U.S. patent application number 15/247105 was filed with the patent office on 2016-12-15 for operating large scale systems and cloud services with zero-standing elevated permissions.
This patent application is currently assigned to Microsoft Technology Licensing, LLC. The applicant listed for this patent is Microsoft Technology Licensing, LLC. Invention is credited to Andrey Lukyanov, Alexander MacLeod, Colin Nash, Rajmohan Rajagopalan, Vivek Sharma, Jaskaran Singh.
Application Number | 20160364576 15/247105 |
Document ID | / |
Family ID | 49115260 |
Filed Date | 2016-12-15 |
United States Patent
Application |
20160364576 |
Kind Code |
A1 |
MacLeod; Alexander ; et
al. |
December 15, 2016 |
OPERATING LARGE SCALE SYSTEMS AND CLOUD SERVICES WITH ZERO-STANDING
ELEVATED PERMISSIONS
Abstract
Large scale system operation may be provided. Upon receiving an
action request from a user, a determination may be made as to
whether the user requires elevated permissions to perform the
action request. In response to determining that the user requires
elevated permissions to perform the action request, the action
request may be forwarded to a lockbox for evaluation and a
permission response may be received from the lockbox.
Inventors: |
MacLeod; Alexander;
(Seattle, WA) ; Lukyanov; Andrey; (Redmond,
WA) ; Nash; Colin; (Mill Creek, WA) ; Singh;
Jaskaran; (Redmond, WA) ; Rajagopalan; Rajmohan;
(Redmond, WA) ; Sharma; Vivek; (Seattle,
WA) |
|
Applicant: |
Name |
City |
State |
Country |
Type |
Microsoft Technology Licensing, LLC |
Redmond |
WA |
US |
|
|
Assignee: |
Microsoft Technology Licensing,
LLC
Redmond
WA
|
Family ID: |
49115260 |
Appl. No.: |
15/247105 |
Filed: |
August 25, 2016 |
Related U.S. Patent Documents
|
|
|
|
|
|
Application
Number |
Filing Date |
Patent Number |
|
|
13413078 |
Mar 6, 2012 |
9460303 |
|
|
15247105 |
|
|
|
|
Current U.S.
Class: |
1/1 |
Current CPC
Class: |
G06Q 10/06 20130101;
G06F 21/604 20130101; G06F 21/6218 20130101 |
International
Class: |
G06F 21/62 20060101
G06F021/62; G06F 21/60 20060101 G06F021/60 |
Claims
1. A method for providing large scale system operation, the method
comprising: receiving an action request from a user; determining
whether the user requires elevated permissions to perform the
action request; in response to determining that the user requires
elevated permissions to perform the action request, forwarding the
action request to a lockbox; and receiving a permission response
from the lockbox.
2. The method of claim 1, further comprising: determining whether
the permission response comprises an approval; and in response to
determining that the permission response comprises the approval,
granting the user temporary elevated permission to perform the
requested action.
3. The method of claim 2, further comprising: determining, by the
lockbox, whether the action request complies with at least one
policy; and in response to determining that the action request
complies with the at least one policy, providing the permission
response comprising the approval.
4. The method of claim 3, further comprising: in response to
determining that the action request does not comply with the at
least one policy, forwarding the action request to at least one
approval user.
5. The method of claim 3, wherein the at least one policy comprises
one of a plurality of pre-defined permission elevation
policies.
6. The method of claim 3, wherein the at least one policy comprises
a user role evaluation rule.
7. The method of claim 3, wherein the at least one policy comprises
a permission elevation expiration rule.
8. The method of claim 3, wherein the at least one policy comprises
an action request denial rule.
9. The method of claim 2, further comprising: determining whether a
pre-configured interval has elapsed since receiving the permission
response from the lockbox; and in response to determining that the
pre-configured interval has elapsed since receiving the permission
response from the lockbox, revoking the temporary elevated
permission from the user.
10. A system for providing large scale system operation, the system
comprising: a memory storage; and a processing unit coupled to the
memory storage, wherein the processing unit is operable to: receive
an action request requiring an elevated permission from a user;
determine whether the action request complies with at least one of
a plurality of permission policies; in response to determining that
the action request complies with the at least one of the plurality
of permission policies, grant the user an elevated permission to
perform the requested action; and in response to determining that
the action request does not comply with the at least one of the
plurality of permission policies, forward the action request to at
least one approval user.
11. The system of claim 10, wherein the processing unit is further
operative to: determine whether at least one of a plurality of
users currently granted elevated permissions should have the
granted elevated permissions revoked; and in response to
determining that the at least one of the plurality of users
currently granted elevated permissions should have the granted
elevated permissions revoked, revoke the elevated permissions.
12. The system of claim 11, wherein the processing unit is further
operative to determine whether the at least one of the plurality of
users currently granted elevated permissions should have the
granted elevated permissions revoked on at least one of the
following: a configurable time interval, a pre-defined interval,
and upon a manual request.
13. The system of claim 10, wherein the at least one of the
plurality of permission policies determines whether the user is
associated with a security flag.
14. The system of claim 10, wherein the at least one of the
plurality of permission policies determines whether the user
belongs to a specific user group.
15. The system of claim 14, wherein the specific user group
comprises at least one of the following: an administrator group, a
security clearance group, an on-call group, and an onsite
group.
16. The system of claim 10, wherein the processing unit is further
operative to create a log entry comprising the user, the action
request, and the granted elevated permissions.
17. The system of claim 16, wherein the processing unit is further
operative to create at least one second log entry associated with
at least one second action request received from the user while the
user is associated with the granted elevated permissions.
18. The system of claim 17, wherein the processing unit is further
operative to provide an audit report comprising a plurality of log
entries.
19. The system of claim 10, wherein the elevated permission
comprises a set of permissions associated with a task.
20. A computer-readable medium which stores a set of instructions
which when executed performs a method for providing large scale
system operation, the method executed by the set of instructions
comprising: receiving an action request from a user, wherein the
user is associated with at least one user group comprising basic
access permissions to at least one software service and wherein the
basic access permissions prohibit access to a plurality of user
data associated with the at least one software service; determining
whether the requested action requires an elevated permission; in
response to determining that the requested action requires the
elevated permission: determining whether the action request
complies with at least one of a plurality of permission policies
associated with a lockbox service, wherein the plurality of
permission policies comprise at least one of the following: a user
group criterion, a security flag criterion, an action scope
criterion, and a schedule criterion, in response to determining
that the action request does not comply with the at least one of a
plurality of permission policies, forwarding the action request to
at least one approval user, in response to determining that the
action request complies with the at least one of a plurality of
permission policies, granting the elevated permission to the user
for a limited duration, wherein the limited duration is defined by
at least one of the following: the at least one permission policy,
a configuration setting associated with the software service, and a
configuration setting associated with the at least one user group,
performing the requested action, and creating a log entry
associated with the user and the requested action; periodically
determining whether at least one second user currently granted at
least one second elevated permission should have the at least one
second elevated permission revoked; in response to determining that
the at least one second user should have the at least one second
elevated permission revoked, revoking the at least one second
elevated permission; periodically determining whether at least one
third user is no longer associated with the at least one software
service; in response to determining that the at least one third
user is no longer associated with the at least one software
service, removing the at least one third user from the at least one
user group; and providing an audit report comprising a plurality of
log entries associated with a plurality of requested actions.
Description
RELATED APPLICATION
[0001] Related U.S. patent application Ser. No. 13/052,788, filed
on Mar. 21, 2011 and entitled "Email-Based Automated Recovery
Action in a Hosted Environment," assigned to the assignee of the
present application, is hereby incorporated by reference.
BACKGROUND
[0002] Large scale system operation may be provided. Security and
privacy are primary concerns Software as a Service (SaaS) systems.
Customers want service providers to operate with a very low human
touch and a minimum number of operators and engineers with
potential access to customer data. Conventional approaches for this
problem are to segregate access and ensure that users who need full
administrator access have gone through complete background
clearance. Such approaches must also assume good intentions on the
part of those users, who are provided standing persistent
permissions.
SUMMARY
[0003] This Summary is provided to introduce a selection of
concepts in a simplified form that are further described below in
the Detailed Description. This Summary is not intended to identify
key features or essential features of the claimed subject matter.
Neither is this Summary intended to be used to limit the claimed
subject matter's scope.
[0004] Large scale system operation may be provided. Upon receiving
an action request from a user, a determination may be made as to
whether the user requires elevated permissions to perform the
action request. In response to determining that the user requires
elevated permissions to perform the action request, the action
request may be forwarded to a lockbox for evaluation and a
permission response may be received from the lockbox.
[0005] Both the foregoing general description and the following
detailed description provide examples and are explanatory only.
Accordingly, the foregoing general description and the following
detailed description should not be considered to be restrictive.
Further, features or variations may be provided in addition to
those set forth herein. For example, embodiments may be directed to
various feature combinations and sub-combinations described in the
detailed description.
BRIEF DESCRIPTION OF THE DRAWINGS
[0006] The accompanying drawings, which are incorporated in and
constitute a part of this disclosure, illustrate various
embodiments of the present invention. In the drawings:
[0007] FIG. 1 is a block diagram of an operating environment;
[0008] FIG. 2 is a flow chart of a method for providing large scale
system operation; and
[0009] FIG. 3 is a block diagram of a computing device.
DETAILED DESCRIPTION
[0010] The following detailed description refers to the
accompanying drawings. Wherever possible, the same reference
numbers are used in the drawings and the following description to
refer to the same or similar elements. While embodiments of the
invention may be described, modifications, adaptations, and other
implementations are possible. For example, substitutions,
additions, or modifications may be made to the elements illustrated
in the drawings, and the methods described herein may be modified
by substituting, reordering, or adding stages to the disclosed
methods. Accordingly, the following detailed description does not
limit the invention.
[0011] Large scale system operation may be provided. Administrative
access to systems used to provide cloud services may be regulate to
ensure that there are no unauthorized access or exposure to the
customer generated data. Furthermore, full auditing and reporting
of all administrator activity and/or access may be provided. Such
access management may be fully automated to grant, monitor, revoke
and report access based on the needs of operating a large scale
service and/or a complex on-premise system.
[0012] By default, everyone who has access to operate the service,
debug issues, and/or respond to escalations and incidents in the
system may be provided configuration view only permissions. Nobody
in the system may belong to a full administrator and/or other
elevated permissions security group. When an elevated access is
needed, as when making a change in the system as a corrective
action and/or to do invasive debugging of customer specific issues,
the user may be expected to submit a request to an on-demand
elevation system such as a lockbox.
[0013] The lockbox may evaluate the role of the requestor and the
role group that they are requesting access to with a set of
pre-defined policies. The lockbox may then make a decision either
to automatically elevate and/or request explicit approval from an
approval body as dictated by the policies. During elevation, the
lockbox may stamp an attribute in the user object with an expiry
time based on a requested interval. This lockbox may automatically
de-elevate at a configured interval by default. The lockbox
policies may also allow for elevation for a requested period of
time. A de-elevate component of the lockbox may execute at
configurable intervals looking for folks to be de-elevated.
[0014] All the activity on elevation requests may be audited and
monitored. The lockbox may grant permissions at a granular level
that segregates the duties and ensures that malicious activity
can't happen. For example, those with permissions to change a
configuration that is potentially exposing customer data do not
have permissions to wipe off the audit trail of such change. The
lockbox may monitor account usage and automatically disables user
accounts inactive accounts and/or accounts associated with users
who no longer have rights to access the services system.
[0015] FIG. 1 is a block diagram of an operating environment 100
for large scale system operation comprising a server 110. Server
110 may comprise a lockbox component 115, a plurality of hosted
software services 120(A)-(C) and a plurality of user data storage
components 122(A)-(C) associated with a multi-tenant application
server 124. Server 110 may be operative to execute a plurality of
other applications and/or services (not shown). Lockbox component
115 may comprise a permission module 125, a logging/auditing module
130, and a plurality of permission policies 135. Server 110 may be
operative to communicate with a plurality of users such as an
on-call engineer 140, an onsite engineer 145, and administrator
150, and/or a plurality of users 155(A)-(C) of software services
120(A)-(C). The users may access server 110 via a network 160
using, for example, an electronic communications device such as a
computer, laptop, cellular and/or IP phone, tablet, game console
and/or other device.
[0016] FIG. 2 is a flow chart setting forth the general stages
involved in a method 200 consistent with an embodiment of the
invention for providing large scale system operation. Method 200
may be implemented using a computing device 300 as described in
more detail below with respect to FIG. 3. Ways to implement the
stages of method 200 will be described in greater detail below.
Method 200 may begin at starting block 205 and proceed to stage 210
where computing device 300 may receive an action request from a
user. For example, on-call engineer 140 may attempt to run a
debugging trace on a process associated with software service
120(A). To protect the privacy of user data 122(A), such access may
not be always available to operators and/or engineers associated
with server 110. Such users may be limited to basic access
permissions, such as viewing log data and/or configuration
information, and access to user data 122(A)-(C) is prohibited.
[0017] Method 200 may then advance to stage 215 where computing
device 300 may determine whether the requested action requires an
elevated permission. For example, on-call engineer 140 may have
basic permission to view a log entry, but restarting software
service 120(B) may require an elevated permission.
[0018] In response to determining that the requested action
requires the elevated permission, method 200 may advance to stage
220 where computing device 300 may determine whether the action
request complies with at least one of a plurality of permission
policies associated with a lockbox service. For example, the
requested action may be forwarded to lockbox component 115 and
checked for compliance with at least one permission policy of
plurality of permission policies 135 by permission module 125. Such
policies may comprise checks for factors such as a user group
criterion, a security flag criterion, an action scope criterion,
and a schedule criterion. For example, a user may belong to an
"onsite" user group that allows greater automated elevation of
permissions that a user accessing server 110 from offsite.
[0019] Method 200 may then advance to stage 225 where computing
device 300 may grant the elevated permission to the user. For
example, lockbox component 115 may elevate the permissions
allocated to on-call engineer 140 in order to allow the requested
action to be performed. This elevation may be for a limited
duration, that may be defined, for example, by the permission
policy, by a configuration setting associated with the software
service, and/or by a configuration setting associated with the at
least one user group. Such permissions may comprise a set of
permissions associated with a task, such as the need to modify
overall configuration data for server 110 and restart several core
services (e.g., network and/or user management services) in order
to install a new software service into production.
[0020] If the action request is determined not to comply with the
permission policies, method 200 may advance to stage 227 where
computing device 300 may forward the action request to at least one
approval user. For example, lockbox component 115 may forward the
request to administrator 150 for review.
[0021] After elevating the access at stage 225, or if the requested
action is determined not to need elevated access at stage 215,
method 200 may advance to stage 230 where computing device 300 may
perform the requested action. For example, on-call engineer 140 may
be allowed to perform a debugging trace as allowed by the newly
elevated permissions.
[0022] Method 200 may then advance to stage 235 where computing
device 300 may create a log entry of the action request. The log
entry may comprise whether the request resulted in automatic
approval of the permissions elevation at stage 225 and/or whether
the request was sent for administrator approval at stage 227. The
log entry may further comprise a record of data accessed by the
requesting user while the elevated permissions were in force.
Consistent with embodiments of the invention, users who receive
elevated permissions that permit access to user data 122(A)-(C) may
be denied, by policies 135, if they request an action to modify log
entries associated with such access. Such denials may also be
logged and/or forwarded to administrator 150.
[0023] Method 200 may advance to stage 240 where computing device
300 may determine whether any users currently granted at least one
second elevated permission should have those permissions revoked.
For example, policies 135 may define a configurable length of time
that such elevations are to remain in effect.
[0024] In response to identifying a user that should have their
elevated permission revoked, method 200 may advance to stage 245
where computing device 300 may revoke the elevated permission
and/or restore the user to only basic level access.
[0025] After revoking the elevated permissions at stage 245, or if
no users were found to need permissions revoked at stage 240,
method 200 may advance to stage 250 where computing device 300 may
detect whether any users should have all access revoked. For
example, a user who has been inactive for a configurable length of
time or a user who is no longer employed by an organization
associated with operating multi-tenant server 110 may be identified
as candidates for removal.
[0026] In response to determining that the identified user should
be removed, such as where the user is no longer associated with one
of software services 120(A)-(C), method 200 may advance to stage
255 where computing device 300 may remove the user's access. For
example, the user may be removed from the basic level user group
and may have their access, including the ability to request
actions, revoked.
[0027] Method 200 may then advance to stage 260 where computing
device 300 may provide an audit report. For example, administrator
150 may be provided with an audit report comprising a list of all
users who have been granted elevated permissions that allow access
to user data 122(A)-(C). Method 200 may then end at stage 265.
[0028] An embodiment consistent with the invention may comprise a
system for providing large scale system operation. The system may
comprise a memory storage and a processing unit coupled to the
memory storage. The processing unit may be operative to receive an
action request from a user, determine whether the user requires
elevated permissions to perform the action request, and in response
to determining that the user requires elevated permissions to
perform the action request, forward the action request to a lockbox
and receive a permission response from the lockbox. In response to
determining that the permission response comprises the approval,
the processing unit may be operative to grant the user temporary
elevated permission to perform the requested action. The permission
response may be the result of the processing unit applying one of a
plurality of permission policies that may each comprise a plurality
of pre-defined evaluation rules, such as a rule associated with the
user's role and/or user group membership (e.g., an onsite and/or
on-call operator), an expiration rule (e.g., how long an elevated
permission may persist), a security flag rules (e.g., whether the
user's account indicates that the user has undergone a security
clearance and/or background check), and an action request
evaluation rule that may determine whether the requested action
violates a privacy policy (e.g., denying elevations that may allow
the user to modify a log entry associated with their own
actions.)
[0029] Another embodiment consistent with the invention may
comprise a system for providing large scale system operation. The
system may comprise a memory storage and a processing unit coupled
to the memory storage. The processing unit may be operative to
receive an action request requiring an elevated permission from a
user and determine whether the action request complies with at
least one of a plurality of permission policies. In response to
determining that the action request complies with the at least one
of the plurality of permission policies, the processing unit may be
operative to grant the user an elevated permission to perform the
requested action. Otherwise, the processing unit may be operative
to forward the action request to at least one approval user. The
processing unit may be further operative to provide an audit report
comprising a plurality of log entries associated with requested
actions from various users. The granted elevated permissions may
comprise, for example, a set of permissions for various actions
associated with a task such as deploying a new software service to
production on a cloud server.
[0030] Yet another embodiment consistent with the invention may
comprise a system for providing large scale system operation. The
system may comprise a memory storage and a processing unit coupled
to the memory storage. The processing unit may be operative to
receive an action request from a user and determine whether the
requested action requires an elevated permission. In response to
determining that the requested action requires the elevated
permission, the processing unit may be operative to determine
whether the action request complies with at least one of a
plurality of permission policies associated with a lockbox service
and, if not, forward the action request to at least one approval
user. Otherwise, the processing unit may be operative to grant the
elevated permission to the user for a limited duration, perform the
requested action, and create a log entry associated with the user
and the requested action. The processing unit may be further
operative to periodically determine whether any users currently
granted elevated permissions should have those elevated permissions
revoked, such as after an expiration time defined by one of the
permission policies and, if so, revoke the elevated permissions.
The processing unit may be further operative to periodically detect
whether any users are no longer associated with the at least one
software service, such as where an operator is moved to a new
project and/or leaves the organization associated with supporting
the software service and, if so, remove the at least one third user
from the at least one user group. The processing unit may also be
operative to provide an audit report comprising a plurality of log
entries associated with a plurality of requested actions.
[0031] The embodiments and functionalities described herein may
operate via a multitude of computing systems, including wired and
wireless computing systems, mobile computing systems (e.g., mobile
telephones, tablet or slate type computers, laptop computers,
etc.). In addition, the embodiments and functionalities described
herein may operate over distributed systems, where application
functionality, memory, data storage and retrieval and various
processing functions may be operated remotely from each other over
a distributed computing network, such as the Internet or an
intranet. User interfaces and information of various types may be
displayed via on-board computing device displays or via remote
display units associated with one or more computing devices. For
example user interfaces and information of various types may be
displayed and interacted with on a wall surface onto which user
interfaces and information of various types are projected.
Interaction with the multitude of computing systems with which
embodiments of the invention may be practiced include, keystroke
entry, touch screen entry, voice or other audio entry, gesture
entry where an associated computing device is equipped with
detection (e.g., camera) functionality for capturing and
interpreting user gestures for controlling the functionality of the
computing device, and the like. FIG. 3 and the associated
descriptions provide a discussion of a variety of operating
environments in which embodiments of the invention may be
practiced. However, the devices and systems illustrated and
discussed with respect to FIG. 3 are for purposes of example and
illustration and are not limiting of a vast number of computing
device configurations that may be utilized for practicing
embodiments of the invention, described herein.
[0032] With reference to FIG. 3, a system consistent with an
embodiment of the invention may include a computing device, such as
computing device 300. In a basic configuration, computing device
300 may include at least one processing unit 302 and a system
memory 304. Depending on the configuration and type of computing
device, system memory 304 may comprise, but is not limited to,
volatile (e.g. random access memory (RAM)), non-volatile (e.g.
read-only memory (ROM)), flash memory, or any combination. System
memory 304 may include operating system 305, one or more
programming modules 306, and may include lockbox component 115.
Operating system 305, for example, may be suitable for controlling
computing device 300's operation. Furthermore, embodiments of the
invention may be practiced in conjunction with a graphics library,
other operating systems, or any other application program and is
not limited to any particular application or system. This basic
configuration is illustrated in FIG. 3 by those components within a
dashed line 308.
[0033] Computing device 300 may have additional features or
functionality. For example, computing device 300 may also include
additional data storage devices (removable and/or non-removable)
such as, for example, magnetic disks, optical disks, or tape. Such
additional storage is illustrated in FIG. 3 by a removable storage
309 and a non-removable storage 310. Computing device 300 may also
contain a communication connection 316 that may allow device 300 to
communicate with other computing devices 318, such as over a
network in a distributed computing environment, for example, an
intranet or the Internet. Communication connection 316 is one
example of communication media.
[0034] The term computer readable media as used herein may include
computer storage media. Computer storage media may include volatile
and nonvolatile, removable and non-removable media implemented in
any method or technology for storage of information, such as
computer readable instructions, data structures, program modules,
or other data. System memory 304, removable storage 309, and
non-removable storage 310 are all computer storage media examples
(i.e., memory storage.) Computer storage media may include, but is
not limited to, RAM, ROM, electrically erasable read-only memory
(EEPROM), flash memory or other memory technology, CD-ROM, digital
versatile disks (DVD) or other optical storage, magnetic cassettes,
magnetic tape, magnetic disk storage or other magnetic storage
devices, or any other medium which can be used to store information
and which can be accessed by computing device 300. Any such
computer storage media may be part of device 300. Computing device
300 may also have input device(s) 312 such as a keyboard, a mouse,
a pen, a sound input device, a touch input device, a capture
device, etc. A capture device may be operative to record a user and
capture spoken words, motions and/or gestures made by the user,
such as with a camera and/or microphone. The capture device may
comprise any speech and/or motion detection device capable of
detecting the speech and/or actions of the user. For example, the
capture device may comprise a Microsoft.RTM. Kinect.RTM. motion
capture device comprising a plurality of cameras and a plurality of
microphones. Output device(s) 314 such as a display, speakers, a
printer, etc. may also be included. The aforementioned devices are
examples and others may be used.
[0035] The term computer readable media as used herein may also
include communication media. Communication media may be embodied by
computer readable instructions, data structures, program modules,
or other data in a modulated data signal, such as a carrier wave or
other transport mechanism, and includes any information delivery
media. The term "modulated data signal" may describe a signal that
has one or more characteristics set or changed in such a manner as
to encode information in the signal. By way of example, and not
limitation, communication media may include wired media such as a
wired network or direct-wired connection, and wireless media such
as acoustic, radio frequency (RF), infrared, and other wireless
media.
[0036] As stated above, a number of program modules and data files
may be stored in system memory 304, including operating system 305.
While executing on processing unit 302, programming modules 306 may
perform processes and/or methods as described above. The
aforementioned process is an example, and processing unit 302 may
perform other processes. Other programming modules that may be used
in accordance with embodiments of the present invention may include
electronic mail and contacts applications, word processing
applications, spreadsheet applications, database applications,
slide presentation applications, drawing or computer-aided
application programs, etc.
[0037] Generally, consistent with embodiments of the invention,
program modules may include routines, programs, components, data
structures, and other types of structures that may perform
particular tasks or that may implement particular abstract data
types. Moreover, embodiments of the invention may be practiced with
other computer system configurations, including hand-held devices,
multiprocessor systems, microprocessor-based or programmable
consumer electronics, minicomputers, mainframe computers, and the
like. Embodiments of the invention may also be practiced in
distributed computing environments where tasks are performed by
remote processing devices that are linked through a communications
network. In a distributed computing environment, program modules
may be located in both local and remote memory storage devices.
[0038] Furthermore, embodiments of the invention may be practiced
in an electrical circuit comprising discrete electronic elements,
packaged or integrated electronic chips containing logic gates, a
circuit utilizing a microprocessor, or on a single chip containing
electronic elements or microprocessors. Embodiments of the
invention may also be practiced using other technologies capable of
performing logical operations such as, for example, AND, OR, and
NOT, including but not limited to mechanical, optical, fluidic, and
quantum technologies. In addition, embodiments of the invention may
be practiced within a general purpose computer or in any other
circuits or systems.
[0039] Embodiments of the invention, for example, may be
implemented as a computer process (method), a computing system, or
as an article of manufacture, such as a computer program product or
computer readable media. The computer program product may be a
computer storage media readable by a computer system and encoding a
computer program of instructions for executing a computer process.
The computer program product may also be a propagated signal on a
carrier readable by a computing system and encoding a computer
program of instructions for executing a computer process.
Accordingly, the present invention may be embodied in hardware
and/or in software (including firmware, resident software,
micro-code, etc.). In other words, embodiments of the present
invention may take the form of a computer program product on a
computer-usable or computer-readable storage medium having
computer-usable or computer-readable program code embodied in the
medium for use by or in connection with an instruction execution
system. A computer-usable or computer-readable medium may be any
medium that can contain, store, communicate, propagate, or
transport the program for use by or in connection with the
instruction execution system, apparatus, or device.
[0040] The computer-usable or computer-readable medium may be, for
example but not limited to, an electronic, magnetic, optical,
electromagnetic, infrared, or semiconductor system, apparatus,
device, or propagation medium. More specific computer-readable
medium examples (a non-exhaustive list), the computer-readable
medium may include the following: an electrical connection having
one or more wires, a portable computer diskette, a random access
memory (RAM), a read-only memory (ROM), an erasable programmable
read-only memory (EPROM or Flash memory), an optical fiber, and a
portable compact disc read-only memory (CD-ROM). Note that the
computer-usable or computer-readable medium could even be paper or
another suitable medium upon which the program is printed, as the
program can be electronically captured, via, for instance, optical
scanning of the paper or other medium, then compiled, interpreted,
or otherwise processed in a suitable manner, if necessary, and then
stored in a computer memory.
[0041] Embodiments of the invention may be practiced via a
system-on-a-chip (SOC) where each and/or many of the components
illustrated above may be integrated onto a single integrated
circuit. Such an SOC device may include one or more processing
units, graphics units, communications units, system virtualization
units and various application functionalities, all of which may be
integrated (or "burned") onto the chip substrate as a single
integrated circuit. When operating via an SOC, the functionality,
described herein, with respect to training and/or interacting with
any component of operating environment 100 may operate via
application-specific logic integrated with other components of the
computing device/system on the single integrated circuit
(chip).
[0042] Embodiments of the present invention, for example, are
described above with reference to block diagrams and/or operational
illustrations of methods, systems, and computer program products
according to embodiments of the invention. The functions/acts noted
in the blocks may occur out of the order as shown in any flowchart.
For example, two blocks shown in succession may in fact be executed
substantially concurrently or the blocks may sometimes be executed
in the reverse order, depending upon the functionality/acts
involved.
[0043] While certain embodiments of the invention have been
described, other embodiments may exist. Furthermore, although
embodiments of the present invention have been described as being
associated with data stored in memory and other storage mediums,
data can also be stored on or read from other types of
computer-readable media, such as secondary storage devices, like
hard disks, floppy disks, or a CD-ROM, a carrier wave from the
Internet, or other forms of RAM or ROM. Further, the disclosed
methods' stages may be modified in any manner, including by
reordering stages and/or inserting or deleting stages, without
departing from the invention.
[0044] All rights including copyrights in the code included herein
are vested in and the property of the Applicants. The Applicants
retain and reserve all rights in the code included herein, and
grant permission to reproduce the material only in connection with
reproduction of the granted patent and for no other purpose.
[0045] While certain embodiments of the invention have been
described, other embodiments may exist. While the specification
includes examples, the invention's scope is indicated by the
following claims. Furthermore, while the specification has been
described in language specific to structural features and/or
methodological acts, the claims are not limited to the features or
acts described above. Rather, the specific features and acts
described above are disclosed as example for embodiments of the
invention.
* * * * *