ZERO CONFIGURATION COMMUNICATIONS BETWEEN A SANDBOXED PROGRAM AND A NETWORKED SERVICE

• US 20130340050A1
• Filed: 08/15/2013
• Published: 12/19/2013
• Est. Priority Date: 11/26/2008
• Status: Active Grant

• Current Assignee: Samba TV Incorporated
• Original Assignee: Free Stream Media Corporation
• Inventors: Harrison, David A.
• Granted Patent: US 9,706,265 B2
• Time in Patent Office: Days
• US Class Current: 726/4
• CPC Class Codes: G06F 16/783 using metadata automatically derived from the content
• CPC Class Codes: G06F 21/10 Protecting distributed programs or content, e.g. vending or licensing of copyrighted material protection in video systems or pay television H04N7/16 ; Digital rights management [DRM]
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 3/14 Digital output to display device ; Cooperation and interconnection of the display device with other functional units
• CPC Class Codes: G06Q 30/0255 based on user history
• CPC Class Codes: G06Q 30/0269 based on user profile or attribute
• CPC Class Codes: G08C 17/02 using a radio link
• CPC Class Codes: H04L 12/18 for broadcast or conference , e.g. multicast
• CPC Class Codes: H04L 2101/668 Internet protocol [IP] address subnets
• CPC Class Codes: H04L 61/2514 between local and global IP addresses
• CPC Class Codes: H04L 61/2517 using port numbers
• CPC Class Codes: H04L 61/256 NAT traversal
• CPC Class Codes: H04L 61/2575 using address mapping retrieval, e.g. simple traversal of user datagram protocol through session traversal utilities for NAT [STUN]
• CPC Class Codes: H04L 61/4511 using domain name system [DNS]
• CPC Class Codes: H04L 61/4541 Directories for service discovery
• CPC Class Codes: H04L 61/5007 Internet protocol [IP] addresses
• CPC Class Codes: H04L 63/10 for controlling access to devices or network resources
• CPC Class Codes: H04L 63/102 Entity profiles
• CPC Class Codes: H04L 65/1069 Session establishment or de-establishment
• CPC Class Codes: H04L 65/61 : for supporting one-way streaming services, e.g. Internet radio
• CPC Class Codes: H04L 67/02 : based on web technology, e.g. hypertext transfer protocol [HTTP]
• CPC Class Codes: H04L 67/10 : in which an application is distributed across nodes in the network software deployment G06F8/60; multiprogramming arrangements G06F9/46
• CPC Class Codes: H04L 67/141 : Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04N 21/23424 : involving splicing one content stream with another content stream, e.g. for inserting or substituting an advertisement
• CPC Class Codes: H04N 21/2541 : Rights Management protecting software against unauthorised usage in a vending or licensing environment G06F21/10; security in data switching network management H04L41/28; security management or policies for network security H04L63/20; access security in wireless networks H04W12/08
• CPC Class Codes: H04N 21/278 : Content descriptor database or directory service for end-user access details of content or meta data based information retrieval of video data in video databases G06F16/739
• CPC Class Codes: H04N 21/4126 : The peripheral being portable, e.g. PDAs or mobile phones
• CPC Class Codes: H04N 21/41407 : embedded in a portable device, e.g. video client on a mobile phone, PDA, laptop constructional details of equipment or arrangements specially adapted for portable computer application G06F1/1626; arrangements specially adapted for mobile receivers in broadcast systems H04H20/57
• CPC Class Codes: H04N 21/4147 : PVR [Personal Video Recorder] H04N5/76 takes precedence ; arrangements for broadcast with accumulation-type receivers H04H20/40
• CPC Class Codes: H04N 21/435 : Processing of additional data, e.g. decrypting of additional data, reconstructing software from modules extracted from the transport stream
• CPC Class Codes: H04N 21/4415 : using biometric characteristics of the user, e.g. by voice recognition or fingerprint scanning cryptography using biological data H04L9/3231; authentication in networks using biometric H04L63/0861
• CPC Class Codes: H04N 21/466 : Learning process for intelligent management, e.g. learning user preferences for recommending movies services using the results of monitoring in broadcast systems H04H60/61
• CPC Class Codes: H04N 21/6175 : involving transmission via Internet broadcast-related systems characterised by the transmission system being the Internet H04H60/82
• CPC Class Codes: H04N 21/64322 : IP
• CPC Class Codes: H04N 21/812 : involving advertisement data advertising per se G06Q30/02
• CPC Class Codes: H04N 21/835 : Generation of protective data, e.g. certificates protecting software against unauthorised usage in a vending or licensing environment G06F21/10
• CPC Class Codes: H04N 21/8352 : involving content or source identification data, e.g. Unique Material Identifier [UMID]
• CPC Class Codes: H04N 21/8358 : involving watermark protecting executable software by watermarking G06F21/16; image watermarking in general G06T1/0021; watermarks inserted in still images for transmission purposes H04N1/32144; inserting watermarks during video coding H04N19/467
• CPC Class Codes: H04N 21/84 : Generation or processing of descriptive data, e.g. content descriptors systems specially adapted for using meta-information in broadcast systems H04H60/73

Abstract

A method, apparatus and system related to zero configuration communication between a sandboxed program and a networked service are disclosed. In one aspect a system includes a networked device configured to announce a networked service to a discovery service, and/or perform the discovery service for a private network; and/or a client device configured to execute a sandboxed program in a security sandbox. The system also includes automatically instantiating a connection between the sandboxed program and the networked device and/or the networked service. The discovery agent may be running with the sandboxed program is configured to query the discovery service for a service information associated with of the networked device and/or the networked service. The service information may include a global unique identifier (GUID), an alphanumeric name, a public address pair, and/or a private address pair.

Claims

1. A system comprising:

a networked device configured to at least one of;

announce a networked service to a discovery service, and

perform the discovery service for a private network; and

a client device configured to execute a sandboxed program in a security sandbox and to automatically instantiate a connection between the sandboxed program and at least one of the networked device and the networked service.

2. The system of claim 1:

wherein a discovery agent running with the sandboxed program is configured to query the discovery service for a service information associated with at least one of the networked device and the networked service,

wherein the service information comprises at least one of a global unique identifier (GUID), an alphanumeric name, a public address pair, and a private address pair.

3. The system of claim 1:

wherein the discovery service comprises at least one of a logically centralized discovery service, a private discovery service, and an extension to the security sandbox, and

wherein the discovery service is configured to at least one of;

provide an application-layer routing between the sandboxed program and at least one of the networked device and the networked service, and

perform a traditional discovery method comprising at least one of a multicast protocol, a unicast protocol, an anycast protocol, a broadcast protocol, a Bonjour®

protocol, a Simple Service Discovery Protocol (SSDP), a Local Service Discovery (LSD) uTorrent®

protocol, a Service Location Protocol (SLP), a Universal Plug and Play (UPnP) protocol, a Multicast Domain Name System (MDNS) protocol, and a Domain Name System-based Service Discovery (DNS-SD) protocol.

4. The system of claim 1:

wherein the networked service comprises at least one of a discoverable service and an undiscoverable service,

wherein the discoverable service comprises at least one of the networked service of the networked device, a gateway discoverable service, an elected discoverable service, and an unelected discoverable service,

wherein when the discoverable service comprises the gateway discoverable service, the gateway discoverable service is configured to announce the undiscoverable service to the discovery service and to provide a sandbox-reachable interface on behalf of the undiscoverable service, and

wherein when the discoverable service comprises the elected discoverable service, the elected discoverable service is configured to at least one of;

announce an other networked service to the discovery service, and

act as the discovery service for the private network.

5. The system of claim 1:

wherein the sandboxed program is configured to bypass the discovery service when establishing the connection between the sandboxed program and at least one of the networked device and the networked service.

6. The system of claim 1:

wherein the networked device is configured to announce an availability of the networked service across a range of public Internet Protocol (IP) addresses such that the sandboxed program communicates with at least one of the networked device and the networked service in any one of the range of public IP addresses.

7. The system of claim 1:

wherein at least one of the networked device and the networked service is configured to at least one of offer an access token to the sandboxed program and manage an access of the sandboxed program to at least one of the networked device and the networked service,

wherein the access token uniquely identifies the sandboxed program, and

wherein the sandboxed program is configured to communicate with at least one of the networked device and the networked service by passing the access token.

8. The system of claim 7:

wherein the access token is offered to the sandboxed program on at least one of the private network and a local area network (LAN) with at least one of the networked device and the networked service.

9. The system of claim 1:

wherein the sandboxed program is configured to process a hardware address associated with the sandboxed program from at least one of the networked device and the networked service.

10. The system of claim 1:

wherein the networked device is further configured to announce a service description of the networked service to the discovery service,

wherein the sandboxed program is configured to query the discovery service for a particular service description, and

wherein the discovery service returns the networked service with the service description that matches the particular service description.

11. The system of claim 1:

wherein the sandboxed program is configured to associate at least one of the networked device and the networked service with a user account, and

wherein the user account is accessed when establishing the connection between at least one of the networked device and the networked service and at least one of the client device and an other client device.

12. The system of claim 2:

wherein at least one of the discovery agent and the sandboxed program is configured to bypass the discovery service by caching the service information associated with at least one of the networked device and the networked service.

13. The system of claim 1:

wherein the sandboxed program is configured to obtain an explicit permission to communicate with any device other than an origin server.

14. The system of claim 2:

wherein the discovery agent is further configured to serve as a trusted intermediary between an untrusted sandboxed program and at least one of the networked device and the networked service,

wherein the trusted intermediary is configured to guard at least one of the GUID, the alphanumeric name, the public address pair, and the private address pair associated with at least one of the networked device and the networked service from the untrusted sandboxed program, and

wherein the trusted intermediary and the untrusted sandboxed program are configured to communicate via a mutually agreed programming interface.

15. The system of claim 2:

wherein the discovery agent is further configured to enforce a communications policy imposing an access restriction to at least one of the networked device and the networked service.

16. The system of claim 1:

wherein at least one of the networked device and the networked service is further configured to send a number of periodic keep-alive messages to the discovery service.

17. The system of claim 1:

wherein a private IP address associated with at least one of the networked device and the networked service remains unknown to the client device when;

a first Network Address Translator (NAT) device coupled with a network on which the client device operates is configured to process a communication from a public IP address of a different network on which at least one of the networked device and the networked service operates, and

a second NAT device coupled with the different network is configured to translate the private IP address to the public IP address.

18. The system of claim 1:

wherein at least one of the networked device and the networked service is further configured to communicate with the sandboxed program by polling a message queue, and

wherein the message queue is configured to store a message from the sandboxed program.

19. The system of claim 1, further comprising:

a relay service configured to forward a packet between the sandboxed program and at least one of the networked device and the networked service.

20. The system of claim 19:

wherein the relay service comprises at least one of a Traversal Using Relays around NAT (TURN) server, a Simple Traversal of User Datagram Protocol over NATs (STUN) server, a STUN and TCP too (STUNT) server, the discovery service, a simple relay, a simple Transmission Control Protocol (TCP) relay, a simple User Datagram Protocol (UDP) relay, a GUID-relay, a TCP GUID-routing-relay, and a UDP GUID-routing-relay.

21. The system of claim 1:

wherein a NAT traversal mechanism comprises at least one of a DeMilitarized Zone (DMZ), an explicit port mapping, a user manual configuration, a casting of at least one of the networked device and the networked service as a communication initiator, an announcement to the discovery service with a source port that is bound to a port on which at least one of the networked device and the networked service listens, the discovery service sending a SYN from the port on which at least one of the networked device and the networked service listens, a hole punching process, a port prediction, and using a server to learn an address of an outermost NAT residing in a path between the server and at least one of the networked device and the networked service along with communicating the address via an external mechanism.

22. A method comprising:

at least one of announcing, by a networked device, a networked service to a discovery service and performing, by the networked device, the discovery service for a private network;

executing, by a client device, a sandboxed program in a security sandbox; and

automatically instantiating, by the client device, a connection between the sandboxed program and at least one of the networked device and the networked service.

23. The method of claim 22, further comprising:

querying, by a discovery agent running with the sandboxed program, the discovery service for a service information associated with at least one of the networked device and the networked service,

wherein the service information comprises at least one of a global unique identifier (GUID), an alphanumeric name, a public address pair, and a private address pair.

24. The method of claim 22, further comprising:

at least one of providing, by the discovery service, an application-layer routing between the sandboxed program and at least one of the networked device and the networked service and performing, by the discovery service, a traditional discovery method comprising at least one of a multicast protocol, a unicast protocol, an anycast protocol, a broadcast protocol, a Bonjour®

protocol, a Simple Service Discovery Protocol (SSDP), a Local Service Discovery (LSD) uTorrent®

protocol, a Service Location Protocol (SLP), a Universal Plug and Play (UPnP) protocol, a Multicast Domain Name System (MDNS) protocol, and a Domain Name System-based Service Discovery (DNS-SD) protocol,

wherein the discovery service comprises at least one of a logically centralized discovery service, a private discovery service, and an extension to the security sandbox.

25. The method of claim 22:

wherein the networked service comprises at least one of a discoverable service and an undiscoverable service,

wherein the discoverable service comprises at least one of the networked service of the networked device, a gateway discoverable service, an elected discoverable service, and an unelected discoverable service,

wherein when the discoverable service comprises the gateway discoverable service, the gateway discoverable service is configured to announce the undiscoverable service to the discovery service and to provide a sandbox-reachable interface on behalf of the undiscoverable service, and

wherein when the discoverable service comprises the elected discoverable service, the elected discoverable service is configured to at least one of;

announce an other networked service to the discovery service, and

act as the discovery service for the private network.

26. The method of claim 22, further comprising:

bypassing, by the sandboxed program, the discovery service when establishing the connection between the sandboxed program and at least one of the networked device and the networked service.

27. The method of claim 22, further comprising:

announcing, by the networked device, an availability of the networked service across a range of public Internet Protocol (IP) addresses such that the sandboxed program communicates with at least one of the networked device and the networked service in any one of the range of public IP addresses.

28. The method of claim 22, further comprising:

at least one of offering, by at least one of the networked device and the networked service, an access token to the sandboxed program and managing, by at least one of the networked device and the networked service, an access of the sandboxed program to at least one of the networked device and the networked service,

wherein the access token uniquely identifies the sandboxed program, and

wherein the sandboxed program is configured to communicate with at least one of the networked device and the networked service by passing the access token.

29. The method of claim 28:

wherein the access token is offered to the sandboxed program on at least one of the private network and a local area network (LAN) with at least one of the networked device and the networked service.

30. The method of claim 22, further comprising:

processing, by the sandboxed program, a hardware address associated with the sandboxed program from at least one of the networked device and the networked service.

31. The method of claim 22, further comprising:

announcing, by the networked device, a service description of the networked service to the discovery service;

querying, by the sandboxed program, the discovery service for a particular service description; and

returning, by the discovery service, the networked service with the service description that matches the particular service description.

32. The method of claim 22, further comprising:

associating, by the sandboxed program, at least one of the networked device and the networked service with a user account, and

wherein the user account is accessed when establishing the connection between at least one of the networked device and the networked service and at least one of the client device and an other client device.

33. The method of claim 23, further comprising:

bypassing, by at least one of the discovery agent and the sandboxed program, the discovery service by caching the service information associated with at least one of the networked device and the networked service.

34. The method of claim 22, further comprising:

obtaining, by the sandboxed program, an explicit permission to communicate with any device other than an origin server.

35. The method of claim 23, further comprising:

serving, by the discovery agent, as a trusted intermediary between an untrusted sandboxed program and at least one of the networked device and the networked service,

wherein the trusted intermediary is configured to guard at least one of the GUID, the alphanumeric name, the public address pair, and the private address pair associated with at least one of the networked device and the networked service from the untrusted sandboxed program, and

wherein the trusted intermediary and the untrusted sandboxed program are configured to communicate via a mutually agreed programming interface.

36. The method of claim 23, further comprising:

enforcing, by the discovery agent, a communications policy imposing an access restriction to at least one of the networked device and the networked service.

37. The method of claim 22, further comprising:

sending, by at least one of the networked device and the networked service, a number of periodic keep-alive messages to the discovery service.

38. The method of claim 22:

wherein a private IP address associated with at least one of the networked device and the networked service remains unknown to the client device when;

a first Network Address Translator (NAT) device coupled with a network on which the client device operates is configured to process a communication from a public IP address of a different network on which at least one of the networked device and the networked service operates, and

a second NAT device coupled with the different network is configured to translate the private IP address to the public IP address.

39. The method of claim 22, further comprising:

communicating, by at least one of the networked device and the networked service, with the sandboxed program by polling a message queue, and

wherein the message queue is configured to store a message from the sandboxed program.

40. The method of claim 22, further comprising:

forwarding, by a relay service, a packet between the sandboxed program and at least one of the networked device and the networked service.

41. The method of claim 40:

wherein the relay service comprises at least one of a Traversal Using Relays around NAT (TURN) server, a Simple Traversal of User Datagram Protocol over NATs (STUN) server, a STUN and TCP too (STUNT) server, the discovery service, a simple relay, a simple Transmission Control Protocol (TCP) relay, a simple User Datagram Protocol (UDP) relay, a GUID-relay, a TCP GUID-routing-relay, and a UDP GUID-routing-relay.

42. The method of claim 22:

wherein a NAT traversal mechanism comprises at least one of a DeMilitarized Zone (DMZ), an explicit port mapping, a user manual configuration, a casting of at least one of the networked device and the networked service as a communication initiator, an announcement to the discovery service with a source port that is bound to a port on which at least one of the networked device and the networked service listens, the discovery service sending a SYN from the port on which at least one of the networked device and the networked service listens, a hole punching process, a port prediction, and using a server to learn an address of an outermost NAT residing in a path between the server and at least one of the networked device and the networked service along with communicating the address via an external mechanism.