System for access control management

Abstract

A process includes receiving a first message generated in response to a first client computing device being associated with a first activation device, where the first message includes a first client computing device identifier associated with a first user of the first client computing device and a first activation device identifier of the first activation device, and identifying a first virtual device associated with the first active device based on the association configuration and the first active device identifier. The process may also include identifying a first application associated with the first virtual device based on the first virtual device and the association configuration, and running the first application associated with the first virtual device in response to the first message.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This patent claims the benefit of U.S. Provisional Patent Application No. 63 / 390,914, entitled “Variable, Configurable Device,” filed on July 20, 2022. The entire contents of the aforementioned patent application are incorporated herein by reference. Technical Field

[0003] The present disclosure relates generally to Internet of Things (IoT) systems, and more particularly, to creating virtual devices in a client-server mode for client devices based on activation points in the IoT system. Background Art

[0004] The Internet of Things (IoT) describes a network of physical objects embedded with sensors, software and other technologies for the purpose of connecting and exchanging data with other devices and systems over a network. These devices support a wide range of applications and, with the increasing number of billions of interconnected everyday devices, provide communication between people, processes and devices. Summary of the invention

[0005] The following is a non-exhaustive list of some aspects of the present technology. These and other aspects are described in the following disclosure.

[0006] Some aspects include a process that includes: receiving, with a computer system, a first message generated in response to a first client computing device being associated with a first activation device, wherein the first message includes a first client computing device identifier associated with a first user of the first client computing device and a first activation device identifier of the first activation device; identifying, using the computer system and based on an association configuration and the first activation device identifier, a first virtual device associated with the first activation device; identifying, using the computer system and based on the first virtual device and the association configuration, a first application associated with the first virtual device; and, in response to the first message, running, with the computer system, the first application associated with the first virtual device.

[0007] Some aspects include a tangible, non-transitory machine-readable medium storing instructions that, when executed by a data processing apparatus, cause the data processing apparatus to perform operations including the procedures described above.

[0008] Some aspects include a system comprising: one or more processors; and a memory storing instructions that, when executed by the processors, cause the processors to implement the operations of the above-described processes. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] The above and other aspects of the present technology will be better understood when the present application is read in light of the following drawings, in which like numbers represent similar or identical elements:

[0010] Figure 1 shows a computing environment in which the present technology may be implemented in some embodiments;

[0011] Figure 2 A block diagram according to some embodiments of the present disclosure is shown. Figure 1 An example of a server computing device of a computing environment;

[0012] Figure 3 A block diagram according to some embodiments of the present disclosure is shown. Figure 1 An example of a client computing device of a computing environment;

[0013] Figure 4 A flow chart illustrating a process for a variable, configurable device according to some embodiments of the present disclosure;

[0014] Figure 5 shows a graphical user interface according to some embodiments of the present disclosure;

[0015] Figure 6 An activation device according to some embodiments of the present disclosure is shown;

[0016] FIG. 7A to FIG. 7D The user and Figure 6 A series of actions and a graphical user interface for activating a process of device interaction;

[0017] Figure 8 shows a graphical user interface according to some embodiments of the present disclosure;

[0018] Fig. 9 shows a graphical user interface according to some embodiments of the present disclosure;

[0019] Fig.10 shows a graphical user interface according to some embodiments of the present disclosure;

[0020] Fig.11 illustrates a graphical user interface according to some embodiments of the present disclosure; and

[0021] Fig.12 An example computing device is shown in which the present technology may be implemented in some embodiments.

[0022] Although the present technology is susceptible to various modifications and alternative forms, specific embodiments thereof are shown by way of example in the drawings and will be described in detail herein. The drawings may not be drawn to scale. However, it should be understood that the drawings and their detailed description are not intended to limit the present technology to the particular form disclosed, but rather, the present invention is intended to cover all modifications, equivalents and alternatives that fall within the spirit and scope of the present technology as defined by the appended claims. DETAILED DESCRIPTION

[0023] In order to alleviate the problems described in this disclosure, the inventors had to invent solutions and, in some cases, just as importantly, recognize problems in the field of proximity devices and the Internet of Things (IoT) that had been overlooked (or not yet foreseen) by others. Indeed, the inventors wish to emphasize the difficulty of recognizing these emerging problems, which will become more apparent in the future if industry trends continue as the inventors anticipate. Furthermore, because multiple problems are solved, it should be understood that some embodiments are problem specific and that not all embodiments solve every problem of the conventional systems described herein or provide every benefit described herein. That is, improvements that solve various arrangements of these problems are described below.

[0024] Various embodiments of the present disclosure provide a framework for creating virtual or logical devices in a client-server mode, which are capable of performing specific tasks defined and configured in software, and which are activated by points in the physical world or their equivalents in the digital world, which may be referred to as activation points or activation devices. When in the physical world, activation points may include cryptographic security devices, such as, but not limited to, radio frequency identification (RFID) tags, near field communication (NFC) tags, Bluetooth low energy (BLE) beacons, ultra-wideband (UWB) devices, or other devices that are obvious to those skilled in the art who possess the present disclosure. When the activation point is virtual in the digital world of the embodiments discussed here, the activation point may include an icon in a website with an associated or embedded JavaScript object notation (JSON) web token, or a virtual object in an augmented reality or virtual reality space. The design and placement of activation points and associated messaging, such as through marketing, may convey the functionality of the associated physical device or virtual device.

[0025] In various embodiments of the present disclosure, some system categories that can be implemented using this paradigm include "receiver" devices, "presenter" devices, and "action" devices. Receiver devices may include portal devices through which others can contact owners, services, or other recipients that are obvious to those skilled in the art who possess the present disclosure. Presenter devices may include provider devices through which owners can submit evidence, credentials, or other information that is obvious to those skilled in the art who possess the present disclosure. Action devices, when activated, may include some actions or tasks, such as establishing a connection, generating a memo, subscribing to a group, recording an activity, or any other action that is obvious to those skilled in the art who possess the present disclosure. A virtual device or system implemented in this paradigm may include the functionality of a combination of features from more than one category. In addition, an activation device may be separated from a virtual device of one type or category and associated with a virtual device of another type or category. As illustrated by several use cases discussed below, this association or separation can flexibly provide great value. As previously described, a virtual device may be implemented in a client-server mode, and certain types of proximity devices (e.g., physical or virtual proximity devices) may be used as activation devices. The client computing device may be a smartphone, smartwatch, tablet, desktop computer, or any other connected computing device capable of interacting with the type of neighboring device associated with the virtual device. The servers may be owned and accessed on the public Internet, or they may be provided by a cloud service, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, or other cloud services apparent to those skilled in the art in possession of this disclosure.

[0026] When a user activates one of the activation devices, encrypted obfuscated data that can only be decrypted by the backend service can be presented to the user, and the encrypted obfuscated data contains, at the most basic level, a unique identifier of the activation device, as well as parameters for determining the authenticity of the activation device, excluding counterfeit and tampered devices, and detecting and preventing certain types of misuse. Cryptographic obfuscation can provide security and privacy, and although some basic functions can be implemented without cryptographic obfuscation, the practicality of virtual devices without such security and privacy may be limited. The backend service interprets this data and facilitates interaction with the virtual device based on its functions, features, configuration, and owner preferences. Although conceptually simple, several types of devices with strong real-world practicality can be implemented within this framework. The systems and methods of the present disclosure describe several applications (e.g., loops and passes) implemented in the framework. Loops may belong to the recipient class, while passes may belong to the presenter and action class. In addition, the concepts of roles, acquaintances, and assumed friends are introduced in new and specific ways, which adds value to the interactions created around virtual devices and platform services.

[0027] Figure 1 An example of a computing environment 10 in which the present technology may be implemented is shown. In some embodiments, the computing environment 10 is a distributed computing environment that implements a client / server architecture, although other architectures are also contemplated, including a monolithic architecture executed on a single computing device. In some embodiments, the computing environment 10 includes a server computing device 12, a client computing device 14, an activation device 16 (e.g., the activation device discussed above), and a network 20, such as the Internet, through which these components can communicate.

[0028] In some embodiments, the client computing device 14 is a desktop computer, laptop computer, in-store kiosk, tablet computer, mobile phone, head mounted display, wearable device, etc., executing an operating system and a client application 14a, such as a web browser or native application in which the described user interface is presented. Two client computing devices 14 are shown, but embodiments can support substantially more concurrent sessions, for example, more than 100 or more than 1,000 sessions distributed geographically in the United States or around the world.

[0029] In some embodiments, the server computing device 12 is a non-blocking web server or application program interface server that is configured to service multiple concurrent sessions with different client computing devices 14, such as implementing a model-view-controller architecture or other design. In some embodiments, the server computing device 12 can dynamically generate assets, markup language instructions, and scripting language instructions through the client application 14, through the backend service 12a, in response to requests from the client computing devices 14, to send a user interface to those client computing devices 14, or to update a user interface on those client computing devices 14. The user interface can evolve over time (e.g., in a web application), and in some cases, new resources (e.g., images and other data) sent from the server computing device 12 are displayed in response to user input to the user interface. A configuration engine and a rendering engine included on the server can be used to generate image files and metadata used by the server computing device 12 to generate the user interface.

[0030] In various embodiments, the activation device 16 may include a physical or virtual activation device. When in the real world, the activation device 16 may include a cryptographic security device, such as but not limited to an RFID tag, an NFC tag, a BLE beacon, a UWB device, or other devices that are obvious to those skilled in the art who possess this disclosure. When the activation device 16 is virtual in the digital world of the embodiments discussed here, it may include an icon in a website or a virtual object in an augmented reality or virtual reality space, which has an associated or embedded JavaScript Object Notation (JSON) web token or other cryptographic obfuscation token for securely embedding information in an HTML element or virtual object. In some embodiments, the activation device 16 may be included in the client computing device 14 and may therefore require power.

[0031] In some embodiments, the server computing device 12, the activation device 16, or the client computing device 14 may perform the process, for example, by executing program code stored on a tangible, non-transitory machine-readable medium. The operations shown may be performed in a different order, omitted, duplicated, performed concurrently, performed serially, insert additional operations, be fully automated, involve human intervention, or be modified relative to the illustrated arrangement, and this is not intended to be limiting of any other description herein.

[0032] Figure 2 An embodiment of a server computing device 200 is shown in FIG. Figure 1 The server computing device 12 discussed above. Thus, the server computing device 200 may include a single server or multiple servers or computers operating in a distributed manner across multiple servers. In the illustrated embodiment, the server computing device 200 includes a chassis 202 that houses the components of the server computing device 200. Figure 2 For example, chassis 202 may house a processing system (not shown) and a non-transitory memory system (not shown) that includes instructions that, when executed by the processing system, cause the processing system to provide a variable, configurable device engine 204 that is configured to perform the functions of a variable, configurable device engine or server discussed below. Figure 1 , the variable, configurable device engine 204 can be a backend service 12a or a part of providing a backend service 12a. Figure 2 In the particular example shown, the variable, configurable device engine 204 may be configured to perform at least a portion of the functionality described herein such that resources on the client computing device 14 may be freed to perform other functionality.

[0033] The chassis 202 may also house a communication system 206 that is coupled to the variable, configurable device engine 204 (e.g., via a coupling between the communication system 206 and the processing system) and configured to provide communications over the network 20 as described below. The communication system 206 may allow the server computing device 200 to communicate with the server computing device 200 via the communication system 206. Figure 1 The network 104 sends and receives information.

[0034] The chassis 202 may also house a storage device (not shown) that provides a storage system 208 that is coupled to the variable, configurable device engine 204 through the processing system. The storage system 208 may be configured to provide various databases. For example, the storage system 208 may store a virtual device database 214 that may include a plurality of virtual devices 214a, 214b, 214c, or 214d. The virtual devices 214a-214d may include various loop or pass devices discussed herein. The storage system 208 may include an activation device database 216 that includes an activation device identifier 216a, 216b, 216c, or 216d of the activation device 16 and any other information associated with the activation device. The storage system 208 may include an owner database 218 that includes a user identifier 218a, a user identifier 218b, a user identifier 218c, or a user identifier 218d of a user of the variable, configurable device system and any other information associated with the user. In addition, the storage system 208 may include at least one application in the application database 222 that is discussed herein. Figure 1 The client computing device 14 provides instructions to the variable, configurable device engine 204. As shown, the application database 222 may include application 222a, application 222b, application 222c, or application 222d, which may provide separate applications or different configurations of a single application.

[0035] In various embodiments, the storage system 208 may include a configuration database 224, which includes a configuration 224a, a configuration 224b, a configuration 224c, or a configuration 224d. The configurations 224a-224d may provide mappings between users 218a-users 218d, virtual devices 214a-virtual devices 214d, activation devices 216a-activation devices 216d, and applications 222a-applications 222d. The configurations 224a-224d may be edited by the variable, configurable device engine 204 to change the mappings between the various virtual devices, users, activation devices, and applications. In addition to the mappings, the configurations 224a-224d may also include other instructions or permissions to allow or deny certain features of the applications 222a-applications 222d. Although a particular server computing device 200 has been shown, those skilled in the art having possession of the present disclosure will recognize that other server devices (or other devices operating in accordance with the teachings of the present disclosure in a manner similar to that described below for server computing device 200) may include various components and / or component configurations for providing conventional computing device functionality as well as the functionality discussed below, while also remaining within the scope of the present disclosure.

[0036] Figure 3 An embodiment of a client computing device 300 is shown in FIG. Figure 1 The client computing device 14 discussed herein may be provided by a mobile computing device such as a laptop / notebook computer, a tablet computer, a mobile phone, or a wearable computer. In the illustrated embodiment, the client computing device 300 includes a chassis 302 that houses the components of the client computing device 300. Several of these components are Figure 3 For example, chassis 302 may house a processing system (not shown) and a non-transitory memory system (not shown) that includes instructions that, when executed by the processing system, cause the processing system to provide a variable, configurable device user interface engine 304 that is configured to perform the functions of a variable, configurable device user interface engine or client computing device 300 discussed below. Thus, variable, configurable device engine 204 may be Figure 1 Client application 14a.

[0037] The chassis 302 may also house a communication system 306 that is coupled to the variable, configurable device user interface engine 304 (e.g., via a coupling between the communication system 306 and the processing system). The communication system 306 may include software or instructions stored on a computer-readable medium that allows the client computing device 300 to send and receive information through the above-mentioned communication network. For example, the communication system 306 may include a first communication interface 308 to provide communication through the network 104 as detailed above (e.g., a first (e.g., relatively long-range) transceiver). In one embodiment, the first communication interface 308 may be a wireless antenna that is configured to provide communication with an IEEE 802.11 protocol (Wi-Fi), cellular communications, satellite communications, other microwave radio communications, or other communications. The communication system 306 may also include a second communication interface 310 that is configured to provide direct communication with other user devices, sensors, storage devices, and other devices. (e.g., a second (e.g., relatively short-range) transceiver). For example, the second communication interface 310 can be configured to operate according to a wireless protocol, such as Bluetooth, Bluetooth Low Energy (BLE), Near Field Communication (NFC), RFID, UWB, Infrared Data Association (IrDA), ANT, Zigbee, Z-Wave IEEE 802.11 protocol (Wi-Fi), and other wireless communication protocols that allow direct communication between devices. For example, the communication interface 310 can include an RFID reader or writer or an NCF reader or writer.

[0038] Chassis 302 may house a storage device (not shown) that provides a storage system 312 that is coupled to the variable, configurable device user interface engine 304 through the processing system. Storage system 312 may include any instructions, content, or data described herein and may be used with Figure 2 The storage system 208 of the server computing device 200 shares some databases.

[0039] In various embodiments, chassis 302 also houses a user input / output (I / O) system 314 that is coupled to the changeable, configurable device user interface engine 304 (e.g., via a coupling between the processing system and the user I / O system 314). In one embodiment, the user I / O system 314 may be provided by a keyboard input subsystem, a mouse input subsystem, a track pad input subsystem, a touch input display subsystem, a microphone, an audio system, one or more cameras, a haptic feedback system, or any other input / output subsystem that would be apparent to one of ordinary skill in the art in possession of this disclosure. Chassis 302 also houses a display system 316 that is coupled to the changeable, configurable device user interface engine 304 (e.g., via a coupling between the processing system and the display system 316) and may be included in the user I / O system 314. In some embodiments, the display system 316 may be provided by a display device that is integrated into the client computing device 300 and includes a display screen (e.g., a display screen on a laptop / notebook computing device, a tablet computing device, a mobile phone, augmented reality glasses, a virtual reality headset, other wearable devices, or other devices that include a display screen), or provided by a display device that is directly coupled to the client computing device 300 (e.g., a display device coupled to a desktop computing device via a wired or wireless connection).

[0040] The chassis 302 may also house a sensor system 318, which may be housed in or disposed on the chassis 302. The sensor system 318 may be coupled to the variable, configurable device user interface engine 304 via the processing system. The sensor system 318 may include one or more sensors that collect sensor data about the client computing device 300, a user of the client computing device 300, the physical environment surrounding the client computing device 300, or other sensor data that would be apparent to one of ordinary skill in the art in possession of this disclosure. For example, the sensor system 318 may include a positioning sensor that may include a geolocation sensor (a global positioning system (GPS) receiver, a real-time kinematic (RTK) GPS receiver, or a differential GPS receiver), a Wi-Fi-based positioning system (WPS) receiver, an accelerometer, a gyroscope, a compass, an inertial measurement unit (e.g., a six-axis IMU), or any other sensor for detecting or calculating orientation, position, or motion that would be apparent to one of ordinary skill in the art in possession of this disclosure.

[0041] In various embodiments, the sensor system 318 may include an imaging sensor, which may include, for example, a camera, a depth sensing camera (e.g., based on projected structured light, time of flight, a lidar sensor, or other methods), other imaging sensors (e.g., a three-dimensional image capture camera, an infrared image capture camera, an ultraviolet image capture camera, a similar video recorder, or various other image or data capture devices that can be used to collect visual information from the physical environment around the client computing device 300). The sensor system 318 may include other sensors, such as a beacon sensor, an ultra-wideband sensor, an air pressure sensor, one or more biosensors, an actuator, a pressure sensor, a temperature sensor, an RFID reader / writer, an audio sensor, an anemometer, a chemical sensor (e.g., a carbon monoxide sensor), or any other sensor that would be apparent to one skilled in the art in possession of the present disclosure. Although a particular client computing device 300 has been illustrated, one skilled in the art in possession of the present disclosure will recognize that a client computing device (or other device operating in accordance with the teachings of the present disclosure in a manner similar to that described below for the client computing device 300) may include various components and / or component configurations for providing conventional computing device functionality as well as the functionality discussed below, while also remaining within the scope of the present disclosure.

[0042] In some embodiments, server computing device 12, client computing device 14, or activation device 16 may perform the operations, for example, by executing program code stored on a tangible, non-transitory machine-readable medium. Figure 4 The process 400 of . The operations shown may be performed in a different order, omitted, duplicated, performed concurrently, performed serially, insert additional operations, be fully automated, involve human intervention, or be modified relative to the arrangement shown, and this is not meant to be limiting of any other description herein.

[0043] In some embodiments, process 400 Figure 4 . Process 400 may begin at block 402, where a message generated in response to a client computing device being associated with an activation device may be received. The message may include a client computing device identifier associated with a user of the client computing device and an activation device identifier of the activation device. In one embodiment, at block 402, a mutable, configurable device engine 204 of a server computing device 200 may receive the message via a communication system 206. In block 404, the message may be verified. In one embodiment, at block 404, a mutable, configurable device engine 204 of a server computing device 200 may verify the message, the activation device 16, or the client computing device 300.

[0044] In various embodiments, the message may be received from the variable, configurable device user interface engine 304 of the client computing device 300 via the communication system 306 and the network 20. The user of the client computing device 300 may scan the activation device 16 using the sensor system 318 or the communication system 306. The activation device 16 may generate a message and be received by the client computing device 300 via the sensor system 318 or the communication system 306. The message may be provided to the variable, configurable device user interface engine 304. The variable, configurable device user interface engine 304 may add a client handle, such as a client computing device identifier for identifying the user of the client computing device 300. The message and the client handle may be provided to the variable, configurable device engine 204 of the server computing device 200 via the communication system 306, the network 20, and the communication system 206, and the server computing device 200 may use the client handle and the content of the message to authenticate the user and the activation device 16.

[0045] For example, the activation device 16 may generate a secure unique NFC data exchange format (NDEF) (SUN) message. The activation device 16 may include an NFC tag that may be programmed to respond with one of several types of responses when scanned. One type of response is to provide a record known as an NDEF record, one of several types of NDEF records being known as a uniform resource identifier (URI). In various embodiments, an implementation is discussed in which the NFC tag makes available a specific type of URI known as a uniform resource location (URL) and a specific type of URL known as a web address or link, the web address or link including a fixed portion and a variable portion, wherein the variable portion has been cryptographically obfuscated using Advanced Encryption Standard (AES) cryptography, such as: https: / / 192.168.1.100:3010 / sparrow?d=273F04F46B214F11D9 1FDAF98E04E788&f=84CCC213F902DB5194B1B1A919CD2D92E24BBF1775D835B0ED23EC9A13 4413EF548743F38B304605938DECEA9F4C91EFFB301BB6FBB1BD3EE4CF2F6438B660&m= 483D5AAB4B83BD2A .

[0046] The first portion of the URL defines a fixed protocol (https) and host name (192.168.1.100:3010). The user's client computing device 300 can direct the user to the host through an Internet browser (e.g., Safari, Chrome, Firefox, etc.), or an application associated with the host (e.g., the mutable, configurable device user interface engine 304). The backend service hosted at the address (e.g., the mutable, configurable device engine 204) uses the rest of the URL to formulate a response for the user. In the example above, this portion consists of the route " / sparrow" and three query parameters: d=273F04F46B214F11D91FDAF98E04E788, f=84CCC213F902DB5194B1B1A919CD2D92E24BBF1775D835B0ED23EC9A134413EF548743F38B304605938DECEA9F4C91EFFB301BB6FBB1BD3EE4CF2F6438B660, and m=483D5AAB4B83BD2A, where "m" is a cryptographic message authentication code (CMAC) used to verify the integrity and authenticity of the rest of the URL.

[0047] The mutable, configurable device engine 204 uses the routing specifier "sparrow" to identify a group of NFC tags, which allows it to look up a key associated with the group, such as k1, which it uses to decrypt the "d" query parameter to identify the specific tag being scanned by its unique ID (UID) and a counter value that increments each time a tag is scanned. The counter value can allow the mutable, configurable device engine 204 to identify repeated and out-of-order scans, which can indicate an attempt to record the URL at one time and access the service later, or to access the service more than once using the same URL. Using the UID, the mutable, configurable device engine 204 can look up another key, such as k2, which it uses to decrypt the "f" query parameter containing a unique alphanumeric value, such as x1, to verify the authenticity of the device, and check the "m" parameter against a corresponding calculated value to establish the integrity of the URL data. The unique alphanumeric value hidden in the "f" parameter x1 may only be known to the mutable, configurable device engine 204 and is used to detect counterfeit devices. All unique data (UID, counter, x1) is obfuscated by cryptographic techniques, which renders the query parameter values ​​meaningless to anyone without the proper encryption keys and methods, thereby hiding the identity, ownership, and configuration of the activated device. Note that the query parameters change each time the tag is scanned in a way that only the mutable, configurable device engine 204 can unravel.

[0048] The specific example of a web resource NDEF record retrieved from an NFC device is one embodiment of how to implement the activation device 16. There are many other methods that can affect the same or similar results. The key elements of the appropriate method are proximity or proximity interaction, encryption that affects privacy, security, verifying the authenticity of the activation device, excluding counterfeiting and tampering of the activation device 16, and preventing certain types of misuse. Other types of records, other types of cryptography (including asymmetric key cryptography), other types of proximity devices (such as RFID (including UHF) tags, dual-frequency (HF & UHF) tags, BLE beacons, UWB devices, or other activation devices that are obvious to those skilled in the art who possess this disclosure) can be used to implement these elements. Another method is to display the encrypted data on the screen as a QR code that changes after each use. Although the above are examples of physical contact or activation devices, the virtual contact or activation device 16 can be an icon or another graphic in a website, or an object associated with a cryptographic obfuscation token (such as a JSONWeb token) in the AR / VR space, which serves the same purpose as the variable component of the web resource NDEF record described above.

[0049] Process 400 may proceed to block 406 where a virtual device associated with the activation device is identified based on the associated configuration and the activation device identifier. In one embodiment, at block 406, the variable, configurable device engine 204 may use the activation device identifier or the client computing device identifier (which in some embodiments may be a user identifier (e.g., an identifier associated with a user account generated by the variable, configurable device user interface engine 304)) to determine the virtual device associated with the activation device 16. For example, the variable, configurable device engine 204 may use the received activation device identifier to search the configuration database 224 for configurations 224a-224d that include the activation device identifier. From there, the variable, configurable device engine 204 may determine from a configuration file (e.g., configuration 224c) that includes the activation device identifier of the activation device associated with the virtual device (e.g., virtual device 214d) in the virtual device database 214. In some embodiments, in addition to the activation device identifier, the client computing device identifier may also be used to determine the virtual device associated with the activation device 16. Furthermore, in some embodiments, the client computing device identifier may be an identifier for determining the virtual device.

[0050] Process 400 can proceed to block 408, where an application associated with the virtual device is identified based on the virtual device and the associated configuration. In one embodiment, at block 408, the variable, configurable device engine 204 can identify an application associated with the virtual device based on the virtual device and the associated configuration. For example, the configuration 224c identifying the virtual device 214d can also identify the mapping between the virtual device 214d and the application 222a. Examples of applications are discussed below (e.g., loop applications, pass applications, lost device applications, or other applications discussed herein or obvious to those skilled in the art who possess this disclosure). The applications described herein can be sub-applications of larger applications or different configurations of applications. In some embodiments, instead of independent applications that can be associated with the virtual device, the virtual device itself can include a fixed application that can be configured based on the user, the owner's preferences, other criteria discussed herein, or other criteria obvious to those skilled in the art who possess this disclosure.

[0051] The process 400 may proceed to block 410 where an application associated with the virtual device is run in response to the message. In one embodiment, at block 410, the variable, configurable device engine 204 may cause the application or a portion of the application to run on a processor of the server computing device 12 / 200. The application may respond to the message such that instructions are sent back to the client computing device 14 / 300. Execution of the application may cause the instructions to be provided to another client computing device that may be associated with the owner user of the virtual device or activation device 16.

[0052] Process 400 can proceed to block 412, where an instruction to change the associated configuration is received and executed. In one embodiment, at block 412, a variable, configurable device engine 204 can receive an instruction to update the associated configuration settings. As described above, the associated configuration can include a mapping between a user, an activation device, a virtual device, and an application. For example, an owner user can be the owner of one or more virtual devices, each of which is associated with one or more applications. Each virtual device can be associated with one or more activation devices that the owner user can also own and control. A virtual device, an activation device, or an application can also be associated with one or more participating users, thereby allowing or preventing participating users from using devices that are associated and configured together. In this way, a virtual device, a user, an activation device, or an application can be exchanged in various ways to achieve a desired configuration or a variable configuration that changes according to the conditions met, as described in the examples of the present disclosure.

[0053] For example, in various embodiments, an instruction to associate a virtual device with another application may be received. The application associated with the virtual device may be disassociated by updating the association configuration, and a new application may be associated with the virtual device so that when a new message is received in response to a user approaching an activation device associated with the virtual device, the new application may be presented.

[0054] In another example, an instruction may be received to disassociate the activation device from the virtual device. The mutable, configurable device engine 204 may disassociate the activation device so that if the client computing device forwards a message received by the activation device, the mutable, configurable device engine 204 will not recognize the virtual device as being associated with the activation device, and thus the associated application will not run. Similarly, other activation devices may be associated with the virtual device, or the disassociated activation device may be associated with another virtual device.

[0055] In another example, a virtual device may be associated with more than one application, and which application is running may be based on which user activated the associated activation device. For example, a message from a first client computing device may activate a first application (e.g., an application or a configuration of a separate application), while a message from a second client computing device may activate a second application. The associated configuration may associate applications based on a user identifier. In yet another example, a virtual device itself may be exchanged with another virtual device, or an owner associated with a virtual device, application, or activation device may be updated.

[0056] Although the above example describes the client computing device 14 transmitting data or messages from the activation device 16 to the server computing device 12, other methods of protecting the transmission of data from the activation device 16 to the backend service 12a may also be employed. One such method is out-of-band transmission, which means that the data from the activation device 16 can be transmitted to the backend service 12a through a channel other than the client computing device 14. For example, the activation device 16 may include some or all of the components of the client computing device 14 / 300 and may be connected to a home network, including directly or indirectly through other things in the Internet of Things, which in turn may be connected to the Internet through, for example, a hub, or the activation device 16 may have a direct connection to the Internet, such as through a cellular or satellite data connection. Data from the activation device 16 and additional data from the client computing device 14, including the client handle, can be relayed to the backend service 12a through this alternative channel. Such data transmission from the activation device 16 may not require cryptographic obfuscation because the client computing device 14 never has it. In some cases, a particular communication method may employ encryption as a general or optional means of obfuscating all payloads, regardless of whether the activation device 16 employs any cryptographic obfuscation.

[0057] The embodiment of the SUN message is an example, however, it lacks a parameter that may be critical to preventing one type of abuse. The parameter is the timestamp when the activation device 16 is scanned. In the embodiment of the SUN message, a timestamp is used from the moment the client computing device 14 delivers the NDEF message to the client application 14a (e.g., the variable, configurable device user interface engine 304), or from the moment the backend service 12a (e.g., the variable, configurable device engine 204) receives data from the client application 14a. Under normal circumstances, these two timestamps may be substantially the same. However, this approach is not foolproof. A malicious actor may use another application on the actor's client computing device 14 to record the NDEF message without sending it to the client application 14a, and therefore not sending it to the backend service 12a. The actor may send it to the client application 14a much later (e.g., one hour later), or the actor may attempt to send it directly to the backend service 12a through a malicious application. If no other scans of the activation device 16 are sent to the backend service 12a within this hour, the backend service 12a may not have any means to determine that the scan data has been recorded one hour ago. With the original SUN message, the backend service 12a may only have access to a counter to determine the order of scans. This situation could be prevented if there was a way to determine when the activation device 16 was scanned, regardless of when the SUN message was delivered to the client app 14a or the backend service 12a. One way to accomplish this is to implement a clock in the activation device 16 and include the scan timestamp as an additional parameter in the SUN message. The timestamp parameter can be cryptographically obfuscated like the other parameters in the SUN message, or it can be in plain text but covered by a signature, such as the signature represented in parameter "c". Providing a timestamp at the activation device 16 requires the activation device 16 to be powered, which is feasible for some types of activation devices but impractical for some other types of activation devices.

[0058] Another method of including a timestamp is to implement the scan event with a two-way exchange, where the client computing device 14 initiates the interaction by sending a timestamp to the activation device 16, which then includes the timestamp in its return SUN message. A malicious actor could defeat this method by sending a future timestamp to the activation device 14. This is done by creating a timestamp and a reference identifier to it in the backend service 12a, then sending that reference identifier to the client app 14a, which then uses the client computing device 14 to send it to the activation device 16, which then returns it in a SUN message. The reference identifier itself could be a timestamp obfuscated by encryption using a method and key known only to the backend service 12a, or it could be a type UUID, etc., of the reference timestamp.

[0059] As described above, authorizations and permissions can be given to various users, which can be recorded in the backend service 12a as various association configurations. The variable, configurable device engine 204 can use the client handle of the client computing device 14 to find the association. However, authorizations and permissions can also be provided to the authorized party in other ways, including but not limited to through signed tokens. For example, the authorizer can specify authorizations and permissions in the form of dictionaries and key-value pairs in a JSON file that conforms to an appropriate protocol or framework, sign the token with a private key, and send it to the authorizer. This refers to asymmetric key encryption using a public-private key pair. Signed tokens can be stored on the client computing device 14 and can be presented by sending them to the backend service together with the data received from the relevant activation device 16. Signed tokens can also be stored in a cloud repository or a distributed database. Signed tokens can also be sent to the activation device 16 and verified locally.

[0060] In various embodiments, the act of scanning activation device 16 may be meant to imply an interaction whereby data is exchanged between client computing device 14 and activation device 16 to achieve various purposes, including but not limited to identifying activation device 16, establishing its trusted and untampered status, establishing the order and / or time of interactions, updating certain records in activation device 16, authenticating activation device 16, authenticating client computing device 14, determining activation device authorization, determining client computing device authorization, or other purposes. Although some examples of process 400 are discussed above, other variations may be implemented by those skilled in the art in possession of the present disclosure without departing from the scope of the present disclosure. Several examples of applications that may run on this variable, configurable device platform are given below.

[0061] Loop

[0062] There are many ways to contact someone, including post, phone, email, Skype, WhatsApp, or other communication methods. Some communication methods communicate directly with the person in question, such as personal mobile phone numbers, personal emails, and one-on-one Skype calls. Other communication methods direct communication at an object associated with the person of interest, such as a phone number associated with a residence or mail addressed to a business. There are many other ways to categorize contact methods, such as by the ability to reuse the method, or by the ability of the owner to control the parameters of the communication. For example, phone contacts are often reusable. Once a user's phone number is known, another user can call them again using the same phone number. Most of the other methods in the list above are similar. For example, once a user's email address or Skype username is known, another user can contact them again using the same credentials. However, some of these methods allow the contacted party to remove the contacting party from their contact list, after which the contacting party may not be able to contact the contacted party again, which is a crude type of control.

[0063] The loop may include a virtual device or a virtual device-application pair that allows one party to contact and communicate with another party without having to exchange any contact information. Its functionality may be implemented in software within a client-server framework, and one or more cryptographically secure proximity devices, such as RFID, NFC, BLE, UWB, virtual proximity devices, etc., are used as contact points (e.g., activation points / devices 16 discussed above). These contact points (e.g., cryptographically secure proximity devices) allow the backend service 12a to detect and manage various types of misuse attempts, perform verification to establish the authenticity of the proximity device and exclude forged and tampered proximity devices, and find ownership, functions, features, settings, and preferences of the owner. The cryptographic security feature of the contact point has an important function so that the identity or contact information of the owner or other people with whom the owner may share the loop device will not be exposed to the contact party, which means that the contact party may not be able to contact the owner without contacting the contact point every time it wishes to establish contact and communication. Although contact and communication can also be facilitated by contact points that do not implement strong security and / or strong privacy, without them, the practical application of the loop will be severely limited.

[0064] The owner of the loop can control which users can contact the owner, or control when and how users initiate contact. The owner can enable, disable, mute, or ready the loop at any time. The owner can set it to require additional credentials before opening communication, and the owner can grant managed permission to the contact to continue communication initiated later through the loop without it. The following embodiments of the present disclosure discuss several types of loop virtual devices to convey the range of their practicality. For example, the loop can include a door loop, a car loop, a normal owner loop, a lost property loop, a business loop, or any other loop that is obvious to a person skilled in the art who possesses the present disclosure.

[0065] Figure 5 A graphical user interface 504 is shown showing a list view of three loop devices (loop 506, loop 508, and loop 510), as can be shown via a mutable, configurable device user interface engine 304 provided on a display device 502 of an owner's client computing device 500. From this view, the owner can access the configuration or settings (gear icon 512) of each loop 506-510, its shared authorization interface (share icon 514), mute reminders and notifications (ring icon 516), access email threads (envelope icon 518), chat (chat icon 520), a summary of voice and video calls (phone icon 522), and a list of all events (barcode icon 524) or whether there are any communications associated with the loop. The three loops 506-510 in this view include two door loops associated with a physical address (e.g., loop 506 and loop 508), and one car loop associated with a car (e.g., loop 510).

[0066] The loop can be accessed through the contact point. In one embodiment, the contact point can be a label, window sticker, or other type of carrier embedded with a secure communication inlay, where the design of the carrier and / or its artwork conveys its functionality. For example, an NFC inlay can include an NFC chip, an antenna mounted on a substrate, which can include clear plastic with or without an adhesive. The NFC inlay can be combined with a label or other carrier to create a more durable and more aesthetically pleasing NFC tag. For example, Figure 6A communication inlay 600 is shown, which may be an activation device 16, with artwork on a window sticker 602 having embedded therein a secure communication tag 604 intended to convey the concept of a doorbell. A centrally located NFC Forum wayfinding sign 606 or alternative graphics of an NFC or other communication inlay informs visitors that to access its functionality, the visitor must scan the proximity tag using a proximity reader in a client computing device 14. This particular type of activation device 16 may be referred to as a doorbell device. Note the distinction between a doorbell device (activation device) and a door ring (including a virtual device associated with a doorbell device). Finally, placing such a doorbell device at or near the entrance of a location (e.g., a residence or business) may enhance its intended functionality.

[0067] FIG. 7A to FIG. 7D Shows Figure 6 Example use of the communication inlay 600. To access the door loop interface of the variable, configurable device application on the user computing device 700, the visitor may first select a proximity device reader function (e.g., an NFC reader function) or the function may be active by default, and scan the communication device inlay 600 (e.g., a doorbell device). Fig. 7A As shown, once the user has scanned the communication device inlay 600 , and before the gate loop interface 702 is presented to the user on the user computing device 700 , several events may occur.

[0068] After establishing the integrity of the uniform resource locator (URL) data obtained from the NFC scan to exclude attempts at counterfeiting and tampering and misuse of the activation device 16, the backend service 12a proceeds to identify the associated gate loop (e.g., Figure 5 loop 508) related ownership, functionality, settings, and preferences, and formulates a response for the visitor. A successful response is to present the visitor with Figure 7B and 7C 702, Error! Reference source not found. (a). Note that this door loop interface has additional components that are not present in traditional or modern video doorbells. In addition, there are features that are implemented in the backend service 12a that are not visible on the interface. The embodiments of the present disclosure first discuss the components of the doorbell interface and later discuss some of the hidden features.

[0069] The gate loop interface 702 may include a title or identifier 704 assigned by the owner, such as the address "77Elm" associated therewith. The gate loop interface 702 may include a countdown timer 706 indicating the time remaining to activate the gate loop, such as "2 minutes and 19 seconds". Fig.7DAs shown, if the visitor does not activate the door loop within the countdown period (scan timeout), the scan is terminated. This prevents a certain type of misuse, in which the visitor may attempt to activate the door loop after scanning the activation device (e.g., communication device inlay 600) and possibly after leaving. The door loop interface 702 may include activation buttons, such as a doorbell button 708, an initiate chat button 710, a video call button 712, or other buttons, such as a voice call button (not shown), a security entrance pin plate (not shown). The door loop interface 702 may include an email form 714 for posting emails and having the option to include attachments, such as images, videos, newsletters, flyers, or other functions. The "door loop" interface may also present secure entry options, for example, it may bring up a PIN pad or camera for facial recognition, and in the event of successful authorization, it may "start" the unlocking of the door lock and / or the automatic opening of the door. In the case of multiplexing, the door loop interface may first present a screen requiring the visitor to select a group / unit, and then access the group / unit's Figure 7C The gate loop interface 702.

[0070] The door loop interface 702 options may be different for a visitor who is not a registered user of the host service (a "customer"), a visitor who is not a registered user (a "user"), a visitor who is not a contact of the owner (a "contact"), or if he is logged in as a private person, or as a member of an enterprise, service organization, law enforcement agency, or any other tag-based or group-based user group.

[0071] The owner can deactivate the door ring by changing its settings appropriately, which will mark it as deactivated in the device list view and display a deactivation message to anyone who scans the associated enabled device (e.g., doorbell device or door device).

[0072] If a visitor accesses an activated device 16 during a time that the owner has marked "Do Not Disturb," the doorbell interface 702 may display a customized "Do Not Disturb" message set by the owner, and may or may not provide simplified functionality, such as the ability to post only emails or flyers, depending on the configuration of the Ring device.

[0073] In addition, the owner may require the visitor to share his location before presenting the gate loop interface 702. This feature may prevent another type of misuse, in which the activation device may have been moved from its intended location, such as when it has been vandalized or stolen. If the visitor refuses to share his location, or if his location does not match the location of the activation device set by the owner, the backend service 12a may not present the gate loop interface 702, and instead the visitor may see a message indicating why the gate loop interface 702 is not being presented.

[0074] Figure 8 Shows that following Figure 5 , Figure 6 , Fig. 7A , Figure 7B and Figure 7C Example of an example owner user computing device 700. Once a visitor activates Figure 7B and 7C 808, the owner is notified via an alert 802 on a client computing device 800 (e.g., client computing device 14 / 300) or multiple devices, depending on preferences associated with the owner. In this embodiment of alert 802, alert 802 may include a title 803 (e.g., "Ahead") indicating the door loop and the activation device 16 that was triggered. The owner may have several options. The owner may click an "OK!" button 804 to indicate that the owner will be at the door shortly, or a "DND!" button 806 to indicate that the owner does not want to be disturbed at this time. The owner may also respond by initiating a chat 808, a voice call 810, or a video call 812 with the visitor.

[0075] In various embodiments, the door loop application can implement a service so that when the owner initiates a video call, the visitor is simply brought into the call without presenting the owner with a prompt to accept or decline. However, if the visitor initiates a video call request, the owner can choose to accept or decline.

[0076] When the visitor is waiting for the owner to respond to the alarm, the visitor can see the waiting answer state, which includes an option to cancel activation, and if selected, the alarm 802 will be immediately dismissed. The waiting answer state can have its own countdown timer (ring timeout), after which the alarm 802 will be automatically canceled.

[0077] If the owner does not take any action in response to the alert 802, and once the ring timeout has expired, the visitor may see a status that communicates to the visitor that the owner is not home or unavailable.

[0078] The visitor may also activate other door ring buttons, such as to start a chat (e.g., chat button 710), or to request a voice or video call (e.g., video call button 712), or the visitor may simply use Figure 7C The email is posted in the form 714 in the doorbell interface 702. A successfully delivered email can be confirmed by a confirmation screen.

[0079] Fig. 9An example embodiment of a door loop configuration or setup interface 900 is shown, in which an owner can specify various preferences, such as a title, an answering identity (self or another fictitious identity). The door loop configuration can be one of the configurations 224a-224d stored in the configuration database 224. Several doorbell devices or door devices (e.g., activation devices 16) can be associated with one door loop (e.g., a virtual device). In the example shown here, there are two doorbell devices associated with the door loop, one titled "Front", which can refer to its location at the front door entrance, and the other titled "Rear", which can refer to its location at the back door entrance of the house. The owner can choose to deactivate the door loop from the door loop configuration or setup interface 900, as well as deactivate each doorbell device individually from the doorbell device settings. When a visitor activates a door loop that has more than one activation device associated with it, the owner can be notified of the specific activation device that has been activated. For example, in Figure 8 In the alarm 802, the title 803 of the gate loop is limited by the title "Front" of the activated activation device.

[0080] The “Who Can Initiate” configuration option may allow the owner to present different door loop interface options to a visitor based on whether the visitor is a registered user of the service (“User”) (e.g., a user of user identifiers 218 a - 218 d ) or is (a “Customer”), and whether the visitor is on a contact list associated with the owner (“Contacts”).

[0081] The "Answer As" setting mentioned above can provide the owner with the option to answer the door ring either using his real identity as defined in his account profile, or through a fictitious identity of his choice, such as "Homeowner", "Resident of 77 Elm", a pseudonym such as "Popeye", etc. This is a privacy feature; if the owner replies to the visitor, the visitor will see the name associated with the "Answer As" identity.

[0082] In various embodiments, the owner of a virtual device (e.g., a door ring) can share the door ring with the owner's contacts. For example, the owner can share with other members of the household when the owner or other residents are away, or even with a friend or relative who can remotely open the door. The sharing or permission function is achieved through "grants". There are several types of "grants" available, such as "answer", "change configuration", "delete", etc.

[0083] If the owner shares a gate loop with another user, that user may receive a notification to accept or decline the sharing. If the user accepts, a "shared" gate loop designated by the "shared" flag may be created. The owner may later revoke one or more stock grants. If the owner revokes all grants, the shared loop is marked as "revoked" and is no longer functional.

[0084] With the "Answer" authorization, the grantee becomes a receiver of the Door Loop, which means that when a visitor activates the Door Loop, the grantee is notified in addition to the owner who is the default receiver. The grantee can configure the shared Door Loop preferences independently of the owned Door Loop preferences. The owner can share the Door Loop with any number of grantees, and he can provide them with the same or different authorizations.

[0085] When a visitor activates an activation device associated with a Door Loop with multiple receivers, then all receivers (unless they have configured their corresponding Door Loop, owner or sharer, to not alert them) will receive the Door Loop alarm. Any receiver can then answer the Door Loop, and as soon as one receiver answers, the alarms for the other receivers are automatically disarmed. If one receiver answers with "DND!", the visitor continues to see the Waiting for Answer status until all receivers have responded with "DND!" or the Ring Timeout has expired. If one receiver starts a chat with the visitor, the other receivers can join in.

[0086] For example, a visitor who is already on the recipient's contact list can directly initiate communication with the recipient without activating the doorbell device. However, most visitors are unlikely to be on the recipient's contact list. The recipient can control who can contact them through the door loop, how they can contact them, and how long, how many times, and how far away from the doorbell device they can be contacted after scanning the doorbell device. This is achieved through various logical means implemented in the variable, configurable device engine 204 and configured by settings and preferences. Other functions of the door loop application may include: (1) The visitor can select a unit or group number, ring the bell, initiate a chat, make a call request, send an email, or access the security entrance interface once after scanning the door loop activation device and before the scan times out. The visitor cannot ring the bell again, initiate another chat, make another call request, post additional emails, or access the security entrance interface again without scanning the doorbell device again. (2) The data generated by the scan can only be used in the order in which it was scanned. (3) Any chat initiated through the GateLoop interface can be set to terminate or deactivate after a certain period of time from when the activation device was scanned or activated, such as 10 minutes, or some other predetermined time from when the owner last sent a message on the chat, or after the visitor has exhausted his or her message quota allowed by the owner or another recipient. (4) Because the data records obtained from the GateLoop activation device are encrypted and obfuscated, they can only be decrypted by the GateLoop application using the appropriate keys and methods in its possession, so the visitor cannot access the recipient's identity, contact information, or features, settings, preferences, authorizations, etc. associated with the GateLoop.

[0087] After the visitor has sent an email through the loop device, the visitor may not have a way to send additional communications without again passing through the contact point / activation device 16, which requires the visitor to be in the vicinity. However, once the owner receives the doorstep email or chat message, the owner may want to contact the visitor, but also limit the visitor from sending unwanted additional emails or chat messages, or unwanted email or chat message types. For example, for a doorstep email or chat message that includes a service item that the homeowner may be interested in. The owner may want to reply to the visitor to discuss a quote, but the owner may also want to prevent the visitor from being able to send the owner duplicate quotes or other emails or messages that are not related to lawn mowing services. At the same time, the visitor may want to limit replies from homes where the visitor has posted service offers in some way. For example, the visitor may want to limit the response period to 2 months, which may coincide with late spring and early summer, and when the visitor expects to be fully employed and no longer requires additional work.

[0088] To achieve this, reply quotas could be introduced. For door mails or chat messages posted, such as those posted via Door Loop, a reply count and reply period could be set. If this is the visitor's preference, this would mean that the homeowner could reply to the visitor's door mail or chat message, for example, three times in two months or some other count and period, and then never reply again. In a similar manner, when the owner of Door Loop replies to the visitor, the owner could assign a reply quota to the owner's replies on a per-mail or message basis, continuing the exchange in a controlled manner. For example, the owner might allow the visitor to send him one reply in two weeks.

[0089] While the above examples discuss door loops as a type of loop (e.g., a virtual device), and while door loops can be associated with residences or places of business, a general owner loop may be appropriate in other scenarios. For example, an owner's loop can be easily associated with almost any object, not just a place of residence or work. For example, an owner's loop can be associated with a car by sticking an activation device 16 on the inside of one of the car's windows; an owner's loop associated with a car can be referred to as a car loop because it can provide some functionality specific to that use case. Anyone can scan the activation device 16 (e.g., a tag embedded with a proximity device) to access a graphical user interface to contact and communicate with the owner or other recipients with whom the owner may have shared the car loop in a manner very similar to a visitor accessing a door loop. Visitors can request a chat, voice or video call, or send an email if the owner has set up a car loop configuration that allows such communication methods. For example, the owner can configure the loop to allow visitors to initiate a chat or post an email, but they may not request a voice or video call. The car loop interface may include an additional activation option, which may be referred to as a "honk" option, and which is intended to communicate to the owner a request that the owner now move the owner's vehicle because it may be blocking the visitor's path. This is a common requirement in many Asian countries where city streets are narrow and vehicles are often parked in a jam-packed manner.

[0090] While the owner's loop activation device can be associated with an object such as a car, bicycle, storage unit, etc., the owner's loop activation device 16 can also be embedded or integrated into an object such as a toy, sports equipment, clothing, and virtually any object. In this case, the object itself becomes the carrier of the activation device 16, and we refer to such an owner's loop activation device as an embedded activation device 16, which is different from an associated activation device 16 in some respects.

[0091] The associated activation device 16 can be removed from the associated object and associated with another object. Alternatively, the owner may also want to create another ring to associate the activation device 16, and similarly, it is desirable to provide the ability to detach the activation device 16 from one ring (e.g., a virtual device) and associate it with another ring. In contrast, an embedded activation device 16 cannot be removed from the object in which it is embedded. Thus, there may be situations in which the owner of an object may want to sell or give away the object, and therefore also want to transfer the embedded activation device 16 to a new owner. The owner may also want to transfer ownership of a removable activation device. Therefore, a set of additional modes can be implemented for removable and embedded activation devices. For example, four additional modes of the owner's loop activation device can be implemented. In the "Open" mode, any registered user can scan the device and set it as their own. In the "Security Code" mode, any registered user can scan the device, provide the correct security code set by the previous owner, and then set it as their own security code. In the "Request Transfer" mode, any registered user can scan the device and request to transfer ownership, and if they do so, the current owner will be notified and he can allow or deny it. Finally, a person may lose a removable activation device or an object containing an embedded activation device. In this case, the owner can mark the activation device as lost. Marking the activation device as "lost" temporarily separates it from its virtual device (e.g., the owner's loop) and associates it with another virtual device (e.g., the lost object loop). In other embodiments, when the activation device is marked as lost, another application or software function can be associated with the virtual device associated with the owner (e.g., the owner's loop).

[0092] The Lost Object Loop is a loop or application designed specifically for handling lost objects. When a user scans a lost activation device or an activation device embedded in a lost object, the user can immediately see that the object has been marked as lost by its owner. In addition, the user can see a customized message from the owner and have one or more methods to contact the owner, as configured by the owner. Although the Lost Object Loop is introduced here in the context of a lost removable activation device or an embedded activation device, where the carrier object may have been lost, the concept of marking a removable activation device or an embedded activation device lost (essentially marking the carrier object lost) applies to many types of activation devices, not just the owner's loop activation device.

[0093] One of the key elements of a touchpoint (and more generally, an activation device) is its unique identifier, which allows it to be associated with a corresponding virtual device. As mentioned above, another virtual device or application associated with a virtual device is a pass, which will be discussed in further detail below, which can combine functionality from the Presenter and Action classes. The activation device of a pass can similarly be marked as "lost." Like the owner's loop activation device, when the activation device of a pass loop is marked as lost (essentially marking the carrier item as lost), it is temporarily separated from its nominal virtual device (for example, the purpose of which may be to present a document) and associated with the lost item loop. Note that the pass device is not configured to be able to contact and communicate, the system and method of the present disclosure provides for logically converting the pass device into one device by associating the pass device with the loop virtual device to meet the needs.

[0094] This ability to convert any activation device into a loop activation device has a wide range of applications. For example, consider the case where a user loses a credit card. The credit card is embedded with a secure proximity device, which is a smart card with a secure element that can provide cryptographically obfuscated data that can be accessed by a backend service 12a (e.g., Figure 2 The variable, configurable device engine 204 of the present disclosure is used to identify and authenticate it. In the context of the present disclosure, this makes the credit card a suitable candidate for being associated with a lost property loop while disabling its primary function of making payments when it is lost.

[0095] In some embodiments, when an owner scans an activation device or an object with an embedded activation device that the owner previously marked as lost, the mutable, configurable device engine 204 automatically disassociates the activation device from the lost object loop or application and associates it with the original virtual device or application to which it belonged before it was marked as lost.

[0096] In another embodiment, the owner's loop activation device can be designed to receive electronic proximity mail as its primary function. In this way, the virtual device can be associated with an electronic proximity mail application (e.g., one of the other applications 222a-222d). Such an activation device 16 can be applied to each mailbox in a community mailbox group, a post office mailbox group, and to mailboxes at or near the entrance of a residence. The corresponding loop can be set to present an interface that allows electronic proximity mail to be received as its primary offer, and may or may not provide additional functions such as ringing, chatting, and calling.

[0097] In another embodiment, the loop activation device 16 may be embedded with a cryptographically secure UHF RFID tag, such as a Radio Frequency Identification (RAIN) RFID tag, which can be read from up to 100 feet. Such an activation device 16 may be applied to a premises in a manner facing the road and may be scanned from a moving vehicle. The loop functionality of receiving adjacent mail may be automatic for authorized senders, allowing mail to be delivered from a moving vehicle, while the owner of the loop retains control over who may deliver such mail to his or her loop device. Such a scenario may be attractive for distributing email flyers for a community newsletter, etc.

[0098] In another embodiment, a UHF or dual-frequency activation device may be used on a car's windshield or license plate in the same manner as a toll tag, but providing multiple functionality from the Receiver and Presenter categories. For example, an associated virtual device may be configured to allow a service provider (e.g., a drive-thru business) to scan the activation device (using a UHF RFID reader) and call the driver once to accept the driver's order without access to contact credentials or knowing the driver's identity (e.g., a Receiver class functionality). Additionally, the virtual device may be configured to present access credentials at restricted parking access points, make payments at toll gates, and the like (e.g., a Presenter class functionality). For added security, the UHF feature may be disabled in the backend service when the associated windshield or license plate mounted activation device is scanned near an authorized service provider.

[0099] In another embodiment, the activation device 16 can be attached to a piece of clothing, such as next to a manufacturer's tag on a jacket or shirt, or it can be embedded in the clothing. This activation device 16 can also be made of a dual-frequency tag, which can achieve multiple functions: a loop contact point for the owner, store inventory, and locating stolen items.

[0100] In another embodiment, the loop activation device 16 may be embedded in a work of art, whereby it may serve as a point of contact for the artist, curator, past or present owner, art historian, auction house, etc. This arrangement may provide the provenance of the work of art and allow the aforementioned parties to communicate if they so desire.

[0101] In another embodiment, the activation device 16 can be implemented using a BLE beacon device. Such an activation device 16 can be scanned by a smartphone from up to 100 feet or more away, so the associated loop can be accessed from the driveway of a home or even the curb. In addition, a person's neighbors can access it from the comfort of their own home.

[0102] In another embodiment of the present disclosure, the contact point can be a combination of one or more devices: a conventional doorbell button, a video doorbell, an NFC-activated device, a UHF RFID-activated device, a UWB-activated device, a BLE beacon-activated device, or other activation devices that are obvious to a person skilled in the art in possession of the present disclosure.

[0103] In another embodiment, an additional feature may be provided to allow a public service person (e.g., parking enforcement police officer accessing a car loop or owner loop via an activation device 16 associated with a car, bicycle, or any other vehicle, as will be apparent to one skilled in the art in possession of this disclosure) to contact the owner without the owner's explicit authorization.

[0104] In another embodiment, the owner of the owner loop can be an organization, such as a private club. Such an owner can configure the loop to receive activations from its members, different from activations from non-members.

[0105] In another embodiment of a receiver-type device, the activation device 16 and its corresponding virtual device and application can act as a building internal communication or access control system. In this embodiment, the configuration and preferences of the receiver virtual device are controlled in part by the owners and / or residents of each group and in part by the building management, concierge or security. For example, in addition to facilitating the contact of visitors (as in the case of a door loop), this setting can also help food delivery personnel to enter the building safely and frictionlessly, enter the elevator at the right time and arrive at the right floor, while satisfying the authorization and recording requirements of all relevant parties (owners, residents and building management). Thus, in some embodiments, the activation device 16 can be associated with a security device (which can include some or all components of the client computing device 14), which can include a communication system configured to communicate with the server computing device 12 or the client computing device 14, so that when the application associated with the virtual device verifies the visitor, the application can transmit a signal to the security device (e.g., a lock, access controller, etc.) to allow the visitor to access (e.g., open the door).

[0106] Access

[0107] While the above loops may provide one or more types of applications 222a-222d, other applications may be associated with a user, an activation device, or a virtual device. A "pass" application is described below. It is common practice to use smart cards for identity credentials and payment, and embedded NFC tags for business cards, loyalty, access, etc. Sometimes, a smart card or NFC tag or similar technology in a carrier vehicle serves multiple purposes, such as in a smart ring that can be used for payment, access, loyalty, or other functions. There are some key elements required to implement various use case scenarios. A points card may require a simple identifier, and an access card may also require a simple identifier, but a cryptographically obfuscated identifier. Identity and payment cards may require additional complexity to affect biometric authentication, or to handle offline use.

[0108] As described above, device classes are introduced that can be created within the above framework. The passport virtual device combines some of the features of the action class with some of the features of the presenter class. The pass owner has complete control over who performs what actions when the associated activation device is activated, including not performing any actions, and what credentials and / or proofs can be presented. In addition, the owner can set up the pass to require certain authentication and authorizations and potential rewards when proofs and credentials are provided to another party. The activation device 16 can be embedded in a wearable item such as a bracelet, or embedded in a standard sized card that people can carry in their wallet, as a tag on the case of their mobile phone, or even virtually embedded in their smartphone.

[0109] In various embodiments, a pass implements a small set of functions from two classes: establishing contact (e.g., adding someone to their contact list (action class), and presenting a certificate, such as a virtual contact file (VCF) or also known as a vCard, a health insurance certificate, a membership subscription, or a loyalty certificate (presenter class). A pass can be associated with an activation device 16, which is a proximity device embedded in a carrier object such as a bracelet, pin, etc.

[0110] After establishing the integrity of the URL data, eliminating counterfeit and tampered devices and attempts at misuse, the mutable, configurable device engine 204 can proceed to identify the ownership, functionality, settings, and preferences associated with the associated pass (virtual device), perform appropriate actions, and formulate a response for the activating party.

[0111] Below are a few examples of how a pass may be configured, and what happens when the associated pass activation device is activated or scanned. For example, the scanning party may be an individual the pass owner has just met, and the scanning action adds this person to the owner's contact list and presents him with the VCF; or the scanning party may be a health clinic, and the scanning action presents the clinic with the owner's health insurance credentials, medical history, and any prescriptions the owner may currently be taking; or the scanning party may be a bookstore, and the scanning action presents the bookstore with his loyalty membership and payment credentials, etc.

[0112] Error! Reference source not found. Fig.10 A passport virtual device 1000 is shown in a device list view on the owner's client computing device 14. In this view, the owner can access the configuration or settings of the passport (gear icon), its authorization interface (share icon), disable or enable the device (checkmark icon), create screen activation points (QR code icon), and access a list of all scan events associated with the embedded passport activation device (barcode icon).

[0113] Configuration or settings view 1002. The action function associated with the pass activation device is to connect with the scanning party. The owner can configure this function to do nothing ("Don't connect"), to prompt him to decide how to connect ("Ask me"), to connect with the owner's real identity as defined in his account profile, or to connect through one of the owner's assumed identities (e.g., Popeye the Sailor, Archie Andrews, or Dr. Bilal Ahmed). The owner can also turn off the pass activation device.

[0114] In various embodiments, "User" refers to a registered user of the service. Non-registered users of the service may be referred to as "Customers." The owner may allow different authorizations for the two groups. For example, a registered user scanner of the owner's pass-activation device may present a "social" vCard / VCF that the owner has configured for a social setting. If no prerequisites are selected, the scanner does not need to share any credentials in return.

[0115] If the owner has set the "Connect As" setting to "Ask Me", and the shared authorization registered user presents his social vCard / VCF, then when the registered user of the service scans the passport-activated device, a message is presented to the scanner informing the scanner that the connection request has been registered, and the scanner can also download the owner's social vCard / VCF. At the same time, the owner can receive a notification to accept or deny the connection request, and if the owner decides to connect, the owner can choose to connect as "self", for example, using the owner's real identity defined in the account profile, or through one of the owner's assumed identities.

[0116] If the owner has configured the "Connect as" setting to "Myself", and the owner has revoked the registered user's sharing authorization from Share vCard / VCF to Do Not Share Anything, the registered user scanner will be immediately added to the owner's contact list and the scanner will display a confirmation message.

[0117] If the owner has set "Connect as" to anything other than "Don't connect" and a passport is scanned by someone who is not logged into the service, the scanner may see a message that the connection request is pending until the scanner logs in. Once the scanner logs in, the connection request can be processed. If the owner has set "Connect as" to "Ask me," the owner will receive a notification, as in the previous example; otherwise, the connection will proceed without any further action.

[0118] In another example, if the owner is attending a professional seminar, he may want to configure the passport to connect as a professional identity and set up shared authorization for users and customers to share his professional vCard / VCF.

[0119] When a colleague who is a logged in user of the service scans a pass activation device at a seminar, the colleague can be added to the owner's contacts via the owner's professional role (e.g., Dr. Bilal Ahmed), and the colleague can then also be presented with the owner's professional vCard / VCF. Note that the owner can share a vCard / VCF without asking for anything in return. However, the owner can request that the scanner also share the scanner's vCard / VCF, LinkedIn profile, or other social media profile.

[0120] The above scenarios show some use cases for using passport-activated devices and virtual devices in a person-to-person context. However, it can also be used to make payments or present credentials elsewhere. The functionality of a passport is determined by several factors, including its setup, authorizations and requirements, contact points, association of the scanner account (e.g., individual, business, service provider, etc.), authorizations, and setup.

[0121] Fig.11 Some examples of authorization settings for several different organizations are shown. The first example 1102 is presenting an owner's membership certificate for a City of Ottawa recreation facility (swimming pool, basketball court, gym, etc.) When the owner scans the pass activation device at a City of Ottawa recreation facility, after verifying the authorization of the scanning point to access the membership certificate.

[0122] The second example 1104 is when he scans his pass activation device at an Appletree Medical Group clinic, providing his Ontario Health Insurance Plan (OHIP) credentials after verifying the scanning point's authorization to access his medical insurance credentials.

[0123] A third example 1106 is when the owner scans the pass activation device at a Chapters or Indigo bookstore, providing his Plum Plus membership certificate (loyalty program).

[0124] This framework of identity, authorization, prerequisites, and authorization is a powerful tool that can be used to expand the usefulness of a passport to facilitate a wide range of interactions. Certain types of interactions, such as payments, may require additional authentication for increased security, which can be accomplished in a variety of ways, including prompts for passwords, palm scans, etc. on smart devices or point-of-sale (POS) machines.

[0125] In various embodiments, the owner of a pass virtual device can easily disassociate the activation device 16 (pass activation device) from it and associate another one. For example, the owner may have compatible proximity devices embedded in several objects, and the owner may want to associate one or the other with the day or event, etc. The owner can easily do this by scanning the device that the owner wishes to associate, which will bring up a settings interface that allows him to change the association.

[0126] Additionally, at some point, the owner may want to sell or give away the carrier of the activation device 16, such as a bracelet, thereby also transferring ownership of the embedded pass activation device. The owner can also do this through the other modes available in the activation device settings. In "Open" mode, any registered user can scan the device and set it up as their own. In "Security Code" mode, any registered user can scan the device, provide the correct security code set by the previous owner, and then set it up as their own. In "Request Transfer" mode, any registered user can scan the device and request a transfer of ownership, and if the user does so, the current owner will be notified and can allow or deny.

[0127] Finally, an owner may lose, for example, a bracelet containing an embedded activation device, which is an activation point associated with a pass virtual device. In this case, the owner can mark the embedded activation device as lost. Marking the activation device as "lost" temporarily detaches it from the pass virtual device or application and associates it with a loop virtual device or application specifically designed to handle lost objects. Disassociating the activation device / proximity device will deactivate the pass virtual device. However, it will be reactivated as soon as the owner associates another compatible activation device with it. At the same time, the activation device in the lost bracelet is now associated with the newly created or existing lost object ring. When someone scans the lost activation device or the embedded activation device in a lost object associated with the lost object loop, the user can immediately see that the object has been marked as lost by its owner. In addition, the user can see a customized message from the owner and have one or more methods to contact the owner, as configured by the owner. For example, the scanner can initiate a chat, or request to speak with the owner, or the scanner can send an email for the owner.

[0128] Thus, the disclosed system and method provides an activation device 16 that is a secure NFC tag. As mentioned above, another type of activation point may include a QR code on a screen. The QR code encodes similar data contained in a secure NFC tag, but in the form of a secure token, such as a JSON Web Token.

[0129] Characters, Acquaintances, and Assumptions of Friends

[0130] A persona can be thought of as a persona that a person presents to others, or that is perceived by others, or that a person adopts for some purpose. It may represent a character that is completely real or believable, partly real and partly fictitious, or completely fictitious. An acquaintance can be thought of as a less intimate connection or contact than a friend, someone with whom a person may not know as well as a friend. An assumed friend may be thought of as someone that a person considers (or assumes) to be a friend, but unbeknownst to the person, the assumed friend considers their relationship to be more than just friendship.

[0131] As described below, the use of these concepts is described in a new and specific way that adds value to interactions that can be fully online or partly online and partly face-to-face.

[0132] In the context of online platforms for interaction between individuals and groups, it is common practice to include certain people in a contact list. These contacts are sometimes called relationships or friends and may include a person's real friends, family, muses, celebrities, and anyone else he or she wishes to be able to communicate with, follow his or her activities, etc.

[0133] The owner of a virtual device can associate the owner's real identity, as defined in the owner's account profile, with an application associated with the virtual device. The application can be associated with the owner's friends in the context of the service. The owner can create a variety of personas, which the author creates to interact with others to achieve specific goals. For example, a fictional cartoon character may be created for relaxed social interaction, while a person uses the author's real name and professional identity for professional interaction.

[0134] Each of the author's contacts can be associated with one or another of his roles. For example, some contacts can be associated with a social role. While other contacts can be connected to the author through a professional role.

[0135] The word "persona" often carries a negative connotation, sometimes referring to a false identity created to deceive others, or a false identity for someone with multiple personality disorder, etc. However, personas are also often used by professional writers, actors, singers, and other public figures for marketing purposes, as well as to keep their professional and personal lives compartmentalized. In the context of services, personas are used in several ways. First, personas can be used to maintain separate groups of contacts. For example, to separate one's professional relationships from personal relationships, or one group of friends from another group of friends, or one's family relationships from one's friends, etc. Second, personas can be used to maintain privacy. In the previous section, we introduced the Ring virtual device, which can be accessed through a contact point, and which allows anyone to establish a connection and communicate with the owner without the need or possession of their contact information. This device allows communication in the form of chat, voice and video calls, and email. In this case, the owner can choose to communicate with other parties through the persona. For example, in the context of Door Ring, the owner can create a persona called "Homeowner" to communicate with visitors at the door. The owner may be using a "Popeye" persona to chat with a street vendor who visits the owner through his Door Ring. Another use case for personas is similar to using a pseudonym in the real world, for example, a person might use a persona to write a blog.

[0136] Answering a door question with a persona or writing a blog post with an assumed identity does not require that the persona be connected to another person. In the context of the Service, users may be connected to other users through one of their personas or assumed identities. Such connections may be referred to as one's acquaintances. Such connections, i.e., acquaintances, may be limited to connections through one's persona or assumed identity. For example, in the context of the Service, users may not be allowed to connect with another person through a persona unless they have been in contact in person. This means that the two people have met or they have been to the same event and know someone in common, but do not necessarily know each other well enough to know their real identity.

[0137] One way for a user to meet someone is for the user to ask someone the user meets at a social gathering to scan the user's pass activation device. A user's "connected identity" setting can be configured for personas. For example, Jennifer may create a persona called Anna Sinclair, Error! Reference source not found. to connect with people she may meet at social events. She may use her real photo, just one that looks a little different than the one on her real profile to maintain enough authenticity. This allows her to separate the connections she has made as Anna Sinclair from the connections she has made as her real identity Jennifer and the connections she has made as other personas she may have created. In addition, this allows her to control her own security, privacy, and choices. If she disconnects a certain contact she has made as Anna Sinclair, that person will no longer be able to contact her because the Service may be configured so that the persona is not searchable. That person may not be able to find her on the Service without knowing her real identity; in addition, the Application may allow Jennifer to make her real identity non-searchable as well.

[0138] Another way to interact through personas is through an event that both people might attend, such as a mutual friend's wedding. This mutual friend has set up a gateway-activated device to create an online group within the service for social communication related to the physical event. The "gateway" can be another virtual device associated with an application, one of the functions of which is to create online groups of people connected through physical events. The people in the group so created do not need to be in each other's contact lists. They are considered related through the group representing the event they are both present at. People attending the event can join this online group by scanning the gateway-activated device at the event. They can join the group using their real identity or using a persona. If they join using a persona, then the others in the group will begin to identify them as that persona. Through the relationship of having attended the same event, these people can interact with each other through, for example, chat, which can identify them with the identity they used to join the group. This strategy limits abuse by requiring each participant to scan the gateway-activated device at the event, which ensures that they are actually present at the event, which in turn means that their real identity is likely to be known to at least someone at the event. In addition, if the host or group administrator senses abuse, they can remove anyone from the group.

[0139] Volatility

[0140] While the functionality of a virtual device may vary depending on who scans it (whether an individual, business, or other type of entity, the attributes and authorizations associated with the scanning point device or application, and the authorizations, permissions, and prerequisites set by the owner or administrator in the backend service), the example of a passport virtual device was given earlier, in which its functionality changes when scanned by an individual (establishing a connection, downloading a vCard) and when it is scanned by a health clinic (providing health insurance credentials, medical history, and a list of current medications), the term mutability can refer to more obvious changes, such as in the earlier cited example, where a bracelet embedded with a pass-activating device is lost, and once the owner marks it lost in the backend service settings associated with the embedded device - by changing its "mode" from "associated" to "lost", the pass-activating device becomes separated from the pass virtual device and associated with the lost item loop virtual device: the associated virtual device mutates from a pass virtual device to a loop virtual device. Below we give another example of mutability.

[0141] In various embodiments, the virtual device with which the activation device 16 is once associated can mutate at certain points in the life cycle of the carrier object. For example, an activation device, such as a secure multi-feature tag embedded in a piece of clothing, can first be associated with a virtual device that allows the manufacturer to track the object during production, quality control, packaging, etc. until the item is handed over to a distributor or warehouse, at which time the associated virtual device can mutate to serve the warehouse tracking and inventory process. Later, when the goods are transferred to retailers, the associated virtual device can mutate again to meet the needs of the retailer's tracking, inventory, and electronic article surveillance (EAS) or anti-theft functions. Finally, when the item is sold to the end customer, the associated device may mutate again to become the owner's loop device. Typical functions associated with tags on clothing include tracking, inventory, electronic article surveillance, and authenticity authentication. In addition, dual-frequency tags allow end consumers to interact with the tags by scanning the tags with a smartphone NFC reader.

[0142] Typically, when the end consumer's activation device 16 is set up, it can be configured to hide all identifying information, including its UID. For example, the NXP NTAG424DNA chip allows us to set a random ID, which displays a random ID instead of its real UID to anyone who scans it. To retrieve the chip's unique ID (UID), the encryption key used to hide it must be known; this key is securely stored in the backend service and is only used by authorized parties. At certain stages of the activation device lifecycle, it may be important not to hide the UID. For example, manufacturers, warehouses, and retailers may want to be able to track and inventory objects even if their systems are not connected to our backend service, or for simplicity and speed; or hiding the UID may not have any value to them. Therefore, in this case, the activation device 16 can be set to not hide its UID initially until it is sold to the end customer. The conversion to hide the UID can be done by the retailer at the point of sale, or after the consumer purchases it using a smartphone, for example, when associating a newly purchased item (embedded in the activation device) with the owner's loop virtual device.

[0143] As previously mentioned, if the owner sells the item in a second-hand transaction, ownership of the embedded activation device can be transferred to the new owner. However, if the item ends up in a second-hand store or charity inventory, the associated virtual device functionality can change again to serve the tracking, inventory and EAS functions required by the second-hand store or charity inventory warehouse.

[0144] The mutability of associated functions (virtual devices) and changes in ownership create new possibilities. For example, in the case of a women's designer handbag with a dual-frequency activation device embedded during the manufacturing process, the manufacturer can associate additional information about the object in the object's metadata and provenance (e.g., the manufacturer can associate it with the brand and designer of the object). As the ownership of such a handbag is transferred from the manufacturer to the distributor, retailer, consumer, second-hand store, consumer and then to recycling, the functions of the associated (virtual) mutable device change between one or more of tracking, inventory, EAS, cashier-less shopping, owner loop, recording end of life and environmental impact. In this way, if changes occur during the life cycle of the handbag, the application associated with the virtual device also changes. In addition, because the activation device is embedded with a globally unique ID, it is uniquely identifiable, and because the activation device is embedded at the time of manufacturing, the history of the object is recorded throughout its life cycle. This provenance provides functions such as interactions between parties in the life cycle of the object; for example, between the designer and the end user, between the brand and the end user, between the end user of the object instance or the user of the designer's object, and so on. Interactions can include contact and communication, sharing experiences, shopping, customer support, etc.

[0145] The examples discussed in this disclosure can be implemented using an NXP NTAG424DNA chip that uses AES-128 cryptography. These examples utilize only one of the many possible settings that the chip may have, which enables it to serve in an activation device 16 that can be used for services that have been created and may be created in the future. As previously described, this setting also enables the chip to provide a secure unique NDEF (SUN) message at each tap read, which includes the chip UID, a counter value that increments at each tap, a unique alphanumeric identifier that is only known to the backend service, all of which are obfuscated by encryption technology, and a message authentication code that verifies the integrity of the SUN message. The initial embodiment uses this setting so that the activation device embedded with this type of NFC device can be read by most smartphones on the market, and as much as possible, the services associated with these activation devices are available without the need to download an application. This also means that the end user does not need to write to the NFC chip embedded in the activation device, except occasionally. However, the present disclosure is not limited to the use of AES-128 cryptography, or to a specific setting for delivering a SUN message at each tap, or to not requiring the NFC chip to be written, or to any specific proximity device. Basically, in some cases, it may be desirable to hide the unique ID of the proximity device for privacy and security, as well as to prevent abuse. In addition, it may be desirable to use a hidden counter that increments at each tap readout to prevent another type of misuse, where tap data is used more than once, or it is used out of order. Furthermore, it may be desirable to use a hidden alphanumeric value that can be programmed before the activation device is delivered to the customer to verify the authenticity of the activation point and detect counterfeit devices that may be embedded into the ecosystem by malicious entities.

[0146] Thus, in other embodiments, other types of passwords and other types of settings may be used to identify the activation device 16, detect reuse or out-of-order use of data read from the activation device 16, verify the authenticity of the activation device, exclude counterfeit and tampered activation devices, enable additional functionality through the activation device, such as, but not limited to, writing to the device to store additional data that can be used in offline situations, including but not limited to asymmetric key cryptography, elliptic curve cryptography, and other mechanisms that can authenticate and / or establish a secure communication channel based on a combination of methods such as challenge-response protocols. These additional embodiments may also include such a setting in which some cryptographic keys are embedded in the secure element of the reader device to enable offline use of some or all functions associated with the activation device.

[0147] Fig.121 is a diagram illustrating an exemplary computing system 1200 according to an embodiment of the present technology. Portions of the systems and methods described herein may include or be executed on one or more computer systems similar to the computing system 1200. In addition, the processes and modules described herein may be executed by one or more processing systems similar to the computing system 1200. For example, the client computing device 14 / 300, the server computing device 12 / 200, or the activation device 16 may be provided by the computing system 1200.

[0148] The computing system 1200 may include one or more processors (e.g., processors 1210a-1210n) coupled to a system memory 1220, an input / output (I / O) device interface 1230, and a network interface 1240 via an input / output (I / O) interface 1250. The processor may include a single processor or multiple processors (e.g., distributed processors). The processor may be any suitable processor capable of executing or otherwise performing instructions. The processor may include a central processing unit (CPU) that executes program instructions to perform arithmetic, logic, and input / output operations of the computing system 1200. The processor may execute code (e.g., processor firmware, protocol stack, database management system, operating system, or a combination thereof) that creates an execution environment for program instructions. The processor may include a programmable processor. The processor may include a general-purpose or special-purpose microprocessor. The processor may receive instructions and data from a memory (e.g., system memory 1220). The computing system 1200 may be a single processor system including one processor (e.g., processor 1210a), or a multiprocessor system including any number of suitable processors (e.g., 1210a-1210n). Multiple processors may be employed to provide parallel or sequential execution of one or more portions of the techniques described herein. The processes described herein, such as logic flows, may be performed by one or more programmable processors that execute one or more computer programs to perform functions by operating on input data and generating corresponding outputs. The processes described herein may be performed by dedicated logic circuits, and the devices may also be implemented as dedicated logic circuits, such as FPGAs (field programmable gate arrays) or ASICs (application-specific integrated circuits). The computing system 1200 may include multiple computing devices (e.g., distributed computer systems) to implement various processing functions.

[0149] I / O device interface 1230 may provide an interface for connecting one or more I / O devices 1260 to computer system 1200. I / O devices may include devices that receive input (e.g., from a user) or output information (e.g., to a user). I / O devices 1260 may include, for example, a graphical user interface presented on a display (e.g., a cathode ray tube (CRT) or liquid crystal display (LCD) monitor), a pointing device (e.g., a computer mouse or trackball), a keyboard, a keypad, a touchpad, a scanning device, a voice recognition device, a gesture recognition device, a printer, an audio speaker, a microphone, a camera, etc. I / O devices 1260 may be connected to computer system 1200 via a wired or wireless connection. I / O devices 1260 may be connected to computer system 1200 from a remote location. For example, I / O devices 1260 located on a remote computer system may be connected to computer system 1200 via a network and network interface 1240.

[0150] The network interface 1240 may include a network adapter that provides connection of the computer system 1200 to a network. The network interface 1240 may facilitate data exchange between the computer system 1200 and other devices connected to the network. The network interface 1240 may support wired or wireless communications. The network may include an electronic communications network, such as the Internet, a local area network (LAN), a wide area network (WAN), a cellular communications network, etc.

[0151] System memory 1220 may be configured to store program instructions 1201 or data 1202. Program instructions 1201 may be executed by a processor (e.g., one or more processors 1210a-1210n) to implement one or more embodiments of the present technology. Instructions 1201 may include computer program instruction modules for implementing one or more techniques described herein for various processing modules. Program instructions may include computer programs (referred to as programs, software, software applications, scripts, or codes in some forms). Computer programs may be written in programming languages, including compiled or interpreted languages, or declarative or procedural languages. Computer programs may include units suitable for computing environments, including as independent programs, modules, components, or subroutines. Computer programs may or may not correspond to files in a file system. Programs may be stored in a portion of a file that holds other programs or data (e.g., one or more scripts stored in a markup language document), in a single file dedicated to the program in question, or in multiple collaborative files (e.g., files storing one or more modules, subroutines, or code portions). A computer program can be deployed to be executed on one or more computer processors located at one local site or distributed across multiple remote sites and interconnected by a communication network.

[0152] The system memory 1220 may include a tangible program carrier on which program instructions are stored. The tangible program carrier may include a non-transitory computer-readable storage medium. The non-transitory computer-readable storage medium may include a machine-readable storage device, a machine-readable storage substrate, a storage device, or any combination thereof. The non-transitory computer-readable storage medium may include a non-volatile memory (e.g., flash memory, ROM, PROM, EPROM, EEPROM memory), a volatile memory (e.g., a random access memory (RAM), a static random access memory (SRAM), a synchronous dynamic RAM (SDRAM)), a mass storage memory (e.g., a CD-ROM and / or DVD-ROM, a hard disk drive), etc. The system memory 1220 may include a non-transitory computer-readable storage medium on which program instructions executable by a computer processor (e.g., one or more of processors 1210a-processors 1210n) may be stored to implement the subject matter and functional operations described herein. The memory (e.g., system memory 1220) may include a single memory device and / or multiple memory devices (e.g., a distributed memory device). Instructions or other program codes that provide the functions described herein may be stored on a tangible, non-transitory computer-readable medium. In some cases, the entire instruction set may be stored on the medium at the same time, or in some cases, different portions of the instructions may be stored on the same medium at different times.

[0153] The I / O interface 1250 may be configured to coordinate I / O traffic between the processors 1210a-1210n, the system memory 1220, the network interface 1240, the I / O devices 1260, and / or other peripheral devices. The I / O interface 1250 may perform protocol, timing, or other data conversions to convert data signals from one component (e.g., the system memory 1220) into a format suitable for use by another component (e.g., the processors 1210a-1210n). The I / O interface 1250 may include support for devices connected via various types of peripheral buses, such as a variant of the Peripheral Component Interconnect (PCI) bus standard or the Universal Serial Bus (USB) standard.

[0154] Embodiments of the techniques described herein may be implemented using a single instance of computer system 1200 or multiple computer systems 1200 configured to host different portions or instances of the embodiments. Multiple computer systems 1200 may provide for parallel or sequential processing / execution of one or more portions of the techniques described herein.

[0155] Those skilled in the art will appreciate that computer system 1200 is merely illustrative and is not intended to limit the scope of the technology described herein. Computer system 1200 may include any combination of devices or software that can perform or otherwise provide the performance of the technology described herein. For example, computer system 1200 may include cloud computing systems, data centers, server chassis, servers, virtual servers, desktop computers, laptop computers, tablet computers, server devices, client devices, mobile phones, personal digital assistants (PDAs), mobile audio or video players, game consoles, on-board computers or global positioning systems (GPS), etc., or a combination thereof. Computer system 1200 may also be connected to other devices not shown, or may be run as an independent system. In addition, in some embodiments, the functions provided by the components shown may be combined in fewer components or distributed in additional components. Similarly, in some embodiments, the functions of some components shown may not be provided, or other additional functions may be available.

[0156] Those skilled in the art will also understand that, although various items are shown as being stored in memory or on a storage device when in use, for the purpose of memory management and data integrity, these items or a portion of them may be transmitted between memory and other storage devices. Alternatively, in other embodiments, some or all software components may be executed in a memory on another device and communicate with the computer system shown via inter-computer communication. Some or all system components or data structures may also be stored (e.g., as instructions or structured data) on a computer-accessible medium or portable article to be read by an appropriate drive, various examples of which are described above. In some embodiments, instructions stored on a computer-accessible medium separated from the computer system 1200 may be transmitted to the computer system 1200 via a transmission medium or signal, such as an electrical, electromagnetic or digital signal, transmitted via a communication medium such as a network or wireless link. Various embodiments may also include receiving, sending or storing instructions or data implemented according to the foregoing description on a computer-accessible medium. Therefore, the present technology may be practiced with other computer system configurations.

[0157] In the block diagram, the components shown are depicted as discrete functional blocks, but the embodiments are not limited to the system in which the functions described herein are organized as shown. The functions provided by each component may be provided by software or hardware modules that are organized differently from the present description, for example, such software or hardware may be mixed, combined, copied, decomposed, distributed (for example, within a data center or geographically), or otherwise organized differently. The functions described herein may be provided by one or more processors of one or more computers, which execute code stored on a tangible, non-transitory machine-readable medium. In some cases, although the singular term "medium" is used, the instructions may be distributed on different storage devices associated with different computing devices, for example, each computing device has a different subset of instructions, which is an implementation consistent with the use of the singular term "medium" herein. In some cases, a third-party content delivery network may host some or all of the information transmitted over the network, in which case, to the extent that the information (e.g., content) is considered to be provided or otherwise provided, the information may be provided by sending instructions to retrieve the information from the content delivery network.

[0158] The reader should understand that this application describes several independently useful technologies. Instead of separating these technologies into multiple independent patent applications, the applicant grouped these technologies into a single file because their related themes contribute to the economy in the application process. However, the different advantages and aspects of these technologies should not be lumped together. In some cases, the embodiments solve all the defects mentioned here, but it should be understood that these technologies are independently useful, and some embodiments only solve a subset of these problems or provide other unmentioned benefits, which are obvious to those skilled in the art who read this disclosure. Due to cost constraints, some of the technologies disclosed herein may not be claimed for protection at present, but may be claimed in later applications, such as continued applications or by amending the present claims. Similarly, due to space limitations, the abstract and overview of the invention section of this document should not be regarded as a comprehensive list containing all these technologies or all aspects of these technologies.

[0159] It should be understood that the description and the drawings are not intended to limit the present technology to the specific form disclosed, on the contrary, the present invention is intended to cover all modifications, equivalents and substitutes that fall within the spirit and scope of the present technology defined by the appended claims. In view of this description, further modifications and alternative embodiments of various aspects of the present technology will be obvious to those skilled in the art. Therefore, the description and the drawings are interpreted as illustrative only, and are intended to teach those skilled in the art to implement the general way of the present technology. It should be understood that the forms of the present technology shown and described here will be regarded as examples of embodiments. Elements and materials can replace those shown and described here, parts and processes can be reversed or omitted, and certain features of the present technology can be used independently, all of which are obvious to those skilled in the art who benefit from the description of the present technology. Without departing from the spirit and scope of the present technology described in the appended claims, changes can be made to the elements described here. The titles used here are only for organizational purposes and are not meant to limit the scope of the description.

[0160] As used throughout this application, the word "may" is used in a permissive sense (i.e., meaning likely), rather than a mandatory sense (i.e., meaning must). The words "include" and "comprises" and the like mean including, but not limited to. As used throughout this application, the singular forms "a", "an", and "the" include plural referents unless the context clearly indicates otherwise. Thus, for example, reference to "an element" includes a combination of two or more elements, even though other terms and phrases, such as "one or more", are used for one or more elements. Unless otherwise indicated, the term "or" is non-exclusive, i.e., includes "and" and "or" terms describing conditional relationships, such as, "in response to X, Y", "based on X, Y", "if X, Y", "when X, Y", etc., including causal relationships, where the antecedent is a necessary causal condition, the antecedent is a sufficient causal condition, or the antecedent is a contributing causal condition to the result, for example, "state X occurs when condition Y is obtained" is a genus of "X only occurs on Y" and "X occurs on Y and Z". This conditional relationship is not limited to the results obtained directly following the antecedent condition, because some results may be delayed, and in the conditional statement, the antecedent condition is related to its result, for example, the antecedent condition is related to the probability of the result occurring. Unless otherwise specified, a statement in which multiple attributes or functions are mapped to multiple objects (e.g., one or more processors perform steps A, B, C, and D) includes all of these attributes or functions being mapped to all of these objects, as well as subsets of attributes or functions being mapped to subsets of attributes or functions (e.g., all processors perform steps AD, and processor 1 performs step A, processor 2 performs step B and part of step C, and processor 3 performs step C and part of step D). Similarly, references to a "computer system" that performs step A and a "computer system" that performs step B may include the same computing device within a computer system that performs these two steps or different computing devices within a computer system that performs steps A and B. In addition, unless otherwise specified, a statement that a value or action is "based on" another condition or value includes both the case where the condition or value is the only factor and the case where the condition or value is one of multiple factors. Unless otherwise stated, a statement that "each" instance of a certain set has certain properties should not be read as excluding the case where certain identical or similar members of the larger set do not have that property, i.e., each does not necessarily mean every. Limitations on the order of steps should not be read as claims unless expressly stated, for example, using explicit language such as "after performing X, performing Y", as opposed to statements that might be improperly construed to imply an order limitation, such as "perform X on item, perform Y on item X", which is used for the purpose of making the claim more readable rather than to prescribe an order.Statements referring to "at least Z of A, B, and C," etc. (e.g., "at least Z of A, B, or C") refer to at least Z of the listed categories (A, B, and C), and do not require at least Z elements in each category. Unless otherwise stated, it will be apparent from the discussion that it should be understood that throughout the discussion of this specification, the use of terms such as "processing," "computing," "determining," etc. refers to the action or process of a specific device, such as a special purpose computer or similar special purpose electronic processing / computing device. Features described with reference to geometric configurations, such as "parallel," "perpendicular / orthogonal," "square," "cylindrical," etc., should be interpreted to include items that substantially embody the properties of the geometric configurations, for example, reference to "parallel" surfaces includes substantially parallel surfaces. Reference is made to the ranges in the specification to determine the permissible ranges of deviations from the Platonic ideal for these geometric configurations, to industry norms in the field of use if such ranges are not stated, to industry norms in the field of manufacture of the specified features if such ranges are not defined, and to features that substantially embody geometric configurations should be interpreted to include those features that are within 15% of the defined properties of the geometric configurations if such ranges are not defined. The terms "first", "second", "third", "given", etc., if used in the claims, are used to distinguish or otherwise identify, not to indicate order or numerical limitation. As is the case in ordinary usage in the art, data structures and formats described with reference to uses that are obvious to humans need not be presented in a human-understandable format to constitute the described data structures or formats, for example, text need not be presented or even encoded in Unicode or ASCII to constitute text; images, maps, and data visualizations need not be displayed or decoded to constitute images, maps, and data visualizations, respectively; speech, music, and other audio need not be emitted through speakers or decoded to constitute speech, music, or other audio, respectively. Computer-implemented instructions, commands, etc. are not limited to executable code, and may be implemented in the form of data that causes the function to be invoked, such as in the form of arguments to a function or API call. In the case where custom noun phrases (and other coined terms) are used in the claims and lack a self-explanatory structure, the definition of such phrases may be recited in the claims themselves, in which case the use of such custom noun phrases should not be considered to impart additional limitations by inspection of the specification or external evidence.

[0161] In this patent, any U.S. patent, U.S. patent application, or other material (e.g., article) is incorporated herein by reference, and the text of these materials is incorporated by reference only to the extent that there is no conflict between these materials and the statements and drawings described herein. In the event of such a conflict, the text of this document controls, and the terms in this document should not be given a narrower interpretation due to the way those terms are used in other materials incorporated by reference.

[0162] The present technology will be better understood with reference to the following examples:

[0163] 1. A non-transitory machine-readable medium storing instructions, which, when executed by one or more processors, implement the following operations: receiving, with a computer system, a first message generated in response to a first client computing device being associated with a first activation device, wherein the first message includes a first client computing device identifier associated with a first user of the first client computing device and a first activation device identifier of the first activation device; identifying, using the computer system and based on an association configuration and the first activation device identifier, a first virtual device associated with the first activation device; identifying, using the computer system and based on the first virtual device and the association configuration, a first application associated with the first virtual device; and, in response to the first message, running, using the computer system, the first application associated with the first virtual device.

[0164] 2. According to the medium described in embodiment 1, the operation also includes: receiving an instruction to associate a first virtual device with a second application program using a computer system; disassociating the first application from the first virtual device using the computer system by updating an association configuration; associating the computer system with the second application and the first virtual device; and running the second application using the computer system and in response to a second message received for the first virtual device.

[0165] 3. The medium of any one of embodiments 1-2, wherein the operations further comprise: utilizing the computer system and in response to running the first application, providing a first graphical user interface to the second client computing device.

[0166] 4. The medium of embodiment 3, wherein the second client computing device is associated with the owner of the first virtual device according to an association configuration.

[0167] 5. A medium according to any one of embodiments 1-4, wherein the operation further comprises: receiving an instruction to disassociate the first activation device from the first virtual device using a computer system; and disassociating the first activation device from the first virtual device by updating an association configuration, wherein if the client computing device is associated with the first activation device, the first virtual device is not identified in any received message.

[0168] 6. A medium according to embodiment 5, wherein the operation also includes: receiving a second instruction to associate the first activation device with the second virtual device using a computer system; associating the first activation device and the second virtual device with the computer system by updating an association configuration; and running a second application associated with the second virtual device according to the association configuration using the computer system and in response to any subsequent message received for the second virtual device that includes the first activation device identifier.

[0169] 7. The medium of embodiment 6, wherein the second application is different from the first application.

[0170] 8. The medium of embodiment 6, wherein the first virtual device is associated with a first owner, the second client computing device is associated with the first owner, and the second virtual device is associated with the second owner and a third client computing device associated with the second owner.

[0171] 9. A medium according to any one of embodiments 1-8, wherein the operation further comprises: receiving, by a computer system, a second message generated in response to a second client computing device being associated with a first activation device, wherein the second message comprises a second client computing device identifier associated with a second user of the second client computing device and a first activation device identifier of the first activation device; identifying, by the computer system and based on an association configuration and the first activation device identifier, a first virtual device associated with the first activation device; identifying, by the computer system and based on the first virtual device, the second client computing device identifier and the association configuration, a second application associated with the first virtual device; and, in response to the second message, running, by the computer system, the second application associated with the first virtual device.

[0172] 10. A medium according to any one of embodiments 1-9, wherein the operation further comprises: receiving, by a computer system, a second message generated in response to a second client computing device being associated with a first activation device, wherein the second message comprises a second client computing device identifier associated with a second user of the second client computing device and a first activation device identifier of the first activation device; identifying, by the computer system and based on an association configuration, the first activation device identifier, and the second client computing device identifier, a second virtual device associated with the first activation device; identifying, by the computer system and based on the second virtual device and the association configuration, a second application associated with the second virtual device; and, in response to the second message, running, by the computer system, the second application associated with the first virtual device.

[0173] 11. The medium of any of embodiments 1-10, wherein the first activation device is embedded in the object.

[0174] 12. The medium of any of embodiments 1-11, wherein the first activation device is removable from an object to which it is coupled.

[0175] 13. The medium of any one of embodiments 1-12, wherein the first activation device is a virtual activation device presented as a virtual object in an augmented reality or virtual reality environment.

[0176] 14. The medium of any one of embodiments 1-13, wherein the first activation device is a physical activation device comprising at least one of a radio frequency identification (RFID) tag, a near field communication (NFC) tag, a Bluetooth low energy (BLE) beacon, a dual frequency tag, or an ultra wideband (UWB) device.

[0177] 15. The medium of any one of embodiments 1-14, wherein the first message comprises a Secure Unique NFC Data Exchange Format (NDEF) (SUN) message.

[0178] 16. The medium of any one of embodiments 1-15, wherein the first message includes location information of the first client computing device, and wherein the execution of the first application is further responsive to the location information satisfying a location condition.

[0179] 17. The medium of any one of embodiments 1-16, wherein in the associated configuration, the first activation device and the first virtual device are associated with a second user who is an owner of the first activation device and the first virtual device.

[0180] 18. A medium according to embodiment 17, wherein the operation also includes: receiving a request to change ownership of a first activation device with a computer system; disassociating the first activation device from a first virtual device in an association configuration with the computer system; and associating the first activation device with a second virtual device associated with a second user with the computer system.

[0181] 19. The medium of any of embodiments 1-18, wherein the operations further comprise steps for authenticating the first activation device.

[0182] 20. A method comprising: the operation of any one of embodiments 1-19.

[0183] 21. A system, comprising: one or more processors; and a memory storing instructions, which, when executed by the processor, enables the processor to perform operations, including: the operations of any one of embodiments 1-19.

Claims

1. A non-transitory machine-readable medium storing instructions that, when executed by one or more processors, implement operations comprising: receiving, with a computer system, a first message generated in response to a first client computing device being associated with a first activation device, wherein the first message includes a first client computing device identifier associated with a first user of the first client computing device and a first activation device identifier of the first activation device; identifying, with the computer system and based on an association configuration and the first activation device identifier, a first virtual device associated with the first activation device; identifying, using the computer system and based on the first virtual device and the associated configuration, a first application associated with the first virtual device; and A first application associated with the first virtual device is executed using the computer system in response to the first message.

2. The medium according to claim 1, wherein The operations also include: receiving, using the computer system, an instruction to associate the first virtual device with a second application; disassociating the first application from the first virtual device using a computer system by updating an association configuration; associating the computer system with the second application and the first virtual device; and The second application is executed using the computer system and in response to receiving a second message for the first virtual device.

3. The medium according to claim 1, wherein The operations also include: Utilizing the computer system and in response to executing the first application, a first graphical user interface is provided to a second client computing device.

4. The medium of claim 3, wherein: According to the association configuration, a second client computing device is associated with the owner of the first virtual device.

5. The medium according to claim 1, wherein The operations also include: receiving, using the computer system, an instruction to disassociate the first activation device from the first virtual device; and The first activation device is disassociated from the first virtual device using the computer system by updating the association configuration, wherein the first virtual device is not identified in any messages received if a client computing device is associated with the first activation device.

6. The medium according to claim 5, wherein The operations also include: receiving, using the computer system, a second instruction to associate the first activation device with a second virtual device; Associating the first activation device with the second virtual device using the computer system by updating the association configuration; and A second application associated with the second virtual device according to the association configuration is executed, utilizing the computer system and in response to any subsequent message received for the second virtual device that includes the first activation device identifier.

7. The medium according to claim 6, wherein: The second application is different from the first application.

8. The medium according to claim 6, wherein A first virtual device is associated with a first owner, a second client computing device is associated with the first owner, the second virtual device is associated with a second owner, and a third client computing device is associated with the second owner.

9. The medium according to claim 1, wherein The operations also include: receiving, with the computer system, a second message generated in response to a second client computing device being associated with the first activation device, wherein the second message includes a second client computing device identifier associated with a second user of the second client computing device and the first activation device identifier of the first activation device; identifying, using the computer system and based on an association configuration and the first activation device identifier, the first virtual device associated with the first activation device; identifying, using the computer system and based on the first virtual device, the second client computing device identifier, and the association configuration, a second application associated with the first virtual device; and In response to the second message, the second application associated with the first virtual device is executed using a computer system.

10. The medium according to claim 1, wherein The operations also include: receiving, with the computer system, a second message generated in response to a second client computing device being associated with the first activation device, wherein the second message includes a second client computing device identifier associated with a second user of the second client computing device and the first activation device identifier of the first activation device; identifying, using a computer system and based on an association configuration, the first activation device identifier, and the second client computing device identifier, a second virtual device associated with the first activation device; identifying, using the computer system and based on the second virtual device and the associated configuration, a second application associated with the second virtual device; and In response to the second message, the second application associated with the first virtual device is executed using the computer system.

11. The medium according to claim 1, wherein The first activation device is embedded in the object.

12. The medium according to claim 1, wherein The first activation device is removable from an object to which it is coupled.

13. The medium according to claim 1, wherein The first activation device is a virtual activation device, which is presented as a virtual object in an augmented reality or virtual reality environment.

14. The medium according to claim 1, wherein The first activation device is a physical activation device that includes at least one of a radio frequency identification (RFID) tag, a near field communication (NFC) tag, a Bluetooth low energy (BLE) beacon, a dual frequency tag, or an ultra wideband (UWB) device.

15. The medium according to claim 1, wherein The first message comprises a Secure Unique NFC Data Exchange Format (NDEF) (SUN) message.

16. The medium according to claim 1, wherein The first message includes location information of the first client computing device, and wherein the execution of the first application is further responsive to the location information satisfying a location condition.

17. The medium according to claim 1, wherein In the associated configuration, the first activation device and the first virtual device are associated with a second user who is an owner of the first activation device and the first virtual device.

18. The medium according to claim 17, wherein: The operations also include: receiving, using the computer system, a request to change ownership of the first activation device; disassociating, using the computer system, the first activation device from the first virtual device in the association configuration; and The first activation device is associated, using the computer system, with a second virtual device associated with the second user.

19. The medium according to claim 1, wherein: The operations also include a step for authenticating the first activation device.

20. A method comprising: receiving, with a computer system, a first message generated in response to a first client computing device being associated with a first activation device, wherein the first message includes a first client computing device identifier associated with a first user of the first client computing device and a first activation device identifier of the first activation device; identifying, with the computer system and based on an association configuration and the first activation device identifier, a first virtual device associated with the first activation device; identifying, utilizing the computer system and based on the first virtual device and the associated configuration, a first application associated with the first virtual device; and In response to the first message, the first application associated with the first virtual device is executed using a computer system.

Images