Verifiable device assisted service policy implementation

• US 8,270,310 B2
• Filed: 03/02/2009
• Issued: 09/18/2012
• Est. Priority Date: 01/28/2009
• Status: Active Grant

• Current Assignee: Headwater Research LLC (Greg Raleigh)
• Original Assignee: Headwater Partners I LLC (Greg Raleigh)
• Inventors: Raleigh, Gregory G.
• Primary Examiner(s): SINKANTARAKORN, PAWARIS
• Application Number:
  US12/380,759
• Publication Number:
  US 20100188975A1
• Time in Patent Office: 1,296 Days
• Field of Search: 370252-253, 370/465, 370/468, 709223-226
• US Class Current: 370/252
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: G06Q 10/06375 Prediction of business process outcome or impact based on a proposed change
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0207 Discounts or incentives, e.g. coupons or rebates
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: G06Q 30/0284 Time or distance, e.g. usage of parking meters or taximeters
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0876 Aspects of the degree of configuration automation
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 : Policy-based network configuration management
• CPC Class Codes: H04L 41/5003 : Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5025 : by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
• CPC Class Codes: H04L 41/5054 : Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/20 : Traffic policing
• CPC Class Codes: H04L 47/2408 : for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 51/046 : Interoperability with other network applications or services
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/04 : for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 : by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/145 : avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/49 : Connection to several service providers
• CPC Class Codes: H04M 15/58 : based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/61 : based on the service used
• CPC Class Codes: H04M 15/66 : Policy and charging system
• CPC Class Codes: H04M 15/80 : Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/8055 : Selecting cheaper transport technology for a given service
• CPC Class Codes: H04M 15/88 : Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 2215/0188 : Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04W 12/00 : Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 : of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 28/02 : Traffic management, e.g. flow control or congestion control
• CPC Class Codes: H04W 28/0215 : based on user or device properties, e.g. MTC-capable devices services for machine-to-machine communication [M2M] or machine type communication [MTC] H04W4/70; wireless resource selection or allocation plan definition based on terminal or device properties H04W72/51
• CPC Class Codes: H04W 28/0268 : using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] negotiating SLA or negotiating QoS H04W28/24
• CPC Class Codes: H04W 28/12 : using signalling between network elements
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/18 : Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals
• CPC Class Codes: H04W 4/20 : Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/14 : using user query or user detection
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 8/02 : Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/18 : Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 8/20 : Transfer of user or subscriber data
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/08 : Access point devices
• CPC Class Codes: Y02P 90/80 : Management or planning

Abstract

Various embodiments are disclosed for a services policy communication system and method. In some embodiments, a communications device implements a service policy for assisting control of the communications device use of a service on a network; and monitors use of the service based on the service policy, in which the implementation of the service policy is verified.

Claims

1. A system, comprising:

an end user device including;

an access modem configured to communicate with an access network that provides a network service;

memory configured to store a local service control policy; and

a policy implementation agent configured to implement the local service control policy on the end user device, the local service control policy for assisting in control of the end user device'"'"'s use of the network service on the access network; and

an access control integrity element configured to;

obtain a first measure of the end user device'"'"'s usage of the network service;

verify whether the policy implementation agent is properly implementing a proper service control policy by determining whether the first usage measure is consistent with the proper service control policy being properly implemented on the end user device; and

identify the end user device as being not compliant when the first usage measure is not consistent with the proper service control policy being properly implemented on the end user device

wherein the end user device further includes;

a first service monitor configured to monitor use of the network service by the end user device, wherein the first service monitor is configured to;

classify usage into a plurality of categories, each category corresponding to a different network service provided by the access network; and

determine a second usage measure for each category, wherein the second usage measures are provided to the access control integrity element for comparing to the first usage measure.

2. The system recited in claim 1, wherein the end user device is a mobile end user device, and the network service includes one or more Internet-based services.

3. The system recited in claim 1, wherein the policy implementation agent is located in the access modem.

4. The system recited in claim 1, wherein the access control integrity element is located in the end user device.

5. The system recited in claim 1, wherein the access control integrity element is located in the access network.

6. The system recited in claim 1, wherein the access control integrity element is on the end user device, and wherein a billing agent on the end user device is configured to bill a service account associated with the end user device or a user of the end user device for a service cost overage when the use of the network service by the end user device exceeds a service usage limit setting stored locally in the end user device, wherein the service usage limit setting is associated with a service usage level record stored in a network device.

7. The system recited in claim 1, wherein the end user device is configured to:

measure service usage at a plurality of points in a data path in the end user device, and wherein the access control integrity element is configured to;

compare the measured service usage at the plurality of points to each other; and

determine whether the end user device is noncompliant based on the comparison of the respective measured service usages.

8. The system recited in claim 1, wherein the end user device is configured to:

compare the monitored use of the network service by the end user device to the local service control policy; and

control use of the network service by the end user device based on the comparison, wherein the policy implementation agent is used to implement the control, and wherein the monitored use is different than the first usage measure.

9. The system recited in claim 1, wherein the policy implementation agent is configured to:

perform traffic shaping if the end user device is identified as not being compliant with the proper service control policy being properly implemented on the end user device.

10. The system of claim 1, wherein at least one of the policy implementation agent and the local service control policy are susceptible to compromise, and wherein a compromised state results in the end user device being identified as not compliant.

11. The system of claim 1, wherein the access control integrity element includes an access control integrity server on a network device, the access control integrity server configured to affect the continued use or cost of the network service when the access control integrity server identifies the end user device as not being compliant with the proper service control policy being properly implemented on the end user device.

12. The system of claim 1, wherein the access control integrity element is configured to determine whether the first usage measure is consistent with the proper service control policy being properly implemented on the end user device by comparing the first usage measure to one or more parameters of a service control policy setting, the one or more parameters defining compliant usage of the network service by the end user device.

13. The system of claim 12, wherein the one or more parameters of the proper service control policy include a range of expected usage of the network service by the end user device.

14. The system of claim 13, wherein the expected usage includes at least one of a total amount of usage, an amount of data in a period of time, and a number of times the network service is accessed.

15. The system of claim 13, wherein the range is determined by a statistical analysis of patterns of usage of the network service.

16. The system of claim 12, wherein the one or more parameters of the service control policy setting define an expected service activity behavior for the end user device'"'"'s use of the network service.

17. The system of claim 12, wherein the access control integrity element is configured to verify implementation of the policy implementation agent based on comparisons of a plurality of usage measures to a plurality of parameters of the service control policy setting.

18. The system of claim 12, wherein the one or more parameters include at least one of a limit on a total usage of the first service, a limit on a rate of usage of the first service, URLs or IP addresses that are blocked, and URLs or IP addresses that are permissible.

19. The system of claim 12, wherein the access control integrity element is configured to determine a projected usage based on the first usage measure, and wherein the comparing the first usage measure to the one or more parameters of the service control policy setting includes comparing the projected usage to the one or more parameters.

20. The system of claim 12, wherein the access control integrity element is further configured to compare the second usage measures against one or more parameters of a service control policy setting.

21. The system of claim 1, further comprising:

a network measurement device on the access network, wherein the network measurement device is configured to determine the first measure of usage of the network service by the end user device.

22. The system of claim 1, wherein the end user device further includes a secure measurement device configured to generate the first usage measure.

23. The system of claim 1, wherein the access control integrity element includes an access control integrity agent that is on the end user device and that is inaccessible to a user of the end user device.

24. The system of claim 1,

wherein the first service monitor is further configured to determine a third measure of the usage of the access network, and

wherein the access control integrity element is configured to:

receive the third usage measure; and

compare the third usage measure to the first usage measure to determine whether a difference is within a tolerance limit;

compare the first usage measure and/or the third usage measure to a limit on usage;

or

compare the first usage measure and/or the third usage measure to an expected usage.

25. The system of claim 1, wherein the access control integrity element is configured to cause the policy implementation agent to alter continued use or cost of the network service when the first usage measure is determined to be not consistent with the proper service control policy being properly implemented on the end user device.

26. The system of claim 1, wherein the access control integrity element is configured to cause a notification of a noncompliance condition to be provided to a user of the end user device when the first usage measure is determined to be not consistent with the proper service control policy being properly implemented on the end user device.

27. The system of claim 1, wherein the policy implementation agent implements a local service control policy specific to each category.

28. The system of claim 1, wherein the access control integrity element is configured to:

aggregate the second usage measures to obtain an aggregate result; and

compare the aggregate result to the first usage measure.

29. The system of claim 1, wherein the end user device is configured to receive the local service control policy from the access network.

30. A system, comprising:

an end user device including;

an access modem configured to communicate with an access network that provides a network service;

memory configured to store a service policy;

a policy implementation agent configured to implement the service policy, the service policy for assisting in providing a service plan for the end user device'"'"'s use of the network service on the access network;

a service monitor agent configured to;

monitor the end user device'"'"'s use of the network service based on the service policy;

measure service usage of the network service by the end user device;

classify the service usage into a plurality of categories, each category corresponding to a different network service provided by the access network; and

determine control channel information based on the service usage for each category, and

a service control device link configured to transmit at least a portion if the control channel information over a control channel in response to a trigger, the trigger being based on an amount of service usage of the network service by the end user device since a last transmission of control channel information.

31. The system recited in claim 30, wherein the control channel is a secure communication channel.

32. The system recited in claim 30, wherein the service control device link is further configured to transmit the control channel information over the control channel in response to another trigger, wherein the another trigger is a minimum amount of time between transmissions.

33. The system recited in claim 30, wherein the amount of service usage of the network service by the end user device is a number of messages.

34. A method, comprising:

obtaining a first measure of usage of a network service on an access network by an end user device, the end user device including a policy implementation agent configured to implement a local service control policy on the end user device, the local service control policy for assisting in control of the end user device'"'"'s use of the network service on the access network;

obtaining a second usage measure for each of a plurality of categories, each category corresponding to a different network service provided by the access network to the end user device;

comparing at least one of the second usage measures to the first usage measure;

verifying whether the implementation of the local service control policy is compliant by determining whether the first usage measure is consistent with a proper service control policy being properly implemented on the end user device; and

identifying the end user device as being not compliant when the first usage measure is not consistent with the proper service control policy being properly implemented on the end user device.

35. The method recited in claim 34, wherein the first usage measure is a network-based service usage measure, and wherein verifying whether the implementation of the local service control policy is compliant is performed in a service controller in the access network.

36. The method recited in claim 35, wherein the implementation of the local service control policy is further verified by comparing the network-based service usage measure to a device-assisted service usage measure sent by the end user device.

37. The method recited in claim 34, further comprising:

performing a responsive action if the end user device is identified as not being compliant with the local service control policy.

38. The method recited in claim 37, wherein the responsive action includes one or more of the following:

quarantine the end user device, suspend the end user device, bill for a service usage overage, route or copy device traffic to a device behavior analysis function, and notify a network manager or network troubleshooting function.

39. The method recited in claim 34, wherein verifying whether the first usage measure is consistent with the proper service control policy being properly implemented on the end user device is determined in the access network.

40. The method of claim 34, wherein the determining whether the first usage measure is consistent with the proper service control policy being properly implemented on the end user device includes:

comparing the first usage measure to one or more parameters of a service control policy setting, the one or more parameters defining a compliant usage of the network service by the end user device.

41. The method of claim 40, wherein the one or more parameters of the service control policy setting include a range of expected usage of the network service by the end user device.

42. The method of claim 41, wherein the range is determined by a statistical analysis of patterns of usage of the network service.

43. The method of claim 40, wherein the one or more parameters of the service control policy setting define an expected service activity behavior for the end user device'"'"'s use of the network service.

44. The method of claim 40, wherein determining whether the first usage measure is consistent with the proper service control policy being properly implemented on the end user device includes:

comparing a plurality of usage measures to a plurality of parameters of the service control policy setting.

45. The method of claim 40, further comprising:

comparing the second usage measures to the one or more parameters of the service control policy setting.

46. The method of claim 34, further comprising:

receiving a third measure of usage of the access network by the end user device, the third measure being measured by a service monitor on the end user device; and

comparing the third usage measure to the first usage measure to determine whether a difference is within a tolerance limit;

comparing at least one of the first usage measure and the third usage measure to a limit on usage;

or

comparing at least one of the first usage measure and the third usage measure to an expected usage.

47. The method of claim 34, wherein comparing the at least one of the second usage measures to the first usage measure includes:

aggregating the plurality of second usage measures to obtain an aggregate result; and

comparing the aggregate result to the first usage measure.

48. A computer program product, the computer program product being embodied in a non-transitory computer readable storage medium and comprising computer instructions executable by a processor for:

obtaining a first measure of usage of a network service on an access network by a end user device, the end user device including a policy implementation agent configured to implement a local service control policy on the end user device, the local service control policy for assisting in control of the end user device'"'"'s use of the network service on the access network;

obtaining a second usage measure for each of a plurality of categories, each category corresponding to a different network service provided by the access network to the end user device;

comparing at least one of the second usage measures to the first usage measure;

verifying whether the implementation of the local service control policy is compliant by determining whether the first usage measure is consistent with a proper service control policy being properly implemented on the end user device; and

identifying the end user device as being not compliant when the first usage measure is not consistent with the proper service control of policy being properly implemented on the end user device.

49. A system comprising:

a service controller on an access network, the access network providing a network service to an end user device, the end user device including a policy implementation agent configured to implement a local service control policy on the end user device, the local service control policy for assisting in control of the end user device'"'"'s use of the network service on the access network,

the service controller configured to verify whether the policy implementation agent is properly implementing a proper service control policy, the service controller including;

an access control integrity server configured to;

obtain a first measure of end user device'"'"'s usage of the network service;

obtain a second usage measure for each of a plurality of categories, each category corresponding to a different network service provided by the access network to the end user device;

compare at least one of the second usage measures to the first usage measure;

determine whether the first usage measure is consistent with the proper service control policy being properly implemented on the end user device; and

identify the end user device as being not compliant when the first usage measure is not consistent with the proper service control policy being properly implemented on the end user device.

50. The system of claim 49, wherein the access control integrity server is configured to determine whether the first usage measure is consistent with the proper service control policy being properly implemented on the end user device by comparing the first usage measure to one or more parameters of a service control policy setting, the one or more parameters defining a compliant usage of the network service by the end user device.

51. The system of claim 50, wherein the one or more parameters of the service control policy setting include a range of expected usage of the network service by the end user device.

52. The system of claim 51, wherein the range is determined by a statistical analysis of patterns of usage of the network service.

53. The system of claim 50, wherein the one or more parameters of the service control policy setting define an expected service activity behavior for the end user device'"'"'s use of the network service.

54. The system of claim 50, wherein the access control integrity server is configured to verify the implementation of the policy implementation agent based on comparisons of the second usage measures to the one or more parameters of the service control policy setting.

55. The system of claim 50, wherein the access control integrity server is configured to determine a projected usage based on the first usage measure, and wherein comparing the first usage measure to the one or more parameters of the service control policy setting includes comparing the projected usage to the one or more parameters.

56. The system of claim 49, further comprising:

a network measurement device on the access network, wherein the network measurement device is configured to determine the first measure of usage of the network service by the end user device, and wherein the access control integrity server is configured to obtain the first usage measure from the network measurement device.

57. The system of claim 49, wherein the access control integrity server is configured to:

receive a third measure of usage of the access network by the end user device, the third measure being measured by a service monitor on the end user device; and

compare the third usage measure to the first usage measure to determine whether a difference is within a tolerance limit;

compare at least one of the first usage measure and the third usage measure to a limit on usage;

or

compare at least one of the first usage measure and the third usage measure to an expected usage.

58. The system of claim 49, wherein the access control integrity server is configured to:

aggregate the second usage measures to obtain an aggregate result; and

compare the aggregate result to the first usage measure.

59. A system comprising:

means for obtaining a first measure of usage of a network service on an access network by a end user device, the end user device including a policy implementation agent configured to implement a local service control policy on the end user device, the local service control policy for assisting in control of the end user device'"'"'s use of the network service on the access network;

means for obtaining a second usage measure for each of a plurality of categories, each category corresponding to a different network service provided by the access network to the end user device;

means for comparing at least one of the second usage measures to the first usage measure;

means for verifying whether the implementation of the local service control policy is compliant by determining whether the first usage measure is consistent with a proper service control policy being properly implemented on the end user device; and

means for identifying the end user device as being not compliant when the first usage measure is not consistent with the proper service control policy being properly implemented on the end user device.