Secure and trusted device-based billing and charging process using privilege for network proxy authentication and audit

• US 10,282,719 B1
• Filed: 11/12/2015
• Issued: 05/07/2019
• Est. Priority Date: 11/12/2015
• Status: Active Grant

• Current Assignee: T-Mobile Innovations LLC (Deutsche Telekom AG)
• Original Assignee: Sprint Communications Company LP (Deutsche Telekom AG)
• Inventors: Paczkowski, Lyle W., Teixeira, Joao "Tex"
• Primary Examiner(s): Frenel, Vanel
• Application Number:
  US14/939,887
• Time in Patent Office: 1,272 Days
• Field of Search: 705 34, 705 35, 705 40, 705 261, 726 7, 726 1, 726 28, 709217, 455410, 713172
• CPC Class Codes: G06Q 20/0855 involving a third party
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/145 Payments according to the detected use or quantity
• CPC Class Codes: G06Q 20/382 insuring higher security of transaction
• CPC Class Codes: G06Q 20/401 Transaction verification
• CPC Class Codes: H04L 63/00 Network architectures or network communication protocols for network security cryptographic mechanisms or cryptographic arrangements for secret or secure communication H04L9/00; network architectures or network communication protocols for wireless network security H04W12/00; security arrangements for protecting computers or computer systems against unauthorised activity G06F21/00
• CPC Class Codes: H04L 67/01 Protocols
• CPC Class Codes: H04L 67/535 Tracking the activity of the user network monitoring arrangements H04L43/00; recording of computer activity G06F11/34
• CPC Class Codes: H04M 15/43 Billing software details
• CPC Class Codes: H04M 15/47 Fraud detection or prevention means
• CPC Class Codes: H04M 15/48 Secure or trusted billing, e.g. trusted elements or encryption
• CPC Class Codes: H04M 15/60 based on actual use of network resources
• CPC Class Codes: H04M 15/67 Transmitting arrangements for sending billing related information
• CPC Class Codes: H04W 12/069 using certificates or pre-shared keys
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware
• CPC Class Codes: H04W 12/40 Security arrangements using identity modules
• CPC Class Codes: H04W 12/66 Trust-dependent, e.g. using trust scores or trust relationships
• CPC Class Codes: H04W 4/24 Accounting or billing

Abstract

A user equipment with a primary identifier and a secondary identifier. The user equipment comprises a witness application stored in the memory, that when executed by the processor in a trusted security zone, wherein the trusted security zone provides hardware assisted trust, transmits a message comprising the logs of the communication service consumption to a server in a network of a service provider associated with the user equipment using a trusted end-to-end communication channel, wherein the logs are translated by the server to a format compatible with a billing data store supported by a billing server, wherein the translated logs are transmitted to the billing data store, whereby a bill is created for each of the primary identifier and the secondary identifier by the billing server accessing the billing data store.

Claims

1. A user equipment with a primary identifier and a secondary identifier, comprising:

a memory;

a processor; and

a witness application stored in the memory, that when executed by the processor in a trusted security zone, wherein the trusted security zone provides hardware assisted trust,

monitors communication service consumption of a plurality of different communication services associated with each of the primary identifier and the secondary identifier of the user equipment,

stores a plurality of logs of communication service consumption differentiated by identifier in the trusted security zone, and

transmits a message comprising the logs of the communication service consumption to a server in a network of a service provider associated with the user equipment using a trusted end-to-end communication channel, wherein the logs are translated by the server to a format compatible with a billing data store supported by a billing server, wherein the translated logs are transmitted to the billing data store, wherein a bill is created for each of the primary identifier based on the monitored communication service consumption of the plurality of different communication services associated with the primary identifier and the secondary identifier based on the monitored communication service consumption of the plurality of different communication services associated with the secondary identifier by the billing server accessing the billing data store.

2. The user equipment of claim 1, wherein the identifier is one of a phone number, a uniform resource identifier (URI), or a uniform resource locator (URL).

3. The user equipment of claim 1, wherein the message comprising the logs of the communication service consumption is transmitted to the server using the trusted end-to-end communication channel periodically.

4. The user equipment of claim 3, wherein the message comprising the logs of the communication service consumption is transmitted to the server every time communication services are used, every day, every week, every month, or every two months.

5. The user equipment of claim 3, wherein non-network related activity is monitored by the witness application.

6. The user equipment of claim 5, wherein the non-network related activity is transmitted in the message comprising the communication service consumption to the server for billing purposes using the trusted end-to-end communication channel.

7. The user equipment of claim 1, wherein the secondary identifier is deposited to the user equipment via the trusted security zone.

8. The user equipment of claim 7, wherein a service order code (SOC) is assigned to the secondary identifier.

9. A method of collecting communication service consumption information associated with a primary identifier and a secondary identifier of a user equipment (UE), comprising:

monitoring, by a witness application that executes in a trusted security zone of the UE, communication service consumption of a plurality of different communication services associated with each of the primary identifier and the secondary identifier of the UE, wherein the trusted security zone provides hardware assisted trust;

storing a plurality of logs of communication service consumption differentiated by identifier in the trusted security zone; and

transmitting a message comprising the logs of the communication service consumption over a trusted end-to-end communication channel to a server in a network of a service provider associated with the UE, wherein the logs are translated by the server to a format compatible with a billing data store supported by a billing server, wherein the translated logs are transmitted to the billing data store, wherein a bill is created for each of the primary identifier based on the monitored communication service consumption of the plurality of different communication services associated with the primary identifier and the secondary identifier based on the monitored communication service consumption of the plurality of different communication services associated with the secondary identifier by the billing server accessing the billing data store.

10. The method of claim 9, wherein the UE is one of a smart phone, a laptop computer, a notebook computer, a tablet computer, a personal digital assistant (PDA), a media player, a headset computer, a wearable computer, a game console, an Internet digital media streaming device, a television, a set top box, a portable storage device, a hotspot, a 2.5 Wi-Fi translator, an Internet of Things (IoT) device, or another network/communications capable device.

11. The method of claim 9, wherein the UE establishes a wireless communication with a radio access network according to a code division multiple access (CDMA) wireless communication protocol, a global system for mobile communication (GSM) wireless communication protocol, a long-term evolution (LTE) wireless communication protocol, or a world-wide interoperability for microwave access (WiMAX) wireless communication protocol.

12. The method of claim 9, wherein the identifier is one of a phone number, a uniform resource identifier (URI), or a uniform resource locator (URL).

13. The method of claim 9, wherein the message comprising the logs of the communication service consumption is transmitted to the server using the trusted end-to-end communication channel periodically.

14. The method of claim 13, wherein non-network related activity is monitored by the witness application.

15. The method of claim 9, wherein the secondary identifier is deposited to the user equipment via the trusted security zone.

16. The method of claim 9, wherein a service order code (SOC) is assigned specifically to the secondary identifier.

17. A method of providing wireless communication service to a user equipment (UE) from a foreign wireless network supported by a foreign wireless communication service provider that is different from a home wireless network that is supported by a home service provider of the UE, comprising:

attempting by the UE to register to roam on the foreign wireless network;

receiving a denial message by the UE, where the denial message denies roaming on the foreign wireless network by the UE and comprises a link to a broker application that mediates access to the foreign wireless network;

downloading from the link in the denial message, by a trusted application on the UE, the broker application, wherein the trusted application executes in a trusted security zone of the UE, wherein the trusted security zone provides hardware assisted trust;

installing, by the broker application, a network access key into the trusted security zone of the UE for the foreign wireless network, wherein the broker application executes in the trusted security zone;

presenting, by the broker application, credentials to the foreign wireless network, wherein the credentials comprise the network access key;

examining, by a foreign wireless communication service provider server, the network access key presented by the UE; and

responsive to the network access key being validated based on the examining results, granting, by the foreign wireless communication service provider server, network access of the foreign wireless network to the UE.

18. The method of claim 17, wherein the user equipment is one of a smart phone, a laptop computer, a notebook computer, a tablet computer, a personal digital assistant (PDA), a media player, a headset computer, a wearable computer, a game console, an Internet digital media streaming device, a television, a set top box, a portable storage device, a hotspot, a 2.5 Wi-Fi translator, an Internet of Things (IoT) device, or another network/communications capable device.

19. The method of claim 17, wherein payment information is provided to the foreign wireless communication service provider via the broker application when the broker application is downloaded.

20. The method of claim 17, further comprising monitoring communication service consumption associated with the foreign wireless network and reporting the monitored communication service consumption to the foreign wireless communication service provider server.