Patent ID: 12192068

DETAILED DESCRIPTION

Various aspects of the disclosure are described more fully hereinafter with reference to the accompanying drawings. This disclosure may, however, be embodied in many different forms and should not be construed as limited to any specific structure or function presented throughout this disclosure. Rather, these aspects are provided so that this disclosure will be thorough and complete, and will fully convey the scope of the disclosure to those skilled in the art. Based on the teachings herein, one skilled in the art should appreciate that the scope of the disclosure is intended to cover any aspect of the disclosure disclosed herein, whether implemented independently of or combined with any other aspect of the disclosure. For example, an apparatus may be implemented or a method may be practiced using any number of the aspects set forth herein. In addition, the scope of the disclosure is intended to cover such an apparatus or method which is practiced using other structure, functionality, or structure and functionality in addition to or other than the various aspects of the disclosure set forth herein. It should be understood that any aspect of the disclosure disclosed herein may be embodied by one or more elements of a claim.

For the purposes of promoting an understanding of the principles of the present disclosure, reference will now be made to the aspects illustrated in the drawings, and specific language may be used to describe the same. It will nevertheless be understood that no limitation of the scope of the disclosure is intended. Any alterations and further modifications to the described devices, instruments, methods, and any further application of the principles of the present disclosure are fully contemplated as would normally occur to one skilled in the art to which the disclosure relates. In particular, it is fully contemplated that the features, components, and/or steps described with respect to one aspect may be combined with the features, components, and/or steps described with respect to other aspects of the present disclosure. For the sake of brevity, however, the numerous iterations of these combinations may not be described separately. For simplicity, in some instances the same reference numbers are used throughout the drawings to refer to the same or like parts.

FIG.1is an illustration of an example100associated with improved access control for network services, according to various aspects of the present disclosure. Example100shows an architectural depiction of included components. In some aspects, the components may include cyber security service provider (CSP) control infrastructure102, a service distributor108, a service manager114, and one or more user devices120in communication with each other over a network126. The CSP control infrastructure102may include a processing unit104and a security database106to enable provision of network services. The service distributor108may include a processing unit110and a web application112to enable the service distributor108to access and/or communicate with the CSP control infrastructure102regarding the network services. The service manager114may include a processing unit116and a web application118to enable the service manager114to access and/or communicate with the CSP control infrastructure102regarding the network services. The user device120may include a processing unit122and a web application124to enable the user device120to access and/or communicate with the CSP control infrastructure102and/or to enable receipt of the network services.

In some aspects, the CSP control infrastructure102may be owned and operated by a cyber security service provider for purposes of, for example, providing network services. The CSP control infrastructure102may include a combination of hardware and software components that enable provision of the network services. As discussed below in further detail, the CSP control infrastructure102may interface with a web application installed on an entity (e.g., the service distributor, the service manager, and/or the user device120). The CSP control infrastructure102may utilize an application programming interface (API) to interface with the web application, the API including one or more endpoints to a defined request-response message system. In some aspects, the API may be configured to receive, via the network, an access request from the entity to access the CSP control infrastructure102for purposes associated with provision of the network services. The access request may include an authentication request to authenticate the entity and/or to receive the network services.

The API may further be configured to handle the connection request(s) by mediating the authentication request. For instance, the API may receive from the entity credentials including, for example, a unique combination of a user ID and password for purposes of authenticating the entity. In another example, the credentials may include a unique validation code or a one-time passcode known to an authorized user. The API may provide the received credentials to the processing unit104for verification. The processing unit104may communicate with the security database106to authenticate the entity.

The security database106may include a structured repository of valid credentials belonging to authorized users. In one example, the structured repository may include one or more tables containing valid unique combinations of user IDs and passwords belonging to authorized users. In another example, the structured repository may include one or more tables containing valid unique validation codes or one-time passcodes associated with authorized users. The cyber security service provider may add or delete such valid unique combinations of user IDs and passwords from the structured repository at any time. Based at least in part on receiving the credentials from the API, the user database106and a processor (e.g., the processing unit104or another local or remote processor) may verify the received credentials by matching the received credentials with the valid credentials stored in the structured repository. In some aspects, the security database106and the processing unit104may authenticate the user device120when the received credentials match at least one of the valid credentials. In this case, the cyber security service provider may enable the CSP control infrastructure to provide access and/or the network services to the entity. When the received credentials fail to match at least one of the valid credentials, the user database106and the processor may fail to authenticate the entity. In this case, the cyber security service provider may enable the CSP control infrastructure to decline to provide access and/or the network services to the entity.

In some aspects, an entity may include a processing unit (e.g., processing unit110, processing unit116, processing unit122). In some aspects, the processing unit may include a logical unit including a logical component configured to perform complex operations associated with computing, for example, numerical weights related to various factors associated with providing the network services. In some aspects, the processing unit may include processor720discussed below with respect toFIG.7.

In some aspects, the entity may install an instance of a web application (e.g., web application112, web application118, web application124). In an example, the web application may include a client application configured and provided by the CSP control infrastructure102to enable the entity to gain access to the CSP control infrastructure102and/or to obtain the network services. In another example, the web application may include a web browser configured by the CSP control infrastructure102to execute a cyber security script provided by the CSP control infrastructure102to enable the entity to gain access to the CSP control infrastructure102and/or to obtain the network services.

The service distributor108may utilize the processing unit110and/or the web application112to communicate with the CSP control infrastructure102regarding the network services. In an example, the service distributor108may establish a business relationship with the cyber security provider to enable distribution of the network services. For instance, the service distributor108may enable distribution of the network services to one or more user devices120. In some aspects, the user devices120may be associated with individual users. In some aspects, the user devices120may be associated with a group of users such as, for example, employees of a company, members of a family, or the like. As discussed below in further detail with respect toFIG.2, the CSP control infrastructure102may enable optimized control access by the service distributor108to the CSP control infrastructure102.

The service distributor108may establish a business relationship with the service manager114for managing provision of the distributed network services. In an example, the service manager114may manage allocation of the network services among the one or more user devices120. In another example, the service manager114may manage tiered access to the network services by the one or more user devices120. For instance, the service manager114may enable a tier-1 user device120to access available network services and may enable a tier-2 user device120to access a subset of the available network services. As discussed below in further detail with respect toFIG.3, the CSP control infrastructure102may also enable optimized control access by the service manager114to the CSP control infrastructure102.

A user device120may utilize the processing unit122and/or the web application124to access the CSP control infrastructure102and/or to obtain the network services. Non-limiting examples of the user device120include, for example, a laptop, a mobile phone, a tablet computer, a desktop computer, a server computer, a smart device, a router, an Internet-of-Things (IoT) device such as an MSP smart home appliance, a smart home security system, an autonomous vehicle, a smart health monitor, smart factory equipment, a wireless inventory tracker, a biometric scanner, or a combination thereof.

The network126may include any digital network that permits several nodes to share and access resources. In some aspects, the network126may include one or more of, for example, a local-area network (LAN), a wide-area network (WAN), a campus-area network (CAN), a metropolitan-area network (MAN), a home-area network (HAN), Internet, Intranet, Extranet, and Internetwork.

One or more components (e.g., processing units, security database, web applications, etc.) included in example100shown inFIG.1may further be associated with a controller/processor, a memory, a communication interface, or a combination thereof (e.g.,FIG.7). For instance, the one or more components may include or may be included in a controller/processor, a memory, or a combination thereof. In some aspects, the one or more components included may be separate and distinct from each other. Alternatively, in some aspects, the one or more of the components may be combined with one or more of the other components. In some aspects, the one or more of the components may be local with respect to one or more of the other components. Alternatively, in some aspects, the one or more of the components may be located remotely with respect to one or more of the other components. Additionally, or alternatively, the one or more components may be implemented at least in part as software stored in a memory for execution by a processor. For example, a component (or a portion of a component) may be implemented as instructions or code stored in a non-transitory computer-readable medium and executable by a controller or a processor to perform the functions or operations of the component. Additionally, the one or more components may be configured to perform one or more functions described as being performed by another one or more of the components.

As indicated above,FIG.1is provided as an example. Other examples may differ from what is described with regard toFIG.1.

To reduce occurrence of cybercrimes and/or to mitigate risks associated with cybercrimes, a cyber security provider may utilize a CSP control infrastructure to provide network services to user devices. Further, to reach a wider network of user devices, the cyber security provider may establish a business relationship with a service distributor that may enable the cyber security provider in distributing the network services. In some cases, the service distributor may own and operate a network platform (e.g., cloud-based platform) to enable the user devices to obtain the network services from the CSP control infrastructure. In an example, the user devices may utilize a network (e.g., Internet) to receive the network services from the CSP control infrastructure through the network platform. Further, the service distributor may establish a business relationship with a service manager that may manage provision of the distributed network services to the user devices.

In this case, the CSP control infrastructure, the service distributor, the service manager, and/or the user devices may communicate with each other access information associated with the service distributor, the service manager, and/or the user devices accessing the CSP control infrastructure in connection with the network services. In some cases, the CSP control infrastructure may communicate access information with the service distributor (or service manager or user device) to enable the service distributor (or service manager or user device) to access the CSP control infrastructure. Similarly, the service distributor may communicate access information with the service manager to enable the service manager to access the CSP control infrastructure. Similarly, the service manager may communicate access information with the user devices to enable the user devices to access the CSP control infrastructure.

Utilization of the network platform by the service provider and/or communication of the access information among different entities may result in private information (e.g., identification information, contact information, financial information, location information, etc.) associated with the service distributor, the service manager, and/or the user devices becoming compromised. In an example, such utilization of the network platform and/or communication of the service information may involve unencrypted communication of the access information over the open Internet among the user devices, the service distributor, the service manager, and/or the CSP control infrastructure. A malicious party may monitor and/or intercept the unencrypted communication to gain unauthorized access to the access information. Further, the malicious party, while acting as the service distributor, the service manager, and/or user device, may utilize the access information to gain unauthorized access to the CSP control infrastructure. Based at least in part on gaining unauthorized access to the CSP control infrastructure, the malicious party may execute unauthorized requests to gain unauthorized access to the private information.

Based at least in part on gaining unauthorized access to the private information, the malicious party may gain unauthorized access to systems and/or devices associated with the service distributor, the service manager, the user devices, and/or the CSP control infrastructure. Based at least in part on gaining unauthorized access to the systems and/or devices, the malicious party may introduce malware in the systems and/or devices, the malware being designed to disrupt and/or damage operation of the systems and/or devices. In an example, the malware may adversely affect operating systems utilized by the systems and/or devices such that the operating systems may run slower and/or associated circuitry may emit excessive heat and/or noise, thereby causing damage. Further, the malware may execute unauthorized transmission and/or deletion of the private information from memories associated with the systems and/or devices.

The user devices, the service distributor, the service manager, and/or the CSP control infrastructure may expend various resources (e.g., processing resources, management resources, memory resources, bandwidth resources, network resources, financial resources, power consumption resources, battery life, or the like) in efforts to mitigate effects of the access information becoming compromised.

Various aspects of systems and techniques discussed in the present disclosure enable improved access control for network services. In some aspects, a cyber security service provider may utilize a CSP control infrastructure to provide network services (e.g., cyber security services, data storage and protection services, or a combination thereof) to user devices. The network services may be distributed to the user devices by a service distributor and may be managed by a service manager. To facilitate protection of access information associated with the user devices, the CSP control infrastructure may implement the optimized access control. In some aspects, the optimized access control may include the CSP control infrastructure providing respective authentication mechanisms for the service distributor, the service manager, and/or the user devices to gain authorized access to the CSP control infrastructure. The authentication mechanisms may assist in ensuring that the service provider, the service manager, and/or the user devices receive access to the CSP control infrastructure while other parties (e.g., a malicious party) may be prevented from gaining unauthorized access to the CSP control infrastructure. In this way, the optimized access control may enable efficient utilization of resources (e.g., processing resources, management resources, memory resources, bandwidth resources, network resources, financial resources, power consumption resources, battery life, or the like) by the CSP control infrastructure, the service distributor, the service manager, and/or the user devices for more suitable tasks.

In some aspects, a system including an infrastructure device; and a manager device configured to manage network services provided by the infrastructure device, wherein the infrastructure device is configured to transmit, to the manager device, an invitation link to enable the manager device to manage network services provided by the infrastructure device, the infrastructure device is configured to transmit, to the manager device based at least in part on verifying that the invitation link was activated by the manager device, seed information to enable the manager device to determine authorization information, the manager device is configured to determine the authorization information based at least in part on utilizing the seed information, the manager device is configured to transmit, to the infrastructure device during a communication session, a manager request related to an action to be performed regarding the network services, the manager request being signed based at least in part on utilizing a first portion of the authorization information; and the infrastructure device is configured to authorize the manager request based at least in part on verifying that the communication session is currently active.

FIG.2is an illustration of an example flow200associated with improved access control for network services, according to various aspects of the present disclosure. The example flow200may include a CSP control infrastructure (e.g., CSP control infrastructure102) and a service distributor (e.g., service distributor108) in communication with each other over a network126. The CSP control infrastructure102may include a processing unit104and a security database106to enable provision of the network services. The service distributor108may include a processing unit110and a web application112to enable access by the service distributor108to the CSP control infrastructure102and/or to enable receipt of the network services.

In some aspects, the web application112may enable the service distributor108to receive information to be processed by the web application112and/or by the CSP control infrastructure102. The web application112may include a graphical user interface to receive the information via a local input interface (e.g., touch screen, keyboard, mouse, pointer, etc.) associated with the service distributor108. The information may be received via text input or via a selection from among a plurality of options (e.g., pull down menu, etc.). In some aspects, the web application112may activate and/or enable, at an appropriate time, the graphical interface for receiving the information. For instance, the web application112may cause a screen (e.g., local screen) associated with the service distributor108to display, for example, a pop-up message to request entry of the information. Further, the web application112may enable transmission of at least a portion of the information to the CSP control infrastructure102. In some aspects, the web application112may utilize a processing unit (e.g., processing unit110, processor720) associated with the service distributor108to perform processes/operations associated with classification of the data files.

In some aspects, as discussed elsewhere herein, the CSP control infrastructure102and the service distributor108may enter into a business relationship regarding distribution of network services provided by the CSP control infrastructure102. As shown by reference numeral210, the service distributor108may register a distributor account with the CSP control infrastructure102. During registration, the service distributor108may provide registration information to the CSP control infrastructure102. Such registration information may include, for example, identification information associated with the service distributor108, contact information associated with the service distributor108(e.g., a phone number, an email address, or the like), financial information (e.g., bank account number), or a combination thereof.

Based at least in part on receiving the registration information, as shown by reference numeral220, the CSP control infrastructure102may determine and transmit an invitation link to the service distributor108. The CSP control infrastructure102may utilize the contact information (e.g., email address) associated with the service distributor108to transmit the invitation link. The invitation link may include a uniform resource locator (URL) associated with a uniform resource identifier (URI).

In some aspects, the invitation link may include a static portion and a dynamic portion. In an example, the invitation link may be in the form of (static portion)(dynamic portion). The static portion may remain constant for invitation links determined with respect to inviting service distributors (e.g., service distributor108) to access the CSP control infrastructure102. In some aspects, the CSP control infrastructure102may configure the static portion to include routing information to enable routing of the service distributor108to a server associated with the CSP control infrastructure102.

The dynamic portion may be time-specific and/or recipient-specific (e.g., unique to the service distributor108). In some aspects, the dynamic portion may be determined randomly utilizing time-specific information and/or recipient-specific information. When the dynamic portion is time-specific, the CSP control infrastructure102may determine the time-specific dynamic portion to include a unique time identifier identifying a point in time utilizing a UNIX time system (e.g., Epoch time, Posix time, etc.). In some aspects, the identified point in time may be associated with a point in time when the invitation link is determined. In some aspects, the identified point in time may be associated with a point in time and/or a duration of time indicating an expiration time before which the invitation link is to be utilized by the service distributor108to access the CSP control infrastructure102. In some aspects, when the dynamic portion is time-specific, the invitation link may be configured to be utilized a limited number of times. In some aspects, the invitation link may include rate-limiting properties such that the invitation link may be utilized the limited number of times prior to the expiration time. In an example, the CSP control infrastructure102may determine the unique time identifier based at least in part on encoding information indicating the identified point in time, the limited number of times, and/or the rate limiting properties into a unique string of alphanumeric and/or special characters.

When the dynamic portion is recipient-specific, the CSP control infrastructure102may determine the recipient-specific dynamic portion based at least in part on determining a unique recipient identifier that identifies the service distributor108. To determine the unique recipient identifier, the CSP control infrastructure102may utilize at least a portion of the identification information received along with the registration information from the service distributor108. In an example, the CSP control infrastructure102may encode the identification information into a unique string of alphanumeric and/or special characters to determine the unique recipient identifier.

In some aspects, the invitation link may be in the form of, for example,https://CSPcontrolinfrastructure.com/invitation/74obUbN2et6fYKqd70vNHRVXoONh4wyrUgg=,where https://CSPcontrolinfrastructure.com/webview/ may include the static portion and 74obUbN2et6fYKqd70vNHRVXoUKDaWICgONh4wyrUgg= may be the dynamic portion (e.g., unique time identifier and/or unique recipient identifier).

In some aspects, the invitation link may be in the form of, for example,https://CSPcontrolinfrastructure.com/invitation/HFTGKVBKDHRUVWTDDHPXQPBASRQB CFYT, orhttps://CSPcontrolinfrastructure.com/invitation/DCsMGVnkeKLMfx3FkCcDxbQgJUHHuEb5, orhttps://CSPcontrolinfrastructure.com/invitation/2b9f7a72-f4a8-46f8-b38c-ad50dcdd78a7.

In some aspects, the CSP control infrastructure102may correlate and store information included in the invitation link in association with the service distributor108and/or the registered distributor account. In this way, when the invitation link is activated, the CSP control infrastructure102may determine that the invitation link was activated by the service distributor108and is associated with the registered distributor account. Further, when the invitation link is activated, the CSP control infrastructure102may determine whether the invitation link was activated in compliance with the expiration time and/or in compliance with the limited number of times and/or in compliance with the rate-limiting properties.

Based at least in part on receiving the invitation link, as shown by reference numeral230, the service distributor108may activate the invitation link. In some aspects, the service distributor108may utilize the web application112to activate the invitation link. In this case, the CSP control infrastructure102may determine that the invitation link was activated by the service distributor108and may verify that the invitation link was activated in compliance with the expiration time and/or in compliance with the limited number of times and/or in compliance with the rate-limiting properties.

Based at least in part on a successful verification, as shown by reference numeral240, the CSP control infrastructure102may enable the web application112and/or the service distributor108to determine distributor cryptographic keys. In an example, when the web application112includes a client application configured and provided by the CSP control infrastructure102, the CSP control infrastructure102may transmit activation information to activate a configured functionality within the client application to determine the distributor cryptographic keys. Alternatively, configuration of the client application by the CSP control infrastructure may enable automatic activation of the functionality to determine the distributor cryptographic keys based at least in part on receipt of certain information (e.g., master password, etc.) by the web application112. In another example, when the web application112includes a web browser, the CSP control infrastructure102may transmit a script to be executed by the web browser on the service distributor108to determine the distributor cryptographic keys. In some aspects, the CSP control infrastructure may transmit unique information (e.g., identification information, contact information, etc., or a combination thereof) associated with the service distributor108to be used as seed information for determining the distributor cryptographic keys, thereby enabling the distributor cryptographic keys to be unique to the service distributor108.

Based at least in part on being enabled, as shown by reference numeral250, the web application112installed on the service distributor108may determine and assign an asymmetric distributor key pair to the service distributor108and/or to the registered distributor account. In some aspects, the web application112may utilize the seed information for determining the distributor key pair, as indicated by the CSP control infrastructure102. The distributor key pair may be unique to the service distributor108and/or to the registered distributor account. The distributor public key and the distributor private key may be associated with each other via, for example, a mathematical function. As a result, data encrypted using the distributor public key may be decrypted by utilizing the distributor private key. Similarly, data signed using the distributor private key may be validated by utilizing the distributor public key.

Based at least in part on determining the distributor key pair, as shown by reference numeral260, the web application112and/or the service distributor108may transmit the distributor public key to the CSP control infrastructure102. In some aspects, the distributor public key may be transmitted in association with a message signed by using the distributor private key. In some aspects, the distributor public key may be transmitted along with the message signed by using the distributor private key. In some aspects, the service distributor108may utilize an algorithm such as, for example, a cryptography algorithm (e.g., Ed25519 or EdDSA), the RSA algorithm (e.g., RSA), or the like along with the distributor private key to sign the message.

Based at least in part on receiving the distributor public key in association with the signed message, as shown by reference numeral270, the CSP control infrastructure102may validate the signed message. In some aspects, the CSP control infrastructure102may utilize the distributor public key to validate the signed message. When the signed message is signed using the distributor private key, that is associated with the distributor public key, the CSP control infrastructure102may successfully validate the signed message. In this case, the CSP control infrastructure102may determine that the service distributor108, that activated the invitation link and transmitted the signed message, is in possession of the distributor private key. Based at least in part on determining that the service distributor108is in possession of the distributor private key, the CSP control infrastructure102may store the distributor public key in correlation with the service distributor108and/or the registered distributor account.

When the service distributor108is to access the CSP control infrastructure102, as shown by reference numeral280, the service distributor108may utilize the web application112to transmit an action request to an application programming interface (API) associated with the CSP control infrastructure102. In some aspects, the action request may be associated with requesting an action to be performed in connection with distributing the network services. The service distributor108may utilize the web application112to transmit the action request, which may include an Internet protocol (IP) packet. In some aspects, the IP packet may enable the service distributor108to, for example, call a function related to the action to be performed in connection with distributing the network services. Some examples of actions to be performed in connection with distributing the network services include registering a service manager (e.g., service manager114) associated with the service distributor108, reviewing user data associated with usage of network services by user devices associated with the service distributor108, reviewing financial information, or the like.

In some aspects, to enable authentication of the action request with the CSP control infrastructure102, the service distributor108may include a web token in the IP packet. The web token may include authentication information to be utilized by the CSP control infrastructure102to authenticate the action request. Such authentication information may include, for example, identification information regarding the service distributor108, information regarding a point in time when the web token was created, information regarding a point in time when the web token was signed, or a combination thereof. In an example, the service distributor108may include the web token in a header included in the IP packet. In another example, the service distributor108may include the web token in a payload included in the IP packet. In some aspects, the web token may include a JSON web token (JWT). Further, the service distributor108may sign the request by using the distributor private key.

In some aspects, every action request from the service distributor108may be authenticated by the CSP control infrastructure102. In other words, for every action request, the service distributor108may determine and transmit a respective IP packet including a respective web token, with the action request being signed by using the distributor private key.

Based at least in part on receiving the action request, as shown by reference numeral290, the CSP control infrastructure102may validate the action request. In some aspects, the CSP control infrastructure102may receive the IP packet and may extract the signed web token from the header or the payload included in the IP packet. Further, the CSP control infrastructure102may receive the identification information associated with the service provider108from the extracted web token. Based at least in part on analyzing the identification information, the CSP control infrastructure102may determine that the action request is transmitted by the service distributor108. In this case, the CSP control infrastructure102may retrieve the distributor public key stored in correlation with the service distributor108and/or the registered distributor account associated with the service distributor108.

The CSP control infrastructure102may utilize the retrieved distributor public key to validate the signed action request. When the action request is signed using the distributor private key, that is associated with the distributor public key, the CSP control infrastructure102may successfully validate the signed action request. In this case, the CSP control infrastructure102may determine that the service distributor108, that transmitted the action request, is in possession of the distributor private key and/or is the same service distributor108associated with the registered distributor account. In other words, the CSP control infrastructure102may determine that the service distributor108is authorized to make the action request. As a result, the CSP control infrastructure102may enable the service distributor108to perform the requested action and/or the CSP control infrastructure102may perform the requested action.

In this way, by utilizing the optimized access control, as discussed herein, the CSP control infrastructure may mitigate instances of a malicious party gaining unauthorized access to the CSP control infrastructure, the service distributor, the service manager, and/or the user devices. Further, the CSP control infrastructure may mitigate instances of private information associated with the user devices becoming compromised. As a result, the optimized access control may enable efficient utilization of resources (e.g., processing resources, management resources, memory resources, bandwidth resources, network resources, financial resources, power consumption resources, battery life, or the like) by the CSP control infrastructure, the service distributor, the service manager, and/or the user devices for more suitable tasks.

As indicated above,FIG.2is provided as an example. Other examples may differ from what is described with regard toFIG.2.

FIG.3is an illustration of an example flow300associated with improved access control for network services, according to various aspects of the present disclosure. The example flow300may include a CSP control infrastructure (e.g., CSP control infrastructure102) and a service manager (e.g., service manager114) in communication with each other over a network126. The CSP control infrastructure102may include a processing unit104and a security database106to enable provision of the network services. The service manager114may include a processing unit116and a web application118to enable access by the service manager114to the CSP control infrastructure102and/or to enable receipt of the network services.

In some aspects, the web application118may enable the service manager114to receive information to be processed by the web application118and/or by the CSP control infrastructure102. The web application118may include a graphical user interface to receive the information via a local input interface (e.g., touch screen, keyboard, mouse, pointer, etc.) associated with the service manager114. The information may be received via text input or via a selection from among a plurality of options (e.g., pull down menu, etc.). In some aspects, the web application118may activate and/or enable, at an appropriate time, the graphical interface for receiving the information. For instance, the web application118may cause a screen (e.g., local screen) associated with the service manager114to display, for example, a pop-up message to request entry of the information. Further, the web application118may enable transmission of at least a portion of the information to the CSP control infrastructure102. In some aspects, the web application118may utilize a processing unit (e.g., processing unit106, processor720) associated with the service manager114to perform processes/operations associated with the improved access control.

In some aspects, as discussed elsewhere herein, the service distributor108may establish a business relationship with the service manager114for managing provision of the distributed network services. In an example, the service manager114may manage allocation of the network services among the one or more user devices120. In another example, the service manager114may manage tiered access to the network services by the one or more user devices120. For instance, the service manager114may enable a tier-1 user device120to access available network services and may enable a tier-2 user device120to access a subset of the available network services.

The CSP control infrastructure102may enable optimized control access by the service manager114to the CSP control infrastructure102. In some aspects, as shown by reference numeral305, the CSP control infrastructure102may receive manager information associated with the service manager114from the service distributor108. Such manager information may include, for example, identification information, contact information (e.g., a phone number, an email address, or the like), financial information (e.g., bank account number), or a combination thereof.

Based at least in part on receiving the manager information, as shown by reference numeral310, the CSP control infrastructure102may determine and transmit an invitation link to the service manager114. The CSP control infrastructure102may utilize the contact information (e.g., email address) associated with the service manager114to transmit the invitation link. The invitation link may include a uniform resource locator (URL) associated with a uniform resource identifier (URI).

In some aspects, the invitation link may include a static portion and a dynamic portion. In an example, the invitation link may be in the form of (static portion)(dynamic portion). The static portion may remain constant for invitation links determined with respect to inviting service managers (e.g., service manager114) to access the CSP control infrastructure102. In some aspects, the CSP control infrastructure102may configure the static portion to include routing information to enable routing of the service manager114to a server associated with the CSP control infrastructure102.

The dynamic portion may be time-specific and/or recipient-specific (e.g., unique to the service manager114). When the dynamic portion is time-specific, the CSP control infrastructure102may determine the time-specific dynamic portion to include a unique time identifier identifying a point in time utilizing, for example, a UNIX time system (e.g., Epoch time, Posix time, etc.). In some aspects, the identified point in time may be associated with a point in time when the invitation link is determined. In some aspects, the identified point in time may be associated with a point in time and/or a duration of time indicating an expiration time before which the invitation link is to be activated by the service manager114to access the CSP control infrastructure102. In some aspects, when the dynamic portion is time-specific, the invitation link may be configured to be utilized a limited number of times. The rate-limiting properties may also mitigate instances of a malicious party gaining unauthorized access via the invitation link (e.g., guess, brute force, etc.). In an example, the CSP control infrastructure102may determine the unique time identifier based at least in part on encoding information indicating the identified point in time, the limited number of times, and/or the rate limiting properties into a unique string of alphanumeric and/or special characters.

When the dynamic portion is recipient-specific, the CSP control infrastructure102may determine the recipient-specific dynamic portion based at least in part on determining a unique recipient identifier that identifies the service manager114. To determine the unique recipient identifier, the CSP control infrastructure102may utilize at least a portion of the identification information received along with the manager information from the service distributor108. In an example, the CSP control infrastructure102may encode the identification information into a unique string of alphanumeric and/or special characters to determine the unique recipient identifier.

In some aspects, the invitation link may be in the form of, for example,https://CSPcontrolinfrastructure.com/webview/M74obUbN2et6fYKqd70vNHRV XoONh4wyrthig=where https://CSPcontrolinfrastructure.com/webview/may include the static portion and M74obUbN2et6fYKqd70vNHRVXoUKDaWICgONh4wyrUgg= may be the dynamic portion (e.g., unique time identifier and/or unique recipient identifier).

In some aspects, the CSP control infrastructure102may correlate and store information included in the invitation link in association with the manager information associated with the service manager114. In this way, when the invitation link is activated, the CSP control infrastructure102may determine that the invitation link was activated by the service manager114. Further, when the invitation link is activated, the CSP control infrastructure102may verify whether the invitation link was activated in compliance with the expiration time and/or in compliance with the limited number of times and/or in compliance with the rate-limiting properties.

Based at least in part on receiving the invitation link, as shown by reference numeral315, the service manager114may activate the invitation link to access the CSP control infrastructure102. In some aspects, the service manager114may utilize the web application118to activate the invitation link. In this case, the CSP control infrastructure102may determine that the invitation link was activated by the service manager114and may verify that the invitation link was activated in compliance with the expiration time and/or in compliance with the limited number of times and/or in compliance with the rate-limiting properties, as discussed elsewhere herein.

Based at least in part on activating the link, the service manager114may set up a manager account with the CSP control infrastructure102. To set up the manager account, the service manager114may utilize the web application118. In some aspects, the service manager114may set up a login system including registering a unique combination of a username and/or a password (e.g., login information) in association with the manager account. In some aspects, the CSP control infrastructure102may associate the manager account associated with the service manager114with the service distributor108. As a result, the service distributor108may have authorized access to review information associated with network services managed by the service manager114and/or information associated with network services received by the service manager114.

Based at least in part on the service manager114logging into the manager account, as shown by reference numeral320, the CSP control infrastructure102may authenticate login information and enable the service manager114to determine authorization information. In an example, when the web application118includes a client application configured and provided by the CSP control infrastructure102, the CSP control infrastructure102may transmit activation information (e.g., enabling information) to activate a configured functionality within the client application to determine the authorization information. Alternatively, configuration of the client application by the CSP control infrastructure102may enable automatic activation of the functionality to determine the authorization information based at least in part on receipt of certain information (e.g., master password, etc.) by the client application. In another example, when the web application118includes a web browser, the CSP control infrastructure102may transmit a script (e.g., enabling information) to be executed by the web browser on the service manager114to determine the authorization information. In some aspects, the CSP control infrastructure may transmit unique information (e.g., identification information, contact information, etc., or a combination thereof) associated with the service manager114to be used as seed information for determining the authorization information, thereby enabling the authorization information to be unique to the service manager114.

The authorization information may include, for example, an asymmetric manager key pair, a master password, and/or a master key. For instance, based at least in part on receiving the seed information, as shown by reference numeral325, the service manager114may determine an asymmetric manager key pair associated with the service manager114and/or the manager account. In other words, the manager key pair may be unique to the service manager114and/or the manager account. The manager key pair may include a manager public key and a manager private key. The manager public key and the manager private key may be associated with each other via, for example, a mathematical function. As a result, data encrypted using the manager public key may be decrypted by utilizing the manager private key. Further, data signed using the manager private key may be validated by utilizing the manager public key.

The service manager114may also determine the master password including a master string of alphanumeric characters. In some aspects, the master string may be based at least in part on the seed information and may be unique to the service manager114and/or the manager account. Based at least in part on receiving the master string, the service manager114may utilize the web application118to determine a master key. In some aspects, the service manager114may utilize a password derivation function and/or a key derivation function to determine the master key based at least in part on the master string. The password derivation function and/or the key derivation function may perform password hashing to determine the master key. The web application118may utilize the master key to encrypt the manager private key.

As shown by reference numeral330, the service manager114may transmit, and the CSP control infrastructure102may receive, at least a portion of the information determined by the service manager114. For instance, the service manager114may transmit, for example, the manager public key and the encrypted manager private key to the CSP control infrastructure102. The CSP control infrastructure102may store the received information in association with the manager information and/or the service manager114and/or the manager account associated with the service manager114.

When the service manager114is to access the CSP control infrastructure102, as shown by reference numeral335, the service manager114may authenticate itself with the CSP control infrastructure102. In some aspects, the service manager114may initiate a session based at least in part on logging-in into the CSP control infrastructure102by utilizing the unique combination of the username and/or the password. Further, the service manager114may provide identification information that identifies the service manager114.

In this case, as shown by reference numeral340, the CSP control infrastructure102may determine, based at least in part on receiving the unique combination of the username and/or the password associated with the manager account and/or the identification information, that the service manager114associated with the manager account has initiated the session. In this case, the CSP control infrastructure102may determine a session token for the session initiated by the service manager114. Further, the CSP control infrastructure102may retrieve the manager public key and the encrypted manager private key associated with the service manager114and/or the manager account. The CSP control infrastructure102may transmit the encrypted manager private key to the service manager114.

The CSP control infrastructure102may authenticate the service manager114to provide access. In some aspects, the CSP control infrastructure102may enable (e.g., activate functionality and/or provide script for) the web application118to receive the master password associated with the service manager114. The web application118may enable the graphical user interface to receive the master password. Based at least in part on the web application118receiving the master password, the CSP control infrastructure102may enable (e.g., activate functionality and/or provide script for) the web application118to determine the master key, and to utilize the master key to decrypt the encrypted manager private key. Based at least in part on decrypting the encrypted manager private key, the service manager114may utilize the manager private key to sign manager requests during the active session.

As shown by reference numeral345, the service manager114may utilize the web application118to transmit a manager request to an application programming interface (API) associated with the CSP control infrastructure102. In some aspects, the manager request may be associated with requesting an action to be performed in connection with managing the distributed network services. The service manager114may utilize the web application118to transmit the manager request, which may include an Internet protocol (IP) packet. In some aspects, the IP packet may enable the service manager114to, for example, call a function related to the action to be performed in connection with managing the distributed network services. Some examples of actions to be performed in connection with managing the distributed network services include registering one or more subordinate manager devices/accounts, registering one or more user devices (e.g., user devices102) associated with the service manager114, reviewing user data associated with usage of network services by user devices associated with the service manager114, reviewing financial information, or the like.

In some aspects, to enable authorization of the manager request with the CSP control infrastructure102, the service manager114may include a web token in the IP packet. The web token may include information to be utilized by the CSP control infrastructure102to authorize the manager request. Such information may include, for example, identification information regarding the service manager114, information regarding a point in time when the web token was created, information regarding a point in time when the web token was signed and/or transmitted, or a combination thereof. In an example, the service manager114may include the web token in a header included in the IP packet. In another example, the service manager114may include the web token in a payload included in the IP packet. In some aspects, the web token may include a JSON web token (JWT). Further, the service manager114may sign the request by using the manager private key.

In some aspects, every manager request from the service manager114may be authorized by the CSP control infrastructure102. In other words, for every manager request, the service manager114may determine and transmit a respective IP packet including a respective web token, with the manager request being signed by using the manager private key.

Based at least in part on receiving the manager request, as shown by reference numeral350, the CSP control infrastructure102may authorize the manager request. In some aspects, the CSP control infrastructure102may receive the IP packet and may extract the web token from the header or the payload included in the IP packet.

Further, the CSP control infrastructure102may determine whether the session associated with the service manager is still active. The CSP control infrastructure may also determine, based at least in part on the information regarding the points in time in the manager request, that the manager request was determined during the active session. When the CSP control infrastructure102determines that the session associated with the service manager is still active and/or that the manager request was determined during the active session and/or that the manager request was signed and/or that the manager request was transmitted during the active session, the CSP control infrastructure may utilize the retrieved manager public key to authorize the manager request.

When the manager request is signed using the manager private key, that is associated with the manager public key, the CSP control infrastructure102may successfully authorize the signed manager request. In this case, the CSP control infrastructure102may determine that the service manager114is authorized to make the manager request. As a result, the CSP control infrastructure102may enable the service manager114to perform the requested action and/or the CSP control infrastructure102may perform the requested action.

In some aspects, the service manager114may enable manager devices associated with the service manager114(e.g., administrative personnel, employees, etc. associated with the service manager114) to set up subordinate manager accounts related to the manager account associated with the service manager114. Each subordinate manager account may be set up in a similar and/or analogous manner as the manager account. In an example, each subordinate manager account may be associated with a respective subordinate manager key pair, subordinate master password, etc. Further, each subordinate manager account may transmit the respective subordinate manager public key and an encrypted respective subordinate manager private key to the CSP control infrastructure102, as discussed above with respect to the service manager114. In some aspects, the subordinate manager accounts may have different levels of access to the CSP control infrastructure102. In an example, a subordinate manager account associated with administrative personnel may have access to the CSP control infrastructure102to perform administrative functions associated with accounts (e.g., manager account, subordinate manager accounts, etc.) associated with the service manager114. In another example, a subordinate manager account associated with an employee may have access to the CSP control infrastructure102to perform employee functions associated with employment of the employee at the service manager114.

In this way, by utilizing the optimized access control, as discussed herein, the CSP control infrastructure may mitigate instances of a malicious party gaining unauthorized access to the CSP control infrastructure, the service distributor, the service manager, and/or the user devices. Further, the CSP control infrastructure may mitigate instances of private information associated with the user devices becoming compromised. As a result, the optimized access control may enable efficient utilization of resources (e.g., processing resources, management resources, memory resources, bandwidth resources, network resources, financial resources, power consumption resources, battery life, or the like) by the CSP control infrastructure, the service distributor, the service manager, and/or the user devices for more suitable tasks.

FIG.4is an illustration of an example process400associated with improved access control for network services, according to various aspects of the present disclosure. In some aspects, the process400may be performed by memories and/or processors/controllers (e.g., processing unit104, processing unit110, processor720) associated with an infrastructure device (e.g., CSP control infrastructure102) and/or a manager device (e.g., manager device114). As shown by reference numeral410, process400may include transmitting, by an infrastructure device to a manager device, an invitation link to enable the manager device to manage network services provided by the infrastructure device. For instance, the infrastructure device may utilize an associated communication interface (e.g., communication interface770) the associated memory and/or processor to transmit, to the manager device, an invitation link to enable the manager device to manage network services provided by the infrastructure device, as discussed elsewhere herein.

As shown by reference numeral420, process400may include transmitting, by the infrastructure device to the manager device based at least in part on verifying that the invitation link was activated by the manager device, seed information to enable the manager device to determine authorization information. For instance, the infrastructure device may utilize the associated communication interface, memory, and/or processor to transmit, to the manager device, seed information based at least in part on verifying that the invitation link was activated by the manager device, as discussed elsewhere herein.

As shown by reference numeral430, process400may include determining, by the manager device, the authorization information based at least in part on utilizing the seed information. For instance, the manager device may utilize the associated memory and/or processor to determine the authorization information based at least in part on utilizing the seed information, as discussed elsewhere herein.

As shown by reference numeral440, process400may include transmitting, by the manager device to the infrastructure device during a communication session, a manager request related to an action to be performed regarding the network services, the manager request being signed based at least in part on utilizing a first portion of the authorization information. For instance, the manager device may utilize the associated communication interface, memory, and/or processor to transmit, to the infrastructure device during a communication session, a manager request related to an action to be performed regarding the network services, the manager request being signed based at least in part on utilizing a first portion of the authorization information, as discussed elsewhere herein.

As shown by reference numeral450, process400may include authorizing, by the infrastructure device, the manager request based at least in part on verifying that the communication session is currently active. For instance, the infrastructure device may utilize the associated memory and/or processor to authenticate the manager request based at least in part on verifying that the communication session is currently active, as discussed elsewhere herein.

Process400may include additional aspects, such as any single aspect or any combination of aspects described below and/or in connection with one or more other processes described elsewhere herein.

In a first aspect, in process400, authorizing the manager request includes the infrastructure device authorizing the manager request based at least in part on verifying that the manager request was determined by the manager device during the communication session.

In a second aspect, alone or in combination with the first aspect, in process400, authorizing the manager request includes the infrastructure device authorizing the manager request based at least in part on verifying that the manager request was signed by the manager device during the communication session.

In a third aspect, alone or in combination with the first through second aspects, in process400, authorizing the manager request includes the infrastructure device authorizing the manager request based at least in part on utilizing a second portion of the authorization information, the second portion being different from the first portion.

In a fourth aspect, alone or in combination with the first through third aspects, in process400, determining the authorization information includes the manager device determining a master string of alphanumeric characters, and a master key based at least in part on the master string of alphanumeric characters.

In a fifth aspect, alone or in combination with the first through fourth aspects, in process400, transmitting the seed information includes the infrastructure device transmitting the seed information in association with enabling information to enable the manager device to determine the authorization information.

In a sixth aspect, alone or in combination with the first through fifth aspects, in process400, transmitting the seed information includes the infrastructure device transmitting information unique to the manager device.

AlthoughFIG.4shows example blocks of the process, in some aspects, the process may include additional blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted inFIG.4. Additionally, or alternatively, two or more of the blocks of the process may be performed in parallel.

As indicated above,FIG.4is provided as an example. Other examples may differ from what is described with regard toFIG.4.

FIG.5is an illustration of an example process500associated with improved access control for network services, according to various aspects of the present disclosure. In some aspects, the process500may be performed by a memory and/or a processor/controller (e.g., processing unit102, processor720) associated with an infrastructure device (e.g., CSP control infrastructure102). As shown by reference numeral510, process500may include transmitting, by an infrastructure device to a manager device, an invitation link to enable the manager device to manage network services provided by the infrastructure device. For instance, the infrastructure device may utilize an associated communication interface (e.g., communication interface770) with the associated memory and/or processor to transmit to a manager device, an invitation link to enable the manager device to manage network services provided by the infrastructure device, as discussed elsewhere herein.

As shown by reference numeral520, process500may include transmitting, by the infrastructure device to the manager device based at least in part on the manager device activating the invitation link, seed information to be utilized by the manager device to determine authorization information. For instance, the infrastructure device may utilize the associated communication interface, memory, and/or processor to transmit, to the manager device based at least in part on the manager device activating the invitation link, seed information to be utilized by the manager device to determine authorization information, as discussed elsewhere herein.

As shown by reference numeral530, process500may include receiving, by the infrastructure device from the manager device during an active communication session, a manager request related to an action to be performed regarding the network services, the manager request being signed based at least in part on utilizing a first portion of the authorization information. For instance, the infrastructure device may utilize the associated communication interface, memory, and/or processor to receive, from the manager device during an active communication session, a manager request related to an action to be performed regarding the network services, the manager request being signed based at least in part on utilizing a first portion of the authorization information, as discussed elsewhere herein.

As shown by reference numeral540, process500may include enabling, by the infrastructure device, performance of the action regarding the network services based at least in part on verifying that the communication session is currently active. For instance, the user device may utilize the associated memory and/or processor to enable performance of the action regarding the network services based at least in part on verifying that the communication session is currently active, as discussed elsewhere herein.

Process500may include additional aspects, such as any single aspect or any combination of aspects described below and/or in connection with one or more other processes described elsewhere herein.

In a first aspect, in process500, enabling performance of the action includes enabling performance of the action based at least in part on verifying that the manager request was determined by the manager device during the communication session.

In a second aspect, alone or in combination with the first aspect, in process500, enabling performance of the action includes enabling performance of the action based at least in part on verifying that the manager request was signed by the manager device during the communication session.

In a third aspect, alone or in combination with the first through second aspects, in process500, enabling performance of the action includes enabling performance of the action based at least in part on utilizing a second portion of the authorization information, the second portion being different from the first portion.

In a fourth aspect, alone or in combination with the first through third aspects, in process500, transmitting the seed information includes transmitting the seed information in association with enabling information to enable the manager device to determine the authorization information.

In a fifth aspect, alone or in combination with the first through fourth aspects, in process500, transmitting the seed information includes transmitting information unique to the manager device.

In a sixth aspect, alone or in combination with the first through fifth aspects, process500may include verifying that the invitation link was activated by the manager device.

AlthoughFIG.5shows example blocks of the process, in some aspects, the process may include additional blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted inFIG.5. Additionally, or alternatively, two or more of the blocks of the process may be performed in parallel.

As indicated above,FIG.5is provided as an example. Other examples may differ from what is described with regard toFIG.5.

FIG.6is an illustration of an example process600associated with improved access control for network services, according to various aspects of the present disclosure. In some aspects, the process600may be performed by a memory and/or a processor/controller (e.g., processing unit110, processor720) associated with a manager device (e.g., manager device114) executing a web application. As shown by reference numeral610, process600may include receiving, by a manager device from an infrastructure device, an invitation link to enable the manager device to manage network services provided by the infrastructure device. For instance, the manager device may utilize an associated communication interface (e.g., communication interface770) with the associated memory and/or processor to receive, from an infrastructure device, an invitation link to enable the manager device to manage network services provided by the infrastructure device, as discussed elsewhere herein.

As shown by reference numeral620, process600may include receiving, by the manager device from the infrastructure device based at least in part on the manager device activating the invitation link, seed information to be utilized by the manager device to determine authorization information. For instance, the manager device may utilize the associated communication interface, memory, and/or processor to receive, from the infrastructure device based at least in part on the manager device activating the invitation link, seed information to be utilized by the manager device to determine authorization information, as discussed elsewhere herein.

As shown by reference numeral630, process600may include transmitting, by the manager device to the infrastructure device during an active communication session and based at least in part on determining the authorization information, a manager request related to an action to be performed regarding the network services, a portion of the manager request being signed based at least in part on utilizing a first portion of the authorization information. For instance, the manager device may utilize the associated communication interface, memory, and/or processor to transmit, to the infrastructure device during an active communication session and based at least in part on determining the authorization information, a manager request related to an action to be performed regarding the network services, a portion of the manager request being signed based at least in part on utilizing a first portion of the authorization information, as discussed elsewhere herein.

As shown by reference numeral640, process600may include performing, by the manager device, the action regarding the network services based at least in part on a verification that the communication session is currently active. For instance, the manager device may utilize the associated memory and/or processor to perform the action regarding the network services based at least in part on a verification that the communication session is currently active, as discussed elsewhere herein.

Process600may include additional aspects, such as any single aspect or any combination of aspects described below and/or in connection with one or more other processes described elsewhere herein.

In a first aspect, in process600, performing the action includes performing the action based at least in part on a verification that the manager request was determined by the manager device during the communication session.

In a second aspect, alone or in combination with the first aspect, in process600, performing the action includes performing the action based at least in part on a verification that the manager request was signed by the manager device during the communication session.

In a third aspect, alone or in combination with the first through second aspects, in process600, performing the action includes performing the action based at least in part on a verification of the manager request by utilizing a second portion of the authorization information, the second portion being different from the first portion.

In a fourth aspect, alone or in combination with the first through third aspects, in process600, determining the authorization information includes determining a master string of alphanumeric characters, and a master key based at least in part on the master string of alphanumeric characters.

In a fifth aspect, alone or in combination with the first through fourth aspects, in process600, receiving the seed information includes receiving the seed information in association with enabling information to enable the manager device to determine the authorization information.

In a sixth aspect, alone or in combination with the first through fifth aspects, in process600, receiving the seed information includes receiving unique information associated with the manager device to enable the authorization information to be unique to the manager device.

AlthoughFIG.6shows example blocks of the process, in some aspects, the process may include additional blocks, fewer blocks, different blocks, or differently arranged blocks than those depicted inFIG.6. Additionally, or alternatively, two or more of the blocks of the process may be performed in parallel.

As indicated above,FIG.6is provided as an example. Other examples may differ from what is described with regard toFIG.6.

FIG.7is an illustration of example devices700associated with improved access control for network services, according to various aspects of the present disclosure. In some aspects, the example devices700may form part of or implement the systems, servers, environments, infrastructures, components, devices, or the like described elsewhere herein (e.g., control infrastructure, distributor device, manager device, user device, etc.) and may be used to perform example processes described elsewhere herein. The example devices700may include a universal bus710communicatively coupling a processor720, a memory730, a storage component740, an input component750, an output component760, and a communication interface770.

Bus710may include a component that permits communication among multiple components of a device700. Processor720may be implemented in hardware, firmware, and/or a combination of hardware and software. Processor720may take the form of a central processing unit (CPU), a graphics processing unit (GPU), an accelerated processing unit (APU), a microprocessor, a microcontroller, a digital signal processor (DSP), a field-programmable gate array (FPGA), an application-specific integrated circuit (ASIC), or another type of processing component. In some aspects, processor720may include one or more processors capable of being programmed to perform a function. Memory730may include a random access memory (RAM), a read only memory (ROM), and/or another type of dynamic or static storage device (e.g., a flash memory, a magnetic memory, and/or an optical memory) that stores information and/or instructions for use by processor720.

Storage component740may store information and/or software related to the operation and use of a device700. For example, storage component740may include a hard disk (e.g., a magnetic disk, an optical disk, and/or a magneto-optic disk), a solid state drive (SSD), a compact disc (CD), a digital versatile disc (DVD), a floppy disk, a cartridge, a magnetic tape, and/or another type of non-transitory computer-readable medium, along with a corresponding drive.

Input component750may include a component that permits a device700to receive information, such as via user input (e.g., a touch screen display, a keyboard, a keypad, a mouse, a button, a switch, and/or a microphone). Additionally, or alternatively, input component750may include a component for determining location (e.g., a global positioning system (GPS) component) and/or a sensor (e.g., an accelerometer, a gyroscope, an actuator, another type of positional or environmental sensor, and/or the like). Output component760may include a component that provides output information from device700(via, for example, a display, a speaker, a haptic feedback component, an audio or visual indicator, and/or the like).

Communication interface770may include a transceiver-like component (e.g., a transceiver, a separate receiver, a separate transmitter, and/or the like) that enables a device700to communicate with other devices, such as via a wired connection, a wireless connection, or a combination of wired and wireless connections. Communication interface770may permit device700to receive information from another device and/or provide information to another device. For example, communication interface770may include an Ethernet interface, an optical interface, a coaxial interface, an infrared interface, a radio frequency (RF) interface, a universal serial bus (USB) interface, a Wi-Fi interface, a cellular network interface, and/or the like.

A device700may perform one or more processes described elsewhere herein. A device700may perform these processes based on processor720executing software instructions stored by a non-transitory computer-readable medium, such as memory730and/or storage component740. As used herein, the term “computer-readable medium” may refer to a non-transitory memory device. A memory device may include memory space within a single physical storage device or memory space spread across multiple physical storage devices.

Software instructions may be read into memory730and/or storage component740from another computer-readable medium or from another device via communication interface770. When executed, software instructions stored in memory730and/or storage component740may cause processor720to perform one or more processes described elsewhere herein. Additionally, or alternatively, hardware circuitry may be used in place of or in combination with software instructions to perform one or more processes described elsewhere herein. Thus, implementations described herein are not limited to any specific combination of hardware circuitry and software.

The quantity and arrangement of components shown inFIG.7are provided as an example. In practice, a device700may include additional components, fewer components, different components, or differently arranged components than those shown inFIG.7. Additionally, or alternatively, a set of components (e.g., one or more components) of a device700may perform one or more functions described as being performed by another set of components of a device700.

As indicated above,FIG.7is provided as an example. Other examples may differ from what is described with regard toFIG.7.

Persons of ordinary skill in the art will appreciate that the aspects encompassed by the present disclosure are not limited to the particular exemplary aspects described herein. In that regard, although illustrative aspects have been shown and described, a wide range of modification, change, and substitution is contemplated in the foregoing disclosure. It is understood that such variations may be made to the aspects without departing from the scope of the present disclosure. Accordingly, it is appropriate that the appended claims be construed broadly and in a manner consistent with the present disclosure.

The foregoing disclosure provides illustration and description, but is not intended to be exhaustive or to limit the aspects to the precise form disclosed. Modifications and variations may be made in light of the above disclosure or may be acquired from practice of the aspects.

As used herein, the term “component” or “device” is intended to be broadly construed as hardware, firmware, or a combination of hardware and software. As used herein, a processor is implemented in hardware, firmware, or a combination of hardware and software.

As used herein, satisfying a threshold may, depending on the context, refer to a value being greater than the threshold, greater than or equal to the threshold, less than the threshold, less than or equal to the threshold, equal to the threshold, or not equal to the threshold, among other examples, or combinations thereof.

It will be apparent that systems or methods described herein may be implemented in different forms of hardware, firmware, or a combination of hardware and software. The actual specialized control hardware or software code used to implement these systems or methods is not limiting of the aspects. Thus, the operation and behavior of the systems or methods were described herein without reference to specific software code—it being understood that software and hardware can be designed to implement the systems or methods based, at least in part, on the description herein.

Even though particular combinations of features are recited in the claims or disclosed in the specification, these combinations are not intended to limit the disclosure of various aspects. In fact, many of these features may be combined in ways not specifically recited in the claims or disclosed in the specification. Although each dependent claim listed below may directly depend on only one claim, the disclosure of various aspects includes each dependent claim in combination with every other claim in the claim set. A phrase referring to “at least one of” a list of items refers to any combination of those items, including single members. As an example, “at least one of: a, b, or c” is intended to cover a, b, c, a-b, a-c, b-c, and a-b-c, as well as any combination with multiples of the same element (for example, a-a, a-a-a, a-a-b, a-a-c, a-b-b, a-c-c, b-b, b-b-b, b-b-c, c-c, and c-c-c or any other ordering of a, b, and c).

No element, act, or instruction used herein should be construed as critical or essential unless explicitly described as such. Also, as used herein, the articles “a” and “an” are intended to include one or more items, and may be used interchangeably with “one or more.” Further, as used herein, the article “the” is intended to include one or more items referenced in connection with the article “the” and may be used interchangeably with “the one or more.” Furthermore, as used herein, the term “set” is intended to include one or more items (e.g., related items, unrelated items, a combination of related and unrelated items, etc.), and may be used interchangeably with “one or more.” Where only one item is intended, the phrase “only one” or similar language is used. Also, as used herein, the terms “has,” “have,” “having,” or the like are intended to be open-ended terms. Further, the phrase “based on” is intended to mean “based, at least in part, on” unless explicitly stated otherwise. Also, as used herein, the term “or” is intended to be inclusive when used in a series and may be used interchangeably with “and/or,” unless explicitly stated otherwise (e.g., if used in combination with “either” or “only one of”).