Method and system for enabling data usage accounting through a relay

• US 10,410,154 B2
• Filed: 07/24/2017
• Issued: 09/10/2019
• Est. Priority Date: 09/05/2014
• Status: Active Grant

• Current Assignee: Vmware LLC (Broadcom, Inc.)
• Original Assignee: VMware, Inc. (Broadcom, Inc.)
• Inventors: Asnis, James
• Primary Examiner(s): King, John B
• Application Number:
  US15/658,015
• Publication Number:
  US 20170330122A1
• Time in Patent Office: 778 Days
• CPC Class Codes: G06Q 10/06313 Resource planning in a project environment
• CPC Class Codes: H04L 12/1403 Architecture for metering, charging or billing
• CPC Class Codes: H04L 12/1435 volume-based
• CPC Class Codes: H04L 12/1496 involving discounts
• CPC Class Codes: H04L 43/0876 Network utilisation, e.g. volume of load or congestion level
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 67/14 Session management for real-time applications in data packet communications networks H04L65/1066
• CPC Class Codes: H04L 67/141 Setup of application sessions admission control or resource allocation in data switching networks H04L47/70
• CPC Class Codes: H04L 67/563 Data redirection of data network streams
• CPC Class Codes: H04W 12/08 Access security
• CPC Class Codes: H04W 12/37 Managing security policies for mobile devices or for controlling mobile applications

Abstract

A method and system for enabling data usage accounting is described herein. The method can be practiced on a computing device that has secure applications and unsecure applications installed thereon. Initially, a request for a data session that includes a final endpoint can be received through a secure application. The request for the data session can be intercepted and modified to cause the request to be re-directed back to the secure application. A connection with a relay server can be initiated instead of the final endpoint such that data usage accounting for the data session is to be conducted at a remote location.

Claims

1. A computing device that is configured to support segregated data usage accounting, comprising:

a display that is configured to display both personal applications and enterprise applications that are installed on the computing device, wherein the enterprise applications are associated with an enterprise that has designated the enterprise applications for enterprise data usage accounting that is to be segregated from data usage accounting for the personal applications; and

a processing unit that is communicatively coupled to the display, wherein the processing unit is configured to;

detect a data session request from an enterprise application among the enterprise applications to exchange data with an intended external entity;

redirect the data session request from the intended external entity to a relay component that is remotely located from the computing device and that is configured to facilitate the data session request between the enterprise application and the intended external entity and to perform a remote enterprise data usage accounting of the data session request;

authenticate the computing device with the relay component to establish a connection with the relay component; and

buffer the data associated with the data session request while the connection is established with the relay component.

2. The computing device according to claim 1, wherein the processing unit is further configured to re-write addressing information associated with the data session request to cause redirection of the data session request from the intended external entity to the relay component.

3. The computing device according to claim 1, wherein the enterprise application is a secure application.

4. The computing device according to claim 1, wherein the processing unit is further configured to cause redirection of the data session request from the intended external entity to the relay component in a transparent manner with respect to the enterprise application from which the data session request is detected.

5. The computing device according to claim 1, wherein the computing device is configured to support a secure workspace that isolates the enterprise applications from the personal applications that are installed on the computing device.

6. The computing device according to claim 1, wherein a data usage total associated with the data session request is determined remotely from the computing device.

7. The computing device according to claim 1, wherein the relay component is configured to perform both the data exchange and the remote enterprise data usage accounting.

8. The computing device according to claim 1, wherein:

the data session request includes a final endpoint for retrieval of content; and

the processing unit is further configured to provide the final endpoint to the relay component to enable the relay component to establish a connection with the final endpoint.

9. The computing device according to claim 1, wherein the processing unit is further configured to limit redirection to only the enterprise applications.

10. A method to support segregated data usage accounting, comprising:

having at least one personal application and at least one enterprise application installed on a computing device, wherein the at least one enterprise application is associated with an enterprise for enterprise data usage accounting that is to be segregated from data usage accounting for the at least one personal application;

detecting a data session request from the at least one enterprise application to exchange data with an intended external entity;

redirecting the data session request from the intended external entity to a relay component that is remotely located from the computing device and that is configured to facilitate the data session request between the at least one enterprise application and the intended external entity and to perform a remote enterprise data usage accounting of the data session request;

authenticating the computing device with the relay component to establish a connection with the relay component; and

buffer the data associated with the data session request while the connection is established with the relay component.

11. The method according to claim 10, wherein the redirecting comprises re-writing addressing information associated with the data session request to cause redirection of the data session request from the intended external entity to the relay component.

12. The method according to claim 10, wherein the at least one enterprise application is a secure application.

13. The method according to claim 10, wherein the redirecting the data session request from the intended external entity to the relay component occurs a transparent manner with respect to the at least one enterprise application from which the data session request is detected.

14. The method according to claim 10, wherein the computing device is configured to support a secure workspace that isolates the at least one enterprise application from the personal application on the computing device.

15. The method according to claim 10, wherein a data usage total associated with the data session request is determined remotely from the computing device.

16. The method according to claim 10, wherein the relay component is configured to perform both the data exchange and the remote enterprise data usage accounting.

17. The method according to claim 10, wherein:

the data session request includes a final endpoint for retrieval of content; and

the method further comprises providing the final endpoint to the relay component to enable the relay component to establish a connection with the final endpoint.

18. A computing device that is configured to support segregated data usage accounting, comprising:

a display that is configured to display both personal applications and enterprise applications that are installed on the computing device, wherein the enterprise applications are designated for enterprise data usage accounting that is to be segregated from data usage accounting for the personal applications; and

a processing unit that is communicatively coupled to the display, wherein the processing unit is configured to;

detect a data session request from an enterprise application among the enterprise applications to exchange data with an intended external entity;

redirect the data session request from the intended external entity to a relay component that is remotely located from the computing device and that is configured to facilitate the data session request between the enterprise application and the intended external entity and to perform a remote enterprise data usage accounting of the data session request;

authenticate the computing device with the relay component to establish a connection with the relay component; and

buffer the data associated with the data session request while the connection is established with the relay component.

19. The computing device according to claim 18, wherein the processing unit is further configured to re-write addressing information associated with the data session request to cause redirection of the data session request from the intended external entity to the relay component.

20. The computing device according to claim 18, wherein:

the data session request includes a final endpoint for retrieval of content; and

the processing unit is further configured to provide the final endpoint to the relay component to enable the relay component to establish a connection with the final endpoint.