Patent ID: 12256006

DESCRIPTION OF EXAMPLE EMBODIMENTS

Overview

In particular embodiments, a first network apparatus may comprise one or more processors and one or more computer-readable non-transitory storage media coupled to one or more of the processors. The one or more computer-readable non-transitory storage media may comprise instructions operable when executed by one or more of the processors to cause the first network apparatus to receive an authorization request from a user device redirected from a second network apparatus. The processors may be operable when executing the instructions to generate an authorization response comprising a resource authorization token. The processors may be operable when executing the instructions to transmit the resource authorization token to a distributed ledger for storage and to the user device, wherein the distributed ledger is a blockchain record.

In particular embodiments, a method for service authentication based on storing authorization tokens on a distributed ledger may comprise receiving an authorization request from a user device associated with a user redirected from a first network apparatus, wherein the first network apparatus redirected the user device based on a determination that a request to access a resource generated by the user device did not comprise a session cookie. The method may further comprise generating an authorization response comprising a resource authorization token. The method may comprise transmitting the resource authorization token to a distributed ledger for storage and to the user device, wherein the distributed ledger is a blockchain record.

In particular embodiments, one or more computer-readable non-transitory storage media may embody software that is operable on a first network apparatus when executed to receive an authorization request from a user device redirected from a second network apparatus. The software may be operable when executed to generate an authorization response comprising a resource authorization token. The software may be operable when executed to transmit the resource authorization token to a distributed ledger for storage and to the user device, wherein the distributed ledger is a blockchain record.

EXAMPLE EMBODIMENTS

FIG.1illustrates an example system where a user accesses a cloud resource. In the example illustrated inFIG.1, a user device102associated with a first user may be communicatively coupled to a communication network104. The user device102may access one or more resource servers103located in cloud systems. The one or more resource servers103may comprise a storage and/or application server106. As an example and not by way of limitation, the user device102may access the storage server106located in a public cloud to access a cloud data storage service. A communication session between the user device102and the storage server106may be established. Traffic for the communication session may go through a first network apparatus108of the communication network104. In particular embodiments, the first network apparatus108may be any suitable network apparatus that connects the communication network104and the public cloud. As another example and not by way of limitation, the user device102may access the application server106located in a private cloud to access an application. A communication session between the user device102and the application server106may be established. Traffic for the communication session may also go through the first network apparatus108of the communication network104.

In particular embodiments, the first user may undergo an authentication process in order to access the resources in one or more resource servers103. In such a scenario, a blockchain record110may be stored in the communication network104to maintain a log of authorization and/or access tokens generated during the authentication process. Embodiments disclosed herein leverage blockchain technology to provide a secure and distributed approach for establishing authentication of a user and for maintaining a compliance log. For example, authorization may need to be able to determine what actions a user can perform when an application has access to potentially sensitive data and the application is publicly accessible by internal users or by third parties. A second network apparatus112, operating as an authenticator, may generate an authorization token114indicating authorized actions for a user associated with the user device to perform while accessing a resource or a group of resources that the user is authorized to access. In embodiments, the second network apparatus112may be an OpenID Connect (OIDC) compliant identity provider. The second network apparatus112may further generate an access token116, for an authorized user, to provide access to one or more resource servers103. In embodiments, the blockchain record110may receive and store the generated authorization tokens114and access tokens116. The tokens114,116may be stored using any suitable encryption technique and may be accessible by an external server118for a compliance process. In particular embodiments, the external server118may operate under compliance checking. For example, the external server118may access the blockchain record110to assert the intended use of an application service as attested by the issuance of tokens114,116. In these embodiments, the external server118may verify or settle, through the blockchain record110, charges and/or disputes between clients of a service (i.e., user device102) and a service provider (i.e., resource server103).

In particular embodiments, first network apparatus108may be located at a network boundary that enables a local network to connect to an external network. In particular embodiments, the first network apparatus108may be equipped with a router function and a proxy function. The first network apparatus108may implement an identity-aware proxy through authentication and authorization using the router function and proxy function. The identity-aware proxy may enable improvement of application security governance for legacy and new applications without changes to application logic by allowing the enterprise to centralize user access control for applications. In particular embodiments, each of the router and proxy functions may be implemented on a separate computing machine or may be collocated at a single computing machine. The router function may enable the computing devices within a local network to access external networks including one or more cloud systems and the Internet. The router function may also terminate a request to access a resource and determine whether the request has been authenticated and/or authorized. The proxy function may establish a first communication session with a user device and may also establish a second communication session with a resource server (for example, the resource server103) providing a requested resource. The proxy function may relay traffic between the user device102and the resource server103via the first communication session and the second communication session. The proxy function may behave as if the proxy function is the resource server103to the user device102while the proxy function may also behave as if the proxy function is the user device102to the resource server103. In particular embodiments, the router function and the proxy function may collocate at a single network apparatus (e.g., first network apparatus108).

The first network apparatus108may receive a request to access a resource from a user device102associated with a user. Accessing the resource may be provided as a web service. The request may be a Hypertext Transfer Protocol (HTTP) request. In particular embodiments, the request may not comprise a session cookie. The session cookie in the request may indicate that a communication session from the user device102to access the resource has been established. In other words, the user has been authorized to access the resource using the user device102. The first network apparatus108may determine that the request does not comprise a session cookie. As an example and not by way of limitation, the resource may be an application server106in a cloud. As another example and not by way of limitation, the resource may be a storage server106in a cloud. The first network apparatus108may maintain the resources that can be accessed from the communication network104. In particular embodiments, the resource server103is located in the external network.

As an example and not by way of limitation, the user device102associated with a first user may try to access the storage server106located in a public cloud for a cloud data storage service. A HTTP request to access the storage server106from the user device102may arrive at the first network apparatus108of the communication network104. The first network apparatus108may check whether the storage server106is an available cloud resource. The first network apparatus108may also determine whether the request message comprises a session cookie. As another example and not by way of limitation, the user device102associated with the first user may try to access an application server106located in a private cloud. A HTTP request to access the application server106from the user device102may arrive at the first network apparatus108. The first network apparatus108may check whether the application server106is one of the available cloud resources. The first network apparatus108may also determine whether the request message comprises a session cookie. Although this disclosure describes receiving a request to access a resource in a particular manner, this disclosure contemplates receiving a request to access a resource in any suitable manner.

In particular embodiments, the first network apparatus108may generate an authorization request. The authorization request may comprise an identifier associated with the user, an identifier associated with the user device102, and/or an identifier associated with the resource. In exemplary embodiments, the identifier associated with the user device102may be an Internet Protocol (IP) address associated with the user device102. The authorization request may also comprise credentials received from the user device102. The authorization request may further comprise a type of an action requested on the resource. In particular embodiments, the first network apparatus108may send the authorization request to the second network apparatus112, and the second network apparatus112may be equipped with the identity provider function. The identity provider function may authenticate users and may authorize the users to perform one or more particular actions to a resource. In particular embodiments, the identity provider function may collocate with the router function and the proxy function. In particular embodiments, the identify provider function may locate apart from the router function and the proxy function.

As an example and not by way of limitation, continuing with a prior example, the first network apparatus108may generate an authorization request for the request from the user device102to access the application server106. The authorization request may comprise a user identifier associated with the user, a device identifier associated with the user device102, and/or a resource identifier associated with the application server106. The first network apparatus108may send the generated authorization request to an identity provider server. In particular embodiments, the identity provider server (i.e., the second network apparatus112) may be collocated with the first network apparatus108. Although this disclosure describes sending an authorization request in a particular manner, this disclosure contemplates sending an authorization request in any suitable manner.

In particular embodiments, the identity provider function of the second network apparatus112may authenticate the user. The identity provider function may also determine whether the user is authorized to access the resource using the user device102. In particular embodiments, the second network apparatus112may perform an attribute-based access control (ABAC). ABAC defines an access control paradigm whereby access rights may be granted to users through the use of policies that combine attributes together. The policies may use any type of attributes (user attributes, resource attributes, object, environment attributes etc.). This model may support Boolean logic, in which rules contain “if, then” statements about who is making the request, the resource, and the action. For example: IF the requestor is a manager, THEN allow read/write access to sensitive data. The policies in ABAC may be able to express a complex Boolean rule set that can evaluate many different attributes. Attribute values may be set-valued or atomic-valued. Set-valued attributes may contain more than one atomic value. Examples of set-valued attributes may comprise role and project. Atomic-valued attributes may contain only one atomic value. Examples of atomic-valued attributes may comprise clearance and sensitivity. Attributes may be compared to static values or to one another, thus enabling relation-based access control. As an example and not by way of limitation, continuing with a prior example, the identity provider server may, on receiving an authorization request from the first network apparatus108, authenticate the user. The identity provider server may also authorize whether the user is authorized to access the application server106on the user device102. The identity provider server may determine one or more actions allowed for the user to access the application server106. As an example, the user may be allowed only to retrieve critical data on the application server106. As another example, the user may be allowed to retrieve and update critical data on the application server106. As yet another example, the user may be allowed to retrieve, update and delete critical data on the application server106. The allowed actions for the user may be determined based on various attributes associated with the user and the resource. The identity provider server may send an authorization response to the first network apparatus108. Although this disclosure describes authorizing the user to access a resource in a particular manner, this disclosure contemplates authorizing the user to access a resource in any suitable manner.

In particular embodiments, the first network apparatus108may receive an authorization response comprising a resource authorization token from the second network apparatus112. The first network apparatus108may determine that the user is authorized to access the resource using the user device102based on the received resource authorization token. The first network apparatus108may cache the resource authorization token as the session cookie. The first network apparatus108may send a message to the user device102to complete an establishment of a first communication session with the user device102. The message may comprise the resource authorization token. The resource authorization token may be used by the user device102as the session cookie in subsequent requests for accessing the resource. As an example and not by way of limitation, continuing with a prior example, the first network apparatus108receives an authorization response from the identity provider server. The authorization response may comprise a resource authorization token. The resource authorization token may comprise information associated with access rights for the user to access the application server106using the user device102. The first network apparatus108may determine that the user is allowed to access the application server106based on the resource authorization token. The first network apparatus108may complete an establishment of a communication session with the user device102by sending a message to the user device102. The message may comprise the resource authorization token. The user device102may use the resource authorization token as a session cookie for the following request messages on the communication session. Although this disclosure describes establishing a communication session based on authorization in a particular manner, this disclosure contemplates establishing a communication session based on authorization in any suitable manner.

FIG.2illustrates an example traffic relay between the user device102and resource server103for authorizing a request to access a resource by a user. At step202, the user device102may send an API call comprising an HTTP request to access an application server106(referring toFIG.1) of the resource server103. At step204, upon receiving the HTTP request, the router function of the first network apparatus108may check whether the request contains a session cookie in the HTTP request headers. If the session cookie is not present, the router function of the first network apparatus108may send a redirect message to the user device102at step206, where the redirect message may cause the user device102to contact the identity provider function of the second network apparatus112and perform an authentication. At step208, the user device102transmits a request to obtain a resource authorization token after being redirected by the first network apparatus108. At step210, the user device102may perform an authentication process with the second network apparatus112. Step210may comprise a plurality of message exchanges. In embodiments, the second network apparatus112may operate as an authenticator for the user to access a resource from the resource server103. In particular embodiments, the second network apparatus112may be an OpenID Connect (OIDC)-compliant identity provider server. The OIDC is a simple identity layer on top of the OAuth protocol. The OIDC may allow the first network apparatus108to verify the identity of a user based on the authentication performed by an identity provider server, as well as to obtain basic profile information about the user in an interoperable and representational state transfer (REST)-like manner. OIDC may specify a RESTful HTTP Application Programming Interface (API), using JavaScript Object Notation (JSON) as a data format.

After successfully authenticating the user, the second network apparatus112may generate an authorization response comprising a resource authorization token. In embodiments, the resource authorization token is a JavaScript Object Notation (JSON) Web Token (JWT) provided through an Oauth protocol. The resource authorization token may indicate authorized actions for a user associated with the user device102to perform while accessing a resource or a group of resources that the user is authorized to access. In particular embodiments, the resource authorization token may indicate the authorized actions for the user to perform while accessing the resource. The authorized actions for the user may be determined based on attributes associated with the user and the requested resource. When the user requests another action to the resource, the first network apparatus108may allow the requested action to the resource if the requested action is one of the authorized actions. Although this disclosure describes authorization for a plurality of actions to a resource in a particular manner, this disclosure contemplates authorization for a plurality of actions to a resource in any suitable manner.

In particular embodiments, the resource authorization token may indicate the resources that the user is authorized to access. The first network apparatus108may allow the user to access a second resource without performing additional authorization procedure if the second resource is one of the authorized resources. Although this disclosure describes achieving single sign-on (SSO) feature using an identity-aware proxy in a particular manner, this disclosure contemplates achieving SSO feature using an identity-aware proxy in any suitable manner.

At step212, the second network apparatus112may transmit the generated resource authorization token to a distributed ledger for storage. In particular embodiments, the distributed ledger may be the blockchain record110stored in the communication network104(referring toFIG.1). At step214, the second network apparatus112may transmit the generated resource authorization token to the user device102for further utilization in accessing a resource. At step216, the user device102may provide the received resource authorization token to the first network apparatus108through an API call. At step218, the proxy function of the first network apparatus108may present the received resource authorization token back to the identity provider function of the second network apparatus112. Upon receiving the resource authorization token from the first network apparatus108, the second network apparatus112may generate an access token, wherein the access token provides access to the resource server103. At step220, the second network apparatus112may transmit the generated access token to the blockchain record110for storage. In particular embodiments, step220may be optional, or the function of transmitting the access token to the blockchain record110may be performed by a different component (for example, resource server103). At step222, the second network apparatus112may transmit the generated access token to the first network apparatus108for further utilization by the user operating the user device102.

After the proxy function of the first network apparatus108validates the access token, the proxy function may determine whether the user is authorized to access the storage and/or application server106based on the resource authorization token. At step224, the proxy function of the first network apparatus108may send a message to the user device102to complete the establishment of a first communication session between the first network apparatus108and the user device102. The message may comprise a session cookie and the access token. In particular embodiments, the session cookie may be the resource authorization token received from the second network apparatus112. In particular embodiments, the proxy function may generate the session cookie based on the received resource authorization token. During step224, the first network apparatus108may further exchange messages with the resource server103to establish a second communication session between the first network apparatus108and the resource server103. The first network apparatus108may relay traffic between the user device102and the resource server103via the first communication session and the second communication session.

As an example and not by way of limitation, the user device102, or the first network apparatus108on behalf of the user device102, may transmit a request to establish the second communication session at step226. The request may include the access token generated by the second network apparatus112. At step228, the resource server103may transmit the generated access token to the blockchain record110for storage. In particular embodiments, step228may be optional, and may be implemented if step220does not occur. At step230, the resource server103sends a HTTP response to complete an establishment of the second communication session. Although this disclosure describes relaying traffic between a user device and a resource server through a first communication session and a second communication session at a proxy in a particular manner, this disclosure contemplates relaying traffic between a user device and a resource server in any suitable manner. Further, although this disclosure describes authorization with an OIDC-compliant identity provider in a particular manner, this disclosure contemplates authorization with the OIDC-compliant identity provider in any suitable manner.

In particular embodiments, the first network apparatus108may relay traffic between the user device102and the resource server103via the first communication session and the second communication session. At step232, the user device102may transmit a request to the resource server103to access a resource. The first network apparatus108may receive the request via the first communication session from the user device102and forward it to the resource server103using the second communication session. At step234, the resource server103may send the requested one or more resources to the authorized user through the first network apparatus108. The first network apparatus108may receive the response from the resource server103using the second communication session and may relay the response to the user device102via the first communication session. At step236, the external server118may be in communication with the blockchain record110. Step236may comprise a plurality of message exchanges between the external server118and blockchain record110. The external server118may transmit a request to access the blockchain record110in order to determine one or more resource authorization tokens114and/or access tokens116generated for a user. The external server118may assess all operations allowed for that given user based on analyzing the one or more resource authorization tokens114and/or access tokens116.

FIG.3illustrates an example method300for service authentication and storing authorization tokens114(referring toFIG.1) on the blockchain record110(referring toFIG.1). The method300may begin at step302, where the second network apparatus112(referring toFIG.1) may receive an authorization request to access a resource from the user device102(referring toFIG.1) associated with a user. The request may have been redirected from the first network apparatus108(referring toFIG.1), where the first network apparatus108determined that the user device102was not authorized. The second network apparatus112may authenticate the user and determine whether the user is authorized to access the resource using the user device102. At step304, after authenticating the user, the second network apparatus112may generate an authorization response comprising a resource authorization token114. At step306, the second network apparatus112may transmit the authorization response to the user device102and the resource authorization token114to the blockchain record110. The resource authorization token114may be transmitted to the blockchain record110for storage, and the authorization response comprising the resource authorization token114may be transmitted to the user device102for further utilization in accessing a resource.

At step308, the second network apparatus112may receive the resource authorization token114from the first network apparatus108in an API call. In embodiments, the user device102may have relayed the authorization response from the second network apparatus112to the first network apparatus108. The first network apparatus108may present the received resource authorization token114to obtain an access token116(referring toFIG.1) for a resource. Upon receiving the resource authorization token114from the first network apparatus108, the second network apparatus112may generate the access token116, wherein the access token116provides access to the resource server103(referring toFIG.1). At step310, the second network apparatus112may transmit the generated access token116to the blockchain record110for storage and to the first network apparatus108for further utilization by the user operating the user device102. In embodiments, a different component other than the second network apparatus112may transmit the access token116to the blockchain record110. The method300may then proceed to end.

Particular embodiments may repeat one or more steps of the method ofFIG.3, where appropriate. Although this disclosure describes and illustrates particular steps of the method ofFIG.3as occurring in a particular order, this disclosure contemplates any suitable steps of the method ofFIG.3occurring in any suitable order. Moreover, although this disclosure describes and illustrates an example method for service authentication and storing authorization tokens on the blockchain record110including the particular steps of the method ofFIG.3, this disclosure contemplates any suitable method for service authentication and storing authorization tokens including any suitable steps, which may include all, some, or none of the steps of the method ofFIG.3, where appropriate. Furthermore, although this disclosure describes and illustrates particular components, devices, or systems carrying out particular steps of the method ofFIG.3, this disclosure contemplates any suitable combination of any suitable components, devices, or systems carrying out any suitable steps of the method ofFIG.3.

FIG.4illustrates an example computer system400. In particular embodiments, one or more computer systems400perform one or more steps of one or more methods described or illustrated herein. In particular embodiments, one or more computer systems400provide functionality described or illustrated herein. In particular embodiments, software running on one or more computer systems400performs one or more steps of one or more methods described or illustrated herein or provides functionality described or illustrated herein. Particular embodiments include one or more portions of one or more computer systems400. Herein, reference to a computer system may encompass a computing device, and vice versa, where appropriate. Moreover, reference to a computer system may encompass one or more computer systems, where appropriate. Further, each one of user device102, first network apparatus108, second network apparatus112, and resource server103inFIG.1may be any suitable computer system, such as the illustrated computer system400.

This disclosure contemplates any suitable number of computer systems400. This disclosure contemplates computer system400taking any suitable physical form. As example and not by way of limitation, computer system400may be an embedded computer system, a system-on-chip (SOC), a single-board computer system (SBC) (such as, for example, a computer-on-module (COM) or system-on-module (SOM)), a desktop computer system, a laptop or notebook computer system, an interactive kiosk, a mainframe, a mesh of computer systems, a mobile telephone, a personal digital assistant (PDA), a server, a tablet computer system, an augmented/virtual reality device, or a combination of two or more of these. Where appropriate, computer system400may include one or more computer systems400; be unitary or distributed; span multiple locations; span multiple machines; span multiple data centers; or reside in a cloud, which may include one or more cloud components in one or more networks. Where appropriate, one or more computer systems400may perform without substantial spatial or temporal limitation one or more steps of one or more methods described or illustrated herein. As an example and not by way of limitation, one or more computer systems400may perform in real time or in batch mode one or more steps of one or more methods described or illustrated herein. One or more computer systems400may perform at different times or at different locations one or more steps of one or more methods described or illustrated herein, where appropriate.

In particular embodiments, computer system400includes a processor402, memory404, storage406, an input/output (I/O) interface408, a communication interface410, and a bus412. Although this disclosure describes and illustrates a particular computer system having a particular number of particular components in a particular arrangement, this disclosure contemplates any suitable computer system having any suitable number of any suitable components in any suitable arrangement.

In particular embodiments, processor402includes hardware for executing instructions, such as those making up a computer program. As an example and not by way of limitation, to execute instructions, processor402may retrieve (or fetch) the instructions from an internal register, an internal cache, memory404, or storage406; decode and execute them; and then write one or more results to an internal register, an internal cache, memory404, or storage406. In particular embodiments, processor402may include one or more internal caches for data, instructions, or addresses. This disclosure contemplates processor402including any suitable number of any suitable internal caches, where appropriate. As an example and not by way of limitation, processor402may include one or more instruction caches, one or more data caches, and one or more translation lookaside buffers (TLBs). Instructions in the instruction caches may be copies of instructions in memory404or storage406, and the instruction caches may speed up retrieval of those instructions by processor402. Data in the data caches may be copies of data in memory404or storage406for instructions executing at processor402to operate on; the results of previous instructions executed at processor402for access by subsequent instructions executing at processor402or for writing to memory404or storage406; or other suitable data. The data caches may speed up read or write operations by processor402. The TLBs may speed up virtual-address translation for processor402. In particular embodiments, processor402may include one or more internal registers for data, instructions, or addresses. This disclosure contemplates processor402including any suitable number of any suitable internal registers, where appropriate. Where appropriate, processor402may include one or more arithmetic logic units (ALUs); be a multi-core processor; or include one or more processors402. Although this disclosure describes and illustrates a particular processor, this disclosure contemplates any suitable processor.

In particular embodiments, memory404includes main memory for storing instructions for processor402to execute or data for processor402to operate on. As an example and not by way of limitation, computer system400may load instructions from storage406or another source (such as, for example, another computer system400) to memory404. Processor402may then load the instructions from memory404to an internal register or internal cache. To execute the instructions, processor402may retrieve the instructions from the internal register or internal cache and decode them. During or after execution of the instructions, processor402may write one or more results (which may be intermediate or final results) to the internal register or internal cache. Processor402may then write one or more of those results to memory404. In particular embodiments, processor402executes only instructions in one or more internal registers or internal caches or in memory404(as opposed to storage406or elsewhere) and operates only on data in one or more internal registers or internal caches or in memory404(as opposed to storage406or elsewhere). One or more memory buses (which may each include an address bus and a data bus) may couple processor402to memory404. Bus412may include one or more memory buses, as described below. In particular embodiments, one or more memory management units (MMUs) reside between processor402and memory404and facilitate accesses to memory404requested by processor402. In particular embodiments, memory404includes random access memory (RAM). This RAM may be volatile memory, where appropriate. Where appropriate, this RAM may be dynamic RAM (DRAM) or static RAM (SRAM). Moreover, where appropriate, this RAM may be single-ported or multi-ported RAM. This disclosure contemplates any suitable RAM. Memory404may include one or more memories404, where appropriate. Although this disclosure describes and illustrates particular memory, this disclosure contemplates any suitable memory.

In particular embodiments, storage406includes mass storage for data or instructions. As an example and not by way of limitation, storage406may include a hard disk drive (HDD), a floppy disk drive, flash memory, an optical disc, a magneto-optical disc, magnetic tape, or a Universal Serial Bus (USB) drive or a combination of two or more of these. Storage406may include removable or non-removable (or fixed) media, where appropriate. Storage406may be internal or external to computer system400, where appropriate. In particular embodiments, storage406is non-volatile, solid-state memory. In particular embodiments, storage406includes read-only memory (ROM). Where appropriate, this ROM may be mask-programmed ROM, programmable ROM (PROM), crasable PROM (EPROM), electrically crasable PROM (EEPROM), electrically alterable ROM (EAROM), or flash memory or a combination of two or more of these. This disclosure contemplates mass storage406taking any suitable physical form. Storage406may include one or more storage control units facilitating communication between processor402and storage406, where appropriate. Where appropriate, storage406may include one or more storages406. Although this disclosure describes and illustrates particular storage, this disclosure contemplates any suitable storage.

In particular embodiments, I/O interface408includes hardware, software, or both, providing one or more interfaces for communication between computer system400and one or more I/O devices. Computer system400may include one or more of these I/O devices, where appropriate. One or more of these I/O devices may enable communication between a person and computer system400. As an example and not by way of limitation, an I/O device may include a keyboard, keypad, microphone, monitor, mouse, printer, scanner, speaker, still camera, stylus, tablet, touch screen, trackball, video camera, another suitable I/O device or a combination of two or more of these. An I/O device may include one or more sensors. This disclosure contemplates any suitable I/O devices and any suitable I/O interfaces408for them. Where appropriate, I/O interface408may include one or more device or software drivers enabling processor402to drive one or more of these I/O devices. I/O interface408may include one or more I/O interfaces408, where appropriate. Although this disclosure describes and illustrates a particular I/O interface, this disclosure contemplates any suitable I/O interface.

In particular embodiments, communication interface410includes hardware, software, or both providing one or more interfaces for communication (such as, for example, packet-based communication) between computer system400and one or more other computer systems400or one or more networks. As an example and not by way of limitation, communication interface410may include a network interface controller (NIC) or network adapter for communicating with an Ethernet or other wire-based network or a wireless NIC (WNIC) or wireless adapter for communicating with a wireless network, such as a WI-FI network. This disclosure contemplates any suitable network and any suitable communication interface410for it. As an example and not by way of limitation, computer system400may communicate with an ad hoc network, a personal area network (PAN), a local area network (LAN), a wide area network (WAN), a metropolitan area network (MAN), or one or more portions of the Internet or a combination of two or more of these. One or more portions of one or more of these networks may be wired or wireless. As an example, computer system400may communicate with a wireless PAN (WPAN) (such as, for example, a BLUETOOTH WPAN), a WI-FI network, a WI-MAX network, a cellular telephone network (such as, for example, a Global System for Mobile Communications (GSM) network, a Long-Term Evolution (LTE) network, or a 5G network), or other suitable wireless network or a combination of two or more of these. Computer system400may include any suitable communication interface410for any of these networks, where appropriate. Communication interface410may include one or more communication interfaces410, where appropriate. Although this disclosure describes and illustrates a particular communication interface, this disclosure contemplates any suitable communication interface.

In particular embodiments, bus412includes hardware, software, or both coupling components of computer system400to each other. As an example and not by way of limitation, bus412may include an Accelerated Graphics Port (AGP) or other graphics bus, an Enhanced Industry Standard Architecture (EISA) bus, a front-side bus (FSB), a HYPERTRANSPORT (HT) interconnect, an Industry Standard Architecture (ISA) bus, an INFINIBAND interconnect, a low-pin-count (LPC) bus, a memory bus, a Micro Channel Architecture (MCA) bus, a Peripheral Component Interconnect (PCI) bus, a PCI-Express (PCle) bus, a serial advanced technology attachment (SATA) bus, a Video Electronics Standards Association local (VLB) bus, or another suitable bus or a combination of two or more of these. Bus412may include one or more buses412, where appropriate. Although this disclosure describes and illustrates a particular bus, this disclosure contemplates any suitable bus or interconnect.

Herein, a computer-readable non-transitory storage medium or media may include one or more semiconductor-based or other integrated circuits (ICs) (such, as for example, field-programmable gate arrays (FPGAs) or application-specific ICs (ASICs)), hard disk drives (HDDs), hybrid hard drives (HHDs), optical discs, optical disc drives (ODDs), magneto-optical discs, magneto-optical drives, floppy diskettes, floppy disk drives (FDDs), magnetic tapes, solid-state drives (SSDs), RAM-drives, SECURE DIGITAL cards or drives, any other suitable computer-readable non-transitory storage media, or any suitable combination of two or more of these, where appropriate. A computer-readable non-transitory storage medium may be volatile, non-volatile, or a combination of volatile and non-volatile, where appropriate.

Herein, “or” is inclusive and not exclusive, unless expressly indicated otherwise or indicated otherwise by context. Therefore, herein, “A or B” means “A, B, or both,” unless expressly indicated otherwise or indicated otherwise by context. Moreover, “and” is both joint and several, unless expressly indicated otherwise or indicated otherwise by context. Therefore, herein, “A and B” means “A and B, jointly or severally,” unless expressly indicated otherwise or indicated otherwise by context.

The scope of this disclosure encompasses all changes, substitutions, variations, alterations, and modifications to the example embodiments described or illustrated herein that a person having ordinary skill in the art would comprehend. The scope of this disclosure is not limited to the example embodiments described or illustrated herein. Moreover, although this disclosure describes and illustrates respective embodiments herein as including particular components, elements, feature, functions, operations, or steps, any of these embodiments may include any combination or permutation of any of the components, elements, features, functions, operations, or steps described or illustrated anywhere herein that a person having ordinary skill in the art would comprehend. Furthermore, reference in the appended claims to an apparatus or system or a component of an apparatus or system being adapted to, arranged to, capable of, configured to, enabled to, operable to, or operative to perform a particular function encompasses that apparatus, system, component, whether or not it or that particular function is activated, turned on, or unlocked, as long as that apparatus, system, or component is so adapted, arranged, capable, configured, enabled, operable, or operative. Additionally, although this disclosure describes or illustrates particular embodiments as providing particular advantages, particular embodiments may provide none, some, or all of these advantages.