Verifiable and accurate service usage monitoring for intermediate networking devices

• US 8,467,312 B2
• Filed: 04/12/2012
• Issued: 06/18/2013
• Est. Priority Date: 01/28/2009
• Status: Active Grant

• Current Assignee: Headwater Research LLC (Greg Raleigh)
• Original Assignee: Headwater Partners I LLC (Greg Raleigh)
• Inventors: Raleigh, Gregory G.
• Primary Examiner(s): Huq, Obaidul
• Application Number:
  US13/445,134
• Publication Number:
  US 20120195222A1
• Time in Patent Office: 432 Days
• Field of Search: 370/229, 370/230, 370/241, 370/252, 370/351, 370/389, 370/395.1, 370/395.2, 370/395.21, 370/395.4, 370/395.42, 370/395.43
• US Class Current: 370/252
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: G06Q 10/06375 Prediction of business process outcome or impact based on a proposed change
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0207 Discounts or incentives, e.g. coupons or rebates
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: G06Q 30/0284 Time or distance, e.g. usage of parking meters or taximeters
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0876 Aspects of the degree of configuration automation
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 : Policy-based network configuration management
• CPC Class Codes: H04L 41/5003 : Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5025 : by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
• CPC Class Codes: H04L 41/5054 : Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/20 : Traffic policing
• CPC Class Codes: H04L 47/2408 : for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 51/046 : Interoperability with other network applications or services
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/04 : for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 : by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/145 : avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/49 : Connection to several service providers
• CPC Class Codes: H04M 15/58 : based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/61 : based on the service used
• CPC Class Codes: H04M 15/66 : Policy and charging system
• CPC Class Codes: H04M 15/80 : Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/8055 : Selecting cheaper transport technology for a given service
• CPC Class Codes: H04M 15/88 : Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 2215/0188 : Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04W 12/00 : Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 : of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 28/02 : Traffic management, e.g. flow control or congestion control
• CPC Class Codes: H04W 28/0215 : based on user or device properties, e.g. MTC-capable devices services for machine-to-machine communication [M2M] or machine type communication [MTC] H04W4/70; wireless resource selection or allocation plan definition based on terminal or device properties H04W72/51
• CPC Class Codes: H04W 28/0268 : using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] negotiating SLA or negotiating QoS H04W28/24
• CPC Class Codes: H04W 28/12 : using signalling between network elements
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/18 : Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals
• CPC Class Codes: H04W 4/20 : Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/14 : using user query or user detection
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 8/02 : Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/18 : Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 8/20 : Transfer of user or subscriber data
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/08 : Access point devices
• CPC Class Codes: Y02P 90/80 : Management or planning

Abstract

Various embodiments are disclosed for a services policy communication system and method. In some embodiments, an intermediary networking device provides a service intermediary or intermediate connection between a network and one or more communications devices; implements a service policy set for assisting control of the intermediate networking device use of a service on the network, in which the service policy set includes one or more service policies, each policy being associated with either the intermediate networking device or a communications device; and monitors use of the service based on the service policy set; and in which the one or more of the communication devices include a service usage notification capability, and the implementation of the first service policy set is verified.

Claims

1. A first end point device comprising:

an access network modem capable of communicating data over at least one access network;

a local area network modem capable of communicating the data with one or more additional end point devices over a local area network;

one or more forwarding agents capable of forwarding the data between the access network modem and the local area network modem according to an access network forwarding policy to implement a forwarding service;

one or more additional agents capable of;

obtaining integrity information based on one or more aspects of the forwarding service, the integrity information comprising state information regarding a state of the one or more forwarding agents, the state information comprising an identifier of software comprising at least a portion of the one or more forwarding agents, the identifier being a hash or signature of the software comprising at least a portion of the one or more forwarding agents,

determining whether the hash or signature of the software comprising at least a portion of the one or more forwarding agents is consistent with an expected hash or signature, and

preventing the software comprising at least a portion of the one or more forwarding agents from loading into memory or executing on the first end point device if the hash or signature of the software comprising at least a portion of the one or more forwarding agents is not consistent with the expected hash or signature.

2. The first end point device of claim 1, wherein the one or more forwarding agents include a policy implementation agent capable of forwarding data in a communication stack of the first end point device, and a firewall agent capable of passing, routing, or redirecting the data to an access network routing path, a traffic tunnel, a network address, a network destination, a network end point, or a combination of these according to the access network forwarding policy.

3. The first end point device of claim 1, wherein the state information further comprises one or more configuration parameters for configuring an implementation of the forwarding service by the one or more forwarding agents, and wherein the one or more additional agents are further capable of using at least an aspect of the one or more configuration parameters to assist in the implementation of the forwarding service by the one or more forwarding agents.

4. The first end point device of claim 3, wherein the configuration parameters indicate:

whether to allow the forwarding service;

one or more access networks over which the forwarding service is authorized;

a number of additional end point devices allowed to use the forwarding service;

a limit for aggregate traffic through the access network modem;

one or more limits on usage of the forwarding service by one or more of the one or more additional end point devices;

an access network route, tunnel identifier, network address, network destination identifier, network end point identifier, or traffic redirection to be used by the one or more forwarding agents for communicating the data over the access network;

or a combination of these.

5. The first end point device of claim 3, wherein the one or more additional agents are further capable of preventing the configuration parameters from loading into memory on the first end point device if a hash or signature of the one or more configuration parameters is inconsistent with an expected signature or hash.

6. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in implementing a limitation or restriction on which networks over which the forwarding service is allowed.

7. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in limiting an amount of data communicated via the access network modem or an amount of data communicated via the local area network modem.

8. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in routing, directing, or re-directing traffic associated with the first end point device based on network destination information, network source information, a network traffic routing identifier, a network traffic tunnel identifier, traffic data content, or a combination of these.

9. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in routing, directing, or re-directing traffic associated with the first end point device based on a port address, a uniform resource location (URL), a domain name, an IP address, a MAC address, an end point device identifier (ID), a user ID, an end point device application layer tag, an end point credential, a user credential, or a combination of these.

10. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in routing, directing, or redirecting traffic associated with the first end point device based on information about HTTP layer traffic parameters or application layer traffic parameters.

11. The first end point device of claim 1, wherein the integrity information further comprises a result of a scan for potentially malicious code that performs an unauthorized change to the forwarding service, and wherein the one or more additional agents are further capable of using the result of the scan to assist in determining whether the forwarding service is being properly implemented.

12. The first end point device of claim 1, wherein the local area network modem provides a connection via at least one of Bluetooth, Wi-Fi, or USB, and wherein the access network modem provides a connection via at least one 2G, 3G, or 4G.

13. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in implementing a restriction on at least an aspect of traffic associated with the first end point device, wherein the restriction comprises not allowing at least a portion of the traffic associated with the first end point device.

14. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in implementing a restriction on at least an aspect of traffic associated with the one or more additional end point devices, wherein the restriction comprises not allowing at least a portion of traffic associated with at least one of the one or more additional end point devices.

15. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in implementing a restriction on at least an aspect of traffic associated with the first end point device, the restriction comprising not allowing a connection for the first end point device, or not allowing a connection for at least one of the one or more additional end point devices.

16. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in implementing a traffic control of at least an aspect of traffic associated with the first end point device or traffic associated with at least one of the one or more additional end point devices, wherein the traffic control comprises routing, directing, or redirecting the traffic associated with the first end point device or the traffic associated with at least one of the one or more additional end point devices to an access network routing path, a traffic tunnel, a network address, a network destination, a network end point, or a combination of these.

17. The first end point device of claim 1, wherein the one or more forwarding agents are further capable of:

determining that a user of the first end point device or a user of one of the one or more additional end point devices is attempting to use the forwarding service or is successfully using the forwarding service,

determining that the access network forwarding policy does not allow the forwarding service, and

based on determining that the user of the first end point device or the user of one of the one or more additional end point devices is attempting to use the forwarding service or is successfully using the forwarding service, and based on determining that the access network forwarding policy does not allow the forwarding service, taking an action, the action comprising assisting in causing a first notification to be presented through a user interface of the first end point device, assisting in causing a second notification to be presented through a user interface of a second end point device of the one or more additional end point devices, restricting at least an aspect of traffic associated with the first end point device, or a combination of these.

18. The first end point device of claim 17, wherein the action comprises assisting in causing the first notification to be presented on the user interface of the first end point device, the first notification for presenting information through the user interface of the first end point device, the information indicating that a current service plan status of the first end point device does not provide for the forwarding service.

19. The first end point device of claim 17, wherein the action comprises assisting in causing the first notification to be presented through the user interface of the first end point device, the first notification offering a forwarding option, the forwarding option for enabling the forwarding service.

20. The first end point device of claim 19, wherein the one or more additional agents are further capable of:

accepting a user input through the user interface of the first end point device, the user input indicating whether the forwarding option has been selected;

if the user input indicates that the forwarding option has been selected, configuring the access network forwarding policy to allow traffic associated with the one or more additional end point devices; and

if the user input indicates that the forwarding option has not been selected, configuring the access network forwarding policy not to allow the traffic associated with the one or more additional end point devices.

21. The first end point device of claim 17, wherein the action comprises assisting in causing the second notification to be presented through the user interface of the second end point device of the one or more additional end point devices, the second notification offering a forwarding option, the forwarding option for enabling the forwarding service for at least the second end point device.

22. The first end point device of claim 17, wherein the access network forwarding policy is based on a user selection indicating whether a forwarding option providing for the forwarding service has been selected by a user.

23. The first end point device of claim 17, wherein the action comprises restricting at least an aspect of traffic associated with the first end point device, and wherein restricting the at least an aspect of traffic associated with the first end point device comprises not allowing at least a portion of the traffic associated with the first end point device.

24. The first end point device of claim 17, wherein the action comprises restricting at least an aspect of traffic associated with the first end point device, and wherein restricting the at least an aspect of traffic associated with the first end point device comprises not allowing at least a portion of traffic associated with at least one of the one or more additional end point devices.

25. The first end point device of claim 17, wherein the action comprises restricting at least an aspect of traffic associated with the first end point device, and wherein restricting the at least an aspect of traffic associated with the first end point device comprises not allowing a connection for the first end point device, or not allowing a connection for at least one of the one or more additional end point devices.

26. The first end point device of claim 17, wherein the one or more additional agents are further capable of determining that the first end point device is providing the forwarding service to at least one of the one or more additional end point devices, and determining whether the first end point device providing the forwarding service to the at least one of the one or more additional end point devices is in accordance with the access network forwarding policy.

27. The first end point device of claim 17, wherein the action comprises restricting at least an aspect of traffic associated with the first end point device, and wherein restricting the at least an aspect of traffic associated with the first end point device comprises communicating some or all of the traffic associated with the first end point device to a quarantine service.

28. The first end point device of claim 27, wherein the one or more additional agents are further capable of providing the quarantine service, and wherein providing the quarantine service comprises:

offering, through the user interface of the first end point device, a service sign-up website, a service sign-up wireless application protocol (WAP) site, or a service sign-up portal, the service sign-up website, the service sign-up WAP site, or the service sign-up portal providing an offer for the forwarding service,

accepting, through the service sign-up website, the service sign-up WAP site, or the service sign-up portal, a user input through the user interface, the user input indicating whether a user accepts the offer, and

if the user input indicates that the user accepts the offer, configuring the wireless access network forwarding policy to allow the forwarding service.

29. The first end point device of claim 27, wherein the one or more additional agents are further capable of providing the quarantine service, and wherein providing the quarantine service comprises:

offering, through the user interface of a particular end point device of the one or more additional end point devices, a service sign-up website, a service sign-up wireless application protocol (WAP) site, or a service sign-up portal, the service sign-up website, the service sign-up WAP site, or the service sign-up portal providing an offer for the forwarding service to the particular end point device,

accepting, through the service sign-up website, the service sign-up WAP site, or the service sign-up portal, a user input through the user interface of the particular end point device, the user input indicating whether a user accepts the offer, and

if the user input indicates that the user accepts the offer, configuring the access network forwarding policy to allow the forwarding service for at least the particular end point device.

30. The first end point device of claim 17, wherein the one or more additional agents are further capable of:

accounting for at least a portion or an aspect of usage of the forwarding service; and

generating a usage record based on the usage of the forwarding service.

31. The first end point device of claim 17, wherein the one or more additional agents are further capable of:

obtaining a configuration or setting from the one or more forwarding agents, and

based on the obtained configuration or setting, determining whether the one or more forwarding agents are compliant with the access network forwarding policy.

32. The first end point device of claim 17, wherein the action comprises assisting in causing a first notification to be presented through a user interface of the first end point device, the first user notification comprising an offer to allow at least one of the one or more additional end point devices to use the forwarding service.

33. The first end point device of claim 32, wherein the one or more additional agents are further capable of:

obtaining a response to the first notification, and

if the response to the first notification indicates acceptance of the offer, configuring the access network forwarding policy to allow usage of the forwarding service by the at least one of the one or more additional end point devices.

34. The first end point device of claim 1, wherein the one or more forwarding agents or the one or more additional agents are capable of obtaining at least an aspect of the access network forwarding policy from a network element.

35. The first end point device of claim 1, wherein the one or more forwarding agents or the one or more additional agents are capable of obtaining at least an aspect of the access network forwarding policy from a first end point device memory that is configured during manufacturing, distribution, or sale of the first end point device.

36. The first end point device of claim 1, wherein the one or more forwarding agents are further capable of implementing a roaming network forwarding policy when the wireless access network is a roaming network.

37. The first end point device of claim 36, wherein the roaming network forwarding policy assists the one or more forwarding agents or the one or more additional agents or both in:

determining that the wireless access network is a roaming network,

identifying an attempted or successful use of the forwarding service, and

based on determining that the wireless access network is a roaming network, and based on identifying the attempted or successful use of the forwarding service, presenting a notification through a user interface of the first end point device, the notification indicating that the first end point device is providing the forwarding service on the roaming network.

38. The first end point device of claim 37, wherein the one or more forwarding agents or the one or more additional agents are further capable of obtaining, through the user interface of the first end point device, a response to the notification.

39. The first end point device of claim 38, wherein the roaming network forwarding policy assists the one or more forwarding agents in preventing use of the forwarding service unless or until the one or more forwarding agents or the one or more additional agents obtain the response to the notification.

40. The first end point device of claim 37, wherein the notification comprises a service purchase offer enabling a user of the first end point device to purchase a roaming forwarding service, and wherein the one or more forwarding agents or the one or more additional agents are further capable of:

obtaining a user response indicating acceptance of the offer, and

assisting in providing the user response to a network element.

41. The first end point device of claim 40, wherein the roaming network forwarding policy assists the one or more forwarding agents in preventing use of the forwarding service unless or until the one or more forwarding agents or the one or more additional agents obtain the user response indicating acceptance of the offer.

42. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in directing or re-directing traffic associated with the one or more additional end point devices based on network destination information, network source information, a network traffic routing identifier, a network traffic tunnel identifier, traffic data content, or a combination of these.

43. The first end point device of claim 1, wherein the access network forwarding policy comprises one or more settings or instructions to assist the one or more forwarding agents in directing or re-directing traffic associated with the one or more additional end point devices based on a port address, a uniform resource location (URL), a domain name, an IP address, a MAC address, an end point device identifier (ID), a user ID, an end point device application layer tag, an end point credential, a user credential, or a combination of these.