent application Ser. No. 14/452,697 for INTERACTIVE INDICIA READER, filed Aug. 6, 2014 (Todeschini);   U.S. patent application Ser. No. 14/453,019 for DIMENSIONING SYSTEM WITH GUIDED ALIGNMENT, filed Aug. 6, 2014 (Li et al.);   U.S. patent application Ser. No. 14/460,387 for APPARATUS FOR DISPLAYING BAR CODES FROM LIGHT EMITTING DISPLAY SURFACES filed Aug. 15, 2014 (Van Horn et al.);   U.S. patent application Ser. No. 14/460,829 for ENCODED INFORMATION READING TERMINAL WITH WIRELESS PATH SELECTON CAPABILITY, filed Aug. 15, 2014 (Wang et al.);   U.S. patent application Ser. No. 14/462,801 for MOBILE COMPUTING DEVICE WITH DATA COGNITION SOFTWARE, filed on Aug. 19, 2014 (Todeschini et al.);   U.S. patent application Ser. No. 14/446,387 for INDICIA READING TERMINAL PROCESSING PLURALITY OF FRAMES OF IMAGE DATA RESPONSIVELY TO TRIGGER SIGNAL ACTIVATION filed Jul. 30, 2014 (Wang et al.);   U.S. patent application Ser. No. 14/446,391 for MULTIFUNCTION POINT OF SALE APPARATUS WITH OPTICAL SIGNATURE CAPTURE filed Jul. 30, 2014 (Good et al.);   U.S. patent application Ser. No. 29/486,759 for an Imaging Terminal, filed Apr. 2, 2014 (Oberpriller et al.);   U.S. patent application Ser. No. 29/492,903 for an INDICIA SCANNER, filed Jun. 4, 2014 (Zhou et al.); and   U.S. patent application Ser. No. 29/494,725 for an IN-COUNTER BARCODE SCANNER, filed Jun. 24, 2014 (Oberpriller et al.).