Verifiable service policy implementation for intermediate networking devices

• US 8,516,552 B2
• Filed: 04/04/2012
• Issued: 08/20/2013
• Est. Priority Date: 01/28/2009
• Status: Active Grant

• Current Assignee: Headwater Research LLC (Greg Raleigh)
• Original Assignee: Headwater Partners I LLC (Greg Raleigh)
• Inventors: Raleigh, Gregory G.
• Primary Examiner(s): Colin, Carl
• Assistant Examiner(s): Siddiqi, Mohammad A
• Application Number:
  US13/439,788
• Publication Number:
  US 20120192249A1
• Time in Patent Office: 503 Days
• Field of Search: 455/405, 455/406, 455/422, 455/423, 726/1, 726/15, 726/2, 709/217, 370/251, 370/252, 370/235
• US Class Current: 726/2
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: G06Q 10/06375 Prediction of business process outcome or impact based on a proposed change
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0207 Discounts or incentives, e.g. coupons or rebates
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: G06Q 30/0284 Time or distance, e.g. usage of parking meters or taximeters
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0876 Aspects of the degree of configuration automation
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 : Policy-based network configuration management
• CPC Class Codes: H04L 41/5003 : Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5025 : by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
• CPC Class Codes: H04L 41/5054 : Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/20 : Traffic policing
• CPC Class Codes: H04L 47/2408 : for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 51/046 : Interoperability with other network applications or services
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/04 : for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 : by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/145 : avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/49 : Connection to several service providers
• CPC Class Codes: H04M 15/58 : based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/61 : based on the service used
• CPC Class Codes: H04M 15/66 : Policy and charging system
• CPC Class Codes: H04M 15/80 : Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/8055 : Selecting cheaper transport technology for a given service
• CPC Class Codes: H04M 15/88 : Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 2215/0188 : Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04W 12/00 : Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 : of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 28/02 : Traffic management, e.g. flow control or congestion control
• CPC Class Codes: H04W 28/0215 : based on user or device properties, e.g. MTC-capable devices services for machine-to-machine communication [M2M] or machine type communication [MTC] H04W4/70; wireless resource selection or allocation plan definition based on terminal or device properties H04W72/51
• CPC Class Codes: H04W 28/0268 : using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] negotiating SLA or negotiating QoS H04W28/24
• CPC Class Codes: H04W 28/12 : using signalling between network elements
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/18 : Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals
• CPC Class Codes: H04W 4/20 : Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/14 : using user query or user detection
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 8/02 : Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/18 : Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 8/20 : Transfer of user or subscriber data
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/08 : Access point devices
• CPC Class Codes: Y02P 90/80 : Management or planning

Abstract

A first wireless end-user communication device comprising a user interface and at least one processor configured to: use a forwarding agent on the first wireless end-user communication device to forward traffic between a first wireless access network and one or more other wireless end-user communication devices according to a forwarding policy to implement a forwarding service, the forwarding policy associated with one or more policy settings, the one or more other wireless end-user communication devices communicatively coupled to the first wireless end-user communication device over a wireless local area network or a wireless personal area network; obtain, through the user interface, a modification request to modify an aspect of the forwarding service; modify at least one of the one or more policy settings based at least in part on the modification request; and provide an accounting of a usage associated with the forwarding service.

Claims

1. A first wireless end-user communication device, comprising:

a user interface;

at least one processor configured to;

use a forwarding agent on the first wireless end-user communication device to forward first traffic between a first wireless access network and one or more other wireless end-user communication devices according to a forwarding policy to implement a forwarding service, the forwarding policy associated with one or more policy settings, the one or more other wireless end-user communication devices communicatively coupled to the first wireless end-user communication device over a wireless local area network or a wireless personal area network,

use the forwarding agent on the first wireless end-user communication device to forward second traffic between a second wireless access network and the one or more other wireless end-user communication devices,

obtain, through the user interface, a modification request to modify an aspect of the forwarding service,

modify at least one of the one or more policy settings based at least in part on the modification request, and

provide an accounting of a usage associated with the forwarding service, wherein the accounting of the usage associated with the forwarding service comprises a measure of usage of the forwarding service over the first wireless access network or over the second wireless access network; and

memory coupled to the at least one processor and configured to provide the at least one processor with instructions.

2. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is configured to communicate a state of the forwarding service to a network element communicatively coupled to the wireless end-user communication device over the first wireless access network or over the second wireless access network.

3. The first wireless end-user communication device recited in claim 1, wherein the at least one of the one or more policy settings assists in controlling whether the forwarding service is active, enabled, or available to the one or more other wireless end-user communication devices.

4. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to receive at least a portion of the forwarding policy or at least a portion of the one or more policy settings from a network element communicatively coupled to the first wireless end-user communication device over the first wireless access network or over the second wireless access network.

5. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to receive a forwarding policy setting instruction from a network element communicatively coupled to the first wireless end-user communication device over the first wireless access network or over the second wireless access network.

6. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to receive at least a portion of the forwarding policy or at least a portion of the one or more policy settings over a secure channel established between the first wireless end-user communication device and a network element communicatively coupled to the first wireless end-user communication device over the first wireless access network or over the second wireless access network.

7. The first wireless end-user communication device recited in claim 1, further comprising an agent configured to detect availability of one or more wireless access networks on which to use the forwarding service, the one or more wireless access networks including the first wireless access network or the second wireless access network.

8. The first wireless end-user communication device recited in claim 7, wherein the at least one processor is further configured to provide a user notification when the agent detects availability of the one or more wireless access networks on which to use the forwarding service.

9. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to enable or disable the forwarding service for at least a subset of the one or more other wireless end-user communication devices.

10. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to provide, through the user interface, an indication that the forwarding service is active, enabled, or available to the one or more other wireless end-user communication devices.

11. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to notify a user of the first wireless end-user communication device when the forwarding service is active, enabled, or available over a roaming network, or when at least one of the one or more other wireless end-user communication devices attempts to use the forwarding service over the roaming network.

12. The first wireless end-user communication device recited in claim 1, wherein at least a portion of the one or more policy settings is based on whether the first wireless access network is a home network or a roaming network.

13. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to implement a different forwarding service characteristic in accordance with the forwarding policy based on identification information of a particular device of the one or more other wireless end-user communication devices or identification information of a particular user of the particular device.

14. The first wireless end-user communication device recited in claim 1, further comprising a device agent, and wherein the device agent is configured to notify a user when one of the one or more other wireless end-user communication devices attempts to connect to or use, or succeeds in connecting to or using, the forwarding service.

15. The first wireless end-user communication device recited in claim 1, wherein the at least one of the one or more policy settings establishes whether a particular device of the one or more other wireless end-user communication devices is allowed to use the forwarding service.

16. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to execute an authentication process before modifying the at least one of the one or more policy settings.

17. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to pass or redirect the first traffic to one or more particular access network routing paths of the first wireless access network according to the forwarding policy.

18. The first wireless end-user communication device recited in claim 1, wherein at least a portion of the forwarding policy is stored in an environment secure from user or application modification.

19. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to verify that the forwarding policy does not include unauthorized code.

20. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to:

receive at least a portion of the forwarding policy or at least a portion of the one or more policy settings over a secure link established between the first wireless end-user communication device and a network element communicatively coupled to the first wireless end-user communication device over the first wireless access network or over the second wireless access network, and

verify the at least a portion of the forwarding policy or the at least a portion of the one or more policy settings using a signature, a certificate, a hash, or a version configuration.

21. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to examine an execution environment or a storage environment of the forwarding policy.

22. The first wireless end-user communication device recited in claim 1, wherein the forwarding agent is stored in an environment secure from user or application modification.

23. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to verify the forwarding agent using a signature, a certificate, a hash, or a version configuration.

24. The first wireless end-user communication device recited in claim 1, wherein at least a portion of the one or more policy settings is stored in an environment secure from tampering.

25. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to verify that the at least one of the one or more policy settings has not been tampered with.

26. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to provide, through the user interface, an offer to enable the forwarding service, and wherein the modification request comprises an indication that a user has accepted the offer to enable the forwarding service.

27. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to notify a user of the first wireless end-user communication device of a forwarding service payment term.

28. The first wireless end-user communication device recited in claim 27, wherein the at least one processor is further configured to send a user acknowledgement to a network element communicatively coupled to the first wireless end-user communication device over the first wireless access network or over the second wireless access network to indicate user acceptance of the forwarding service payment term.

29. The first wireless end-user communication device recited in claim 26, wherein the at least one processor is further configured to obtain information associated with the offer to enable the forwarding service from a network element communicatively coupled to the first wireless end-user communication device over the first wireless access network or over the second wireless access network.

30. The first wireless end-user communication device recited in claim 26, wherein the at least one processor is further configured to send, to a network system communicatively coupled to the first wireless end-user communication device over the first wireless access network or over the second wireless access network, an indication that the user has accepted the offer.

31. The first wireless end-user communication device recited in claim 1, wherein the forwarding agent is configured to assist in implementing a service plan over the first wireless access network or over the second wireless access network, the service plan including the forwarding service, and wherein the service plan is associated with one or more policies.

32. The first wireless end-user communication device recited in claim 31, wherein the one or more policies include one or more accounting policies, one or more notification policies, one or more control policies, or a combination of these.

33. The first wireless end-user communication device recited in claim 1, wherein the forwarding agent comprises software.

34. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to present a notification through the user interface, the notification indicating that the forwarding service is not available to the first wireless end-user communication device.

35. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to present a notification through the user interface, the notification providing an option to enable the forwarding service, and wherein the modification request comprises a response to the notification.

36. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to control at least an aspect of the first traffic or at least an aspect of the second traffic.

37. The first wireless end-user communication device recited in claim 36, wherein control at least an aspect of the first traffic or at least an aspect of the second traffic comprises do not allow at least a portion of the first traffic or at least a portion of the second traffic.

38. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to assist in presenting a notification through a user interface of a particular device of the one or more other wireless end-user communication devices, the notification presenting an option for enabling the forwarding service for at least the particular device.

39. The first wireless end-user communication device recited in claim 38, wherein the at least one processor is further configured to obtain a response to the notification from the particular device.

40. The first wireless end-user communication device recited in claim 1, wherein provide an accounting of a usage associated with the forwarding service comprises present a measure of the usage of the forwarding service through the user interface.

41. The first wireless end-user communication device recited in claim 1, wherein provide an accounting of a usage associated with the forwarding service comprises present an estimate of the usage associated with the forwarding service through the user interface.

42. The first wireless end-user communication device recited in claim 1, wherein provide an accounting of a usage associated with the forwarding service comprises send information about a measure of the usage associated with the forwarding service to a network element communicatively coupled to the wireless end-user communications device over the first wireless access network or over the second wireless access network.

43. The first wireless end-user communication device recited in claim 1, wherein provide an accounting of a usage associated with the forwarding service comprises provide information about a measure of the usage associated with the forwarding service to at least one of the one or more other wireless end-user communication devices.

44. The first wireless end-user communication device recited in claim 1, wherein the accounting of a usage associated with the forwarding service comprises a measure of a usage of the forwarding service associated with a particular device of the one or more other wireless end-user communication devices.

45. The first wireless end-user communication device recited in claim 1, wherein the at least one of the one or more policy settings sets a limit on how many of the one or more other wireless end-user communication devices are allowed to use the forwarding service.

46. The first wireless end-user communication device recited in claim 1, wherein the one or more other wireless end-user communication devices comprise at least a second wireless end-user communication device and a third wireless end-user communication device, and wherein the accounting of a usage associated with the forwarding service comprises an aggregate measure of usage of the forwarding service, the aggregate measure comprising at least a first measure of usage of the forwarding service associated with the second wireless end-user communication device and a second measure of usage of the forwarding service associated with the third wireless end-user communication device.

47. The first wireless end-user communication device recited in claim 46, wherein the at least one processor is further configured to apply a control to the forwarding service based on the aggregate measure.

48. The first wireless end-user communication device recited in claim 46, wherein the at least one processor is further configured to provide a notification based on the aggregate measure.

49. The first wireless end-user communication device recited in claim 48, wherein provide a notification based on the aggregate measure comprises send a report to a network element communicatively coupled to the first wireless end-user communication device over the first wireless access network or over the second wireless access network.

50. The first wireless end-user communication device recited in claim 48, wherein provide a notification based on the aggregate measure comprises present the notification through the user interface.

51. The first wireless end-user communication device recited in claim 1, wherein the accounting of a usage associated with the forwarding service comprises a measure of usage of the forwarding service associated with the one or more other wireless end-user communication devices.

52. The first wireless end-user communication device recited in claim 1, wherein the first wireless access network is a home network and the second wireless access network is a roaming network.

53. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to restrict at least a portion of the usage of the forwarding service, the at least a portion of the usage of the forwarding service being associated with at least one of the one or more other wireless end-user communication devices.

54. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to provide information about the forwarding service to at least one of the one or more other wireless end-user communication devices.

55. The first wireless end-user communication device recited in claim 54, wherein the information about the forwarding service comprises first information about the first wireless access network or second information about the second wireless access network.

56. The first wireless end-user communication device recited in claim 54, wherein the information about the forwarding service comprises first information about a first cost associated with usage of the first wireless access network or second information about a second cost associated with usage of the second wireless access network.

57. The first wireless end-user communication device recited in claim 54, wherein the information about the forwarding service comprises information about a cost associated with the forwarding service, information about a home network, information about a roaming network, information about a roaming condition, an offer to enable the forwarding service, or a combination of these.

58. The first wireless end-user communication device recited in claim 1, wherein the first wireless end-user communication device is associated with a service plan, and wherein the at least one processor is further configured to determine that the first wireless end-user communication device is not operating in accordance with the service plan.

59. The first wireless end-user communication device recited in claim 1, wherein the at least one processor is further configured to determine that the first wireless end-user communication device is not operating in accordance with the forwarding policy.

60. The first wireless end-user communication device recited in claim 59, wherein the at least one processor is further configured to take an action based on the determination that the first wireless end-user communication device is not operating in accordance with the forwarding policy.

61. The first wireless end-user communication device recited in claim 60, wherein the action comprises restricting or blocking at least an aspect of the first traffic, directing at least a portion of the first traffic to a quarantine service or server, restricting or blocking at least an aspect of the second traffic, directing at least a portion of the second traffic to the quarantine service or server, or a combination of these.

62. The first wireless end-user communication device recited in claim 60, wherein the action comprises causing a first notification to be presented through the user interface, causing a second notification to be sent to an administrator or a user, causing a third notification to be sent to at least one of the one or more wireless end-user communication devices, causing a message to be sent to a network element, or a combination of these.

63. The first wireless end-user communication device recited in claim 59, wherein determine that the first wireless end-user communication device is not operating in accordance with the forwarding policy comprises:

determine that the forwarding policy does not authorize the forwarding service, and

determine that the forwarding service is being used by or is or available to the one or more other wireless end-user communication devices.

64. The first wireless end-user communication device recited in claim 1, wherein the aspect of the forwarding service establishes whether the forwarding service is active, enabled, or available to the one or more other wireless end-user communication devices.

65. The first wireless end-user communication device recited in claim 1, wherein the aspect of the forwarding service is a limit on how many of the one or more other wireless end-user communication devices are allowed to use the forwarding service.

66. The first wireless end-user communication device recited in claim 1, wherein the first wireless access network is a first cellular network and the second wireless access network is a second cellular network.