Communications device with secure data path processing agents

• US 9,980,146 B2
• Filed: 05/18/2016
• Issued: 05/22/2018
• Est. Priority Date: 01/28/2009
• Status: Active Grant

• Current Assignee: Headwater Research LLC (Greg Raleigh)
• Original Assignee: Headwater Research LLC (Greg Raleigh)
• Inventors: Raleigh, Gregory G., Lavine, James, Raissinia, Alireza, Sabin, Michael J.
• Primary Examiner(s): RUDY, ANDREW J
• Application Number:
  US15/158,522
• Publication Number:
  US 20170099604A1
• Time in Patent Office: 734 Days
• Field of Search: 726 1, 726 2, 726 5, 726 7, 705 28, 705 30
• CPC Class Codes: G06F 21/575 Secure boot
• CPC Class Codes: H04L 41/046 comprising network management agents or mobile agents therefor
• CPC Class Codes: H04L 63/1425 Traffic logging, e.g. anomaly detection
• CPC Class Codes: H04W 12/12 Detection or prevention of fraud
• CPC Class Codes: H04W 12/128 Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware

Abstract

A network system comprising memory configured to store a device communication activity policy, and a policy verification processor configured to (a) receive a device data record over a trusted communication link between the network system and a device data record generator on a communications device, the device data record comprising information about a data communications activity by the communications device, the information configured to assist the policy verification processor in determining whether the communications device is operating or has operated in accordance with the device communication activity policy, (b) determine, based on the device data record, whether the communications device is operating or has operated in accordance with the device communication activity policy, and (c) upon determining that the communications device is not operating or has not operated in accordance with the device communication activity policy, initiate an error handling action.

Claims

1. A mobile end-user device comprising:

a wireless wide-area network (WWAN) modem, including signal processing elements, to communicate Internet service activity data with at least one WWAN;

an application processing environment to execute device applications that each communicate Internet service activity data with one or more network servers via the WWAN modem and the WWAN;

a secure processing environment in an Internet service activity data path between the application processing environment and the signal processing elements, the secure processing environment executing a service to generate first device data records (DDRs) reflecting a first data usage classification of Internet service activity data traversing the data path;

a service processor agent to execute outside of the secure processing environment, the service processor agent operating to generate second DDRs reflecting a second data usage classification of Internet service activity data attributed to one or more device applications executing in the application processing environment; and

one or more device agents to communicate the first and second DDRs to one or more network elements.

2. The mobile end-user device of claim 1, wherein the signal processing elements also reside in the secure processing environment.

3. The mobile end-user device of claim 1, wherein the one or more device agents execute outside of the secure processing environment, the service to secure the first DDRs and to provide the secure first DDRs to the one or more device agents.

4. The mobile end-user device of claim 1, the service and/or the service processor agent configured to generate respective DDRs to provide at least approximate alignment between a measurement interval spanned by a given first DDR and a measurement interval spanned by a given second DDR.

5. The mobile end-user device of claim 1, wherein the second data usage classification differs from the first data usage classification at least by providing device usage attributed to specific device applications.

6. The mobile end-user device of claim 1, wherein the second data usage classification differs from the first data usage classification at least by providing device usage attributed to an active network used.

7. The mobile end-user device of claim 1, wherein the second data usage classification differs from the first data usage classification at least by providing device usage classified with layer 7 network information.

8. The mobile end-user device of claim 1, wherein the secure processing environment executes on a processor in the WWAN modem.

9. The mobile end-user device of claim 1, wherein the secure processing environment executes on a processor in a Subscriber Identity Module coupled to the device.