Network system with common secure wireless message service serving multiple applications on multiple wireless devices

• US 9,198,117 B2
• Filed: 03/24/2015
• Issued: 11/24/2015
• Est. Priority Date: 01/28/2009
• Status: Active Grant

• Current Assignee: Headwater Research LLC (Greg Raleigh)
• Original Assignee: Headwater Partners I LLC (Greg Raleigh)
• Inventors: Raleigh, Gregory G.
• Primary Examiner(s): RUDY, ANDREW J
• Application Number:
  US14/667,516
• Publication Number:
  US 20150200882A1
• Time in Patent Office: 245 Days
• Field of Search: 709/203, 709/204, 709/206, 709/207, 709/217, 709/219, 709/223, 713168-170, 705/28, 705/30, 455/405, 455/406, 455/411, 455/414.1
• US Class Current: 1/1
• CPC Class Codes: G06F 15/177 Initialisation or configuration control processor initialisation G06F9/4405
• CPC Class Codes: G06Q 10/06315 Needs-based resource requirements planning or analysis
• CPC Class Codes: G06Q 10/06375 Prediction of business process outcome or impact based on a proposed change
• CPC Class Codes: G06Q 20/102 Bill distribution or payments
• CPC Class Codes: G06Q 20/20 Point-of-sale [POS] network systems
• CPC Class Codes: G06Q 20/32 using wireless devices
• CPC Class Codes: G06Q 20/40 Authorisation, e.g. identification of payer or payee, verification of customer or shop credentials; Review and approval of payers, e.g. check credit lines or negative lists
• CPC Class Codes: G06Q 30/0207 Discounts or incentives, e.g. coupons or rebates
• CPC Class Codes: G06Q 30/0241 Advertisements
• CPC Class Codes: G06Q 30/0283 Price estimation or determination
• CPC Class Codes: G06Q 30/0284 Time or distance, e.g. usage of parking meters or taximeters
• CPC Class Codes: G06Q 30/04 Billing or invoicing
• CPC Class Codes: G06Q 30/0601 Electronic shopping [e-shopping]
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/12 Accounting
• CPC Class Codes: H04L 12/14 Charging , metering or billing arrangements for data wireline or wireless communications
• CPC Class Codes: H04L 12/1407 Policy-and-charging control [PCC] architecture
• CPC Class Codes: H04L 41/0806 for initial configuration or provisioning, e.g. plug-and-play
• CPC Class Codes: H04L 41/0876 Aspects of the degree of configuration automation
• CPC Class Codes: H04L 41/0893 Assignment of logical groups to network elements
• CPC Class Codes: H04L 41/0894 : Policy-based network configuration management
• CPC Class Codes: H04L 41/5003 : Managing SLA; Interaction between SLA and QoS
• CPC Class Codes: H04L 41/5025 : by proactively reacting to service quality change, e.g. by reconfiguration after service quality degradation or upgrade
• CPC Class Codes: H04L 41/5054 : Automatic deployment of services triggered by the service manager, e.g. service implementation by automatic configuration of network components
• CPC Class Codes: H04L 47/20 : Traffic policing
• CPC Class Codes: H04L 47/2408 : for supporting different services, e.g. a differentiated services [DiffServ] type of service
• CPC Class Codes: H04L 51/046 : Interoperability with other network applications or services
• CPC Class Codes: H04L 63/0236 : Filtering by address, protocol, port number or service, e.g. IP-address or URL
• CPC Class Codes: H04L 63/04 : for providing a confidential data exchange among entities communicating through data packet networks
• CPC Class Codes: H04L 63/0428 : wherein the data content is protected, e.g. by encrypting or encapsulating the payload
• CPC Class Codes: H04L 63/08 : for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/0853 : using an additional device, e.g. smartcard, SIM or a different communication terminal cryptographic mechanisms or cryptographic arrangements for entity authentication involving additional secure or trusted devices H04L9/3234
• CPC Class Codes: H04L 63/0892 : by using authentication-authorization-accounting [AAA] servers or protocols
• CPC Class Codes: H04L 63/10 : for controlling access to devices or network resources
• CPC Class Codes: H04L 63/20 : for managing network security; network security policies in general filtering policies H04L63/0227
• CPC Class Codes: H04L 67/145 : avoiding end of session, e.g. keep-alive, heartbeats, resumption message or wake-up for inactive or interrupted session
• CPC Class Codes: H04L 67/306 : User profiles
• CPC Class Codes: H04L 67/34 : involving the movement of software or configuration parameters network booting or remote initial program loading [RIPL] G06F9/4416
• CPC Class Codes: H04L 67/51 : Discovery or management thereof, e.g. service location protocol [SLP] or web services
• CPC Class Codes: H04L 67/55 : Push-based network services
• CPC Class Codes: H04L 67/564 : Enhancement of application control based on intercepted application data
• CPC Class Codes: H04L 67/63 : Routing a service request depending on the request content or context
• CPC Class Codes: H04L 9/32 : including means for verifying the identity or authority of a user of the system or for message authentication, e.g. authorization, entity authentication, data integrity or data verification, non-repudiation, key authentication or verification of credentials
• CPC Class Codes: H04L 9/3247 : involving digital signatures
• CPC Class Codes: H04M 15/00 : Arrangements for metering, time-control or time indication ; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP
• CPC Class Codes: H04M 15/49 : Connection to several service providers
• CPC Class Codes: H04M 15/58 : based on statistics of usage or network monitoring
• CPC Class Codes: H04M 15/61 : based on the service used
• CPC Class Codes: H04M 15/66 : Policy and charging system
• CPC Class Codes: H04M 15/80 : Rating or billing plans; Tariff determination aspects
• CPC Class Codes: H04M 15/8055 : Selecting cheaper transport technology for a given service
• CPC Class Codes: H04M 15/88 : Provision for limiting connection, or expenditure
• CPC Class Codes: H04M 2215/0188 : Network monitoring; statistics on usage on called/calling number
• CPC Class Codes: H04W 12/00 : Security arrangements; Authentication; Protecting privacy or anonymity
• CPC Class Codes: H04W 12/02 : Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII]
• CPC Class Codes: H04W 12/037 : of the control plane, e.g. signalling traffic
• CPC Class Codes: H04W 12/06 : Authentication
• CPC Class Codes: H04W 12/08 : Access security
• CPC Class Codes: H04W 12/37 : Managing security policies for mobile devices or for controlling mobile applications
• CPC Class Codes: H04W 24/08 : Testing, supervising or monitoring using real traffic
• CPC Class Codes: H04W 28/02 : Traffic management, e.g. flow control or congestion control
• CPC Class Codes: H04W 28/0215 : based on user or device properties, e.g. MTC-capable devices services for machine-to-machine communication [M2M] or machine type communication [MTC] H04W4/70; wireless resource selection or allocation plan definition based on terminal or device properties H04W72/51
• CPC Class Codes: H04W 28/0268 : using specific QoS parameters for wireless networks, e.g. QoS class identifier [QCI] or guaranteed bit rate [GBR] negotiating SLA or negotiating QoS H04W28/24
• CPC Class Codes: H04W 28/12 : using signalling between network elements
• CPC Class Codes: H04W 4/02 : Services making use of location information
• CPC Class Codes: H04W 4/12 : Messaging; Mailboxes; Announcements
• CPC Class Codes: H04W 4/18 : Information format or content conversion, e.g. adaptation by the network of the transmitted or received information for the purpose of wireless delivery to users or terminals
• CPC Class Codes: H04W 4/20 : Services signaling; Auxiliary data signalling, i.e. transmitting data via a non-traffic channel
• CPC Class Codes: H04W 4/24 : Accounting or billing
• CPC Class Codes: H04W 4/50 : Service provisioning or reconfiguring
• CPC Class Codes: H04W 48/14 : using user query or user detection
• CPC Class Codes: H04W 48/16 : Discovering, processing access restriction or access information
• CPC Class Codes: H04W 72/0453 : Resources in frequency domain, e.g. a carrier in FDMA
• CPC Class Codes: H04W 8/02 : Processing of mobility data, e.g. registration information at HLR [Home Location Register] or VLR [Visitor Location Register]; Transfer of mobility data, e.g. between HLR, VLR or external networks
• CPC Class Codes: H04W 8/18 : Processing of user or subscriber data, e.g. subscribed services, user preferences or user profiles; Transfer of user or subscriber data
• CPC Class Codes: H04W 8/20 : Transfer of user or subscriber data
• CPC Class Codes: H04W 84/04 : Large scale networks; Deep hierarchical networks
• CPC Class Codes: H04W 84/042 : Public Land Mobile systems, e.g. cellular systems
• CPC Class Codes: H04W 84/12 : WLAN [Wireless Local Area Networks]
• CPC Class Codes: H04W 88/06 : adapted for operation in multiple networks or having at least two operational modes, e.g. multi-mode terminals
• CPC Class Codes: H04W 88/08 : Access point devices
• CPC Class Codes: Y02P 90/80 : Management or planning

Abstract

Each of several mobile end-user devices contains a device messaging agent that securely communicates with a network message server over a wireless network. The network message server delivers messages to the device messaging agent on behalf of a plurality of network application servers. Each network application server supplies the network message server with application data and an indication of a device and an application on the device to which the application data should be delivered. The network message server securely passes the data and an application identifier to the device messaging agent on the appropriate mobile end-user device. The device messaging agent maps the application identifier to a software process corresponding to the application, and a secure interprocess communication service delivers the application data to that software process.

Claims

1. A network system comprising:

a plurality of device messaging agents, each executable on a respective one of a plurality of mobile end-user devices configured to exchange Internet data via a data connection to a wireless network; and

a network message server

supporting a plurality of secure Internet data connections, each secure Internet data connection between the network message server and a respective one of the mobile end-user devices via a device data connection to a wireless network,

the network message server configured to receive, from each of a plurality of network application servers, multiple requests to transmit application data, each such request indicating a corresponding one of the mobile end-user devices and one of a plurality of applications,

the network message server to generate corresponding Internet data messages based on the requests, each such message containing at least one application identifier for an indicated application and application data corresponding to one of the requests, and

the network message server to transmit each of the generated Internet data messages to the device messaging agent located on the device indicated in the corresponding request, using the corresponding secure Internet data connection for the device indicated in the corresponding request;

each device messaging agent, when executing,

to receive the Internet data messages from the secure Internet data connection corresponding to the device executing the device messaging agent, and

to, for each received message, map the application identifier in the message to a software process corresponding to the application identifier, and forward the application data in the message to the software process via a secure interprocess communication service.

2. The network system of claim 1, the network message server further to collect and buffer multiple requests to transmit application data to a particular one of the devices.

3. The network system of claim 1, wherein the plurality of applications include a first application that receives the application data in a first format, and a second application that receives the application data in a second format different than the first format.

4. The network system of claim 1, the network message server further to encrypt the secure Internet data messages, the device messaging agents further to decrypt each received message to obtain the corresponding application identifier and application data.

5. The network system of claim 4, wherein the secure Internet data messages are transported to the device messaging agent on each device using one or more of encryption on a transport services stack, IP (Internet Protocol) layer encryption, and tunneling.

6. The network system of claim 1, wherein the device messaging agent executes in a secure execution environment on at least one of the devices, and at least one of the applications executes outside of the secure execution environment on that device.

7. The network system of claim 1, wherein:

at least a subset of the device messaging agents, when respectively executing on their respective devices, are each further to

receive, from each of multiple applications executing on the corresponding device, at least one corresponding request to transmit application data, each such request indicating a corresponding one of the network application servers,

generate corresponding upload Internet data messages based on the requests, each such message containing at least one server identifier for an indicated application server and application data corresponding to one of the requests, and

transmit each of the generated upload Internet data messages to the network message server, using the corresponding secure Internet data connection for the device; and

the network message server is further to

receive the upload Internet data messages over the respective secure Internet data connections, and

for each received upload Internet data message, map the server identifier in that message to a corresponding one of the network application servers, and transmit the application data from that message to the corresponding network application server, together with an indication of the device from which that message was received.

8. The network system of claim 7, wherein at least one of the upload Internet data messages comprises a key for the network application server corresponding to the requesting application.

9. The network system of claim 1, further comprising, on at least one of the devices, the secure interprocess communication service, and wherein the secure interprocess communication service and the secure Internet data connection from that device to the network message server are separately secured.

10. The network system of claim 1, wherein at least one of the secure Internet data messages comprises multiple identifier/data pairs.

11. The network system of claim 1, wherein the secure interprocess communication service forwards the application data to at least one of the software processes in an encrypted format.

12. The network system of claim 1, the device messaging agent on at least one of the devices further to initiate the secure connection to the network message server.

13. The network system of claim 1, at least one of the devices having a network stack in communication with the device messaging agent, wherein the secure connection between the network message server and that device is terminated within the network stack.

14. The network system of claim 1, wherein at least one of the applications on at least one of the devices and the network application server corresponding to that application authenticate with each other prior to passing application data via the device messaging agent on that device and the network message server.

15. The network system of claim 1, further comprising a secure server to store a secure authorization list, the secure authorization list indicating the applications and network application servers that are allowed to communicate using the network message server.

16. The network system of claim 2, wherein the network message server transmits the collected and buffered requests to the particular device upon the occurrence of a transmission trigger.

17. The network system of claim 16, wherein the transmission trigger is the expiration of a periodic timer.

18. The network system of claim 16, wherein the transmission trigger is the receipt of a transmission from the device messaging agent of the particular device.