Security for augmented reality (AR) systems

Abstract

The augmented reality (AR) system includes a display, a camera device, and a secure data vault system. The secure data vault system includes a sandbox system operatively coupled to the camera device and configured to receive camera device data from the camera device, wherein, during operation of the AR system, the camera device only sends camera device data to the sandbox system, and wherein the sandbox system includes an execution environment configured to restrict the execution of instructions to a predefined memory address range. The secure data vault system also includes a display and rendering system operatively coupled to the sandbox system and configured to render images based on camera device data processed via instructions and display the images via the display, wherein the display is configured to display both the images and the real-world environment surrounding the AR system.

Description

Priority Statement

[0001] This patent application claims the benefit of priority to U.S. Application Serial No. 18 / 496,080, filed on October 27, 2023, the entire contents of which are incorporated herein by reference. Background Technology

[0002] Augmented reality (AR) systems include camera systems capable of capturing various electronic images and videos, such as cameras mounted on mobile devices. Image and video capture is becoming increasingly popular. Image and video capture is used to provide AR visualizations. Additionally, users are increasingly sharing media content items such as electronic images and videos with each other. Users are also increasingly utilizing their mobile devices to communicate with each other using messaging apps. Attached Figure Description

[0003] In accompanying drawings that are not necessarily drawn to scale, similar reference numerals can describe similar parts in different views. To facilitate identification of any discussion of a particular element or action, one or more of the highest-order digits in the reference numerals indicate the drawing number in which that element was first introduced. Some non-limiting examples are shown in the accompanying drawings:

[0004] Figure 1 It is a diagrammatic representation of a networked environment in which the content of this disclosure can be deployed, based on some examples.

[0005] Figure 2 This is a block diagram illustrating further details about an interactive system based on some examples.

[0006] Figure 3 It is a graphical representation of a messaging system with both client-side and server-side functionalities, based on some examples.

[0007] Figure 4 It is a graphical representation based on examples such as data structures maintained in a database.

[0008] Figure 5 It is a graphical representation based on some example messages.

[0009] Figure 6 An AR system including a head-mounted wearable device is shown, based on some examples.

[0010] Figure 7 The diagram illustrates, based on some examples, the processing suitable for using a secure data vault system.

[0011] Figure 8 It is a graphical representation of a machine in the form of a computer system, based on some examples, within which a set of instructions can be executed to enable the machine to perform any or more of the methods discussed herein.

[0012] Figure 9 It is a block diagram showing a software architecture in which examples can be implemented. Detailed Implementation

[0013] Camera systems and microphones are included in a variety of devices such as mobile devices, smartwatches, drones, etc. These systems enable users to capture images and videos and communicatively and / or operatively couple to applications such as interactive clients. In some examples, the interactive client allows users to capture media content while using it and apply augmented reality (AR) photography filters and / or virtual lenses to the media content. The resulting media content is then used to interact with other users, such as members of a group, by sending the media to other users via messages, who can then respond with their own media content.

[0014] Augmented reality (AR) experiences involve applying virtual content to a real-world environment, whether by presenting the virtual content through a transparent display visible through its real-world environment, or by augmenting image data to include virtual content overlaid on the real-world environment depicted in the image data. Virtual content may include one or more AR content items. AR content items may include audio content, visual content, or visual effects. Devices that support AR experiences using any of these methods are referred to herein as “AR devices.” Devices that include virtual reality (VR) content are referred to herein as “VR devices.”

[0015] The techniques described herein provide a secure data vault system. A secure data vault system is an isolated and secure environment within an operating system (OS), such as AR OS. The secure data vault system remains separate from user applications while allowing users / creators to maintain control over their data. The secure data vault system includes a "sandbox" that allows users to perform certain computations on raw and computed data within the sandbox. Raw data includes data from camera devices, microphones, and other sensors. Raw data is shared with the secure data vault system via privileged areas of the OS, enabling the secure data vault system to manage the use of raw data. Computed data is data generated from the raw data or data generated without using camera devices, microphones, and other sensors. Raw data is stored within the secure data vault system, while computed data is allowed to leave the secure data vault system under certain policy mandates, as further described below.

[0016] In some examples, a secure data vault system is part of the operating system but includes hardware components for providing isolation and trust. The secure data vault system also enables machine learning and AI models that process raw data as input. For example, some AI models are trained to take raw data as input and then output AR “tokens,” such as virtual content suitable for overlaying real-world images. By providing a secure data vault system, the techniques described in this paper improve reliability, security, and minimize attack vectors.

[0017] Networked computing environment

[0018] Figure 1 This is a block diagram illustrating an example interactive system 100 for facilitating interactions on a network, such as exchanging text messages, making text audio and video calls, or playing games. Interactive system 100 includes multiple user systems 102, each of which hosts multiple applications including an interactive client 104 and other applications 106. Each interactive client 104 is communicatively coupled to other instances of the interactive client 104 (e.g., hosted on corresponding other user systems 102), an interactive server system 110, and a third-party server 112 via one or more communication networks including a network 108 (e.g., the Internet). The interactive client 104 may also communicate with the locally hosted applications 106 using an application programming interface (API).

[0019] Each user system 102 may include multiple user devices, such as mobile devices 114, head-mounted wearable devices 116, and computer client devices 118, which are communicatively connected to exchange data and messages.

[0020] Interactive client 104 interacts with other interactive clients 104 and with interactive server system 110 via network 108. The data exchanged between interactive clients 104 (e.g., interaction 120) and between interactive client 104 and interactive server system 110 includes functions (e.g., commands for activating functions) and payload data (e.g., text, audio, video, or other multimedia data).

[0021] Interactive server system 110 provides server-side functionality to interactive client 104 via network 108. While some functions of interactive system 100 are described herein as being performed by interactive client 104 or interactive server system 110, the location of certain functions—whether within interactive client 104 or interactive server system 110—may be a design choice. For example, it might be technically preferred that specific technologies and functions are initially deployed within interactive server system 110, but later migrated to interactive client 104 of user system 102 with sufficient processing power.

[0022] The interactive server system 110 supports various services and operations provided to the interactive client 104. Such operations include sending data to and receiving data from the interactive client 104, and processing data generated by the interactive client 104. This data may include message content, client device information, geolocation information, media enhancements and overlays, message content persistence conditions, entity relationship information, and live event information. Data exchange within the interactive system 100 is activated and controlled via functions available through the user interface (UI) of the interactive client 104.

[0023] Specifically, the focus now shifts to interactive server system 110. Application Programming Interface (API) server 122 is coupled to interactive server 124 and provides it with a programming interface, making the functionality of interactive server 124 accessible to interactive client 104, other applications 106, and third-party server 112. Interactive server 124 is communicatively coupled to database server 126, thereby facilitating access to database 128, which stores data associated with the interactions processed by interactive server 124. Similarly, web server 130 is coupled to interactive server 124 and provides a web-based interface to interactive server 124. For this purpose, web server 130 handles incoming network requests via Hypertext Transfer Protocol (HTTP) and several other related protocols.

[0024] Application Programming Interface (API) server 122 receives and sends interactive data (e.g., command and message payloads) between interactive server 124 and user system 102 (as well as interactive client 104 and other applications 106) and third-party server 112. Specifically, API server 122 provides a set of interfaces (e.g., routines and protocols) that interactive client 104 and other applications 106 can invoke or query to activate the functionality of interactive server 124. Application Programming Interface (API) server 122 exposes various functions supported by interaction server 124, including account registration; login functionality; sending interactive data from one interaction client 104 to another interaction client 104 via interaction server 124; transferring media files (e.g., images or videos) from interaction client 104 to interaction server 124; setting up a collection of media data (e.g., stories); retrieving a user's friend list for user system 102; retrieving messages and content; adding and deleting entities (e.g., friends) against an entity relationship graph (e.g., entity graph 410); locating friends in the entity relationship graph; and opening (e.g., application events associated with interaction client 104).

[0025] Also shown is a secure data vault system 132 suitable for processing raw data from devices 114, 116, and 118. As mentioned earlier, the raw data includes data generated via camera devices, microphones, and / or other sensors included in devices 114, 116, and 118, such as gyroscopes, navigation systems (e.g., GPS, inertial navigation systems), temperature sensors, etc. In some examples, the raw data is processed only via the secure data vault system 132, thereby providing data isolation and security.

[0026] In fact, the secure data vault system is an isolated and secure environment within an operating system (OS) (such as an AR OS). The secure data vault system remains separate from application 106 while allowing users / creators to maintain control over their data. In some examples, the secure data vault system is part of the OS but includes hardware components for providing isolation and trust, as described further below. The secure data vault system also enables the local execution of machine learning and AI models that use raw data as input. That is, certain AI models are trained to take raw data as input and then output AR “tags,” such as virtual content suitable for overlaying real-world images. These AI models are executed locally only by the secure data vault system 132 within the corresponding devices 114, 116, 118, and not on external systems such as external servers or cloud-based systems.

[0027] Figure 2 This is a block diagram illustrating further details of an example of a secure data vault system 132, based on some examples. In the depicted examples, the secure data vault system 132 includes an application programming interface (API) 202, which developers use to interface with and perform certain functions of the secure data vault system 132. In some examples, APIs provided by developers, such as the depicted public developer API 204, are used to interface with the secure data vault system 132 via API 202.

[0028] API 202 includes function calls, methods, object-oriented classes, etc., that can execute certain functionalities provided by the secure data vault system 132. In some examples, API 202 may include certain security features, such as authenticating developer use of API 202 by receiving security tokens, login / password combinations, challenge / response authentication, secure handshake authentication, etc. Once the session is authenticated, the secure data vault system 132 can receive raw data via privileged access OS API 206. More specifically, privileged access OS API 206 is used solely by the secure data vault system 132 and not by any other system to receive raw data.

[0029] As mentioned above, the raw data includes camera device data, microphone data, and / or sensor data from various sensors included in devices such as devices 114, 116, and 118 (e.g., AR devices). In some examples, the OS is also granted access to the raw data, for example, to test the camera device, microphone, and / or other sensors, to calibrate the camera device, microphone, and / or other sensors, etc. By isolating the raw data when using the camera device, microphone, and / or other sensors so that it is processed only via the secure data vault system 132, the techniques described herein improve security and enhance privacy. For example, a user of device 114, 116, or 118 might be enjoying a shared AR experience and inadvertently glance at her driver's license placed on a table surface. The secure data vault system 132 would detect that the camera device data includes a driver's license via an AI model 208 executable via execution environment 212, and then blur the camera device data so that the details of the driver's license are not visible in the shared AR experience. Similarly, the microphone can pick up certain conversations and / or sounds, and then the AI ​​model 208 will detect these conversations and / or sounds and blur them, for example by muting the conversations and / or sounds or by adding noise.

[0030] Execution environment 212 is included within sandbox system 210. The sandbox environment provides additional isolation and security. For example, sandbox system 210 ensures that any actions performed within it remain isolated from the rest of the system, thus preventing potential harm from malware or unintended consequences from the code. In some examples, execution environment 212 restricts the execution of instructions or code to a predefined memory range (e.g., a start memory address and an end memory address). By isolating applications or code, sandbox system 210 reduces the risk of security vulnerabilities such as buffer overflows or privilege escalation affecting the entire system. If a program within sandbox system 210 behaves erratically or becomes unresponsive, the program can be terminated without affecting the rest of the system. Sandbox system 210 may additionally utilize virtualization techniques to create completely independent virtual machines (VMs) or containers to host the isolated execution environment 212. In some examples, sandbox system 210 is a separate hardware system. For example, field-programmable gate arrays (FPGAs), separate microprocessors, custom circuit systems, etc., may be provided as part of devices 114, 116, 118 and used as sandbox system 210. Therefore, for example, by minimizing the exposure to code that may be maliciously modified, the attack vector is minimized.

[0031] The secure data vault system 132 imposes constraints on data sharing both on-device and off-device (network). In some examples, the secure data vault system 132 may communicate only with a trusted set of features. A list of permitted processes / features can be placed in a security compatibility matrix 214. For example, columns in the security compatibility matrix 214 list the various functions provided by the secure data vault system 132, and rows in the security compatibility matrix 214 list the processes that have access to these functions. Therefore, a process can invoke API 202 and request the execution of a specific function, and can then check the security compatibility matrix 214 to verify that the process is permitted to execute that function.

[0032] The secure network service 216 included in the secure data vault system 132 is also illustrated. The secure network service 216 is used to communicate with external systems to update the AI ​​model 208, the execution environment 212, and / or the security compatibility matrix 214. The secure network service 216 may use technologies such as Transport Layer Security (TLS) in Hypertext Transfer Protocol Security (HTTPS) download-only mode. That is, in some examples, the secure network service 216 may be used solely for downloading information. Authentication of downloads via the secure network service 216 may be provided via challenge / response hardware technologies (e.g., via a hardware security token device that provides multi-factor authentication), the use of keys, time-slot downloads (e.g., downloads occur only at a given time of day), etc.

[0033] Display and rendering system 218 is also included in secure data vault system 132, suitable for dynamically creating and displaying 3D representations, for example, as an overlay on a real-time view of the surroundings provided by a camera device. Sound can also be provided via display and rendering system 218. Display and rendering system 218 additionally includes security features, such as using AI model 208 to detect images and / or sounds that may have been found to be private and to blur them. As mentioned earlier, certain documents (e.g., driver's licenses, credit cards, social security cards, passports) may have been viewed during an AR session. AI model 208 can detect the presence of private information and collaborate with display and rendering system 218 to blur images and / or mute them, thereby protecting privacy. In some examples, display and rendering system 218 may also provide the user with notification of the presence of private information. By providing isolated, secure, and local execution via sandbox system 210, secure data vault system 132 improves privacy and user security in various AR systems.

[0034] System Framework

[0035] Figure 3This is a block diagram illustrating further details of an interactive system 100 according to some examples. Specifically, the interactive system 100 is shown to include an interactive client 104 and an interactive server 124. The interactive system 100 includes multiple subsystems supported on the client side by the interactive client 104 and on the server side by the interactive server 124. In some examples, these subsystems are implemented as microservices. A microservice subsystem (e.g., a microservice application) may have components that enable it to operate independently and communicate with other services. Example components of a microservice subsystem may include: Functional logic: Functional logic implements the functions of the microservice subsystem and represents the specific capabilities or functions provided by the microservice. API Interface: Microservices can use lightweight protocols such as REST or messaging to communicate with other components through well-defined APIs or interfaces. The API interface defines the input and output of the microservice subsystem, as well as the way the microservice subsystem interacts with other microservice subsystems of the interactive system 100. Data storage device: The microservice subsystem can be responsible for its own data storage device, which can be in the form of a database, cache, or other storage mechanism (e.g., using database server 126 and database 128). This allows the microservice subsystem to operate independently of other microservices in the interactive system 100. Service discovery: Microservice subsystems can find other microservice subsystems in the interactive system 100 and communicate with them. The service discovery mechanism enables microservice subsystems to locate and communicate with other microservice subsystems in a scalable and efficient manner. Monitoring and logging: Microservice subsystems may need to be monitored and logged to ensure availability and performance. Monitoring and logging mechanisms enable the tracking of the health and performance of microservice subsystems.

[0036] In some examples, the interactive system 100 may adopt a monolithic architecture, a service-oriented architecture (SOA), a function-as-a-service (FaaS) architecture, or a modular architecture.

[0037] The example subsystem is discussed below.

[0038] The image processing system 302 provides various functions that enable users to capture and enhance (e.g., annotate or otherwise modify or edit) media content associated with a message.

[0039] The camera device system 304 includes (e.g., in a camera device application) control software that (e.g., directly or via operating system controls) interacts with and controls the hardware camera device hardware of the user system 102 to modify and enhance real-time images captured and displayed via the interactive client 104.

[0040] Enhancement system 306 provides functionality related to the generation and distribution of enhancements (e.g., media overlays) for images captured in real-time by the camera device of user system 102 or retrieved from the memory of user system 102. For example, enhancement system 306 is operable to select, present, and display media overlays (e.g., image filters or image lenses) for interactive client 104 to enhance real-time images received via camera device system 304 or stored images retrieved from memory 602 of user system 102. These enhancements are selected and presented to the user of interactive client 104 by enhancement system 306 based on a plurality of inputs and data, such as: The geographical location of user system 102; and User entity relationship information of users in user system 102.

[0041] Enhancements may include audio and visual content and visual effects. Examples of audio and visual content include images, text, logos, animations, and sound effects. Examples of visual effects include color overlays. Audio and visual content or visual effects may be applied to media content items (e.g., photos or videos) at user system 102 for transmission in messages, or to video content such as video content streams or feeds sent from interactive client 104. Therefore, image processing system 302 can interact with and support various subsystems of communication system 308, such as messaging system 310 and video communication system 312.

[0042] Media overlays may include text or image data that can be superimposed on photographs taken by user system 102 or video streams produced by user system 102. In some examples, media overlays may be location overlays (e.g., Venice Beach), names of on-site events, or names of businesses (e.g., beach cafes). In other examples, image processing system 302 uses the geographic location of user system 102 to identify media overlays that include the names of businesses located at the geographic location of user system 102. Media overlays may include additional tags associated with businesses. Media overlays may be stored in database 128 and accessed through database server 126.

[0043] Image processing system 302 provides a user-based publishing platform that allows users to select geographical locations on a map and upload content associated with those locations. Users can also specify which media overlays should be provided to other users. Image processing system 302 generates a media overlay that includes the uploaded content and associates it with the selected geographical location.

[0044] The augmented creation system 314 supports augmented reality developer platforms and includes applications for content creators (e.g., artists and developers) to create and publish augmented reality experiences (e.g., augmented reality experiences) on interactive clients 104. The augmented creation system 314 provides content creators with a library of built-in features and tools, including, for example, custom shaders, tracking technologies, and templates.

[0045] In some examples, the enhancement creation system 314 provides a merchant-based publishing platform that allows merchants to select specific enhancements associated with geographic locations via a bidding process. For instance, the enhancement creation system 314 associates the media overlay of the highest-bidding merchant with a corresponding geographic location for a predefined amount of time.

[0046] Communication system 308 is responsible for implementing and processing various forms of communication and interaction within interactive system 100, and includes message sending and receiving system 310, audio communication system 316, and video communication system 312. Message sending and receiving system 310 is responsible for enabling temporary or time-limited access to content by interactive client 104. Message sending and receiving system 310 includes (e.g., within a short-duration timer system) multiple timers that selectively enable access (e.g., for presentation and display) of messages and associated content via interactive client 104 based on duration and display parameters associated with a message or set of messages (e.g., a story). Audio communication system 316 implements and supports audio communication (e.g., real-time audio chat) between multiple interactive clients 104. Similarly, video communication system 312 implements and supports video communication (e.g., real-time video chat) between multiple interactive clients 104.

[0047] The user management system 318 is operationally responsible for managing user data and profiles, and maintaining entity information about the relationship between users and users of the interaction system 100 (e.g., stored in entity table 408, entity diagram 410, and profile data 402).

[0048] The collection management system 320 is operationally responsible for managing groups or collections of media (e.g., collections of text, image, video, and audio data). Collections of content (e.g., messages, including images, videos, text, and audio) can be organized into "event galleries" or "event stories." Such collections can be made available for a specified time period (e.g., the duration of an event related to the content). For example, content related to a concert can be made available as a "story" for the duration of the concert. The collection management system 320 is also responsible for publishing icons to the user interface of the interactive client 104, which provide notifications for specific collections. The collection management system 320 includes curation functions that enable collection managers to manage and curate specific content collections. For example, a curation interface allows event organizers to curate collections of content related to a specific event (e.g., removing inappropriate content or redundant messages). Additionally, the collection management system 320 employs machine vision (or image recognition technology) and content rules to automatically curate content collections. In some examples, users may be paid to include user-generated content in the collection. In such a situation, the collection management system 320 operates to automatically pay such users for access to its content.

[0049] Map system 322 provides various geographic location (e.g., geolocation) functions and supports the presentation of map-based media content and messages via interactive client 104. For example, map system 322 enables the display (e.g., stored in profile data 402) of user icons or avatars on the map to indicate the current or past locations of the user's "friends" within the context of the map, as well as media content generated by such friends (e.g., a collection of messages including photos and videos). For example, on the map interface of interactive client 104, a message posted by a user from a specific geographic location to interactive system 100 can be displayed to the specific user's "friends" at that specific location within the context of the map. The user can also share his or her location and status information with other users of interactive system 100 via interactive client 104 (e.g., using an appropriate status avatar), where the location and status information is similarly displayed to the selected user within the context of the map interface of interactive client 104.

[0050] Game system 324 provides various game functions within the context of interactive client 104. Interactive client 104 provides a game interface that offers a list of available games that a user can launch and play with other users of interactive system 100 within the context of interactive client 104. Interactive system 100 also enables specific users to invite other users to play specific games by sending invitations from interactive client 104. Interactive client 104 also supports sending and receiving audio, video, and text messages (e.g., chat) within the context of playing the game, provides leaderboards for the game, and also supports providing in-game rewards (e.g., game currency and items).

[0051] External resource system 326 provides interactive client 104 with an interface to communicate with remote servers (e.g., third-party server 112) to launch or access external resources (i.e., applications or applets). Each third-party server 112 hosts applications or smaller versions of applications (e.g., game applications, utility applications, payment applications, or ride-sharing applications) based on markup languages ​​(e.g., HTML5). Interactive client 104 can launch web-based resources (e.g., applications) by accessing HTML5 files from the third-party server 112 associated with the web-based resource. The application hosted by the third-party server 112 is programmed in JavaScript using a software development kit (SDK) provided by interactive server 124. The SDK includes an application programming interface (API) with functionality that can be invoked or activated by the web-based application. Interactive server 124 hosts a JavaScript library that provides access to a given external resource for specific user data of interactive client 104. HTML5 is an example of a technology used for programming games, but applications and resources programmed using other technologies can be used.

[0052] To integrate the SDK's functionality into the web-based resource, the third-party server 112 downloads the SDK from the interactive server 124, or the third-party server 112 otherwise receives the SDK. Once downloaded or received, the SDK is included as part of the application code of the web-based external resource. The code of the web-based resource can then call or activate certain functions of the SDK to integrate the features of the interactive client 104 into the web-based resource.

[0053] The SDK stored on the interactive server system 110 effectively bridges the gap between external resources (e.g., application 106 or applet) and the interactive client 104. This provides users with a seamless experience of communicating with other users on the interactive client 104 while preserving the look and feel of the interactive client 104. To bridge communication between the external resources and the interactive client 104, the SDK facilitates communication between the third-party server 112 and the interactive client 104. A bridging script running on the user system 102 establishes two unidirectional communication channels between the external resources and the interactive client 104. Messages are sent asynchronously between the external resources and the interactive client 104 via these communication channels. Each SDK function activation is sent as a message and a callback. Each SDK function is implemented by constructing a unique callback identifier and sending a message with that callback identifier.

[0054] By using the SDK, not all information from the interactive client 104 is shared with the third-party server 112. The SDK limits which information is shared based on the needs of the external resources. Each third-party server 112 provides the interactive server 124 with an HTML5 file corresponding to the web-based external resource. The interactive server 124 can add a visual representation (e.g., box design or other graphics) of the web-based external resource to the interactive client 104. Once the user selects the visual representation or instructs the interactive client 104 to access the features of the web-based external resource through the interactive client 104's GUI, the interactive client 104 obtains the HTML5 file and instantiates the resource used to access the features of the web-based external resource.

[0055] Interactive client 104 presents a graphical user interface (GUI) for an external resource (e.g., a login page or title screen). During, before, or after presenting the login page or title screen, interactive client 104 determines whether the initiated external resource has previously been authorized to access the user data of interactive client 104. In response to determining that the initiated external resource has previously been authorized to access the user data of interactive client 104, interactive client 104 presents another GUI of the external resource, including its functionality and characteristics. In response to determining that the initiated external resource has not previously been authorized to access the user data of interactive client 104, after displaying the login page or title screen of the external resource for a threshold time period (e.g., 3 seconds), interactive client 104 slides up a menu (e.g., animates the menu to appear from the bottom of the screen to the middle or other parts of the screen) to authorize the external resource to access the user data. This menu identifies the type of user data that the external resource will be authorized to use. In response to receiving a user selection of the accept option, interactive client 104 adds the external resource to the list of authorized external resources and allows the external resource to access the user data from interactive client 104. External resources are authorized by the interactive client 104 to access user data under the OAuth 2 framework.

[0056] Interactive client 104 controls the type of user data shared with external resources based on the type of authorized external resource. For example, it provides access to a first type of user data (e.g., a two-dimensional avatar of a user with or without different avatar characteristics) to external resources including full-scale applications (e.g., application 106). As another example, it provides access to a second type of user data (e.g., payment information, a user's two-dimensional avatar, a user's three-dimensional avatar, and avatars with various avatar characteristics) to external resources including smaller versions of the application (e.g., a web-based version of the application). Avatar characteristics include different ways of customizing the appearance and feel of an avatar (e.g., different poses, facial features, clothing, etc.).

[0057] The advertising system 328 enables third parties to purchase advertisements to be presented to end users via the interactive client 104, and also handles the delivery and presentation of these advertisements.

[0058] Artificial intelligence and machine learning system 330 provides various services to different subsystems within interaction system 100. For example, artificial intelligence and machine learning system 330 operates in conjunction with image processing system 302 and camera device system 304 to analyze images and extract information such as objects, text, or faces. This information can then be used by image processing system 302 to enhance, filter, or manipulate images. Artificial intelligence and machine learning system 330 can be used by enhancement system 306 to generate enhanced content and augmented reality experiences, such as adding virtual objects or animations to real-world images. Communication system 308 and messaging system 310 can use artificial intelligence and machine learning system 330 to analyze communication patterns and provide insights into how users interact with each other, and provide intelligent message classification and tagging, such as classifying messages based on sentiment or topic. Artificial intelligence and machine learning system 330 can also provide chatbot functionality for messaging interactions 120 between user systems 102 and between user systems 102 and interaction server system 110. The artificial intelligence and machine learning system 330 can also work with the audio communication system 316 to provide speech recognition and natural language processing capabilities, enabling users to interact with the interactive system 100 using voice commands.

[0059] Data Architecture

[0060] Figure 4 This is a schematic diagram illustrating a data structure 400 that can be stored in a database 404 of an interactive server system 110, according to certain examples. Although the contents of the database 404 are shown as including multiple tables, it should be understood that data can be stored in other types of data structures, such as object-oriented databases.

[0061] Database 404 includes message data stored in message table 406. For any given message, this message data includes at least message sender data, message receiver (or recipient) data, and payload. See below for reference. Figure 4 Further details are provided regarding information that can be included in the message and is contained within the message data stored in message table 406.

[0062] Entity table 408 stores entity data and (for example, links to entity diagram 410 and profile data 402). Entities whose records are maintained in entity table 408 can include individuals, company entities, organizations, objects, locations, events, etc. Regardless of the entity type, any entity whose data is stored by interactive server system 110 can be an identifiable entity. Each entity is assigned a unique identifier and an entity type identifier (not shown).

[0063] Entity Graph 410 stores information about relationships and associations between entities. As an example only, such relationships can be social, professional (e.g., working in a common company or organization), interest-based, or activity-based. Some relationships between entities can be one-way, such as an individual user subscribing to digital content (e.g., a newspaper or other digital media export or brand) for a business or publishing user. Other relationships can be two-way, such as the "friend" relationship between individual users of Interactive System 100.

[0064] Certain licenses and relationships can be attached to each relationship, and also to each direction of the relationship. For example, a two-way relationship (e.g., a friendship between individual users) can include authorization for the posting of digital content items between the individual users, but certain restrictions or filters can be imposed on the posting of such digital content items (e.g., based on content characteristics, location data, or time of day data). Similarly, a subscription relationship between an individual user and a business user can impose varying degrees of restrictions on the posting of digital content from the business user to the individual user, and can significantly restrict or prevent the posting of digital content from the individual user to the business user. As an example of an entity, a specific user can record certain restrictions in a record for that entity within entity table 408 (e.g., via privacy settings). Such privacy settings can be applied to all types of relationships in the context of interaction system 100, or selectively applied to certain types of relationships.

[0065] Profile data 402 stores various types of profile data about a specific entity. Profile data 402 can be selectively used and presented to other users of the interactive system 100 based on privacy settings specified by the specific entity. In the case that the entity is an individual, profile data 402 includes, for example, a username, phone number, address, settings (e.g., notification and privacy settings), and an avatar representation (or a set of such avatar representations) selected by the user. A specific user can then selectively include one or more of these avatar representations within the content of messages transmitted via the interactive system 100, and on a map interface displayed by the interactive client 104 to other users. The set of avatar representations may include “status avatars,” which present a graphical representation of a status or activity that the user can choose to transmit at a specific time.

[0066] In the case that the entity is a group, in addition to the group name, members and various settings for the relevant group (e.g., notifications), the profile data 402 for the group may similarly include one or more avatars associated with the group.

[0067] Database 404 also stores enhancement data, such as overlays or filters, in enhancement table 412. Enhancement data is associated with and applied to videos (video data is stored in video table 414) and images (image data is stored in image table 416).

[0068] In some examples, filters are displayed as overlays on images or videos during presentation to the receiving user. Filters can be of various types, including user-selected filters from a set of filters presented to the sending user by the interactive client 104 while the sending user is composing a message. Other types of filters include geolocation filters (also known as geographic filters), which can be presented to the sending user based on geographic location. For example, geolocation filters specific to nearby or particular locations can be presented by the interactive client 104 within the user interface based on geographic location information determined by the user system 102's Global Positioning System (GPS) unit.

[0069] Another type of filter is a data filter, which can be selectively presented to the sending user by the interactive client 104 based on other inputs or information collected by the user system 102 during the message creation process. Examples of data filters include the current temperature at a specific location, the current speed of the sending user, the battery life of the user system 102, or the current time.

[0070] Other augmented data that can be stored in image table 416 includes augmented reality content items (e.g., corresponding to an application "lens" or augmented reality experience). Augmented reality content items can be real-time effects and sounds that can be added to images or videos.

[0071] Collection table 418 stores data related to collections of messages and associated image, video, or audio data, compiled into collections (e.g., stories or galleries). The creation of a specific collection can be initiated by a specific user (e.g., each user whose record is maintained in entity table 408). A user can create a "personal story" in the form of a collection of content that has been created and sent / broadcast by that user. For this purpose, the user interface of interactive client 104 may include user-selectable icons that allow the sending user to add specific content to his or her personal story.

[0072] The collection can also constitute a "live story," which is a collection of content from multiple users created manually, automatically, or using a combination of manual and automatic technologies. For example, a "live story" can constitute a curated stream of user-submitted content from various locations and events. Users whose client devices have location services enabled and who are at a common location event at a specific time can be presented with the option to contribute content to a specific live story, for example, via the user interface of interactive client 104. Live stories can be identified to a user by interactive client 104 based on their location. The end result is a "live story" told from a community perspective.

[0073] Another type of content collection is called a "location story," which allows users of user system 102 located in a specific geographic location (e.g., on a college or university campus) to contribute to a specific collection. In some examples, contributions to a location story may employ secondary authentication to verify that the end user belongs to a specific organization or other entity (e.g., is a student on a university campus).

[0074] As mentioned above, video table 414 stores video data, which in some examples is associated with messages whose records are maintained within message table 406. Similarly, image table 416 stores image data associated with messages whose message data is stored in entity table 408. Entity table 408 can associate various enhancements from enhancement table 412 with various images and videos stored in image table 416 and video table 414.

[0075] Data communication architecture

[0076] Figure 5 This is a schematic diagram illustrating the structure of message 500 according to some examples, generated by interactive client 104 for transmission to another interactive client 104 via interactive server 124. The content of a particular message 500 is used to populate message table 406 within database 404 accessible by interactive server 124. Similarly, the content of message 500 is stored in memory as "in-transit" or "in-flight" data for user system 102 or interactive server 124. Message 500 is shown to include the following example components: Message Identifier 502: A unique identifier that identifies message 500. Message text payload 504: The text to be generated by the user via the user interface of user system 102 and included in message 500. Message image payload 506: Image data captured by the camera device component of user system 102 or retrieved from the memory component of user system 102 and included in message 500. The image data for the sent or received message 500 can be stored in image table 416. Message video payload 508: Video data captured by the camera device component or retrieved from the memory component of the user system 102 and included in the message 500. The video data for the sent or received message 500 can be stored in the image table 416. Message audio payload 510: Audio data captured by the microphone or retrieved from the memory component of the user system 102 and included in message 500. Message enhancement data 512: This represents enhancement data (e.g., filters, labels, or other annotations or enhancements) to be applied to the message image payload 506, message video payload 508, or message audio payload 510 of message 500. Enhancement data for the sent or received message 500 can be stored in enhancement table 412. Message duration parameter 514: A parameter value, in seconds, indicating the amount of time that the content of the message (e.g., message image payload 506, message video payload 508, message audio payload 510) will be presented to the user via the interactive client 104 or that is accessible to the user. Message geolocation parameter 516: Geographic location data (e.g., latitude and longitude coordinates) associated with the message's content payload. Multiple message geolocation parameter 516 values ​​may be included in the payload, each of which is associated with a content item included in the content (e.g., a specific image within the message image payload 506 or a specific video within the message video payload 508). Message Story Identifier 518: An identifier value that identifies one or more sets of content (e.g., "Stories" identified in set table 418) associated with a specific content item in the message image payload 506 of message 500. For example, multiple images within the message image payload 506 may each be associated with multiple sets of content using their own identifier values. Message Tag 520: Each message 500 can be labeled with multiple tags, each tag indicating the subject of the content included in the message payload. For example, in the case where a specific image depicts an animal (e.g., a lion) is included in the message image payload 506, the tag value can be included within the message tag 520 indicating the relevant animal. The tag value can be manually generated based on user input, or it can be automatically generated using, for example, image recognition. Message sender identifier 522: An identifier (e.g., message sending system identifier, email address, or device identifier) ​​indicating the user of the user system 102 on which message 500 is generated and from which message 500 is sent. Message receiver identifier 524: An identifier (e.g., message sending and receiving system identifier, email address, or device identifier) ​​indicating the user of the user system 102 to which message 500 is addressed.

[0077] The content (e.g., values) of each component of message 500 can be pointers to locations in tables where content data values ​​are stored. For example, image values ​​in message image payload 506 can be pointers (or addresses) to locations within image table 416. Similarly, values ​​in message video payload 508 can point to data stored in image table 416, values ​​in message enhancement data 512 can point to data stored in enhancement table 412, values ​​in message story identifier 518 can point to data stored in set table 418, and values ​​in message sender identifier 522 and message receiver identifier 524 can point to user records stored in entity table 408.

[0078] Systems with head-worn devices

[0079] Figure 6 A system 600 including a head-worn wearable device 116 with a selector input device is shown according to some examples. Figure 6 This is a high-level functional block diagram of an example head-mounted wearable device 116 that is communicatively coupled to mobile devices 114 and various server systems 604 (e.g., interactive server system 110) via various networks 108.

[0080] The head-mounted wearable device 116 includes one or more camera devices communicatively and / or operatively coupled to the secure data vault system 132, each of which may be, for example, a visible light camera 606, an infrared emitter 608, and an infrared camera 610.

[0081] Mobile device 114 connects to head-mounted wearable device 116 using both low-power wireless connection 612 and high-speed wireless connection 614. Mobile device 114 also connects to server system 604 and network 616.

[0082] The head-mounted wearable device 116 also includes two image displays of an optical component image display 618. The two optical component image displays 618 include an image display associated with the left lateral side of the head-mounted wearable device 116 and an image display associated with the right lateral side of the head-mounted wearable device 116. The head-mounted wearable device 116 also includes an image display driver 620, an image processor 622, a low-power circuitry system 624, and a high-speed circuitry system 626. The optical component image displays 618 are used to present images and videos to the user of the head-mounted wearable device 116, including images that may include a graphical user interface.

[0083] The image display driver 620 commands and controls the image display 618 of the optical components. The image display driver 620 can directly deliver image data to the image display 618 of the optical components for presentation, or it can convert the image data into a signal or data format suitable for delivery to the image display device. For example, the image data can be video data formatted according to compression formats such as H.264 (MPEG-4 Part 10), HEVC, Theora, Dirac, RealVideo RV40, VP8, VP9, ​​etc., and still image data can be formatted according to compression formats such as Portable Netgroup (PNG), Joint Photographic Experts Group (JPEG), Tag Image File Format (TIFF), or Exchangeable Image File Format (EXIF), etc.

[0084] The head-worn device 116 includes a frame and a handle (or leg) extending laterally from the frame. The head-worn device 116 also includes a user input device 628 (e.g., a touch sensor or a press button), comprising an input surface on the head-worn device 116. The user input device 628 (e.g., a touch sensor or a press button) is used to receive input selections from the user for manipulating a graphical user interface of a presented image.

[0085] Figure 6The components shown for the head-worn wearable device 116 are located on one or more circuit boards (e.g., PCBs or flexible PCBs) in the frame or legs. Alternatively or additionally, the depicted components may be located in blocks, frames, hinges, or nose bridges of the head-worn wearable device 116. The left and right visible light camera devices 606 may include digital camera elements, such as complementary metal-oxide-semiconductor (CMOS) image sensors, charge-coupled devices, camera lenses, or any other corresponding visible light or light-capturing elements that can be used to capture data, including images of scenes with unknown objects.

[0086] The head-mounted wearable device 116 includes a memory 602 that stores instructions for performing a subset or all of the functions described herein. The memory 602 may also include storage devices.

[0087] like Figure 6 As shown, the high-speed circuit system 626 includes a high-speed processor 630, a memory 602, and a high-speed wireless circuit system 632. In some examples, an image display driver 620 is coupled to the high-speed circuit system 626 via a secure data vault system 132 and is operated by a display and rendering system 218 to drive the left and right image displays of the image display 618 of the optical components. The high-speed processor 630 can be any processor capable of managing the high-speed communication and operation of any general-purpose computing system required by the head-worn device 116 and is included in the display and rendering system 218. The high-speed processor 630 includes the processing resources required to manage high-speed data transmission to a wireless local area network (WLAN) over a high-speed wireless connection 614 using the high-speed wireless circuit system 632. In some examples, the high-speed processor 630 executes the operating system of the head-worn device 116 (e.g., a LINUX operating system) or other such operating system, and this operating system is stored in the memory 602 for execution. Among other duties, the high-speed processor 630, which executes the software architecture of the head-worn device 116, manages data transmission with the high-speed wireless circuit system 632. In some examples, the high-speed wireless circuit system 632 is configured to implement the Institute of Electrical and Electronics Engineers (IEEE) 802.11 communication standard, also referred to herein as Wi-Fi®. In some examples, the high-speed wireless circuit system 632 may implement other high-speed communication standards.

[0088] The low-power wireless circuitry system 634 and high-speed wireless circuitry system 632 of the head-mounted wearable device 116 may include a short-range transceiver (Bluetooth™) and a wireless wide-area network transceiver, a wireless local area network transceiver, or a wide-area network transceiver (e.g., cellular or Wi-Fi®). The mobile device 114, including transceivers communicating via low-power wireless connection 612 and high-speed wireless connection 614, can be implemented using the architectural details of the head-mounted wearable device 116, as can other components of the network 616.

[0089] Memory 602 includes any storage device capable of storing various data and applications, including camera data generated by the left and right visible light cameras 606, the infrared camera 610, and the image processor 622, as well as images generated for display on an image display 618 in the optical components by the image display driver 620. While memory 602 is shown as integrated with the high-speed circuitry 626, in some examples, memory 602 may be a separate, independent component of the head-mounted wearable device 116. In some such examples, electrical wiring may provide a connection from the image processor 622 or the low-power processor 636 through a chip including the high-speed processor 630 to memory 602. In some examples, the high-speed processor 630 may manage addressing of memory 602, such that the low-power processor 636 will activate the high-speed processor 630 whenever a read or write operation involving memory 602 is required.

[0090] like Figure 6 As shown, the low-power processor 636 or high-speed processor 630 of the head-mounted wearable device 116 may be coupled to a camera device (visible light camera 606, infrared emitter 608, or infrared camera 610), an image display driver 620, a user input device 628 (e.g., a touch sensor or a press button), and a memory 602. In some examples, both the low-power circuitry 624 and the high-speed circuitry 626 are included in the secure data vault system 132.

[0091] The head-mounted wearable device 116 is connected to a host computer. For example, the head-mounted wearable device 116 is paired with the mobile device 114 via a high-speed wireless connection 614 or connected to the server system 604 via a network 616. The server system 604 may be one or more computing devices as part of a service or network computing system, for example, it includes a processor, memory, and network communication interfaces to communicate with the mobile device 114 and the head-mounted wearable device 116 via the network 616.

[0092] Mobile device 114 includes a processor and a network communication interface coupled to the processor. The network communication interface enables communication via network 616, low-power wireless connection 612, or high-speed wireless connection 614. Mobile device 114 may also store at least a portion of its instructions in its memory to implement the functions described herein. In some examples, low-power circuitry system 624 and high-speed wireless circuitry system 632 are included in secure network service 216 and are used only for downloading data, such as update packages, to secure data vault system 132. For example, the update package may include computer instructions configured to update the sandbox system, secure network service 216, and / or display and rendering system 218 to a newer version. The update package is encrypted, and a key stored in sandbox system 210 is used to decrypt and verify the validity of the update package. In some examples, the key used to decrypt the update package is a good privacy (PGP) private key. Therefore, the PGP public key shared by sandbox system 210 is used to encrypt the update package. Verification can then be performed by reading the header of the update package after decryption. The header may include, for example, a cyclic redundancy check (CRC) code to verify the integrity of the instructions included in the update packet.

[0093] The output components of the head-worn wearable device 116 include visual components, such as displays (e.g., liquid crystal displays (LCDs), plasma display panels (PDPs), light-emitting diode (LED) displays, projectors, or waveguides). The image display of the optical components is driven by an image display driver 620. The output components of the head-worn wearable device 116 also include acoustic components (e.g., speakers), haptic components (e.g., vibration motors), other signal generators, etc. The input components (e.g., user input devices 628) of the head-worn wearable device 116, mobile device 114, and server system 604 may include alphanumeric input components (e.g., keyboards, touchscreens configured to receive alphanumeric input, optical keyboards, or other alphanumeric input components), point-based input components (e.g., mice, touchpads, trackballs, joysticks, motion sensors, or other pointing instruments), haptic input components (e.g., physical buttons, touchscreens that provide the position and force of a touch or touch gesture, or other haptic input components), audio input components (e.g., microphones), etc.

[0094] The head-mounted wearable device 116 may also include additional peripheral device elements. Such peripheral device elements may include biometric sensors, additional sensors, or display elements integrated with the head-mounted wearable device 116. For example, peripheral device elements may include any I / O components, including output components, motion components, positioning components, or any other such elements described herein.

[0095] For example, biometric components include those for detecting expressions (e.g., hand gestures, facial expressions, voice expressions, body posture, or eye tracking), measuring biosignals (e.g., blood pressure, heart rate, body temperature, sweating, or brain waves), and identifying a person (e.g., voice recognition, retinal recognition, facial recognition, fingerprint recognition, or EEG-based recognition). Biometric components may include brain-computer interface (BMI) systems that allow communication between the brain and external devices or machines. This can be achieved by recording brain activity data, converting this data into a computer-understandable format, and then using the resulting signals to control the device or machine.

[0096] Examples of BMI technology types include: BMI, based on electroencephalography (EEG), uses electrodes placed on the scalp to record electrical activity in the brain. Invasive BMI uses electrodes surgically implanted in the brain. Optogenetics BMI uses light to control the activity of specific nerve cells in the brain.

[0097] Any biometric data collected by biometric components is captured and stored only with user approval and deleted upon user request. Furthermore, such biometric data can be used for very limited purposes, such as identification verification. To ensure the restricted and authorized use of biometric information and other personally identifiable information (PII), access to this data is limited to authorized personnel (if applicable). Any use of biometric data can be strictly limited to identification verification purposes, and the biometric data cannot be shared or sold to any third party without the user's explicit consent. Additionally, appropriate technical and organizational measures are implemented to ensure the security and confidentiality of this sensitive information.

[0098] Moving components include accelerometer components (e.g., accelerometers), gravity sensor components, rotation sensor components (e.g., gyroscopes), etc. Positioning components include positioning sensor components (e.g., GPS receiver components) for generating position coordinates, Wi-Fi or Bluetooth™ transceivers for generating positioning system coordinates, altitude sensor components (e.g., altimeters or barometers that detect air pressure, from which altitude can be determined), orientation sensor components (e.g., magnetometers), etc. Such positioning system coordinates can also be received from mobile device 114 via low-power wireless circuitry system 634 or high-speed wireless circuitry system 632 through low-power wireless connection 612 and high-speed wireless connection 614.

[0099] Figure 7This is an example process 700 suitable for use with the secure data vault system 132, according to some embodiments. In the depicted embodiments, process 700 receives sensor data at block 702 from various sensors of the AR system (e.g., user system 102), such as sensors communicatively coupled to user system 102 (e.g., camera devices, microphones, gyroscopes, navigation system sensors, biometric sensors, etc.). In some embodiments, sensors are only coupled to the secure data vault system 132, and therefore only sensor signals are sent to the secure data vault system 132.

[0100] Processing 700 at block 704 processes sensor data within sandbox system 210. As previously mentioned, sandbox system 210 can be a hardware-based system, such as an FPGA, one or more processors, and / or one or more custom chips. In operation, programs executable via sandbox system 210 (e.g., computer instructions) are isolated, allowing programs to crash without affecting the non-sandboxed system of the AR system. For example, sandbox system 210, via execution environment 212, does not allow execution of computer instructions outside a specified memory address range (e.g., memory outside sandbox system 210), and computer instructions are executed only by sandbox system 210.

[0101] Additionally, a security compatibility matrix is ​​used to restrict program execution within the sandbox system 210. For example, the security compatibility matrix includes rows storing unique processing (e.g., computer program) identifier data and columns storing instructions that can be executed by the corresponding processing identified by the processing identifier data. That is, the columns include functions, methods, classes, and / or object-oriented objects that can be executed by each of the processing processes listed in the rows. In some examples, an AI model is used to detect private information. For example, images, sounds, and / or geolocation information considered private can be detected via an AI model. Then, processing of the sensor data at box 704 can blur images, mute and / or add noise to sounds, remove geolocation information, etc., to protect user privacy. Processing of the sensor data at box 704 can also notify the user via text, images, and / or voice that private data is being detected and blurred.

[0102] Then, at box 706, the processed data is rendered. For example, an image may be rendered via display and rendering system 218 to blur private data. Similarly, sound may be rendered to inject noise or mute it to protect privacy. Then, at box 708, the rendered image and / or sound are displayed along with the surrounding real-world environment. For example, a driver's license being viewed may now be displayed as blurred, while the surrounding real-world environment, such as the table on which the driver's license is placed, is displayed as unblurred. These images also include rendered 3D images of virtual objects, avatars, etc., which may be overlaid on the surrounding real-world environment. By applying the secure data vault system 132, the techniques described herein improve security and privacy.

[0103] Machine architecture

[0104] Figure 8This is a schematic representation of machine 800, within which instructions 802 (e.g., software, programs, applications, applets, or other executable code) can be executed to cause machine 800 to perform any or more of the methods discussed herein. For example, instructions 802 can cause machine 800 to perform any or more of the methods described herein. Instructions 802 transform a general, unprogrammed machine 800 into a specific machine 800 programmed to perform the described and illustrated functions in the described manner. Machine 800 can operate as a standalone device or can be coupled (e.g., networked) to other machines. In a networked deployment, machine 800 can operate as a server machine or a client machine in a server-client network environment, or as a peer machine in a peer-to-peer (or distributed) network environment. Machine 800 may include, but is not limited to: server computers, client computers, personal computers (PCs), tablet computers, laptop computers, netbooks, set-top boxes (STBs), personal digital assistants (PDAs), entertainment media systems, cellular phones, smartphones, mobile devices, wearable devices (e.g., smartwatches), smart home devices (e.g., smart appliances), other smart devices, web devices, network routers, network switches, network bridges, or any machine capable of sequentially or otherwise executing instructions 802 specifying actions to be taken by machine 800. Furthermore, although only a single machine 800 is shown, the term "machine" should also be considered as a collection of machines that individually or jointly execute instructions 802 to perform any or more of the methods discussed herein. For example, machine 800 may include user system 102 or any of a plurality of server devices forming part of interactive server system 110. In some examples, machine 800 may also include both client and server systems, wherein certain operations of a particular method or algorithm are performed on the server side and certain operations of a particular method or algorithm are performed on the client side.

[0105] Machine 800 may include a processor 804, a memory 806, and input / output (I / O) components 808 that can be configured to communicate with each other via a bus 810. In the example, processor 804 (e.g., a central processing unit (CPU), a reduced instruction set computing (RISC) processor, a complex instruction set computing (CISC) processor, a graphics processing unit (GPU), a digital signal processor (DSP), an application-specific integrated circuit (ASIC), a radio frequency integrated circuit (RFIC), another processor, or any suitable combination thereof) may include, for example, processors 812 and 814 that execute instruction 802. The term "processor" is intended to include multi-core processors, which may include two or more independent processors (sometimes referred to as "cores") capable of executing instructions simultaneously. Although Figure 8 Multiple processors 804 are shown, but machine 800 may include a single processor with a single core, a single processor with multiple cores (e.g., a multi-core processor), multiple processors with a single core, multiple processors with multiple cores, or any combination thereof.

[0106] Memory 806 includes main memory 816, static memory 818, and memory cells 820, all of which are accessible by processor 804 via bus 810. Main memory 806, static memory 818, and memory cells 820 store instructions 802 that implement any one or more of the methods or functions described herein. Instructions 802 may also reside wholly or partially within main memory 816, static memory 818, machine-readable medium 822 within memory cells 820, at least one processor of processor 804 (e.g., within the processor's cache memory), or any suitable combination thereof during execution by machine 800.

[0107] I / O component 808 may include various components for receiving input, providing output, generating output, transmitting information, exchanging information, capturing measurement results, etc. The specific I / O component 808 included in a particular machine will depend on the type of machine. For example, a portable machine such as a mobile phone may include a touch input device or other such input mechanism, while a headless server machine is unlikely to include such a touch input device. It will be understood that I / O component 808 may include... Figure 8Many other components are not shown. In various examples, I / O component 808 may include user output component 824 and user input component 826. User output component 824 may include visual components (e.g., displays such as plasma display panels (PDPs), light-emitting diode (LED) displays, liquid crystal displays (LCDs), projectors, or cathode ray tube (CRT) displays), acoustic components (e.g., speakers), haptic components (e.g., vibration motors, resistance mechanisms), other signal generators, etc. User input component 826 may include alphanumeric input components (e.g., keyboards, touchscreens configured to receive alphanumeric input, photoelectric keyboards, or other alphanumeric input components), point-based input components (e.g., mice, touchpads, trackballs, joysticks, motion sensors, or other pointing instruments), haptic input components (e.g., physical buttons, touchscreens or other haptic input components that provide the position and force of a touch or touch gesture), audio input components (e.g., microphones), etc.

[0108] In another example, I / O component 808 may include biometric component 828, motion component 830, environmental component 832, or positioning component 834, and various other components. For example, biometric component 828 includes components for detecting expressions (e.g., hand gestures, facial expressions, voice expressions, body posture, or eye tracking), measuring biosignals (e.g., blood pressure, heart rate, body temperature, sweating, or brain waves), and identifying a person (e.g., voice recognition, retinal recognition, facial recognition, fingerprint recognition, or EEG-based recognition). Biometric component may include a brain-computer interface (BMI) system that allows communication between the brain and external devices or machines. This can be achieved by recording brain activity data, converting this data into a computer-understandable format, and then using the resulting signals to control the device or machine.

[0109] Examples of BMI technology types include: BMI, based on electroencephalography (EEG), uses electrodes placed on the scalp to record electrical activity in the brain. Invasive BMI uses electrodes surgically implanted in the brain. Optogenetics BMI uses light to control the activity of specific nerve cells in the brain.

[0110] Any biometric data collected by biometric components is captured and stored only with user approval and deleted upon user request. Furthermore, such biometric data can be used for very limited purposes, such as identification verification. To ensure the restricted and authorized use of biometric information and other personally identifiable information (PII), access to this data is limited to authorized personnel (if applicable). Any use of biometric data can be strictly limited to identification verification purposes, and the data cannot be shared or sold to any third party without the user's explicit consent. Additionally, appropriate technical and organizational measures are implemented to ensure the security and confidentiality of this sensitive information.

[0111] The moving part 830 includes an acceleration sensor part (e.g., an accelerometer), a gravity sensor part, and a rotation sensor part (e.g., a gyroscope).

[0112] The environmental component 832 includes, for example, one or more camera devices (with still image / photograph and video capabilities), lighting sensor components (e.g., a photometer), temperature sensor components (e.g., one or more thermometers that detect ambient temperature), humidity sensor components, pressure sensor components (e.g., a barometer), acoustic sensor components (e.g., one or more microphones that detect background noise), proximity sensor components (e.g., an infrared sensor that detects nearby objects), gas sensors (e.g., gas detection sensors that detect the concentration of hazardous gases for safety purposes or measure pollutants in the atmosphere), or other components that can provide indications, measurements, or signals corresponding to the surrounding physical environment.

[0113] Regarding the camera device, user system 102 may have a camera device system including, for example, a front-facing camera on the front surface of user system 102 and a rear-facing camera on the rear surface of user system 102. The front-facing camera may be used, for example, to capture still images and videos (e.g., “selfies”) of the user of user system 102, which can then be enhanced with the enhancement data (e.g., filters) described above. For example, the rear-facing camera may be used to capture still images and videos in a more conventional camera device mode, which are similarly enhanced with the enhancement data. In addition to the front-facing and rear-facing cameras, user system 102 may also include a 360° camera for capturing 360° photos and videos.

[0114] Furthermore, the camera system of user system 102 may include dual rear cameras (e.g., a main camera and a depth-sensing camera), or even include triple, quadruple, or quintuple rear camera configurations on the front and rear sides of user system 102. For example, these multiple camera systems may include wide-angle cameras, ultra-wide-angle cameras, telephoto cameras, macro cameras, and depth sensors.

[0115] The positioning component 834 includes a position sensor component (e.g., a GPS receiver component), an altitude sensor component (e.g., an altimeter or barometer that detects air pressure and from which altitude can be obtained), an orientation sensor component (e.g., a magnetometer), and the like.

[0116] Various technologies can be used to achieve communication. I / O component 808 also includes communication component 836, which is operable to couple machine 800 to network 838 or device 840 via a suitable coupling or connection. For example, communication component 836 may include a network interface component or another suitable device that interfaces with network 838. In further examples, communication component 836 may include wired communication component, wireless communication component, cellular communication component, near field communication (NFC) component, Bluetooth component, etc. ® Components (e.g., Bluetooth) ® Low energy consumption), Wi-Fi ® Components and other communication components that provide communication via other modes. Device 840 can be any peripheral device from another machine or various peripheral devices (e.g., a peripheral device coupled via USB).

[0117] Furthermore, communication component 836 can detect identifiers, or includes components operable to detect identifiers. For example, communication component 836 may include a radio frequency identification (RFID) tag reader component, an NFC smart tag detection component, an optical reader component (e.g., for detecting one-dimensional barcodes such as Universal Product Code (UPC) barcodes, multi-dimensional barcodes such as Quick Response (QR) codes, Aztec codes, data matrices, Dataglyphs, etc.), etc. TM The device can be equipped with optical sensors for MaxiCode, PDF417, UltraCode, UCC RSS-2D barcodes, and other optical codes, or acoustic detection components (e.g., microphones for identifying audio signals of the tags). Additionally, various information can be obtained via communication component 836, such as location via Internet Protocol (IP) geolocation, location via Wi-Fi® signal triangulation, or location by detecting NFC beacon signals that indicate a specific location.

[0118] Various memories (e.g., main memory 816, static memory 818, and the memory of processor 804) and storage unit 820 may store one or more sets of instructions and data structures (e.g., software) embodied or used by any one or more of the methods or functions described herein. These instructions (e.g., instruction 802) cause various operations to implement the disclosed examples when executed by processor 804.

[0119] Instruction 802 can be sent or received over network 838 via a transmission medium using a network interface device (e.g., a network interface component included in communication component 836) and using any of several known transmission protocols (e.g., Hypertext Transfer Protocol (HTTP)). Similarly, instruction 802 can be sent or received via a transmission medium coupled to device 840 (e.g., peer-to-peer coupling).

[0120] Software Architecture

[0121] Figure 9 This is a block diagram 900 illustrating a software architecture 902 that can be installed on any one or more of the devices described herein. The software architecture 902 is supported by hardware, such as a machine 904 including a processor 906, memory 908, and I / O components 910. In this example, the software architecture 902 can be conceptualized as a stack of layers, where each layer provides a specific function. The software architecture 902 includes layers such as an operating system 912, libraries 914, frameworks 916, and applications 918. Operationally, application 918 activates API calls 920 through the software stack and receives messages 922 in response to API calls 920.

[0122] Operating system 912 manages hardware resources and provides public services. Operating system 912 includes, for example, kernel 924, services 926, and drivers 928. Kernel 924 acts as an abstraction layer between hardware and other software layers. For example, kernel 924 provides functions such as memory management, processor management (e.g., scheduling), component management, networking, and security settings. Services 926 can provide other public services to other software layers. Drivers 928 are responsible for controlling or interfacing with the underlying hardware. For example, drivers 928 may include display drivers, camera drivers, BLUETOOTH® or BLUETOOTH® low-power drivers, flash memory drivers, serial communication drivers (e.g., USB drivers), Wi-Fi® drivers, audio drivers, power management drivers, etc.

[0123] Library 914 provides common low-level infrastructure used by application 918. Library 914 may include system libraries 930 (e.g., the C standard library) that provide functions such as memory allocation, string manipulation, and mathematical functions. Additionally, library 914 may include API libraries 932 such as media libraries (e.g., libraries for supporting the rendering and manipulation of various media formats, such as Moving Picture Experts Group-4 (MPEG4), Advanced Video Coding (H.264 or AVC), Moving Picture Experts Group Layer-3 (MP3), Advanced Audio Coding (AAC), Adaptive Multi-Rate (AMR) audio codecs, Joint Picture Experts Group (JPEG or JPG) or Portable Web Graphics (PNG)), graphics libraries (e.g., an OpenGL framework for rendering graphic content on a display in two-dimensional (2D) and three-dimensional (3D) formats), database libraries (e.g., SQLite providing various relational database functions), web libraries (e.g., WebKit providing web browsing functionality), etc. Library 914 may also include a wide variety of other libraries 934 to provide many other APIs to application 918.

[0124] Framework 916 provides a common high-level infrastructure for use by Application 918. For example, Framework 916 provides various graphical user interface (GUI) functions, advanced resource management, and advanced location services. Framework 916 can provide a wide range of other APIs that can be used by Application 918, some of which may be specific to a particular operating system or platform.

[0125] In the example, application 918 may include a home application 936, a contacts application 938, a browser application 940, a book reader application 942, a location application 944, a media application 946, a messaging application 948, a game application 950, and a variety of other applications such as a third-party application 952. Application 918 is a program that performs the functions defined in the program. One or more applications 918 can be created using various programming languages, such as object-oriented programming languages ​​(e.g., Objective-C, Java, or C++) or procedural programming languages ​​(e.g., C or assembly language). In a particular example, third-party application 952 (e.g., an application developed by an entity other than a platform vendor using the Android™ or iOS™ Software Development Kit (SDK)) may be mobile software running on a mobile operating system such as iOS™, Android™, Windows® Phone, or another mobile operating system. In this example, third-party application 952 may activate API calls 920 provided by operating system 912 to facilitate the functions described herein.

[0126] Glossary

[0127] "Carrier signal" refers to any intangible medium, such as a medium capable of storing, encoding, or carrying machine-executable instructions and including digital or analog communication signals, or other intangible medium that facilitates the communication of such instructions. Instructions can be sent or received over a network using a transmission medium via a network interface device.

[0128] "Client device" means any machine that interfaces with a communication network to obtain resources from one or more server systems or other client devices. Client devices can be, but are not limited to, mobile phones, desktop computers, laptop computers, portable digital assistants (PDAs), smartphones, tablet computers, ultrabooks, netbooks, laptop computers, multiprocessor systems, microprocessor-based or programmable consumer electronics, game consoles, set-top boxes, or any other communication device that a user can use to access the network.

[0129] "Communications network" means, for example, one or more parts of a network, which can be an ad hoc network, intranet, extranet, virtual private network (VPN), local area network (LAN), wireless LAN (WLAN), wide area network (WAN), wireless WAN (WWAN), metropolitan area network (MAN), the Internet, a part of the Internet, a part of the Public Switched Telephone Network (PSTN), a Common Old-Style Telephone Service (POTS) network, a cellular telephone network, a wireless network, a Wi-Fi® network, other types of networks, or a combination of two or more such networks. For example, a network or part of a network may include a wireless network or a cellular network, and the coupling may be a Code Division Multiple Access (CDMA) connection, a Global System for Mobile Communications (GSM) connection, or other types of cellular or wireless coupling. In this example, coupling can implement any data transmission technology of various types, such as single-carrier radio transmission technology (1xRTT), evolved data optimization (EVDO) technology, general packet radio service (GPRS) technology, enhanced data rate GSM evolution (EDGE) technology, the 3rd Generation Partnership Project (3GPP) including 3G, fourth-generation wireless (4G) networks, Universal Mobile Telecommunications System (UMTS), High-Speed ​​Packet Access (HSPA), Global Microwave Access Interoperability (WiMAX), Long Term Evolution (LTE) standards, other data transmission technologies defined by various standards setting organizations, other long-distance protocols, or other data transmission technologies.

[0130] A “component” refers to, for example, a device, physical entity, or logic having boundaries defined by functional or subroutine calls, branch points, APIs, or other technologies that provide specific processing or control functionality, such as partitioning or modularization. A component can be combined with other components via its interface to perform machine processing. A component can be an encapsulated functional hardware unit designed for use with other components, and part of a program that typically performs a specific function within a related function. A component can constitute a software component (e.g., code embodied on a machine-readable medium) or a hardware component. A “hardware component” is a tangible unit capable of performing certain operations and can be configured or arranged in some physical manner. In various examples, one or more computer systems (e.g., standalone computer systems, client computer systems, or server computer systems) or one or more hardware components (e.g., processors or processor groups) of a computer system can be configured by software (e.g., an application or application portion) to operate to perform certain operations described herein. Hardware components can also be implemented mechanically, electronically, or in any suitable combination thereof. For example, a hardware component can include a dedicated circuit system or logic permanently configured to perform certain operations. Hardware components can be dedicated processors, such as field-programmable gate arrays (FPGAs) or application-specific integrated circuits (ASICs). Hardware components can also include programmable logic or circuit systems temporarily configured by software to perform certain operations. For example, a hardware component may include software executed by a general-purpose processor or other programmable processor. Once configured by such software, the hardware component becomes a particular machine (or a specific part of a machine), which is uniquely tailored to perform the configured function and is no longer a general-purpose processor. It will be understood that a decision may be made, for cost and time considerations, whether to implement the hardware component mechanically in a dedicated and permanently configured circuit system or in a temporarily configured (e.g., configured by software) circuit system. Therefore, the phrase “hardware component” (or “hardware-implemented component”) should be understood to include tangible entities, i.e., entities physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain way or perform certain operations described herein. Consider the example of a hardware component being temporarily configured (e.g., programmed), without needing to configure or instantiate each hardware component at any given time. For example, in cases where the hardware components include a general-purpose processor that is configured as a dedicated processor via software, this general-purpose processor can be configured as different dedicated processors (e.g., including different hardware components) at different times. The software accordingly configures one or more specific processors to constitute a specific hardware component at one time and different hardware components at different times. Hardware components can provide information to and receive information from other hardware components.Therefore, the described hardware components can be considered communicatively coupled. In the presence of multiple hardware components, communication can be achieved through signal transmission between or among two or more hardware components (e.g., via appropriate circuitry and buses). In examples where multiple hardware components are configured or instantiated at different times, such communication between hardware components can be achieved, for example, by storing information in a memory structure accessible to the multiple hardware components and retrieving information from the memory structure. For example, a hardware component can perform an operation and store the output of that operation in a memory device communicatively coupled to it. Another hardware component can then access the memory device at a subsequent time to retrieve and process the stored output. Hardware components can also initiate communication with input or output devices and can operate on resources (e.g., collections of information). The various operations of the example methods described herein can be performed, at least in part, by one or more processors configured, either temporarily (e.g., by software) or permanently, to perform the relevant operations. Whether temporarily or permanently configured, such processors can constitute components of a processor implementation that operates to perform one or more operations or functions described herein. As used herein, "processor-implemented component" refers to a hardware component implemented using one or more processors. Similarly, the methods described herein can be implemented at least partially by processors, where a particular processor or one or more processors are examples of hardware. For example, at least some of the operations of the methods can be performed by one or more processors or processor-implemented components. Furthermore, one or more processors can also operate to support the execution of related operations in a "cloud computing" environment or as a "Software as a Service" (SaaS) operation. For example, at least some of the operations can be performed by a group of computers (as an example of a machine including processors), where these operations are accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., APIs). The execution of some operations can be distributed among processors, not residing within a single machine, but deployed across multiple machines. In some examples, the processor or processor-implemented component can reside in a single geographic location (e.g., in a home environment, office environment, or server cluster). In other examples, the processor or processor-implemented component can be distributed across multiple geographic locations.

[0131] "Computer-readable storage medium" refers to both, for example, machine storage media and transmission media. Therefore, these terms include both storage devices / media and carrier / modulated data signals. The terms "machine-readable medium," "computer-readable medium," and "device-readable medium" refer to the same thing and can be used interchangeably in this disclosure.

[0132] A "brief message" is a message that is accessible for a limited time, such as a short period of time. Brief messages can be text, images, videos, etc. The access time for a brief message can be set by the message sender. Alternatively, the access time can be a default setting or a setting specified by the recipient. Regardless of the setting method, the message is temporary.

[0133] "Machine storage medium" refers to, for example, a single or multiple storage devices and media (e.g., centralized or distributed databases, and associated caches and servers) that store executable instructions, routines, and data. Therefore, this term should be considered to include, but is not limited to, solid-state memory and optical and magnetic media, including memory internal or external to the processor. Specific examples of machine storage media, computer storage media, and device storage media include: non-volatile memory, including, for example, semiconductor memory devices such as erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), FPGAs, and flash memory devices; disks, such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks. The terms "machine storage medium," "device storage medium," and "computer storage medium" mean the same thing and may be used interchangeably in this disclosure. The terms "machine storage medium," "computer storage medium," and "device storage medium" expressly exclude carrier waves, modulated data signals, and other such media, at least some of which are covered under the term "signal medium."

[0134] "Non-transitory computer-readable storage medium" means, for example, a tangible medium capable of storing, encoding, or carrying instructions that can be executed by a machine.

[0135] "Signal medium" means any intangible medium capable of storing, encoding, or carrying instructions that can be executed by a machine, and includes digital or analog communication signals or other intangible media that facilitate the communication of software or data. The term "signal medium" should be considered to include any form of modulated data signal, carrier wave, etc. The term "modulated data signal" means a signal whose characteristics are set or altered in a manner that encodes information in the signal. The terms "transmission medium" and "signal medium" mean the same thing and may be used interchangeably in this disclosure.

[0136] "User equipment" means, for example, a device that is accessed, controlled, or owned by a user, and that the user interacts with to perform actions or interactions on the user equipment, including interactions with other users or computer systems.

Claims

1. An augmented reality (AR) system, comprising: monitor; Camera device; as well as A secure data vault system, comprising: A sandbox system, operatively coupled to the camera device and configured to receive camera device data from the camera device, wherein, during operation of the AR system, the camera device only sends camera device data to the sandbox system, and wherein the sandbox system includes an execution environment configured to restrict the execution of instructions to a predefined memory address range; and A display and rendering system, operatively coupled to the sandbox system and configured to render an image based on camera device data processed via the instructions and display the image via the display, wherein the display is configured to display both the image and the real-world environment surrounding the AR system.

2. The system of claim 1, comprising one or more processors configured to receive one or more user inputs via a user input device to adjust the display and the camera device, wherein, The secure data vault system includes a hardware-based system that is separate from the one or more processors and configured to process the camera device data.

3. The system according to claim 2, wherein, The hardware-based system includes a field-programmable gate array (FPGA), a processor, a custom circuit system, or a combination thereof.

4. The system according to claim 2, wherein, The hardware-based system is configured to execute the sandbox system within a virtual machine.

5. The system according to claim 1, wherein, The instructions include an artificial intelligence model configured to detect private information.

6. The system according to claim 5, wherein, The display and rendering system is configured to blur parts of the real-world environment based on the private information.

7. The system according to claim 1, wherein, The execution environment is configured to receive an identifier for a process that requests the execution of a subset of the instructions, and to verify, based on the identifier, that the process is permitted to execute the subset of the instructions.

8. The system according to claim 7, wherein, The execution environment is configured to verify, based on the identifier and the data storage included in the secure data vault system, that the processing is permitted to execute the subset of instructions.

9. The system according to claim 8, wherein, The data storage includes a security compatibility matrix, which comprises multiple rows and multiple columns.

10. The system according to claim 9, wherein, The plurality of rows include a plurality of unique processing identifier data, and wherein the plurality of columns include a plurality of instructions that can be executed by a corresponding processing identified by the processing identifier data.

11. The system according to claim 10, wherein, The plurality of instructions include functions, methods, classes, object-oriented objects, or combinations thereof.

12. The system according to claim 1, wherein, The execution environment is configured to isolate the execution of a program comprising multiple program instructions, such that the crash of the program does not affect other systems included in the AR system.

13. The system according to claim 12, wherein, The execution environment is configured to disallow the execution of any program instruction that accesses a memory address outside the specified memory address range included in the predefined memory address range.

14. The system according to claim 1, wherein, The secure data vault system includes a secure network service configured to authenticate connections to external systems and, when the connection is authenticated, download update packages for the sandbox system from the external systems.

15. The system according to claim 14, wherein, The update package includes computer instructions configured to update the sandbox system to a newer version.

16. The system according to claim 14, wherein, The secure network service is configured to verify the validity of the update package based on a key used to encrypt the update package.

17. The system according to claim 1, wherein, The display and rendering system is configured to be operatively coupled only to the sandbox system and to display images based solely on data received via the sandbox system.

18. The system according to claim 1, wherein, The secure data vault system includes a secure application programming interface (API) configured to authenticate access to the sandbox system and provide one or more programming interfaces to execute instructions via the sandbox system.

19. A method comprising: Data is received from a camera device operatively coupled to a sandbox system included in an augmented reality (AR) system, wherein, during operation of the camera device, the camera device sends data only to the sandbox system, and wherein the sandbox system includes an execution environment configured to restrict the execution of instructions to a predefined range of memory addresses. Render an image based on the camera device data processed via the instructions; and The image is displayed via a display included in the AR system, wherein the display is configured to display both the image and the real-world environment surrounding the AR system.

20. A non-transitory machine-readable medium storing instructions that, when executed by a computer system, cause the computer system to perform an operation, the operation comprising: Data is received from a camera device operatively coupled to a sandbox system included in an augmented reality (AR) system, wherein, during operation of the camera device, the camera device sends data only to the sandbox system, and wherein the sandbox system includes an execution environment configured to restrict the execution of instructions to a predefined range of memory addresses. Render an image based on the camera device data processed via the instructions; and The image is displayed via a display included in the AR system, wherein the display is configured to display both the image and the real-world environment surrounding the AR system.

Images