SECURITY TECHNIQUES FOR DEVICE ASSISTED SERVICES

• US 20100199325A1
• Filed: 01/27/2010
• Published: 08/05/2010
• Est. Priority Date: 01/28/2009
• Status: Active Grant

• Current Assignee: Headwater Research LLC (Greg Raleigh)
• Original Assignee: Headwater Partners I LLC (Greg Raleigh)
• Inventors: Raleigh, Gregory G.
• Granted Patent: US 8,391,834 B2
• Time in Patent Office: Days
• US Class Current: 726/3
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/55 Detecting local intrusion or implementing counter-measures
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: G06F 2221/2115 Third party
• CPC Class Codes: G06F 2221/2149 Restricted operating environment
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: G06Q 10/06375 Prediction of business process outcome or impact based on a proposed change
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0207 Discounts or incentives, e.g. coupons or rebates
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: G06Q 30/0284 Time or distance, e.g. usage of parking meters or taximeters
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 41/0806 : for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0876 : Aspects of the degree of configuration automation
• CPC Class Codes: H04L 41/0893 : Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/5003 : Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5025 : by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
• CPC Class Codes: H04L 41/5054 : Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/20 : Traffic policing
• CPC Class Codes: H04L 47/2408 : for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 51/046 : Interoperability with other network applications or services
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/04 : for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 : by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/145 : the attack involving the propagation of malware through the network, e.g. viruses, trojans or worms
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/145 : avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/58 : based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/61 : based on the service used
• CPC Class Codes: H04M 15/80 : Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/88 : Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 2215/0188 : Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04W 12/00 : Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 : of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/088 : using filters or firewalls
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 28/02 : Traffic management, e.g. flow control or congestion control
• CPC Class Codes: H04W 28/0215 : based on user or device properties, e.g. MTC-capable devices services for machine-to-machine communication [M2M] or machine type communication [MTC] H04W4/70; wireless resource selection or allocation plan definition based on terminal or device properties H04W72/51
• CPC Class Codes: H04W 28/0268 : using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] negotiating SLA or negotiating QoS H04W28/24
• CPC Class Codes: H04W 28/12 : using signalling between network elements
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/18 : Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals
• CPC Class Codes: H04W 4/20 : Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/14 : using user query or user detection
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 8/02 : Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/18 : Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 8/20 : Transfer of user or subscriber data
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/08 : Access point devices
• CPC Class Codes: Y02P 90/80 : Management or planning

Abstract

Security techniques for device assisted services are provided. In some embodiments, secure service measurement and/or control execution partition is provided. In some embodiments, implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control of the communications device use of a service on a wireless network, in which the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network; monitoring use of the service based on the service profile; and verifying the use of the service based on the monitored use of the service.

Claims

1. A system, comprising:

a processor of a communications device configured to;

implement a service profile executed at least in part in a secure execution environment for assisting control of the communications device use of a service on a wireless network, wherein the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network;

monitor use of the service based on the service profile; and

verify the use of the service based on the monitored use of the service;

a memory of the communications device coupled to the processor and configured to provide the processor with instructions.

2. The system recited in claim 1, wherein the use of the service is verified based at least in is part on device based service usage information.

3. The system recited in claim 1, wherein the communications device is a mobile communications device or an intermediate networking device, and the service includes one or more Internet based services.

4. The system recited in claim 1, wherein the communications device includes a modem, and the processor is located in the modem.

5. The system recited in claim 1, wherein the communications device is a mobile communications device, and the service includes one or more Internet based services, and wherein the mobile communications device includes one or more of the following:

a mobile phone, a PDA, an eBook reader, a music device, an entertainment/gaming device, a computer, laptop, a netbook, a tablet, and a home networking system.

6. The system recited in claim 1, wherein the service plan allows for access to the service with service capabilities that are controlled based on one or more of the following:

period of time, network address, service type, content type, application type, bandwidth, and data usage.

7. The system recited in claim 1, wherein the service policy settings include one or more of the following:

access control settings, traffic control settings, billing system settings, user notification with acknowledgement settings, user notification with synchronized service usage information, user privacy settings, user preference settings, authentication settings, admission control settings, application access settings, content access settings, transaction settings, and network or device management communication settings.

8. The system recited in claim 1, wherein the secure execution environment includes a protected device assisted service execution partition.

9. The system recited in claim 1, wherein the secure execution environment includes a protected device assisted service execution partition, and wherein the protected device assisted service execution partition is implemented at least in part as a hardware partition.

10. The system recited in claim 1, wherein the secure execution environment includes a protected device assisted service execution partition, and wherein the protected device assisted service execution partition is implemented at least in part as a software partition.

11. The system recited in claim 1, wherein the secure execution environment includes a protected device assisted service execution partition, and wherein the protected device assisted service execution partition is implemented at least in part in a virtual machine executed on the processor.

12. The system recited in claim 1, wherein the secure execution environment includes a protected device assisted service execution partition, and the processor is further configured to:

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition are in communication with a server executing a service controller.

13. The system recited in claim 1, wherein the secure execution environment includes a protected device assisted service execution partition, and the processor is further configured to:

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition include a device agent for providing a service usage measure.

14. The system recited in claim 1, wherein the secure execution environment includes a protected device assisted service execution partition, and the processor is further configured to:

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition are in secure communication with a server executing a service controller, and wherein the secure communication with the server executing the service controller includes encrypted communications.

15. The system recited in claim 1, wherein the communications device includes a modem, and the processor is located in the modem, and wherein the secure execution environment includes a secure modem execution partition that is implemented using a hardware and/or software partition, and wherein the processor is further configured to:

execute one or more device assisted service agents in the secure modem execution partition, wherein the device assisted service agents executed in the secure modem execution partition are in communication with a server executing a service controller.

16. The system recited in claim 1, wherein the communications device includes a modem, and the processor is located in the modem, and wherein the secure execution environment includes a secure modem execution partition that is implemented using a hardware and/or software partition, and wherein the processor is further configured to:

execute one or more device assisted service agents in the secure modem execution partition, wherein the device assisted service agents executed in the secure modem execution partition are in secure communication with a server executing a service controller, and wherein the secure communication with the server executing the service controller includes encrypted communications.

17. The system recited in claim 1, wherein the communications device includes a modem, and the processor is located in the modem, and wherein the secure execution environment includes a secure modem execution partition that is implemented using a hardware and/or is software partition, and wherein the processor is further configured to:

execute one or more device assisted service agents in the secure modem execution partition, wherein one or more device assisted service agents executed in the secure modem execution partition include a modem agent for providing service usage measure.

18. The system recited in claim 1, wherein the processor of the communications device is further configured to:

execute one or more device assisted service agents in a kernel execution partition; and

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition are in communication with a server executing a service controller.

19. The system recited in claim 1, wherein the processor of the communications device is further configured to:

execute one or more device assisted service agents in an application execution partition;

execute one or more device assisted service agents in a kernel execution partition; and

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition are in communication with a server executing a service controller.

20. The system recited in claim 1, wherein the processor of the communications device is further configured to:

execute one or more device assisted service agents in an application execution partition;

execute one or more device assisted service agents in a kernel execution partition;

execute one or more device assisted service agents in a modem execution partition; and

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition are in communication with a server is executing a service controller.

21. The system recited in claim 1, wherein the processor of the communications device is further configured to:

execute one or more device assisted service agents in an application execution partition;

execute one or more device assisted service agents in a kernel execution partition;

execute one or more device assisted service agents in a modem execution partition; and

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition are in communication with a server executing a service controller, and wherein the one or more device assisted service agents executed in the protected device assisted service execution partition include one or more of the following;

an application identifier agent, an access control integrity agent, a policy control agent, a policy implementation agent, and a service usage measure agent.

22. The system recited in claim 1, wherein the processor of the communications device is further configured to:

execute one or more device assisted service agents in an application execution partition;

execute one or more device assisted service agents in a kernel execution partition;

execute one or more device assisted service agents in a modem execution partition, wherein the modem execution partition is in communication with the protected device assisted execution partition using a modem local channel; and

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition are in communication with a server executing a service controller, and wherein the one or more device assisted service agents executed in the protected device assisted service execution partition include one or more of the following;

an application identifier agent, an access control integrity agent, a policy control agent, a policy implementation agent, and a service usage measure agent.

23. The system recited in claim 1, wherein the processor of the communications device is is further configured to:

execute one or more device assisted service agents in an application execution partition;

execute one or more device assisted service agents in a kernel execution partition;

execute one or more device assisted service agents in a modem execution partition, wherein the modem execution partition is in communication with the protected device assisted execution partition using a modem local channel, and wherein the one or more device assisted service agents in the modem execution partition include a service usage measure agent; and

execute one or more device assisted service agents in the protected device assisted service execution partition, wherein the one or more device assisted service agents executed in the protected device assisted service execution partition in communication with a server executing a service controller, and wherein the one or more device assisted service agents executed in the protected device assisted service execution partition include one or more of the following;

an application identifier agent, an access control integrity agent, a policy control agent, a policy implementation agent, and a service usage measure agent.

24. A method, comprising:

implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control of the communications device use of a service on a wireless network, wherein the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network;

monitoring use of the service based on the service profile; and

verifying the use of the service based on the monitored use of the service.

25. A computer program product, the computer program product being embodied in a computer readable storage medium and comprising computer instructions for:

implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control of the communications device use of a service on a wireless network, wherein the service profile includes a plurality of service is policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network;

monitoring use of the service based on the service profile; and

verifying the use of the service based on the monitored use of the service.