Patent ID: 12229774

DETAILED DESCRIPTION

Payment applications, particularly ones that run on client computing devices, may encounter a variety of issues at the hand of unscrupulous individuals. Although efforts can be made to perform monitoring at various locations (e.g., utilizing different forms of authentication and authorization), such efforts are not necessarily enough to precisely determine problems affecting these applications.

Payment applications running on a client device may become infected by malware or otherwise infiltrated by bad actors, thereby generating serious security issues. Malware infected applications may instruct the device to perform functions that are not authorized by a user in a covert manner that avoids detection by conventional manners. For example, the malware may alter the functions executed by the application to produce a different set of results than intended (e.g., cause unauthorized payments or money transfers).

Traditional malware detection methods may not be sufficient to detect more sophisticated malware. For example, signature based detection can be problematic because obfuscation techniques can create code series that look different (i.e., have a different signature) but perform the same actions as the original code. This obfuscation technique may be used to bypass signature matching. Additionally, using techniques like WebInject to inject JavaScript to execute web pages in a browser can further disable known protection mechanisms.

By providing a system that monitors functions being executed off the client-side memory stack, certain metrics may be measured or recorded and compared to expected values for the function being performed. A measured or recorded value deviating from an expected value suggests that there may be an anomaly in the execution of the functions. Under such instances, the execution of the function may be suspended and an administrator or owner of the account may be prompted to investigate further. The monitoring system may compare certain values of the monitored functions to a state machine in order to determine whether a match exists between the functions, or whether certain attributes falls within acceptable parameters. The state machine may be implemented as a JavaScript application, a plug-in, or it may be incorporated into the browser as an external application. Alternatively, or in addition, the state machine may be implemented in the operating system of the computing device so that it's active and running in the background at boot up of the user device, and thus not easily disabled.

This specification includes references to “one embodiment,” “some embodiments,” or “an embodiment.” The appearances of these phrases do not necessarily refer to the same embodiment. Particular features, structures, or characteristics may be combined in any suitable manner consistent with this disclosure.

“First,” “Second,” etc. As used herein, these terms are used as labels for nouns that they precede, and do not necessarily imply any type of ordering (e.g., spatial, temporal, logical, cardinal, etc.). Furthermore, various components may be described or claimed as “configured to” perform a task or tasks. In such contexts, “configured to” is used to connote structure by indicating that the components include structure (e.g., stored logic) that performs the task or tasks during operation. As such, the component can be said to be configured to perform the task even when the component is not currently operational (e.g., is not on). Reciting that a component is “configured to” perform one or more tasks is expressly intended not to invoke 35 U.S.C. § 112 (f) for that component.

FIG.1illustrates an exemplary embodiment of a computing system adapted for implementing one or more embodiments disclosed herein to detect malware by monitoring client-side memory stacks in order to protect users of payment system applications. As shown, a computing system100may comprise or implement a plurality of servers, devices, and/or software components that operate to perform various methodologies in accordance with the described embodiments. Exemplary servers, devices, and/or software components may include, for example, stand-alone and enterprise-class servers running an operating system (OS) such as a MICROSOFT® OS, a UNIX® OS, a LINUX® OS, or other suitable OS. It may be appreciated that the servers illustrated inFIG.1may be deployed in other ways and that the operations performed and/or the services provided by such servers may be combined, distributed, and/or separated for a given implementation and may be performed by a greater number or fewer number of servers. One or more servers may be operated and/or maintained by the same or different entities.

Computing system100may include, among various devices, servers, databases and other elements, one or more clients102comprising or employing one or more client devices104, such as a laptop, a mobile computing device, a tablet, a personal computer, a wearable device, and/or any other computing device having computing and/or communications capabilities in accordance with the described embodiments. Client devices104may include a cellular telephone, smart phone, electronic wearable device (e.g., smart watch, virtual reality headset), or other similar mobile devices that a user may carry on or about his or her person and access readily.

Client devices104generally may provide one or more client programs106, such as system programs and application programs to perform various computing and/or communications operations. Exemplary system programs may include, without limitation, an operating system (e.g., MICROSOFT® OS, UNIX® OS, LINUX® OS, Symbian OS™, iOS, Android, Embedix OS, Binary Run-time Environment for Wireless (BREW) OS, JavaOS, a Wireless Application Protocol (WAP) OS, and others), device drivers, programming tools, utility programs, software libraries, application programming interfaces (APIs), and so forth. Exemplary application programs may include, without limitation, a payment system application, a web browser application, messaging application, contacts application, calendar application, electronic document application, database application, media application (e.g., music, video, television), location-based services (LBS) application (e.g., GPS, mapping, directions, positioning systems, geolocation, point-of-interest, locator) that may utilize hardware components such as an antenna, and so forth. One or more of client programs106may display various graphical user interfaces (GUIs) to present information to and/or receive information from one or more users of client devices104. In some embodiments, client programs106may include one or more applications configured to conduct some or all of the functionalities and/or processes discussed below.

As shown, client devices104may be communicatively coupled via one or more networks108to a network-based system110. Network-based system110may be structured, arranged, and/or configured to allow client102to establish one or more communications sessions between network-based system110and various client devices104and/or client programs106. Accordingly, a communications session between client devices104and network-based system110may involve the unidirectional and/or bidirectional exchange of information and may occur over one or more types of networks108depending on the mode of communication. While the embodiment ofFIG.1illustrates a computing system100deployed in a client-server operating environment, it is to be understood that other suitable operating environments and/or architectures may be used in accordance with the described embodiments.

Data communications between client devices104and the network-based system110may be sent and received over one or more networks108such as the Internet, a WAN, a WWAN, a WLAN, a mobile telephone network, a landline telephone network, personal area network, as well as other suitable networks. For example, client devices104may communicate with network-based system110over the Internet or other suitable WAN by sending and or receiving information via interaction with a website, e-mail, IM session, and/or video messaging session. Any of a wide variety of suitable communication types between client devices104and system110may take place, as will be readily appreciated. In particular, wireless communications of any suitable form (e.g., Bluetooth, near-field communication, etc.) may take place between client device104and system110, such as that which often occurs in the case of mobile phones or other personal and/or mobile devices.

Network-based system110may comprise one or more communications servers120to provide suitable interfaces that enable communication using various modes of communication and/or via one or more networks108. Communications servers120may include a web server122, an API server124, and/or a messaging server126to provide interfaces to one or more application servers130. Application servers130of network-based system110may be structured, arranged, and/or configured to provide various online services to client devices that communicate with network-based system110. In various embodiments, client devices104may communicate with application servers130of network-based system110via one or more of a web interface provided by web server122, a programmatic interface provided by API server124, and/or a messaging interface provided by messaging server126. It may be appreciated that web server122, API server124, and messaging server126may be structured, arranged, and/or configured to communicate with various types of client devices104, and/or client programs106and may interoperate with each other in some implementations.

Web server122may be arranged to communicate with web clients and/or applications such as a web browser, web browser toolbar, desktop widget, mobile widget, web-based application, web-based interpreter, virtual machine, mobile applications, and so forth. API server124may be arranged to communicate with various client programs106comprising an implementation of API for network-based system110. Messaging server126may be arranged to communicate with various messaging clients and/or applications such as e-mail, IM, SMS, MMS, telephone, VoIP, video messaging, IRC, and so forth, and messaging server126may provide a messaging interface to enable access by client102to the various services and functions provided by application servers130.

Application servers130of network-based system110may be a server that provides various services to client devices, such as malware detection and/or malware library updates. Application servers130may include multiple servers and/or components. For example, application servers130may include a code generator132, clean room134, system call mapping engine136, code mutation engine138, system call comparison engine140, code concatenation engine142, testing engine144, and/or library update engine146. These servers and/or components, which may be in addition to other servers, may be structured and arranged to help protect devices against malware.

Application servers130, in turn, may be coupled to and capable of accessing one or more databases150including system call database152, application database154, and/or malware database156. Databases150generally may store and maintain various types of information for use by application servers130and may comprise or be implemented by various types of computer storage devices (e.g., servers, memory) and/or database structures (e.g., relational, object-oriented, hierarchical, dimensional, network) in accordance with the described embodiments.

FIG.2illustrates an exemplary computer system200in block diagram format suitable for implementing on one or more devices of the computing system inFIG.1. In various implementations, a device that includes computer system200may comprise a personal computing device (e.g., a smart or mobile phone, a computing tablet, a personal computer, laptop, wearable device, PDA, etc.) that is capable of communicating with a network. A service provider and/or a content provider may utilize a network computing device (e.g., a network server) capable of communicating with the network. It should be appreciated that each of the devices utilized by users, service providers, and content providers may be implemented as computer system200in a manner as follows. Additionally, as more and more devices become communication capable, such as smart devices using wireless communication to report, track, message, relay information and so forth, these devices may be part of computer system200.

Computer system200may include a bus202or other communication mechanisms for communicating information data, signals, and information between various components of computer system200. Components include an input/output (I/O) controller204that processes a user action, such as selecting keys from a keypad/keyboard, selecting one or more buttons, links, actuatable elements, etc., and sends a corresponding signal to bus202. I/O controller204may also include an output component, such as a display206and a cursor control208(such as a keyboard, keypad, mouse, touchscreen, etc.). In some examples, I/O controller204may include an image sensor for capturing images and/or video, such as a complementary metal-oxide semiconductor (CMOS) image sensor, and/or the like. An audio input/output component210may also be included to allow a user to use voice for inputting information by converting audio signals. Audio I/O component210may allow the user to hear audio. A transceiver or network interface212transmits and receives signals between computer system200and other devices, such as another user device, a merchant server, an email server, application service provider, web server, a payment provider server, and/or other servers via a network. In various embodiments, such as for many cellular telephone and other mobile device embodiments, this transmission may be wireless, although other transmission mediums and methods may also be suitable. A processor214, which may be a micro-controller, digital signal processor (DSP), or other processing component, processes these various signals, such as for display on computer system200or transmission to other devices over a network216via a communication link218. Again, communication link218may be a wireless communication in some embodiments. Processor214may also control transmission of information, such as cookies, IP addresses, images, and/or the like to other devices.

Components of computer system200also include a system memory220(e.g., RAM), a static storage component222(e.g., ROM), and/or a disk drive224. Computer system200performs specific operations by processor214and other components by executing one or more sequences of instructions contained in system memory220. Logic may be encoded in a computer-readable medium, which may refer to any medium that participates in providing instructions to processor214for execution. Such a medium may take many forms, including but not limited to, non-volatile media, volatile media, and/or transmission media. In various implementations, non-volatile media includes optical or magnetic disks, volatile media includes dynamic memory such as system memory220, and transmission media includes coaxial cables, copper wire, and fiber optics, including wires that comprise bus202. In one embodiment, the logic is encoded in a non-transitory machine-readable medium. In one example, transmission media may take the form of acoustic or light waves, such as those generated during radio wave, optical, and infrared data communications.

Some common forms of computer readable media include, for example, floppy disk, flexible disk, hard disk, magnetic tape, any other magnetic medium, CD-ROM, any other optical medium, punch cards, paper tape, any other physical medium with patterns of holes, RAM, PROM, EPROM, FLASH-EPROM, any other memory chip or cartridge, or any other medium from which a computer is adapted to read.

In various embodiments of the present disclosure, execution of instruction sequences to practice the present disclosure may be performed by computer system200. In various other embodiments of the present disclosure, a plurality of computer systems200coupled by communication link218to the network (e.g., such as a LAN, WLAN, PTSN, and/or various other wired or wireless networks, including telecommunications, mobile, and cellular phone networks) may perform instruction sequences to practice the present disclosure in coordination with one another. Modules described herein may be embodied in one or more computer readable media or be in communication with one or more processors to execute or process the techniques and algorithms described herein.

A computer system may transmit and receive messages, data, information and instructions, including one or more programs (i.e., application code) through a communication link and a communication interface. Received program code may be executed by a processor as received and/or stored in a disk drive component or some other non-volatile storage component for execution.

Where applicable, various embodiments provided by the present disclosure may be implemented using hardware, software, or combinations of hardware and software. Also, where applicable, the various hardware components and/or software components set forth herein may be combined into composite components comprising software, hardware, and/or both without departing from the spirit of the present disclosure. Where applicable, the various hardware components and/or software components set forth herein may be separated into sub-components comprising software, hardware, or both without departing from the scope of the present disclosure. In addition, where applicable, it is contemplated that software components may be implemented as hardware components and vice-versa.

Software, in accordance with the present disclosure, such as program code and/or data, may be stored on one or more computer-readable media. It is also contemplated that software identified herein may be implemented using one or more computers and/or computer systems, networked and/or otherwise. Such software may be stored and/or used at one or more locations along or throughout the system, at client102, network-based system110, or both. Where applicable, the ordering of various steps described herein may be changed, combined into composite steps, and/or separated into sub-steps to provide features described herein.

The foregoing networks, systems, devices, and numerous variations thereof may be used to implement one or more services, such as the services discussed above and in more detail below.

FIG.3illustrates an exemplary process300for detecting malware by monitoring client-side memory stacks, for example, JavaScript stacks. JavaScript processes messages from a queue one at a time, and each time a new message is loaded, functions are called to a stack. The stack may increase or decrease in size depending on the functions called. Once all the functions of a message have been called, JavaScript may proceed to a next message in the queue with corresponding functions that are called. This event loop may be monitored to detect the presence of malware.

At operation310the system receives a request for a payment process for a transaction via a payment system application running on a client device. Once payment has been initiated, the functions begin to populate the client-side memory stack in step320. The system then monitors the activity on the client-side memory stack in step330to determine whether the series of functions being called is identical to a known series of functions that correspond to the initiated payment process. In other words, the system expects certain functions to be called for a particular payment process. The system further expects the calls of these functions to be made in a particular order.

In one example, the system expects functions A→B→C to be called in that order for a particular message associated with a payment being processed. If, however, the system, while monitoring the functions, detects that the functions are called out of order (e.g., A→C→B), or that an unexpected function is included in or omitted from the series (e.g., A→D→B→C or A→C, remedial action is taken in step340. A determination that the expected series of functions is called in the expected order suggests that the system is operating properly and thus not compromised. On the other hand, a determination that the expected series of functions is not called in the expected order suggests that the system is not operating properly and thus may have been compromised.

In some embodiments, the monitoring of the client-side memory stack is used to detect malware that may have been installed on the system and that modifies the behavior of the JavaScript executed by the browsers. In certain instances, malware that is installed on the system may cause the payment application to conduct transactions that may be detrimental to the owner of an account and for the gain of a hacker. By detecting such unusual activity that suggests that the system is not operating properly, the system may protect the owner of the account from such harms. Upon making a determination that the expected functions are not called in the expected order, remedial action such as interrupting the payment process and/or flagging it for review may be taken. The system may also alert an administrator and/or the owner of the account subject to the potential breach.

FIG.4illustrates an alternative exemplary process400for detecting malware by monitoring client-side memory stacks. Similar to process300, the system receives a request for initiating payment for a transaction via a payment system application in step410. In response to receiving the request, payment is initiated by calling the corresponding functions and populating the client-side memory stack with the called functions in step420. The system then monitors the activity on the client-side memory stack in step430to determine whether a number of parameters and/or the types of parameters is retrieved by the called functions corresponds to what is expected for each of the called functions. That is, for each function called, the system expects a specific number of parameters and/or types of parameters to be retrieved by the function.

For example, the system expects a specific function called by the payment process to retrieve two parameters. If, however, the system detects that the function called instead retrieves three parameters (or any number of parameters which is not two), remedial action is taken in step440. Additionally or alternatively, the system may expect a specific function called by the payment process to retrieve parameters of types a and b. If, however, the system detects that the function called instead retrieves parameters of types y and z (or any combination that is not specifically types a and b), remedial action is taken in step440.

In some embodiments, the system may expect certain parameters to be passed to the functions on the stack itself, or at specific locations, which can also be monitored by the system. If the system detects that the parameters aren't passed to the functions on the stack as expected, or are not passed at specific locations, remedial action is taken in step440.

As discussed above, a determination of the function operating outside of an expected norm suggests that the system is not operating properly and thus may have been compromised. When such a determination is made, remedial measures such as interrupting the payment process and/or flagging it for review may be taken. In some instances, an alert may be sent to the administrator and/or the owner of the account of subject to the potential breach.

FIG.5illustrates another exemplary process500for detecting malware by monitoring client-side memory stacks. Similar to processes300and400described above, the system receives a request for initiating payment for a transaction via a payment system application in step510, which causes the functions corresponding to the payment to be called and the client-side memory stack to be populated with the called functions in step520. The system then monitors the activity being conducted on the client-side memory stack in step530to measure the time it takes for each of the functions to be performed, e.g., by a JavaScript engine. In step540, the time measured for each function is then compared to a corresponding known approximation of time in which the system expects the function to be performed, in order to determine if any anomalies exist. For example, the system measures the amount of time elapsed from the time that a user clicks “Ok” to initiate a payment to when a command is sent to a server. This time is compared to the known approximation of time (i.e., the amount of time in which the function is expected to be completed) which may be retrieved by the system from a data repository.

The known approximation of time may be a window of time so as to provide some amount of threshold variation. That is, if a function is expected to be performed in 35 ms, the known approximation may be a range of 32 ms to 38 ms. By providing such a threshold, the likelihood of false positives (i.e., a detection of an issue when no actual issue exists) may be reduced.

When the measured time for the execution of the function falls outside of the range of the known approximation of time, remedial action is taken in step550. Remedial action is taken because if measured time does not correspond to an expected known approximation, then the system is determined to not be operating properly, i.e., the system may have been compromised. When such a determination is made, the payment process may be interrupted and/or flagged for review. In some instances, an alert may be sent to the administrator and/or the owner of the account of subject to the potential breach. When the system flags the monitored activity, an administrator may perform a thorough investigation into what caused the system to operate outside of the expected parameters.

In considering the amount of time it takes for a function to execute, the system may normalize out the delays resulting from network latency. In other words, time delays related to network speed should not to be considered because the system is designed to detect malware operating within the application. Such malware typically does not affect network speeds. Also, network speed can vary depending on a variety of factors, including but not limited to the type of connection, the host server, the user device (e.g., components and configuration), and environmental characteristics external to the system.

Additionally, the system may normalize the measured time based on factors such as computing power and the number of concurrent applications being handled by the system. These two factors are critical in approximating the amount of time a function takes to execute because they represent the amount of resources available for handling the execution of the function—the fewer resources the system has at its disposal, the longer it would take to execute the function and vice versa. Normalizing the measured time effectively eliminates the variances resulting from systems having different amounts of resources which result in different amounts of times it takes to execute a function. The normalizing thus reduces the probability of erroneously detecting an anomaly in the execution of the functions.

In some embodiments, a combination of all three of the factors described above may be considered in identifying potential malware and taking remedial measures, as illustrated by exemplary process600inFIG.6. For example, after the system receives a request for initiating payment for a transaction via a payment system application in step610, the functions are called and the client-side memory stack is subsequently populated with the called functions in step620. The system then monitors the activity on the client-side memory stack by determining whether the series of functions being called is identical to a known series of functions that correspond to the initiated payment process in step630. If the system determines that the expected series of functions is called in the expected order, the system proceeds to step640. Otherwise, the process proceeds to step650where remedial action is taken.

In step640, the system determines whether a number and types of parameters retrieved by the called functions correspond to what is expected for each of the called functions. If the number and the types of the parameters retrieved corresponds to expectations, the system proceeds to step660. If, however, the number or the types of the parameters is different from expectations, then the system proceeds to step650where remedial action is taken.

At step660, the time for each function is measured and then compared to a corresponding known approximation of time in which the system expects the function to be performed. Determining that the measured time falls within a known approximation of time suggests that the system is operating properly and thus not compromised. If, however, the measured time falls outside of the known window, the system will determine that there's an anomaly among the functions and thus proceed to step650for remedial action to be taken.

While the above exemplary embodiment of utilizing all three of the factors in combination provides for identifying the series of functions, determining the parameters retrieved, and measuring the time of executing in a specific order, one of ordinary skill in the art may appreciate that the order of these steps may be rearranged in any order. In other words, the system may measure the time of execution first and then determine the number of parameters retrieved, before identifying the series of functions.

In some embodiments, the monitoring of the client-side memory stack is used to detect malware that may have been installed on the system. In certain instances, malware that is installed on the system may cause the payment application to conduct transactions that may be detrimental to the owner of an account and for the gain of a hacker. By detecting unusual activity on the memory stack that suggests that the system is not operating properly, the system may protect the owner of the account from such harms. Upon making a determination that the expected functions are not called in the expected order, remedial action may be taken. As discussed above, the system may suspend the initiated payment pending further review. The system may also alert an administrator and/or the owner of the account of the potential breach.

In some examples, the payment application may be a benign application that has been infected with malware. The malware may cause the application to process transactions that are not authorized by the owner of the account. For example, the malware may cause an unauthorized transfer of funds from the owner of the account to another party determined by the malware without the knowledge of the owner. For example, a hacker may cause malware to be installed on the application to transfer funds from the owner's account to the hacker's account.

In another embodiment, the malware may be used to obtain sensitive information of the owner of the account. For example, the malware may be used to record social security numbers, login information and associated credentials, credit card information, and other associated billing information from the owner. This misappropriated information may then be used later on to complete fraudulent transactions.

In some examples, in response to determining that the system is not operating properly and thus potentially compromised, the system may continue operation and separate or isolate calls for the application that are detected as unexpected calls. For example, when the system identifies calls to functions that are not expected, those functions are separated or isolated to be analyzed, and the expected calls may be allowed to proceed.

In some embodiments, the monitoring may be performed by an application external to the system. Alternatively, the monitoring may be performed via a plug-in in the browser to detect the anomalies in the function execution process. In one example, the plug-in may be part of PayPal's One Touch™ application, or the plug-in may be separate from the payment system application itself.

In some embodiments, monitoring the functions include comparing certain attributes of the monitored functions to a state machine in order to determine whether a match exists between the functions, or whether the attributes (e.g., time elapsed during execution) falls within acceptable parameters. The state machine may be implemented as a JavaScript application, a plug-in, or it may be incorporated into the browser as an external application. Alternatively, or in addition, the state machine may be implemented in the operating system of the computing device so that it's active and running in the background at boot up of the user device.

In some instances, if a determination has been made that the expected functions are not being performed in an expected manner, the system may require the user of the account to re-authenticate himself. For example, the remedial measures taken in steps340,440,550and650may be to present a captcha challenge, or any of a variety of authentication challenges to prove that the user is who he claims to be, or to prove that the user is a human. Since malware can cause a payment processing operation to initiate without a command with a user, presenting such a challenge may be effective in quickly identifying a situation where malware of this type is present.

In some embodiments, the payment system application securely stores login information on the device to streamline the payment within the checkout process. For example, when a PayPal One Touch™ transaction is initiated, the user will have already been logged into the user's PayPal account. In this example, when payment is initiated, an authentication process may be skipped over and messages corresponding to making the payment are processed by JavaScript. As such, requiring re-authentication when an anomaly is detected in the execution of the functions will be a useful deterrent against hacking.

While the exemplary embodiments describe the client-side memory stack as being a JavaScript stack, one of ordinary skill in the art will appreciate that the functions may be called to any type of queuing scheme that is used for running functions in a particular order.

The user device described above may be one of a variety of devices including but not limited to a smartphone, a tablet, a laptop and a pair of augmented reality spectacles. Each of these devices embodies some processing capabilities and an ability to connect to a network (e.g., the internet, a LAN, a WAN, etc.). Each device also includes a display element for displaying a variety of information. The combination of these features (display element, processing capabilities and connectivity) on the mobile communications enables a user to perform a variety of essential and useful functions.

The foregoing description is provided to enable a person skilled in the art to practice the various configurations described herein. While the subject technology has been particularly described with reference to the various figures and configurations, it should be understood that these are for illustration purposes only and should not be taken as limiting the scope of the subject technology.

There may be many other ways to implement the subject technology. Various functions and elements described herein may be partitioned differently from those shown without departing from the scope of the subject technology. Various modifications to these configurations will be readily apparent to those skilled in the art, and generic principles defined herein may be applied to other configurations. Thus, many changes and modifications may be made to the subject technology, by one having ordinary skill in the art, without departing from the scope of the subject technology.

It is understood that the specific order or hierarchy of steps in the processes disclosed is an illustration of exemplary approaches. Based upon design preferences, it is understood that the specific order or hierarchy of steps in the processes may be rearranged. Some of the steps may be performed simultaneously. The accompanying method claims present elements of the various steps in a sample order, and are not meant to be limited to the specific order or hierarchy presented.

A phrase such as “an aspect” does not imply that such aspect is essential to the subject technology or that such aspect applies to all configurations of the subject technology. A disclosure relating to an aspect may apply to all configurations, or one or more configurations. An aspect may provide one or more examples of the disclosure. A phrase such as an “aspect” may refer to one or more aspects and vice versa. A phrase such as an “implementation” does not imply that such implementation is essential to the subject technology or that such implementation applies to all configurations of the subject technology. A disclosure relating to an implementation may apply to all implementations, or one or more implementations. An implementation may provide one or more examples of the disclosure. A phrase such an “implementation” may refer to one or more implementations and vice versa. A phrase such as a “configuration” does not imply that such configuration is essential to the subject technology or that such configuration applies to all configurations of the subject technology. A disclosure relating to a configuration may apply to all configurations, or one or more configurations. A configuration may provide one or more examples of the disclosure. A phrase such as a “configuration” may refer to one or more configurations and vice versa.

Furthermore, to the extent that the terms “include,” “have,” and “the like” are used in the description or the claims, such terms are intended to be inclusive in a manner similar to the term “comprise” as “comprise” is interpreted when employed as a transitional word in a claim.

The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any implementation described herein as “exemplary” is not necessarily to be construed as preferred or advantageous over other implementations.

A reference to an element in the singular is not intended to mean “one and only one” unless specifically stated, but rather “one or more.” The term “some” refers to one or more. All structural and functional equivalents to the elements of the various configurations described throughout this disclosure that are known or later come to be known to those of ordinary skill in the art are expressly incorporated herein by reference and intended to be encompassed by the subject technology. Moreover, nothing disclosed herein is intended to be dedicated to the public regardless of whether such disclosure is explicitly recited in the above description.