Automatic generation and distribution of policy information regarding malicious mobile traffic in a wireless network

Description

BACKGROUND

Mobile malware incidence has recently surged significantly in view of the prevalence of mobile application sharing, downloading, and installation from communal application market places. Mobile malware contain code that can compromise personal data and consume a user's data plans and/or voice-based minutes. Mobile malware can also enable bypassing of firewalls and have further impact by hijacking USB synchronization and affect any sync'ed computer or laptop, or make way into enterprise servers.

With mobile users now downloading and installing mobile applications from these marketplaces where software applications are made by any developer around the world, malware can easily be repackaged into applications and utilities by any party and uploaded to these online application market places. Mobile device security is thus becoming a critical and urgent task in the increased reliance on mobile devices for every day business, personal and entertainment use.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1A depicts an example diagram showing observations of traffic and traffic patterns in monitoring mobile application activities of applications on a mobile device.

FIG. 1B illustrates an example diagram of a system where a host server facilitates management of traffic, content caching, and/or resource conservation between mobile devices (e.g., wireless devices), an application server or content provider, or other servers such as an ad server, promotional content server, or an e-coupon server in a wireless network (or broadband network) for resource conservation. The host server can further monitor mobile application activities for malicious traffic on a mobile device and/or automatically generate and/or distribute policy information regarding malicious traffic in a wireless network.

FIG. 1C illustrates an example diagram of a proxy and cache system distributed between the host server and device which facilitates network traffic management between a device, an application server or content provider, or other servers such as an ad server, promotional content server, or an e-coupon server for resource conservation and content caching. The proxy system distributed among the host server and the device can further monitor mobile application activities for malicious traffic on a mobile device and/or automatically generate and/or distribute policy information regarding malicious traffic in a wireless network.

FIG. 2A depicts a block diagram illustrating an example of client-side components in a distributed proxy and cache system residing on a mobile device (e.g., wireless device) that manages traffic in a wireless network (or broadband network) for resource conservation, content caching, and/or traffic management. The client-side proxy (or local proxy) can further categorize mobile traffic and/or implement delivery policies based on application behavior, content priority, user activity, and/or user expectations.

FIG. 2B depicts a block diagram illustrating a further example of components in the cache system shown in the example of FIG. 2A which is capable of caching and adapting caching strategies for mobile application behavior and/or network conditions. Components capable of detecting long poll requests and managing caching of long polls are also illustrated.

FIG. 2C depicts a block diagram illustrating additional components in the application behavior detector and the caching policy manager in the cache system shown in the example of FIG. 2A which is further capable of detecting cache defeat and perform caching of content addressed by identifiers intended to defeat cache.

FIG. 2D depicts a block diagram illustrating examples of additional components in the local cache shown in the example of FIG. 2A which is further capable of performing mobile traffic categorization and policy implementation based on application behavior and/or user activity.

FIG. 3A depicts a block diagram illustrating an example of server-side components in a distributed proxy and cache system that manages traffic in a wireless network (or broadband network) for resource conservation, content caching, and/or traffic management. The server-side proxy (or proxy server) can further categorize mobile traffic and/or implement delivery policies based on application behavior, content priority, user activity, and/or user expectations.

FIG. 3B depicts a block diagram illustrating a further example of components in the caching policy manager in the cache system shown in the example of FIG. 3A which is capable of caching and adapting caching strategies for mobile application behavior and/or network conditions. Components capable of detecting long poll requests and managing caching of long polls are also illustrated.

FIG. 3C depicts a block diagram illustrating another example of components in the proxy system shown in the example of FIG. 3A which is further capable of managing and detecting cache defeating mechanisms and monitoring content sources.

FIG. 3D depicts a block diagram illustrating examples of additional components in proxy server shown in the example of FIG. 3A which is further capable of performing mobile traffic categorization and policy implementation based on application behavior and/or traffic priority.

FIG. 4A depicts a block diagram illustrating another example of client-side components in a distributed proxy and cache system, further including a malware manager and filter engine.

FIG. 4B depicts a block diagram illustrating additional components in the malware manager and filter engine shown in the example of FIG. 4A.

FIG. 5A depicts a block diagram illustrating an example of server-side components in a distributed proxy and cache system, further including a malware manager and filter engine.

FIG. 5B depicts a block diagram illustrating additional components in the malware manager and filter engine shown in the example of FIG. 5A.

FIG. 6A depicts a flow diagram illustrating an example process for distributed content caching between a mobile device (e.g., any wireless device) and remote proxy and the distributed management of content caching.

FIG. 6B depicts a timing diagram showing how data requests from a mobile device (e.g., any wireless device) to an application server/content provider in a wireless network (or broadband network) can be coordinated by a distributed proxy system in a manner such that network and battery resources are conserved through using content caching and monitoring performed by the distributed proxy system.

FIG. 7 depicts a table showing examples of different traffic or application category types which can be used in implementing network access and content delivery policies.

FIG. 8 depicts a table showing examples of different content category types which can be used in implementing network access and content delivery policies.

FIG. 9 depicts an interaction diagram showing how polls having data requests from a mobile device (e.g., any wireless device) to an application server/content provider over a wireless network (or broadband network) can be can be cached on the local proxy and managed by the distributed caching system.

FIG. 10 depicts an interaction diagram showing how polls for content from an application server/content provider which employs cache-defeating mechanisms in identifiers (e.g., identifiers intended to defeat caching) over a wireless network (or broadband network) can be detected and locally cached.

FIG. 11 depicts a flow chart illustrating an example process for collecting information about a request and the associated response to identify cacheability and caching the response.

FIG. 12 depicts a flow chart illustrating an example process showing decision flows to determine whether a response to a request can be cached.

FIG. 13 depicts a flow chart illustrating an example process for determining potential for cacheability based on request periodicity and/or response repeatability.

FIG. 14 depicts a flow chart illustrating an example process for dynamically adjusting caching parameters for a given request or client.

FIG. 15 depicts a flow chart illustrating example processes for application and/or traffic (data) categorization while factoring in user activity and expectations for implementation of network access and content delivery policies.

FIG. 16A depicts a flow chart illustrating example processes for handling traffic which is to be suppressed at least temporarily determined from application/traffic categorization.

FIG. 16B depicts a flow chart illustrating an example process for selection of a network configuration for use in sending traffic based on application and/or traffic (data) categorization.

FIG. 16C depicts a flow chart illustrating an example process for implementing network access and content delivery policies based on application and/or traffic (data) categorization.

FIG. 17 depicts a flow chart illustrating an example process for network selection based on mobile user activity or user expectations.

FIG. 18 depicts a data timing diagram showing an example of detection of periodic request which may be suitable for caching.

FIG. 19 depicts a data timing diagram showing an example of detection of change in request intervals and updating of server polling rate in response thereto.

FIG. 20 depicts a data timing diagram showing an example of serving foreground requests with cached entries.

FIG. 21 depicts a data timing diagram showing an example of the possible effect of cache invalidation that occurs after outdated content has been served once again to a requesting application.

FIG. 22 depicts a data timing diagram showing cache management and response taking into account the time-to-live (TTL) set for cache entries.

FIG. 23 depicts a flow chart illustrating an example process for using request characteristics information of requests initiated from a mobile device for malware detection and assessment of cache appropriateness of the associated responses.

FIG. 24 depicts a flow chart illustrating example processes for analyzing request characteristics to determine or identify the presence of malware or other suspicious activity/traffic.

FIG. 25 depicts a flow chart illustrating example processes for malware handling when malware or other suspicious activity is detected.

FIG. 26 depicts a flow chart illustrating an example process for detection or filtering of malicious traffic on a mobile device based on associated locations of a request.

FIGS. 27A-B depict flow charts illustrating example processes for monitoring mobile application activities for malicious traffic on a mobile device.

FIG. 28 depicts a flow chart illustrating an example process for automatically generating and/or distributing policy information for malicious mobile traffic in a wireless network.

FIG. 29 depicts a flow chart illustrating examples of third parties enabled to define policy information regarding malicious mobile traffic.

FIG. 30 depicts a chart illustrating examples of policy information devised for handling malicious traffic.

FIG. 31 shows a diagrammatic representation of a machine in the example form of a computer system within which a set of instructions, for causing the machine to perform any one or more of the methodologies discussed herein, may be executed.

DETAILED DESCRIPTION

The following description and drawings are illustrative and are not to be construed as limiting. Numerous specific details are described to provide a thorough understanding of the disclosure. However, in certain instances, well-known or conventional details are not described in order to avoid obscuring the description. References to “one embodiment” or “an embodiment” in the present disclosure can be, but not necessarily are, references to the same embodiment and such references mean at least one of the embodiments.

Reference in this specification to “one embodiment” or “an embodiment” means that a particular feature, structure, or characteristic described in connection with the embodiment is included in at least one embodiment of the disclosure. The appearances of the phrase “in one embodiment” in various places in the specification are not necessarily all referring to the same embodiment, nor are separate or alternative embodiments mutually exclusive of other embodiments. Moreover, various features are described which may be exhibited by some embodiments and not by others. Similarly, various requirements are described which may be requirements for some embodiments but not other embodiments.

The terms used in this specification generally have their ordinary meanings in the art, within the context of the disclosure, and in the specific context where each term is used. Certain terms that are used to describe the disclosure are discussed below, or elsewhere in the specification, to provide additional guidance to the practitioner regarding the description of the disclosure. For convenience, certain terms may be highlighted, for example using italics and/or quotation marks. The use of highlighting has no influence on the scope and meaning of a term; the scope and meaning of a term is the same, in the same context, whether or not it is highlighted. It will be appreciated that same thing can be said in more than one way.

Consequently, alternative language and synonyms may be used for any one or more of the terms discussed herein, nor is any special significance to be placed upon whether or not a term is elaborated or discussed herein. Synonyms for certain terms are provided. A recital of one or more synonyms does not exclude the use of other synonyms. The use of examples anywhere in this specification, including examples of any terms discussed herein, is illustrative only, and is not intended to further limit the scope and meaning of the disclosure or of any exemplified term. Likewise, the disclosure is not limited to various embodiments given in this specification.

Without intent to limit the scope of the disclosure, examples of instruments, apparatus, methods and their related results according to the embodiments of the present disclosure are given below. Note that titles or subtitles may be used in the examples for convenience of a reader, which in no way should limit the scope of the disclosure. Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this disclosure pertains. In the case of conflict, the present document, including definitions, will control.

Embodiments of the present disclosure include automatic generation and distribution of policy information regarding malicious mobile traffic in a wireless network.

There are multiple factors that contribute to the proliferation of data: the end-user, mobile devices, wireless devices, mobile applications, and the network. As mobile devices evolve, so do the various elements associated with them-availability, applications, user behavior, location thus changing the way the network interacts with the device and the application.

The disclosed technology provides a comprehensive and end-to-end solution that is able to address each element for operators and devices manufacturers to support both the shift in mobile or wireless devices and the surge in data by leveraging the premise that mobile content has a definable or relevant “freshness” value. The “freshness” of mobile content can be determined, either with certainty, or with some heuristics having a tolerance within which the user experience is enhanced, or not negatively impacted, or negatively impacted but is either not perceptible to the user or within a tolerable threshold level.

The disclosed innovation transparently determines such “freshness” by monitoring, analyzing, and applying rules (which may be heuristically determined) the transactions (requests/responses) between applications (e.g., mobile applications) and the peers (corresponding server or other clients). Moreover, the technology is further able to effectively cache content which may be marked by its originating/host server as being “non-cacheable” and identify some “freshness” value which can then be used in implementing application-specific caching. In general, the “freshness” value has an approximate minimum value which is typically determined using the update interval (e.g., interval with which requests are sent) between the application and its corresponding server/host.

One embodiment of the disclosed technology includes a system that optimizes multiple aspects of the connection with wired and wireless networks and devices through a comprehensive view of device and application activity including: loading, current application needs on a device, controlling the type of access (push vs. pull or hybrid), location, concentration of users in a single area, time of day, how often the user interacts with the application, content or device, and using this information to shape traffic to a cooperative client/server or simultaneously mobile devices without a cooperative client. Because the disclosed server is not tied to any specific network provider it has visibility into the network performance across all service providers. This enables optimizations to be applied to devices regardless of the operator or service provider, thereby enhancing the user experience and managing network utilization while roaming. Bandwidth has been considered a major issue in wireless networks today. More and more research has been done related to the need for additional bandwidth to solve access problems. Many of the performance enhancing solutions and next generation standards, such as those commonly referred to as 3.5G, LTE, 4G, and WiMAX, are focused on providing increased bandwidth. Although partially addressed by the standards, a key problem that remains is lack of bandwidth on the signaling channel more so than the data channel and the standard does not address battery life very well.

Embodiments of the disclosed technology includes, for example, alignment of requests from multiple applications to minimize the need for several polling requests; leverage specific content types to determine how to proxy/manage a connection/content; and applying specific heuristics associated with device, user behavioral patterns (how often they interact with the device/application) and/or network parameters.

Embodiments of the present technology can further include, moving recurring HTTP polls performed by various widgets, RSS readers, etc., to remote network node (e.g., Network Operation Center (NOC)), thus considerably lowering device battery/power consumption, radio channel signaling and bandwidth usage. Additionally, the offloading can be performed transparently so that existing applications do not need to be changed.

In some embodiments, this can be implemented using a local proxy on the mobile device (e.g., any wireless device) which automatically detects recurring requests for the same content (RSS feed, Widget data set) that matches a specific rule (e.g., happens every 15 minutes). The local proxy can automatically cache the content on the mobile device while delegating the polling to the server (e.g., a proxy server operated as an element of a communications network). The server can then notify the mobile/client proxy if the content changes, and if content has not changed (or not changed sufficiently, or in an identified manner or amount) the mobile proxy provides the latest version in its cache to the user (without need to utilize the radio at all). This way the mobile or wireless device (e.g., a mobile phone, smart phone, M2M module/MODEM, or any other wireless devices, etc.) does not need to open (e.g., thus powering on the radio) or use a data connection if the request is for content that is monitored and that has been not flagged as new/changed.

The logic for automatically adding content sources/application servers (e.g., including URLs/content) to be monitored can also check for various factors like how often the content is the same, how often the same request is made (is there a fixed interval/pattern?), which application is requesting the data, etc. Similar rules to decide between using the cache and request the data from the original source may also be implemented and executed by the local proxy and/or server.

For example, when the request comes at an unscheduled/unexpected time (user initiated check), or after every (n) consecutive times the response has been provided from the cache, etc., or if the application is running in the background vs. in a more interactive mode of the foreground. As more and more mobile applications or wireless enabled applications base their features on resources available in the network, this becomes increasingly important. In addition, the disclosed technology allows elimination of unnecessary chatter from the network, benefiting the operators trying to optimize the wireless spectrum usage.

Traffic Categorization and Policy

In some embodiments, the disclosed proxy system is able to establish policies for choosing traffic (data, content, messages, updates, etc.) to cache and/or shape. Additionally, by combining information from observing the application making the network requests, getting explicit information from the application, or knowing the network destination the application is reaching, the disclosed technology can determine or infer what category the transmitted traffic belongs to.

For example, in one embodiment, mobile or wireless traffic can be categorized as: (a1) interactive traffic or (a2) background traffic. The difference is that in (a1) a user is actively waiting for a response, while in (2) a user is not expecting a response. This categorization can be used in conjunction with or in lieu of a second type of categorization of traffic: (b1) immediate, (b2) low priority, (b3) immediate if the requesting application is in the foreground and active.

For example, a new update, message or email may be in the (b1) category to be delivered immediately, but it still is (a2) background traffic—a user is not actively waiting for it. A similar categorization applies to instant messages when they come outside of an active chat session. During an active chat session a user is expecting a response faster. Such user expectations are determined or inferred and factored into when optimizing network use and device resources in performing traffic categorization and policy implementation.

Some examples of the applications of the described categorization scheme, include the following: (a1) interactive traffic can be categorized as (b1) immediate—but (a2) background traffic may also be (b2) or (b3). An example of a low priority transfer is email or message maintenance transaction such as deleting email or other messages or marking email as read at the mail or application server. Such a transfer can typically occur at the earlier of (a) timer exceeding a timeout value (for example, 2 minutes), and (b) data being sent for other purposes.

An example of (b3) is IM presence updates, stock ticker updates, weather updates, status updates, news feeds. When the UI of the application is in the foreground and/or active (for example, as indicated by the backlight of the device/phone being lit or as determined or inferred from the status of other sensors), updates can be considered immediate whenever server has something to push to the device. When the application is not in the foreground or not active, such updates can be suppressed until the application comes to foreground and is active.

With some embodiments, networks can be selected or optimized simultaneously for (a1) interactive traffic and (a2) background traffic.

In some embodiments, as the wireless device or mobile device proxy (separately or in conjunction with the server proxy) is able to categorize the traffic as (for example) (a1) interactive traffic or (a2) background traffic, it can apply different policies to different types of traffic. This means that it can internally operate differently for (a1) and (a2) traffic (for example, by allowing interactive traffic to go through to the network in whole or in part, and apply stricter traffic control to background traffic; or the device side only allows a request to activate the radio if it has received information from the server that the content at the host has been updated, etc.).

When the request does require access over the wireless network, the disclosed technology can request the radio layer to apply different network configurations to different traffic. Depending on the type of traffic and network this may be achieved by different means:

(1) Using 3G/4G for (a1) and 2G/2.5G for (a2);

(2) Explicitly specifying network configuration for different data sets (e.g. in terms of use of FACH (forward access channel) vs. DCH (dedicated channel), or otherwise requesting lower/more network efficient data rates for background traffic); or

(3) Utilizing different network access points for different data sets (access points which would be configured to use network resources differently similar to (1) and (2) above).

Additionally, 3GPP Fast Dormancy calls for improvements so that applications, operating systems or the mobile device would have awareness of the traffic type to be more efficient in the future. Embodiments of the disclosed system, having the knowledge of the traffic category and being able to utilize Fast Dormancy appropriately may solve the problem identified in Fast Dormancy. This way the mobile or broadband network does not need to be configured with a compromised configuration that adversely impacts both battery consumption and network signaling resources.

Polling Schedule

Detecting (or determining) a polling schedule allows the proxy server (server-side of the distributed cache system) to be as close as possible with its polls to the application polls. Many applications employ scheduled interval polling (e.g., every 4 hours or every 30 seconds, at another time interval). The client side proxy can detect automatic polls based on time measurements and create a automatic polling profile for an application. As an example, the local proxy attempts to detect the time interval between requests and after 2, 3, 4, or more polls, determines an automatic rate if the time intervals are all within 1 second (or another measure of relative closeness) of each other. If not, the client may collect data from a greater number of polling events (e.g., 10-12 polls) and apply a statistical analysis to determine, compute, or estimate a value for the average interval that is used. The polling profile is delivered to the server where it is used. If it is a frequent manual request, the locally proxy can substitute it with a default interval for this application taken from a profile for non-critical applications.

In some embodiments, the local proxy (e.g., device side proxy) may keep monitoring the application/client polls and update the polling interval. If it changes by more than 30% (or another predetermined/dynamic/conditional value) from the current value, it is communicated to the proxy server (e.g., server-side proxy). This approach can be referred to as the scenario of “lost interest.” In some instances, the local proxy can recognize requests made outside of this schedule, consider them “manual,” and treat them accordingly.

Application Classes/Modes of Caching

In some embodiments, applications can be organized into three groups or modes of caching. Each mobile client/application can be categorized to be treated as one of these modes, or treated using multiple modes, depending on one or more conditions.

A) Fully cached—local proxy updates (e.g., sends application requests directly over the network to be serviced by the application server/content host) only when the proxy server tells the local proxy to update. In this mode, the local proxy can ignore manual requests and the proxy server uses the detected automatic profile (e.g., sports score applets, Facebook, every 10, 15, 30, or more polls) to poll the application server/content provider.

B) Partially cached—the local proxy uses the local or internal cache for automatic requests (e.g., application automatic refreshes), other scheduled requests but passes through some manual requests (e.g., email download, Ebay or some Facebook requests); and

C) Never cached (e.g., real-time stock ticker, sports scores/statuses; however, in some instances, 15 minutes delayed quotes can be safely placed on 30 seconds schedules—B or even A).

The actual application or caching mode classification can be determined based on the rate of content change and critical character of data. Unclassified applications by default can be set as class C.

Backlight and Active Applications

In some embodiments, the local proxy starts by detecting the device backlight status. Requests made with the screen light ‘off’ can be allowed to use the local cache if a request with identical signature is registered with the proxy server, which is polling the original host server/content server(s) to which the requests are directed. If the screen light is ‘on’, further detection can be made to determine whether it is a background application or for other indicators that local cache entries can or cannot be used to satisfy the request. When identified, the requests for which local entries can be used may be processed identically to the screen light off situation. Foreground requests can use the aforementioned application classification to assess when cached data is safe to use to process requests.

FIG. 1A depicts an example diagram showing observations of traffic and traffic patterns made from applications 108 on a mobile device 150 used by a distributed traffic management system (illustrated in FIG. 1B-FIG. 1C) in monitoring mobile application activities of made from applications on a mobile device.

The mobile device 150 can include a local proxy (e.g., the local proxy 175, 275, as shown in the examples of FIG. 1C, FIGS. 2-4). In one embodiment, the local proxy on the mobile device 150 can monitor outgoing and/or incoming traffic for various reasons including but not limited traffic optimization, for example, for resource management, network resource use optimization, and/or power consumption optimization purposes.

In conjunction with monitoring traffic for resource optimization purposes (e.g., by the traffic monitor engine 405 shown in the example of FIG. 4B), the information gathered, in addition to being used for resource optimization (network and/or device resource) can also be used for detection of malicious traffic to/from the mobile device 150 (e.g., malware, etc.). The traffic monitor engine 405 can also gather information about traffic characteristics specific for the purposes of detecting malicious traffic.

For example, in monitoring traffic to/from the mobile device 150 (e.g., by the traffic monitor engine 405), the proxy can detect, track, analyze, and/or track patterns (e.g., timing patterns, location patterns, periodicity patterns, etc.) for use in optimizing traffic and/or for caching purposes. In tracking patterns, either for the purpose of resource optimization or for the purpose of malware detection, suspicious traffic patterns can be detected (e.g., by the suspicious traffic pattern detector 416) from one or more applications or services on the device 150.

Traffic can be flagged (e.g., by the malware detection engine 415) as suspicious based on its timing characteristics (e.g., t1113, t2115, t3117) including, time of day, frequency of occurrence, time interval between requests, etc. Timing characteristics can also be tracked relative to other requests/traffic made by the same application or other requests/traffic appearing to be made by the same application (e.g., 108). For example, the time interval between t1113, t2115, and/or t3117 may be determined and/or tracked over time. Certain criteria in the time interval across requests made by an application 108 may cause a particular traffic event to be identified as being suspicious.

Traffic can also be flagged as suspicious based on the target destination (e.g., by the suspicious destination detector 417). For example, in a request made by an application which appears to be connecting to Facebook 108 on the device 105 makes two requests to addressable entities on the Facebook server 103 and 105. However, the same application 108 is also detected to be making a request to entity 606 which does not appear to be a Facebook resource. The suspicious destination detector 417 (e.g., shown in the example of FIG. 4B) can identify suspicious destinations/origins or routing of requests based on the destination/origination identifier or a portion of the identifier (e.g., IP address, URI, URL, destination country, originating country, etc.) or identify suspicious destinations based on the application 108 making the request relative to the destination of the traffic and whether the destination would be expected according to the application/service 108 making or appearing to be making the request.

In addition, traffic 119 t4 can be identified as suspicious based on whether billable activity 109 is triggered (e.g., sending/receiving of SMS messages, international calls, purchase, etc.). Suspicious traffic 121 can also be identified based upon the requested port 111 on the mobile device for incoming and/or outgoing requests. In some instances, traffic 123 generating an un-secure request 113 to a known secure site may also be identified as suspicious or malicious traffic.

In response to identifying malware or detecting traffic that is potentially malicious, the proxy can generate a notification (e.g., by the malware notifier module 425). The notifier module 425 can notify the device (e.g., the operating system), the user (e.g., the user notifier 426), and/or the server 427 (e.g., the host server 100, 200, or proxy 325 in the examples of FIGS. 1B-C, FIGS. 2-5 respectively) to determine how to handle the identified malware or detected traffic. The malware traffic handling engine 435 can subsequently handle the suspicious traffic according to OS, user, and/or server instructions.

For example, the user notifier 426 can notify the user that suspicious traffic has been detected and prompt whether the user wishes to allow the traffic. The notifier 426 can also identify the source (e.g., application/service 608) of the suspicious traffic for the user to take action or to instruct the proxy 375 (e.g., or the malware manager and filter engine 501 on the server side shown in the example of FIG. 5A) and/or the device operating system to take action. The notifier module 425 can also recommend different types of action to be taken by the user or device OS based on specific characteristics of the offending traffic (e.g., based on level of maliciousness or based on level of certainty that the offending traffic is in fact malware or other types of malicious software).

Alternatively, the local proxy 275 can implement malware traffic handling processes automatically, within the mobile operating system on the mobile device 150/250, with or without input from the mobile operating system, user, and/or server. For example, the malware traffic handling engine 435 (of the example shown in FIG. 4B) can block all incoming and/or outgoing suspicious traffic. The malware traffic handling engine 435 can also implement different handing procedures based on maliciousness and/or level of certainty that the suspicious traffic is in fact malicious. For example, timing patterns which are abnormal or which appear to fall out of the norm for an application by which a request appears to be generated. The type of information included in a request can indicate or flag malicious traffic (e.g., if the type of information includes user information, data, geolocation, browsing data, call records, financial or credit card information, other sensitive personal information, etc.). A list of malware or malicious traffic identifiers and/or the associated applications can be compiled and updated (e.g., by the malware list manager 445) and stored in the local proxy 275.

The above described malware detection and filtering may be performed solely on the local proxy 175 or 275, or solely by a proxy server 325 remote from the device 150, or performed by a combination of both the local proxy 275 and the proxy server 325. For example, the proxy server 325 can detect malware or otherwise suspicious traffic (e.g., by the malware detection engine 515) based on its own observations of incoming/outgoing traffic requests of the device 150 passing through the proxy server 325 (e.g., which generally resides on the server side of a distributed proxy and cache system such as that shown in the example of FIG. 1C). Based on various criteria (e.g., timing and/or origin/destination address), the malware detection engine 515 can mark certain traffic as being malicious or potentially malicious. In addition, the identification of malicious traffic, malware, or potentially malicious traffic may be communicated to the proxy server 325 by the local proxy 275.

Either based on its own identification and/or identification of malware by the local proxy 275 communicated to the proxy 325, the proxy 325 and intercept the malicious or potentially malicious traffic (e.g., by the suspicious traffic interceptor 505), to block the traffic entirely or to hold the traffic from passing until verification that the traffic is not malicious. The proxy 325 can similarly notify various parties (e.g., by the malware notification module 525) when offensive traffic has been detected including but not limited to, mobile devices which have the same application as the one detected to generate offensive traffic, users, network providers, or third party applications/content providers in the event that a malicious resources is attempting to appear as a legitimate application.

The proxy server 325 can subsequently handle and manage malicious or potentially malicious traffic based on instructions received from one or more parties (e.g., by the malware traffic handler 535). For example, a network service provider may instruct the proxy server 325 to block all future traffic originating from or destined to a particular application for all mobile devices on their network. A specific user may instruct the proxy to allow the traffic, or the user may request additional information before making a decision on how to handle the malicious or potentially malicious traffic.

FIG. 1B illustrates an example diagram of a system where a host server 100 facilitates management of traffic, content caching, and/or resource conservation between mobile devices (e.g., wireless devices 150), and an application server or content provider 110, or other servers such as an ad server 120A, promotional content server 120B, or an e-coupon server 120C in a wireless network (or broadband network) for resource conservation. The host server can further monitor mobile application activities for malicious traffic on a mobile device and/or automatically generate and/or distribute policy information regarding malicious traffic in a wireless network.

The client devices 150 can be any system and/or device, and/or any combination of devices/systems that is able to establish a connection, including wired, wireless, cellular connections with another device, a server and/or other systems such as host server 100 and/or application server/content provider 110. Client devices 150 will typically include a display and/or other output functionalities to present information and data exchanged between among the devices 150 and/or the host server 100 and/or application server/content provider 110. The application server/content provider 110 can by any server including third party servers or service/content providers further including advertisement, promotional content, publication, or electronic coupon servers or services. Similarly, separate advertisement servers 120A, promotional content servers 120B, and/or e-Coupon servers 120C as application servers or content providers are illustrated by way of example.

For example, the client devices 150 can include mobile, hand held or portable devices, wireless devices, or non-portable devices and can be any of, but not limited to, a server desktop, a desktop computer, a computer cluster, or portable devices, including a notebook, a laptop computer, a handheld computer, a palmtop computer, a mobile phone, a cell phone, a smart phone, a PDA, a Blackberry device, a Palm device, a handheld tablet (e.g., an iPad or any other tablet), a hand held console, a hand held gaming device or console, any SuperPhone such as the iPhone, and/or any other portable, mobile, hand held devices, or fixed wireless interface such as a M2M device, etc. In one embodiment, the client devices 150, host server 100, and application server 110 are coupled via a network 106 and/or a network 108. In some embodiments, the devices 150 and host server 100 may be directly connected to one another.

The input mechanism on client devices 150 can include touch screen keypad (including single touch, multi-touch, gesture sensing in 2D or 3D, etc.), a physical keypad, a mouse, a pointer, a track pad, motion detector (e.g., including 1-axis, 2-axis, 3-axis accelerometer, etc.), a light sensor, capacitance sensor, resistance sensor, temperature sensor, proximity sensor, a piezoelectric device, device orientation detector (e.g., electronic compass, tilt sensor, rotation sensor, gyroscope, accelerometer), or a combination of the above.

Signals received or detected indicating user activity at client devices 150 through one or more of the above input mechanism, or others, can be used in the disclosed technology in acquiring context awareness at the client device 150. Context awareness at client devices 150 generally includes, by way of example but not limitation, client device 150 operation or state acknowledgement, management, user activity/behavior/interaction awareness, detection, sensing, tracking, trending, and/or application (e.g., mobile applications) type, behavior, activity, operating state, etc.

Context awareness in the present disclosure also includes knowledge and detection of network side contextual data and can include network information such as network capacity, bandwidth, traffic, type of network/connectivity, and/or any other operational state data. Network side contextual data can be received from and/or queried from network service providers (e.g., cell provider 112 and/or Internet service providers) of the network 106 and/or network 108 (e.g., by the host server and/or devices 150). In addition to application context awareness as determined from the client 150 side, the application context awareness may also be received from or obtained/queried from the respective application/service providers 110 (by the host 100 and/or client devices 150).

The host server 100 can use, for example, contextual information obtained for client devices 150, networks 106/108, applications (e.g., mobile applications), application server/provider 110, or any combination of the above, to manage the traffic in the system to satisfy data needs of the client devices 150 (e.g., to satisfy application or any other request including HTTP request). In one embodiment, the traffic is managed by the host server 100 to satisfy data requests made in response to explicit or non-explicit user 103 requests and/or device/application maintenance tasks. The traffic can be managed such that network consumption, for example, use of the cellular network is conserved for effective and efficient bandwidth utilization. In addition, the host server 100 can manage and coordinate such traffic in the system such that use of device 150 side resources (e.g., including but not limited to battery power consumption, radio use, processor/memory use) are optimized with a general philosophy for resource conservation while still optimizing performance and user experience.

For example, in context of battery conservation, the device 150 can observe user activity (for example, by observing user keystrokes, backlight status, or other signals via one or more input mechanisms, etc.) and alters device 150 behaviors. The device 150 can also request the host server 100 to alter the behavior for network resource consumption based on user activity or behavior.

In one embodiment, the traffic management for resource conservation is performed using a distributed system between the host server 100 and client device 150. The distributed system can include proxy server and cache components on the server side 100 and on the device/client side, for example, as shown by the server cache 135 on the server 100 side and the local cache 185 on the client 150 side.

Functions and techniques disclosed for context aware traffic management for resource conservation in networks (e.g., network 106 and/or 108) and devices 150, reside in a distributed proxy and cache system. The proxy and cache system can be distributed between, and reside on, a given client device 150 in part or in whole and/or host server 100 in part or in whole. The distributed proxy and cache system are illustrated with further reference to the example diagram shown in FIG. 1C. Functions and techniques performed by the proxy and cache components in the client device 150, the host server 100, and the related components therein are described, respectively, in detail with further reference to the examples of FIGS. 2-3.

In one embodiment, client devices 150 communicate with the host server 100 and/or the application server 110 over network 106, which can be a cellular network and/or a broadband network. To facilitate overall traffic management between devices 150 and various application servers/content providers 110 to implement network (bandwidth utilization) and device resource (e.g., battery consumption), the host server 100 can communicate with the application server/providers 110 over the network 108, which can include the Internet (e.g., a broadband network).

In general, the networks 106 and/or 108, over which the client devices 150, the host server 100, and/or application server 110 communicate, may be a cellular network, a broadband network, a telephonic network, an open network, such as the Internet, or a private network, such as an intranet and/or the extranet, or any combination thereof. For example, the Internet can provide file transfer, remote log in, email, news, RSS, cloud-based services, instant messaging, visual voicemail, push mail, VoIP, and other services through any known or convenient protocol, such as, but is not limited to the TCP/IP protocol, UDP, HTTP, DNS, FTP, UPnP, NSF, ISDN, PDH, RS-232, SDH, SONET, etc.

The networks 106 and/or 108 can be any collection of distinct networks operating wholly or partially in conjunction to provide connectivity to the client devices 150 and the host server 100 and may appear as one or more networks to the serviced systems and devices. In one embodiment, communications to and from the client devices 150 can be achieved by, an open network, such as the Internet, or a private network, broadband network, such as an intranet and/or the extranet. In one embodiment, communications can be achieved by a secure communications protocol, such as secure sockets layer (SSL), or transport layer security (TLS).

In addition, communications can be achieved via one or more networks, such as, but are not limited to, one or more of WiMax, a Local Area Network (LAN), Wireless Local Area Network (WLAN), a Personal area network (PAN), a Campus area network (CAN), a Metropolitan area network (MAN), a Wide area network (WAN), a Wireless wide area network (WWAN), or any broadband network, and further enabled with technologies such as, by way of example, Global System for Mobile Communications (GSM), Personal Communications Service (PCS), Bluetooth, WiFi, Fixed Wireless Data, 2G, 2.5G, 3G, 4G, IMT-Advanced, pre-4G, LTE Advanced, mobile WiMax, WiMax 2, WirelessMAN-Advanced networks, enhanced data rates for GSM evolution (EDGE), General packet radio service (GPRS), enhanced GPRS, iBurst, UMTS, HSPDA, HSUPA, HSPA, UMTS-TDD, 1xRTT, EV-DO, messaging protocols such as, TCP/IP, SMS, MMS, extensible messaging and presence protocol (XMPP), real time messaging protocol (RTMP), instant messaging and presence protocol (IMPP), instant messaging, USSD, IRC, or any other wireless data networks, broadband networks, or messaging protocols.

FIG. 1C illustrates an example diagram of a proxy and cache system distributed between the host server 100 and device 150 which facilitates network traffic management between the device 150 and an application server or content provider 110, or other servers such as an ad server 120A, promotional content server 120B, or an e-coupon server 120C for resource conservation and content caching. The proxy system distributed among the host server 100 and the device 150 can further monitor mobile application activities for malicious traffic on a mobile device and/or automatically generate and/or distribute policy information regarding malicious traffic in a wireless network.

The distributed proxy and cache system can include, for example, the proxy server 125 (e.g., remote proxy) and the server cache, 135 components on the server side. The server-side proxy 125 and cache 135 can, as illustrated, reside internal to the host server 100. In addition, the proxy server 125 and cache 135 on the server-side can be partially or wholly external to the host server 100 and in communication via one or more of the networks 106 and 108. For example, the proxy server 125 may be external to the host server and the server cache 135 may be maintained at the host server 100. Alternatively, the proxy server 125 may be within the host server 100 while the server cache is external to the host server 100. In addition, each of the proxy server 125 and the cache 135 may be partially internal to the host server 100 and partially external to the host server 100. The application server/content provider 110 can by any server including third party servers or service/content providers further including advertisement, promotional content, publication, or electronic coupon servers or services. Similarly, separate advertisement servers 120A, promotional content servers 120B, and/or e-Coupon servers 120C as application servers or content providers are illustrated by way of example.

The distributed system can also, include, in one embodiment, client-side components, including by way of example but not limitation, a local proxy 175 (e.g., a mobile client on a mobile device) and/or a local cache 185, which can, as illustrated, reside internal to the device 150 (e.g., a mobile device).

In addition, the client-side proxy 175 and local cache 185 can be partially or wholly external to the device 150 and in communication via one or more of the networks 106 and 108. For example, the local proxy 175 may be external to the device 150 and the local cache 185 may be maintained at the device 150. Alternatively, the local proxy 175 may be within the device 150 while the local cache 185 is external to the device 150. In addition, each of the proxy 175 and the cache 185 may be partially internal to the host server 100 and partially external to the host server 100.

In one embodiment, the distributed system can include an optional caching proxy server 199. The caching proxy server 199 can be a component which is operated by the application server/content provider 110, the host server 100, or a network service provider 112, and or any combination of the above to facilitate network traffic management for network and device resource conservation. Proxy server 199 can be used, for example, for caching content to be provided to the device 150, for example, from one or more of, the application server/provider 110, host server 100, and/or a network service provider 112. Content caching can also be entirely or partially performed by the remote proxy 125 to satisfy application requests or other data requests at the device 150.

In context aware traffic management and optimization for resource conservation in a network (e.g., cellular or other wireless networks), characteristics of user activity/behavior and/or application behavior at a mobile device (e.g., any wireless device) 150 can be tracked by the local proxy 175 and communicated, over the network 106 to the proxy server 125 component in the host server 100, for example, as connection metadata. The proxy server 125 which in turn is coupled to the application server/provider 110 provides content and data to satisfy requests made at the device 150.

In addition, the local proxy 175 can identify and retrieve mobile device properties, including one or more of, battery level, network that the device is registered on, radio state, or whether the mobile device is being used (e.g., interacted with by a user). In some instances, the local proxy 175 can delay, expedite (prefetch), and/or modify data prior to transmission to the proxy server 125, when appropriate, as will be further detailed with references to the description associated with the examples of FIGS. 2-3.

The local database 185 can be included in the local proxy 175 or coupled to the local proxy 175 and can be queried for a locally stored response to the data request prior to the data request being forwarded on to the proxy server 125. Locally cached responses can be used by the local proxy 175 to satisfy certain application requests of the mobile device 150, by retrieving cached content stored in the cache storage 185, when the cached content is still valid.

Similarly, the proxy server 125 of the host server 100 can also delay, expedite, or modify data from the local proxy prior to transmission to the content sources (e.g., the application server/content provider 110). In addition, the proxy server 125 uses device properties and connection metadata to generate rules for satisfying request of applications on the mobile device 150. The proxy server 125 can gather real time traffic information about requests of applications for later use in optimizing similar connections with the mobile device 150 or other mobile devices.

In general, the local proxy 175 and the proxy server 125 are transparent to the multiple applications executing on the mobile device. The local proxy 175 is generally transparent to the operating system or platform of the mobile device and may or may not be specific to device manufacturers. In some instances, the local proxy 175 is optionally customizable in part or in whole to be device specific. In some embodiments, the local proxy 175 may be bundled into a wireless model, a firewall, and/or a router.

In one embodiment, the host server 100 can in some instances, utilize the store and forward functions of a short message service center (SMSC) 112, such as that provided by the network service provider, in communicating with the device 150 in achieving network traffic management. Note that 112 can also utilize any other type of alternative channel including USSD or other network control mechanisms. As will be further described with reference to the example of FIG. 3, the host server 100 can forward content or HTTP responses to the SMSC 112 such that it is automatically forwarded to the device 150 if available, and for subsequent forwarding if the device 150 is not currently available.

In general, the disclosed distributed proxy and cache system allows optimization of network usage, for example, by serving requests from the local cache 185, the local proxy 175 reduces the number of requests that need to be satisfied over the network 106. Further, the local proxy 175 and the proxy server 125 may filter irrelevant data from the communicated data. In addition, the local proxy 175 and the proxy server 125 can also accumulate low priority data and send it in batches to avoid the protocol overhead of sending individual data fragments. The local proxy 175 and the proxy server 125 can also compress or transcode the traffic, reducing the amount of data sent over the network 106 and/or 108. The signaling traffic in the network 106 and/or 108 can be reduced, as the networks are now used less often and the network traffic can be synchronized among individual applications.

With respect to the battery life of the mobile device 150, by serving application or content requests from the local cache 185, the local proxy 175 can reduce the number of times the radio module is powered up. The local proxy 175 and the proxy server 125 can work in conjunction to accumulate low priority data and send it in batches to reduce the number of times and/or amount of time when the radio is powered up. The local proxy 175 can synchronize the network use by performing the batched data transfer for all connections simultaneously.

FIG. 2A depicts a block diagram illustrating an example of client-side components in a distributed proxy and cache system residing on a mobile device (e.g., wireless device) 250 that manages traffic in a wireless network (or broadband network) for resource conservation, content caching, and/or traffic management. The client-side proxy (or local proxy 275) can further categorize mobile traffic and/or implement delivery policies based on application behavior, content priority, user activity, and/or user expectations.

The device 250, which can be a portable or mobile device (e.g., any wireless device), such as a portable phone, generally includes, for example, a network interface 208 an operating system 204, a context API 206, and mobile applications which may be proxy-unaware 210 or proxy-aware 220. Note that the device 250 is specifically illustrated in the example of FIG. 2 as a mobile device, such is not a limitation and that device 250 may be any wireless, broadband, portable/mobile or non-portable device able to receive, transmit signals to satisfy data requests over a network including wired or wireless networks (e.g., WiFi, cellular, Bluetooth, LAN, WAN, etc.).

The network interface 208 can be a networking module that enables the device 250 to mediate data in a network with an entity that is external to the host server 250, through any known and/or convenient communications protocol supported by the host and the external entity. The network interface 208 can include one or more of a network adaptor card, a wireless network interface card (e.g., SMS interface, WiFi interface, interfaces for various generations of mobile communication standards including but not limited to 2G, 3G, 3.5G, 4G, LTE, etc.,), Bluetooth, or whether or not the connection is via a router, an access point, a wireless router, a switch, a multilayer switch, a protocol converter, a gateway, a bridge, a bridge router, a hub, a digital media receiver, and/or a repeater.

Device 250 can further include, client-side components of the distributed proxy and cache system which can include, a local proxy 275 (e.g., a mobile client of a mobile device) and a cache 285. In one embodiment, the local proxy 275 includes a user activity module 215, a proxy API 225, a request/transaction manager 235, a caching policy manager 245 having an application protocol module 248, a traffic shaping engine 255, and/or a connection manager 265. The traffic shaping engine 255 may further include an alignment module 256 and/or a batching module 257, the connection manager 265 may further include a radio controller 266. The request/transaction manager 235 can further include an application behavior detector 236 and/or a prioritization engine 241, the application behavior detector 236 may further include a pattern detector 237 and/or and application profile generator 239. Additional or less components/modules/engines can be included in the local proxy 275 and each illustrated component.

As used herein, a “module,” “a manager,” a “handler,” a “detector,” an “interface,” a “controller,” a “normalizer,” a “generator,” an “invalidator,” or an “engine” includes a general purpose, dedicated or shared processor and, typically, firmware or software modules that are executed by the processor. Depending upon implementation-specific or other considerations, the module, manager, handler, detector, interface, controller, normalizer, generator, invalidator, or engine can be centralized or its functionality distributed. The module, manager, handler, detector, interface, controller, normalizer, generator, invalidator, or engine can include general or special purpose hardware, firmware, or software embodied in a computer-readable (storage) medium for execution by the processor.

As used herein, a computer-readable medium or computer-readable storage medium is intended to include all mediums that are statutory (e.g., in the United States, under 35 U.S.C. §101), and to specifically exclude all mediums that are non-statutory in nature to the extent that the exclusion is necessary for a claim that includes the computer-readable (storage) medium to be valid. Known statutory computer-readable mediums include hardware (e.g., registers, random access memory (RAM), non-volatile (NV) storage, to name a few), but may or may not be limited to hardware.

In one embodiment, a portion of the distributed proxy and cache system for network traffic management resides in or is in communication with device 250, including local proxy 275 (mobile client) and/or cache 285. The local proxy 275 can provide an interface on the device 250 for users to access device applications and services including email, IM, voice mail, visual voicemail, feeds, Internet, games, productivity tools, or other applications, etc.

The proxy 275 is generally application independent and can be used by applications (e.g., both proxy-aware and proxy-unaware applications 210 and 220 and other mobile applications) to open TCP connections to a remote server (e.g., the server 100 in the examples of FIGS. 1B-1C and/or server proxy 125/325 shown in the examples of FIG. 1B and FIG. 3A). In some instances, the local proxy 275 includes a proxy API 225 which can be optionally used to interface with proxy-aware applications 220 (or applications (e.g., mobile applications) on a mobile device (e.g., any wireless device)).

The applications 210 and 220 can generally include any user application, widgets, software, HTTP-based application, web browsers, video or other multimedia streaming or downloading application, video games, social network applications, email clients, RSS management applications, application stores, document management applications, productivity enhancement applications, etc. The applications can be provided with the device OS, by the device manufacturer, by the network service provider, downloaded by the user, or provided by others.

One embodiment of the local proxy 275 includes or is coupled to a context API 206, as shown. The context API 206 may be a part of the operating system 204 or device platform or independent of the operating system 204, as illustrated. The operating system 204 can include any operating system including but not limited to, any previous, current, and/or future versions/releases of, Windows Mobile, iOS, Android, Symbian, Palm OS, Brew MP, Java 2 Micro Edition (J2ME), Blackberry, etc.

The context API 206 may be a plug-in to the operating system 204 or a particular client/application on the device 250. The context API 206 can detect signals indicative of user or device activity, for example, sensing motion, gesture, device location, changes in device location, device backlight, keystrokes, clicks, activated touch screen, mouse click or detection of other pointer devices. The context API 206 can be coupled to input devices or sensors on the device 250 to identify these signals. Such signals can generally include input received in response to explicit user input at an input device/mechanism at the device 250 and/or collected from ambient signals/contextual cues detected at or in the vicinity of the device 250 (e.g., light, motion, piezoelectric, etc.).

In one embodiment, the user activity module 215 interacts with the context API 206 to identify, determine, infer, detect, compute, predict, and/or anticipate, characteristics of user activity on the device 250. Various inputs collected by the context API 206 can be aggregated by the user activity module 215 to generate a profile for characteristics of user activity. Such a profile can be generated by the user activity module 215 with various temporal characteristics. For instance, user activity profile can be generated in real-time for a given instant to provide a view of what the user is doing or not doing at a given time (e.g., defined by a time window, in the last minute, in the last 30 seconds, etc.), a user activity profile can also be generated for a ‘session’ defined by an application or web page that describes the characteristics of user behavior with respect to a specific task they are engaged in on the device 250, or for a specific time period (e.g., for the last 2 hours, for the last 5 hours).

Additionally, characteristic profiles can be generated by the user activity module 215 to depict a historical trend for user activity and behavior (e.g., 1 week, 1 mo., 2 mo., etc.). Such historical profiles can also be used to deduce trends of user behavior, for example, access frequency at different times of day, trends for certain days of the week (weekends or week days), user activity trends based on location data (e.g., IP address, GPS, or cell tower coordinate data) or changes in location data (e.g., user activity based on user location, or user activity based on whether the user is on the go, or traveling outside a home region, etc.) to obtain user activity characteristics.

In one embodiment, user activity module 215 can detect and track user activity with respect to applications, documents, files, windows, icons, and folders on the device 250. For example, the user activity module 215 can detect when an application or window (e.g., a web browser or any other type of application) has been exited, closed, minimized, maximized, opened, moved into the foreground, or into the background, multimedia content playback, etc.

In one embodiment, characteristics of the user activity on the device 250 can be used to locally adjust behavior of the device (e.g., mobile device or any wireless device) to optimize its resource consumption such as battery/power consumption and more generally, consumption of other device resources including memory, storage, and processing power. In one embodiment, the use of a radio on a device can be adjusted based on characteristics of user behavior (e.g., by the radio controller 266 of the connection manager 265) coupled to the user activity module 215. For example, the radio controller 266 can turn the radio on or off, based on characteristics of the user activity on the device 250. In addition, the radio controller 266 can adjust the power mode of the radio (e.g., to be in a higher power mode or lower power mode) depending on characteristics of user activity.

In one embodiment, characteristics of the user activity on device 250 can also be used to cause another device (e.g., other computers, a mobile device, a wireless device, or a non-portable device) or server (e.g., host server 100 and 300 in the examples of FIGS. 1B-C and FIG. 3A) which can communicate (e.g., via a cellular or other network) with the device 250 to modify its communication frequency with the device 250. The local proxy 275 can use the characteristics information of user behavior determined by the user activity module 215 to instruct the remote device as to how to modulate its communication frequency (e.g., decreasing communication frequency, such as data push frequency if the user is idle, requesting that the remote device notify the device 250 if new data, changed, data, or data of a certain level of importance becomes available, etc.).

In one embodiment, the user activity module 215 can, in response to determining that user activity characteristics indicate that a user is active after a period of inactivity, request that a remote device (e.g., server host server 100 and 300 in the examples of FIGS. 1B-C and FIG. 3A) send the data that was buffered as a result of the previously decreased communication frequency.

In addition, or in alternative, the local proxy 275 can communicate the characteristics of user activity at the device 250 to the remote device (e.g., host server 100 and 300 in the examples of FIGS. 1B-C and FIG. 3A) and the remote device determines how to alter its own communication frequency with the device 250 for network resource conservation and conservation of device 250 resources.

One embodiment of the local proxy 275 further includes a request/transaction manager 235, which can detect, identify, intercept, process, manage, data requests initiated on the device 250, for example, by applications 210 and/or 220, and/or directly/indirectly by a user request. The request/transaction manager 235 can determine how and when to process a given request or transaction, or a set of requests/transactions, based on transaction characteristics.

The request/transaction manager 235 can prioritize requests or transactions made by applications and/or users at the device 250, for example by the prioritization engine 241. Importance or priority of requests/transactions can be determined by the request/transaction manager 235 by applying a rule set, for example, according to time sensitivity of the transaction, time sensitivity of the content in the transaction, time criticality of the transaction, time criticality of the data transmitted in the transaction, and/or time criticality or importance of an application making the request.

In addition, transaction characteristics can also depend on whether the transaction was a result of user-interaction or other user-initiated action on the device (e.g., user interaction with a application (e.g., a mobile application)). In general, a time critical transaction can include a transaction resulting from a user-initiated data transfer, and can be prioritized as such. Transaction characteristics can also depend on the amount of data that will be transferred or is anticipated to be transferred as a result of the requested transaction. For example, the connection manager 265, can adjust the radio mode (e.g., high power or low power mode via the radio controller 266) based on the amount of data that will need to be transferred.

In addition, the radio controller 266/connection manager 265 can adjust the radio power mode (high or low) based on time criticality/sensitivity of the transaction. The radio controller 266 can trigger the use of high power radio mode when a time-critical transaction (e.g., a transaction resulting from a user-initiated data transfer, an application running in the foreground, any other event meeting a certain criteria) is initiated or detected.

In general, the priorities can be set by default, for example, based on device platform, device manufacturer, operating system, etc. Priorities can alternatively or in additionally be set by the particular application; for example, the Facebook application (e.g., a mobile application) can set its own priorities for various transactions (e.g., a status update can be of higher priority than an add friend request or a poke request, a message send request can be of higher priority than a message delete request, for example), an email client or IM chat client may have its own configurations for priority. The prioritization engine 241 may include set of rules for assigning priority.

The prioritization engine 241 can also track network provider limitations or specifications on application or transaction priority in determining an overall priority status for a request/transaction. Furthermore, priority can in part or in whole be determined by user preferences, either explicit or implicit. A user, can in general, set priorities at different tiers, such as, specific priorities for sessions, or types, or applications (e.g., a browsing session, a gaming session, versus an IM chat session, the user may set a gaming session to always have higher priority than an IM chat session, which may have higher priority than web-browsing session). A user can set application-specific priorities, (e.g., a user may set Facebook-related transactions to have a higher priority than LinkedIn-related transactions), for specific transaction types (e.g., for all send message requests across all applications to have higher priority than message delete requests, for all calendar-related events to have a high priority, etc.), and/or for specific folders.

The prioritization engine 241 can track and resolve conflicts in priorities set by different entities. For example, manual settings specified by the user may take precedence over device OS settings, network provider parameters/limitations (e.g., set in default for a network service area, geographic locale, set for a specific time of day, or set based on service/fee type) may limit any user-specified settings and/or application-set priorities. In some instances, a manual synchronization request received from a user can override some, most, or all priority settings in that the requested synchronization is performed when requested, regardless of the individually assigned priority or an overall priority ranking for the requested action.

Priority can be specified and tracked internally in any known and/or convenient manner, including but not limited to, a binary representation, a multi-valued representation, a graded representation and all are considered to be within the scope of the disclosed technology.

TABLE I

Change

Change

(initiated on device)
Priority
(initiated on server)
Priority

Send email
High
Receive email
High

Delete email
Low
Edit email
Often not possible to sync

(Un)read email
Low

(Low if possible)

Move message
Low
New email in deleted items
Low

Read more
High

Download
High
Delete an email
Low

attachment

(Un)Read an email
Low

New Calendar event
High
Move messages
Low

Edit/change Calendar event
High
Any calendar change
High

Any contact change
High

Add a contact
High
Wipe/lock device
High

Edit a contact
High
Settings change
High

Search contacts
High
Any folder change
High

Change a setting
High
Connector restart
High (if no changes nothing is

Manual send/receive
High

sent)

IM status change
Medium
Social Network Status Updates
Medium

Auction outbid or change
High
Sever Weather Alerts
High

notification

Weather Updates
Low
News Updates
Low

Table I above shows, for illustration purposes, some examples of transactions with examples of assigned priorities in a binary representation scheme. Additional assignments are possible for additional types of events, requests, transactions, and as previously described, priority assignments can be made at more or less granular levels, e.g., at the session level or at the application level, etc.

As shown by way of example in the above table, in general, lower priority requests/transactions can include, updating message status as being read, unread, deleting of messages, deletion of contacts; higher priority requests/transactions, can in some instances include, status updates, new IM chat message, new email, calendar event update/cancellation/deletion, an event in a mobile gaming session, or other entertainment related events, a purchase confirmation through a web purchase or online, request to load additional or download content, contact book related events, a transaction to change a device setting, location-aware or location-based events/transactions, or any other events/request/transactions initiated by a user or where the user is known to be, expected to be, or suspected to be waiting for a response, etc.

Inbox pruning events (e.g., email, or any other types of messages), are generally considered low priority and absent other impending events, generally will not trigger use of the radio on the device 250. Specifically, pruning events to remove old email or other content can be ‘piggy backed’ with other communications if the radio is not otherwise on, at the time of a scheduled pruning event. For example, if the user has preferences set to ‘keep messages for 7 days old,’ then instead of powering on the device radio to initiate a message delete from the device 250 the moment that the message has exceeded 7 days old, the message is deleted when the radio is powered on next. If the radio is already on, then pruning may occur as regularly scheduled.

The request/transaction manager 235, can use the priorities for requests (e.g., by the prioritization engine 241) to manage outgoing traffic from the device 250 for resource optimization (e.g., to utilize the device radio more efficiently for battery conservation). For example, transactions/requests below a certain priority ranking may not trigger use of the radio on the device 250 if the radio is not already switched on, as controlled by the connection manager 265. In contrast, the radio controller 266 can turn on the radio such a request can be sent when a request for a transaction is detected to be over a certain priority level.

In one embodiment, priority assignments (such as that determined by the local proxy 275 or another device/entity) can be used cause a remote device to modify its communication with the frequency with the mobile device or wireless device. For example, the remote device can be configured to send notifications to the device 250 when data of higher importance is available to be sent to the mobile device or wireless device.

In one embodiment, transaction priority can be used in conjunction with characteristics of user activity in shaping or managing traffic, for example, by the traffic shaping engine 255. For example, the traffic shaping engine 255 can, in response to detecting that a user is dormant or inactive, wait to send low priority transactions from the device 250, for a period of time. In addition, the traffic shaping engine 255 can allow multiple low priority transactions to accumulate for batch transferring from the device 250 (e.g., via the batching module 257). In one embodiment, the priorities can be set, configured, or readjusted by a user. For example, content depicted in Table I in the same or similar form can be accessible in a user interface on the device 250 and for example, used by the user to adjust or view the priorities.

The batching module 257 can initiate batch transfer based on certain criteria. For example, batch transfer (e.g., of multiple occurrences of events, some of which occurred at different instances in time) may occur after a certain number of low priority events have been detected, or after an amount of time elapsed after the first of the low priority event was initiated. In addition, the batching module 257 can initiate batch transfer of the cumulated low priority events when a higher priority event is initiated or detected at the device 250. Batch transfer can otherwise be initiated when radio use is triggered for another reason (e.g., to receive data from a remote device such as host server 100 or 300). In one embodiment, an impending pruning event (pruning of an inbox), or any other low priority events, can be executed when a batch transfer occurs.

In general, the batching capability can be disabled or enabled at the event/transaction level, application level, or session level, based on any one or combination of the following: user configuration, device limitations/settings, manufacturer specification, network provider parameters/limitations, platform-specific limitations/settings, device OS settings, etc. In one embodiment, batch transfer can be initiated when an application/window/file is closed out, exited, or moved into the background; users can optionally be prompted before initiating a batch transfer; users can also manually trigger batch transfers.

In one embodiment, the local proxy 275 locally adjusts radio use on the device 250 by caching data in the cache 285. When requests or transactions from the device 250 can be satisfied by content stored in the cache 285, the radio controller 266 need not activate the radio to send the request to a remote entity (e.g., the host server 100, 300, as shown in FIG. 1B and FIG. 3A or a content provider/application server such as the server/provider 110 shown in the examples of FIG. 1B and FIG. 1C). As such, the local proxy 275 can use the local cache 285 and the cache policy manager 245 to locally store data for satisfying data requests to eliminate or reduce the use of the device radio for conservation of network resources and device battery consumption.

In leveraging the local cache, once the request/transaction manager 225 intercepts a data request by an application on the device 250, the local repository 285 can be queried to determine if there is any locally stored response, and also determine whether the response is valid. When a valid response is available in the local cache 285, the response can be provided to the application on the device 250 without the device 250 needing to access the cellular network or wireless broadband network.

If a valid response is not available, the local proxy 275 can query a remote proxy (e.g., the server proxy 325 of FIG. 3A) to determine whether a remotely stored response is valid. If so, the remotely stored response (e.g., which may be stored on the server cache 135 or optional caching server 199 shown in the example of FIG. 1C) can be provided to the mobile device, possibly without the mobile device 250 needing to access the cellular network, thus relieving consumption of network resources.

If a valid cache response is not available, or if cache responses are unavailable for the intercepted data request, the local proxy 275, for example, the caching policy manager 245, can send the data request to a remote proxy (e.g., server proxy 325 of FIG. 3A) which forwards the data request to a content source (e.g., application server/content provider 110 of FIG. 1B) and a response from the content source can be provided through the remote proxy, as will be further described in the description associated with the example host server 300 of FIG. 3A. The cache policy manager 245 can manage or process requests that use a variety of protocols, including but not limited to HTTP, HTTPS, IMAP, POP, SMTP, XMPP, and/or ActiveSync. The caching policy manager 245 can locally store responses for data requests in the local database 285 as cache entries, for subsequent use in satisfying same or similar data requests.

The caching policy manager 245 can request that the remote proxy monitor responses for the data request and the remote proxy can notify the device 250 when an unexpected response to the data request is detected. In such an event, the cache policy manager 245 can erase or replace the locally stored response(s) on the device 250 when notified of the unexpected response (e.g., new data, changed data, additional data, etc.) to the data request. In one embodiment, the caching policy manager 245 is able to detect or identify the protocol used for a specific request, including but not limited to HTTP, HTTPS, IMAP, POP, SMTP, XMPP, and/or ActiveSync. In one embodiment, application specific handlers (e.g., via the application protocol module 246 of the caching policy manager 245) on the local proxy 275 allows for optimization of any protocol that can be port mapped to a handler in the distributed proxy (e.g., port mapped on the proxy server 325 in the example of FIG. 3A).

In one embodiment, the local proxy 275 notifies the remote proxy such that the remote proxy can monitor responses received for the data request from the content source for changed results prior to returning the result to the device 250, for example, when the data request to the content source has yielded same results to be returned to the mobile device. In general, the local proxy 275 can simulate application server responses for applications on the device 250, using locally cached content. This can prevent utilization of the cellular network for transactions where new/changed data is not available, thus freeing up network resources and preventing network congestion.

In one embodiment, the local proxy 275 includes an application behavior detector 236 to track, detect, observe, monitor, applications (e.g., proxy-aware and/or unaware applications 210 and 220) accessed or installed on the device 250. Application behaviors, or patterns in detected behaviors (e.g., via the pattern detector 237) of one or more applications accessed on the device 250 can be used by the local proxy 275 to optimize traffic in a wireless network needed to satisfy the data needs of these applications.

For example, based on detected behavior of multiple applications, the traffic shaping engine 255 can align content requests made by at least some of the applications over the network (wireless network) (e.g., via the alignment module 256). The alignment module 256 can delay or expedite some earlier received requests to achieve alignment. When requests are aligned, the traffic shaping engine 255 can utilize the connection manager to poll over the network to satisfy application data requests. Content requests for multiple applications can be aligned based on behavior patterns or rules/settings including, for example, content types requested by the multiple applications (audio, video, text, etc.), device (e.g., mobile or wireless device) parameters, and/or network parameters/traffic conditions, network service provider constraints/specifications, etc.

In one embodiment, the pattern detector 237 can detect recurrences in application requests made by the multiple applications, for example, by tracking patterns in application behavior. A tracked pattern can include, detecting that certain applications, as a background process, poll an application server regularly, at certain times of day, on certain days of the week, periodically in a predictable fashion, with a certain frequency, with a certain frequency in response to a certain type of event, in response to a certain type user query, frequency that requested content is the same, frequency with which a same request is made, interval between requests, applications making a request, or any combination of the above, for example.

Such recurrences can be used by traffic shaping engine 255 to offload polling of content from a content source (e.g., from an application server/content provider 110 of FIG. 1A) that would result from the application requests that would be performed at the mobile device or wireless device 250 to be performed instead, by a proxy server (e.g., proxy server 125 of FIG. 1C or proxy server 325 of FIG. 3A) remote from the device 250. Traffic shaping engine 255 can decide to offload the polling when the recurrences match a rule. For example, there are multiple occurrences or requests for the same resource that have exactly the same content, or returned value, or based on detection of repeatable time periods between requests and responses such as a resource that is requested at specific times during the day. The offloading of the polling can decrease the amount of bandwidth consumption needed by the mobile device 250 to establish a wireless (cellular or other wireless broadband) connection with the content source for repetitive content polls.

As a result of the offloading of the polling, locally cached content stored in the local cache 285 can be provided to satisfy data requests at the device 250, when content change is not detected in the polling of the content sources. As such, when data has not changed, application data needs can be satisfied without needing to enable radio use or occupying cellular bandwidth in a wireless network. When data has changed and/or new data has been received, the remote entity to which polling is offloaded, can notify the device 250. The remote entity may be the host server 300 as shown in the example of FIG. 3A.

In one embodiment, the local proxy 275 can mitigate the need/use of periodic keep-alive messages (heartbeat messages) to maintain TCP/IP connections, which can consume significant amounts of power thus having detrimental impacts on mobile device battery life. The connection manager 265 in the local proxy (e.g., the heartbeat manager 267) can detect, identify, and intercept any or all heartbeat (keep-alive) messages being sent from applications.

The heartbeat manager 267 can prevent any or all of these heartbeat messages from being sent over the cellular, or other network, and instead rely on the server component of the distributed proxy system (e.g., shown in FIG. 1C) to generate and send the heartbeat messages to maintain a connection with the backend (e.g., application server/provider 110 in the example of FIG. 1A).

The local proxy 275 generally represents any one or a portion of the functions described for the individual managers, modules, and/or engines. The local proxy 275 and device 250 can include additional or less components; more or less functions can be included, in whole or in part, without deviating from the novel art of the disclosure.

In one embodiment, the caching policy manager 245 includes a metadata generator 203, a cache look-up engine 205, a cache appropriateness decision engine 246, a poll schedule generator 247, an application protocol module 248, a cache or connect selection engine 249 and/or a local cache invalidator 244. The cache appropriateness decision engine 246 can further include a timing predictor 246a, a content predictor 246b, a request analyzer 246c, and/or a response analyzer 246d, and the cache or connect selection engine 249 includes a response scheduler 249a. The metadata generator 203 and/or the cache look-up engine 205 are coupled to the cache 285 (or local cache) for modification or addition to cache entries or querying thereof.

The cache look-up engine 205 may further include an ID or URI filter 205a, the local cache invalidator 244 may further include a TTL manager 244a, and the poll schedule generator 247 may further include a schedule update engine 247a and/or a time adjustment engine 247b. One embodiment of caching policy manager 245 includes an application cache policy repository 243. In one embodiment, the application behavior detector 236 includes a pattern detector 237, a poll interval detector 238, an application profile generator 239, and/or a priority engine 241. The poll interval detector 238 may further include a long poll detector 238a having a response/request tracking engine 238b. The poll interval detector 238 may further include a long poll hunting detector 238c. The application profile generator 239 can further include a response delay interval tracker 239a.

The pattern detector 237, application profile generator 239, and the priority engine 241 were also described in association with the description of the pattern detector shown in the example of FIG. 2A. One embodiment further includes an application profile repository 242 which can be used by the local proxy 275 to store information or metadata regarding application profiles (e.g., behavior, patterns, type of HTTP requests, etc.)

The cache appropriateness decision engine 246 can detect, assess, or determine whether content from a content source (e.g., application server/content provider 110 in the example of FIG. 1B) with which a mobile device 250 interacts and has content that may be suitable for caching. For example, the decision engine 246 can use information about a request and/or a response received for the request initiated at the mobile device 250 to determine cacheability, potential cacheability, or non-cacheability. In some instances, the decision engine 246 can initially verify whether a request is directed to a blacklisted destination or whether the request itself originates from a blacklisted client or application. If so, additional processing and analysis may not be performed by the decision engine 246 and the request may be allowed to be sent over the air to the server to satisfy the request. The black listed destinations or applications/clients (e.g., mobile applications) can be maintained locally in the local proxy (e.g., in the application profile repository 242) or remotely (e.g., in the proxy server 325 or another entity).

In one embodiment, the decision engine 246, for example, via the request analyzer 246c, collects information about an application or client request generated at the mobile device 250. The request information can include request characteristics information including, for example, request method. For example, the request method can indicate the type of HTTP request generated by the mobile application or client. In one embodiment, response to a request can be identified as cacheable or potentially cacheable if the request method is a GET request or POST request. Other types of requests (e.g., OPTIONS, HEAD, PUT, DELETE, TRACE, or CONNECT) may or may not be cached. In general, HTTP requests with uncacheable request methods will not be cached.

Request characteristics information can further include information regarding request size, for example. Responses to requests (e.g., HTTP requests) with body size exceeding a certain size will not be cached. For example, cacheability can be determined if the information about the request indicates that a request body size of the request does not exceed a certain size. In some instances, the maximum cacheable request body size can be set to 8092 bytes. In other instances, different values may be used, dependent on network capacity or network operator specific settings, for example.

In some instances, content from a given application server/content provider (e.g., the server/content provider 110 of FIG. 1C) is determined to be suitable for caching based on a set of criteria, for example, criteria specifying time criticality of the content that is being requested from the content source. In one embodiment, the local proxy (e.g., the local proxy 175 or 275 of FIG. 1C and FIG. 2A) applies a selection criteria to store the content from the host server which is requested by an application as cached elements in a local cache on the mobile device to satisfy subsequent requests made by the application.

The cache appropriateness decision engine 246, further based on detected patterns of requests sent from the mobile device 250 (e.g., by a mobile application or other types of clients on the device 250) and/or patterns of received responses, can detect predictability in requests and/or responses. For example, the request characteristics information collected by the decision engine 246, (e.g., the request analyzer 246c) can further include periodicity information between a request and other requests generated by a same client on the mobile device or other requests directed to the same host (e.g., with similar or same identifier parameters).

Periodicity can be detected, by the decision engine 246 or the request analyzer 246c, when the request and the other requests generated by the same client occur at a fixed rate or nearly fixed rate, or at a dynamic rate with some identifiable or partially or wholly reproducible changing pattern. If the requests are made with some identifiable pattern (e.g., regular intervals, intervals having a detectable pattern, or trend (e.g., increasing, decreasing, constant, etc.) the timing predictor 246a can determine that the requests made by a given application on a device is predictable and identify it to be potentially appropriate for caching, at least from a timing standpoint.

An identifiable pattern or trend can generally include any application or client behavior which may be simulated either locally, for example, on the local proxy 275 on the mobile device 250 or simulated remotely, for example, by the proxy server 325 on the host 300, or a combination of local and remote simulation to emulate application behavior.

In one embodiment, the decision engine 246, for example, via the response analyzer 246d, can collect information about a response to an application or client request generated at the mobile device 250. The response is typically received from a server or the host of the application (e.g., mobile application) or client which sent the request at the mobile device 250. In some instances, the mobile client or application can be the mobile version of an application (e.g., social networking, search, travel management, voicemail, contact manager, email) or a web site accessed via a web browser or via a desktop client.

For example, response characteristics information can include an indication of whether transfer encoding or chunked transfer encoding is used in sending the response. In some instances, responses to HTTP requests with transfer encoding or chunked transfer encoding are not cached, and therefore are also removed from further analysis. The rationale here is that chunked responses are usually large and non-optimal for caching, since the processing of these transactions may likely slow down the overall performance. Therefore, in one embodiment, cacheability or potential for cacheability can be determined when transfer encoding is not used in sending the response.

In addition, the response characteristics information can include an associated status code of the response which can be identified by the response analyzer 246d. In some instances, HTTP responses with uncacheable status codes are typically not cached. The response analyzer 246d can extract the status code from the response and determine whether it matches a status code which is cacheable or uncacheable. Some cacheable status codes include by way of example: 200—OK, 301—Redirect, 302—Found, 303—See other, 304—Not Modified, 307 Temporary Redirect, or 500—Internal server error. Some uncacheable status codes can include, for example, 403—Forbidden or 404—Not found.

In one embodiment, cacheability or potential for cacheability can be determined if the information about the response does not indicate an uncacheable status code or indicates a cacheable status code. If the response analyzer 246d detects an uncacheable status code associated with a given response, the specific transaction (request/response pair) may be eliminated from further processing and determined to be uncacheable on a temporary basis, a semi-permanent, or a permanent basis. If the status code indicates cacheability, the transaction (e.g., request and/or response pair) may be subject to further processing and analysis to confirm cacheability, as shown in the example flow charts of FIGS. 9-10.

Response characteristics information can also include response size information. In general, responses can be cached locally at the mobile device 250 if the responses do not exceed a certain size. In some instances, the default maximum cached response size is set to 115 KB. In other instances, the max cacheable response size may be different and/or dynamically adjusted based on operating conditions, network conditions, network capacity, user preferences, network operator requirements, or other application-specific, user specific, and/or device-specific reasons. In one embodiment, the response analyzer 246d can identify the size of the response, and cacheability or potential for cacheability can be determined if a given threshold or max value is not exceeded by the response size.

Furthermore, response characteristics information can include response body information for the response to the request and other response to other requests generated by a same client on the mobile device, or directed to a same content host or application server. The response body information for the response and the other responses can be compared, for example, by the response analyzer 246d, to prevent the caching of dynamic content (or responses with content that changes frequently and cannot be efficiently served with cache entries, such as financial data, stock quotes, news feeds, real-time sporting event activities, etc.), such as content that would no longer be relevant or up-to-date if served from cached entries.

The cache appropriateness decision engine 246 (e.g., the content predictor 246b) can definitively identify repeatability or identify indications of repeatability, potential repeatability, or predictability in responses received from a content source (e.g., the content host/application server 110 shown in the example of FIG. 1C). Repeatability can be detected by, for example, tracking at least two responses received from the content source and determines if the two responses are the same. For example, cacheability can be determined, by the response analyzer 246d, if the response body information for the response and the other responses sent by the same mobile client or directed to the same host/server are same or substantially the same. The two responses may or may not be responses sent in response to consecutive requests. In one embodiment, hash values of the responses received for requests from a given application are used to determine repeatability of content (with or without heuristics) for the application in general and/or for the specific request. Additional same responses may be required for some applications or under certain circumstances.

Repeatability in received content need not be 100% ascertained. For example, responses can be determined to be repeatable if a certain number or a certain percentage of responses are the same, or similar. The certain number or certain percentage of same/similar responses can be tracked over a select period of time, set by default or set based on the application generating the requests (e.g., whether the application is highly dynamic with constant updates or less dynamic with infrequent updates). Any indicated predictability or repeatability, or possible repeatability, can be utilized by the distributed system in caching content to be provided to a requesting application or client on the mobile device 250.

In one embodiment, for a long poll type request, the local proxy 175 can begin to cache responses on a third request when the response delay times for the first two responses are the same, substantially the same, or detected to be increasing in intervals. In general, the received responses for the first two responses should be the same, and upon verifying that the third response received for the third request is the same (e.g., if R0=R1=R2), the third response can be locally cached on the mobile device. Less or more same responses may be required to begin caching, depending on the type of application, type of data, type of content, user preferences, or carrier/network operator specifications.

Increasing response delays with same responses for long polls can indicate a hunting period (e.g., a period in which the application/client on the mobile device is seeking the longest time between a request and response that a given network will allow), as detected by the long poll hunting detector 238c of the application behavior detector 236.

An example can be described below using T0, T1, T2, where T indicates the delay time between when a request is sent and when a response (e.g., the response header) is detected/received for consecutive requests:

T0=Response0(t)−Request0(t)=180 s.(+/−tolerance)
T1=Response1(t)−Request1(t)=240 s.(+/−tolerance)
T2=Response2(t)−Request2(t)=500 s.(+/−tolerance)

In the example timing sequence shown above, T0<T1<T2, this may indicate a hunting pattern for a long poll when network timeout has not yet been reached or exceeded. Furthermore, if the responses R0, R1, and R2 received for the three requests are the same, R2 can be cached. In this example, R2 is cached during the long poll hunting period without waiting for the long poll to settle, thus expediting response caching (e.g., this is optional accelerated caching behavior which can be implemented for all or select applications).

As such, the local proxy 275 can specify information that can be extracted from the timing sequence shown above (e.g., polling schedule, polling interval, polling type) to the proxy server and begin caching and to request the proxy server to begin polling and monitoring the source (e.g., using any of T0, T1, T2 as polling intervals but typically T2, or the largest detected interval without timing out, and for which responses from the source is received will be sent to the proxy server 325 of FIG. 3A for use in polling the content source (e.g., application server/service provider 310)).

However, if the time intervals are detected to be getting shorter, the application (e.g., mobile application)/client may still be hunting for a time interval for which a response can be reliably received from the content source (e.g., application/server server/provider 110 or 310), and as such caching typically should not begin until the request/response intervals indicate the same time interval or an increasing time interval, for example, for a long poll type request.

An example of handling a detected decreasing delay can be described below using T0, T1, T2, T3, and T4 where T indicates the delay time between when a request is sent and when a response (e.g., the response header) is detected/received for consecutive requests:

T0=Response0(t)−Request0(t)=160 s.(+/−tolerance)
T1=Response1(t)−Request1(t)=240 s.(+/−tolerance)
T2=Response2(t)−Request2(t)=500 s.(+/−tolerance)
T3=Time out at 700 s.(+/−tolerance)
T4=Response4(t)−Request4(t)=600(+/−tolerance)

If a pattern for response delays T1<T2<T3>T4 is detected, as shown in the above timing sequence (e.g., detected by the long poll hunting detector 238c of the application behavior detector 236), it can be determined that T3 likely exceeded the network time out during a long poll hunting period. In Request 3, a response likely was not received since the connection was terminated by the network, application, server, or other reason before a response was sent or available. On Request 4 (after T4), if a response (e.g., Response 4) is detected or received, the local proxy 275 can then use the response for caching (if the content repeatability condition is met). The local proxy can also use T4 as the poll interval in the polling schedule set for the proxy server to monitor/poll the content source.

Note that the above description shows that caching can begin while long polls are in hunting mode in the event of detecting increasing response delays, as long as responses are received and not timed out for a given request. This can be referred to as the optional accelerated caching during long poll hunting. Caching can also begin after the hunting mode (e.g., after the poll requests have settled to a constant or near constant delay value) has completed. Note that hunting may or may not occur for long polls and when hunting occurs; the proxy 275 can generally detect this and determine whether to begin to cache during the hunting period (increasing intervals with same responses) or wait until the hunt settles to a stable value.

In one embodiment, the timing predictor 246a of the cache appropriateness decision engine 246 can track timing of responses received from outgoing requests from an application (e.g., mobile application) or client to detect any identifiable patterns which can be partially wholly reproducible, such that locally cached responses can be provided to the requesting client on the mobile device 250 in a manner that simulates content source (e.g., application server/content provider 110 or 310) behavior. For example, the manner in which (e.g., from a timing standpoint) responses or content would be delivered to the requesting application/client on the device 250. This ensures preservation of user experience when responses to application or mobile client requests are served from a local and/or remote cache instead of being retrieved/received directly from the content source (e.g., application, content provider 110 or 310).

In one embodiment, the decision engine 246 or the timing predictor 246a determines the timing characteristics a given application (e.g., mobile application) or client from, for example, the request/response tracking engine 238b and/or the application profile generator 239 (e.g., the response delay interval tracker 239a). Using the timing characteristics, the timing predictor 246a determines whether the content received in response to the requests are suitable or are potentially suitable for caching. For example, poll request intervals between two consecutive requests from a given application can be used to determine whether request intervals are repeatable (e.g., constant, near constant, increasing with a pattern, decreasing with a pattern, etc.) and can be predicted and thus reproduced at least some of the times either exactly or approximated within a tolerance level.

In some instances, the timing characteristics of a given request type for a specific application, for multiple requests of an application, or for multiple applications can be stored in the application profile repository 242. The application profile repository 242 can generally store any type of information or metadata regarding application request/response characteristics including timing patterns, timing repeatability, content repeatability, etc.

The application profile repository 242 can also store metadata indicating the type of request used by a given application (e.g., long polls, long-held HTTP requests, HTTP streaming, push, COMET push, etc.) Application profiles indicating request type by applications can be used when subsequent same/similar requests are detected, or when requests are detected from an application which has already been categorized. In this manner, timing characteristics for the given request type or for requests of a specific application which has been tracked and/or analyzed, need not be reanalyzed.

Application profiles can be associated with a time-to-live (e.g., or a default expiration time). The use of an expiration time for application profiles, or for various aspects of an application or request's profile can be used on a case by case basis. The time-to-live or actual expiration time of application profile entries can be set to a default value or determined individually, or a combination thereof. Application profiles can also be specific to wireless networks, physical networks, network operators, or specific carriers.

One embodiment includes an application blacklist manager 201. The application blacklist manager 201 can be coupled to the application cache policy repository 243 and can be partially or wholly internal to local proxy or the caching policy manager 245. Similarly, the blacklist manager 201 can be partially or wholly internal to local proxy or the application behavior detector 236. The blacklist manager 201 can aggregate, track, update, manage, adjust, or dynamically monitor a list of destinations of servers/host that are ‘blacklisted,’ or identified as not cached, on a permanent or temporary basis. The blacklist of destinations, when identified in a request, can potentially be used to allow the request to be sent over the (cellular) network for servicing. Additional processing on the request may not be performed since it is detected to be directed to a blacklisted destination.

Blacklisted destinations can be identified in the application cache policy repository 243 by address identifiers including specific URIs or patterns of identifiers including URI patterns. In general, blacklisted destinations can be set by or modified for any reason by any party including the user (owner/user of mobile device 250), operating system/mobile platform of device 250, the destination itself, network operator (of cellular network), Internet service provider, other third parties, or according to a list of destinations for applications known to be uncacheable/not suited for caching. Some entries in the blacklisted destinations may include destinations aggregated based on the analysis or processing performed by the local proxy (e.g., cache appropriateness decision engine 246).

For example, applications or mobile clients on the mobile device for which responses have been identified as non-suitable for caching can be added to the blacklist. Their corresponding hosts/servers may be added in addition to or in lieu of an identification of the requesting application/client on the mobile device 250. Some or all of such clients identified by the proxy system can be added to the blacklist. For example, for all application clients or applications that are temporarily identified as not being suitable for caching, only those with certain detected characteristics (based on timing, periodicity, frequency of response content change, content predictability, size, etc.) can be blacklisted.

The blacklisted entries may include a list of requesting applications or requesting clients on the mobile device (rather than destinations) such that, when a request is detected from a given application or given client, it may be sent through the network for a response, since responses for blacklisted clients/applications are in most circumstances not cached.

A given application profile may also be treated or processed differently (e.g., different behavior of the local proxy 275 and the remote proxy 325) depending on the mobile account associated with a mobile device from which the application is being accessed. For example, a higher paying account, or a premier account may allow more frequent access of the wireless network or higher bandwidth allowance thus affecting the caching policies implemented between the local proxy 275 and proxy server 325 with an emphasis on better performance compared to conservation of resources. A given application profile may also be treated or processed differently under different wireless network conditions (e.g., based on congestion or network outage, etc.).

Note that cache appropriateness can be determined, tracked, and managed for multiple clients or applications on the mobile device 250. Cache appropriateness can also be determined for different requests or request types initiated by a given client or application on the mobile device 250. The caching policy manager 245, along with the timing predictor 246a and/or the content predictor 246b which heuristically determines or estimates predictability or potential predictability, can track, manage and store cacheability information for various application or various requests for a given application. Cacheability information may also include conditions (e.g., an application can be cached at certain times of the day, or certain days of the week, or certain requests of a given application can be cached, or all requests with a given destination address can be cached) under which caching is appropriate which can be determined and/or tracked by the cache appropriateness decision engine 246 and stored and/or updated when appropriate in the application cache policy repository 243 coupled to the cache appropriateness decision engine 246.

The information in the application cache policy repository 243 regarding cacheability of requests, applications, and/or associated conditions can be used later on when same requests are detected. In this manner, the decision engine 246 and/or the timing and content predictors 246a/b need not track and reanalyze request/response timing and content characteristics to make an assessment regarding cacheability. In addition, the cacheability information can in some instances be shared with local proxies of other mobile devices by way of direct communication or via the host server (e.g., proxy server 325 of host server 300).

For example, cacheability information detected by the local proxy 275 on various mobile devices can be sent to a remote host server or a proxy server 325 on the host server (e.g., host server 300 or proxy server 325 shown in the example of FIG. 3A, host 100 and proxy server 125 in the example of FIGS. 1B-C). The remote host or proxy server can then distribute the information regarding application-specific, request-specific cacheability information and/or any associated conditions to various mobile devices or their local proxies in a wireless network or across multiple wireless networks (same service provider or multiple wireless service providers) for their use.

In general, the selection criteria for caching can further include, by way of example but not limitation, the state of the mobile device indicating whether the mobile device is active or inactive, network conditions, and/or radio coverage statistics. The cache appropriateness decision engine 246 can in any one or any combination of the criteria, and in any order, identifying sources for which caching may be suitable.

The response can be stored in the cache 285 (e.g., also referred as the local cache) as a cache entry. In addition to the response to a request, the cached entry can include response metadata having additional information regarding caching of the response. The metadata may be generated by the metadata generator 203 and can include, for example, timing data such as the access time of the cache entry or creation time of the cache entry. Metadata can include additional information, such as any information suited for use in determining whether the response stored as the cached entry is used to satisfy the subsequent response. For example, metadata information can further include, request timing history (e.g., including request time, request start time, request end time), hash of the request and/or response, time intervals or changes in time intervals, etc.

The cache entry is typically stored in the cache 285 in association with a time-to-live (TTL), which for example may be assigned or determined by the TTL manager 244a of the cache invalidator 244. The time-to-live of a cache entry is the amount of time the entry is persisted in the cache 285 regardless of whether the response is still valid or relevant for a given request or client/application on the mobile device 250. For example, if the time-to-live of a given cache entry is set to 12 hours, the cache entry is purged, removed, or otherwise indicated as having exceeded the time-to-live, even if the response body contained in the cache entry is still current and applicable for the associated request.

A default time-to-live can be automatically used for all entries unless otherwise specified (e.g., by the TTL manager 244a), or each cache entry can be created with its individual TTL (e.g., determined by the TTL manager 244a based on various dynamic or static criteria). Note that each entry can have a single time-to-live associated with both the response data and any associated metadata. In some instances, the associated metadata may have a different time-to-live (e.g., a longer time-to-live) than the response data.

The content source having content for caching can, in addition or in alternate, be identified to a proxy server (e.g., proxy server 125 or 325 shown in the examples of FIGS. 1B-1C and FIG. 3A, respectively) remote from and in wireless communication with the mobile device 250 such that the proxy server can monitor the content source (e.g., application server/content provider 110) for new or changed data. Similarly, the local proxy (e.g., the local proxy 175 or 275 of FIGS. 1B-1C and FIG. 2A, respectively) can identify to the proxy server that content received from a specific application server/content provider is being stored as cached elements in the local cache 285.

Once content has been locally cached, the cache policy manager 245, upon receiving future polling requests to contact the application server/content host (e.g., 110 or 310), can retrieve the cached elements from the local cache to respond to the polling request made at the mobile device 250 such that a radio of the mobile device is not activated to service the polling request. For example, the cache look-up engine 205 can query the cache 285 to identify the response to be served to a response. The response can be served from the cache in response to identifying a matching cache entry and also using any metadata stored with the response in the cache entry. The cache entries can be queried by the cache look-up engine using a URI of the request or another type of identifier (e.g., via the ID or URI filter 205a). The cache-lookup engine 205 can further use the metadata (e.g., extract any timing information or other relevant information) stored with the matching cache entry to determine whether response is still suited for use in being served to a current request.

Note that the cache-look-up can be performed by the engine 205 using one or more of various multiple strategies. In one embodiment, multiple cook-up strategies can be executed sequentially on each entry store din the cache 285, until at least one strategy identifies a matching cache entry. The strategy employed to performing cache look-up can include a strict matching criteria or a matching criteria which allows for non-matching parameters.

For example, the look-up engine 205 can perform a strict matching strategy which searches for an exact match between an identifier (e.g., a URI for a host or resource) referenced in a present request for which the proxy is attempting to identify a cache entry and an identifier stored with the cache entries. In the case where identifiers include URIs or URLs, the matching algorithm for strict matching will search for a cache entry where all the parameters in the URLs match. For example:

Example 1

1. Cache contains entry for http://test.com/products/

2. Request is being made to URI http://test.com/products/

Strict strategy will find a match, since both URIs are same.

Example 2

1. Cache contains entry for http://test.com/products/?query=all

2. Request is being made to URI http://test.com/products/?query=sub

Under the strict strategy outlined above, a match will not be found since the URIs differ in the query parameter.

In another example strategy, the look-up engine 205 looks for a cache entry with an identifier that partially matches the identifier references in a present request for which the proxy is attempting to identify a matching cache entry. For example, the look-up engine 205 may look for a cache entry with an identifier which differs from the request identifier by a query parameter value. In utilizing this strategy, the look-up engine 205 can collect information collected for multiple previous requests (e.g., a list of arbitrary parameters in an identifier) to be later checked with the detected arbitrary parameter in the current request. For example, in the case where cache entries are stored with URI or URL identifiers, the look-up engine searches for a cache entry with a URI differing by a query parameter. If found, the engine 205 can examine the cache entry for information collected during previous requests (e.g. a list of arbitrary parameters) and checked whether the arbitrary parameter detected in or extracted from the current URI/URL belongs to the arbitrary parameters list.

Example 1

1. Cache contains entry for http://test.com/products/?query=all, where query is marked as arbitrary.

2. Request is being made to URI http://text.com/products/?query=sub

Match will be found, since query parameter is marked as arbitrary.

Example 2

1. Cache contains entry for http://test.com/products/?query=all, where query is marked as arbitrary.

2. Request is being made to URI http://test.com/products/?query=sub&sort=asc

Match will not be found, since current request contains sort parameter which is not marked as arbitrary in the cache entry.

Additional strategies for detecting cache hit may be employed. These strategies can be implemented singly or in any combination thereof. A cache-hit can be determined when any one of these strategies determines a match. A cache miss may be indicated when the look-up engine 205 determines that the requested data cannot be served from the cache 285, for any reason. For example, a cache miss may be determined when no cache entries are identified for any or all utilized look-up strategies.

Cache miss may also be determined when a matching cache entry exists but determined to be invalid or irrelevant for the current request. For example, the look-up engine 205 may further analyze metadata (e.g., which may include timing data of the cache entry) associated with the matching cache entry to determine whether it is still suitable for use in responding to the present request.

When the look-up engine 205 has identified a cache hit (e.g., an event indicating that the requested data can be served from the cache), the stored response in the matching cache entry can be served from the cache to satisfy the request of an application/client.

By servicing requests using cache entries stored in cache 285, network bandwidth and other resources need not be used to request/receive poll responses which may have not changed from a response that has already been received at the mobile device 250. Such servicing and fulfilling application (e.g., mobile application) requests locally via cache entries in the local cache 285 allows for more efficient resource and mobile network traffic utilization and management since the request need not be sent over the wireless network further consuming bandwidth. In general, the cache 285 can be persisted between power on/off of the mobile device 250, and persisted across application/client refreshes and restarts.

For example, the local proxy 275, upon receipt of an outgoing request from its mobile device 250 or from an application or other type of client on the mobile device 250, can intercept the request and determine whether a cached response is available in the local cache 285 of the mobile device 250. If so, the outgoing request is responded to by the local proxy 275 using the cached response on the cache of the mobile device. As such, the outgoing request can be filled or satisfied without a need to send the outgoing request over the wireless network, thus conserving network resources and battery consumption.

In one embodiment, the responding to the requesting application/client on the device 250 is timed to correspond to a manner in which the content server would have responded to the outgoing request over a persistent connection (e.g., over the persistent connection, or long-held HTTP connection, long poll type connection, that would have been established absent interception by the local proxy). The timing of the response can be emulated or simulated by the local proxy 275 to preserve application behavior such that end user experience is not affected, or minimally affected by serving stored content from the local cache 285 rather than fresh content received from the intended content source (e.g., content host/application server 110 of FIG. 1B-FIG. 1C). The timing can be replicated exactly or estimated within a tolerance parameter, which may go unnoticed by the user or treated similarly by the application so as to not cause operation issues.

For example, the outgoing request can be a request for a persistent connection intended for the content server (e.g., application server/content provider of examples of FIGS. 1B-1C). In a persistent connection (e.g., long poll, COMET-style push or any other push simulation in asynchronous HTTP requests, long-held HTTP request, HTTP streaming, or others) with a content source (server), the connection is held for some time after a request is sent. The connection can typically be persisted between the mobile device and the server until content is available at the server to be sent to the mobile device. Thus, there typically can be some delay in time between when a long poll request is sent and when a response is received from the content source. If a response is not provided by the content source for a certain amount of time, the connection may also terminate due to network reasons (e.g., socket closure) if a response is not sent.

Thus, to emulate a response from a content server sent over a persistent connection (e.g., a long poll style connection), the manner of response of the content server can be simulated by allowing a time interval to elapse before responding to the outgoing request with the cached response. The length of the time interval can be determined on a request by request basis or on an application by application (client by client basis), for example.

In one embodiment, the time interval is determined based on request characteristics (e.g., timing characteristics) of an application on the mobile device from which the outgoing request originates. For example, poll request intervals (e.g., which can be tracked, detected, and determined by the long poll detector 238a of the poll interval detector 238) can be used to determine the time interval to wait before responding to a request with a local cache entry and managed by the response scheduler 249a.

One embodiment of the cache policy manager 245 includes a poll schedule generator 247 which can generate a polling schedule for one or more applications on the mobile device 250. The polling schedule can specify a polling interval that can be employed by an entity which is physically distinct and/or separate from the mobile device 250 in monitoring the content source for one or more applications (such that cached responses can be verified periodically by polling a host server (host server 110 or 310) to which the request is directed) on behalf of the mobile device. One example of such an external entity which can monitor the content at the source for the mobile device 250 is a proxy server (e.g., proxy server 125 or 325 shown in the examples of FIGS. 1B-1C and FIGS. 3A-C).

The polling schedule (e.g., including a rate/frequency of polling) can be determined, for example, based on the interval between the polling requests directed to the content source from the mobile device. The polling schedule or rate of polling may be determined at the mobile device 250 (by the local proxy). In one embodiment, the poll interval detector 238 of the application behavior detector 236 can monitor polling requests directed to a content source from the mobile device 250 in order to determine an interval between the polling requests made from any or all application (e.g., mobile application).

For example, the poll interval detector 238 can track requests and responses for applications or clients on the device 250. In one embodiment, consecutive requests are tracked prior to detection of an outgoing request initiated from the application (e.g., mobile application) on the mobile device 250 by the same mobile client or application (e.g., mobile application). The polling rate can be determined using request information collected for the request for which the response is cached. In one embodiment, the rate is determined from averages of time intervals between previous requests generated by the same client which generated the request. For example, a first interval may be computed between the current request and a previous request, and a second interval can be computed between the two previous requests. The polling rate can be set from the average of the first interval and the second interval and sent to the proxy server in setting up the caching strategy.

Alternate intervals may be computed in generating an average; for example, multiple previous requests in addition to two previous requests may be used, and more than two intervals may be used in computing an average. In general, in computing intervals, a given request need not have resulted in a response to be received from the host server/content source in order to use it for interval computation. In other words, the timing characteristics of a given request may be used in interval computation, as long as the request has been detected, even if the request failed in sending, or if the response retrieval failed.

One embodiment of the poll schedule generator 247 includes a schedule update engine 247a and/or a time adjustment engine 247b. The schedule update engine 247a can determine a need to update a rate or polling interval with which a given application server/content host from a previously set value, based on a detected interval change in the actual requests generated from a client or application (e.g., mobile application) on the mobile device 250.

For example, a request for which a monitoring rate was determined may now be sent from the application (e.g., mobile application) or client at a different request interval. The scheduled update engine 247a can determine the updated polling interval of the actual requests and generate a new rate, different from the previously set rate to poll the host at on behalf of the mobile device 250. The updated polling rate can be communicated to the remote proxy (proxy server 325) over the cellular network for the remote proxy to monitor the given host. In some instances, the updated polling rate may be determined at the remote proxy or remote entity which monitors the host.

In one embodiment, the time adjustment engine 247b can further optimize the poll schedule generated to monitor the application server/content source (110 or 310). For example, the time adjustment engine 247b can optionally specify a time to start polling to the proxy server. For example, in addition to setting the polling interval at which the proxy server is to monitor the application, server/content host can also specify the time at which an actual request was generated at the mobile client/application.

However, in some cases, due to inherent transmission delay or added network delays or other types of latencies, the remote proxy server receives the poll setup from the local proxy with some delay (e.g., a few minutes, or a few seconds). This has the effect of detecting response change at the source after a request is generated by the mobile client/application causing the invalidate of the cached response to occur after it has once again been served to the application after the response is no longer current or valid.

To resolve this non-optimal result of serving the out-dated content once again before invalidating it, the time adjustment engine 247b can specify the time (t0) at which polling should begin in addition to the rate, where the specified initial time t0 can be specified to the proxy server 325 as a time that is less than the actual time when the request was generated by the mobile app/client. This way, the server polls the resource slightly before the generation of an actual request by the mobile client such that any content change can be detected prior to an actual application request. This prevents invalid or irrelevant out-dated content/response from being served once again before fresh content is served.

In one embodiment, an outgoing request from a mobile device 250 is detected to be for a persistent connection (e.g., a long poll, COMET style push, and long-held (HTTP) request) based on timing characteristics of prior requests from the same application or client on the mobile device 250. For example, requests and/or corresponding responses can be tracked by the request/response tracking engine 238b of the long poll detector 238a of the poll interval detector 238.

The timing characteristics of the consecutive requests can be determined to set up a polling schedule for the application or client. The polling schedule can be used to monitor the content source (content source/application server) for content changes such that cached content stored on the local cache in the mobile device 250 can be appropriately managed (e.g., updated or discarded). In one embodiment, the timing characteristics can include, for example, a response delay time (‘D’) and/or an idle time (‘IT’).

In one embodiment, the response/request tracking engine 238b can track requests and responses to determine, compute, and/or estimate, the timing diagrams for applicant or client requests.

For example, the response/request tracking engine 238b detects a first request (Request 0) initiated by a client on the mobile device and a second request (Request 1) initiated by the client on the mobile device after a response is received at the mobile device responsive to the first request. The second request is one that is subsequent to the first request.

In one embodiment, the response/request tracking engine 238b can track requests and responses to determine, compute, and/or estimate the timing diagrams for applicant or client requests. The response/request tracking engine 238b can detect a first request initiated by a client on the mobile device and a second request initiated by the client on the mobile device after a response is received at the mobile device responsive to the first request. The second request is one that is subsequent to the first request.

The response/request tracking engine 238b further determines relative timings between the first, second requests, and the response received in response to the first request. In general, the relative timings can be used by the long poll detector 238a to determine whether requests generated by the application are long poll requests.

Note that in general, the first and second requests that are used by the response/request tracking engine 238b in computing the relative timings are selected for use after a long poll hunting period has settled or in the event when long poll hunting does not occur. Timing characteristics that are typical of a long poll hunting period can be, for example, detected by the long poll hunting detector 238c. In other words, the requests tracked by the response/request tracking engine 238b and used for determining whether a given request is a long poll occurs after the long poll has settled.

In one embodiment, the long poll hunting detector 238c can identify or detect hunting mode, by identifying increasing request intervals (e.g., increasing delays). The long poll hunting detector 238a can also detect hunting mode by detecting increasing request intervals, followed by a request with no response (e.g., connection timed out), or by detecting increasing request intervals followed by a decrease in the interval. In addition, the long poll hunting detector 238c can apply a filter value or a threshold value to request-response time delay value (e.g., an absolute value) above which the detected delay can be considered to be a long poll request-response delay. The filter value can be any suitable value characteristic of long polls and/or network conditions (e.g., 2 s, 5 s, 10 s, 15 s, 20 s., etc.) and can be used as a filter or threshold value.

The response delay time (‘D’) refers to the start time to receive a response after a request has been sent and the idle refers to time to send a subsequent request after the response has been received. In one embodiment, the outgoing request is detected to be for a persistent connection based on a comparison (e.g., performed by the tracking engine 238b) of the response delay time relative (‘D’) or average of (‘D’) (e.g., any average over any period of time) to the idle time (‘IT’), for example, by the long poll detector 238a. The number of averages used can be fixed, dynamically adjusted, or changed over a longer period of time. For example, the requests initiated by the client are determined to be long poll requests if the response delay time interval is greater than the idle time interval (D>IT or D>>IT). In one embodiment, the tracking engine 238b of the long poll detector computes, determines, or estimates the response delay time interval as the amount of time elapsed between time of the first request and initial detection or full receipt of the response.

In one embodiment, a request is detected to be for a persistent connection when the idle time (‘IT’) is short since persistent connections, established in response to long poll requests or long poll HTTP requests for example, can also be characterized in detecting immediate or near-immediate issuance of a subsequent request after receipt of a response to a previous request (e.g., IT ˜0). As such, the idle time (‘IT’) can also be used to detect such immediate or near-immediate re-request to identify long poll requests. The absolute or relative timings determined by the tracking engine 238b are used to determine whether the second request is immediately or near-immediately re-requested after the response to the first request is received. For example, a request may be categorized as a long poll request if D+RT+IT˜D+RT since IT is small for this to hold true. IT may be determined to be small if it is less than a threshold value. Note that the threshold value could be fixed or calculated over a limited time period (a session, a day, a month, etc.), or calculated over a longer time period (e.g., several months or the life of the analysis). For example, for every request, the average IT can be determined, and the threshold can be determined using this average IT (e.g., the average IT less a certain percentage may be used as the threshold). This can allow the threshold to automatically adapt over time to network conditions and changes in server capability, resource availability or server response. A fixed threshold can take upon any value including by way of example but not limitation (e.g., 1 s. 2 s. 3 s. . . . etc.).

In one embodiment, the long poll detector 238a can compare the relative timings (e.g., determined by the tracker engine 238b) to request-response timing characteristics for other applications to determine whether the requests of the application are long poll requests. For example, the requests initiated by a client or application can be determined to be long poll requests if the response delay interval time (‘D’) or the average response delay interval time (e.g., averaged over x number of requests or any number of delay interval times averaged over x amount of time) is greater than a threshold value.

The threshold value can be determined using response delay interval times for requests generated by other clients, for example by the request/response tracking engine 238b and/or by the application profile generator 239 (e.g., the response delay interval tracker 239a). The other clients may reside on the same mobile device and the threshold value is determined locally by components on the mobile device. The threshold value can be determined for all requests over all resources server over all networks, for example. The threshold value can be set to a specific constant value (e.g., 30 seconds, for example) to be used for all requests, or any request which does not have an applicable threshold value (e.g., long poll is detected if D>30 seconds).

In some instances, the other clients reside on different mobile devices and the threshold can be determined by a proxy server (e.g., proxy server 325 of the host 300 shown in the example of FIGS. 3A-B) which is external to the mobile device and able to communicate over a wireless network with the multiple different mobile devices, as will be further described with reference to FIG. 3B.

In one embodiment, the cache policy manager 245 sends the polling schedule to the proxy server (e.g., proxy server 125 or 325 shown in the examples of FIGS. 1B-1C and FIG. 3A) and can be used by the proxy server in monitoring the content source, for example, for changed or new content (updated response different from the cached response associated with a request or application). A polling schedule sent to the proxy can include multiple timing parameters including but not limited to interval (time from request 1 to request 2) or a time out interval (time to wait for response, used in long polls, for example). Referring to the timing diagram of a request/response timing sequence timing intervals ‘RI’, ‘D’, ‘RT’, and/or ‘IT’, or some statistical manipulation of the above values (e.g., average, standard deviation, etc.) may all or in part be sent to the proxy server.

For example, in the case when the local proxy 275 detects a long poll, the various timing intervals in a request/response timing sequence (e.g., ‘D’, ‘RT’, and/or ‘IT’) can be sent to the proxy server 325 for use in polling the content source (e.g., application server/content host 110). The local proxy 275 can also identify to the proxy server 325 that a given application or request to be monitored is a long poll request (e.g., instructing the proxy server to set a ‘long poll flag’, for example). In addition, the proxy server uses the various timing intervals to determine when to send keep-alive indications on behalf of mobile devices.

The local cache invalidator 244 of the caching policy manager 245 can invalidate cache elements in the local cache (e.g., cache 185 or 285) when new or changed data (e.g., updated response) is detected from the application server/content source for a given request. The cached response can be determined to be invalid for the outgoing request based on a notification received from the proxy server (e.g., proxy 325 or the host server 300). The source which provides responses to requests of the mobile client can be monitored to determine relevancy of the cached response stored in the cache of the mobile device 250 for the request. For example, the cache invalidator 244 can further remove/delete the cached response from the cache of the mobile device when the cached response is no longer valid for a given request or a given application.

In one embodiment, the cached response is removed from the cache after it is provided once again to an application which generated the outgoing request after determining that the cached response is no longer valid. The cached response can be provided again without waiting for the time interval or provided again after waiting for a time interval (e.g., the time interval determined to be specific to emulate the response delay in a long poll). In one embodiment, the time interval is the response delay ‘D’ or an average value of the response delay ‘D’ over two or more values.

The new or changed data can be, for example, detected by the proxy server (e.g., proxy server 125 or 325 shown in the examples of FIGS. 1B-1C and FIG. 3A). When a cache entry for a given request/poll has been invalidated, the use of the radio on the mobile device 250 can be enabled (e.g., by the local proxy 275 or the cache policy manager 245) to satisfy the subsequent polling requests, as further described with reference to the interaction diagram of FIGS. 9-10.

One embodiment of the cache policy manager 245 includes a cache or connect selection engine 249 which can decide whether to use a locally cached entry to satisfy a poll/content request generated at the mobile device 250 by an application or widget. For example, the local proxy 275 or the cache policy manger 245 can intercept a polling request, made by an application (e.g., mobile application) on the mobile device, to contact the application server/content provider. The selection engine 249 can determine whether the content received for the intercepted request has been locally stored as cache elements for deciding whether the radio of the mobile device needs to be activated to satisfy the request made by the application (e.g., mobile application) and also determine whether the cached response is still valid for the outgoing request prior to responding to the outgoing request using the cached response.

In one embodiment, the local proxy 275, in response to determining that relevant cached content exists and is still valid, can retrieve the cached elements from the local cache to provide a response to the application (e.g., mobile application) which made the polling request such that a radio of the mobile device is not activated to provide the response to the application (e.g., mobile application). In general, the local proxy 275 continues to provide the cached response each time the outgoing request is received until the updated response different from the cached response is detected.

When it is determined that the cached response is no longer valid, a new request for a given request is transmitted over the wireless network for an updated response. The request can be transmitted to the application server/content provider (e.g., server/host 110) or the proxy server on the host server (e.g., proxy 325 on the host 300) for a new and updated response. In one embodiment the cached response can be provided again as a response to the outgoing request if a new response is not received within the time interval, prior to removal of the cached response from the cache on the mobile device.

FIG. 2C depicts a block diagram illustrating another example of components in the application behavior detector 236 and the caching policy manager 245 in the local proxy 275 on the client-side of the distributed proxy system shown in the example of FIG. 2A. The illustrated application behavior detector 236 and the caching policy manager 245 can, for example, enable the local proxy 275 to detect cache defeat and perform caching of content addressed by identifiers intended to defeat cache.

In one embodiment, the caching policy manager 245 includes a cache defeat resolution engine 221, an identifier formalizer 211, a cache appropriateness decision engine 246, a poll schedule generator 247, an application protocol module 248, a cache or connect selection engine 249 having a cache query module 229, and/or a local cache invalidator 244. The cache defeat resolution engine 221 can further include a pattern extraction module 222 and/or a cache defeat parameter detector 223. The cache defeat parameter detector 223 can further include a random parameter detector 224 and/or a time/date parameter detector 226. One embodiment further includes an application cache policy repository 243 coupled to the decision engine 246.

In one embodiment, the application behavior detector 236 includes a pattern detector 237, a poll interval detector 238, an application profile generator 239, and/or a priority engine 241. The pattern detector 237 can further include a cache defeat parameter detector 223 having also, for example, a random parameter detector 233 and/or a time/date parameter detector 234. One embodiment further includes an application profile repository 242 coupled to the application profile generator 239. The application profile generator 239, and the priority engine 241 have been described in association with the description of the application behavior detector 236 in the example of FIG. 2A.

The cache defeat resolution engine 221 can detect, identify, track, manage, and/or monitor content or content sources (e.g., servers or hosts) which employ identifiers and/or are addressed by identifiers (e.g., resource identifiers such as URLs and/or URIs) with one or more mechanisms that defeat cache or are intended to defeat cache. The cache defeat resolution engine 221 can, for example, detect from a given data request generated by an application or client that the identifier defeats or potentially defeats cache, where the data request otherwise addresses content or responses from a host or server (e.g., application server/content host 110 or 310) that is cacheable.

In one embodiment, the cache defeat resolution engine 221 detects or identifies cache defeat mechanisms used by content sources (e.g., application server/content host 110 or 310) using the identifier of a data request detected at the mobile device 250. The cache defeat resolution engine 221 can detect or identify a parameter in the identifier which can indicate that cache defeat mechanism is used. For example, a format, syntax, or pattern of the parameter can be used to identify cache defeat (e.g., a pattern, format, or syntax as determined or extracted by the pattern extraction module 222).

The pattern extraction module 222 can parse an identifier into multiple parameters or components and perform a matching algorithm on each parameter to identify any of which match one or more predetermined formats (e.g., a date and/or time format). For example, the results of the matching or the parsed out parameters from an identifier can be used (e.g., by the cache defeat parameter detector 223) to identify cache defeating parameters which can include one or more changing parameters.

The cache defeat parameter detector 223, in one embodiment can detect random parameters (e.g., by the random parameter detector 224) and/or time and/or date parameters which are typically used for cache defeat. The cache defeat parameter detector 223 can detect random parameters and/or time/dates using commonly employed formats for these parameters and performing pattern matching algorithms and tests.

In addition to detecting patterns, formats, and/or syntaxes, the cache defeat parameter detector 223 further determines or confirms whether a given parameter is defeating cache and whether the addressed content can be cached by the distributed caching system. The cache defeat parameter detector 223 can detect this by analyzing responses received for the identifiers utilized by a given data request. In general, a changing parameter in the identifier is identified to indicate cache defeat when responses corresponding to multiple data requests are the same even when the multiple data requests uses identifiers with the changing parameter being different for each of the multiple data requests. For example, the request/response pairs illustrate that the responses received are the same, even though the resource identifier includes a parameter that changes with each request.

For example, at least two same responses may be required to identify the changing parameter as indicating cache defeat. In some instances, at least three same responses may be required. The requirement for the number of same responses needed to determine that a given parameter with a varying value between requests is cache defeating may be application specific, context dependent, and/or user dependent/user specified, or a combination of the above. Such a requirement may also be static or dynamically adjusted by the distributed cache system to meet certain performance thresholds and/or either explicit/implicit feedback regarding user experience (e.g., whether the user or application is receiving relevant/fresh content responsive to requests). More of the same responses may be required to confirm cache defeat, or for the system to treat a given parameter as intended for cache defeat if an application begins to malfunction due to response caching and/or if the user expresses dissatisfaction (explicit user feedback) or the system detects user frustration (implicit user cues).

The cache appropriateness decision engine 246 can detect, assess, or determine whether content from a content source (e.g., application server/content provider 110 in the example of FIG. 1C) with which a mobile device 250 interacts, has content that may be suitable for caching. In some instances, content from a given application server/content provider (e.g., the server/provider 110 of FIG. 1C) is determined to be suitable for caching based on a set of criteria (for example, criteria specifying time criticality of the content that is being requested from the content source). In one embodiment, the local proxy (e.g., the local proxy 175 or 275 of FIGS. 1B-1C and FIG. 2A) applies a selection criteria to store the content from the host server which is requested by an application as cached elements in a local cache on the mobile device to satisfy subsequent requests made by the application.

The selection criteria can also include, by way of example, but not limitation, state of the mobile device indicating whether the mobile device is active or inactive, network conditions, and/or radio coverage statistics. The cache appropriateness decision engine 246 can any one or any combination of the criteria, and in any order, in identifying sources for which caching may be suitable.

Once application servers/content providers having identified or detected content that is potentially suitable for local caching on the mobile device 250, the cache policy manager 245 can proceed to cache the associated content received from the identified sources by storing content received from the content source as cache elements in a local cache (e.g., local cache 185 or 285 shown in the examples of FIGS. 1B-1C and FIG. 2A, respectively) on the mobile device 250. The content source can also be identified to a proxy server (e.g., proxy server 125 or 325 shown in the examples of FIGS. 1B-1C and FIG. 3A, respectively) remote from and in wireless communication with the mobile device 250 such that the proxy server can monitor the content source (e.g., application server/content provider 110) for new or changed data. Similarly, the local proxy (e.g., the local proxy 175 or 275 of FIGS. 1B-1C and FIG. 2A, respectively) can identify to the proxy server that content received from a specific application server/content provider is being stored as cached elements in the local cache.

In one embodiment, cache elements are stored in the local cache 285 as being associated with a normalized version of an identifier for an identifier employing one or more parameters intended to defeat cache. The identifier can be normalized by the identifier normalizer module 211 and the normalization process can include, by way of example, one or more of: converting the URI scheme and host to lower-case, capitalizing letters in percent-encoded escape sequences, removing a default port, and removing duplicate slashes.

In another embodiment, the identifier is normalized by removing the parameter for cache defeat and/or replacing the parameter with a static value which can be used to address or be associated with the cached response received responsive to a request utilizing the identifier by the normalizer 211 or the cache defeat parameter handler 212. For example, the cached elements stored in the local cache 285 (shown in FIG. 2A) can be identified using the normalized version of the identifier or a hash value of the normalized version of the identifier. The hash value of an identifier or of the normalized identifier may be generated by the hash engine 213.

Once content has been locally cached, the cache policy manager 245 can, upon receiving future polling requests to contact the content server, retrieve the cached elements from the local cache to respond to the polling request made at the mobile device 250 such that a radio of the mobile device is not activated to service the polling request. Such servicing and fulfilling application (e.g., mobile application) requests locally via local cache entries allow for more efficient resource and mobile network traffic utilization and management since network bandwidth and other resources need not be used to request/receive poll responses which may have not changed from a response that has already been received at the mobile device 250.

One embodiment of the cache policy manager 245 includes a poll schedule generator 247 which can generate a polling schedule for one or more applications on the mobile device 250. The polling schedule can specify a polling interval that can be employed by the proxy server (e.g., proxy server 125 or 325 shown in the examples of FIGS. 1B-1C and FIG. 3A) in monitoring the content source for one or more applications. The polling schedule can be determined, for example, based on the interval between the polling requests directed to the content source from the mobile device. In one embodiment, the poll interval detector 238 of the application behavior detector can monitor polling requests directed to a content source from the mobile device 250 in order to determine an interval between the polling requests made from any or all application (e.g., mobile application).

In one embodiment, the cache policy manager 245 sends the polling schedule is sent to the proxy server (e.g., proxy server 125 or 325 shown in the examples of FIGS. 1B-1C and FIG. 3A) and can be used by the proxy server in monitoring the content source, for example, for changed or new content. The local cache invalidator 244 of the caching policy manager 245 can invalidate cache elements in the local cache (e.g., cache 185 or 285) when new or changed data is detected from the application server/content source for a given request. The new or changed data can be, for example, detected by the proxy server. When a cache entry for a given request/poll has been invalidated and/or removed (e.g., deleted from cache) after invalidation, the use of the radio on the mobile device 250 can be enabled (e.g., by the local proxy or the cache policy manager 245) to satisfy the subsequent polling requests, as further described with reference to the interaction diagram of FIG. 4B.

In another embodiment, the proxy server (e.g., proxy server 125 or 325 shown in the examples of FIGS. 1B-1C and FIG. 3A) uses a modified version of a resource identifier used in a data request to monitor a given content source (the application server/content host 110 of FIGS. 1B-1C to which the data request is addressed) for new or changed data. For example, in the instance where the content source or identifier is detected to employ cache defeat mechanisms, a modified (e.g., normalized) identifier can be used instead to poll the content source. The modified or normalized version of the identifier can be communicated to the proxy server by the caching policy manager 245, or more specifically the cache defeat parameter handler 212 of the identifier normalizer 211.

The modified identifier used by the proxy server to poll the content source on behalf of the mobile device/application (e.g., mobile application) may or may not be the same as the normalized identifier. For example, the normalized identifier may be the original identifier with the changing cache defeating parameter removed whereas the modified identifier uses a substitute parameter in place of the parameter that is used to defeat cache (e.g., the changing parameter replaced with a static value or other predetermined value known to the local proxy and/or proxy server). The modified parameter can be determined by the local proxy 275 and communicated to the proxy server. The modified parameter may also be generated by the proxy server (e.g., by the identifier modifier module 353 shown in the example of FIG. 3C).

One embodiment of the cache policy manager 245 includes a cache or connect selection engine 249 which can decide whether to use a locally cached entry to satisfy a poll/content request generated at the mobile device 250 by an application or widget. For example, the local proxy 275 or the cache policy manger 245 can intercept a polling request made by an application (e.g., mobile application) on the mobile device, to contact the application server/content provider. The selection engine 249 can determine whether the content received for the intercepted request has been locally stored as cache elements for deciding whether the a radio of the mobile device needs to be activated to satisfy the request made by the application (e.g., mobile application). In one embodiment, the local proxy 275, in response to determining that relevant cached content exists and is still valid, can retrieve the cached elements from the local cache to provide a response to the application (e.g., mobile application) which made the polling request such that a radio of the mobile device is not activated to provide the response to the application (e.g., mobile application).

In one embodiment, the cached elements stored in the local cache 285 (shown in FIG. 2A) can be identified using a normalized version of the identifier or a hash value of the normalized version of the identifier, for example, using the cache query module 229. Cached elements can be stored with normalized identifiers which have cache defeating parameters removed or otherwise replaced such that the relevant cached elements can be identified and retrieved in the future to satisfy other requests employing the same type of cache defeat. For example, when an identifier utilized in a subsequent request is determined to be utilizing the same cache defeating parameter, the normalized version of this identifier can be generated and used to identify a cached response stored in the mobile device cache to satisfy the data request. The hash value of an identifier or of the normalized identifier may be generated by the hash engine 213 of the identifier normalizer 211.

FIG. 2D depicts a block diagram illustrating examples of additional components in the local proxy 275 shown in the example of FIG. 2A which is further capable of performing mobile traffic categorization and policy implementation based on application behavior and/or user activity.

In this embodiment of the local proxy 275, the user activity module 215 further includes one or more of, a user activity tracker 215a, a user activity prediction engine 215b, and/or a user expectation manager 215c. The application behavior detect 236 can further include a prioritization engine 241a, a time criticality detection engine 241b, an application state categorizer 241c, and/or an application traffic categorizer 241d. The local proxy 275 can further include a backlight detector 219 and/or a network configuration selection engine 251. The network configuration selection engine 251 can further include, one or more of, a wireless generation standard selector 251a, a data rate specifier 251b, an access channel selection engine 251c, and/or an access point selector.

In one embodiment, the application behavior detector 236 is able to detect, determined, identify, or infer, the activity state of an application on the mobile device 250 to which traffic has originated from or is directed to, for example, via the application state categorizer 241c and/or the traffic categorizer 241d. The activity state can be determined by whether the application is in a foreground or background state on the mobile device (via the application state categorizer 241c) since the traffic for a foreground application vs. a background application may be handled differently.

In one embodiment, the activity state can be determined, detected, identified, or inferred with a level of certainty of heuristics, based on the backlight status of the mobile device 250 (e.g., by the backlight detector 219) or other software agents or hardware sensors on the mobile device, including but not limited to, resistive sensors, capacitive sensors, ambient light sensors, motion sensors, touch sensors, etc. In general, if the backlight is on, the traffic can be treated as being or determined to be generated from an application that is active or in the foreground, or the traffic is interactive. In addition, if the backlight is on, the traffic can be treated as being or determined to be traffic from user interaction or user activity, or traffic containing data that the user is expecting within some time frame.

In one embodiment, the activity state is determined based on whether the traffic is interactive traffic or maintenance traffic. Interactive traffic can include transactions from responses and requests generated directly from user activity/interaction with an application and can include content or data that a user is waiting or expecting to receive. Maintenance traffic may be used to support the functionality of an application which is not directly detected by a user. Maintenance traffic can also include actions or transactions that may take place in response to a user action, but the user is not actively waiting for or expecting a response.

For example, a mail or message delete action at a mobile device 250 generates a request to delete the corresponding mail or message at the server, but the user typically is not waiting for a response. Thus, such a request may be categorized as maintenance traffic, or traffic having a lower priority (e.g., by the prioritization engine 241a) and/or is not time-critical (e.g., by the time criticality detection engine 214b).

Contrastingly, a mail ‘read’ or message ‘read’ request initiated by a user a the mobile device 250, can be categorized as ‘interactive traffic’ since the user generally is waiting to access content or data when they request to read a message or mail. Similarly, such a request can be categorized as having higher priority (e.g., by the prioritization engine 241a) and/or as being time critical/time sensitive (e.g., by the time criticality detection engine 241b).

The time criticality detection engine 241b can generally determine, identify, infer the time sensitivity of data contained in traffic sent from the mobile device 250 or to the mobile device from a host server (e.g., host 300) or application server (e.g., app server/content source 110). For example, time sensitive data can include, status updates, stock information updates, IM presence information, email messages or other messages, actions generated from mobile gaming applications, webpage requests, location updates, etc. Data that is not time sensitive or time critical, by nature of the content or request, can include requests to delete messages, mark-as-read or edited actions, application-specific actions such as a add-friend or delete-friend request, certain types of messages, or other information which does not frequently changing by nature, etc. In some instances when the data is not time critical, the timing with which to allow the traffic to pass through is set based on when additional data needs to be sent from the mobile device 250. For example, traffic shaping engine 255 can align the traffic with one or more subsequent transactions to be sent together in a single power-on event of the mobile device radio (e.g., using the alignment module 256 and/or the batching module 257). The alignment module 256 can also align polling requests occurring close in time directed to the same host server, since these request are likely to be responded to with the same data.

In the alternate or in combination, the activity state can be determined from assessing, determining, evaluating, inferring, identifying user activity at the mobile device 250 (e.g., via the user activity module 215). For example, user activity can be directly detected and tracked using the user activity tracker 215a. The traffic resulting therefrom can then be categorized appropriately for subsequent processing to determine the policy for handling. Furthermore, user activity can be predicted or anticipated by the user activity prediction engine 215b. By predicting user activity or anticipating user activity, the traffic thus occurring after the prediction can be treated as resulting from user activity and categorized appropriately to determine the transmission policy.

In addition, the user activity module 215 can also manage user expectations (e.g., via the user expectation manager 215c and/or in conjunction with the activity tracker 215 and/or the prediction engine 215b) to ensure that traffic is categorized appropriately such that user expectations are generally met. For example, a user-initiated action should be analyzed (e.g., by the expectation manager 215) to determine or infer whether the user would be waiting for a response. If so, such traffic should be handled under a policy such that the user does not experience an unpleasant delay in receiving such a response or action.

In one embodiment, an advanced generation wireless standard network is selected for use in sending traffic between a mobile device and a host server in the wireless network based on the activity state of the application on the mobile device for which traffic is originated from or directed to. An advanced technology standards such as the 3G, 3.5G, 3G+, 4G, or LTE network can be selected for handling traffic generated as a result of user interaction, user activity, or traffic containing data that the user is expecting or waiting for. Advanced generation wireless standard network can also be selected for to transmit data contained in traffic directed to the mobile device which responds to foreground activities.

In categorizing traffic and defining a transmission policy for mobile traffic, a network configuration can be selected for use (e.g., by the network configuration selection engine 251) on the mobile device 250 in sending traffic between the mobile device and a proxy server (325) and/or an application server (e.g., app server/host 110). The network configuration that is selected can be determined based on information gathered by the application behavior module 236 regarding application activity state (e.g., background or foreground traffic), application traffic category (e.g., interactive or maintenance traffic), any priorities of the data/content, time sensitivity/criticality.

The network configuration selection engine 2510 can select or specify one or more of, a generation standard (e.g., via wireless generation standard selector 251a), a data rate (e.g., via data rate specifier 251b), an access channel (e.g., access channel selection engine 251c), and/or an access point (e.g., via the access point selector 251d), in any combination.

For example, a more advanced generation (e.g., 3G, LTE, or 4G or later) can be selected or specified for traffic when the activity state is in interaction with a user or in a foreground on the mobile device. Contrastingly, an older generation standard (e.g., 2G, 2.5G, or 3G or older) can be specified for traffic when one or more of the following is detected, the application is not interacting with the user, the application is running in the background on the mobile device, or the data contained in the traffic is not time critical, or is otherwise determined to have lower priority.

Similarly, a network configuration with a slower data rate can be specified for traffic when one or more of the following is detected, the application is not interacting with the user, the application is running in the background on the mobile device, or the data contained in the traffic is not time critical. The access channel (e.g., Forward access channel or dedicated channel) can be specified.

FIG. 3A depicts a block diagram illustrating an example of server-side components in a distributed proxy and cache system residing on a host server 300 that manages traffic in a wireless network for resource conservation. The server-side proxy (or proxy server 325) can further categorize mobile traffic and/or implement delivery policies based on application behavior, content priority, user activity, and/or user expectations.

The host server 300 generally includes, for example, a network interface 308 and/or one or more repositories 312, 314, and 316. Note that server 300 may be any portable/mobile or non-portable device, server, cluster of computers and/or other types of processing units (e.g., any number of a machine shown in the example of FIG. 16) able to receive or transmit signals to satisfy data requests over a network including any wired or wireless networks (e.g., WiFi, cellular, Bluetooth, etc.).

The network interface 308 can include networking module(s) or devices(s) that enable the server 300 to mediate data in a network with an entity that is external to the host server 300, through any known and/or convenient communications protocol supported by the host and the external entity. Specifically, the network interface 308 allows the server 300 to communicate with multiple devices including mobile phone devices 350 and/or one or more application servers/content providers 310.

The host server 300 can store information about connections (e.g., network characteristics, conditions, types of connections, etc.) with devices in the connection metadata repository 312. Additionally, any information about third party application or content providers can also be stored in the repository 312. The host server 300 can store information about devices (e.g., hardware capability, properties, device settings, device language, network capability, manufacturer, device model, OS, OS version, etc.) in the device information repository 314. Additionally, the host server 300 can store information about network providers and the various network service areas in the network service provider repository 316.

The communication enabled by network interface 308 allows for simultaneous connections (e.g., including cellular connections) with devices 350 and/or connections (e.g., including wired/wireless, HTTP, Internet connections, LAN, WiFi, etc.) with content servers/providers 310 to manage the traffic between devices 350 and content providers 310, for optimizing network resource utilization and/or to conserver power (battery) consumption on the serviced devices 350. The host server 300 can communicate with mobile devices 350 serviced by different network service providers and/or in the same/different network service areas. The host server 300 can operate and is compatible with devices 350 with varying types or levels of mobile capabilities, including by way of example but not limitation, 1G, 2G, 2G transitional (2.5G, 2.75G), 3G (IMT-2000), 3G transitional (3.5G, 3.75G, 3.9G), 4G (IMT-advanced), etc.

In general, the network interface 308 can include one or more of a network adaptor card, a wireless network interface card (e.g., SMS interface, WiFi interface, interfaces for various generations of mobile communication standards including but not limited to 1G, 2G, 3G, 3.5G, 4G type networks such as LTE, WiMAX, etc.), Bluetooth, WiFi, or any other network whether or not connected via a router, an access point, a wireless router, a switch, a multilayer switch, a protocol converter, a gateway, a bridge, a bridge router, a hub, a digital media receiver, and/or a repeater.

The host server 300 can further include server-side components of the distributed proxy and cache system which can include a proxy server 325 and a server cache 335. In one embodiment, the proxy server 325 can include an HTTP access engine 345, a caching policy manager 355, a proxy controller 365, a traffic shaping engine 375, a new data detector 347 and/or a connection manager 395.

The HTTP access engine 345 may further include a heartbeat manager 398; the proxy controller 365 may further include a data invalidator module 368; the traffic shaping engine 375 may further include a control protocol 376 and a batching module 377. Additional or less components/modules/engines can be included in the proxy server 325 and each illustrated component.

As used herein, a “module,” a “manager,” a “handler,” a “detector,” an “interface,” a “controller,” a “normalizer,” a “generator,” an “invalidator,” or an “engine” includes a general purpose, dedicated or shared processor and, typically, firmware or software modules that are executed by the processor. Depending upon implementation-specific or other considerations, the module, manager, handler, detector, interface, controller, normalizer, generator, invalidator, or engine can be centralized or its functionality distributed. The module, manager, handler, detector, interface, controller, normalizer, generator, invalidator, or engine can include general or special purpose hardware, firmware, or software embodied in a computer-readable (storage) medium for execution by the processor. As used herein, a computer-readable medium or computer-readable storage medium is intended to include all mediums that are statutory (e.g., in the United States, under 35 U.S.C. §101), and to specifically exclude all mediums that are non-statutory in nature to the extent that the exclusion is necessary for a claim that includes the computer-readable (storage) medium to be valid. Known statutory computer-readable mediums include hardware (e.g., registers, random access memory (RAM), non-volatile (NV) storage, to name a few), but may or may not be limited to hardware.

In the example of a device (e.g., mobile device 350) making an application or content request to an application server or content provider 310, the request may be intercepted and routed to the proxy server 325 which is coupled to the device 350 and the application server/content provider 310. Specifically, the proxy server is able to communicate with the local proxy (e.g., proxy 175 and 275 of the examples of FIG. 1 and FIG. 2 respectively) of the mobile device 350, the local proxy forwards the data request to the proxy server 325 in some instances for further processing and, if needed, for transmission to the application server/content server 310 for a response to the data request.

In such a configuration, the host 300, or the proxy server 325 in the host server 300 can utilize intelligent information provided by the local proxy in adjusting its communication with the device in such a manner that optimizes use of network and device resources. For example, the proxy server 325 can identify characteristics of user activity on the device 350 to modify its communication frequency. The characteristics of user activity can be determined by, for example, the activity/behavior awareness module 366 in the proxy controller 365 via information collected by the local proxy on the device 350.

In one embodiment, communication frequency can be controlled by the connection manager 395 of the proxy server 325, for example, to adjust push frequency of content or updates to the device 350. For instance, push frequency can be decreased by the connection manager 395 when characteristics of the user activity indicate that the user is inactive. In one embodiment, when the characteristics of the user activity indicate that the user is subsequently active after a period of inactivity, the connection manager 395 can adjust the communication frequency with the device 350 to send data that was buffered as a result of decreased communication frequency to the device 350.

In addition, the proxy server 325 includes priority awareness of various requests, transactions, sessions, applications, and/or specific events. Such awareness can be determined by the local proxy on the device 350 and provided to the proxy server 325. The priority awareness module 367 of the proxy server 325 can generally assess the priority (e.g., including time-criticality, time-sensitivity, etc.) of various events or applications; additionally, the priority awareness module 367 can track priorities determined by local proxies of devices 350.

In one embodiment, through priority awareness, the connection manager 395 can further modify communication frequency (e.g., use or radio as controlled by the radio controller 396) of the server 300 with the devices 350. For example, the server 300 can notify the device 350, thus requesting use of the radio if it is not already in use when data or updates of an importance/priority level which meets a criteria becomes available to be sent.

In one embodiment, the proxy server 325 can detect multiple occurrences of events (e.g., transactions, content, data received from server/provider 310) and allow the events to accumulate for batch transfer to device 350. Batch transfer can be cumulated and transfer of events can be delayed based on priority awareness and/or user activity/application behavior awareness as tracked by modules 367 and/or 366. For example, batch transfer of multiple events (of a lower priority) to the device 350 can be initiated by the batching module 377 when an event of a higher priority (meeting a threshold or criteria) is detected at the server 300. In addition, batch transfer from the server 300 can be triggered when the server receives data from the device 350, indicating that the device radio is already in use and is thus on. In one embodiment, the proxy server 325 can order the each messages/packets in a batch for transmission based on event/transaction priority such that higher priority content can be sent first in case connection is lost or the battery dies, etc.

In one embodiment, the server 300 caches data (e.g., as managed by the caching policy manager 355) such that communication frequency over a network (e.g., cellular network) with the device 350 can be modified (e.g., decreased). The data can be cached, for example, in the server cache 335 for subsequent retrieval or batch sending to the device 350 to potentially decrease the need to turn on the device 350 radio. The server cache 335 can be partially or wholly internal to the host server 300, although in the example of FIG. 3A it is shown as being external to the host 300. In some instances, the server cache 335 may be the same as and/or integrated in part or in whole with another cache managed by another entity (e.g., the optional caching proxy server 199 shown in the example of FIG. 1C), such as being managed by an application server/content provider 310, a network service provider, or another third party.

In one embodiment, content caching is performed locally on the device 350 with the assistance of host server 300. For example, proxy server 325 in the host server 300 can query the application server/provider 310 with requests and monitor changes in responses. When changed or new responses are detected (e.g., by the new data detector 347), the proxy server 325 can notify the mobile device 350 such that the local proxy on the device 350 can make the decision to invalidate (e.g., indicated as out-dated) the relevant cache entries stored as any responses in its local cache. Alternatively, the data invalidator module 368 can automatically instruct the local proxy of the device 350 to invalidate certain cached data, based on received responses from the application server/provider 310. The cached data is marked as invalid, and can get replaced or deleted when new content is received from the content server 310.

Note that data change can be detected by the detector 347 in one or more ways. For example, the server/provider 310 can notify the host server 300 upon a change. The change can also be detected at the host server 300 in response to a direct poll of the source server/provider 310. In some instances, the proxy server 325 can in addition, pre-load the local cache on the device 350 with the new/updated data. This can be performed when the host server 300 detects that the radio on the mobile device is already in use, or when the server 300 has additional content/data to be sent to the device 350.

One or more the above mechanisms can be implemented simultaneously or adjusted/configured based on application (e.g., different policies for different servers/providers 310). In some instances, the source provider/server 310 may notify the host 300 for certain types of events (e.g., events meeting a priority threshold level). In addition, the provider/server 310 may be configured to notify the host 300 at specific time intervals, regardless of event priority.

In one embodiment, the proxy server 325 of the host 300 can monitor/track responses received for the data request from the content source for changed results prior to returning the result to the mobile device, such monitoring may be suitable when data request to the content source has yielded same results to be returned to the mobile device, thus preventing network/power consumption from being used when no new changes are made to a particular requested. The local proxy of the device 350 can instruct the proxy server 325 to perform such monitoring or the proxy server 325 can automatically initiate such a process upon receiving a certain number of the same responses (e.g., or a number of the same responses in a period of time) for a particular request.

In one embodiment, the server 300, through the activity/behavior awareness module 366, is able to identify or detect user activity at a device that is separate from the mobile device 350. For example, the module 366 may detect that a user's message inbox (e.g., email or types of inbox) is being accessed. This can indicate that the user is interacting with his/her application using a device other than the mobile device 350 and may not need frequent updates, if at all.

The server 300, in this instance, can thus decrease the frequency with which new or updated content is sent to the mobile device 350, or eliminate all communication for as long as the user is detected to be using another device for access. Such frequency decrease may be application specific (e.g., for the application with which the user is interacting with on another device), or it may be a general frequency decrease (E.g., since the user is detected to be interacting with one server or one application via another device, he/she could also use it to access other services.) to the mobile device 350.

In one embodiment, the host server 300 is able to poll content sources 310 on behalf of devices 350 to conserve power or battery consumption on devices 350. For example, certain applications on the mobile device 350 can poll its respective server 310 in a predictable recurring fashion. Such recurrence or other types of application behaviors can be tracked by the activity/behavior module 366 in the proxy controller 365. The host server 300 can thus poll content sources 310 for applications on the mobile device 350 that would otherwise be performed by the device 350 through a wireless (e.g., including cellular connectivity). The host server can poll the sources 310 for new or changed data by way of the HTTP access engine 345 to establish HTTP connection or by way of radio controller 396 to connect to the source 310 over the cellular network. When new or changed data is detected, the new data detector 347 can notify the device 350 that such data is available and/or provide the new/changed data to the device 350.

In one embodiment, the connection manager 395 determines that the mobile device 350 is unavailable (e.g., the radio is turned off) and utilizes SMS to transmit content to the device 350, for instance, via the SMSC shown in the example of FIG. 1C. SMS is used to transmit invalidation messages, batches of invalidation messages, or even content in the case where the content is small enough to fit into just a few (usually one or two) SMS messages. This avoids the need to access the radio channel to send overhead information. The host server 300 can use SMS for certain transactions or responses having a priority level above a threshold or otherwise meeting a criteria. The server 300 can also utilize SMS as an out-of-band trigger to maintain or wake-up an IP connection as an alternative to maintaining an always-on IP connection.

In one embodiment, the connection manager 395 in the proxy server 325 (e.g., the heartbeat manager 398) can generate and/or transmit heartbeat messages on behalf of connected devices 350 to maintain a backend connection with a provider 310 for applications running on devices 350.

For example, in the distributed proxy system, local cache on the device 350 can prevent any or all heartbeat messages needed to maintain TCP/IP connections required for applications from being sent over the cellular, or other, network and instead rely on the proxy server 325 on the host server 300 to generate and/or send the heartbeat messages to maintain a connection with the backend (e.g., application server/provider 110 in the example of FIG. 1A). The proxy server can generate the keep-alive (heartbeat) messages independent of the operations of the local proxy on the mobile device.

The repositories 312, 314, and/or 316 can additionally store software, descriptive data, images, system information, drivers, and/or any other data item utilized by other components of the host server 300 and/or any other servers for operation. The repositories may be managed by a database management system (DBMS), for example, which may be but is not limited to Oracle, DB2, Microsoft Access, Microsoft SQL Server, PostgreSQL, MySQL, FileMaker, etc.

The repositories can be implemented via object-oriented technology and/or via text files and can be managed by a distributed database management system, an object-oriented database management system (OODBMS) (e.g., ConceptBase, FastDB Main Memory Database Management System, JDOInstruments, ObjectDB, etc.), an object-relational database management system (ORDBMS) (e.g., Informix, OpenLink Virtuoso, VMDS, etc.), a file system, and/or any other convenient or known database management package.

FIG. 3B depicts a block diagram illustrating a further example of components in the caching policy manager 355 in the cache system shown in the example of FIG. 3A which is capable of caching and adapting caching strategies for application (e.g., mobile application) behavior and/or network conditions.

The caching policy manager 355, in one embodiment, can further include a metadata generator 303, a cache look-up engine 305, an application protocol module 356, a content source monitoring engine 357 having a poll schedule manager 358, a response analyzer 361, and/or an updated or new content detector 359. In one embodiment, the poll schedule manager 358 further includes a host timing simulator 358a, a long poll request detector/manager 358b, a schedule update engine 358c, and/or a time adjustment engine 358d. The metadata generator 303 and/or the cache look-up engine 305 can be coupled to the cache 335 (or, server cache) for modification or addition to cache entries or querying thereof.

In one embodiment, the proxy server (e.g., the proxy server 125 or 325 of the examples of FIGS. 1B-1C and FIG. 3A) can monitor a content source for new or changed data via the monitoring engine 357. The proxy server, as shown, is an entity external to the mobile device 250 of FIGS. 2A-B. The content source (e.g., application server/content provider 110 of FIGS. 1B-1C) can be one that has been identified to the proxy server (e.g., by the local proxy) as having content that is being locally cached on a mobile device (e.g., mobile device 150 or 250). The content source can be monitored, for example, by the monitoring engine 357 at a frequency that is based on polling frequency of the content source at the mobile device. The poll schedule can be generated, for example, by the local proxy and sent to the proxy server. The poll frequency can be tracked and/or managed by the poll schedule manager 358.

For example, the proxy server can poll the host (e.g., content provider/application server) on behalf of the mobile device and simulate the polling behavior of the client to the host via the host timing simulator 358a. The polling behavior can be simulated to include characteristics of a long poll request-response sequences experienced in a persistent connection with the host (e.g., by the long poll request detector/manager 358b). Note that once a polling interval/behavior is set, the local proxy 275 on the device-side and/or the proxy server 325 on the server-side can verify whether application and application server/content host behavior match or can be represented by this predicted pattern. In general, the local proxy and/or the proxy server can detect deviations and, when appropriate, re-evaluate and compute, determine, or estimate another polling interval.

In one embodiment, the caching policy manager 355 on the server-side of the distribute proxy can, in conjunction with or independent of the proxy server 275 on the mobile device, identify or detect long poll requests. For example, the caching policy manager 355 can determine a threshold value to be used in comparison with a response delay interval time in a request-response sequence for an application request to identify or detect long poll requests, possible long poll requests (e.g., requests for a persistent connection with a host with which the client communicates including, but not limited to, a long-held HTTP request, a persistent connection enabling COMET style push, request for HTTP streaming, etc.), or other requests which can otherwise be treated as a long poll request.

For example, the threshold value can be determined by the proxy 325 using response delay interval times for requests generated by clients/applications across mobile devices which may be serviced by multiple different cellular or wireless networks. Since the proxy 325 resides on host 300 is able to communicate with multiple mobile devices via multiple networks, the caching policy manager 355 has access to application/client information at a global level which can be used in setting threshold values to categorize and detect long polls.

By tracking response delay interval times across applications across devices over different or same networks, the caching policy manager 355 can set one or more threshold values to be used in comparison with response delay interval times for long poll detection. Threshold values set by the proxy server 325 can be static or dynamic, and can be associated with conditions and/or a time-to-live (an expiration time/date in relative or absolute terms).

In addition, the caching policy manager 355 of the proxy 325 can further determine the threshold value, in whole or in part, based on network delays of a given wireless network, networks serviced by a given carrier (service provider), or multiple wireless networks. The proxy 325 can also determine the threshold value for identification of long poll requests based on delays of one or more application server/content provider (e.g., 110) to which application (e.g., mobile application) or mobile client requests are directed.

The proxy server can detect new or changed data at a monitored content source and transmits a message to the mobile device notifying it of such a change such that the mobile device (or the local proxy on the mobile device) can take appropriate action (e.g., to invalidate the cache elements in the local cache). In some instances, the proxy server (e.g., the caching policy manager 355) upon detecting new or changed data can also store the new or changed data in its cache (e.g., the server cache 135 or 335 of the examples of FIG. 1C and FIG. 3A, respectively). The new/updated data stored in the server cache 335 can be used in some instances to satisfy content requests at the mobile device; for example, it can be used after the proxy server has notified the mobile device of the new/changed content and that the locally cached content has been invalidated.

The metadata generator 303, similar to the metadata generator 203 shown in the example of FIG. 2B, can generate metadata for responses cached for requests at the mobile device 250. The metadata generator 303 can generate metadata for cache entries stored in the server cache 335. Similarly, the cache look-up engine 305 can include the same or similar functions are those described for the cache look-up engine 205 shown in the example of FIG. 2B.

The response analyzer 361 can perform any or all of the functionalities related to analyzing responses received for requests generated at the mobile device 250 in the same or similar fashion to the response analyzer 246d of the local proxy shown in the example of FIG. 2B. Since the proxy server 325 is able to receive responses from the application server/content source 310 directed to the mobile device 250, the proxy server 325 (e.g., the response analyzer 361) can perform similar response analysis steps to determine cacheability, as described for the response analyzer of the local proxy. The responses can be analyzed in addition to or in lieu of the analysis that can be performed at the local proxy 275 on the mobile device 250.

Furthermore, the schedule update engine 358c can update the polling interval of a given application server/content host based on application request interval changes of the application at the mobile device 250 as described for the schedule update engine in the local proxy 275. The time adjustment engine 358d can set an initial time at which polls of the application server/content host is to begin to prevent the serving of out of date content once again before serving fresh content as described for the schedule update engine in the local proxy 275. Both the schedule updating and the time adjustment algorithms can be performed in conjunction with or in lieu of the similar processes performed at the local proxy 275 on the mobile device 250.

FIG. 3C depicts a block diagram illustrating another example of components in the caching policy manager 355 in the proxy server 375 on the server-side of the distributed proxy system shown in the example of FIG. 3A which is capable of managing and detecting cache defeating mechanisms and monitoring content sources.

The caching policy manager 355, in one embodiment, can further include a cache defeating source manager 352, a content source monitoring engine 357 having a poll schedule manager 358, and/or an updated or new content detector 359. The cache defeating source manager 352 can further include an identifier modifier module 353 and/or an identifier pattern tracking module 354.

In one embodiment, the proxy server (e.g., the proxy server 125 or 325 of the examples of FIGS. 1B-1C and FIG. 3A) can monitor a content source for new or changed data via the monitoring engine 357. The content source (e.g., application server/content provider 110 of FIGS. 1B-1C or 310 of FIG. 3A) can be one that has been identified to the proxy server (e.g., by the local proxy) as having content that is being locally cached on a mobile device (e.g., mobile device 150 or 250). The content source 310 can be monitored, for example, by the monitoring engine 357 at a frequency that is based on polling frequency of the content source at the mobile device. The poll schedule can be generated, for example, by the local proxy and sent to the proxy server 325. The poll frequency can be tracked and/or managed by the poll schedule manager 358.

In one embodiment, the proxy server 325 uses a normalized identifier or modified identifier in polling the content source 310 to detect new or changed data (responses). The normalized identifier or modified identifier can also be used by the proxy server 325 in storing responses on the server cache 335. In general, the normalized or modified identifiers can be used when cache defeat mechanisms are employed for cacheable content. Cache defeat mechanisms can be in the form of a changing parameter in an identifier such as a URI or URL and can include a changing time/data parameter, a randomly varying parameter, or other types parameters.

The normalized identifier or modified identifier removes or otherwise replaces the changing parameter for association with subsequent requests and identification of associated responses and can also be used to poll the content source. In one embodiment, the modified identifier is generated by the cache defeating source manager 352 (e.g., the identifier modifier module 353) of the caching policy manager 355 on the proxy server 325 (server-side component of the distributed proxy system). The modified identifier can utilize a substitute parameter (which is generally static over a period of time) in place of the changing parameter that is used to defeat cache.

The cache defeating source manager 352 optionally includes the identifier pattern tracking module 354 to track, store, and monitor the various modifications of an identifier or identifiers that address content for one or more content sources (e.g., application server/content host 110 or 310) to continuously verify that the modified identifiers and/or normalized identifiers used by the proxy server 325 to poll the content sources work as predicted or intended (e.g., receive the same responses or responses that are otherwise still relevant compared to the original, unmodified identifier).

In the event that the pattern tracking module 354 detects a modification or normalization of an identifier that causes erratic or unpredictable behavior (e.g., unexpected responses to be sent) on the content source, the tracking module 354 can log the modification and instruct the cache defeating source manager 352 to generate another modification/normalization, or notify the local proxy (e.g., local proxy 275) to generate another modification/normalization for use in polling the content source. In the alternative or in parallel, the requests from the given mobile application/client on the mobile device (e.g., mobile device 250) can temporarily be sent across the network to the content source for direct responses to be provided to the mobile device and/or until a modification of an identifier which works can be generated.

In one embodiment, responses are stored as server cache elements in the server cache when new or changed data is detected for a response that is already stored on a local cache (e.g., cache 285) of the mobile device (e.g., mobile device 250). Therefore, the mobile device or local proxy 275 can connect to the proxy server 325 to retrieve the new or changed data for a response to a request which was previously cached locally in the local cache 285 (now invalid, out-dated, or otherwise determined to be irrelevant).

The proxy server 325 can detect new or changed data at a monitored application server/content host 310 and transmits a message to the mobile device notifying it of such a change such that the mobile device (or the local proxy on the mobile device) can take appropriate action (e.g., to invalidate the cache elements in the local cache). In some instances, the proxy server (e.g., the caching policy manager 355), upon detecting new or changed data, can also store the new or changed data in its cache (e.g., the server cache 135 or 335 of the examples of FIG. 1C and FIG. 3A, respectively). The updated/new data stored in the server cache can be used, in some instances, to satisfy content requests at the mobile device; for example, it can be used after the proxy server has notified the mobile device of the new/changed content and that the locally cached content has been invalidated.

FIG. 3D depicts a block diagram illustrating examples of additional components in proxy server 325 shown in the example of FIG. 3A which is further capable of performing mobile traffic categorization and policy implementation based on application behavior and/or traffic priority.

In one embodiment of the proxy server 325, the traffic shaping engine 375 is further coupled to a traffic analyzer 336 for categorizing mobile traffic for policy definition and implementation for mobile traffic and transactions directed to one or more mobile devices (e.g., mobile device 250 of FIGS. 2A-2D) or to an application server/content host (e.g., 110 of FIGS. 1B-1C). In general, the proxy server 325 is remote from the mobile devices and remote from the host server, as shown in the examples of FIGS. 1B-1C. The proxy server 325 or the host server 300 can monitor the traffic for multiple mobile devices and is capable of categorizing traffic and devising traffic policies for different mobile devices.

In addition, the proxy server 325 or host server 300 can operate with multiple carriers or network operators and can implement carrier-specific policies relating to categorization of traffic and implementation of traffic policies for the various categories. For example, the traffic analyzer 336 of the proxy server 325 or host server 300 can include one or more of, a prioritization engine 341a, a time criticality detection engine 341b, an application state categorizer 341c, and/or an application traffic categorizer 341d.

Each of these engines or modules can track different criterion for what is considered priority, time critical, background/foreground, or interactive/maintenance based on different wireless carriers. Different criterion may also exist for different mobile device types (e.g., device model, manufacturer, operating system, etc.). In some instances, the user of the mobile devices can adjust the settings or criterion regarding traffic category and the proxy server 325 is able to track and implement these user adjusted/configured settings.

In one embodiment, the traffic analyzer 336 is able to detect, determined, identify, or infer, the activity state of an application on one or more mobile devices (e.g., mobile device 150 or 250) which traffic has originated from or is directed to, for example, via the application state categorizer 341c and/or the traffic categorizer 341d. The activity state can be determined based on whether the application is in a foreground or background state on one or more of the mobile devices (via the application state categorizer 341c) since the traffic for a foreground application vs. a background application may be handled differently to optimize network use.

In the alternate or in combination, the activity state of an application can be determined by the wirelessly connected mobile devices (e.g., via the application behavior detectors in the local proxies) and communicated to the proxy server 325. For example, the activity state can be determined, detected, identified, or inferred with a level of certainty of heuristics, based on the backlight status at mobile devices (e.g., by a backlight detector) or other software agents or hardware sensors on the mobile device, including but not limited to, resistive sensors, capacitive sensors, ambient light sensors, motion sensors, touch sensors, etc. In general, if the backlight is on, the traffic can be treated as being or determined to be generated from an application that is active or in the foreground, or the traffic is interactive. In addition, if the backlight is on, the traffic can be treated as being or determined to be traffic from user interaction or user activity, or traffic containing data that the user is expecting within some time frame.

The activity state can be determined from assessing, determining, evaluating, inferring, identifying user activity at the mobile device 250 (e.g., via the user activity module 215) and communicated to the proxy server 325. In one embodiment, the activity state is determined based on whether the traffic is interactive traffic or maintenance traffic. Interactive traffic can include transactions from responses and requests generated directly from user activity/interaction with an application and can include content or data that a user is waiting or expecting to receive. Maintenance traffic may be used to support the functionality of an application which is not directly detected by a user. Maintenance traffic can also include actions or transactions that may take place in response to a user action, but the user is not actively waiting for or expecting a response.

The time criticality detection engine 341b can generally determine, identify, infer the time sensitivity of data contained in traffic sent from the mobile device 250 or to the mobile device from the host server 300 or proxy server 325, or the application server (e.g., app server/content source 110). For example, time sensitive data can include, status updates, stock information updates, IM presence information, email messages or other messages, actions generated from mobile gaming applications, webpage requests, location updates, etc.

Data that is not time sensitive or time critical, by nature of the content or request, can include requests to delete messages, mark-as-read or edited actions, application-specific actions such as a add-friend or delete-friend request, certain types of messages, or other information which does not frequently changing by nature, etc. In some instances when the data is not time critical, the timing with which to allow the traffic to be sent to a mobile device is based on when there is additional data that needs to the sent to the same mobile device. For example, traffic shaping engine 375 can align the traffic with one or more subsequent transactions to be sent together in a single power-on event of the mobile device radio (e.g., using the alignment module 378 and/or the batching module 377). The alignment module 378 can also align polling requests occurring close in time directed to the same host server, since these request are likely to be responded to with the same data.

In general, whether new or changed data is sent from a host server to a mobile device can be determined based on whether an application on the mobile device to which the new or changed data is relevant, is running in a foreground (e.g., by the application state categorizer 341c), or the priority or time criticality of the new or changed data. The proxy server 325 can send the new or changed data to the mobile device if the application is in the foreground on the mobile device, or if the application is in the foreground and in an active state interacting with a user on the mobile device, and/or whether a user is waiting for a response that would be provided in the new or changed data. The proxy server 325 (or traffic shaping engine 375) can send the new or changed data that is of a high priority or is time critical.

Similarly, the proxy server 325 (or the traffic shaping engine 375) can suppressing the sending of the new or changed data if the application is in the background on the mobile device. The proxy server 325 can also suppress the sending of the new or changed data if the user is not waiting for the response provided in the new or changed data; wherein the suppressing is performed by a proxy server coupled to the host server and able to wirelessly connect to the mobile device.

In general, if data, including new or change data is of a low priority or is not time critical, the proxy server can waiting to transfer the data until after a time period, or until there is additional data to be sent (e.g. via the alignment module 378 and/or the batching module 377).

FIG. 4A depicts a block diagram illustrating another example of client-side components in a distributed proxy and cache system at the mobile device 250, further including a malware manager and filter engine 401. FIG. 4B depicts a block diagram illustrating additional components in the malware manager and filter engine 401 shown in the example of FIG. 4A.

In one embodiment, the malware manager and filter engine 401 of the local proxy 275 includes a traffic monitor engine 405, a malware detection engine 415 having a suspicious traffic pattern detector 416, a suspicious destination detector 417, a billable activity detector 418, a port detector 419, a stripped URL detector 420, and/or a trigger generator, a malware notifier module 425 having a user notifier 426 and/or a server notifier 427, a malware traffic handling engine 435 having a request blocking agent 436, a malware list manager 445, and/or a third party policy module 455.

As described in detail in association with FIG. 1A, the malware detection engine 415 is able to use traffic patterns (e.g., as detected by the suspicious traffic pattern detector 416) to identify malicious incoming/outgoing traffic or otherwise potentially malicious. Traffic patterns can include timing of requests, time interval of requests (e.g., by the suspicious pattern detector 416), destination/origin of requests (e.g., by the suspicious destination detector 417), the data sent/received in the traffic, any processes performed in advance of or as a result of the traffic event.

In addition, the malware detection engine 415 can identify malicious or potentially malicious traffic by reviewing, analyzing security certificates such as those returned in response to an HTTP request to determine the source of the certificate and review for trustworthiness. In addition, the malware detection engine 415 can detect, identify, and/or intercept requests (e.g., outgoing application requests from a mobile device or incoming requests to a mobile device) which invoke billable activities (e.g., SMS, international/foreign correspondences, MMS, international calls, etc.), for example, by the billable activity detector 418.

In addition, the malware detection engine 415 can identify malicious or potentially malicious traffic based on the port or ports on the mobile device that an application request is directed to (e.g., via the port detector 419). The malware detection engine 415 can also detect URL stripping to flag suspicious traffic (e.g., via detector 420). For example, detection of URL stripping allows the matching of URLs and schemes from a response to a subsequent request which can be uses to identify malicious or potentially malicious traffic. Detection of URL stripping by the stripped URL detector 420 can also allow the detection of non-secure request to known secure sites, which may also be an indication of malicious or potentially malicious traffic.

Any of the above detected behaviors or activities can cause a malicious activity trigger to be generated (e.g., by the trigger generator 421). Upon detecting malicious traffic or potentially malicious traffic (e.g., or when a trigger has been generated), the malware traffic handling engine 435 can block the traffic entirely or handle the traffic according to certain criteria. For example, the notifier module 425 can generate a dialogue box to prompt a user regarding the suspected malicious traffic, request, and/or application. The dialogue box can present the offending information or the suspicious parameters of a given request to the user and ask the user whether the request is valid (e.g., whether the request is generated from an allowed/non-malicious application) and/or whether the users wishes to allow the traffic to pass through

If the user has indicated that the offending or flagged traffic/activity/request as being invalid, unauthorized, or otherwise malicious the application can be black-listed and the pattern logged and sent to the server for collection (e.g., by the malware list manager 445). In this situation, the malware traffic handling engine 435 can block the application generating the offending traffic request from accessing the network (either incoming and/or outgoing requests), for example, by the request blocking agent 436. If the user allows the application or request to pass through, it can be white-listed unless a different trigger is detected. In general, the malware list manager 445 can compile, aggregate, revise, and update a list of detected applications, traffic, malware or suspected malware and the associated offending triggering event.

Upon detecting malicious traffic or potentially malicious traffic, the malware traffic handling engine 435 can block the traffic entirely or handle the traffic according to certain criteria. The notifier module 425 can notify a user, network provider, application server, or the host server of such malicious traffic or potentially malicious traffic and receive input from one or more of these parties to determine how to handle the traffic, for example. The malware list manager 445 can compile, aggregate, revise, and update a list of detected malware or suspected malware.

The malware notifier module 425 can also notify a network provider, application server, and/or or the host server (e.g., the proxy server component 325 shown in the example of FIGS. 5A-5B) of such malicious traffic or potentially malicious traffic and receive input from one or more of these parties to determine how to handle the traffic, for example. One embodiment of the local proxy 275 includes a third party policy module 455. The policy module enables network operators, or other third part to define, distribute and apply firewall rules that block or allow applications from: executing, and/or, accessing the network, and/or, interacting with the user (asking for personal information or other requests), and/or uninstalling any related agents, modules, widgets, any component of the application and/or the application altogether, and/or blocking future installation.

The malware manager and filter engine 401 can be coupled to a local cache 485 as shown or internally include the local cache 485 in part or in whole. The malware manager and filter engine 401 may further include, in part or in whole, the components shown on the server side of the engine 501 of FIG. 5B including, for example, one or more of, a suspicious traffic interceptor, a malware detection engine, a malware notification module, a traffic handler, a reporting module and/or a third party policy module.

FIG. 5A depicts a block diagram illustrating an example of server-side components in a distributed proxy and cache system, further including a malware manager and filter engine 501 of the proxy server 325. FIG. 5B depicts a block diagram illustrating additional components in the malware manager and filter engine 501 shown in the example of FIG. 5A.

In one embodiment, the malware manager and filter engine 501 includes a suspicious traffic interceptor 505, a malware detection engine 515, a malware notification module 525, a malware traffic handler 535, a reporting module 545, and/or a third party policy module 555. The malware manager and filter engine 501 can be coupled to a cache 585 as shown or internally include the cache 585 in part or in whole. As described in detail in FIG. 1A, the suspicious traffic interceptor 505 can block, interrupt, or re-direct any malicious, potentially malicious, or otherwise suspicious traffic that is outgoing from the mobile device or incoming to the mobile device. Malware can be detected by the malware manager and filter engine 501 via the malware detection engine 515. The proxy can also identify malicious traffic based on information provided by the local proxy (e.g., proxy 225 in the example of FIGS. 2-3) on a mobile device, for example.

The malware notification module 525 can similarly notify various parties (e.g., a device, device user, device OS, network service provider, application service provider, etc.) of suspicious activity or traffic and handle the traffic by the malware traffic handler 535 based on external input from the various parties, based on an internally maintained set of rules or instructions, or a combination of the above. For example, the suspicious traffic interceptor 505 and/or the malware detection engine 515 may be implemented or integrated in the activity/behavior awareness module 266 and 366 shown in the example of FIGS. 2-3.

In one embodiment, the reporting module 545 dynamically collects information continuously or periodically and reports to various security and virus protection entities. The reporting module 545 may also broadcast policy information collected from a multitude of geographically distributed clients to each other as malicious applications are detected (automatic building and distribution of a policy list).

One embodiment of the malware manager and filter engine 501 includes a third party policy module 555. The policy module 555 enables network operators, or other third part to define, distribute and apply firewall rules that block or allow applications from: executing, and/or, accessing the network, and/or, interacting with the user (asking for personal information or other requests), and/or uninstalling any related agents, modules, widgets, any component of the application and/or the application altogether, and/or blocking future installation.

The components of the engine 501, including the suspicious traffic interceptor 505, the malware detection engine 515, the malware notification module 525, the malware traffic handler 535, the reporting module 545, the third party policy module 555, or the associated functionalities can reside in the proxy 325 or partially reside the proxy server 325 (e.g., for use with the activity behavior awareness module 266 or 366) in addition to the components in proxy server 325 or in lieu of. Additional or less components, modules, agents, and/or engines can be included in the proxy 325 or the malware manager and filter engine 501 and each illustrated component.

In some instances, some or all of the components in the malware manager and filter engine 501 on the server side may be separate from the proxy server 325 and reside on the mobile device 250 of FIG. 2-FIG. 4. For example, the mobile device 250 may include both local proxy 275 and the proxy server 325. The components including the a traffic monitor engine 405, a malware detection engine 415 having a suspicious traffic pattern detector 416, a suspicious destination detector 417, a billable activity detector 418, a port detector 419, a stripped URL detector 420, and/or a trigger generator, a malware notifier module 425 having a user notifier 426 and/or a server notifier 427, a malware traffic handling engine 435 having a request blocking agent 436, a malware list manager 445, and/or a third party policy module 455 and/or the associated functionalities can reside in the proxy 325 as shown or partially reside in the proxy 275 (e.g., for use with the request/transaction manager 235 and/or the application behavior detector 236) in addition to the components in 275 or in lieu of.

In other words, in the event that proxies 275 and 325 are distinct proxies on a given device, they can include some or all of the same components/features. Additional or less components, modules, agents, and/or engines can be included in the local proxy 275 or the malware manager and filter engine 401 and each illustrated component.

Note that some or all of the components shown in the malware manager and filter engine 401 and/or 501 can be implemented and/or performed by the device operating system of the mobile device 250 (e.g., in iOS, Android, Blackberry, Palm OS, Windows Mobile, etc.)

FIG. 6A depicts another flow diagram illustrating an example process for distributed content caching between a mobile device and a proxy server and the distributed management of content caching.

As shown in the distributed system interaction diagram in the example of FIG. 4, the disclosed technology is a distributed caching model with various aspects of caching tasks split between the client-side/mobile device side (e.g., mobile device 450 in the example of FIG. 4) and the server side (e.g., server side 470 including the host server 485 and/or the optional caching proxy 475).

In general the device-side responsibilities can include deciding whether a response to a particular request can be and/or should be cached. The device-side of the proxy can make this decision based on information (e.g., timing characteristics, detected pattern, detected pattern with heuristics, indication of predictability or repeatability) collected from/during both request and response and cache it (e.g., storing it in a local cache on the mobile device). The device side can also notify the server-side in the distributed cache system of the local cache event and notify it monitor the content source (e.g., application server/content provider 110 of FIGS. 1B-C).

The device side can further instruct the server side of the distributed proxy to periodically validate the cache response (e.g., by way of polling, or sending polling requests to the content source). The device side can further decide whether a response to a particular cache request should be returned from the local cache (e.g., whether a cache hit is detected). The decision can be made by the device side (e.g., the local proxy on the device) using information collected from/during request and/or responses received from the content source.

In general, the server-side responsibilities can include validating cached responses for relevancy (e.g., determine whether a cached response is still valid or relevant to its associated request). The server-side can send the mobile device an invalidation request to notify the device side when a cached response is detected to be no longer valid or no longer relevant (e.g., the server invalidates a given content source). The device side then can remove the response from the local cache.

The diagram of FIG. 6A illustrates caching logic processes performed for each detected or intercepted request (e.g., HTTP request) detected at a mobile device (e.g., client-side of the distributed proxy). In step 602, the client-side of the proxy (e.g., local proxy 275 shown in FIGS. 2A-B or mobile device 450 of FIG. 4) receives a request (from an application (e.g., mobile application) or mobile client). In step 604, URL is normalized and in step 606 the client-side checks to determine if the request is cacheable. If the request is determined to be not cacheable in step 612, the request is sent to the source (application server/content provider) in step 608 and the response is received 610 and delivered to the requesting application 622, similar to a request-response sequence without interception by the client side proxy.

If the request is determined to be cacheable, in step 612, the client-side looks up the cache to determine whether a cache entry exists for the current request. If so, in step 624, the client-side can determine whether the entry is valid and if so, the client side can check the request to see if includes a validator (e.g., a modified header or an entity tag) in step 615. For example, the concept of validation is eluded to in section 13.3 of RFC 2616 which describes in possible types of headers (e.g., eTAG, Modified_Since, must_revlaidate, pragma no_cache) and forms a validating response 632 if so to be delivered to the requesting application in step 622. If the request does not include a validator as determined by step 615, a response is formed from the local cache in step 630 and delivered to the requesting application in step 622. This validation step can be used for content that would otherwise normally be considered un-cacheable.

If, instead, in step 624, the cache entry is found but determined to be no longer valid or invalid, the client side of the proxy sends the request 616 to the content source (application server/content host) and receives a response directly from the source in step 618. Similarly, if in step 612, a cache entry was not found during the look up, the request is also sent in step 616. Once the response is received, the client side checks the response to determine if it is cacheable in step 626. If so, the response is cached in step 620. The client then sends another poll in step 614 and then delivers the response to the requesting application in step 622.

FIG. 6B depicts a diagram showing how data requests from a mobile device 450 to an application server/content provider 495 in a wireless network can be coordinated by a distributed proxy system 460 in a manner such that network and battery resources are conserved through using content caching and monitoring performed by the distributed proxy system 460.

In satisfying application or client requests on a mobile device 450 without the distributed proxy system 460, the mobile device 450, or the software widget executing on the device 450, performs a data request 452 (e.g., an HTTP GET, POST, or other request) directly to the application server 495 and receives a response 404 directly from the server/provider 495. If the data has been updated, the widget 455 on the mobile device 450 can refreshes itself to reflect the update and waits for small period of time and initiates another data request to the server/provider 495.

In one embodiment, the requesting client or software widget 455 on the device 450 can utilize the distributed proxy system 460 in handling the data request made to server/provider 495. In general, the distributed proxy system 460 can include a local proxy 465 (which is typically considered a client-side component of the system 460 and can reside on the mobile device 450), a caching proxy 475 (considered a server-side component 470 of the system 460 and can reside on the host server 485 or be wholly or partially external to the host server 485), and a host server 485. The local proxy 465 can be connected to the caching proxy 475 and host server 485 via any network or combination of networks.

When the distributed proxy system 460 is used for data/application requests, the widget 455 can perform the data request 456 via the local proxy 465. The local proxy 465, can intercept the requests made by device applications, and can identify the connection type of the request (e.g., an HTTP get request or other types of requests). The local proxy 465 can then query the local cache for any previous information about the request (e.g., to determine whether a locally stored response is available and/or still valid). If a locally stored response is not available or if there is an invalid response stored, the local proxy 465 can update or store information about the request, the time it was made, and any additional data, in the local cache. The information can be updated for use in potentially satisfying subsequent requests.

The local proxy 465 can then send the request to the host server 485 and the host server 485 can perform the request 456 and returns the results in response 458. The local proxy 465 can store the result and, in addition, information about the result and returns the result to the requesting widget 455.

In one embodiment, if the same request has occurred multiple times (within a certain time period) and it has often yielded same results, the local proxy 465 can notify 460 the server 485 that the request should be monitored (e.g., steps 462 and 464) for result changes prior to returning a result to the local proxy 465 or requesting widget 455.

In one embodiment, if a request is marked for monitoring, the local proxy 465 can now store the results into the local cache. Now, when the data request 466, for which a locally response is available, is made by the widget 455 and intercepted at the local proxy 465, the local proxy 465 can return the response 468 from the local cache without needing to establish a connection communication over the wireless network.

In addition, the server proxy performs the requests marked for monitoring 470 to determine whether the response 472 for the given request has changed. In general, the host server 485 can perform this monitoring independently of the widget 455 or local proxy 465 operations. Whenever an unexpected response 472 is received for a request, the server 485 can notify the local proxy 465 that the response has changed (e.g., the invalidate notification in step 474) and that the locally stored response on the client should be erased or replaced with a new response.

In this case, a subsequent data request 476 by the widget 455 from the device 450 results in the data being returned from host server 485 (e.g., via the caching proxy 475), and in step 478, the request is satisfied from the caching proxy 475. Thus, through utilizing the distributed proxy system 460, the wireless (cellular) network is intelligently used when the content/data for the widget or software application 455 on the mobile device 450 has actually changed. As such, the traffic needed to check for the changes to application data is not performed over the wireless (cellular) network. This reduces the amount of generated network traffic and shortens the total time and the number of times the radio module is powered up on the mobile device 450, thus reducing battery consumption and, in addition, frees up network bandwidth.

FIG. 7 depicts a table 700 showing examples of different traffic or application category types which can be used in implementing network access and content delivery policies. For example, traffic/application categories can include interactive or background, whether a user is waiting for the response, foreground/background application, and whether the backlight is on or off.

FIG. 8 depicts a table 800 showing examples of different content category types which can be used in implementing network access and content delivery policies. For example, content category types can include content of high or low priority, and time critical or non-time critical content/data.

FIG. 9 depicts an interaction diagram showing how application (e.g., mobile application) 955 polls having data requests from a mobile device to an application server/content provider 995 over a wireless network can be can be cached on the local proxy 965 and managed by the distributed caching system (including local proxy 965 and the host server 985 (having server cache 935 or caching proxy server 975)).

In one example, when the mobile application/widget 955 polls an application server/provider 932, the poll can locally be intercepted 934 on the mobile device by local proxy 965. The local proxy 965 can detect that the cached content is available for the polled content in the request and can thus retrieve a response from the local cache to satisfy the intercepted poll 936 without requiring use of wireless network bandwidth or other wireless network resources. The mobile application/widget 955 can subsequently receive a response to the poll from a cache entry 938.

In another example, the mobile application widget 955 polls the application server/provider 940. The poll is intercepted 942 by the local proxy 965 and detects that cache content is unavailable in the local cache and decides to set up the polled source for caching 944. To satisfy the request, the poll is forwarded to the content source 946. The application server/provider 995 receives the poll request from the application and provides a response to satisfy the current request 948. In 950, the application (e.g., mobile application)/widget 955 receives the response from the application server/provider to satisfy the request.

In conjunction, in order to set up content caching, the local proxy 965 tracks the polling frequency of the application and can set up a polling schedule to be sent to the host server 952. The local proxy sends the cache set up to the host server 954. The host server 985 can use the cache set up which includes, for example, an identification of the application server/provider to be polled and optionally a polling schedule 956. The host server 985 can now poll the application server/provider 995 to monitor responses to the request 958 on behalf of the mobile device. The application server receives the poll from the host server and responds 960. The host server 985 determines that the same response has been received and polls the application server 995 according to the specified polling schedule 962. The application server/content provider 995 receives the poll and responds accordingly 964.

The host server 985 detects changed or new responses and notifies the local proxy 965. The host server 985 can additional store the changed or new response in the server cache or caching proxy 968. The local proxy 965 receives notification from the host server 985 that new or changed data is now available and can invalidate the affected cache entries 970. The next time the application (e.g., mobile application)/widget 955 generates the same request for the same server/content provider 972, the local proxy determines that no valid cache entry is available and instead retrieves a response from the server cache 974, for example, through an HTTP connection. The host server 985 receives the request for the new response and sends the response back 976 to the local proxy 965. The request is thus satisfied from the server cache or caching proxy 978 without the need for the mobile device to utilize its radio or to consume mobile network bandwidth thus conserving network resources.

Alternatively, when the application (e.g., mobile application) generates the same request in step 980, the local proxy 965, in response to determining that no valid cache entry is available, forwards the poll to the application server/provider in step 982 over the mobile network. The application server/provider 995 receives the poll and sends the response back to the mobile device in step 984 over the mobile network. The request is thus satisfied from the server/provider using the mobile network in step 986.

FIG. 10 depicts an interaction diagram showing how application 1055 polls for content from an application server/content provider 1095 which employs cache-defeating mechanisms in content identifiers (e.g., identifiers intended to defeat caching) over a wireless network can still be detected and locally cached.

In one example, when the application (e.g., mobile application)/widget 1055 polls an application server/provider in step 1032, the poll can locally be intercepted in step 1034 on the mobile device by local proxy 1065. In step 1034, the local proxy 1065 on the mobile device may also determine (with some level of certainty and heuristics) that a cache defeating mechanism is employed or may be employed by the server provider.

The local proxy 1065 can detect that the cached content is available for the polled content in the request and can thus retrieve a response from the local cache to satisfy the intercepted poll 1036 without requiring use of wireless network bandwidth or other wireless network resources. The application (e.g., mobile application)/widget 1055 can subsequently receive a response to the poll from a cache entry in step 1038 (e.g., a locally stored cache entry on the mobile device).

In another example, the application (e.g., mobile application) widget 1055 polls the application server/provider 1095 in step 1040. The poll is intercepted in step 1042 by the local proxy 1065 which determines that a cache defeat mechanism is employed by the server/provider 1095. The local proxy 1065 also detects that cached content is unavailable in the local cache for this request and decides to setup the polled content source for caching in step 1044. The local proxy 1065 can then extract a pattern (e.g., a format or syntax) of an identifier of the request and track the polling frequency of the application to setup a polling schedule of the host server 1085 in step 1046.

To satisfy the request, the poll request is forwarded to the content provider 1095 in step 1048. The application server/provider 1095 receives the poll request from the application and provides a response to satisfy the current request in step 1050. In step 1052, the application (e.g., mobile application)/widget 1055 receives the response from the application server/provider 1095 to satisfy the request.

In conjunction, in order to setup content caching, the local proxy 1065 caches the response and stores a normalized version of the identifier (or a hash value of the normalized identifier) in association with the received response for future identification and retrieval in step 1054. The local proxy sends the cache setup to the host server 1085 in step 1056. The cache setup includes, for example, the identifier and/or a normalized version of the identifier. In some instances, a modified identifier, different from the normalized identifier, is sent to the host server 1085.

The host server 1085 can use the cache setup, which includes, for example, an identification of the application server/provider to be polled and optionally a polling schedule in step 1058. The host server 1085 can now poll the application server/provider 1095 to monitor responses to the request in step 1060 on behalf of the mobile device. The application server 1095 receives the poll from the host server 1085 responds in step 1062. The host server 1085 determines that the same response has been received and polls the application server 1095, for example, according to the specified polling schedule and using the normalized or modified identifier in step 1064. The application server/content provider 1095 receives the poll and responds accordingly in step 1066.

This time, the host server 1085 detects changed or new responses and notifies the local proxy 1065 in step 1068. The host server 1085 can additionally store the changed or new response in the server cache 1035 or caching proxy 1075 in step 1070. The local proxy 1065 receives notification from the host server 1085 that new or changed data is now available and can invalidate the affected cache entries in step 1072. The next time the application (e.g., mobile application)/widget generates the same request for the same server/content provider 1095 in step 1074, the local proxy 1065 determines that no valid cache entry is available and instead retrieves a response from the server cache in step 1076, for example, through an HTTP connection. The host server 1085 receives the request for the new response and sends the response back to the local proxy 1065 in step 1078. The request is thus satisfied from the server cache or caching proxy in step 1080 without the need for the mobile device to utilize its radio or to consume mobile network bandwidth thus conserving network resources.

Alternatively, when the application (e.g., mobile application) 1055 generates the same request, the local proxy 1065, in response to determining that no valid cache entry is available in step 1084, forwards the poll to the application server provider 1095 in step 1082 over the mobile network. The application server/provider 1095 receives the poll and sends the response back to the mobile device in step 1086 over the mobile network. The request is thus satisfied from the server/provider using the mobile network 1086 in step 1088.

FIG. 11 depicts a flow chart illustrating an example process for collecting information about a request and the associated response to identify cacheability and caching the response.

In process 1102, information about a request and information about the response received for the request is collected. In processes 1104 and 1106, information about the request initiated at the mobile device and information about the response received for the request are used in aggregate or independently to determine cacheability at step 1108. The details of the steps for using request and response information for assessing cacheability are illustrated at flow A as further described in the example of FIG. 12.

In step 1108, if based on flow A it is determined that the response is not cacheable, then the response is not cached in step 1110, and the flow can optionally restart at 1102 to collect information about a request or response to again assess cacheability.

In step 1108, if it is determined from flow A that the response is cacheable, then in 1112 the response can be stored in the cache as a cache entry including metadata having additional information regarding caching of the response. The cached entry, in addition to the response, includes metadata having additional information regarding caching of the response. The metadata can include timing data including, for example, access time of the cache entry or creation time of the cache entry.

After the response is stored in the cache, a parallel process can occur to determine whether the response stored in the cache needs to be updated in process 1120. If so, the response stored in the cache of the mobile device is invalided or removed from the cache of the mobile device, in process 1122. For example, relevance or validity of the response can be verified periodically by polling a host server to which the request is directed on behalf of the mobile device. The host server can be polled at a rate determined at the mobile device using request information collected for the request for which the response is cached. The rate is determined from averages of time intervals between previous requests generated by the same client which generated the request.

The verifying can be performed by an entity that is physically distinct from the mobile device. In one embodiment, the entity is a proxy server coupled to the mobile device and able to communicate wirelessly with the mobile device and the proxy server polls a host server to which the request is directed at the rate determined at the mobile device based on timing intervals between previous requests generated by the same client which generated the request.

In process 1114, a subsequent request for the same client or application is detected. In process 1116, cache look-up in the local cache is performed to identify the cache entry to be used in responding to the subsequent request. In one embodiment, the metadata is used to determine whether the response stored as the cached entry is used to satisfy the subsequent response. In process 1118, the response can be served from the cache to satisfy a subsequent request. The response can be served in response to identifying a matching cache entry for the subsequent request determined at least in part using the metadata.

FIG. 12 depicts a flow chart illustrating an example process for a decision flow to determine whether a response to a request can be cached.

Process 1202 determines if the request is directed to a blacklisted destination. If so, the response is not cached, in step 1285. If a blacklisted destination is detected, or if the request itself is associated with a blacklisted application, the remainder of the analysis shown in the figure may not be performed. The process can continue to steps 1204 and 1206 if the request and its destination are not blacklisted.

In process 1204, request characteristics information associated with the request is analyzed. In analyzing the request, in process 1208, the request method is identified and in step 1214, it is determined whether the response can be cached based on the request method. If an uncacheable request is detected, the request is not cached and the process may terminate at process 1285. If the request method is determined to be cacheable, or not uncacheable, then the response can be identified as cacheable or potentially cacheable (e.g., cacheable but subject to the other tests and analysis shown in the figure) at step 1295.

In process 1210, the size of the request is determined. In process 1216, it is determined whether the request size exceeds a cacheable size. If so, the response is not cached and the analysis may terminate here at process 1285. If the request size does not exceed a cacheable size in step 1216, then the response can be identified as cacheable or potentially cacheable (e.g., cacheable but subject to the other tests and analysis shown in the figure) at step 1295.

In step 1212, the periodicity information between the request and other requests generated by the same client is determined. In step 1218, it is determined whether periodicity has been identified. If not, the response is not cached and the analysis may terminate here at process 1285. If so, then the response can be identified as cacheable or potentially cacheable (e.g., cacheable but subject to the other tests and analysis shown in the figure) at step 1295.

In process 1206, the request characteristics information associated with the response received for the request is analyzed.

In process 1220, the status code is identified and determined whether the status code indicates a cacheable response status code in process 1228. If an uncacheable status code is detected, the request is not cached and the process may terminate at process 1285. If the response status code indicates cacheability, or not uncacheable, then the response can be identified as cacheable or potentially cacheable (e.g., cacheable but subject to the other tests and analysis shown in the figure) at step 1295.

In process 1222, the size of the response is determined. In process 1230, it is determined whether the response size exceeds a cacheable size. If so, the response is not cached and the analysis may terminate here at process 1285. If the response size does not exceed a cacheable size in step 1230, then the response can be identified as cacheable or potentially cacheable (e.g., cacheable but subject to the other tests and analysis shown in the figure) at step 1295.

In process 1224, the response body is analyzed. In process 1232, it is determined whether the response contains dynamic content or highly dynamic content. Dynamic content includes data that changes with a high frequency and/or has a short time to live or short time of relevance due to the inherence nature of the data (e.g., stock quotes, sports scores of fast pace sporting events, etc.). If so, the response is not cached and the analysis may terminate here at process 1285. If not, then the response can be identified as cacheable or potentially cacheable (e.g., cacheable but subject to the other tests and analysis shown in the figure) at step 1295.

Process 1226 determines whether transfer encoding or chunked transfer encoding is used in the response. If so, the response is not cached and the analysis may terminate here at process 1285. If not, then the response can be identified as cacheable or potentially cacheable (e.g., cacheable but subject to the other tests and analysis shown in the figure) at step 1295.

Not all of the tests described above need to be performed to determined whether a response is cached. Additional tests not shown may also be performed. Note that any of the tests 1208, 1210, 1212, 1220, 1222, 1224, and 1226 can be performed, singly or in any combination to determine cacheability. In some instances, all of the above tests are performed. In some instances, all tests performed (any number of the above tests that are actually performed) need to confirm cacheability for the response to be determined to be cacheable. In other words, in some cases, if any one of the above tests indicate non-cacheability, the response is not cached, regardless of the results of the other tests. In other cases, different criteria can be used to determine which tests or how many tests need to pass for the system to decide to cache a given response, based on the combination of request characteristics and response characteristics.

FIG. 13 depicts a flow chart illustrating an example process for determining potential for cacheability based on request periodicity and/or response repeatability.

In process 1302, requests generated by the client are tracked to detect periodicity of the requests. In process 1306, it is determined whether there are predictable patterns in the timing of the requests. If so, the response content may be cached in process 1395. If not, in process 1308 it is determined whether the request intervals fall within a tolerance level. If so, the response content may be cached in process 1395. If not, the response is not cached in process 1385.

In process 1304, responses received for requests generated by the client are tracked to detect repeatability in content of the responses. In process 1310, hash values of response bodies of the responses received for the client are examined and in process 1312 the status codes associated with the responses are examined. In process 1314, it is determined whether there is similarity in the content of at least two of the responses using hash values and/or the status codes. If so, the response may be cached in process 1395. If not, the response is not cached in 1385.

FIG. 14 depicts a flow chart illustrating an example process for dynamically adjusting caching parameters for a given request or client.

In process 1402, requests generated by a client or directed to a host are tracked at the mobile device to detect periodicity of the requests. Process 1404 determines if the request intervals between the two or more requests are the same or approximately the same. In process 1406, it is determined that the request intervals between the two or more requests fall within the tolerance level.

Based on the results of steps 1404 and 1406, the response for the requests for which periodicity is detected is received in process 1408.

In process 1412, a response is cached as a cache entry in a cache of the mobile device. In process 1414, the host is monitored at a rate to verify relevance or validity of the cache entry, and simultaneously, in process 1416, the response can be served from the cache to satisfy a subsequent request.

In process 1410, a rate to monitor a host is determined from the request interval, using, for example, the results of processes 1404 and/or 1406. In process 1420, the rate at which the given host is monitored is set to verify relevance or validity of the cache entry for the requests. In process 1422, a change in request intervals for requests generated by the client is detected. In process 1424, a different rate is computed based on the change in request intervals. The rate at which the given host is monitored to verify relevance or validity of the cache entry for the requests is updated in step 1420.

In process 1502, a system or server detects that new or changed data is available to be sent to a mobile device. The data, new, changed, or updated, can include one or more of, IM presence updates, stock ticker updates, weather updates, mail, text messages, news feeds, friend feeds, blog entries, articles, documents, any multimedia content (e.g., images, audio, photographs, video, etc.), or any others that can be sent over HTTP or wireless broadband networks, either to be consumed by a user or for use in maintaining operation of an end device or application.

In process 1504, the application to which the new or changed data is directed is identified. In process 1506, the application is categorized based on the application. In process 1508, the priority or time criticality of the new or changed data is determined. In process 1510, the data is categorized. Based on the information determined from the application and/or priority/time-sensitivity of the relevant data, any or all of a series of evaluations can be performed to categorize the traffic and/or to formulate a policy for delivery and/or powering on the mobile device radio.

For example, using the identified application information, in process 1512, it is determined whether the application is in an active state interacting with a user on a mobile device. In process 1514, it is determined if the application is running in the foreground on the mobile device.

If the answer is ‘Yes’ to any number of the test of processes 1512 or 1514, the system or server can then determine that the new or changed data is to be sent to the mobile device in step 1526, and sent without delay. Alternatively, the process can continue at flow ‘C’ where the timing, along with other transmission parameters such as network configuration, can be selected, as further illustrated in the example of FIG. 31. If the answer is ‘No’ to the tests of 1512 or 1514, the other test can be performed in any order. As long as one of the tests 1512 or 1514 is ‘Yes,’ then the system or server having the data can proceed to step 1526 and/or flow ‘C.’

If the answer is ‘No’ to the tests 1512 and 1514 based on the application or application characteristics, then the process can proceed to step 1524, where the sending of the new or changed data is suppressed, at least on a temporary basis. The process can continue in flow ‘A’ for example steps for further determining the timing of when to send the data to optimize network use and/or device power consumption, as further described in the example of flow chart in FIG. 29.

Similarly, in process 1516, it is determined whether the application is running in the background. If so, the process can proceed to step 1524 where the sending of the new or changed data is suppressed. However, even if the application is in the background state, any of the remaining tests can be performed. For example, even if an application is in the background state, new or changed data may still be sent if of a high priority or is time critical.

Using the priority or time sensitivity information, in process 1518, it is determined whether the data is of high priority 1518. In process 1520, it is determined whether the data is time critical. In process 1522, it is determined whether a user is waiting for a response that would be provided in the available data.

If the answer is ‘Yes’ to any number of the test of processes 1518, 1520, or 1522, the system or server can then determine that the new or changed data is to be sent to the mobile device in step 1526, and sent without delay. Alternatively, the process can continue at flow ‘C’ where the timing, along with other transmission parameters such as a network configuration, can be selected, as further illustrated in the example of FIG. 31. If the answer is ‘No’ to any of these tests, the other test can be performed in any order. As long as one of the tests 1518, 1520, or 1522 is ‘Yes,’ then the system or server having the data can proceed to step 1526 and/or flow ‘C.’

If the answer is ‘No’ to one or more of the tests 1518, 1520, or 1522, then the process can proceed to step 1524, where the sending of the new or changed data is suppressed, at least on a temporary basis. The process can continue in flow ‘A’ for example steps for further determining the timing of when to send the data to optimize network use and/or device power consumption. The process can continue to step 1524 with or without the other tests being performed if one of the tests yields a ‘No’ response.

The determined application category in step 1504 can be used in lieu of or in conjunction with the determined data categories in step 1510. For example, the new or changed data that is of a high priority or is time critical can be sent at step 1526 even if the application in the foreground state but not actively interacting with the user on the mobile device or if the application is not in the foreground, or in the background.

Similarly, even if the user is not waiting for a response which would be provided in the new or change data (in step 1522), the data can be sent to the mobile device 1526 if the application is in the foreground, or if the data is of high priority or contains time critical content.

In general, the suppression can be performed at the content source (e.g., originating server/content host of the new or changed data), or at a proxy server. For example, the proxy server may be remote from the recipient mobile device (e.g., able to wirelessly connect to the receiving mobile device). The proxy server may also be remote from the originating server/content host. Specifically, the logic and intelligence in determining whether the data is to be sent or suppressed can exist on the same server or be the same entity as the originator of the data to be sent or partially or wholly remote from it (e.g., the proxy is able to communicate with the content originating server).

In one embodiment, the waiting to transfer the data is managed by a local proxy on the mobile device which is able to wirelessly communicate with a recipient server (e.g., the host server for the mobile application or client). The local proxy on the mobile device can control the radio use on the mobile device for transfer of the data when the time period has elapsed, or when additional data to be sent is detected.

FIG. 16A depicts a flow chart illustrating example processes for handling traffic which is to be suppressed at least temporarily determined from application/traffic categorization.

For example, in process 1602, a time period is elapsed before the new or change data is transmitted in step 1606. This can be performed if the data is of low priority or is not time critical, or otherwise determined to be suppressed for sending (e.g., as determined in the flow chart of FIG. 15). The time period can be set by the application, the user, a third party, and/or take upon a default value. The time period may also be adapted over time for specific types of applications or real-time network operating conditions. If the new or changed data to be sent is originating from a mobile device, the waiting to transfer of the data until a time period has elapsed can be managed by a local proxy on the mobile device, which can communicate with the host server. The local proxy can also enable or allow the use radio use on the mobile device for transfer of the data when the time period has elapsed.

In some instances, the new or changed data is transmitted in 1606 when there is additional data to be sent, in process 1604. If the new or changed data to be sent is originating from a mobile device, the waiting to transfer of the data until there is additional data to be sent, can be managed by a local proxy on the mobile device, which can communicate with the host server. The local proxy can also enable or allow the use radio use on the mobile device for transfer of the data when there is additional data to be sent, such that device resources can be conserved. Note that the additional data may originate from the same mobile application/client or a different application/client. The additional data may include content of higher priority or is time critical. The additional data may also be of same or lower priority. In some instances, a certain number of non priority, or non time-sensitive events may trigger a send event.

If the new or changed data to be sent is originating from a server (proxy server or host server of the content), the waiting to transfer of the data until a time period has elapsed or waiting for additional data to be sent, can be managed by the proxy server which can wirelessly communicate with the mobile device. In general, the proxy server waits until additional data is available for the same mobile device before sending the data together in a single transaction to minimize the number of power-ons of device battery and to optimize network use.

FIG. 16B depicts a flow chart illustrating an example process for selection of a network configuration for use in sending traffic based on application and/or traffic (data) categorization.

In process 1608, an activity state of an application on the mobile device is detected for which traffic is directed to or originated from is detected. In parallel or in lieu of activity state, a time criticality of data contained in the traffic to be sent between the mobile device and the host server can be determined, in process 1610. The activity state can be determined in part or in while, by whether the application is in a foreground or background state on the mobile device. The activity state can also be determined by whether a user is interacting with the application.

Using activity state and/or data characteristics, when it has determined from that the data is to be sent to the mobile device in step 1612 of FIG. 15, the process can continue to step 3006 for network configuration selection.

For example, in process 1614, a generation of wireless standard is selected. The generation of wireless standard which can be selected includes 2G or 2.5G, 3G, 3.5G, 3G+, 3GPP, LTE, or 4G, or any other future generations. For example, slower or older generation of wireless standards can be specified for less critical transactions or traffic containing less critical data. For example, older standards such as 2G, 2.5G, or 3G can be selected for routing traffic when one or more of the following is detected, the application is not interacting with the user, the application is running in the background on the mobile device, or the data contained in the traffic is not time critical. Newer generations such as can be specified for higher priority traffic or transactions. For example, newer generations such as 3G, LTE, or 4G can be specified for traffic when the activity state is in interaction with a user or in a foreground on the mobile device.

In process 1616, the access channel type can be selected. For example, forward access channel (FACH) or the dedicated channel (DCH) can be specified. In process 1618, a network configuration is selected based on data rate or data rate capabilities. For example, a network configuration with a slower data rate can be specified for traffic when one or more of the following is detected, the application is not interacting with the user, the application is running in the background on the mobile device, or the data contained in the traffic is not time critical

In process 1620, a network configuration is selected by specifying access points. Any or all of the steps 1614, 1616, 1618, and 1620 can be performed or in any combination in specifying network configurations.

FIG. 16C depicts a flow chart illustrating an example process for implementing network access and content delivery policies based on application and/or traffic (data) categorization.

In process 1634, an activity state of an application on a mobile device to which traffic is originated from or directed to is detected. For example, the activity state can be determined by whether the application is in a foreground or background state on the mobile device. The activity state can also be determined by whether a user is expecting data contained in the traffic directed to the mobile device.

In process 1636, a time criticality of data contained in the traffic to be sent between the mobile device and the host server is detected. For example, when the data is not time critical, the timing with which to allow the traffic to pass through can be set based on when additional data needs to be sent. Therefore, the traffic can be batched with the other data so as to conserve network and/or device resources.

The application state and/or data characteristics can be used for application categorization and/or data categorization to determine whether the traffic resulting therefrom is to be sent to the mobile device or suppressed at least on a temporary basis before sending, as illustrated in the flow chart shown in the example of FIG. 15.

Continuing at flow C after a determination has been made to send the traffic, the parameters relating to how and when the traffic is to be sent can be determined. For example, in process 1638, a timing with which to allow the traffic to pass through, is determined based on the activity state or the time criticality.

In process 1640, radio use on the mobile device is controlled based on the timing with which the traffic is allowed to pass through. For example, for traffic initiated from the mobile device, a local proxy can residing on the mobile device can control whether the radio is to be turned on for a transaction, and if so, when it is to be turned on, based on transaction characteristics determined from application state, or data priority/time-sensitivity.

In process 1642, a network configuration in the wireless network is selected for use in passing traffic to and/or from the mobile device. For example, a higher capacity or data rate network (e.g., 3G, 3G+, 3.5G, LTE, or 4G networks) can be selected for passing through traffic when the application is active or when the data contained in the traffic is time critical or is otherwise of a higher priority/importance.

FIG. 17 depicts a flow chart illustrating an example process for network selection based on mobile user activity or user expectations.

In process 1702, the backlight status of a mobile device is detected. The backlight status can be used to determine or infer information regarding user activity and/or user expectations. For example, in process 1704, user interaction with an application on a mobile device is detected and/or in process 1706, it is determined that a user is expecting data contained in traffic directed to the mobile device, if the backlight is on.

The user interaction 1704 and/or user expectation 1706 can be determined or inferred via other direct or indirect cues. For example, device motion sensor, ambient light, data activity, detection of radio activity and patterns, call processing, etc. can be used alone or in combination to make an assessment regarding user activity, interaction, or expectations.

In process 1708, an activity state of an application on the mobile device for which traffic is originated from or directed to, is determined. In one embodiment, the activity state of the application is determined by user interaction with the application on the mobile device and/or by whether a user is expecting data contained in the traffic directed to the mobile device.

In process 1710, 3G, 4G, or LTE network is selected for use in sending traffic between a mobile device and a host server in the wireless network. Other network configurations or technologies can be selected as well, including but not limited to 2.5G GSM/GPRS networks, EDGE/EGPRS, 3.5G, 3G+, turbo 3G, HSDPA, etc. For example, a higher bandwidth or higher capacity network can be selected when user interaction is detected with an application requesting to access the network. Similarly, if it can be determined or inferred with some certainty that the user may be expecting data contained in traffic requesting network access, a higher capacity or higher data rate network may be selected as well.

The activity state can also be determined by whether data contained in the traffic directed to the mobile device responds to foreground activities in the application. For applications which are in the foreground, a higher capacity (e.g., 3.5G, 4G, or LTE) network may be selected for use in carrying out the transaction.

The activity state can be determined via device parameters such as the backlight status of the mobile device or any other software or hardware based device sensors including but not limited to, resistive sensors, capacitive sensors, light detectors, motion sensors, proximity sensors, touch screen sensors, etc. The network configuration which is selected for use can be further based on a time criticality and/or priority of data contained in the traffic to be sent between the mobile device and the host server.

FIG. 18 depicts a data timing diagram 1800 showing an example of detection of periodic request which may be suitable for caching.

In the example shown, a first request from a client/application on a mobile device is detected at time 1:00 (t1). At this time, a cache entry may be created in step 1802. At time 2:00 (t2), the second request is detected from the same client/application, and the cache entry that was created can now be updated with the detected interval of 1 hour between time t2 and t1 at step 1804. The third request from the same client is now detected at time t3=3:00, and it can now be determined that a periodic request is detected in step 1806. The local proxy can now cache the response and send a start poll request specifying the interval (e.g., 1 hour in this case) to the proxy server.

The timing diagram further illustrates the timing window between 2:54 and 3:06, which indicates the boundaries of a window within which periodicity would be determined if the third request is received within this time frame 1810. The timing window 1808 between 2:54 and 3:06 corresponds to 20% of the previous interval and is the example tolerance shown. Other tolerances may be used, and can be determined dynamically or on a case by case (application by application) basis.

FIG. 19 depicts a data timing diagram 1900 showing an example of detection of change in request intervals and updating of server polling rate in response thereto.

At step 1902, the proxy determines that a periodic request is detected, the local proxy caches the response and sets the polling request to the proxy server, and the interval is set to 1 hour at the 3rd request, for example. At time t4=3:55, the request is detected 55 minutes later, rather than 1 hour. The interval of 55 minutes still fits in to the window 1904 given a tolerance of 20%. However, at step 1906, the 5th request is received at time t5=4:50, which no longer fits within the tolerance window set determined from the interval between the 1st and second, and second and third requests of 1 hour. The local proxy now retrieves the resource or response from the proxy server, and refreshes the local cache (e.g., cache entry not used to serve the 5th request). The local proxy also resends a start poll request to the proxy server with an updated interval (e.g., 55 minutes in the example) and the window defined by the tolerance, set by example to 20%, now becomes 11 minutes, rather than 12 minutes.

Note that in general, the local proxy notifies the proxy server with an updated polling interval when an interval changes is detected and/or when a new rate has been determined. This is performed, however, typically only for background application requests or automatic/programmatic refreshes (e.g., requests with no user interaction involved). In general, if the user is interacting with the application in the foreground and causing out of period requests to be detected, the rate of polling or polling interval specified to the proxy server is typically not update, as illustrated in FIG. 20. FIG. 20 depicts a data timing diagram 2000 showing an example of serving foreground requests with cached entries.

For example, between the times of t=3:00 and 3:30, the local proxy detects 1st and 2nd foreground requests at t=3:10 and t=3:20. These foreground requests are outside of the periodicity detected for background application or automatic application requests. The response data retrieved for the foreground request can be cached and updated, however, the request interval for foreground requests are not sent to the server in process 2008.

As shown, the next periodic request detected from the application (e.g., a background request, programmatic/automatic refresh) at t=4:00, the response is served from the cache, as is the request at t=5:00.

FIG. 21 depicts a data timing diagram 2100 showing an example of a non-optimal effect of cache invalidation occurring after outdated content has been served once again to a requesting application.

Since the interval of proxy server polls is set to approximately the same interval at which the application (e.g., mobile application) is sending requests, it is likely the case that the proxy server typically detects changed content (e.g., at t=5:02) after the cached entry (now outdated) has already been served for a request (e.g., to the 5th request at t=5:00). In the example shown, the resource updates or changes at t=4:20 and the previous server poll which occurs at t=4:02 was not able to capture this change until the next poll at 5:02 and sends a cache invalidation to the local proxy at 2110. Therefore, the local cache does not invalidate the cache at some time after the 5th request at time t=5:00 has already been served with the old content. The fresh content is now not provided to the requesting application until the 6th request at t=6:00, 1 period later at process 2106.

To optimize caching performance and to resolve this issue, the local proxy can adjust time setup by specifying an initial time of request, in addition to the polling interval to the proxy server. The initial time of request here is set to some time before (e.g., a few minutes) the request actually occurred such that the proxy server polls occur slightly before actual future application requests. This way, the proxy can pick up any changes in responses in time to be served to the subsequent application request.

FIG. 22 depicts a data timing diagram 2200 showing cache management and response taking into account the time-to-live (TTL) set for cache entries.

In one embodiment, cached response data in the local cache specifies the amount of time cache entries can be stored in the local cache until it is deleted or removed.

The time when a response data in a given cache entry is to be removed can be determined using the formula: <response data_cache time>+<TTL>, as shown at t=3:00, the response data is automatically removed after the TTL has elapsed due to the caching at step 2212 (e.g., in this example, 24 hours after the caching at step 2212). In general the time to live (TTL) applies to the entire cache entry (e.g., including both the response data and any metadata, which includes information regarding periodicity and information used to compute periodicity). In one embodiment, the cached response data TTL is set to 24 hours by default or some other value (e.g., 6 hours, 12 hours, 48 hours, etc.). The TTL may also be dynamically adjustable or reconfigured by the admin/user and/or different on a case-by-case, device, application, network provider, network conditions, operator, and/or user-specific basis.

In process 2302, information about a request or information about a response to the request initiated at the mobile device is collected. In one embodiment, the information includes request characteristics information associated with the request and/or response characteristics information associated with the response received for the request. In process 2304, the information regarding the request characteristics of the request is analyzed determine if there is malware or possible malware or other suspicious activity. Examples of the analysis performed on the request characteristics are further illustrated at flow ‘A’ in FIG. 24. Malware or potentially malicious traffic, if detected at step 2306, is handled according to the steps illustrated in flow ‘B’ in the example of FIG. 25.

If no malware or other suspicious activity is detected, the information collected about the request or response received for the request initiated at the mobile device can be further used to determine cacheability of the response. Cacheability assessment processes are at least described for example, in FIG. 11-FIG. 17. In response to determining cacheability of the response, the response can be cached by storing the response locally in a cache on the mobile device and serving the response from the cache to satisfy a subsequent request.

FIG. 24 depicts a flow chart illustrating example processes for analyzing request characteristics to determine or identify the presence of malware or other suspicious activity/traffic.

For example, timing characteristics between the request and other requests initiated at the mobile device are detected in process 2422. Timing characteristics can be detected by, one or more of, determining time of day of the request as in process 2404, determining frequency of occurrence of the requests as in process 2406, determining time interval between requests as in process 2408, and determining the periodicity information between the request and other requests initiated at the mobile device in process 2410.

For example, periodicity can be detected when the request and the other requests generated by the same client occur at a fixed rate or nearly fixed rate. In one embodiment, requests can be flagged as malicious or potentially containing malicious traffic when the requests from the same client have a change or significant change in the periodicity from prior requests.

In addition, destination address information can be determined in process 2424 for use in the analysis. Destination address information can be detected by, for example, extracting an IP address, an URI or URL in process 2412, or determining an originating country or a destination country 2414. In some instances patterns or parameters in the IP addresses or other identifiers such as the URI and/or URL are identified as indicators of suspicious activity or traffic which can indicate the presence of malware or other malicious traffic. Repeated occurrences of certain parameters or patterns can also indicate suspicious activity or malicious traffic and be tracked down.

Similarly, destinations, routes, and/or origins determined from IP addresses, URLs, URIs or other identifiers of request can be used for flagging suspicious activity. For example, specific origin countries, destination countries, or countries on a route of a request can indicate a higher likelihood of the traffic being malicious. In one embodiment, the destination address information or other location information can be compared with a list of blacklisted destination or origins or locations to determine whether the request contains malicious traffic or is related to other suspicious activity. The one or more blacklisted destinations can be stored on the proxy server and aggregated from analysis of traffic requests of multiple mobile devices.

In one embodiment, destination address information can be used to identify suspicious destinations based on a client making the request relative to a specified destination of the request. Specifically, the system can determine whether the specified destination of the request is an expected destination according to the client that is or appearing to make the request. Expected or known destinations of commonly used applications, clients, sites or widgets can be maintained and used for comparison.

In one embodiment, whether request content includes personal information of mobile device user can be used to detect malware or other suspicious activity in process 2426. Personal information can be identified by, for example, determining request content includes user information, user cache, user data, or location data in process 2416, determining whether request content includes browsing data, call records, or application usage 2418, or whether request content includes user authentication information, credit card information, or other financial data in process 2420. Under some circumstances, in response to detection that the content of the requests includes personal information, the traffic containing the requests is identified or flatted as malicious or potentially malicious.

Note that in general, the requests that are monitored and characteristics analyzed can be made by a same application or appearing to be made by the same application on the mobile device (e.g., malwares or malicious activity that affect specific applications or application types). The requests may also be made by different applications on the mobile device (e.g., instances where malicious activity is affecting the behavior of or utilizing the functionalities across all or multiple applications/widgets on a device). Using any combination of the above extracted information, the system can make an assessment as to whether there is malware or possible malware in process 2430.

FIG. 25 depicts a flow chart illustrating example processes for malware handling when malware or other suspicious activity is detected.

In process 2502, notifications that suspicious or malicious traffic has been detected are generated. The notification can, prompt a user of the mobile device whether the user wishes to allow the malicious or potentially malicious traffic as in process 2504, notify an operating system of the mobile device as in process 2506, notify a network operator servicing the mobile device as in process 2508, notify an Internet service provider as in process 2510, and/or notify an application service provider or content provider, as in process 2512.

In process 2514, the system receives instructions from one or more of the above entities on how to handle the detected or suspected malware/malicious traffic and can devise a handling strategy in process 2516. In one embodiment, the information about the malicious traffic/event is stored for use in subsequent detections or detection and filtering on other mobile devices serviced by the distributed system.

FIG. 26 depicts a flow chart illustrating an example process for detection or filtering of malicious traffic on a mobile device based on associated locations of a request.

In process 2602, a request generated by a client or application on a mobile device is tracked. In process 2608, the associated locations of the request generated by the client are analyzed. The associated locations can include, the originating location, route (e.g., any intermediate locations), and/or the destination location. In process 2610, it is determined that the requests constitute malicious traffic or potentially malicious traffic based on the associated locations of the request and in process 2612, the request and other requests of the client are blocked.

In process 2604, an expected destination for the request based on the client or the client appearing to make the request is determined and in process 2612, a specified destination of the request is extracted from the associated locations. It is determined at decision flow in 2616 whether the specified destination matches the expected destination. If not, it can be determined that the request possibly or likely constitutes malicious traffic or potentially malicious traffic and in process 2614, the request and other requests of the client, or requests/responses resulting therefrom are blocked.

FIGS. 27A-B depict flow charts illustrating example processes for monitoring mobile application activities for malicious traffic on a mobile device.

In process 2702, application activities of a mobile application on the mobile device are monitored. The application activities can be in part or in whole monitored by the mobile device operating system. In one embodiment, the application activities are monitored by a client (e.g., local proxy) residing on the mobile device, in whole or in part, and can work in conjunction with the mobile device operating system (e.g., iOS, Palm, Android, Blackberry, etc.).

In process 2704, suspicious activity is detected from the application activities. Suspicious activities can be detected from example processes further illustrated in FIG. 27B. For example, in process 2732, a security certificate of the traffic is identified and/or analyzed. In process 2734, request destination of the traffic can be identified. In process 2736, traffic which invokes billable activity can be detected. In process 2738, a port to or from which the traffic is directed on the mobile device is determined. In process 2740, URL or URI stripping is detected. In process 2742, a non-secure request to a known secure site is detected. Any number of the above processes can be used in detecting or flagging suspicious activity in a mobile application.

In process 2706, traffic from which the suspicious activity is detected is blocked, or temporarily blocked until further verification is performed. Alternatively, the suspected traffic can be allowed to pass through until further verification is performed. In process 2708, verification of whether the traffic that is blocked is valid or not is requested. Various mechanisms can be used to verify whether the traffic blocked is in fact invalid traffic. For example, the user may be prompted in a user dialogue via an application user interface. The user can be prompted to determine whether the user made a given request which resulted in the traffic, or otherwise be presented with information allowing the user to decide whether the traffic is valid or invalid. The prompt is, in one embodiment, generated by the mobile operating system of the mobile device. This step may also only be optionally performed.

In process 2710, a verification process to determine whether the traffic valid is performed. If so, in process 2712, the mobile application is white listed. If not, in process 2714, a traffic pattern or sequence of events is logged. In process 2716, the mobile application is black listed. In process 2718, the mobile application or the traffic is reported to a virus protection entity or a security entity.

The black lists and white lists can be dynamically updated by any entity including, a local client on the mobile device, the operating system on the mobile device, or remotely. For example, the black and white lists can be created, received or stored at a remote entity such as a proxy server (e.g., proxy server 325 of the host server), or any other third party entities including but not limited to wireless service providers, mobile network carriers, operators, internet service provider, application service providers, a security entity and/or virus protection/tracking entities.

One embodiment includes generating policy information for malicious mobile traffic using the suspicious activity information which can include the black list and/or white list information. The black and white list information of mobile applications and/or any other policies relating to malicious applications/traffic can be broadcasted future installations of the mobile application or other entities. The policy information can include, for example, an identification of the mobile application and firewall rules as further illustrated FIG. 30.

FIG. 28 depicts a flow chart illustrating an example process for automatically generating and/or distributing policy information for malicious mobile traffic in a wireless network.

In process 2802, suspicious activity of mobile applications is detected at multiple mobile devices.

In process 2804, suspicious activity information detected across multiple mobile devices in a wireless network is aggregated.

In one embodiment, the suspicious activity information is detected by a mobile operating system on the multiple mobile devices. The suspicious activity information can also be detected by a client external to the mobile operating system of the multiple mobile devices. In one embodiment, the suspicious activity information includes an identification of potentially offending mobile applications. The suspicious activity information can also include the suspicious event which caused the trigger, time of event, and/or sequence of events leading up to the suspicious event.

In process 2806, policy information for malicious mobile traffic is generated using the suspicious activity information. The policy information can include firewall rules which determine or provide guidelines as to how to handle the offending traffic or potentially offending application(s). Examples of various parties which can generate all or part of the policy information is illustrated at Flow ‘A’ in FIG. 29. In process 2808, the policy information is distributed. Examples of entities to which the policy information can be distributed are further illustrated at Flow ‘B’ shown in FIG. 30. In process 2810, the suspicious activity information is reported to a virus protection entity or a security entity.

Note that any or all of the above steps can be performed by a mobile operating system or desktop operating system. For example, the mobile operating system of a mobile device can perform any or all the steps. In addition, a local proxy on a mobile device, which can be external to or partially integrated with the mobile operating system can perform any or all of the above steps. Some of the above features can also be in part or in whole, performed by an entity remote from a mobile device (e.g., proxy server 325 of the host server) or any third party entity. For example, the proxy server can use a blacklist and/or a white list to detect the suspicious activity information. The blacklist and/or white list can be stored on the proxy server and aggregated from analysis of traffic in the wireless network

FIG. 29 depicts a flow chart illustrating examples of third parties enabled to define policy information regarding malicious mobile traffic.

In process 2901, a third party is enabled to define the policy information. The third party can include, for example, the mobile operating system or operating system maker 2904, a mobile operator or wireless carrier 2906, an application service provider 2908, and/or an Internet service provider 2910.

FIG. 30 depicts a chart illustrating examples of policy information devised for handling malicious traffic.

In process 3002, the policy information can be implemented at the mobile device (e.g., by the operating system or within the operating system, or another client independent of the operating system), at a remote proxy server remote from the mobile device, by a wireless carrier (mobile operator), application service provider, a virus protection entity, or other service provider(s). In process 3006, the mobile application in which suspicious or malicious traffic is detected, is prevented from accessing the wireless network. In process 3008, the mobile application from interacting with a user, for example, from requesting a user for personal information including location, financial, or identify information, in process 3010. In process 3012, the application is prevented from executing. In process 3014, the mobile application is automatically uninstalled. In process 3016, future installations of the mobile application are automatically blocked.

In alternative embodiments, the machine operates as a standalone device or may be connected (e.g., networked) to other machines. In a networked deployment, the machine may operate in the capacity of a server or a client machine in a client-server network environment, or as a peer machine in a peer-to-peer (or distributed) network environment.

The machine may be a server computer, a client computer, a personal computer (PC), a user device, a tablet PC, a laptop computer, a set-top box (STB), a personal digital assistant (PDA), a cellular telephone, an iPhone, an iPad, a Blackberry, a processor, a telephone, a web appliance, a network router, switch or bridge, a console, a hand-held console, a (hand-held) gaming device, a music player, any portable, mobile, hand-held device, or any machine capable of executing a set of instructions (sequential or otherwise) that specify actions to be taken by that machine.

While the machine-readable medium or machine-readable storage medium is shown in an exemplary embodiment to be a single medium, the term “machine-readable medium” and “machine-readable storage medium” should be taken to include a single medium or multiple media (e.g., a centralized or distributed database and/or associated caches and servers) that store the one or more sets of instructions. The term “machine-readable medium” and “machine-readable storage medium” shall also be taken to include any medium that is capable of storing, encoding or carrying a set of instructions for execution by the machine and that cause the machine to perform any one or more of the methodologies of the presently disclosed technique and innovation.

In general, the routines executed to implement the embodiments of the disclosure may be implemented as part of an operating system or a specific application, component, program, object, module or sequence of instructions referred to as “computer programs.” The computer programs typically comprise one or more instructions set at various times in various memory and storage devices in a computer that, when read and executed by one or more processing units or processors in a computer, cause the computer to perform operations to execute elements involving the various aspects of the disclosure.

Moreover, while embodiments have been described in the context of fully functioning computers and computer systems, those skilled in the art will appreciate that the various embodiments are capable of being distributed as a program product in a variety of forms, and that the disclosure applies equally regardless of the particular type of machine or computer-readable media used to actually effect the distribution.

Further examples of machine-readable storage media, machine-readable media, or computer-readable (storage) media include but are not limited to recordable type media such as volatile and non-volatile memory devices, floppy and other removable disks, hard disk drives, optical disks (e.g., Compact Disk Read-Only Memory (CD ROMS), Digital Versatile Disks, (DVDs), etc.), among others, and transmission type media such as digital and analog communication links.

Unless the context clearly requires otherwise, throughout the description and the claims, the words “comprise,” “comprising,” and the like are to be construed in an inclusive sense, as opposed to an exclusive or exhaustive sense; that is to say, in the sense of “including, but not limited to.” As used herein, the terms “connected,” “coupled,” or any variant thereof, means any connection or coupling, either direct or indirect, between two or more elements; the coupling of connection between the elements can be physical, logical, or a combination thereof. Additionally, the words “herein,” “above,” “below,” and words of similar import, when used in this application, shall refer to this application as a whole and not to any particular portions of this application. Where the context permits, words in the above Detailed Description using the singular or plural number may also include the plural or singular number respectively. The word “or,” in reference to a list of two or more items, covers all of the following interpretations of the word: any of the items in the list, all of the items in the list, and any combination of the items in the list.

The above detailed description of embodiments of the disclosure is not intended to be exhaustive or to limit the teachings to the precise form disclosed above. While specific embodiments of, and examples for, the disclosure are described above for illustrative purposes, various equivalent modifications are possible within the scope of the disclosure, as those skilled in the relevant art will recognize. For example, while processes or blocks are presented in a given order, alternative embodiments may perform routines having steps, or employ systems having blocks, in a different order, and some processes or blocks may be deleted, moved, added, subdivided, combined, and/or modified to provide alternative or sub-combinations. Each of these processes or blocks may be implemented in a variety of different ways. Also, while processes or blocks are at times shown as being performed in series, these processes or blocks may instead be performed in parallel, or may be performed at different times. Further any specific numbers noted herein are only examples: alternative implementations may employ differing values or ranges.

The teachings of the disclosure provided herein can be applied to other systems, not necessarily the system described above. The elements and acts of the various embodiments described above can be combined to provide further embodiments.

Any patents and applications and other references noted above, including any that may be listed in accompanying filing papers, are incorporated herein by reference. Aspects of the disclosure can be modified, if necessary, to employ the systems, functions, and concepts of the various references described above to provide yet further embodiments of the disclosure.

These and other changes can be made to the disclosure in light of the above Detailed Description. While the above description describes certain embodiments of the disclosure, and describes the best mode contemplated, no matter how detailed the above appears in text, the teachings can be practiced in many ways. Details of the system may vary considerably in its implementation details, while still being encompassed by the subject matter disclosed herein. As noted above, particular terminology used when describing certain features or aspects of the disclosure should not be taken to imply that the terminology is being redefined herein to be restricted to any specific characteristics, features, or aspects of the disclosure with which that terminology is associated. In general, the terms used in the following claims should not be construed to limit the disclosure to the specific embodiments disclosed in the specification, unless the above Detailed Description section explicitly defines such terms. Accordingly, the actual scope of the disclosure encompasses not only the disclosed embodiments, but also all equivalent ways of practicing or implementing the disclosure under the claims.

While certain aspects of the disclosure are presented below in certain claim forms, the inventors contemplate the various aspects of the disclosure in any number of claim forms. For example, while only one aspect of the disclosure is recited as a means-plus-function claim under 35 U.S.C. §112, ¶6, other aspects may likewise be embodied as a means-plus-function claim, or in other forms, such as being embodied in a computer-readable medium. (Any claims intended to be treated under 35 U.S.C. §112, ¶6 will begin with the words “means for.”) Accordingly, the applicant reserves the right to add additional claims after filing the application to pursue such additional claim forms for other aspects of the disclosure.

Claims

1. A method for automatically generating and distributing policy information for malicious mobile traffic in a wireless network, the method, comprising: aggregating suspicious activity information detected across multiple mobile devices in a wireless network;wherein, the suspicious activity information is detected, by each of the mobile devices, in mobile application activities occurring on at least one mobile application on the multiple mobile devices;wherein the mobile application activities comprises traffic to and from each mobile device in response to requests from the at least one mobile application, generating policy information for malicious mobile traffic using the suspicious activity information; anddistributing the policy information among the multiple mobile devices or other mobile devices in the wireless network,wherein, the policy information includes an identification of the mobile application and rules which either automatically uninstalls the at least one mobile application or automatically blocks future installations of the at least one mobile application, wherein the suspicious activity information is used to determine cacheability of the response.
2. The method of claim 1, further comprising, distributing the policy information to wireless operators or mobile network carriers.
3. The method of claim 1, further comprising, distributing the policy information to application service providers.
4. The method of claim 1, wherein, the suspicious activity information is detected by a mobile operating system on the multiple mobile devices.
5. The method of claim 1, wherein, the suspicious activity information is detected by a client external to the mobile operating system of the multiple mobile devices.
6. The method of claim 1, further comprising, reporting the suspicious activity information to a virus protection entity or a security entity.
7. The method of claim 1, wherein, the policy information includes firewall rules.
8. The method of claim 1, further comprising, enabling a third party to define the policy information.
9. The method of claim 8, wherein, the third party is a mobile operating system.
10. The method of claim 8, wherein, the third party is a mobile operator or wireless carrier.
11. The method of claim 1, wherein, the suspicious activity information includes an identification of offending mobile applications.
12. The method of claim 1, wherein, the policy information includes an identification of the mobile application and firewall rules which prevent the mobile application from accessing the wireless network.
13. The method of claim 1, wherein, the policy information includes an identification of the mobile application and firewall rules which prevent the mobile application from interacting with a user.
14. The method of claim 1, wherein, the policy information includes an identification of the mobile application and firewall rules which prevent the mobile application from requesting a user for personal information.
15. A system for automatically generating and distributing policy information for malicious mobile traffic in a wireless network, the system, comprising: a plurality of mobile devices in a wireless network;a proxy server able to aggregating suspicious activity information detected across at least one application on a mobile device in the wireless network;wherein, the suspicious activity information is detected in the at least one application activity occurring in traffic that is in response to requests to execute the at least one mobile application installed on the multiple mobile devices;wherein, the proxy server blocks traffic generated by the mobile application activities that is directed to or from the mobile devices;wherein, the proxy server is physically distinct from the mobile device and able to communicate wirelessly with the mobile device,wherein the proxy server generates policy information for malicious mobile traffic using the suspicious activity information and distributes the policy information among the multiple mobile devices or other mobile devices in the wireless network,wherein the policy information includes an identification of the mobile application and rules which either automatically uninstalls the at least one mobile application or automatically blocks future installations of the at least one mobile application, wherein the suspicious activity information is used to determine cacheability of the response.
16. The system of claim 15, wherein the policy information is specific to each application of the at least one mobile applications.
17. The system of claim 15, wherein, the suspicious activity is detected using a security certificate of the traffic.
18. The system of claim 15, wherein, the suspicious activity is detected from traffic which invokes billable activity.
19. The system of claim 15, wherein, the suspicious activity is detected based on a port to or from which the traffic is directed.
20. The system of claim 15, wherein, the proxy server also manages cache on the mobile device.
21. The system of claim 15, wherein, the proxy server is able to use information about requests initiated at the mobile device, to determine whether any of incoming or outgoing traffic from a mobile device to aggregate the suspicious traffic information.
22. The system of claim 15, wherein, the proxy server intercepts or redirects malicious traffic; wherein, the proxy server collects the information about the requests.
23. The system of claim 15, wherein, a local proxy on the mobile devices detects the information about the requests and communicates the information about the requests to the proxy server.
24. The system of claim 15, wherein, the proxy server notifies one or more of multiple entities when the suspicious activity information is detected in mobile application activities.
25. The system of claim 24, wherein, the multiple entities includes, one or more of, a user of the mobile device, the mobile device, an operating system of the mobile device.
26. The system of claim 24, wherein, the multiple entities include, one or more of, a network or cellular service provider, an application service provider, Internet service provider, and content provider.
27. The system of claim 15, wherein, the proxy server uses a blacklist to detect the suspicious activity information; wherein the blacklist is stored on the proxy server and aggregated from analysis of traffic in the wireless network.
28. A server comprising: a hardware processor configured for:aggregating suspicious activity information detected across multiple mobile devices in a wireless network;wherein, the suspicious activity information is detected, by each of the mobile devices, in mobile application activities occurring on at least one mobile application on the multiple mobile devices;wherein the mobile application activities comprises traffic to and from each mobile device in response to requests from the at least one mobile application,generating policy information for malicious mobile traffic using the suspicious activity information; anddistributing the policy information among the multiple mobile devices or other mobile devices in the wireless network,wherein, the policy information includes an identification of the mobile application and rules which either automatically uninstalls the mobile application or automatically blocks future installations of the mobile application,wherein the suspicious activity information is used to determine cacheability of the response.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a Continuation of U.S. patent application Ser. No. 13/546,995 entitled “MONITORING MOBILE APPLICATION ACTIVITIES FOR MALICIOUS TRAFFIC ON A MOBILE DEVICE,” which was filed on Jul. 11, 2012, which claims benefit of U.S. Provisional Patent Application No. 61/512,278 entitled “HEURISTIC DETECTION AND BLOCKING OF MALICIOUS APPLICATIONS IN A WIRELESS NETWORK VIA A DISTRIBUTED PROXY SYSTEM,” which was filed on Jul. 27, 2011, the contents of which are all incorporated by reference herein. This application is related to U.S. patent application Ser. No. 13/458,844 entitled “DETECTION AND FILTERING OF MALWARE BASED ON TRAFFIC OBSERVATIONS MADE IN A DISTRIBUTED MOBILE TRAFFIC MANAGEMENT SYSTEM,” which was filed on Apr. 27, 2012, the contents of which are all incorporated by reference herein.

US Referenced Citations (1221)

Number	Name	Date	Kind
222458	Connolly et al.	Dec 1879	A
447918	Strowger	Mar 1891	A
4200770	Hellman et al.	Apr 1980	A
4255796	Gabbe et al.	Mar 1981	A
4276597	Dissly et al.	Jun 1981	A
4531020	Wechselberger et al.	Jul 1985	A
4807182	Queen	Feb 1989	A
4831582	Miller et al.	May 1989	A
4875159	Cary et al.	Oct 1989	A
4897781	Chang et al.	Jan 1990	A
4972457	O'Sullivan	Nov 1990	A
5008853	Bly et al.	Apr 1991	A
5159624	Makita	Oct 1992	A
5220657	Bly et al.	Jun 1993	A
5263157	Janis	Nov 1993	A
5283856	Gross et al.	Feb 1994	A
5357431	Nakada et al.	Oct 1994	A
5384892	Strong	Jan 1995	A
5386564	Shearer et al.	Jan 1995	A
5392390	Crozier	Feb 1995	A
5434994	Shaheen et al.	Jul 1995	A
5436960	Campana, Jr. et al.	Jul 1995	A
5438611	Campana, Jr. et al.	Aug 1995	A
5479472	Campana, Jr. et al.	Dec 1995	A
5487100	Kane	Jan 1996	A
5491703	Barnaby et al.	Feb 1996	A
5493692	Theimer et al.	Feb 1996	A
5519606	Frid-Nielsen et al.	May 1996	A
5555376	Theimer et al.	Sep 1996	A
5559800	Mousseau et al.	Sep 1996	A
5572571	Shirai	Nov 1996	A
5572643	Judson	Nov 1996	A
5574859	Yeh	Nov 1996	A
5581749	Hossain et al.	Dec 1996	A
5600834	Howard	Feb 1997	A
5603054	Theimer et al.	Feb 1997	A
5604788	Tett	Feb 1997	A
5613012	Hoffman et al.	Mar 1997	A
5619507	Tsuda	Apr 1997	A
5619648	Canale et al.	Apr 1997	A
5623601	Vu	Apr 1997	A
5625670	Campana, Jr. et al.	Apr 1997	A
5625815	Maier et al.	Apr 1997	A
5627658	Connors et al.	May 1997	A
5630081	Rybicki et al.	May 1997	A
5631946	Campana, Jr. et al.	May 1997	A
5632018	Otorii	May 1997	A
5634053	Noble et al.	May 1997	A
5647002	Brunson	Jul 1997	A
5652884	Palevich	Jul 1997	A
5664207	Crumpler et al.	Sep 1997	A
5666530	Clark et al.	Sep 1997	A
5666553	Crozier	Sep 1997	A
5680542	Mulchandani et al.	Oct 1997	A
5682524	Freund et al.	Oct 1997	A
5684990	Boothby	Nov 1997	A
5689654	Kikinis et al.	Nov 1997	A
5692039	Brankley et al.	Nov 1997	A
5696903	Mahany	Dec 1997	A
5701423	Crozier	Dec 1997	A
5701469	Brandli et al.	Dec 1997	A
5704029	Wright, Jr.	Dec 1997	A
5706211	Beletic et al.	Jan 1998	A
5706502	Foley et al.	Jan 1998	A
5706507	Schloss	Jan 1998	A
5710918	Lagarde et al.	Jan 1998	A
5713019	Keaten	Jan 1998	A
5715403	Stefik	Feb 1998	A
5717925	Harper et al.	Feb 1998	A
5721908	Lagarde et al.	Feb 1998	A
5721914	DeVries	Feb 1998	A
5727202	Kucala	Mar 1998	A
5729549	Kostreski et al.	Mar 1998	A
5729704	Stone et al.	Mar 1998	A
5729735	Meyering	Mar 1998	A
5742905	Pepe et al.	Apr 1998	A
5745360	Leone et al.	Apr 1998	A
5752186	Malackowski et al.	May 1998	A
5752246	Rogers et al.	May 1998	A
5754938	Herz et al.	May 1998	A
5757916	MacDoran et al.	May 1998	A
5758088	Bezaire et al.	May 1998	A
5758150	Bell et al.	May 1998	A
5758322	Rongley	May 1998	A
5758354	Huang et al.	May 1998	A
5758355	Buchanan	May 1998	A
5765171	Gehani et al.	Jun 1998	A
5778346	Frid-Nielsen et al.	Jul 1998	A
5778361	Nanjo et al.	Jul 1998	A
5781614	Brunson	Jul 1998	A
5781901	Kuzma	Jul 1998	A
5781906	Aggarwal et al.	Jul 1998	A
5787430	Doeringer et al.	Jul 1998	A
5787441	Beckhardt	Jul 1998	A
5790425	Wagle	Aug 1998	A
5790790	Smith et al.	Aug 1998	A
5790974	Tognazzini	Aug 1998	A
5793413	Hylton et al.	Aug 1998	A
5794210	Goldhaber et al.	Aug 1998	A
5799318	Cardinal et al.	Aug 1998	A
5802312	Lazaridis et al.	Sep 1998	A
5802454	Goshay et al.	Sep 1998	A
5802518	Karaev et al.	Sep 1998	A
5802524	Flowers et al.	Sep 1998	A
5806074	Souder et al.	Sep 1998	A
5809242	Shaw et al.	Sep 1998	A
5809415	Rossmann	Sep 1998	A
5818437	Grover et al.	Oct 1998	A
5819172	Campana, Jr. et al.	Oct 1998	A
5819274	Jackson, Jr.	Oct 1998	A
5819284	Farber et al.	Oct 1998	A
5822324	Kostresti et al.	Oct 1998	A
5822747	Graefe et al.	Oct 1998	A
5826269	Hussey	Oct 1998	A
5831664	Wharton et al.	Nov 1998	A
5832483	Barker	Nov 1998	A
5832489	Kucala	Nov 1998	A
5832500	Burrows	Nov 1998	A
5835087	Herz et al.	Nov 1998	A
5835722	Bradshaw et al.	Nov 1998	A
5838252	Kikinis	Nov 1998	A
5838768	Sumar et al.	Nov 1998	A
5838973	Carpenter-Smith et al.	Nov 1998	A
5845278	Kirsch et al.	Dec 1998	A
5852775	Hidary	Dec 1998	A
5852820	Burrows	Dec 1998	A
5857201	Wright, Jr. et al.	Jan 1999	A
5862223	Walker et al.	Jan 1999	A
5867665	Butman et al.	Feb 1999	A
5867817	Catallo et al.	Feb 1999	A
5870759	Bauer et al.	Feb 1999	A
5884323	Hawkins et al.	Mar 1999	A
5889845	Staples et al.	Mar 1999	A
5890147	Peltonen et al.	Mar 1999	A
5892909	Grasso et al.	Apr 1999	A
5898780	Liu et al.	Apr 1999	A
5898917	Batni et al.	Apr 1999	A
5903723	Beck et al.	May 1999	A
5907618	Gennaro et al.	May 1999	A
5909689	Van Ryzin	Jun 1999	A
5913032	Schwartz et al.	Jun 1999	A
5924096	Draper et al.	Jul 1999	A
5928325	Shaughnessy et al.	Jul 1999	A
5928329	Clark et al.	Jul 1999	A
5937161	Mulligan et al.	Aug 1999	A
5940813	Hutchings	Aug 1999	A
5943676	Boothby	Aug 1999	A
5948066	Whalen et al.	Sep 1999	A
5951636	Zerber	Sep 1999	A
5960394	Gould et al.	Sep 1999	A
5960406	Rasansky et al.	Sep 1999	A
5961590	Mendez et al.	Oct 1999	A
5963642	Goldstein	Oct 1999	A
5964833	Kikinis	Oct 1999	A
5968131	Mendez et al.	Oct 1999	A
5974238	Chase, Jr.	Oct 1999	A
5974327	Agrawal et al.	Oct 1999	A
5978837	Foladare et al.	Nov 1999	A
5978933	Wyld et al.	Nov 1999	A
5987440	O'Neil et al.	Nov 1999	A
6000000	Hawkins et al.	Dec 1999	A
6003070	Frantz	Dec 1999	A
6006274	Hawkins et al.	Dec 1999	A
6016478	Zhang et al.	Jan 2000	A
6016520	Facq et al.	Jan 2000	A
6018762	Brunson et al.	Jan 2000	A
6023700	Owens et al.	Feb 2000	A
6023708	Mendez et al.	Feb 2000	A
6029238	Furukawa	Feb 2000	A
6034621	Kaufman	Mar 2000	A
6035104	Zahariev	Mar 2000	A
6044372	Rothfus et al.	Mar 2000	A
6044381	Boothby et al.	Mar 2000	A
6047051	Ginzboorg et al.	Apr 2000	A
6047327	Tso et al.	Apr 2000	A
6052563	Macko	Apr 2000	A
6052735	Ulrich et al.	Apr 2000	A
6057855	Barkans	May 2000	A
6065055	Hughes et al.	May 2000	A
6073138	de l'Etraz et al.	Jun 2000	A
6073142	Geiger et al.	Jun 2000	A
6073165	Narasimhan et al.	Jun 2000	A
6085166	Beckhardt et al.	Jul 2000	A
6085192	Mendez et al.	Jul 2000	A
6088677	Spurgeon	Jul 2000	A
6101320	Schuetze et al.	Aug 2000	A
6101480	Conmy et al.	Aug 2000	A
6101531	Eggleston et al.	Aug 2000	A
6112181	Shear et al.	Aug 2000	A
6119014	Alperovich et al.	Sep 2000	A
6119171	Alkhatib	Sep 2000	A
6125369	Wu et al.	Sep 2000	A
6125388	Reisman	Sep 2000	A
6128627	Mattis et al.	Oct 2000	A
6130898	Kostreski et al.	Oct 2000	A
6131096	Ng et al.	Oct 2000	A
6131116	Riggins et al.	Oct 2000	A
6134432	Holmes et al.	Oct 2000	A
6138013	Blanchard et al.	Oct 2000	A
6138124	Beckhardt	Oct 2000	A
6138128	Perkowitz et al.	Oct 2000	A
6138146	Moon et al.	Oct 2000	A
6141664	Boothby	Oct 2000	A
6151606	Mendez	Nov 2000	A
6157630	Adler et al.	Dec 2000	A
6161140	Moriya	Dec 2000	A
6167379	Dean et al.	Dec 2000	A
6167435	Druckenmiller et al.	Dec 2000	A
6170014	Darago et al.	Jan 2001	B1
6173312	Atarashi et al.	Jan 2001	B1
6173446	Khan et al.	Jan 2001	B1
6175831	Weinreich et al.	Jan 2001	B1
6178419	Legh-Smith et al.	Jan 2001	B1
6181935	Gossman et al.	Jan 2001	B1
6185184	Mattaway et al.	Feb 2001	B1
6195533	Tkatch et al.	Feb 2001	B1
6198696	Korpi et al.	Mar 2001	B1
6198922	Baynham	Mar 2001	B1
6201469	Balch et al.	Mar 2001	B1
6202085	Benson et al.	Mar 2001	B1
6205448	Kruglikov et al.	Mar 2001	B1
6212529	Boothby et al.	Apr 2001	B1
6219694	Lazaridis et al.	Apr 2001	B1
6221877	Aronov et al.	Apr 2001	B1
6223187	Boothby et al.	Apr 2001	B1
6226686	Rothschild et al.	May 2001	B1
6233341	Riggins	May 2001	B1
6243705	Kucala	Jun 2001	B1
6246875	Seazholtz et al.	Jun 2001	B1
6247135	Feague	Jun 2001	B1
6249808	Seshadri	Jun 2001	B1
6256666	Singhal	Jul 2001	B1
6263201	Hashimoto et al.	Jul 2001	B1
6263340	Green	Jul 2001	B1
6269369	Robertson	Jul 2001	B1
6272545	Flanagin et al.	Aug 2001	B1
6275850	Beyda et al.	Aug 2001	B1
6275858	Bates et al.	Aug 2001	B1
6289212	Stein et al.	Sep 2001	B1
6289214	Backstrom	Sep 2001	B1
6292904	Broomhall et al.	Sep 2001	B1
6295541	Bodnar et al.	Sep 2001	B1
6300947	Kanevsky	Oct 2001	B1
6304881	Halim et al.	Oct 2001	B1
6308201	Pivowar et al.	Oct 2001	B1
6317594	Gossman et al.	Nov 2001	B1
6320943	Borland	Nov 2001	B1
6324541	de l'Etraz et al.	Nov 2001	B1
6324542	Wright, Jr. et al.	Nov 2001	B1
6324544	Alam et al.	Nov 2001	B1
6324587	Trenbeath et al.	Nov 2001	B1
6327586	Kisiel	Dec 2001	B1
6336117	Massarani	Jan 2002	B1
6336138	Caswell et al.	Jan 2002	B1
6351767	Batchelder et al.	Feb 2002	B1
6356937	Montville et al.	Mar 2002	B1
6363051	Eslambolchi et al.	Mar 2002	B1
6363352	Dailey et al.	Mar 2002	B1
6370566	Discolo et al.	Apr 2002	B2
6377810	Geiger et al.	Apr 2002	B1
6380959	Wang et al.	Apr 2002	B1
6389422	Doi et al.	May 2002	B1
6389455	Fuisz	May 2002	B1
6389457	Lazaridis et al.	May 2002	B2
6397057	Malackowski et al.	May 2002	B1
6397230	Carmel et al.	May 2002	B1
6401104	LaRue et al.	Jun 2002	B1
6401112	Boyer et al.	Jun 2002	B1
6401113	Lazaridis et al.	Jun 2002	B2
6405197	Gilmour	Jun 2002	B2
6411696	Iverson et al.	Jun 2002	B1
6415031	Colligan et al.	Jul 2002	B1
6418308	Heinonen et al.	Jul 2002	B1
6421669	Gilmour et al.	Jul 2002	B1
6421781	Fox et al.	Jul 2002	B1
6430602	Kay et al.	Aug 2002	B1
6438585	Mousseau et al.	Aug 2002	B2
6438612	Ylonen et al.	Aug 2002	B1
6442589	Takahashi et al.	Aug 2002	B1
6442637	Hawkins et al.	Aug 2002	B1
6446118	Gottlieb	Sep 2002	B1
6463463	Godfrey et al.	Oct 2002	B1
6463464	Lazaridis et al.	Oct 2002	B1
6487557	Nagatomo	Nov 2002	B1
6487560	LaRue et al.	Nov 2002	B1
6490353	Tan	Dec 2002	B1
6496802	van Zoest et al.	Dec 2002	B1
6499054	Hesselink et al.	Dec 2002	B1
6505214	Sherman et al.	Jan 2003	B1
6516327	Zondervan et al.	Feb 2003	B1
6526433	Chang et al.	Feb 2003	B1
6526506	Lewis	Feb 2003	B1
6529908	Piett et al.	Mar 2003	B1
6532446	King	Mar 2003	B1
6535892	LaRue et al.	Mar 2003	B1
6546005	Berkley et al.	Apr 2003	B1
6549939	Ford et al.	Apr 2003	B1
6556217	Mäkipää et al.	Apr 2003	B1
6593944	Nicolas et al.	Jul 2003	B1
6601026	Appelt et al.	Jul 2003	B2
6615253	Bowman-Amuah	Sep 2003	B1
6618710	Zondervan et al.	Sep 2003	B1
6621892	Banister et al.	Sep 2003	B1
6625621	Tan et al.	Sep 2003	B2
6636482	Cloonan et al.	Oct 2003	B2
6639693	Ejiri et al.	Oct 2003	B1
6640097	Corrigan et al.	Oct 2003	B2
6640244	Bowman-Amuah	Oct 2003	B1
6640249	Bowman-Amuah	Oct 2003	B1
6643650	Slaughter et al.	Nov 2003	B1
6643688	Fuisz	Nov 2003	B1
6647384	Gilmour	Nov 2003	B2
6650890	Irlam et al.	Nov 2003	B1
6662016	Buckham et al.	Dec 2003	B1
6668046	Albal	Dec 2003	B1
6671695	McFadden	Dec 2003	B2
6671700	Creemer et al.	Dec 2003	B1
6671702	Kruglikov et al.	Dec 2003	B2
6671757	Multer et al.	Dec 2003	B1
6694336	Multer et al.	Feb 2004	B1
6697807	McGeachie	Feb 2004	B2
6701378	Gilhuly et al.	Mar 2004	B1
6707801	Hsu	Mar 2004	B2
6708221	Mendez et al.	Mar 2004	B1
6714965	Kakuta et al.	Mar 2004	B2
6721787	Hiscock	Apr 2004	B1
6727917	Chew et al.	Apr 2004	B1
6728530	Heinonen et al.	Apr 2004	B1
6728786	Hawkins et al.	Apr 2004	B2
6732101	Cook	May 2004	B1
6732158	Hesselink et al.	May 2004	B1
6735591	Khan	May 2004	B2
6741232	Siedlikowski et al.	May 2004	B1
6741855	Martin et al.	May 2004	B1
6742015	Bowman-Amuah	May 2004	B1
6742059	Todd et al.	May 2004	B1
6745024	DeJaco et al.	Jun 2004	B1
6745326	Wary	Jun 2004	B1
6756882	Benes et al.	Jun 2004	B2
6757362	Cooper et al.	Jun 2004	B1
6757696	Multer et al.	Jun 2004	B2
6757708	Craig et al.	Jun 2004	B1
6760916	Holtz et al.	Jul 2004	B2
6771294	Pulli et al.	Aug 2004	B1
6775362	Ransom	Aug 2004	B1
6779019	Mousseau et al.	Aug 2004	B1
6782409	Yoshida	Aug 2004	B1
6785868	Raff	Aug 2004	B1
6785906	Gaughan et al.	Aug 2004	B1
6799190	Boothby	Sep 2004	B1
6804707	Ronning	Oct 2004	B1
6816849	Halt, Jr.	Nov 2004	B1
6820088	Hind et al.	Nov 2004	B1
6820204	Desai et al.	Nov 2004	B1
6829487	Eiden et al.	Dec 2004	B2
6834195	Brandenberg et al.	Dec 2004	B2
6847974	Wachtel	Jan 2005	B2
6850757	Watanabe et al.	Feb 2005	B2
6859212	Kumar et al.	Feb 2005	B2
6867774	Halmshaw et al.	Mar 2005	B1
6868447	Slaughter et al.	Mar 2005	B1
6871220	Rajan et al.	Mar 2005	B1
6871236	Fishman et al.	Mar 2005	B2
6873688	Aarnio	Mar 2005	B1
6874017	Inoue et al.	Mar 2005	B1
6879985	Deguchi et al.	Apr 2005	B2
6886030	Easterbrook et al.	Apr 2005	B1
6892070	Warrier et al.	May 2005	B2
6892196	Hughes	May 2005	B1
6895394	Kremer et al.	May 2005	B1
6895558	Loveland	May 2005	B1
6898427	Griffith et al.	May 2005	B1
6922547	O'Neill et al.	Jul 2005	B2
6922721	Minborg et al.	Jul 2005	B1
6925477	Champagne et al.	Aug 2005	B1
6931529	Kunzinger	Aug 2005	B2
6938079	Anderson et al.	Aug 2005	B1
6944447	Portman et al.	Sep 2005	B2
6944662	Devine et al.	Sep 2005	B2
6947770	Rydbeck	Sep 2005	B2
6957397	Hawkins et al.	Oct 2005	B1
6965917	Aloni et al.	Nov 2005	B1
6966058	Earl et al.	Nov 2005	B2
6968175	Raivisto et al.	Nov 2005	B2
6970879	Gilmour	Nov 2005	B1
6972682	Lareau et al.	Dec 2005	B2
6973299	Apfel	Dec 2005	B2
6981041	Araujo et al.	Dec 2005	B2
6981047	Hanson et al.	Dec 2005	B2
6985933	Singhal et al.	Jan 2006	B1
6985983	Pellegrino et al.	Jan 2006	B2
6986061	Kunzinger	Jan 2006	B1
6987734	Hundemer	Jan 2006	B2
6990472	Rosenhaft et al.	Jan 2006	B2
6993326	Link, II et al.	Jan 2006	B2
6993327	Mathis	Jan 2006	B2
6996627	Carden	Feb 2006	B1
6999753	Beckmann et al.	Feb 2006	B2
7020685	Chen et al.	Mar 2006	B1
7024491	Hanmann et al.	Apr 2006	B1
7026984	Thandu et al.	Apr 2006	B1
7032242	Grabelsky et al.	Apr 2006	B1
7035630	Knowles	Apr 2006	B2
7046993	Haaramo et al.	May 2006	B2
7047202	Jaipuria et al.	May 2006	B2
7062024	Kreckel et al.	Jun 2006	B2
7069308	Abrams	Jun 2006	B2
7072678	Allison	Jul 2006	B2
7079499	Akhtar et al.	Jul 2006	B1
7080371	Arnaiz et al.	Jul 2006	B1
7082316	Eiden et al.	Jul 2006	B2
7085365	Kauppinen	Aug 2006	B2
7096030	Huomo	Aug 2006	B2
7100821	Rasti	Sep 2006	B2
7103432	Drader et al.	Sep 2006	B2
7120692	Hesselink et al.	Oct 2006	B2
7120928	Sheth et al.	Oct 2006	B2
7130839	Boreham et al.	Oct 2006	B2
7136645	Hanson et al.	Nov 2006	B2
7139555	Apfel	Nov 2006	B2
7139565	Fiatal et al.	Nov 2006	B2
7140549	de Jong	Nov 2006	B2
7146645	Hellsten et al.	Dec 2006	B1
7149780	Quine et al.	Dec 2006	B2
7149789	Slivka et al.	Dec 2006	B2
7149959	Jones et al.	Dec 2006	B1
7162241	Kim et al.	Jan 2007	B2
7165727	de Jong	Jan 2007	B2
7172118	Urken	Feb 2007	B2
7181228	Boesch	Feb 2007	B2
7184790	Dorenbosch et al.	Feb 2007	B2
7185362	Hawkes et al.	Feb 2007	B2
7194273	Vaudreuil	Mar 2007	B2
7200390	Henager et al.	Apr 2007	B1
7203733	Bern	Apr 2007	B1
7206806	Pineau	Apr 2007	B2
7209757	Naghian et al.	Apr 2007	B2
7219139	Martin et al.	May 2007	B2
7219222	Durbin et al.	May 2007	B1
7224957	Spector	May 2007	B2
7231206	Cudak et al.	Jun 2007	B2
7233795	Ryden	Jun 2007	B1
7234111	Chu et al.	Jun 2007	B2
7239877	Corneille et al.	Jul 2007	B2
7240095	Lewis	Jul 2007	B1
7242680	Gallant	Jul 2007	B2
7245926	Liao et al.	Jul 2007	B2
7257391	Burgess et al.	Aug 2007	B2
7257639	Li et al.	Aug 2007	B1
7259666	Hermsmeyer et al.	Aug 2007	B1
7260552	Riera Jorba et al.	Aug 2007	B2
7260590	Williams	Aug 2007	B1
7260651	Parrella, Sr. et al.	Aug 2007	B2
7272830	de Jong	Sep 2007	B2
7277408	Sorsa	Oct 2007	B2
7284664	Ivchenko et al.	Oct 2007	B1
7289792	Turunen	Oct 2007	B1
7289964	Bowman-Amuah	Oct 2007	B1
7289971	O'Neil et al.	Oct 2007	B1
7293107	Hanson et al.	Nov 2007	B1
7295853	Jin et al.	Nov 2007	B2
7305252	Britt et al.	Dec 2007	B2
7305700	Boynton et al.	Dec 2007	B2
7310350	Shao et al.	Dec 2007	B1
7310729	Gordon et al.	Dec 2007	B2
7324473	Corneille et al.	Jan 2008	B2
7349871	Labrou et al.	Mar 2008	B2
7353274	Rouhi et al.	Apr 2008	B1
7359720	Hartmaier et al.	Apr 2008	B2
7373386	Gardner et al.	May 2008	B2
7374099	de Jong	May 2008	B2
7376701	Bhargava et al.	May 2008	B2
7382879	Miller	Jun 2008	B1
7388950	Elsey et al.	Jun 2008	B2
7389412	Sharma et al.	Jun 2008	B2
7392483	Wong et al.	Jun 2008	B2
7395329	Holt et al.	Jul 2008	B1
7398271	Borkovsky et al.	Jul 2008	B1
7430609	Brown et al.	Sep 2008	B2
7441271	Fiatal et al.	Oct 2008	B2
7443847	Albert et al.	Oct 2008	B1
7461071	Fitzpatrick et al.	Dec 2008	B2
7465231	Lewin et al.	Dec 2008	B2
7469125	Nurmi	Dec 2008	B2
7483036	Moore	Jan 2009	B2
7499537	Elsey et al.	Mar 2009	B2
7502615	Wilhoite et al.	Mar 2009	B2
7519042	Gorday et al.	Apr 2009	B2
7532571	Price et al.	May 2009	B1
7539665	Mendez	May 2009	B2
7548947	Karsriel et al.	Jun 2009	B2
7548969	Tripp et al.	Jun 2009	B2
7551900	Kang et al.	Jun 2009	B2
7567575	Chen et al.	Jul 2009	B2
7574208	Hanson et al.	Aug 2009	B2
7575171	Lev	Aug 2009	B2
7584294	Plamondon	Sep 2009	B2
7587482	Henderson et al.	Sep 2009	B2
7587608	Haller et al.	Sep 2009	B2
7593714	Schultz et al.	Sep 2009	B2
7596608	Alexander et al.	Sep 2009	B2
7613792	Zervas et al.	Nov 2009	B2
7630986	Herz et al.	Dec 2009	B1
7634558	Mangal et al.	Dec 2009	B1
7643818	Backholm et al.	Jan 2010	B2
7644166	Appelman et al.	Jan 2010	B2
7650416	Wu et al.	Jan 2010	B2
7672291	Wang	Mar 2010	B2
7672439	Appelman et al.	Mar 2010	B2
7680281	Fiatal et al.	Mar 2010	B2
7689664	Karlberg	Mar 2010	B2
7693944	Appelman et al.	Apr 2010	B2
7694008	Chang et al.	Apr 2010	B2
7706781	Backholm et al.	Apr 2010	B2
7707573	Marmaros et al.	Apr 2010	B1
7752633	Fleming	Jul 2010	B1
7757956	Koenck et al.	Jul 2010	B2
7769395	Fiatal et al.	Aug 2010	B2
7769400	Backholm et al.	Aug 2010	B2
7769805	Barnes et al.	Aug 2010	B1
7778792	Huang et al.	Aug 2010	B2
7783757	Plamondon	Aug 2010	B2
7796742	Sutaria et al.	Sep 2010	B1
7797064	Loomis et al.	Sep 2010	B2
7809818	Plamondon	Oct 2010	B2
7827055	Snodgrass et al.	Nov 2010	B1
7827597	Boynton et al.	Nov 2010	B2
7853563	Alvarado et al.	Dec 2010	B2
7877703	Fleming	Jan 2011	B1
7881745	Rao et al.	Feb 2011	B1
7899996	Levin-Michael	Mar 2011	B1
7908656	Mu	Mar 2011	B1
7917468	Ariel et al.	Mar 2011	B2
7917505	van Gent et al.	Mar 2011	B2
7921167	Shroff et al.	Apr 2011	B2
7930416	Miller et al.	Apr 2011	B2
7933929	McClendon et al.	Apr 2011	B1
7937091	Roman et al.	May 2011	B2
7970860	Kline et al.	Jun 2011	B2
7996487	Snyder	Aug 2011	B2
8000720	Aaron	Aug 2011	B2
8005891	Knowles et al.	Aug 2011	B2
8010082	Sutaria et al.	Aug 2011	B2
8032409	Mikurak	Oct 2011	B1
8064583	Sutaria et al.	Nov 2011	B1
8069166	Alvarado et al.	Nov 2011	B2
8078158	Backholm	Dec 2011	B2
8087085	Hu et al.	Dec 2011	B2
8107921	Fiatal	Jan 2012	B2
8116214	Backholm et al.	Feb 2012	B2
8127342	Boynton et al.	Feb 2012	B2
8166164	Luna et al.	Apr 2012	B1
8190701	Luna et al.	May 2012	B2
8194680	Brandwine et al.	Jun 2012	B1
8204953	Luna et al.	Jun 2012	B2
8209709	Fleming	Jun 2012	B2
8504680	Hernacki et al.	Aug 2013	B1
8539552	Grabelsky et al.	Sep 2013	B1
8584234	Sobel et al.	Nov 2013	B1
20010009025	Ahonen	Jul 2001	A1
20010010046	Muyres et al.	Jul 2001	A1
20010013069	Shah	Aug 2001	A1
20010023414	Kumar et al.	Sep 2001	A1
20010032254	Hawkins	Oct 2001	A1
20010034225	Gupte et al.	Oct 2001	A1
20010034244	Calder et al.	Oct 2001	A1
20010037453	Mitty et al.	Nov 2001	A1
20010039191	Maierhofer	Nov 2001	A1
20010041566	Xanthos et al.	Nov 2001	A1
20010042009	Montague	Nov 2001	A1
20010042099	Peng	Nov 2001	A1
20010043148	Stewart	Nov 2001	A1
20010052052	Peng	Dec 2001	A1
20010053687	Sivula	Dec 2001	A1
20020002478	Swart et al.	Jan 2002	A1
20020002591	Ketola	Jan 2002	A1
20020007303	Brookler et al.	Jan 2002	A1
20020013727	Lee	Jan 2002	A1
20020019225	Miyashita	Feb 2002	A1
20020019812	Board et al.	Feb 2002	A1
20020035556	Shah et al.	Mar 2002	A1
20020035617	Lynch et al.	Mar 2002	A1
20020038253	Seaman et al.	Mar 2002	A1
20020042875	Shukla	Apr 2002	A1
20020049828	Pekarek-Kostka	Apr 2002	A1
20020053078	Holtz et al.	May 2002	A1
20020055351	Elsey et al.	May 2002	A1
20020059201	Work	May 2002	A1
20020059457	Ballard et al.	May 2002	A1
20020068559	Sharma et al.	Jun 2002	A1
20020073207	Widger et al.	Jun 2002	A1
20020077077	Rezvani et al.	Jun 2002	A1
20020077084	Zellner et al.	Jun 2002	A1
20020078384	Hippelainen	Jun 2002	A1
20020087549	Mostafa	Jul 2002	A1
20020087679	Pulley et al.	Jul 2002	A1
20020087883	Wohlgemuth et al.	Jul 2002	A1
20020089542	Imamura	Jul 2002	A1
20020091921	Kunzinger	Jul 2002	A1
20020095319	Swart et al.	Jul 2002	A1
20020095328	Swart et al.	Jul 2002	A1
20020095391	Swart et al.	Jul 2002	A1
20020095399	Devine et al.	Jul 2002	A1
20020098855	Hartmaier et al.	Jul 2002	A1
20020099613	Swart et al.	Jul 2002	A1
20020099809	Lee	Jul 2002	A1
20020101975	Tiburtius et al.	Aug 2002	A1
20020107944	Bai et al.	Aug 2002	A1
20020107985	Hwang et al.	Aug 2002	A1
20020116499	Ennus et al.	Aug 2002	A1
20020116501	Ho et al.	Aug 2002	A1
20020120388	Bullock	Aug 2002	A1
20020120766	Okajima et al.	Aug 2002	A1
20020120779	Teeple et al.	Aug 2002	A1
20020126701	Requena	Sep 2002	A1
20020133504	Vlahos et al.	Sep 2002	A1
20020144109	Benantar et al.	Oct 2002	A1
20020146129	Kaplan	Oct 2002	A1
20020152379	Gefwert et al.	Oct 2002	A1
20020155848	Suryanarayana	Oct 2002	A1
20020156839	Peterson et al.	Oct 2002	A1
20020158908	Vaajala et al.	Oct 2002	A1
20020161587	Pitts, III et al.	Oct 2002	A1
20020161925	Munger et al.	Oct 2002	A1
20020161928	Ndili	Oct 2002	A1
20020164977	Link, II et al.	Nov 2002	A1
20020167484	Hatanaka et al.	Nov 2002	A1
20020174189	Peng	Nov 2002	A1
20020186848	Shaik	Dec 2002	A1
20020188940	Breckner et al.	Dec 2002	A1
20020193094	Lawless et al.	Dec 2002	A1
20020194209	Bolosky et al.	Dec 2002	A1
20020198027	Rydbeck	Dec 2002	A1
20030005151	Ullman et al.	Jan 2003	A1
20030014491	Horvitz et al.	Jan 2003	A1
20030022662	Mittal	Jan 2003	A1
20030023692	Moroo	Jan 2003	A1
20030023975	Schrader et al.	Jan 2003	A1
20030028430	Zimmerman	Feb 2003	A1
20030028441	Barsness et al.	Feb 2003	A1
20030046433	Luzzatti et al.	Mar 2003	A1
20030046586	Bheemarasetti et al.	Mar 2003	A1
20030046587	Bheemarasetti et al.	Mar 2003	A1
20030050041	Wu	Mar 2003	A1
20030053463	Vikberg et al.	Mar 2003	A1
20030054810	Chen et al.	Mar 2003	A1
20030055882	Kawamura	Mar 2003	A1
20030056096	Albert et al.	Mar 2003	A1
20030060188	Gidron et al.	Mar 2003	A1
20030063120	Wong et al.	Apr 2003	A1
20030065738	Yang et al.	Apr 2003	A1
20030065739	Shnier	Apr 2003	A1
20030065802	Vitikainen et al.	Apr 2003	A1
20030070061	Wong et al.	Apr 2003	A1
20030072451	Pimentel et al.	Apr 2003	A1
20030078880	Alley et al.	Apr 2003	A1
20030084165	Kjellberg et al.	May 2003	A1
20030088629	Berkowitz et al.	May 2003	A1
20030093691	Simon et al.	May 2003	A1
20030097381	Detweiler et al.	May 2003	A1
20030100321	Rao et al.	May 2003	A1
20030100326	Grube et al.	May 2003	A1
20030117432	Kautto-Kiovula et al.	Jun 2003	A1
20030120685	Duncombe et al.	Jun 2003	A1
20030125023	Fishler	Jul 2003	A1
20030126216	Avila et al.	Jul 2003	A1
20030130984	Quinlan et al.	Jul 2003	A1
20030145038	Bin Tariq et al.	Jul 2003	A1
20030146934	Bailey et al.	Aug 2003	A1
20030153338	Herz et al.	Aug 2003	A1
20030154212	Schirmer et al.	Aug 2003	A1
20030156146	Suomela et al.	Aug 2003	A1
20030157947	Fiatal et al.	Aug 2003	A1
20030169262	Lavelle et al.	Sep 2003	A1
20030172112	Vignaud	Sep 2003	A1
20030177281	McQuillan et al.	Sep 2003	A1
20030182431	Sturniolo et al.	Sep 2003	A1
20030187984	Banavar et al.	Oct 2003	A1
20030191971	Klensin et al.	Oct 2003	A1
20030204605	Hudson et al.	Oct 2003	A1
20030208529	Pendyala et al.	Nov 2003	A1
20030208559	Velline et al.	Nov 2003	A1
20030210666	Trossen et al.	Nov 2003	A1
20030211845	Lohtia et al.	Nov 2003	A1
20030217098	Bobde et al.	Nov 2003	A1
20030217142	Bobde et al.	Nov 2003	A1
20030223554	Zhang	Dec 2003	A1
20030227487	Hugh	Dec 2003	A1
20030227745	Khoo	Dec 2003	A1
20030235308	Boynton et al.	Dec 2003	A1
20030236857	Takase et al.	Dec 2003	A1
20030236981	Marmigere et al.	Dec 2003	A1
20040002324	Juntunen et al.	Jan 2004	A1
20040006630	Friend et al.	Jan 2004	A1
20040015504	Ahad et al.	Jan 2004	A1
20040024795	Hind et al.	Feb 2004	A1
20040024892	Creswell et al.	Feb 2004	A1
20040027326	Hays et al.	Feb 2004	A1
20040027375	Ellis et al.	Feb 2004	A1
20040027378	Hays et al.	Feb 2004	A1
20040043770	Amit et al.	Mar 2004	A1
20040049579	Ims et al.	Mar 2004	A1
20040049599	Friend et al.	Mar 2004	A1
20040051715	Brokenshire et al.	Mar 2004	A1
20040054739	Friend et al.	Mar 2004	A1
20040064445	Pfleging et al.	Apr 2004	A1
20040064488	Sinha	Apr 2004	A1
20040068579	Marmigere et al.	Apr 2004	A1
20040068698	Wu et al.	Apr 2004	A1
20040073476	Donahue et al.	Apr 2004	A1
20040073651	Beaulieu et al.	Apr 2004	A1
20040075675	Raivisto et al.	Apr 2004	A1
20040075695	Chew et al.	Apr 2004	A1
20040078814	Allen	Apr 2004	A1
20040080515	Hagiwara	Apr 2004	A1
20040082346	Skytt et al.	Apr 2004	A1
20040098625	Lagadec et al.	May 2004	A1
20040103147	Flesher et al.	May 2004	A1
20040107319	D'Orto et al.	Jun 2004	A1
20040110497	Little	Jun 2004	A1
20040120323	Viikari et al.	Jun 2004	A1
20040123304	Black et al.	Jun 2004	A1
20040127214	Reddy et al.	Jul 2004	A1
20040128375	Rockwell	Jul 2004	A1
20040133626	Herrero et al.	Jul 2004	A1
20040141011	Smethers et al.	Jul 2004	A1
20040147248	Will	Jul 2004	A1
20040147262	Lescuyer et al.	Jul 2004	A1
20040148375	Levett et al.	Jul 2004	A1
20040158611	Daniell et al.	Aug 2004	A1
20040167966	Lee et al.	Aug 2004	A1
20040170257	Gross et al.	Sep 2004	A1
20040172481	Engstrom	Sep 2004	A1
20040176128	Grabelsky et al.	Sep 2004	A1
20040177369	Akins, III	Sep 2004	A1
20040179513	Smith et al.	Sep 2004	A1
20040181550	Warsta et al.	Sep 2004	A1
20040184475	Meier	Sep 2004	A1
20040186902	Stewart	Sep 2004	A1
20040189610	Friend	Sep 2004	A1
20040199497	Timmons	Oct 2004	A1
20040199582	Kucharewski et al.	Oct 2004	A1
20040199663	Horvitz et al.	Oct 2004	A1
20040205248	Little et al.	Oct 2004	A1
20040205330	Godfrey et al.	Oct 2004	A1
20040209602	Joyce et al.	Oct 2004	A1
20040210639	Ben-Yoseph et al.	Oct 2004	A1
20040219932	Verteuil	Nov 2004	A1
20040219940	Kong et al.	Nov 2004	A1
20040230619	Blanco et al.	Nov 2004	A1
20040233930	Colby, Jr.	Nov 2004	A1
20040236792	Celik	Nov 2004	A1
20040242209	Kruis et al.	Dec 2004	A1
20040252816	Nicolas	Dec 2004	A1
20040255126	Reith	Dec 2004	A1
20040258231	Elsey et al.	Dec 2004	A1
20040259535	Elsey et al.	Dec 2004	A1
20040259537	Ackley	Dec 2004	A1
20040260948	Miyata et al.	Dec 2004	A1
20040264396	Ginzburg et al.	Dec 2004	A1
20040266364	Nguyen et al.	Dec 2004	A1
20040268148	Karjala et al.	Dec 2004	A1
20050002501	Elsey et al.	Jan 2005	A1
20050002508	Elsey et al.	Jan 2005	A1
20050002509	Elsey et al.	Jan 2005	A1
20050002510	Elsey et al.	Jan 2005	A1
20050010694	Ma et al.	Jan 2005	A1
20050015432	Cohen	Jan 2005	A1
20050021750	Abrams	Jan 2005	A1
20050022000	Inomata et al.	Jan 2005	A1
20050022182	Mittal	Jan 2005	A1
20050027591	Gailey et al.	Feb 2005	A9
20050027716	Apfel	Feb 2005	A1
20050027869	Johnson	Feb 2005	A1
20050033812	McCarthy et al.	Feb 2005	A1
20050033926	Dumont	Feb 2005	A1
20050037741	Gilbert	Feb 2005	A1
20050038707	Roever et al.	Feb 2005	A1
20050038724	Roever et al.	Feb 2005	A1
20050038863	Onyon et al.	Feb 2005	A1
20050041793	Fulton et al.	Feb 2005	A1
20050044144	Malik et al.	Feb 2005	A1
20050055578	Wright et al.	Mar 2005	A1
20050063544	Uusitalo et al.	Mar 2005	A1
20050071489	Parupudi et al.	Mar 2005	A1
20050071674	Chou et al.	Mar 2005	A1
20050073982	Corneille et al.	Apr 2005	A1
20050076136	Cho et al.	Apr 2005	A1
20050076241	Appelman	Apr 2005	A1
20050086540	Gunter et al.	Apr 2005	A1
20050094625	Bouat	May 2005	A1
20050097225	Glatt et al.	May 2005	A1
20050097570	Bomers	May 2005	A1
20050101307	Brugge et al.	May 2005	A1
20050102257	Onyon et al.	May 2005	A1
20050102328	Ring et al.	May 2005	A1
20050102351	Jiang et al.	May 2005	A1
20050108427	Datta	May 2005	A1
20050117606	Kim	Jun 2005	A1
20050120082	Hesselink et al.	Jun 2005	A1
20050120084	Hu et al.	Jun 2005	A1
20050120181	Arunagirinathan et al.	Jun 2005	A1
20050122333	Sumanaweera et al.	Jun 2005	A1
20050124332	Clark et al.	Jun 2005	A1
20050138111	Aton et al.	Jun 2005	A1
20050144219	Terada	Jun 2005	A1
20050147130	Hurwitz et al.	Jul 2005	A1
20050154698	Ikezawa et al.	Jul 2005	A1
20050154796	Forsyth	Jul 2005	A1
20050154836	Steeley et al.	Jul 2005	A1
20050155027	Wei	Jul 2005	A1
20050164703	Huynh	Jul 2005	A1
20050164721	Yeh et al.	Jul 2005	A1
20050165909	Cromer et al.	Jul 2005	A1
20050170776	Siorpaes	Aug 2005	A1
20050183143	Anderholm et al.	Aug 2005	A1
20050188038	Yabe	Aug 2005	A1
20050193036	Phillips et al.	Sep 2005	A1
20050193096	Yu et al.	Sep 2005	A1
20050198170	LaMay et al.	Sep 2005	A1
20050203966	Labrou et al.	Sep 2005	A1
20050210104	Torvinen	Sep 2005	A1
20050210125	Li	Sep 2005	A1
20050222891	Chan et al.	Oct 2005	A1
20050228812	Hansmann et al.	Oct 2005	A1
20050232295	Young	Oct 2005	A1
20050234860	Roever et al.	Oct 2005	A1
20050235214	Shimizu et al.	Oct 2005	A1
20050246139	Rivenbark et al.	Nov 2005	A1
20050248526	Twerdahl et al.	Nov 2005	A1
20050251555	Little, II	Nov 2005	A1
20050254443	Campbell et al.	Nov 2005	A1
20050262220	Ecklund et al.	Nov 2005	A1
20050273804	Preisman	Dec 2005	A1
20050278307	Battagin et al.	Dec 2005	A1
20050278641	Mansour et al.	Dec 2005	A1
20050278647	Leavitt et al.	Dec 2005	A1
20050288006	Apfel	Dec 2005	A1
20060012672	Schrader et al.	Jan 2006	A1
20060020525	Borelli et al.	Jan 2006	A1
20060020580	Dettinger et al.	Jan 2006	A1
20060020804	Schleifer et al.	Jan 2006	A1
20060020947	Hallamaa et al.	Jan 2006	A1
20060021023	Stewart et al.	Jan 2006	A1
20060022048	Johnson	Feb 2006	A1
20060026580	Cabillic et al.	Feb 2006	A1
20060029062	Rao et al.	Feb 2006	A1
20060029063	Rao et al.	Feb 2006	A1
20060029064	Rao et al.	Feb 2006	A1
20060031114	Zommers	Feb 2006	A1
20060031300	Kock et al.	Feb 2006	A1
20060031365	Kay et al.	Feb 2006	A1
20060031428	Wikman	Feb 2006	A1
20060031785	Raciborski	Feb 2006	A1
20060037071	Rao et al.	Feb 2006	A1
20060046686	Hawkins et al.	Mar 2006	A1
20060047844	Deng	Mar 2006	A1
20060048061	Forlenza et al.	Mar 2006	A1
20060052091	Onyon et al.	Mar 2006	A1
20060052137	Randall et al.	Mar 2006	A1
20060059239	Kouznetsov et al.	Mar 2006	A1
20060059495	Spector	Mar 2006	A1
20060063544	Zhao et al.	Mar 2006	A1
20060069686	Beyda et al.	Mar 2006	A1
20060069687	Cui et al.	Mar 2006	A1
20060069715	Vayssiere	Mar 2006	A1
20060069742	Segre	Mar 2006	A1
20060069746	Davis et al.	Mar 2006	A1
20060073810	Pyhalammi et al.	Apr 2006	A1
20060074951	Beier et al.	Apr 2006	A1
20060075028	Zager et al.	Apr 2006	A1
20060084410	Sutaria et al.	Apr 2006	A1
20060085503	Stoye et al.	Apr 2006	A1
20060093026	Montojo et al.	May 2006	A1
20060093135	Fiatal et al.	May 2006	A1
20060095768	Hoshino et al.	May 2006	A1
20060095969	Portolani et al.	May 2006	A1
20060099969	Staton et al.	May 2006	A1
20060099970	Morgan et al.	May 2006	A1
20060112177	Barkley et al.	May 2006	A1
20060123042	Xie et al.	Jun 2006	A1
20060132495	Anderson	Jun 2006	A1
20060141962	Forbes et al.	Jun 2006	A1
20060143464	Ananthanarayanan et al.	Jun 2006	A1
20060149591	Hauf et al.	Jul 2006	A1
20060149843	Rhoads et al.	Jul 2006	A1
20060149970	Imazu	Jul 2006	A1
20060155822	Yang et al.	Jul 2006	A1
20060161621	Rosenberg	Jul 2006	A1
20060165060	Dua	Jul 2006	A1
20060165226	Ernst et al.	Jul 2006	A1
20060168043	Eisenberger et al.	Jul 2006	A1
20060168164	Lemson	Jul 2006	A1
20060179410	Deeds	Aug 2006	A1
20060188864	Shah	Aug 2006	A1
20060190428	Jung et al.	Aug 2006	A1
20060190569	Neil et al.	Aug 2006	A1
20060190984	Heard et al.	Aug 2006	A1
20060192014	Hamilton et al.	Aug 2006	A1
20060195570	Zellner et al.	Aug 2006	A1
20060209842	Creamer et al.	Sep 2006	A1
20060212531	Kikkawa et al.	Sep 2006	A1
20060224629	Alexander et al.	Oct 2006	A1
20060230394	Forth et al.	Oct 2006	A1
20060236392	Thomas et al.	Oct 2006	A1
20060240804	Backholm et al.	Oct 2006	A1
20060240805	Backholm et al.	Oct 2006	A1
20060242137	Shah et al.	Oct 2006	A1
20060242210	Ring et al.	Oct 2006	A1
20060242320	Nettle et al.	Oct 2006	A1
20060242607	Hudson	Oct 2006	A1
20060252435	Henderson et al.	Nov 2006	A1
20060253456	Pacholec et al.	Nov 2006	A1
20060253605	Sundarrajan et al.	Nov 2006	A1
20060259923	Chiu	Nov 2006	A1
20060265595	Scottodiluzio	Nov 2006	A1
20060271884	Hurst	Nov 2006	A1
20060277265	Backholm et al.	Dec 2006	A1
20060277271	Morse et al.	Dec 2006	A1
20060294071	Weare et al.	Dec 2006	A1
20060294223	Glasgow et al.	Dec 2006	A1
20070005738	Alexion-Tiernan et al.	Jan 2007	A1
20070011367	Scott et al.	Jan 2007	A1
20070019610	Backholm et al.	Jan 2007	A1
20070022118	Layne	Jan 2007	A1
20070027775	Hwang	Feb 2007	A1
20070027832	Fiatal et al.	Feb 2007	A1
20070027886	Gent et al.	Feb 2007	A1
20070027917	Ariel et al.	Feb 2007	A1
20070027920	Alvarado et al.	Feb 2007	A1
20070027921	Alvarado et al.	Feb 2007	A1
20070027930	Alvarado et al.	Feb 2007	A1
20070033531	Marsh	Feb 2007	A1
20070038567	Allaire et al.	Feb 2007	A1
20070038931	Allaire et al.	Feb 2007	A1
20070044041	Beynon et al.	Feb 2007	A1
20070049258	Thibeault	Mar 2007	A1
20070060196	Sharma	Mar 2007	A1
20070061393	Moore	Mar 2007	A1
20070067147	Huang	Mar 2007	A1
20070067381	Grant et al.	Mar 2007	A1
20070067424	Raciborski et al.	Mar 2007	A1
20070070931	Lewis et al.	Mar 2007	A1
20070072617	Lewis et al.	Mar 2007	A1
20070078857	Punaganti et al.	Apr 2007	A1
20070078964	East et al.	Apr 2007	A1
20070088790	Shenfield et al.	Apr 2007	A1
20070088852	Levkovitz	Apr 2007	A1
20070105627	Campbell	May 2007	A1
20070116223	Burke et al.	May 2007	A1
20070118620	Cartmell et al.	May 2007	A1
20070118669	Rand et al.	May 2007	A1
20070123214	Mock	May 2007	A1
20070130108	Simpson et al.	Jun 2007	A1
20070130217	Linyard et al.	Jun 2007	A1
20070140193	Dosa et al.	Jun 2007	A1
20070147317	Smith et al.	Jun 2007	A1
20070147411	Bijwaard et al.	Jun 2007	A1
20070149168	Hariki	Jun 2007	A1
20070150881	Khawand et al.	Jun 2007	A1
20070156824	Thompson	Jul 2007	A1
20070156842	Vermeulen et al.	Jul 2007	A1
20070162514	Civetta et al.	Jul 2007	A1
20070167178	Al-Harbi	Jul 2007	A1
20070174433	Mendez et al.	Jul 2007	A1
20070175998	Lev	Aug 2007	A1
20070198698	Boyd et al.	Aug 2007	A1
20070204341	Rand et al.	Aug 2007	A1
20070220080	Humphrey	Sep 2007	A1
20070220099	Di Giorgio et al.	Sep 2007	A1
20070233855	Brown et al.	Oct 2007	A1
20070237318	McGary	Oct 2007	A1
20070245010	Arn et al.	Oct 2007	A1
20070249365	Jendbro	Oct 2007	A1
20070250591	Milic-Frayling et al.	Oct 2007	A1
20070264993	Hughes	Nov 2007	A1
20070267492	Maclaine Pont	Nov 2007	A1
20070276925	LaJoie et al.	Nov 2007	A1
20070276926	LaJoie et al.	Nov 2007	A1
20070288469	Shenfield	Dec 2007	A1
20070290787	Fiatal et al.	Dec 2007	A1
20070293207	Guedalia et al.	Dec 2007	A1
20070293238	Fiatal et al.	Dec 2007	A1
20070293958	Stehle et al.	Dec 2007	A1
20070294295	Finkelstein et al.	Dec 2007	A1
20070294763	Udezue et al.	Dec 2007	A1
20070296701	Pope et al.	Dec 2007	A1
20070299918	Roberts	Dec 2007	A1
20080001717	Fiatal	Jan 2008	A1
20080008095	Gilfix	Jan 2008	A1
20080009344	Graham et al.	Jan 2008	A1
20080016236	Beverly et al.	Jan 2008	A1
20080022003	Alve	Jan 2008	A1
20080032718	Suresh	Feb 2008	A1
20080034031	Weisbrot et al.	Feb 2008	A1
20080037787	Boynton et al.	Feb 2008	A1
20080059308	Gerken	Mar 2008	A1
20080059398	Tsutsui	Mar 2008	A1
20080061142	Howcroft et al.	Mar 2008	A1
20080068519	Adler et al.	Mar 2008	A1
20080077506	Rampell et al.	Mar 2008	A1
20080077571	Harris et al.	Mar 2008	A1
20080085719	Kuchibhotla et al.	Apr 2008	A1
20080085724	Cormier et al.	Apr 2008	A1
20080086379	Dion et al.	Apr 2008	A1
20080086773	Tuvell et al.	Apr 2008	A1
20080091773	Hameen-Anttila	Apr 2008	A1
20080103877	Gerken	May 2008	A1
20080104666	Dillaway	May 2008	A1
20080114881	Lee et al.	May 2008	A1
20080125225	Lazaridis et al.	May 2008	A1
20080130663	Fridman et al.	Jun 2008	A1
20080133326	Goncalves et al.	Jun 2008	A1
20080133641	Gent et al.	Jun 2008	A1
20080133708	Alvarado et al.	Jun 2008	A1
20080133729	Fridman et al.	Jun 2008	A1
20080134292	Ariel et al.	Jun 2008	A1
20080140665	Ariel et al.	Jun 2008	A1
20080151817	Fitchett et al.	Jun 2008	A1
20080154870	Evermann et al.	Jun 2008	A1
20080155613	Benya et al.	Jun 2008	A1
20080166999	Guedalia et al.	Jul 2008	A1
20080167019	Guedalia et al.	Jul 2008	A1
20080168145	Wilson	Jul 2008	A1
20080183800	Herzog et al.	Jul 2008	A1
20080192820	Brooks et al.	Aug 2008	A1
20080198995	McGary et al.	Aug 2008	A1
20080201362	Multer et al.	Aug 2008	A1
20080201751	Ahmed et al.	Aug 2008	A1
20080204921	Takahashi et al.	Aug 2008	A1
20080207182	Maharajh et al.	Aug 2008	A1
20080209491	Hasek	Aug 2008	A1
20080214148	Ramer et al.	Sep 2008	A1
20080216094	Anderson et al.	Sep 2008	A1
20080220797	Meiby et al.	Sep 2008	A1
20080232290	Elzur et al.	Sep 2008	A1
20080233983	Park et al.	Sep 2008	A1
20080270379	Ramakrishna	Oct 2008	A1
20080273498	Jalil et al.	Nov 2008	A1
20080281798	Chatterjee et al.	Nov 2008	A1
20080288659	Hasha et al.	Nov 2008	A1
20080298386	Fiatal	Dec 2008	A1
20080299956	Bailey et al.	Dec 2008	A1
20080301231	Mehta et al.	Dec 2008	A1
20080301300	Toub	Dec 2008	A1
20080307219	Karandikar	Dec 2008	A1
20080313282	Warila et al.	Dec 2008	A1
20090010204	Pratt, Jr. et al.	Jan 2009	A1
20090010259	Sirotkin	Jan 2009	A1
20090012841	Saft et al.	Jan 2009	A1
20090016526	Fiatal et al.	Jan 2009	A1
20090019485	Ellis et al.	Jan 2009	A1
20090019532	Jacobsen et al.	Jan 2009	A1
20090024794	Iyer et al.	Jan 2009	A1
20090028560	Best et al.	Jan 2009	A1
20090031006	Johnson	Jan 2009	A1
20090052372	Durazzo et al.	Feb 2009	A1
20090054034	Backholm et al.	Feb 2009	A1
20090055353	Meema	Feb 2009	A1
20090059950	Gao et al.	Mar 2009	A1
20090063647	Backholm et al.	Mar 2009	A1
20090075683	Backholm et al.	Mar 2009	A1
20090077263	Koganti et al.	Mar 2009	A1
20090077277	Vidal et al.	Mar 2009	A1
20090094317	Venkitaraman	Apr 2009	A1
20090110179	Elsey et al.	Apr 2009	A1
20090119266	Fitzpatrick et al.	May 2009	A1
20090125523	Fitzpatrick et al.	May 2009	A1
20090144359	Karlsen et al.	Jun 2009	A1
20090144632	Mendez	Jun 2009	A1
20090147008	Do et al.	Jun 2009	A1
20090149203	Backholm et al.	Jun 2009	A1
20090156178	Elsey et al.	Jun 2009	A1
20090157792	Fiatal	Jun 2009	A1
20090164433	R et al.	Jun 2009	A1
20090164560	Fiatal	Jun 2009	A1
20090172565	Jackson et al.	Jul 2009	A1
20090181641	Fiatal	Jul 2009	A1
20090182500	Dicke	Jul 2009	A1
20090187939	Lajoie	Jul 2009	A1
20090191903	Fiatal	Jul 2009	A1
20090193130	Fiatal	Jul 2009	A1
20090193338	Fiatal	Jul 2009	A1
20090215504	Lando	Aug 2009	A1
20090221326	Roussel et al.	Sep 2009	A1
20090228545	Mendez et al.	Sep 2009	A1
20090241180	Fiatal	Sep 2009	A1
20090248670	Fiatal	Oct 2009	A1
20090248696	Rowles et al.	Oct 2009	A1
20090248794	Helms et al.	Oct 2009	A1
20090248878	Tran et al.	Oct 2009	A1
20090249480	Osipkov et al.	Oct 2009	A1
20090252136	Mahany et al.	Oct 2009	A1
20090254589	Nair et al.	Oct 2009	A1
20090254969	Parker	Oct 2009	A1
20090254971	Herz et al.	Oct 2009	A1
20090264138	Kang et al.	Oct 2009	A1
20090282125	Jeide et al.	Nov 2009	A1
20090286531	Bhatt et al.	Nov 2009	A1
20090287750	Banavar et al.	Nov 2009	A1
20090299817	Fok et al.	Dec 2009	A1
20090307133	Holloway et al.	Dec 2009	A1
20090318171	Backholm et al.	Dec 2009	A1
20090323678	Wang	Dec 2009	A1
20090325565	Backholm	Dec 2009	A1
20090327390	Tran et al.	Dec 2009	A1
20100011031	Huang et al.	Jan 2010	A1
20100042691	Maguire	Feb 2010	A1
20100057924	Rauber et al.	Mar 2010	A1
20100064341	Aldera	Mar 2010	A1
20100077035	Li et al.	Mar 2010	A1
20100077083	Tran et al.	Mar 2010	A1
20100083255	Bane et al.	Apr 2010	A1
20100087167	Tsurutome et al.	Apr 2010	A1
20100087184	Stoev et al.	Apr 2010	A1
20100088722	Jiang	Apr 2010	A1
20100093273	Hohl	Apr 2010	A1
20100115050	Sultenfuss et al.	May 2010	A1
20100118190	Salfati et al.	May 2010	A1
20100131593	Kihara et al.	May 2010	A1
20100131617	Osborne et al.	May 2010	A1
20100146107	Fiatal	Jun 2010	A1
20100149975	Tripathi et al.	Jun 2010	A1
20100174735	Fiatal	Jul 2010	A1
20100174939	Vexler	Jul 2010	A1
20100192170	Raleigh	Jul 2010	A1
20100207870	Cho	Aug 2010	A1
20100211651	Guedalia et al.	Aug 2010	A1
20100227594	DeVries	Sep 2010	A1
20100228863	Kawauchi	Sep 2010	A1
20100229096	Maiocco et al.	Sep 2010	A1
20100238915	Cayla et al.	Sep 2010	A1
20100250695	Shenfield et al.	Sep 2010	A1
20100250706	Burckart et al.	Sep 2010	A1
20100250986	Black et al.	Sep 2010	A1
20100268757	Fisher	Oct 2010	A1
20100274922	Reavely	Oct 2010	A1
20100279662	Kuusinen et al.	Nov 2010	A1
20100293335	Muthiah et al.	Nov 2010	A1
20100313018	Jorgensen	Dec 2010	A1
20100319054	Mehta et al.	Dec 2010	A1
20110016195	Kaplan et al.	Jan 2011	A1
20110019627	Krishnaswamy et al.	Jan 2011	A1
20110023084	Kraemer	Jan 2011	A1
20110028129	Hutchison et al.	Feb 2011	A1
20110040718	Tendjoukian et al.	Feb 2011	A1
20110047594	Mahaffey et al.	Feb 2011	A1
20110065419	Book et al.	Mar 2011	A1
20110065424	Estevez et al.	Mar 2011	A1
20110066646	Danado et al.	Mar 2011	A1
20110099363	Boynton et al.	Apr 2011	A1
20110113109	LeVasseur et al.	May 2011	A1
20110119134	Zivkovic et al.	May 2011	A1
20110138402	Fleming	Jun 2011	A1
20110153728	Einarsson et al.	Jun 2011	A1
20110161452	Poornachandran	Jun 2011	A1
20110165889	Fiatal et al.	Jul 2011	A1
20110179138	Van Geest et al.	Jul 2011	A1
20110179377	Fleming	Jul 2011	A1
20110184827	Hubert	Jul 2011	A1
20110190014	Fiatal	Aug 2011	A1
20110191474	Fiatal	Aug 2011	A1
20110201304	Sutaria et al.	Aug 2011	A1
20110207436	van Gent et al.	Aug 2011	A1
20110208810	Li et al.	Aug 2011	A1
20110213800	Saros et al.	Sep 2011	A1
20110213898	Fiatal et al.	Sep 2011	A1
20110214182	Adams et al.	Sep 2011	A1
20110237222	Niejadlik	Sep 2011	A1
20110238772	Fiatal	Sep 2011	A1
20110246950	Luna et al.	Oct 2011	A1
20110252088	Fiatal	Oct 2011	A1
20110264622	Vargas et al.	Oct 2011	A1
20110264731	Knowles et al.	Oct 2011	A1
20110264905	Ovsiannikov	Oct 2011	A1
20110294463	Fiatal	Dec 2011	A1
20110294464	Fiatal	Dec 2011	A1
20110296050	Cherukuri	Dec 2011	A1
20110302154	Snyder	Dec 2011	A1
20110319071	Beppler et al.	Dec 2011	A1
20120005276	Guo et al.	Jan 2012	A1
20120022980	Angelone	Jan 2012	A1
20120023190	Backholm et al.	Jan 2012	A1
20120023226	Petersen et al.	Jan 2012	A1
20120023236	Backholm et al.	Jan 2012	A1
20120072910	Martin et al.	Mar 2012	A1
20120077482	Backholm	Mar 2012	A1
20120078996	Shah	Mar 2012	A1
20120096092	Davidge et al.	Apr 2012	A1
20120108225	Luna et al.	May 2012	A1
20120110109	Luna et al.	May 2012	A1
20120110110	Luna et al.	May 2012	A1
20120110111	Luna et al.	May 2012	A1
20120110112	Luna et al.	May 2012	A1
20120110118	Luna et al.	May 2012	A1
20120110171	Luna et al.	May 2012	A1
20120110173	Luna et al.	May 2012	A1
20120110174	Wootton et al.	May 2012	A1
20120130973	Tamm et al.	May 2012	A1
20120131095	Luna et al.	May 2012	A1
20120131184	Luna et al.	May 2012	A1
20120131685	Broch et al.	May 2012	A1
20120135726	Luna et al.	May 2012	A1
20120140750	Yan et al.	Jun 2012	A1
20120149352	Backholm et al.	Jun 2012	A1
20120151044	Luna et al.	Jun 2012	A1
20120157170	Backholm et al.	Jun 2012	A1
20120158837	Kaul	Jun 2012	A1
20120158908	Luna et al.	Jun 2012	A1
20120173616	Luna et al.	Jul 2012	A1
20120174220	Rodriguez	Jul 2012	A1
20120176968	Luna	Jul 2012	A1
20120178414	Fiatal	Jul 2012	A1
20120179801	Luna et al.	Jul 2012	A1
20120185597	Luna	Jul 2012	A1
20120185918	Backholm et al.	Jul 2012	A1
20120210121	Boynton et al.	Aug 2012	A1
20120221652	Saino et al.	Aug 2012	A1
20120324575	Choi et al.	Dec 2012	A1
20130064120	Bodog et al.	Mar 2013	A1
20130097652	Bhattacharjee et al.	Apr 2013	A1

Foreign Referenced Citations (68)

Number	Date	Country
0772327	May 1997	EP
1278390	Jan 2003	EP
1422899	May 2004	EP
1466261	Oct 2004	EP
1466435	Oct 2004	EP
1482702	Dec 2004	EP
1815634	Aug 2007	EP
1815652	Aug 2007	EP
1817883	Aug 2007	EP
2159730	Mar 2010	EP
117152	Jun 2006	FI
118288	Sep 2007	FI
119581	Dec 2008	FI
4154233	May 1992	JP
10-336372	Dec 1998	JP
2001-218185	Aug 2001	JP
2001-350718	Dec 2001	JP
2001-356973	Dec 2001	JP
2005-515664	May 2005	JP
2009-207177	Sep 2009	JP
4386732	Oct 2009	JP
2001-0018568	Mar 2001	KR
2006-0068186	Jun 2006	KR
2007-0071858	Jul 2007	KR
2007-0102091	Oct 2007	KR
2007-0117874	Dec 2007	KR
2009-0077515	Jul 2009	KR
2010-0064605	Jun 2010	KR
WO 9741661	Nov 1997	WO
WO 9824257	Jun 1998	WO
WO 9858322	Dec 1998	WO
WO 0130130	May 2001	WO
WO 03007570	Jan 2003	WO
WO 03058483	Jul 2003	WO
WO 03058879	Jul 2003	WO
WO 03065701	Aug 2003	WO
WO 03098890	Nov 2003	WO
WO 2004017591	Feb 2004	WO
WO 2004045171	May 2004	WO
WO 2005015925	Feb 2005	WO
WO 2005020108	Mar 2005	WO
WO 2006045005	Apr 2006	WO
WO 2006045102	Apr 2006	WO
WO 2006053952	May 2006	WO
WO 2006053954	May 2006	WO
WO 2006058967	Jun 2006	WO
WO 2007015725	Feb 2007	WO
WO 2007015726	Feb 2007	WO
WO 2007149526	Dec 2007	WO
WO 2007149540	Dec 2007	WO
WO 2008061042	May 2008	WO
2008067335	Jun 2008	WO
WO 2011126889	Oct 2011	WO
WO 2012018430	Feb 2012	WO
WO 2012018431	Feb 2012	WO
WO 2012018477	Feb 2012	WO
WO 2012018479	Feb 2012	WO
WO 2012018556	Feb 2012	WO
WO 2012024030	Feb 2012	WO
WO 2012060995	May 2012	WO
WO 2012060996	May 2012	WO
WO 2012060997	May 2012	WO
WO 2012061430	May 2012	WO
WO 2012061433	May 2012	WO
WO 2012061437	May 2012	WO
WO 2012071283	May 2012	WO
WO 2012071384	May 2012	WO
WO 2012094675	Jul 2012	WO

Non-Patent Literature Citations (186)

Entry
Allchin, James Edward, “An Architecture for Reliable Decentralized Systems,” Ph.D. Thesis, Georgia Institute of Technology, 185 pages, Sep. 1983.
Android Developers, “Date,” 10 pages, Oct. 27, 2011.
Augun, Audrey, “Integrating Lotus Notes With Enterprise Data,” Lotus Notes Advisory, pp. 22-25, Jul.-Aug. 1996.
Balaban, Bob, “This Is Not Your Father's Basic: LotusScript in Notes Release 4,” The View, vol. 1, Issue 5, 32 pages, Nov.-Dec. 1995.
Bedell, Doug, “Meeting Your New Best Friends Six Degrees Widens Your Contacts in Exchange for Sampling Web Sites,” The Dallas Morning News, 4 pages, Oct. 27, 1998.
Bergman, Lawrence D. et al., “Programming-By-Demonstration for Behavior-Based User Interface Customization,” IBM Research Report, RC23116, 5 pages, Feb. 20, 2004.
B'Far, Reza et al., “Designing Effective User Interfaces for Wireless Devices,” Publication Unknown, 14 pages, Published prior to Feb. 23, 2006.
Blaney, Jeff, “You Can Take It With You—An Introduction to Mobile Computing With Notes R4,” The View, vol. 2, Issue 1, 14 pages, Jan.-Feb. 1996.
Braden, R., “Requirements for Internet Hosts—Application and Support,” RFC 1123, 80 pages, Oct. 1989.
Brown, Kevin et al., “Mastering Lotus Notes®,” Sybex Inc., 996 pages, 1995.
“Chapter: About NotesPump,” Publication Unknown, 480 pages, Published prior to Jan. 8, 2003.
“Chapter 13-1—Anatomy of a Note ID,” Publication Unknown, 8 pages, Published prior to Jan. 8, 2003.
Cole, Barb et al., “Lotus Airs Notes-To-Database Integration Tool,” Network World, 2 pages, Oct. 2, 1995.
“CR 3483 to Release 8 TS 25.331, Rev. 2,” 3GPP TSG-RAN2 Meeting #64, Prague, Czech Republic, 11 pages, Nov. 10-14, 2008.
“CR 4100 to Release 8 TS 25.331, Rev. 1,” 3GPP TSG-RAN WG2 Meeting #69, San Francisco, U.S., 6 pages, Feb. 22-26, 2010.
Dahl, Andrew, “Lotus Notes® 4 Administrator's Survival Guide,” Sams Publishing, 64 pages, 1996.
Decker, Stefan et al., “The Social Semantic Desktop,” Digital Enterprise Research Institute, DERI Technical Report May 2, 2004, 7 pages, May 2004.
Elz, R. et al., “Clarifications to the DNS Specification,” RFC 2181, 12 pages, Jul. 1997.
European Patent Application No. EP 03705704.9, Supplementary European Search Report, 4 pages, Jun. 9, 2010.
European Patent Application No. EP 03707338.4, Supplementary European Search Report, 2 pages, Apr. 18, 2011.
European Patent Application No. EP 05815115.0, Supplementary European Search Report, 7 pages, Nov. 17, 2011.
Falkner, Mike, “How to Plan, Develop, and Implement Lotus Notes® In Your Organization,” John Wiley & Sons, Inc., 539 pages, 1996.
Freeland, Pat et al., “Lotus Notes 3-3.1 for Dummies™,” IDG Books Worldwide, 389 pages, 1994.
Frenkel, Garry, “Pumping for Info: Notes and Database Integration,” Network Computing, 10 pages, May 1, 1996.
Gameline, Advertisement, 1 page, 1982.
Gewirtz, David, “Lotus Notes 3 Revealed!,” Prima Publishing, 261 pages, 1994.
Grous, Paul J., “Creating and Managing a Web Site With Lotus Internotes Web Publisher,” The View, vol. 1, Issue 4, 20 pages, Sep.-Oct. 1995.
GSM Association, “Network Efficiency Task Force Fast Dormancy Best Practices,” V1.0, 21 pages, May 26, 2010.
Haas, Zygmunt J. et al., “Mobile-TCP: An Asymmetric Transport Protocol Design for Mobile Systems,” IEEE, pp. 1054-1058, 1997.
Haas, Zygmunt J. et al., “The Design and Performance of Mobile TCP for Wireless Networks,” Journal of High Speed Networks, vol. 10, pp. 187-207, 2001.
Hajdu, Kalman et al., “Lotus Notes Release 4 in a Multiplatform Environment,” IBM Corporation, 173 pages, Feb. 1996.
Hardy, Ed, “Microsoft Proposes Two New Thumb-Driven User Interfaces,” Brighthand Consulting, Inc., 2 pages, 2003.
IBM Corporation, “The Architecture of Lotus Notes,” White Paper No. 114654, 26 pages, May 31, 1995.
IBM Corporation, “The History of Notes and Domino,” Lotus Developer Domain, 11 pages, Sep. 29, 2003.
ImTOO, “ImTOO iPod Movie Converter,” 3 pages, Nov. 9, 2005.
IntelliLink Corporation, “IntelliLink® for Windows User's Guide,” Version 3.0, 167 pages, 1994.
International Application No. PCT/US2003/000618, International Search Report, 1 page, Apr. 4, 2003.
International Application No. PCT/US2003/000624, International Search Report, 2 pages, May 13, 2003.
International Application No. PCT/US2005/037702, International Preliminary Examination Report, 6 pages, Nov. 20, 2007.
International Application No. PCT/US2005/037702, International Search Report, 1 page, Nov. 5, 2007.
International Application No. PCT/US2005/037702, Written Opinion, 6 pages, Nov. 5, 2007.
International Application No. PCT/US2005/038135, International Search Report, 2 pages, Aug. 8, 2008.
International Application No. PCT/US2005/038135, Written Opinion, 8 pages, Aug. 8, 2008.
International Application No. PCT/US2005/038135, International Preliminary Report on Patentability, 9 pages, Oct. 31, 2011.
International Application No. PCT/FI2005/050424, International Search Report, 4 pages, Mar. 2, 2006.
International Application No. PCT/FI2005/050426, International Search Report, 3 pages, Mar. 1, 2006.
International Application No. PCT/FI2005/050441, International Search Report, 3 pages, Mar. 1, 2006.
International Application No. PCT/US2006/023426, International Search Report, 1 page, Feb. 21, 2007.
International Application No. PCT/US2006/023427, International Search Report, 1 page, Oct. 12, 2006.
International Application No. PCT/US2007/014462, International Search Report, 1 page, Jul. 2, 2008.
International Application No. PCT/US2007/014497, International Search Report, 1 page, Aug. 25, 2008.
International Application No. PCT/US2011/030534, International Search Report, 10 pages, Dec. 29, 2011.
International Application No. PCT/US2011/037932, International Search Report, 9 pages, Jan. 2, 2012.
International Application No. PCT/US2011/037943, International Search Report, 11 pages, Jan. 2, 2012.
International Application No. PCT/US2011/043322, International Search Report, 9 pages, Feb. 9, 2012.
International Application No. PCT/US2011/043328, International Search Report, 12 pages, Feb. 27, 2012.
International Application No. PCT/US2011/043409, International Search Report, 11 pages, Feb. 9, 2012.
International Application No. PCT/US2011/044974, International Search Report, 15 pages, Jun. 1, 2012.
International Application No. PCT/US2011/056474, International Search Report, 9 pages, May 4, 2012.
International Application No. PCT/US2011/056476, International Search Report, 12 pages, May 24, 2012.
International Application No. PCT/US2011/056478, International Search Report, 11 pages, May 31, 2012.
International Application No. PCT/US2011/058840, International Search Report, 10 pages, Apr. 26, 2012.
International Application No. PCT/US2011/058843, International Search Report, 11 pages, May 16, 2012.
International Application No. PCT/US2011/058848, International Search Report, 10 pages, Apr. 10, 2012.
International Application No. PCT/US2011/061512, International Search Report, 10 pages, May 10, 2012.
International Application No. PCT/US2012/021459, International Search Report, 10 pages, Jun. 1, 2012.
International Application No. PCT/US2012/022121, International Search Report, 11 pages, May 14, 2012.
Japanese Patent Application No. 2003-558726, Office Action, 2 pages, Jun. 10, 2008.
Karlson, Amy K. et al., “AppLens and LaunchTile: Two Designs for One-Handed Thumb Use on Small Devices,” Proceedings of CHI 2005, 10 pages, Apr. 2-7, 2005.
Kent, S. et al., “Security Architecture for the Internet Protocol,” RFC 2401, The Internet Society, 62 pages, Nov. 1998.
Kleinberg, Jon, “The Small-World Phenomenon: An Algorithmic Perspective,” Cornell Computer Science Technical Report 99-1776, 14 pages, Oct. 1999.
Koeppel, Dan, “GUIs Just Want to Have Fun,” Wired Magazine, Issue 8.10, 12 pages, Oct. 2000.
Kornblith, Polly Russell, “Lotus Notes Answers: Certified Tech Support,” Covers Release 3, McGraw-Hill, Inc., 326 pages, 1994.
Kreisle, Bill, “Teach Yourself . . . Lotus Notes 4,” MIS Press, 464 pages, 1996.
Lamb, John P. et al., “Lotus Notes Network Design,” McGraw-Hill, 278 pages, 1996.
Londergan, Stephen et al., “Lotus Notes® Release 4 for Dummies®,” IDG Books Worldwide, 229 pages, 1996.
Lotus Development Corporation, “Firewall Security Overview and How Firewalls Relate to Lotus Notes,” Lotus Notes Knowledge Base, 9 pages, May 22, 1996.
Lotus Development Corporation, “How to Set Up ‘Firewall’ Protection for a Notes Domain,” Lotus Notes Knowledge Base, 2 pages, Nov. 6, 1995.
Lotus Development Corporation, “Lotus Announces Lotus NotesPump 1.0,” Lotus Notes Knowledge Base, 6 pages, Oct. 31, 1995.
Lotus Development Corporation, “Lotus Inside Notes—The Architecture of Notes and the Domino Server,” 207 pages, 2000.
Lotus Development Corporation, “Lotus NotesPump 1.0 Q & A,” Lotus Notes Knowledge Base, 3 pages, Oct. 31, 1995.
Lotus Development Corporation, “Lotus NotesPump: Database Integration for Lotus Notes,” Lotus Notes Knowledge Base, 5 pages, Oct. 31, 1995.
Lotus Development Corporation, “Lotus Notes Administration,” Release 3.3, 20 pages, 1995.
Lotus Development Corporation, “Lotus Notes Administrator's Guide,” Release 4, 499 pages, 1995.
Lotus Development Corporation, “Lotus Notes Administrator's Guide—Server for NetWare, OS-2, and Unix,” Release 3.1, 509 pages, 1994.
Lotus Development Corporation, “Lotus Notes Administrator's Guide—Server for Windows,” Release 3.1, 345 pages, 1994.
Lotus Development Corporation, “Lotus Notes Application Developer's Guide,” Release 4, 475 pages, 1995.
Lotus Development Corporation, “Lotus Notes Customer Service Application Guide,” Release 3.1, 46 pages, 1994.
Lotus Development Corporation, “Lotus Notes Customer Support Guide,” 33 pages, Published prior to Jan. 8, 2003.
Lotus Development Corporation, “Lotus Notes Customer Support Guide—North American Guide,” Release 4.1, 51 pages, Published prior to Jan. 8, 2003.
Lotus Development Corporation, “Lotus Notes Database Manager's Guide,” Release 4, 115 pages, 1995.
Lotus Development Corporation, “Lotus Notes Deployment Guide,” Release 4, 104 pages, 1995.
Lotus Development Corporation, “Lotus Notes for Windows, OS-2, and Macintosh,” Release 3.3, 89 pages, 1995.
Lotus Development Corporation, “Lotus Notes Getting Started With Application Development,” Release 3.1, 151 pages, 1994.
Lotus Development Corporation, “Lotus Notes Install Guide for Servers,” Release 4, 68 pages, 1996.
Lotus Development Corporation, “Lotus Notes Install Guide for Workstations,” Release 4, 28 pages, 1995.
Lotus Development Corporation, “Lotus Notes Install Guide for Workstations,” Release 4.1, 67 pages, 1996.
Lotus Development Corporation, “Lotus Notes Install Guide for Workstations,” Release 4.5, 81 pages, 1996.
Lotus Development Corporation, “Lotus Notes Internet Cookbook for Notes Release 3,” 21 pages, Jan. 16, 1996.
Lotus Development Corporation, “Lotus Notes Internet Cookbook for Notes Release 4,” 35 pages, Feb. 14, 1996.
Lotus Development Corporation, “Lotus Notes Internotes Web Navigator Administrator's Guide,” Release 4, 60 pages, 1995.
Lotus Development Corporation, “Lotus Notes Internotes Web Navigator User's Guide,” Release 4, 56 pages, 1995.
Lotus Development Corporation, “Lotus Notes Internotes Web Publisher Guide,” Release 4, 122 pages, 1996.
Lotus Development Corporation, “Lotus Notes LotusScript Classes for Notes,” Release 4, 6 pages, Published prior to Jan. 8, 2003.
Lotus Development Corporation, “Lotus Notes Migration Guide,” Release 4, 110 pages, 1996.
Lotus Development Corporation, “Lotus Notes Network Configuration Guide,” Release 4.5, 121 pages, 1996.
Lotus Development Corporation, “Lotus Notes Network Driver Documentation,” Release 3.1, 100 pages, 1994.
Lotus Development Corporation, “Lotus Notes Programmer's Guide—Part 1,” Release 4, 614 pages, 1995.
Lotus Development Corporation, “Lotus Notes Programmer's Guide—Part 2,” Release 4, 462 pages, 1995.
Lotus Development Corporation, “Lotus Notes Quick Reference for Application Developers,” Release 3, 6 pages, Published prior to Jan. 8, 2003.
Lotus Development Corporation, “Lotus Notes Quick Reference for Macintosh,” Release 3, 6 pages, Published prior to Jan. 8, 2003.
Lotus Development Corporation, “Lotus Notes Quick Reference for SmartIcons,” Release 3.1, 4 pages, Published prior to Jan. 8, 2003.
Lotus Development Corporation, “Lotus Notes Quick Reference for Windows and Presentation Manager,” Release 3, 6 pages, Published prior to Jan. 8, 2003.
Lotus Development Corporation, “Lotus Notes Release Notes,” Release 4, 139 pages, 1995.
Lotus Development Corporation, “Lotus Notes Release Notes,” Release 4.1, 197 pages, 1996.
Lotus Development Corporation, “Lotus Notes Server for Windows,” Release 3.3, 7 pages, 1994.
Lotus Development Corporation, “Lotus Notes Server Up and Running!,” Release 4, 13 pages, 1996.
Lotus Development Corporation, “Lotus Notes Site and Systems Planning Guide,” Release 3.1, 169 pages, 1994.
Lotus Development Corporation, “Lotus Notes Start Here—Workstation Install for Windows, OS-2 and Macintosh,” Release 3.3, 47 pages, 1995.
Lotus Development Corporation, “Lotus Notes Step by Step—A Beginner's Guide to Lotus Notes,” Release 4, 179 pages, 1995.
Lotus Development Corporation, “Lotus Notes Step by Step—A Beginner's Guide to Lotus Notes,” Release 4.1, 167 pages, 1996.
Lotus Development Corporation, “Lotus Software Agreement,” 8 pages, Published prior to Jan. 8, 2003.
Lotus Development Corporation, “What Is the Notes Replicator?,” Lotus Notes Knowledge Base, 8 pages, Jul. 5, 1995.
“Lotus Notes Advisor,” Advisor Publications Inc., 55 pages, Jun. 1995.
“Lotus Notes Advisor,” Advisor Publications Inc., 55 pages, Aug. 1995.
“Lotus Notes Advisor,” Advisor Publications Inc., 55 pages, Oct. 1995.
“Lotus Notes Advisor,” Advisor Publications Inc., 55 pages, Dec. 1995.
“Lotus Notes Advisor,” Advisor Publications Inc., 63 pages, Jan.-Feb. 1996.
“Lotus Notes Advisor,” Advisor Publications Inc., 55 pages, Apr. 1996.
“Lotus Notes Advisor,” Advisor Publications Inc., 55 pages, Jun. 1996.
“Lotus Notes Advisor,” Advisor Publications Inc., 55 pages, Aug. 1996.
“Lotus Notes Advisor,” Advisor Publications Inc., 55 pages, Oct. 1996.
“Lotus Notes Advisor,” Advisor Publications Inc., 63 pages, Dec. 1996.
“Lotus Notes—Notes Administration Help,” Screen Shots, 17 pages, Published prior to Jan. 8, 2003.
MacGregor, Rob et al., “The Domino Defense: Security in Lotus Notes and the Internet,” IBM Corporation, 183 pages, Dec. 1997.
Maltz, David A. et al., “MSOCKS: An Architecture for Transport Layer Mobility,” IEEE, pp. 1037-1045, 1998.
Marmel, Elaine, “Easy Lotus® Notes Release 4.0,” Que Corporation, 237 pages, 1996.
Mason, Luke, “Windows XP: New GUI Design Shows Skin Is In,” TechRepublic, 4 pages, Apr. 4, 2001.
McMullen, Melanie, “Network Remote Access and Mobile Computing,” Miller Freeman Inc., 226 pages, 1994.
Microsoft, Definition of “Access,” Microsoft Computer Dictionary, Fifth Edition, 2 pages, May 1, 2002.
Microsoft, Definition of “Synchronization,” Microsoft Computer Dictionary, Fifth Edition, 2 pages, May 1, 2002.
Milgram, Stanley, “The Small-World Problem,” Psychology Today, vol. 2, pp. 60-67, 1967.
Miller, Victor S., “Use of Elliptic Curves in Cryptography,” Advances in Cryptology—CRYPTO '85 Proceedings, vol. 218, pp. 417-426, 1985.
Mockapetris, P., “Domain Names—Concepts and Facilities,” RFC 1034, 43 pages, Nov. 1987.
Mockapetris, P., “Domain Names—Implementation and Specification,” RFC 1035, 43 pages, Nov. 1987.
Myers, Brad A. et al., “Extending the Windows Desktop Interface With Connected Handheld Computers,” WSS'00 Proceedings of the 4th Conference on USENIX Windows Systems Symposium, vol. 4, 10 pages, 2000.
Myers, Brad A. et al., “User Interfaces That Span Hand-Held and Fixed Devices,” CHI'2001 Workshop on Distributed and Disappearing User Interfaces in Ubiquitous Computer, 4 pages, 2001.
National Institute of Standards and Technology, “Advanced Encryption Standard (AES),” Federal Information Processing Standards Publication 197, 52 pages, Nov. 26, 2001.
National Institute of Standards and Technology, “Secure Hash Standard,” Federal Information Processing Standards Publication 180-2, 83 pages, Aug. 1, 2002.
Netscape Communications Corporation, “Netscape Mail Server Administrator's Guide,” Version 2.0, 172 pages, 1996.
Netscape Communications Corporation, “Netscape Mail Server Installation Guide,” Version 2.0 for Unix, 62 pages, 1996.
Netscape Communications Corporation, “Netscape Mail Server User's Guide,” Version 2.0, 35 pages, 1996.
Netscape Communications Corporation, “Netscape News Server Administrator's Guide for Windows NT,” Version 2.0, 119 pages, 1996.
Niederée, Claudia et al., “A Multi-Dimensional, Unified User Model for Cross-System Personalization,” Proceedings of the AVI 2004 Workshop on Environments for Personalized Information Access, 11 pages, 2004.
Nokia, “Developer Platforms,” 3 pages, 2005.
“NotesPump 1.0 Release Notes,” Publication Unknown, 8 pages, Published prior to Jan. 8, 2003.
Opyt, Barbara et al., “Use the Internet As Your Lotus Notes WAN,” Lotus Notes Advisor, pp. 17-20, Nov.-Dec. 1996.
Ortiz, C. Enrique, “An Introduction to the Symbian OS™ Platform for Palm OS® Developers,” Metrowerks Corp., 21 pages, 2002.
“Overview—What Is Lotus NotesPump?,” Publication Unknown, 88 pages, Published prior to Jan. 8, 2003.
Perez, Sarah, “Onavo's Data-Compressing Mobile App Raises $10 Million Series B From Horizons, Motorola Ventures,” 2 pages, Jan. 24, 2012.
Phillips, Joshua et al., “Modeling the Intelligence Analysis Process for Intelligent User Agent Development,” Research and Practice in Human Resource Management, vol. 9, No. 1, pp. 59-73, 2001.
Pyle, Hugh, “The Architecture of Lotus Notes,” Lotus Notes Advisor, Premiere Issue, pp. 18-27, 1995.
Pyle, Lisa, “A Jump Start to the Top Ten R3-To-R4 Migration Considerations,” The View, vol. 1, Issue 5, 22 pages, Nov.-Dec. 1995.
Qualcomm Incorporated, “Managing Background Data Traffic in Mobile Devices,” 16 pages, Jan. 2012.
Qualcomm, “System Parameter Recommendations to Optimize PS Data User Experience and UE Battery Life,” 80-W1112-1, Revision B, 9 pages, Mar. 2007.
Ringel, Meredith et al., “iStuff: A Scalable Architecture for Lightweight, Wireless Devices for Ubicomp User Interfaces,” Proceedings of UbiComp 2002, 2 pages, 2002.
Seven Networks, Inc., “Seven Optimizing the Mobile Ecosystem,” www.seven.com/products.traffic—optimization.php, 1 page, May 29, 2012.
Shafran, Andrew Bryce, “Easy Lotus Notes® for Windows™,” Que Corporation, 199 pages, 1994.
Signorini, Eugene, “SEVEN's Service-Based Wireless Solutions Enable Enterprises to Untether E-Mail,” Wireless/Mobile Enterprise & Commerce, 16 pages, Oct. 2004.
Swedeen, Bret et al., “Under the Microscope—Domino Replication,” LDD Today, 8 pages, Oct. 1, 1998.
Tamura, Randall A., “Lotus® Notes™ 4 Unleashed,” Sams Publishing, 928 pages, 1996.
U.S. Appl. No. 60/663,463, File History, 113 pages, Mar. 18, 2005.
Vivacqua, Adriana et al., “Profiling and Matchmaking Strategies in Support of Opportunistic Collaboration,” CoopIS/DOA/ODBASE 2003, LNCS 2888, pp. 162-177, 2003.
Wainwright, Andrew, “Secrets to Running Lotus Notes: The Decisions No One Tells You How to Make,” IBM Corporation, 193 pages, Oct. 1996.
Wikipedia, Definition for “General Packet Radio Service,” 7 pages, downloaded on May 31, 2012.
Wilcox, Adam A., “PC Learning Labs Teaches Lotus Notes 3.0,” Ziff-Davis Press, 381 pages, 1993.
Wong, Harry, “Casahl's Replic-Action: Delivering True Notes—DBMS Integration,” The View, vol. 2, Issue 1, pp. 33-50, Jan.-Feb. 1996.
International Application No. PCT/US2011/061795, International Search Report, 10 pages, Jul. 31, 2012.
Newton, Harry, “Newton's Telecom Dictionary,” 20th Edition, pp. 67, 127, 542, Mar. 2004.
Jerry Cheng et al. “SmartSiren: Virus Detection and Alert for Smartphones”, Mobisys '07 Proceedings of the 5th International Conference on Mobile Systems, Applications and Services; Jun. 11-14, 2007, San Juan, PR, USA, ACM, New York, USA, dated Jun. 1, 2007.
Extended European search report dated Jan. 5, 2015 for EP Application No. 12817532.0.
Extended European search report dated Jan. 8, 2015 for EP Application No. 12818166.6.
Final Office Action mailed Feb. 20, 2015 for U.S. Appl. No. 13/178,675.
Office Action dated Oct. 23, 2014 for U.S. Appl. No. 13/546,995, filed Jul. 11, 2012.
USPTO, Non-final Office Action for U.S. Appl. No. 13/427,748 and Notice of References Cited.
Non-Final rejection mailed Aug. 19, 2015 for U.S. Appl. No. 13/560,092.

Related Publications (1)

	Number	Date	Country
	20130031600 A1	Jan 2013	US

Provisional Applications (1)

	Number	Date	Country
	61512278	Jul 2011	US

Continuations (1)

	Number	Date	Country
Parent	13546995	Jul 2012	US
Child	13547001		US

Automatic generation and distribution of policy information regarding malicious mobile traffic in a wireless network

Information

Patent Number

Date Filed

Date Issued

Inventors

Original Assignees

Examiners

Agents

CPC

Field of Search

US

CPC

International Classifications

Abstract