Onboarding software on secure devices to generate device identities for authentication with remote servers

[Related applications]

This application is filed in U.S. Patent Application No. 16 entitled "ONBOARDING SOFTWARE ON SECURE DEVICES TO GENERAGE DEVICE IDENTITIES FOR AUTHENTICATION WITH REMOTE SERVERS," filed April 4, 2019, the entire disclosure of which is incorporated herein by reference. /374,905 claims priority.

At least some embodiments disclosed herein relate to identification and authentication of computing devices.

With the increasing number of low-cost devices connected to cloud servers, commonly referred to as the Internet of Things (IoT), it is important to uniquely identify IoT devices and authenticate their identity to reject fake devices. New security challenges are emerging, including:

Several authentication techniques in computer security can be used by one entity to verify the identity of another entity. For example, a secret can be used as part of an entity's identity, and the ability of an entity to indicate that it possesses a secret can be used as a method to authenticate the entity's identity. be able to. Such secrets can be used as passwords, PINs, or encryption keys in the authentication process. By combining multiple roots of trust that are difficult to replicate, IoT devices can increase the likelihood that the identity they claim is valid.

Public key cryptography, or asymmetric cryptography, is a cryptographic system used in many authentication techniques. Such cryptographic systems can generate pairs of asymmetric keys together such that deriving one key of the pair from the other is impractical. A message encrypted using one key of a pair cannot be decrypted using the key itself, but can only be decrypted using the other key of the pair. The system is asymmetric in that it uses different keys for encryption and decryption. One of the keys in the pair can be made public as a public key, and the other key can be kept private, or private. Proving possession of a private key can be used as a method to identify and/or authenticate the entity that has the private key. For example, a private key can be used to sign messages. The public key can be used to verify that the signature included in a message matches the original message, and therefore that the message was generated using the corresponding private key. For example, the private key can be used to create a digital signature of a message by computing a cryptographic hash of the message. If the calculated hash matches the hash recreated from the message, it can be concluded that the message has not been altered in anticipation of the digital signature and that the digital signature was signed by an entity in possession of the private key.

Some authentication techniques use secrets embedded in hardware to derive keys for identification and/or authentication. Such hardware-based secrets are difficult to steal or copy.

In addition to storing secrets, separate hardware security components can be configured to perform cybersecurity tasks, thus offloading the workload from the host CPU (central processing unit) and possibly Sensitive operations can be isolated from applications running on the host CPU, which may be accessed by unauthorized persons. For example, one such security component is the Trusted Platform Module (TPM), which can securely store secrets and plays a role in verifying the integrity of critical boot software.

Some authentication techniques use a combination of secrets embedded in hardware and software data, such as bootloader source code, to create highly reliable identities for low-cost devices.

The device identity composition engine (DICE), which follows standards developed by the Trusted Computing Group (TCG), is a standardization that combines hardware secrets with source code to create trusted identities. It is a technology that has been developed.

The embodiments are illustrated by way of example, and not by way of limitation, in the figures of the accompanying drawings, in which like references indicate like elements.

<figref num="1">1 illustrates a system for identifying a device for authentication, according to one embodiment.</figref><figref num="2">1 illustrates a process for onboarding software on a device with a configuration for secure authentication of the device when accessing a remote server.</figref><figref num="3">2 illustrates a process for onboarding software to a device with a configuration for secure authentication of the device when accessing a remote server.</figref><figref num="4">2 illustrates a process for onboarding software to a device with a configuration for secure authentication of the device when accessing a remote server.</figref><figref num="5">2 illustrates a process for onboarding software to a device with a configuration for secure authentication of the device when accessing a remote server.</figref><figref num="6">4 illustrates a method of onboarding software to a secure device according to one embodiment.</figref><figref num="7">1 is a block diagram of an example computer system on which embodiments of the present disclosure may operate; FIG.</figref>

At least some embodiments disclosed herein uniquely identify a computing device for authentication when accessing a remote server, and the computing device's identity may be stolen or due to a fake device. Techniques are provided for configuring computing devices to be identified through hardware and software so that the risk of duplication can be reduced. For example, the technology can be used for multi-factor authentication of devices processed in the semiconductor supply chain at a lower cost and faster than solutions that require each individual device to onboard itself. .

Specifically, the technology simplifies the secure exchange of information between computer systems to allow a computing device to later authenticate its identity to a remote server. The technology relies on a combination of secrets injected into components of computing devices at the factory and cryptographic functions (e.g., hashes) in software that is later installed for the computing device after the components leave the factory. Contains an authentication mechanism.

For example, a manufacturer of secure hardware components may inject secrets into the hardware component at the factory without knowing the software content that will later be installed on the secure hardware component. The provisioning tool can be configured to appropriately install software content on the hardware component and generate cryptographic side information (eg, a hash) for the software content. Cryptoside information can be securely shared with remote portals. The cryptographic side information may be common to many computing devices configured to use the same version of software content installed on each secure hardware component of the computing device. Thus, uploading the cryptographic side information only once may be sufficient to input computing devices with different identities but using the same version of the software content. Cryptographic side information enables the implementation of multi-factor authentication of computing devices to remote servers, and secure hardware components of computing devices that are injected with different secrets into them at the factory and that cannot be accessed after leaving the factory. Software content is installed during the installation. This technique eliminates the need for a remote server to connect to each individual device and configure the devices for separate identities.

At least one authentication mechanism disclosed herein combines multiple factors for authentication to prevent malicious actors from depersonalizing a valid computing device. For example, multiple factors for authentication may include a secret implemented on a single hardware component within a semiconductor manufacturing facility. The secret is unique to the hardware component among the hardware components manufactured in the semiconductor manufacturing facility. Therefore, secrets can be used to uniquely identify hardware components.

After such hardware components leave the semiconductor manufacturing factory for integration/assembly into a computing device, software content can be installed on the hardware components for operation of the computing device. Different device manufacturers may install different software content on their computing devices. In order for a remote host to verify the authenticity of such a computing device, multiple factors for authentication may further include cryptographic hashing of the software's source code, as well as information about the software content installed on the hardware component. may further contain non-confidential data.

In one example, a system configured to implement the technology may include a provisioning tool, an enrollment portal, and a cloud certificate generator.

A provisioning tool can be used by a device manufacturer to generate a set of commands to configure a computing device for identity and key generation.

The registration portal can be configured to receive non-confidential data about software content installed on the computing device. Once a hardware component of a computing device is registered with a registration portal, non-sensitive data about software content installed on or to be installed on the hardware component may be associated with the registered hardware component. For example, a copy of non-confidential data about software content can be uploaded to a registration portal as part of the registration process. A single upload may be sufficient for multiple devices sharing the same software implementation.

A computing device may implement security functionality to generate asymmetric key pairs from non-confidential data about software content and secrets implemented in hardware components. This security feature can be implemented according to the Device Identity Composition Engine/Robust Internet of Things (DICE/RIoT) standard.

A key management server (KMS) cloud certificate generator can be configured with the ability to emulate asymmetric key generation for such computing devices. A cloud certificate generator can generate the same asymmetric key for a computing device that would be created on a configured computing device using the same set of commands. The cloud certificate generator is configured to generate a certificate for a public key of a computing device, such as a public key of an alias key pair of the computing device or a public key of a device identity key pair of the computing device.

For example, the key generation functionality of the computing device allows the computing device to calculate a first summary of the unique device secret and a first portion of the software each time the device boots. This summary can be labeled with a Composite Device Identifier (CDI) according to the DICE standard. CDI can then be used in a program running at boot time on the host CPU to generate an asymmetric key pair. This program can be labeled as Robust Internet of Things, or RIoT. The RIoT program can derive the first asymmetric key pair from the CDI and a cryptographic hash of the second portion of the source code (eg, bootloader source code). This asymmetric key pair can be labeled an alias key pair. The second key pair can be generated from the CDI, but independently of the second part of the source code. This second key pair can be labeled with a device identification key pair. Alias key pairs can be used to authenticate devices. For example, a device can digitally sign data using the private key of an alias key pair, and the digital signature uses the private key of the alias key pair to verify that the device possesses the private key of the alias key pair. It can be verified using the paired public key. The device identification key pair can be used for operations and management, such as exchanging alias key pairs. If a second part of the source code needs to change as a result of a legitimate software update, the RIoT program can then generate a certificate for a new alias key resulting from the updated software. This certificate is signed using the device identification private key, thus allowing the peer to authenticate the validity of the new alias public key.

For example, a secure hardware component factory may be configured to manufacture secure hardware components, such as secure flash memory components. Factories can inject secret information, such as device secrets and device management keys, into secure hardware components during the component manufacturing process. In some cases, a device secret may be labeled a Unique Device Secret (UDS). The factory is configured to upload a copy of the confidential information to a key management server (KMS).

A device manufacturer may integrate secure hardware components into computing devices manufactured by the device manufacturer. Device manufacturers can design embedded software for computing devices and use provisioning tools to calculate non-sensitive data about the software, such as cryptographic hashes of the software. In addition, device manufacturers can also use provisioning tools to configure hardware components to load software into the appropriate locations on the hardware components and generate the appropriate cryptographic computations to generate key pairs. can.

A device manufacturer uses the registration portal to register secure hardware components that are assembled into computing devices manufactured by the device manufacturer. For example, registration may be performed as part of the process of ordering or purchasing a secure hardware component manufactured by a secure hardware component factory.

Device manufacturers can upload non-sensitive data about software identified by the provisioning tool to the registration portal. Additionally, the device manufacturer can also upload information about the field servers to which the device will be onboarded and which will receive the certificate. In response, the registration portal may request the cloud certificate generator to generate a public key certificate for the registered secure hardware component.

In response to a request from the enrollment portal, the cloud certificate generator retrieves the previously stored device secret of the manufactured secure hardware component, emulates the secure hardware component's key generation functionality, and A secure hardware component can calculate a key pair in the same way that a hardware component calculates its key pair and sign a certificate for the public key of the key pair (e.g., without storing the private key). can.

A cloud certificate generator can provide certificates to device manufacturers' field servers to manage secure hardware components using device management keys and enable security features in secure hardware components. .

When a computing device manufactured by a device manufacturer connects to the device manufacturer's field server (or another server that knows the alias key certificate), the computing device can use the private key for authentication. . The field server uses the corresponding public key certified by the cloud certificate generator to verify that the computing device possesses the corresponding private key and therefore has the identity associated with the public key certification. can do.

FIG. 1 shows a system for identifying a device (101) for authentication, according to one embodiment.

In Figure 1, a device (101) has a secure component (102) configured to securely store at least one secret, such as a device secret (113). The secure component (102) also allows an entity that owns a copy of the device management key (111) to manage the secure component (102), such as turning on security features of the secure component (102). To enable this, a device management key (111) may also be stored.

The secure component (102) may have a device secret summary (121) that can be generated according to DICE/RIoT standards based on the device secret (113) and the software (115). The device secret summary (121) can be used to generate asymmetric key pairs, such as a first key pair (125) and a second key pair (123).

The device (101) includes one or more additional component(s) (104) connected to the secure component (102) to provide the functionality of the device (101) in conjunction with the software (115). May include.

The system of FIG. 1 includes a key management server (105) with a certificate generator (103). The certificate generator (103) is configured with a function of emulating the function of the device (101) when generating an asymmetric key pair.

For example, the set of commands may be configured from a device secret (113) stored in a secure component (102) of the device (101) and from a first cryptographic hash (e.g., 119) of the software (115). May be executed on the device (101) to generate a secret summary (121). Executing the set of commands may further generate asymmetric key pairs, such as a first key pair (125) or a second key pair (123). The certificate generator (103) generates a cryptographic hash (e.g., 119 and 120) to use the same set of commands to generate the device secret summary (121). Similarly, a set of commands executed on a certificate generator (103) can generate a corresponding asymmetric key pair, such as a first key pair (125) or a second key pair (123), and As a result, the certificate generator (103) can digitally sign the certificate of the public key of the corresponding asymmetric key pair using the private key of the certificate generator (103) or the key management server (105). The authenticity of the certificate can be verified using the public key of the certificate generator (103). Therefore, a field server (eg, 109) that trusts the certificate generator (103) or key management server (105) can trust the authenticity of a public key having a certificate signed by the certificate generator (103).

Once the public key of the device (101) is verified, the device (101) can authenticate itself to the field server (eg, 109) using the corresponding private key. For example, the device (101) can digitally sign messages using a private key. If the public key certified to be associated with the private key of the device (101) can be used to verify the digital signature, the device (101) may receive a certificate signed for the private key and/or the public key. can be considered as owning the identity specified in .

The system of FIG. 1 uses a host of secure components (112) (e.g., a device management key (111) and a device secret (113)), as described further below in connection with FIGS. 2-5. allows software to be loaded onto the device (101) using the device manufacturing host (114) at a time and location different from the covert implementation on the secure component (102).

2-5 illustrate a computing device (101) (e.g., as shown in FIG. 1) with a configuration for secure authentication of the device (101) when accessing a remote server (e.g., 109). illustrates the process for onboarding software (115) to.

In FIG. 2, the secure component (102) is configured without knowledge of the software (115) that may subsequently be developed and/or installed on the computing device (101) that uses the secure component (102). configured in the factory without access.

When the secure component (102) is in the factory, the first root of trust secret (e.g., device management key (111) and device secret (113)) is transferred from the secure component's host (112) to the secure component ( 102). The same host (112) transfers the secret copy (e.g., along with the identity of the secure component (102)) to the key management server (105) via a secure connection between the host (112) and the key management server (105). ).

In FIG. 3, a device manufacturer develops a design for a computing device (101) that integrates a secure component (102) and additional components (104). Software (115) for operating the computing device (101) is made available at a device manufacturer's facility (eg, a device manufacturing host (114)). The provisioning tool (117) installs the software (115) in the appropriate locations on the secure component (102) and includes a hash (119) of the first portion of the software and a hash (120) of the second portion of the software. Can be used to generate. The hashes (119 and 120) are used by the key management server (105) when generating the first key certificate (127) and second key certificate (128).

In Figure 3, the device manufacturing host (114) can also use the provisioning tool (117) and the device management key (111) to provision the secure component (102) and thus activate it on the device (101). . The device manufacturing host (114) requests the key management server (105) to transfer the device management key (111) to the device manufacturing host (114) or directly in response to a command sent to the secure component (102). You can make one or more requests, such as signing a . In either case, the provisioning tool (117) provides the same configuration parameters used to provision the secure component (102).

In Figure 3, after the provisioning tool (117) performs both provisioning and software installation operations, the secure component (102) and the additional component (104) are installed on the certificate generator located on the key management server (105). A key pair (123 and 125) is generated based on the same software hash (119, 120) as in (103). More particularly, the secure component (102) generates a device secret summary (121) based on the device secret (113) and a first software hash (119) that is calculated independently of the provisioning tool (117). internally generated and then an additional component (104) generates a key pair (123, 125).

The information about the software (115) may be a hash (119 and 120) of the software (115) shown in FIG. For example, software hashes (119 and 120) can each be generated using cryptographic functions of the source code of software (115). The first software hash (119) represents information of the first part of the software root of trust associated with the device manufacturer. The second software hash (120) represents the second portion of the software root of trust information associated with the device manufacturer.

In Figure 4, the software hashes (119 and 120) used for key generation within the device (101) are used during the registration of the secure component (104) and its use with the software (115) at the registration portal (119 and 120). 107) to the key management server (105).

In Figure 5, the certificate generator (103) uses software hashes (119 and 120) to generate the public key of the device (101), regardless of the operation of the device (101). Sign the public key certificates (127 and 128).

After the security features of the secure component (102) are activated, the secure component (102) installed on the computing device (101) stores the device secret summary (121) of the computing device (101) and its ciphers. Can be used when generating keys (eg 123 and 125).

The key management server (105) may provide a key certificate (127) for the computing device (101) to the server (109), such that the server (109) has a public enable the device (101) to be authenticated based on a message signed by the device (101) using the key and its corresponding private key.

FIG. 6 illustrates a method of onboarding software to a secure device according to one embodiment. For example, the method of FIG. 6 can be implemented in the system of FIG. 6 using the processes shown in FIGS. 2-5.

At block 141, the key management server (105) receives first information implemented in a factory-manufactured component (102).

For example, the first information is unique to the component (102) among the components manufactured at the factory.

For example, the first information may include a device secret (113) implemented in the hardware of the component (102) and/or a device management key (111) that can be used to manage the component (102).

For example, the first information may be received via the secure component host (112) while the component (102) is being manufactured at a factory.

For example, component (102) may be a secure memory device (eg, a secure flash memory device).

At block 143, the key management server (105) stores a copy of the first information.

After the component (102) leaves the factory, it can be assembled into a computing device (101) running software (115). The factory may not have any information about the software (115). Information about the software (115) can be collected later during the registration process.

At block 145, the portal (107) of the key management server (105) receives registration of the component (102) installed on the computing device (101) with the software (115).

At block 147, the portal (107) receives second information about the software (115). The computing device (101) independently generates second information about the software (115) and combines it with the first information implemented in the hardware of the component (102) (e.g. configured to generate a key pair (123) according to DICE/RIoT standards).

At block 149, the key management server (105) uses the copy of the first information stored on the key management server (105) and the second information received via the portal (107) to (101), generate a first public key for the computing device (101).

At block 151, the certificate generator (103) of the key management server (105) digitally signs a first public key certificate using the private key of the certificate generator (103) to Authentication is facilitated by the certified public and private keys of the key pair (123) of 101).

At block 153, the portal (107) receives third information about the software (115). The computing device (101) independently generates third information about the software (115) and combines it with the first information implemented in the hardware of the component (102) (e.g. configured to generate a key pair (125) according to DICE/RIoT standards).

At block 155, the key management server (105) uses the copy of the first information stored on the key management server (105) and the third information received via the portal (107) to (101), generate a second public key for the computing device (101).

At block 157, the certificate generator (103) of the key management server (105) digitally signs the first public key certificate using the private key of the certificate generator (103) to The certified public and private keys of the key pair (125) of the computing device (101) facilitate the exchange of the key pair (123) of the computing device (101).

For example, the device manufacturing host (114) can be configured with a provisioning tool (117) to properly install the software (115) onto the computing device (101). The provisioning tool (117) may be configured to calculate second information about the software (115), which may be a cryptographic hash (119 and 120) of the software (115). The provisioning tool (117) can provide the registration portal (107) with second information (e.g., 119 and 120) about the software (115), and the registration portal (107) can provide the registration portal (107) with information about the public key of the computing device (101). A certificate can be provided to the field server (109).

Upon successful registration of the component (102) with first information (e.g., device secret (113)), the key management server (105) provides a certificate (127) of the public key of the computing device (101). can.

Upon activating the security feature with the device manufacturing host (114), the computing device (101) calculates a public key and a private key for the computing device (101) (e.g., according to the DICE/RIoT standard); /or the private key of the computing device (101) may be used to authenticate the remote server (109).

Later, during the lifetime of the device (101), a valid update may be made to the software (115) such that the first software hash (119) remains unchanged but the second software hash (120) may change. Consequently, this update results in a change in the second key pair (125), but not the first key pair (123) generated by the secure component (102) and the additional component(s) (104). No change occurs. The device may then use the unchanged key pair (125) to create a key exchange certificate by signing the changed public key, that is, the portion of the second key pair (123). can. The key exchange certificate is then uploaded to the field server (109), which uses its second certificate (128) to authenticate its validity and, if successful, to authenticate its validity. The key certificate (127) can be replaced with a key exchange certificate. This process may be performed according to DICE/RIoT standards.

FIG. 7 illustrates an exemplary machine of a computer system (200) in which a set of instructions can be executed to cause the machine to perform any one or more of the methods described herein. In some embodiments, computer system (200) includes, is coupled to, or utilizes a memory subsystem (e.g., key management server (105) of FIG. 1, registration portal (107) and/or a remote server (109)), a certificate generator (103), an enrollment portal (107), and/or a provisioning tool (117) as described with respect to Figures 1-6. may also be used to perform operations of the tools (213) disclosed herein, such as instructions to perform operations corresponding to . In alternative embodiments, the machine may be connected (eg, networked) to other machines in a LAN, intranet, extranet, and/or the Internet. the machine operates in the capacity of a server or client machine in a client-server network environment, as a peer machine in a peer-to-peer (or distributed) network environment, or as a server or client machine in a cloud computing infrastructure or environment; There is.

Machine specifies a personal computer (PC), tablet PC, set-top box (STB), personal digital assistant (PDA), mobile phone, web appliance, server, network router, switch or bridge, or an action taken by that machine. may be any machine capable of executing (sequentially or otherwise) a set of instructions to Additionally, while a single machine is illustrated, the term "machine" also refers to a set (or sets of instructions) for performing any one or more of the methods described herein. shall be construed to include any collection of machines that individually or jointly perform

The exemplary computer system (200) includes a processing unit (202), a main memory (204) (e.g., read-only memory (ROM), dynamic random access memory (DRAM) such as flash memory, synchronous DRAM (SDRAM), or Rambus DRAM). ), static random access memory (SRAM), etc.), and data storage systems (218) that communicate with each other via buses (230) (which may include multiple buses).

Processing unit (202) represents one or more general purpose processing units such as a microprocessor, central processing unit, etc. More specifically, the processing unit implements a multiple instruction set computing (CISC) microprocessor, reduced instruction set computing (RISC) microprocessor, very long instruction word (VLIW) microprocessor, or other instruction set. It may be a processor or a processor implementing a combination of instruction sets. The processing device (202) may also be one or more special purpose processing devices, such as an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), a network processor, etc. be. Processing device (202) is configured to execute instructions (226) to perform the operations and steps described herein. Computer system (200) may further include a network interface device (208) for communicating via network (220).

A data storage system (218) includes a machine-readable storage medium (218) on which one or more sets of instructions (226) or software embodying any one or more of the methods or functions described herein are stored. 224) (also known as computer-readable media). The instructions (226) may also be stored in the main memory (204) or by the processing device (202), which also constitutes the computer system (200), the main memory (204), and the machine-readable storage medium. (202) may reside wholly or at least partially within. Machine-readable storage medium (224), data storage system (218), and/or main memory (204) may correspond to memory subsystem 110 of FIG. 1.

In one embodiment, the instructions (226) include the tools (213) (e.g., provisioning tools (117) described with respect to FIGS. 1-6, enrollment portal (107) software, certificate generator (103) software, keys The management server (105) software includes instructions for implementing functions corresponding to the management server (105) software. Although the machine-readable storage medium (224) is depicted in the exemplary embodiments as being a single medium, the term "machine-readable storage medium" refers to a single medium or one or more sets of instructions. shall be construed to include multiple media storing the same. The term "machine-readable storage medium" also refers to any medium capable of storing or encoding a set of instructions for execution by a machine that causes the machine to perform any one or more of the methods of this disclosure. shall be construed to include the Media. Accordingly, the term "machine-readable storage medium" shall be construed to include, but not be limited to, solid state memory, optical media, and magnetic media.

Some portions of the detailed descriptions presented above are presented in terms of algorithms and symbolic representations of operations on data bits within a computer memory. These algorithmic descriptions and representations are the methods used by those skilled in the data processing arts to most effectively convey the substance of their work to others skilled in the art. An algorithm is here and generally considered to be a self-consistent sequence of operations leading to a desired result. Operations are those that require physical manipulation of physical quantities. Usually, though not necessarily, these quantities take the form of electrical or magnetic signals capable of being stored, combined, compared, and otherwise manipulated. It proves convenient at times, principally for reasons of common usage, to refer to these signals as bits, values, elements, symbols, characters, terms, numbers, or the like.

It should be borne in mind, however, that all of these and similar terms are to be associated with the appropriate physical quantities and are merely convenient labels applied to these quantities. The present disclosure operates on data represented as physical (electronic) quantities within the registers and memory of a computer system, and similarly represented as physical quantities within the memory or registers of a computer system or such other information storage system. May refer to the operations and processes of a computer system or similar electronic computing device that convert data into other data.

The present disclosure also relates to apparatus for performing the operations herein. The device may be specially constructed for the intended purpose, or the device may include a general purpose computer selectively activated or reconfigured by a computer program stored in the computer. . Such computer programs may be installed on any type of disk, including floppy disks, optical disks, CD-ROMs, and magneto-optical disks, read-only memory (ROM), random access memory (RAM), each coupled to a computer system bus. ), EPROM, EEPROM, magnetic or optical card, or any type of medium suitable for storing electronic instructions. be.

The algorithms and displays presented herein are not inherently related to any particular computer or other apparatus. Although various general purpose systems may be used with programs in accordance with the teachings herein, it may prove convenient to construct more specialized apparatus to carry out the methods. The structure of a variety of these systems is presented as explained in the description below. Furthermore, this disclosure has not been described with reference to any particular programming language. It is understood that a variety of programming languages can be used to implement the teachings of this disclosure as described herein.

The present disclosure describes a computer program product, which may include a machine-readable medium having instructions stored thereon that can be used to program a computer system (or other electronic device) to perform processes in accordance with the present disclosure, i.e. Can be provided as software. A machine-readable medium includes any mechanism for storing information in a form readable by a machine (eg, a computer). In some embodiments, the machine-readable (e.g., computer-readable) medium includes read-only memory ("ROM"), random access memory ("RAM"), magnetic disk storage media, optical storage media, flash memory components, etc. machine (eg, computer) readable storage media.

Various functions and operations are described herein as being performed or caused by computer instructions for ease of explanation. However, those skilled in the art will recognize that such expressions imply that the functionality results from the execution of computer instructions by one or more controllers or processors, such as microprocessors. Alternatively, or in combination, the functions and operations may be implemented using special purpose circuits, with or without software instructions, such as using application specific integrated circuits (ASICs) or field programmable gate arrays (FPGAs). . Embodiments can be implemented using hard-wired circuitry without or in combination with software instructions. Thus, the techniques are not limited to any particular combination of hardware circuitry and software or to any particular source of instructions executed by a data processing system.

In the above specification, embodiments of the present disclosure are described with reference to specific exemplary embodiments thereof. It will be evident that various modifications may be made thereto without departing from the broader spirit and scope of the embodiments of the disclosure as set forth in the claims below. Accordingly, the specification and drawings are to be regarded in an illustrative rather than a restrictive sense.