Automatic communications between networked devices such as televisions and mobile devices

1. A system comprising:

a networked device configured to at least one of:

announce a networked service to a discovery service, and

perform the discovery service for a private network; and

a client device configured to execute a sandboxed program in a security sandbox, to automatically instantiate a connection between the sandboxed program and at least one of the networked device and the networked service based on the discovery service, and to dispense with every requirement of user installation and user configuration of both the networked device and the client device for discovery of the networked device by the sandboxed program using the discovery service to enable the automatic instantiation of the connection between the sandboxed program and the at least one of the networked device and the networked service the sandboxed program being inaccessible to multicast and broadcast.

2. The system of claim 1 :

wherein a discovery agent running with the sandboxed program is configured to query the discovery service for a service information associated with the at least one of the networked device and the networked service,

wherein the service information comprises at least one of a global unique identifier (GUID), an alphanumeric name, a public address pair, and a private address pair.

3. The system of claim 2 :

wherein at least one of the discovery agent and the sandboxed program is configured to bypass the discovery service by caching the service information associated with the at least one of the networked device and the networked service.

4. The system of claim 2 :

wherein the discovery agent is further configured to serve as a trusted intermediary between an untrusted sandboxed program and the at least one of the networked device and the networked service,

wherein the trusted intermediary is configured to guard at least one of the GUID, the alphanumeric name, the public address pair, and the private address pair associated with the at least one of the networked device and the networked service from the untrusted sandboxed program, and

wherein the trusted intermediary and the untrusted sandboxed program are configured to communicate via a mutually agreed programming interface.

5. The system of claim 2 :

wherein the discovery agent is further configured to enforce a communications policy imposing an access restriction to the at least one of the networked device and the networked service.

6. The system of claim 1 :

wherein the at least one of the networked device and the networked service is configured to at least one of offer an access token to the sandboxed program and manage an access of the sandboxed program to the at least one of the networked device and the networked service,

wherein the access token uniquely identifies the sandboxed program, and

wherein the sandboxed program is configured to communicate with the at least one of the networked device and the networked service by passing the access token.

7. The system of claim 6 :

wherein the access token is offered to the sandboxed program on at least one of the private network and a local are network (LAN) with the at least one of the networked device and the networked service.

8. The system of claim 1 , further comprising:

a relay service configured to forward a packet between the sandboxed program and the at least one of the networked device and the networked service.

9. The system of claim 8 :

wherein the relay service comprises at least one of a Traversal Using Relays around NAT (TURN) server, a Simple Traversal of User Datagram Protocol over NATs (STUN) server, a STUN and TCP too (STUNT) server, the discovery service, a simple relay, a simple Transmission Control Protocol (TCP) relay, a simple User Datagram Protocol (UDP) relay, a GUID-relay, a TCP GUID-routing-relay, and a UDP GUID-routing-relay.

10. The system of claim 1 :

wherein the discovery service comprises at least one of a logically centralized discovery service, a private discovery service, and an extension to the security sandbox, and

wherein the discovery service is configured to at least one of:

provide an application-layer routing between the sandboxed program and the at least one of the networked device and the networked service, and

perform a traditional discovery method comprising at least one of a multicast protocol, a unicast protocol, an anycast protocol, a broadcast protocol, a Bonjour® protocol, a Simple Service Discovery Protocol (SSDP), a Local Service Discovery (LSD) uTorrent® protocol, a Service Location Protocol (SLP), a Universal Plug and Play (UPnP) protocol, a Multicast Domain Name System (MDNS) protocol, and a Domain Name System-based Service Discovery (DNS-SD) protocol.

11. The system of claim 1 :

wherein the networked service comprises at least one of a discoverable service and an undiscoverable service,

wherein the discoverable service comprises at least one of the networked service of the networked device, a gateway discoverable service, an elected discoverable service, and an unelected discoverable service,

wherein when the discoverable service comprises the gateway discoverable service, the gateway discoverable service is configured to announce the undiscoverable service to the discovery service and to provide a sandbox-reachable interface on behalf of the undiscoverable service, and

wherein when the discoverable service comprises the elected discoverable service, the elected discoverable service is configured to at least one of:

announce another networked service to the discovery service, and act as the discovery service for the private network.

12. The system of claim 1 :

wherein the sandboxed program is configured to bypass the discovery service when establishing the connection between the sandboxed program and the at least one of the networked device and the networked service.

13. The system of claim 1 :

wherein the networked device is configured to announce an availability of the networked service across a range of public Internet Protocol (IP) addresses such that the sandboxed program communicates with the at least one of the networked device and the networked service in any one of the range of public lP addresses.

14. The system of claim 1 :

wherein the sandboxed program is configured to process a hardware address associated with the sandboxed program from the at least one of the networked device and the networked service.

15. The system of claim 1 :

wherein the networked device is further configured to announce a service description of the networked service to the discovery service,

wherein the sandboxed program is configured to query the discovery service for a particular service description, and

wherein the discovery service returns the networked service with the service description that matches the particular service description.

16. The system of claim 1 :

wherein the sandboxed program is configured to associate the at least one of the networked device and the networked service with a user account, and

wherein the user account is accessed when establishing the connection between the at least one of the networked device and the networked service and at least one of the client device and another client device.

17. The system of claim 1 :

wherein the sandboxed program is configured to obtain an explicit permission to communicate with any device other than an origin server.

18. The system of claim 1 :

wherein the at least one of the networked device and the networked service is further configured to send a number of periodic keep-alive messages to the discovery service.

19. The system of claim 1 :

wherein a private IP address associated with the at least one of the networked device and the networked service remains unknown to the client device when:

a first Network Address Translator (NAT) device coupled with a network on which the client device operates is configured to process a communication from a public IP address of a different network on which the at least one of the networked device and the networked service operates, and

a second NAT device coupled with the different network is configured to translate the private IP address to the public IP address.

20. The system of claim 1 :

wherein the at least one of the networked device and the networked service is further configured to communicate with the sandboxed program by polling a message queue, and

wherein the message queue is configured to store a message from the sandboxed program.

21. The system of claim 1 :

wherein a NAT traversal mechanism comprises at least one of a DeMilitarized Zone (DMZ), an explicit port mapping, a user manual configuration, a casting of the at least one of the networked device and the networked service as a communication initiator, an announcement to the discovery service with a source port that is bound to a port on which the at least one of the networked device and the networked service listens, the discovery service sending a SYN from the port on which the at least one of the networked device and the networked service listens, a hole punching process, a port prediction, and using a server to learn an address of an outermost NAT residing in a path between the server and the at least one of the networked device and the networked service along with communicating the address via an external mechanism.

22. A method comprising:

at least one of announcing, by a networked device, a networked service to a discovery service and performing, by the networked device, the discovery service for a private network;

executing, by a client device, a sandboxed program in a security sandbox, the sandboxed program being inaccessible to multicast and broadcast;

automatically instantiating, by the client device, a connection between the sandboxed program and at least one of the networked device and the networked service based on the discovery service; and

dispensing with every requirement of user installation and user configuration of both the networked device and the client device for discovery of the networked device by the sandboxed program using the discovery service to enable the automatic instantiation of the connection between the sandboxed program and the at least one of the networked device and the networked service.

23. The method of claim 22 , further comprising:

querying, by a discovery agent running with the sandboxed program, the discovery service for a service information associated with the at least one of the networked device and the networked service,

wherein the service information comprises at least one of a global unique identifier (GUM), an alphanumeric name, a public address pair, and a private address pair.

24. The method of claim 23 , further comprising:

bypassing, by at least one of the discovery agent and the sandboxed program, the discovery service by caching the service information associated with the at least one of the networked device and the networked service.

25. The method of claim 23 , further comprising:

serving, by the discovery agent, as a trusted intermediary between an untrusted sandboxed program and the at least one of the networked device and the networked service,

wherein the trusted intermediary is configured to guard at least one of the MD, the alphanumeric name, the public address pair, and the private address pair associated with the at least one of the networked device and the networked service from the untrusted sandboxed program, and

wherein the trusted intermediary and the untrusted sandboxed program are configured to communicate via a mutually agreed programming interface.

26. The method of claim 23 , further comprising:

enforcing, by the discovery agent, a communications policy imposing an access restriction to the at least one of the networked device and the networked service.

27. The method of claim 22 , further comprising:

at least one of offering, by the at least one of the networked device and the networked service, an access token to the sandboxed program and managing, by the at least one of the networked device and the networked service, an access of the sandboxed program to the at least one of the networked device and the networked service,

wherein the access token uniquely identifies the sandboxed program, and

wherein the sandboxed program is configured to communicate with the at least one of the networked device and the networked service by passing the access token.

28. The method of claim 27 :

wherein the access token is offered to the sandboxed program on at least one of the private network and a local area network (LAN) with the at least one of the networked device and the networked service.

29. The method of claim 22 , further comprising:

forwarding, by a relay service, a packet between the sandboxed program and the at least one of the networked device and the networked service.

30. The method of claim 29 :

wherein the relay service comprises at least one of a Traversal Using Relays around NAT (TURN) server, a Simple Traversal of User Datagram Protocol over NATs (STUN) server, a STUN and TCP too (STUNT) server, the discovery service, a simple relay, a simple Transmission Control Protocol (TCP) relay, a simple User Datagram Protocol (UDP) relay, a GUID-relay, a TCP GUID-routing-relay, and a UDP GUID-routing-relay.

31. The method of claim 22 , further comprising:

at least one of providing, by the discovery service, an application-layer routing between the sandboxed program and the at least one of the networked device and the networked service and performing, by the discovery service, a traditional discovery method comprising at least one of a multicast protocol, a unicast protocol, an anycast protocol, a broadcast protocol, a Bonjour® protocol, a Simple Service Discovery Protocol (SSDP), a Local Service Discovery (LSD) uTorrent® protocol, a Service Location Protocol (SLP), a Universal Plug and Play (UPnP) protocol, a Multicast Domain Name System (MDNS) protocol, and a Domain Name System-based Service Discovery (DNS-SD) protocol,

wherein the discovery service comprises at least one of a logically centralized discovery service, a private discovery service, and an extension to the security sandbox.

32. The method of claim 22 :

wherein the networked service comprises at least one of a discoverable service and an undiscoverable service,

wherein the discoverable service comprises at least one of the networked service of the networked device, a gateway discoverable service, an elected discoverable service, and an unelected discoverable service,

wherein when the discoverable service comprises the gateway discoverable service, the gateway discoverable service is configured to announce the undiscoverable service to the discovery service and to provide a sandbox-reachable interface on behalf of the undiscoverable service, and

wherein when the discoverable service comprises the elected discoverable service, the elected discoverable service is configured to at least one of:

announce another networked service to the discovery service, and act as the discovery service for the private network.

33. The method of claim 22 , further comprising:

bypassing, by the sandboxed program, the discovery service when establishing the connection between the sandboxed program and the at least one of the networked device and the networked service.

34. The method of claim 22 , further comprising:

announcing, by the networked device, an availability of the networked service across a range of public Internet Protocol (IP) addresses such that the sandboxed program communicates with the at least one of the networked device and the networked service in any one of the range of public IP addresses.

35. The method of claim 22 , further comprising:

processing, by the sandboxed program, a hardware address associated with the sandboxed program from the at least one of the networked device and the networked service.

36. The method of claim 22 , further comprising:

announcing, by the networked device, a service description of the networked service to the discovery service;

querying, by the sandboxed program, the discovery service for a particular service description; and

returning, by the discovery service, the networked service with the service description that matches the particular service description.

37. The method of claim 22 , further comprising:

associating, by the sandboxed program, the at least one of the networked device and the networked service with a user account, and

wherein the user account is accessed when establishing the connection between the at least one of the networked device and the networked service and at least one of the client device and another client device.

38. The method of claim 22 , further comprising:

obtaining, by the sandboxed program, an explicit permission to communicate with any device other than an origin server.

39. The method of claim 22 , further comprising:

sending, by the at least one of the networked device and the networked service, a number of periodic keep-alive messages to the discovery service.

40. The method of claim 22 :

wherein a private IP address associated with the at least one of the networked device and the networked service remains unknown to the client device when:

a first Network Address Translator (NAT) device coupled with a network on which the client device operates is configured to process a communication from a public IP address of a different network on which the at least one of the networked device and the networked service operates, and

a second NAT device coupled with the different network is configured to translate the private IP address to the public IP address.

41. The method of claim 22 , further comprising:

communicating, by the at least one of the networked device and the networked service, with the sandboxed program by polling a message queue, and

wherein the message queue is configured to store a message from the sandboxed program.

42. The method of claim 22 :

wherein a NAT traversal mechanism comprises at least one of a DeMilitarized Zone (DMZ), an explicit port mapping, a user manual configuration, a casting of the at least one of the networked device and the networked service as a communication initiator, an announcement to the discovery service with a source port that is bound to a port on which the at least one of the networked device and the networked service listens, the discovery service sending a SYN from the port on which the at least one of the networked device and the networked service listens, a hole punching process, a port prediction, and using a server to learn an address of an outermost NAT residing in a path between the server and the at least one of the networked device and the networked service along with communicating the address via an external mechanism.