Verifiable device assisted service policy implementation

• US 20100188975A1
• Filed: 03/02/2009
• Published: 07/29/2010
• Est. Priority Date: 01/28/2009
• Status: Active Grant

• Current Assignee: Headwater Research LLC (Greg Raleigh)
• Original Assignee: Greg Raleigh
• Inventors: Raleigh, Gregory G.
• Granted Patent: US 8,270,310 B2
• Time in Patent Office: Days
• US Class Current: 370/230.100
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: G06Q 10/06375 Prediction of business process outcome or impact based on a proposed change
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0207 Discounts or incentives, e.g. coupons or rebates
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: G06Q 30/0284 Time or distance, e.g. usage of parking meters or taximeters
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0876 Aspects of the degree of configuration automation
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 : Policy-based network configuration management
• CPC Class Codes: H04L 41/5003 : Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5025 : by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
• CPC Class Codes: H04L 41/5054 : Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/20 : Traffic policing
• CPC Class Codes: H04L 47/2408 : for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 51/046 : Interoperability with other network applications or services
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/04 : for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 : by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/145 : avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/49 : Connection to several service providers
• CPC Class Codes: H04M 15/58 : based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/61 : based on the service used
• CPC Class Codes: H04M 15/66 : Policy and charging system
• CPC Class Codes: H04M 15/80 : Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/8055 : Selecting cheaper transport technology for a given service
• CPC Class Codes: H04M 15/88 : Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 2215/0188 : Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04W 12/00 : Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 : of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 28/02 : Traffic management, e.g. flow control or congestion control
• CPC Class Codes: H04W 28/0215 : based on user or device properties, e.g. MTC-capable devices services for machine-to-machine communication [M2M] or machine type communication [MTC] H04W4/70; wireless resource selection or allocation plan definition based on terminal or device properties H04W72/51
• CPC Class Codes: H04W 28/0268 : using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] negotiating SLA or negotiating QoS H04W28/24
• CPC Class Codes: H04W 28/12 : using signalling between network elements
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/18 : Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals
• CPC Class Codes: H04W 4/20 : Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/14 : using user query or user detection
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 8/02 : Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/18 : Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 8/20 : Transfer of user or subscriber data
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/08 : Access point devices
• CPC Class Codes: Y02P 90/80 : Management or planning

Abstract

Various embodiments are disclosed for a services policy communication system and method. In some embodiments, a communications device implements a service policy for assisting control of the communications device use of a service on a network; and monitors use of the service based on the service policy, in which the implementation of the service policy is verified.

Claims

1. A system, comprising:

a processor of a communications device configured to;

implement a first service policy for assisting control of the communications device use of a first service on a first network; and

monitor use of the first service based on the first service policy; and

a memory of the communications device coupled to the processor and configured to provide the processor with instructions,

wherein the implementation of the first service policy is verified.

2. The system recited in claim 1, wherein the communications device is a mobile communications device, and the first service includes one or more Internet based services.

3. The system recited in claim 1, wherein the communications device is a mobile communications device, and the first service includes one or more Internet based services, and wherein the mobile communications device includes one or more of the following:

a mobile phone, a PDA, an eBook reader, a music device, an entertainment/gaming device, a computer, laptop, a netbook, and a home networking system.

4. The system recited in claim 1, wherein the communications device includes a modem, and the processor is located in the modem.

5. The system recited in claim 1, wherein the communications device includes a secure access module, and wherein a service monitor is stored in the secure access module.

6. The system recited in claim 1, wherein the communications device includes a secure access module, and wherein a local service usage counter is stored in the secure access module.

7. The system recited in claim 1, wherein the first service policy includes one or more of the following:

access control settings, traffic control settings, billing system settings, user notification with acknowledgement settings, user notification with synchronized service usage information, user privacy settings, user preference settings, authentication settings, admission control settings, application access settings, content access settings, transaction settings, and network or device management communication settings.

8. The system recited in claim 1, wherein the implementation of the first service policy is verified in the device.

9. The system recited in claim 1, wherein the implementation of the first service policy is verified in the first network.

10. The system recited in claim 1, wherein the implementation of the first service policy is verified by a network device in communication with the first network.

11. The system recited in claim 1, wherein the implementation of the first service policy is verified by a network device in communication with the first network, wherein the network device includes one or more of the following:

a billing system;

a AAA system;

a gateway;

a router;

a switch;

a network server;

a device that generates, aggregates, manages or stores CDRs;

a base station controller; and

a base station.

12. The system recited in claim 1, wherein the implementation of the first service policy is verified using a network based service usage measure.

13. The system recited in claim 1, wherein the implementation of the first service policy is verified by performing one or more of the following:

compare a network based service usage measure with the first service policy, compare, a device assisted service usage measure with the first service policy, compare the network based service usage measure to the device assisted service usage measure, and verify presence of an activation tracking system on the communications device.

14. The system recited in claim 1, wherein the implementation of the first service policy is verified by performing one or more of the following:

compare a network based service usage measure with the first service policy, compare a device assisted service usage measure with the first service policy, compare the network based service usage measure to the device assisted service usage measure, compare a first device assisted service usage measure to a second device assisted service usage measure, verify presence of a service processor, verify configuration of the service processor, verify billing events are reported properly, compare the network based service usage measure with reported device billing data, verify reporting of a test billing event, verify reporting of the communications device reports billing events from a transaction server, verify presence of an activation tracking system, verify device configuration or operation, verify device standing or service plan standing, verify proper operation of the service processor, verify service processor heartbeat response reports, verify monitoring of a test service event, download a new service processor and perform integrity checks, verify a service processor code configuration with agent self-diagnosis checks, verify that the communications device uses the first service only after being authorized, verify user standing, and verify an agent communications log.

15. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform a responsive action if the use of the first service on the first network is out of policy based on the first service policy.

16. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform a responsive action if the use of the first service on the first network is out of policy based on the first service policy, wherein the responsive action includes one or more of the following;

quarantine the communications device, suspend the communications device, bill for a service usage overage, route or copy device traffic to a device behavior analysis function, and notify a network manager or network troubleshooting function.

17. The system recited in claim 1, wherein the communications device is quarantined if it is determined that the communications device has been tampered with or compromised.

18. The system recited in claim 1, wherein the communications device is suspended if it is determined that the communications device has been tampered with or compromised.

19. The system recited in claim 1, wherein the processor of the communications device is further configured to:

store a first service policy setting, wherein the first service policy setting is associated with a first service policy record in the first network.

20. The system recited in claim 1, wherein the processor of the communications device is further configured to:

store a first service policy setting, wherein the first service policy setting is associated with a first service policy record for the communications device in the first network, and wherein the first service policy setting includes one or more of the following;

a register setting, a software or hardware configuration, one or more executable instructions, and an executable program.

21. The system recited in claim 1, wherein the processor of the communications device is further configured to:

store a service usage limit setting, wherein a service account associated with the communications device or a user of the communications device is billed for a service cost overage when the use of the first service by the communications device exceeds the service usage limit setting, wherein the service usage limit setting is associated with a service usage level record stored in a network device.

22. The system recited in claim 1, wherein the processor of the communications device is further configured to:

determine if the use of the first service by the communications device is out of policy based on device assisted service usage information and the first service policy.

23. The system recited in claim 1, wherein whether the use of the first service by the communications device is out of policy is determined in the first network.

24. The system recited in claim 1, wherein whether the use of the first service by the communications device is out of policy is determined based on network based service usage information and the first service policy.

25. The system recited in claim 1, wherein a service account associated with the communications device or a user of the communications device is billed for a service cost overage when it is determined that the use of the first service by the communications device is out of policy based on the first service policy.

26. The system recited in claim 1, wherein a service account associated with the communications device or a user of the communications device is billed for a service cost overage when the use of the first service by the communications device exceeds a service usage limit setting stored locally in the communications device, wherein the service usage limit setting is associated with a service usage level record stored in a network device.

27. The system recited in claim 1, wherein a service account associated with the communications device or a user of the communications device is billed for a service cost overage when it is determined that the use of the first service by the communications device is out of policy based on network service usage information and the first service policy.

28. The system recited in claim 1, wherein the processor of the communications device is further configured to:

measure service usage at one or more points in the communications device, wherein a service account associated with the communications device or a user of the communications device is billed when it is determined that the use of the first service by the communications device is out of policy based on the measured service usage information and the first service policy.

29. The system recited in claim 1, wherein the processor of the communications device is further configured to:

implement a second service policy for assisting control of the communications device use of a first service on a second network; and

monitor use of the first service based on the second service policy,

wherein the implementation of the second service policy is verified.

30. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform an integrity check of a service processor on the communications device, wherein the service processor implements the first service policy and monitors use of the first service based on the first service policy.

31. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform an integrity check of a service processor on the communications device, wherein the service processor implements the first service policy and monitors use of the first service based on the first service policy, and wherein the integrity check includes one or more of the following;

collect information on the first service usage, agent configuration, and agent behavior;

cross check the collected information to identify integrity breaches in the first service policy implementation;

perform asynchronous or periodic checks to verify presence, configuration or proper operation of agents of the service processor; and

perform a challenge-response sequence verification of agents of the service processor.

32. The system recited in claim 1, wherein the processor of the communications device is further configured to:

receive network based service usage information for the communications device; and

determine if the use of the first service by the communications device is out of policy based on the network based service usage information and the first service policy.

33. The system recited in claim 1, wherein the processor of the communications device is further configured to:

receive network based service usage information for the communications device, wherein the network based service usage information for the communications device is based on one or more CDRs, and wherein the network based service usage information is received from one or more of the following;

a billing system;

a AAA system;

a gateway;

a router;

a switch;

a network server;

a device that generates, aggregates, manages or stores CDRs;

a base station controller; and

a base station; and

determine if the use of the first service by the communications device is out of policy based on the network based service usage information and the first service policy.

34. The system recited in claim 1, wherein the processor of the communications device is further configured to:

receive network based service usage information for the communications device; and

compare the network based service usage information to device based service usage information.

35. The system recited in claim 1, wherein the processor of the communications device is further configured to:

measure service usage at a plurality of points in the communications device;

compare the measured service usage to the first service policy; and

perform a responsive action if the measured service usage is out of policy based on the first service policy.

36. The system recited in claim 1, wherein the processor of the communications device is further configured to:

measure service usage at a plurality of points in the communications device;

compare the measured service usage at the plurality of points; and

perform a responsive action if the measured service usage at the plurality of points indicates that the device has been tampered with or compromised.

37. The system recited in claim 1, wherein the processor of the communications device is further configured to:

compare the monitored use of the first service by the communications device to the first service policy; and

control use of the first service by the communications device based on the first service policy.

38. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform traffic shaping if the monitored use of the first service is out of policy based on the first service policy.

39. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform application layer based traffic shaping if the monitored use of the first service is out of policy based on the first service policy.

40. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform application layer based traffic shaping based on user input if the monitored use of the first service is out of policy based on the first service policy.

41. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform application layer traffic shaping based on a user selected application.

42. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform traffic shaping based on one or more privacy settings if the monitored use of the first service is out of policy based on the first service policy.

43. The system recited in claim 1, wherein the processor of the communications device is further configured to:

measure service usage in the communications device using application layer tagging for a user selected application.

44. The system recited in claim 1, wherein the processor of the communications device is further configured to:

perform traffic shaping based on network capacity information for the first network.

45. The system recited in claim 1, wherein the processor of the communications device is further configured to:

monitor configuration or operation of a service processor executing on the processor, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy.

46. The system recited in claim 1, wherein the processor of the communications device is further configured to:

execute a service processor in a secure execution environment, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy.

47. The system recited in claim 1, wherein the processor of the communications device is further configured to:

execute a service processor, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy, and wherein the service processor is located in a secure storage of the communications device.

48. The system recited in claim 1, wherein the processor of the communications device is further configured to:

execute a service processor, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy, and wherein the service processor is located in one or more of the following;

a memory, non-volatile memory, an external memory, a processor, a modem, an external modem, and an external communications bus, of the communications device.

49. The system recited in claim 1, wherein the processor of the communications device is further configured to:

download a service processor, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy.

50. The system recited in claim 1, wherein the processor of the communications device is further configured to:

download a component of a service processor, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy.

51. The system recited in claim 1, wherein the processor of the communications device is further configured to:

download a component of a service processor based on one or more of the following;

a time based event, a periodic event, in response to a request, in response to a service processor malfunction or error, a service processor integrity check, and in response to a service processor integrity check error, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy.

52. The system recited in claim 1, wherein the processor of the communications device is further configured to:

periodically report configuration or operation of the communications device to a network device, the report including service usage information.

53. The system recited in claim 1, wherein the processor of the communications device is further configured to:

periodically report configuration or operation of a service processor executing on the processor to a service controller, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy, and the service controller communicates with the service processor.

54. The system recited in claim 1, wherein the processor of the communications device is further configured to:

report configuration or operation of a service processor executing on the processor in response to a polling request from a service controller, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy, and the service controller communicates with the service processor.

55. The system recited in claim 1, wherein the processor of the communications device is further configured to:

send a report including configuration or operation information of the communications device to a service controller, wherein a service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy, and the service controller communicates with the service processor, and wherein the report is sent based on one or more of the following;

a time based event, a service data usage based event, a request from the service controller, a polling request from the service controller, a request from a billing server, and an error condition related to the communications device.

56. The system recited in claim 1, wherein the processor of the communications device is further configured to:

send a response to a challenge/response query from a service controller, the response including information based on configuration or operation of the communications device, wherein the service controller communicates with a service processor.

57. The system recited in claim 1, wherein the processor of the communications device is further configured to:

send a response to a test service usage sequence from a service controller, wherein the service controller communicates with a service processor.

58. The system recited in claim 1, wherein the processor of the communications device is further configured to:

send a response to a test service billing sequence from a service controller, wherein the service controller communicates with a service processor.

59. The system recited in claim 1, wherein the processor of the communications device is further configured to:

control access to the first network based on one or more of the following;

a network address identifier, an application type, a service type, a content type, a time of day, and an associated service usage level.

60. The system recited in claim 1, wherein the processor of the communications device is further configured to:

control traffic based on one or more of the following;

a network address identifier, an application type, a service type, a content type, a time of day, and an associated service usage level.

61. The system recited in claim 1, wherein the processor of the communications device is further configured to:

report service usage for the communications device based on one or more of the following;

a network address identifier, an application type, a service type, a content type, a time of day, and an associated service usage level.

62. The system recited in claim 1, wherein the processor of the communications device is further configured to:

report service usage for the communications device to a third party network, wherein the third party network associated with one or more of the following;

an enterprise associated with a service plan for the communications device, a person associated with the service plan for the communications device, and one or more parents of a user of the communications device.

63. A system, comprising:

a processor of a communications device configured to;

implement a first service policy for assisting control of the communications device use of a first service on a first network;

monitor use of the first service based on the first service policy; and

communicate control channel information over a control channel, wherein the control channel information includes information related to the first service policy implementation, and wherein a network bandwidth required for communicating the control channel information is reduced by associating a frequency of communication or an amount of data in each communication with a service usage level for the first service; and

a memory of the communications device coupled to the processor and configured to provide the processor with instructions.

64. The system recited in claim 63, wherein the control channel is a secure communication channel.

65. The system recited in claim 63, wherein the processor of the communications device is further configured to:

verify a service processor executing on the processor using periodic communications over the control channel to a service controller, wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy, and the service controller communicates with the service processor to continuously verify the service processor.

66. The system recited in claim 63, wherein the processor of the communications device is further configured to:

execute a service processor, wherein the service processor communicates over the control channel to a service controller, and wherein the service processor implements the first service policy and monitors use of the first service by the communications device based on the first service policy, and the service controller is located in a central provider network, a private network, or Internet.

67. A method, comprising:

implementing a first service policy for assisting control of a communications device use of a first service on a first network;

monitoring use of the first service based on the first service policy using a processor of the communications device, wherein the implementation of the first service policy is verified.

68. A computer program product, the computer program product being embodied in a computer readable storage medium and comprising computer instructions for:

implementing a first service policy for assisting control of a communications device use of a first service on a first network;

monitoring use of the first service based on the first service policy, wherein the implementation of the first service policy is verified.