Service selection set publishing to device agent with on-device service selection

Information

  • Patent Grant
  • 10171990
  • Patent Number
    10,171,990
  • Date Filed
    Thursday, January 26, 2017
    7 years ago
  • Date Issued
    Tuesday, January 1, 2019
    5 years ago
Abstract
Disclosed herein are various embodiments for publishing a service offer set to a device agent on an end-user device and for on-device selection of a service. In some embodiments, a network system publishes a service offer set to an end-user device over a wireless access network, receives an offer set user selection from the end-user device, and provisions one or more network functions based on the offer set user selection.
Description
BACKGROUND

With the advent of mass market digital communications and content distribution, many access networks such as wireless networks, cable networks and DSL (Digital Subscriber Line) networks are pressed for user capacity, with, for example, EVDO (Evolution-Data Optimized), HSPA (High Speed Packet Access), LTE (Long Term Evolution), WiMax (Worldwide Interoperability for Microwave Access), and Wi-Fi (Wireless Fidelity) wireless networks increasingly becoming user capacity constrained. Although wireless network capacity will increase with new higher capacity wireless radio access technologies, such as MIMO (Multiple-Input Multiple-Output), and with more frequency spectrum being deployed in the future, these capacity gains are likely to be less than what is required to meet growing digital networking demand.


Similarly, although wire line access networks, such as cable and DSL, can have higher average capacity per user, wire line user service consumption habits are trending toward very high bandwidth applications that can quickly consume the available capacity and degrade overall network service experience. Because some components of service provider costs go up with increasing bandwidth, this trend will also negatively impact service provider profits.





BRIEF DESCRIPTION OF THE DRAWINGS

Various embodiments are disclosed in the following detailed description and the accompanying drawings.



FIG. 1 illustrates a wireless network architecture for providing device assisted CDR creation, aggregation, mediation and billing in accordance with some embodiments.



FIG. 2 illustrates another wireless network architecture for providing device assisted CDR creation, aggregation, mediation and billing in accordance with some embodiments.



FIG. 3 illustrates another wireless network architecture for providing device assisted CDR creation, aggregation, mediation and billing in accordance with some embodiments.



FIG. 4 illustrates provisioning of a wireless network for providing device assisted CDR creation, aggregation, mediation and billing in accordance with some embodiments.



FIG. 5 illustrates a network architecture for providing device assisted CDRs in accordance with some embodiments.



FIG. 6 illustrates another network architecture for providing device assisted CDRs in accordance with some embodiments.



FIG. 7 illustrates another network architecture for providing device assisted CDRs in accordance with some embodiments.



FIG. 8 illustrates another network architecture for providing device assisted CDRs in accordance with some embodiments.



FIG. 9 is a functional diagram illustrating a device based service processor and a service controller in accordance with some embodiments.



FIG. 10 provides a table summarizing various service processer functional elements in accordance with some embodiments.



FIG. 11 provides a table summarizing various service controller functional elements in accordance with some embodiments.



FIG. 12 illustrates a device stack providing various service usage measurement from various points in the networking stack for a service monitor agent, a billing agent, and an access control integrity agent to assist in verifying the service usage measures and billing reports in accordance with some embodiments.



FIG. 13 illustrates an embodiment similar to FIG. 12 in which some of the service processor is implemented on the modem and some of the service processor is implemented on the device application processor in accordance with some embodiments.



FIGS. 14A through 14E illustrate various embodiments of intermediate networking devices that include a service processor for the purpose of verifiable service usage measurement, reporting, and billing reports in accordance with some embodiments.



FIG. 15 illustrates a wireless network architecture for providing device assisted CDR creation, aggregation, mediation and billing including a proxy server in accordance with some embodiments.



FIG. 16 is a functional diagram illustrating the service control device link of the service processor and the service control service link of the service controller in accordance with some embodiments.



FIG. 17 is a functional diagram illustrating framing structure of a service processor communication frame and a service controller communication frame in accordance with some embodiments.



FIGS. 18A through 18J provide tables summarizing various service processor heartbeat functions and parameters in accordance with some embodiments.



FIGS. 19A through 19S provide tables summarizing various device based service policy implementation verification techniques in accordance with some embodiments.



FIGS. 20A through 20E provide tables summarizing various techniques for protecting the device based service policy from compromise in accordance with some embodiments.



FIG. 21 illustrates an example embodiment of a process to start or stop a data session with SGSN notification.



FIG. 22 illustrates an example embodiment of a process to start or stop a data session with GGSN notification.



FIG. 23 illustrates an example embodiment with network system elements that can be included in a service controller system to facilitate a device-assisted services (DAS) implementation and the flow of information between those elements.



FIG. 24 illustrates an example embodiment of a service controller reconciliation processing procedure that may be used to detect fraud using information from the end-user device and information from a second source.



FIG. 25 illustrates an example embodiment that can be advantageous in cases where it is desirable to identify service usage classifications in the network for the purpose of providing a device user or service sponsor with the opportunity to pay for access network service usage that is classified by application or website.





DETAILED DESCRIPTION

The invention can be implemented in numerous ways, including as a process; an apparatus; a system; a composition of matter; a computer program product embodied on a computer readable storage medium; and/or a processor, such as a processor configured to execute instructions stored on and/or provided by a memory coupled to the processor. In this specification, these implementations, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the invention. Unless stated otherwise, a component such as a processor or a memory described as being configured to perform a task may be implemented as a general component that is temporarily configured to perform the task at a given time or a specific component that is manufactured to perform the task. As used herein, the term ‘processor’ refers to one or more devices, circuits, and/or processing cores configured to process data, such as computer program instructions.


A detailed description of one or more embodiments of the invention is provided below along with accompanying figures that illustrate the principles of the invention. The invention is described in connection with such embodiments, but the invention is not limited to any embodiment. The scope of the invention is limited only by the claims and the invention encompasses numerous alternatives, modifications and equivalents. Numerous specific details are set forth in the following description in order to provide a thorough understanding of the invention. These details are provided for the purpose of example and the invention may be practiced according to the claims without some or all of these specific details. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the invention is not unnecessarily obscured.


There are many new types of digital devices where it is becoming desirable, for example, to connect these devices to wireless networks including wireless wide area networks (WWAN, such as 3G and 4G) and/or wireless local area (WLAN) networks. These devices include, for example, consumer electronics devices, business user devices, and machine to machine devices that benefit from flexible wide area data connections and the Internet. Example devices include netbooks, notebooks, mobile Internet devices, personal navigation (e.g., GPS enabled) devices, music and multimedia players, eReaders, industrial telemetry, automotive emergency response and diagnostics, 2-way home and industrial power metering and control, vending machines, parking meters, and many other devices. For example, it is highly advantageous to offer service usage and service billing plans for such devices that are more optimal for each type of device and each type of desired user experience. To accomplish this, more sophisticated service usage measuring and service usage billing systems are needed as compared to the conventional network based techniques in existence today. By providing more flexibility in service measurement and billing, more advantageous and cost effective service plans can be created for, for example, the new WWAN connected devices cited above for all three markets (e.g., consumer, business and machine to machine) that still maintain the necessary profit margins for the WWAN carriers to be successful with these various service businesses.


Accordingly, various embodiments disclosed herein provide for a new and flexible augmentation or replacement for existing carrier network service usage measurement, service usage accounting, and service usage billing systems and techniques.


A charging data record (CDR) is a term that as used herein defines a formatted measure of device service usage information, typically generated by one or more network functions that supervise, monitor, and/or control network access for the device. CDRs typically form the basis for recording device network service usage, and often form the basis for billing for such usage. Various embodiments are provided herein for device assisted CDR creation, mediation, and billing. There are many limitations to the capabilities of service usage recording, aggregation and/or billing when CDRs are generated exclusively by network based functions or equipment. Accordingly, by either augmenting network based service usage measures with device based service usage measures, or by replacing network based service usage measures with device based service usage measures, it is possible to create a CDR generation, aggregation, mediation and/or billing solution that has superior or more desirable capabilities/features. While in theory, many of the service usage measures that can be evaluated on a device can also be evaluated in the network data path using various network equipment technologies including but not limited to deep packet inspection (DPI), there are many examples where measuring service usage at the device is either more desirable or more practical, or in some cases it is the only way to obtain the desired measure. Such examples include but are not limited to the following:

    • Application layer service usage measures (e.g., traffic usage categorized by application or by combinations of application, destination, and/or content type);
    • Usage measures that do not involve user traffic but instead involve network overhead traffic (e.g., basic connection maintenance traffic, signaling traffic, network logon/AAA/authentication/monitoring traffic, service software update traffic);
    • Usage that is associated with services that are charged to another entity other than the end user (e.g., basic network connection service offer traffic, traffic associated with providing network access to or downloading service marketing information, traffic associated with advertiser sponsored services, traffic associated with content provider sponsored services, 911 service traffic);
    • Usage measures involving encrypted traffic (e.g., traffic that is run over encrypted networking protocols or between secure end points);
    • Implementing service usage measure collection and/or service usage billing across multiple networks that may have different and in some cases incompatible, inaccessible (to the CDR system of record) or incomplete service usage measurement capabilities;
    • Service usage measurement and/or service usage billing capabilities that are not supported by the present network gateways, routers, MWC/HLRs, AAA, CDR aggregation, CDR mediation, billing and/or provisioning systems;
    • New service usage measures and/or new service usage billing capabilities that are desirable to implement in a manner that does not require major changes or upgrades to the existing network gateways, routers, MWC/HLRs, AAA, CDR aggregation, CDR mediation, billing and/or provisioning systems;
    • New service usage measures and/or new service usage billing capabilities that are desirable to implement in a manner that allows for rapid definition and implementation of new service measures and/or billing plans;
    • New service usage measures and/or new service usage billing capabilities that are desirable to implement in a manner that may be implemented in a manner that enables multiple device group definitions in which each device group gets a customized programmable definition for service usage collection, accounting and/or billing;
    • Multi device billing;
    • Multi user billing;
    • Intermediate device billing with single user and multi user with and without multi device;
    • Content downloads from a specific source to a specific application with the content being of a specific type or even identified down to a particular content ID; and/or
    • Various other single event transactions used for billing purposes.


      For these and other reasons, it is desirable to provide a system/process that utilizes device assisted service usage measures that provides either an enhancement of existing network based service usage CDR system capabilities and techniques and/or a replacement for network based CDR system capabilities and techniques.


In some embodiments, techniques, such as a system and/or process, that utilize device assisted service usage measures include one or more of the following: (1) receiving a service usage measure from a device in communication with a wireless network, (2) verifying or protecting the validity of the service usage measure, (3) generating a CDR based on the service usage measure (e.g., device assisted CDR), (4) aggregating CDRs, and (5) mediating the CDR with network CDRs. In some embodiments, the techniques also include providing a design and provisioning of devices/network equipment to recognize the CDRs. In some embodiments, the techniques also include provisioning to recognize that the device belongs to a Device Assisted Services (DAS) device group and that corresponding CDRs should be accepted and mediated. In some embodiments, the device assisted CDRs are also generated using formats, network communications protocols, network device authentication and/or provisioning to allow device assisted CDRs into the network CDR system, encryption, and/or signatures as required by the network (e.g., to comply with network generated CDR requirements or based on any other network and/or service provider requirements and/or standards).


In some embodiments, mediation rules include multi device, multi user, single user devices, and/or intermediate networking devices that can be single user or multi user, as described herein.


In some embodiments, a device assisted CDR generator collects device based service usage measures that are used as the basis for, or as an enhancement (e.g., as a supplement or in addition) to, one or more (e.g., network generated) CDRs that provide one or more networking functions with properly formatted service usage reports that the network function(s) accepts as being transmitted from an authorized source, read, and utilized for helping to determine the service usage of a device or group of devices. In some embodiments, the network functions that the device assisted CDR generator shares CDRs with typically include one or more of the following: service usage/CDR aggregation and/or mediation servers, gateways, routers, communication nodes, Mobile Wireless Centers (MWCs, including HLRs), databases, AAA systems, billing interfaces, and billing systems. For example, the process of CDR creation in the CDR generator typically includes either using one or more device based measures of service usage, or one or more device based measures of service usage in combination with one or more network based measures of service usage, possibly processing one or more of such service usage measures according to a set of CDR creation, CDR aggregation, and/or CDR mediation rules to arrive at a final device usage measure that is, for example, then formatted with the proper syntax, framed, possibly encrypted and/or signed, and encapsulated in a communication protocol or packet suitable for sharing with network functions. In some embodiments, the CDR generator resides in the device. In some embodiments, the CDR generator resides in a network server function that receives the device assisted service usage measures, along with possibly network based usage measures, and then creates a CDR (e.g., in the service controller 122).


In some embodiments, the device assisted CDR generator can reside in the service processor (e.g., service processor 115), for example, in the service usage history or billing server functions. In some embodiments, the device assisted CDR generator resides in the device itself, for example, within the service processor functions, such as the billing agent or the service monitor agent.


There are several factors that are considered in the various embodiments in order to create a useful, reliable, and secure device assisted CDR system, including, for example, but not limited to:

    • Identification of each device based service usage measure with one or more usage transaction codes;
    • Verification of the device based usage measure(s);
    • Secure communication of the device based usage measures to the network;
    • Efficient (e.g., low bandwidth) communication of the device based service usage measure;
    • Coordination/comparison/aggregation of the device based service usage measure with network based service usage measure(s);
    • Formatting the device based service usage measure into a CDR that can be properly communicated to the network functions and/or equipment that process service usage information;
    • Causing the network based functions and/or equipment used for CDR collection, aggregation, mediation and/or billing to recognize, authorize, and accept communications and CDRs from the device assisted CDR generator, reading and properly implementing the correct network session context for the CDR so that the CDR is properly associated with the correct device/user/session;
    • Implementing the CDR aggregation rules that determine how to collect and aggregate the device assisted CDRs as they are reported through the network CDR system hierarchy;
    • Implementing the mediation rules that determine how the various device based service usage transaction code measures are combined and mediated with the other device based service usage transaction code measures to result in consistent service usage information for each of the transaction code categories maintained in the network;
    • Implementing the mediation rules that determine how the device assisted CDRs are combined and mediated with network based CDRs to result in consistent service usage information for each of the transaction code categories maintained in the network;
    • Implementing mediation rules to reconcile the variances between network based CDR usage measures and device assisted CDR usage measures;
    • Classification of one or more device groups, with each group having the capability to uniquely define the service usage collection, accounting, and/or billing rules;
    • Collecting CDRs generated on networks other than the home network so that service usage may be measured, accounted for, and/or billed for across multiple networks;
    • Multi device billing;
    • Multi user billing; and/or
    • Intermediate device billing with single user and multi user with and without multi device.


In some embodiments, verification of the relative accuracy of the device assisted service usage measure is provided. Given that, for example, the service usage measure is often being generated on an end user device or a device that is readily physically accessed by the general public or other non-secure personnel from a network management viewpoint, in some embodiments, the device agents used in one or more of the service processor 115 agents are protected from hacking, spoofing, and/or other misuse. Various techniques are provided herein for protecting the integrity of the agents used for generating the device assisted service usage measures.


In some embodiments, the service usage measures are verified by network based cross checks using various techniques. For example, network based cross checks can provide valuable verification techniques, because, for example, it is generally not possible or at least very difficult to defeat well designed network based cross checks using various techniques, such as those described herein, even if, for example, the measures used to protect the device agents are defeated or if no device protection measures are employed. In some embodiments, network based cross checks used to verify the device assisted service usage measures include comparing network based service usage measures (e.g. CDRs generated by service usage measurement apparatus in the network equipment, such as the BTS/BSCs 125, RAN Gateways 410, Transport Gateways 420, Mobile Wireless Center/HLRs 132, AAA 121, Service Usage History/CDR Aggregation, Mediation, Feed 118, or other network equipment), sending secure query/response command sequences to the service processor 115 agent(s) involved in device assisted CDR service usage measurement or CDR creation, sending test service usage event sequences to the device and verifying that the device properly reported the service usage, and using various other techniques, such as those described herein with respect to various embodiments.


In some embodiments, one or more of the following actions are taken if the device based service usage measure is found to be in error or inaccurate: bill the user for usage overage or an out of policy device, suspend the device, quarantine the device, SPAN the device, and/or report the device to a network administration function or person.


In some embodiments, the CDR syntax used to format the device assisted service usage information into a CDR and/or network communication protocols for transmitting CDRs are determined by industry standards (e.g., various versions of 3GPP TS 32.215 format and 3GPP2 TSG-X X.S0011 or TIA-835 format). In some embodiments, for a given network implementation the network designers will specify modifications of the standard syntax, formats and/or network communication/transmission protocols. In some embodiments, for a given network implementation the network designers will specify syntax, formats, and/or network communication/transmission protocols that are entirely different than the standards.


In some embodiments, within the syntax and formatting for the CDR the device assisted service usage is typically categorized by a transaction code. For example, the transaction code can be similar or identical to the codes in use by network equipment used to generate CDRs, or given that the device is capable of generating a much richer set of service usage measures, the transaction codes can be a superset of the codes used by network equipment used to generate CDRs (e.g., examples of the usage activities that can be labeled as transaction codes that are more readily supported by device assisted CDR systems as compared to purely network based CDR systems are provided herein).


In some embodiments, the device sends an identifier for a usage activity tag, an intermediate server determines how to aggregate into CDR transaction codes and which CDR transaction code to use.


In some embodiments, the device service processor 115 compartmentalizes usage by pre-assigned device activity transaction codes (e.g., these can be sub-transactions within the main account, transactions within a given bill-by-account transaction or sub-transactions within a bill-by-account transaction). The device implements bill-by-account rules to send different usage reports for each bill-by-account function. In some embodiments, the service controller 122 programs the device to instruct it on how to compartmentalize these bill-by-account service usage activities so that they can be mapped to a transaction code.


In some embodiments, the device reports less compartmentalized service usage information and the service controller 122 does the mapping of service usage activities to CDR transaction codes, including in some cases bill-by-account codes.


In some embodiments, the CDR sent to 118 or other network equipment, for example, can include various types of transaction codes including but not limited to a raw device usage CDR, a bill-by-account (e.g., a sub-activity transaction code) CDR, a billing offset CDR, and/or a billing credit CDR. For example, the decision logic (also referred to as business rules or CDR aggregation and mediation rules) that determines how these various types of CDR transaction codes are to be aggregated and mediated by the core network and the billing system can be located in the network equipment (e.g., a network element, such as service usage 118), in the service controller 122, and/or in the billing system 123.


In some embodiments, the device assisted CDR generator uses the device assisted service usage measures to generate a CDR that includes service usage information, service usage transaction code(s), and, in some embodiments, network information context. In some embodiments, the service usage information, transaction code, and/or network information context is formatted into communication framing, syntax, encryption/signature, security and/or networking protocols that are compatible with the formatting used by conventional networking equipment to generate CDRs. For example, this allows networking equipment used for CDR collection, recording, aggregation, mediation, and/or conversion to billing records to properly accept, read, and interpret the CDRs that are generated with the assistance of device based service usage measurement. In some embodiments, the device assisted service measures are provided to an intermediate network server referred to as a service controller (e.g., service controller 122). In some embodiments, the service controller uses a CDR feed aggregator for a wireless network to collect device generated usage information for one or more devices on the wireless network; and provides the device generated usage information in a syntax (e.g., charging data record (CDR)), and a communication protocol (e.g., 3GPP or 3GPP2, or other communication protocol(s)) that can be used by the wireless network to augment or replace network generated usage information for the one or more devices on the wireless network.


In some embodiments, mediation rules include multi device, multi user, single user devices, intermediate networking devices that can be single user or multi user. For example, the device assisted CDRs can be formatted by the device assisted CDR generator to include a transaction code for one user account, even though the CDRs originate from multiple devices that all belong to the same user. This is an example for a multi-user device assisted CDR billing solution. In another example for a multi-user device assisted CDR billing solution, device assisted CDRs from multiple devices and multiple users can all be billed to the same account (e.g., a family plan or a corporate account), but the bill-by-account CDR transaction records can be maintained through the billing system so that sub-account visibility is provided so that the person or entity responsible for the main account can obtain visibility about which users and/or devices are creating most of the service usage billing. For example, this type of multi-user, multi-device device assisted CDR billing solution can also be used to track types of service usage and/or bill for types of service usage that are either impossible or at least very difficult to account and/or bill for with purely network based CDR systems. In some embodiments, bill-by-account CDR transaction records can be used to provide sponsored transaction services, account for network chatter, provide service selection interfaces, and other services for multi-user or multi-device service plans.


In addition to conventional single user devices (e.g., cell phones, smart phones, netbooks/notebooks, mobile internet devices, personal navigation devices, music players, electronic eReaders, and other single user devices) device assisted service usage measurement and CDRs are also useful for other types of network capable devices and/or networking devices, such as intermediate networking devices (e.g., 3G/4G WWAN to WLAN bridges/routers/gateways, femto cells, DOCSIS modems, DSL modems, remote access/backup routers, and other intermediate network devices). For example, in such devices, particularly with a secure manner to verify that the device assisted service usage measures are relatively accurate and/or the device service processor 115 software is not compromised or hacked, many new service provider service delivery and billing models can be supported and implemented using the techniques described herein. For example, in a WiFi to WWAN bridge or router device multiple user devices can be supported with the same intermediate networking device in a manner that is consistent and compatible with the central provider's CDR aggregation and/or billing system by sending device assisted CDRs as described herein that have a service usage and/or billing code referenced to the end user and/or the particular intermediate device.


In some embodiments, the device assisted CDRs generated for the intermediate networking device are associated with a particular end user in which there can be several or many end users using the intermediate networking device for networking access, and in some embodiments, with each end user being required to enter a unique log-in to the intermediate networking device. For example, in this way, all devices that connect using WiFi to the intermediate networking device to get WWAN access generate CDRs can either get billed to a particular end user who is responsible for the master account for that device, or the CDRs can get billed in a secure manner, with verified relative usage measurement accuracy to multiple end users from the same intermediate networking device. In another example, an end user can have one account that allows access to a number of intermediate networking devices, and each intermediate networking device can generate consistent device assisted CDRs with transaction codes for that end user regardless of which intermediate networking device the end user logs in on.


In some embodiments, some of the services provided by the intermediate networking device are billed to a specific end user device assisted CDR transaction code, while other bill-by-account services are billed to other transaction code accounts, such as sponsored partner transaction service accounts, network chatter accounts, sponsored advertiser accounts, and/or service sign up accounts. For example, in this manner, various embodiments are provided in which intermediate networking devices (e.g., a WWAN to WiFi router/bridge) can sold to one user but can service and be used to bill other users (e.g., and this can be covered in the first purchasing user's service terms perhaps in exchange for a discount), or such intermediate networking devices can be located wherever access is desired without concern that the device will be hacked into so that services can be acquired without charge.


In some embodiments, various types of service usage transactions are billed for on the intermediate networking device, to any of one or more users, in which the information required to bill for such services is not available to the central provider or MVNO network equipment, just as is the case with, for example, conventional single user devices. In view of the various embodiments and techniques described herein, those skilled in the art will appreciate that similar service models are equally applicable not just to WWAN to WiFi intermediate networking devices, but also to the Femto Cell, remote access router, DOCSIS, DSL and other intermediate WWAN to WiFi networking devices.



FIG. 1 illustrates a wireless network architecture for providing device assisted CDR creation, aggregation, mediation and billing in accordance with some embodiments. As shown, FIG. 1 includes a 4G/3G/2G wireless network operated by, for example, a central provider. As shown, various wireless devices 100 are in communication with base stations 125 for wireless network communication with the wireless network, and other devices 100 are in communication with Wi-Fi Access Points (APs) or Mesh 702 for wireless communication to Wi-Fi Access CPE 704 in communication with central provider access network 109. In some embodiments, each of the wireless devices 100 includes a service processor 115 (as shown), and each service processor connects through a secure control plane link to a service controller 122. In some embodiments, the network based service usage information (e.g., CDRs) is obtained from one or more network elements. As shown, an MVNO core network 210 also includes a CDR storage, aggregation, mediation, feed 118, a MVNO billing interface 122, and a MVNO billing system 123 (and other network elements as shown in FIG. 1).


As shown in FIG. 1, a CDR storage, aggregation, mediation, feed 118 (e.g., service usage 118, including a billing aggregation data store and rules engine) is a functional descriptor for, in some embodiments, a device/network level service usage information collection, aggregation, mediation, and reporting function located in one or more of the networking equipment components attached to one or more of the sub-networks shown in FIG. 1 (e.g., central provider access network 109 and/or central provider core network 110), which is in communication with the service controller 122, and a central billing interface 127. As shown in FIG. 1, service usage 118 is shown as a function in communication with the central provider core network 110. In some embodiments, the CDR storage, aggregation, mediation, feed 118 function is located elsewhere in the network or partially located in elsewhere or integrated with as part of other network elements. In some embodiments, CDR storage, aggregation, mediation, feed 118 functionality is located or partially located in the AAA server 121 and/or the mobile wireless center/Home Location Register (HLR) 132 (as shown, in communication with a DNS/DHCP server 126). In some embodiments, service usage 118 functionality is located or partially located in the base station, base station controller and/or base station aggregator, collectively referred to as base station 125 in FIG. 1. In some embodiments, CDR storage, aggregation, mediation, feed 118 functionality is located or partially located in a networking component in the central provider access network 109, a networking component in the core network 110, the central billing system 123, the central billing interface 127, and/or in another network component or function. This discussion on the possible locations for the network based and device based service usage information collection, aggregation, mediation, and reporting function (e.g., CDR storage, aggregation, mediation, feed 118) can be easily generalized as described herein and as shown in the other figures described herein by one of ordinary skill in the art. Also as shown in FIG. 1, the service controller 122 is in communication with the central billing interface 123 (also sometimes referred to as the external billing management interface or billing communication interface) 127, which is in communication with the central billing system 123. As shown, an order management 180 and subscriber management 182 are also in communication with the central provider core network 110 for facilitating order and subscriber management of services for the devices 100 in accordance with some embodiments.


In some embodiments, the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) provides a device/network level service usage information collection, aggregation, mediation, and reporting function. In some embodiments, the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) collects device generated usage information for one or more devices on the wireless network (e.g., devices 100); and provides the device generated usage information in a syntax and a communication protocol that can be used by the wireless network to augment or replace network generated usage information for the one or more devices on the wireless network. In some embodiments, the syntax is a charging data record (CDR), and the communication protocol is selected from one or more of the following: 3GPP, 3GPP2, or other communication protocols. In some embodiments, the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) includes a service usage data store (e.g., a billing aggregator) and a rules engine for aggregating the collected device generated usage information. In some embodiments, the syntax is a charging data record (CDR), and the network device is a CDR feed aggregator, and the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) also aggregates CDRs for the one or more devices on the wireless network; applies a set of rules to the aggregated CDRs using a rules engine (e.g., bill by account, transactional billing, and/or any other billing or other rules for service usage information collection, aggregation, mediation, and reporting), and communicates a new set of CDRs for the one or more devices on the wireless network to a billing interface or a billing system (e.g., providing a CDR with a billing offset by account/service). In some embodiments, the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) communicates a new set of CDRs for the one or more devices on the wireless network to a billing interface or a billing system. In some embodiments, the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) communicates with a service controller to collect the device generated usage information for the one or more devices on the wireless network. In some embodiments, the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) communicates with a service controller, in which the service controller is in communication with a billing interface or a billing system. In some embodiments, the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) communicates the device generated usage information to a billing interface or a billing system. In some embodiments, the CDR storage, aggregation, mediation, feed (and/or other network elements or combinations of network elements) communicates with a transport gateway and/or a Radio Access Network (RAN) gateway to collect the network generated usage information for the one or more devices on the wireless network. In some embodiments, the service controller 122 communicates the device generated service usage information to the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements).


In some embodiments, the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) performs rules for performing a bill by account aggregation and mediation function. In some embodiments, the service controller 122 in communication with the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) performs a rules engine for aggregating and mediating the device generated usage information. In some embodiments, a rules engine device in communication with the CDR storage, aggregation, mediation, feed 118 (and/or other network elements or combinations of network elements) performs a rules engine for aggregating and mediating the device generated usage information.


In some embodiments, the rules engine is included in (e.g., integrated with/part of) the CDR storage, aggregation, mediation, feed 118. In some embodiments, the rules engine and associated functions, as described herein, is a separate function/device. In some embodiments, the service controller 122 performs some or all of these rules engine based functions, as described herein, and communicates with the central billing interface 127. In some embodiments, the service controller 122 performs some or all of these rules engine based functions, as described herein, and communicates with the central billing system 123.


In some embodiments, duplicate CDRs are sent from the network equipment to the billing system 123 that is used for generating service billing. In some embodiments, duplicate CDRs are filtered to send only those CDRs/records for devices controlled by the service controller and/or service processor (e.g., the managed devices). For example, this approach can provide for the same level of reporting, lower level of reporting, and/or higher level of reporting as compared to the reporting required by the central billing system 123.


In some embodiments, a bill-by-account billing offset is provided. For example, bill-by-account billing offset information can be informed to the central billing system 123 by providing a CDR aggregator feed that aggregates the device based service usage data feed to provide a new set of CDRs for the managed devices to the central billing interface 127 and/or the central billing system 123. In some embodiments, transaction billing is provided using similar techniques. For example, transaction billing log information can be provided to the central billing interface 127 and/or the central billing system 123.


In some embodiments, the rules engine (e.g., performed by the service usage 118 or another network element, as described herein) provides a bill-by-account billing offset. For example, device generated usage information (e.g., charging data records (CDRs)) includes a transaction type field (e.g., indicating a type of service for the associated service usage information). The rules engine can apply a rule or a set of rules based on the identified service associated with the device generated usage information to determine a bill-by-account billing offset (e.g., a new CDR can be generated to provide the determined bill-by-account billing offset). In some examples, the determined bill-by-account billing offset can be provided as a credit to the user's service usage account (e.g., a new CDR can be generated with a negative offset for the user's service usage account, such as for network chatter service usage, or transactional service usage, or for any other purposes based on one or more rules performed by the rules engine).


As another example, for a transactional service, a first new CDR can be generated with a negative offset for the user's service usage account for that transactional service related usage, and a second new CDR can be generated with a positive service usage value to charge that same service usage to the transactional service provider (e.g., Amazon, eBay, or another transactional service provider). In some embodiments, the service controller 122 generates these two new CDRs, and the service usage 118 stores, aggregates, and communicates these two new CDRs to the central billing interface 127. In some embodiments, the service controller 122 generates these two new CDRs, and the service usage 118 stores, aggregates, and communicates these two new CDRs to the central billing interface 127, in which the central billing interface 127 applies rules (e.g., performs the rules engine for determining the bill-by-account billing offset).


In some embodiments, the service controller 122 sends the device generated CDRs to the rules engine (e.g., service usage 118), and the rules engine applies one or more rules, such as those described herein and/or any other billing/service usage related rules as would be apparent to one of ordinary skill in the art. In some embodiments, the service controller 122 generates CDRs similar to other network elements, and the rules (e.g., bill-by-account) are performed in the central billing interface 127. For example, for the service controller 122 to generate CDRs similar to other network elements, in some embodiments, the service controller 122 is provisioned on the wireless network and behaves substantially similar to other CDR generators on the network) as would be apparent to one of ordinary skill in the art.


In some embodiments, the service controller 122 is provisioned as a new type of networking function that is recognized as a valid and secure source for CDRs by the other necessary elements in the network (e.g., the Service Usage History/CDR Aggregation and Mediation Server 118). In some embodiments, in which the network apparatus typically only recognize CDRs from certain types of networking equipment (e.g., RAN Gateway 410 or Transport Gateway 420 (as shown in FIG. 3)), then the Service Controller 122 can provide authentication credentials to the other networking equipment that indicate it is one of the approved types of equipment (e.g., for purposes of generating/providing CDRs). In some embodiments, the link between the Service Controller 122 and the necessary CDR aggregation and mediation equipment is secured, authenticated, encrypted and/or signed.


In some embodiments, the CDR storage, aggregation, mediation, feed 118 discards the network based service usage information (e.g., network based CDRs) received from one or more network elements. In these embodiments, the service controller 122 can provide the device based service usage information (e.g., device based CDRs) to the CDR storage, aggregation, mediation, feed 118 (e.g., the CDR storage, aggregation, mediation, feed 118 can just provide a store, aggregate, and communication function(s)), and the device based service usage information is provided to the central billing interface 127 or the central billing system 123.


In some embodiments, the device based CDRs and/or new CDRs generated based on execution of a rules engine as described herein is provided only for devices that are managed and/or based on device group, service plan, or any other criteria, categorization, and/or grouping.



FIG. 2 illustrates another wireless network architecture for providing device assisted CDR creation, aggregation, mediation and billing in accordance with some embodiments. As shown in FIG. 2, some devices 100 are in communication with DOC SIS Head End 125 and some devices 100 are in communication with DSLAM 125, which are in communication with the central provider access network 109.



FIG. 3 illustrates another wireless network architecture for providing device assisted CDR creation, aggregation, mediation and billing in accordance with some embodiments. Referring now to the 4G/3G/2G access network as shown in FIG. 3, the 4G/3G and 3G/2G base stations/nodes 125 are in communication with a 4G/3G/2G Radio Access Network (RAN) gateway 410 via a radio access network 405, which are in communication with a 4G/3G/2G transport gateway 420 via an access transport network 415. The central provider core network 110 is in network communication with the access transport network 415 (e.g., via a dedicated/leased line, and as shown, via a firewall 124). The Internet 120 is available via a firewall 124 and the transport gateway(s) 420, as shown. Also, as shown, a network apparatus provisioning system 160, order management 180, and subscriber management 182 are in communication with the central provider core network 110. As shown, a AAA server 121, a mobile wireless center/Home Location Register (HLR) 132, a DNS/DHCP 126, and CDR storage, aggregation, mediation, feed 118 are also in communication with the access transport network 415. The central billing system 123 and the central billing interface 127 are shown in communication with the central provider core network 110.


As shown, FIG. 3 includes a 4G/3G/2G wireless network operated by, for example, a central provider. In some embodiments, each of the wireless devices 100 includes a service processor 115 (as shown), and each service processor connects through a secure control plane link to a service controller 122. In some embodiments, the network based service usage information (e.g., network generated CDRs) is obtained from Radio Access Network (RAN) gateway(s) 410 and/or transport gateway(s) 420. In some embodiments, device based service usage information (e.g., device assisted CDRs) are generated by the service processor 115 and/or service controller 122 for some or all of the wireless devices 100 using similar techniques as described herein, and in some embodiments, such device based service usage information (e.g., device assisted CDRs) is sent to the CDR storage, aggregation, mediation, feed 118 (e.g., the CDR storage, aggregation, mediation, feed 118 can just provide a store, aggregate, and communication function(s)), and/or to the central billing interface 127 or the central billing system 123, as similarly described herein with respect to various embodiments.



FIG. 4 illustrates provisioning of a wireless network for providing device assisted CDR creation, aggregation, mediation and billing in accordance with some embodiments. As shown in FIG. 4, the provisioning of various network equipment is provided as shown to recognize each other as an authorized source of CDRs (e.g., this can be done manually or in an automated manner). For example, order management 180, subscriber management, billing interface 127, billing system 123, network provisioning system 160, service controller 122, access network AAA server 121, mobile wireless center 132, and CDR storage, aggregation, mediation feed 118 communicate with each other for such provisioning, which can be implemented using various techniques. In some embodiments, the various network elements are provisioned to recognize device assisted CDRs being generated by the service controller 122, which, for example, can be provided to the billing interface 127 and/or the billing system 123. In some embodiments, network generated CDRs are provided by RAN/Access gateway 410, aggregation/transport gateway 425, and/or base station controller 125. In some embodiments, other network elements generate/receive/store device assisted CDRs.


In some embodiments, provisioning of various network equipment is provided to recognize a given device as belonging to a device group that supports a service usage and/or billing plan that relies upon and/or utilizes device assisted CDRs.


In some embodiments, the CDR formats, transaction codes, and CDR transmission destinations are programmed for each device that generates CDRs, including the service controller 122 (e.g., in some embodiments, the service controller 122 is the intermediary for CDRs) and/or service processor 115 (e.g., in some embodiments, the device sends CDRs to network CDR aggregation or billing interface 127/billing system 123 with no intermediate server function).



FIG. 5 illustrates a network architecture for providing device assisted CDRs in accordance with some embodiments. As shown, network generated CDRs are sent from various network elements to the CDR storage, aggregation, mediation, feed 118 and the service controller 122, as shown in dashed lines with arrows in FIG. 5. In some embodiments, the network generated CDRs are used for verification of device assisted service (DAS) usage and/or billing information. In some embodiments, the network generated CDRs are provided to the service controller 122, and the service controller 122 implements aggregation and/or mediation rules to examine and, in some cases, aggregate and/or mediate network generated/based CDRs with device assisted/based CDRs.


In some embodiments, device assisted CDRs are sent from the service controller 122 to CDR storage, aggregation, mediation, feed 118 and communicated to the billing system 123, as shown in solid lines with arrows in FIG. 5. In some embodiments, CDR storage, aggregation, mediation, feed 118 uses DAS service usage CDRs to augment network generated/based CDRs with bill-by-account transaction codes (e.g., as similarly described herein). In some embodiments, CDR storage, aggregation, mediation, feed 118 implements aggregation and/or mediation rules to account for DAS CDR usage amount in a new bill-by-account transaction code and removes the same service usage amount from the bulk device account transaction code. In some embodiments, a first DAS CDR is sent for the new bill by account transaction code, and a second DAS CDR is sent to be used as a correction (credit) to the main device usage account transaction code, and CDR storage, aggregation, mediation, feed 118 implements the rules to perform this mediation. In some embodiments, a first DAS CDR is used for a given bill-by-account transaction code, and a second DAS CDR is used as the main device account transaction code, in which the service controller 122 (or device) has already implemented the mediation rules so that CDR storage, aggregation, mediation, feed 118 simply passes such DAS CDRs to billing after aggregating them.



FIG. 6 illustrates another network architecture for providing device assisted CDRs in accordance with some embodiments. FIG. 6 also shows the communication of device assisted CDRs and network generated CDRs using solid and dashed lines with arrows, respectively. As shown, in some embodiments, CDR storage, aggregation, mediation, feed 118 sends network based CDRs to service controller 122 for various purposes, such as those previously described herein.


In some embodiments, service controller 122 sends DAS CDRs to billing for various uses by the billing system 123. In some embodiments, the billing system 123 uses DAS service usage CDRs to augment network based CDRs with bill-by-account transaction codes. In some embodiments, the billing system 123 implements aggregation and/or mediation rules to account for DAS CDR usage amount in a new bill-by-account transaction code and removes the same service usage amount from the bulk device account transaction code. In some embodiments, a first DAS CDR is sent for the new bill by account transaction code, and a second DAS CDR is sent to be used as a correction (credit) to the main device usage account transaction code, and the billing system 123 implements the rules to perform this mediation. In some embodiments, a first DAS CDR is used for a given bill-by-account transaction code, and a second is used as the main device account transaction code, in which the service controller 122 (or device) has already implemented the mediation rules so that the billing system 123 simply passes such DAS CDRs after aggregating them.



FIG. 7 illustrates another network architecture for providing device assisted CDRs in accordance with some embodiments. FIG. 7 also shows the communication of device assisted CDRs and network generated CDRs using solid and dashed lines with arrows, respectively. FIG. 7 is similar to FIG. 6, except as shown in FIG. 7, service usage information is passed through the billing interface 127 instead of the billing CDR aggregation interface. For example, the service usage detailed bill-by-account information and offset (credit) information can be formatted as a CDR or can be formatted in a higher level syntax as required by the billing interface 127.



FIG. 8 illustrates another network architecture for providing device assisted CDRs in accordance with some embodiments. FIG. 8 also shows the communication of device assisted CDRs and network generated CDRs using solid and dashed lines with arrows, respectively. In some embodiments, as shown in FIG. 8, the central provider need not modify the existing CDR storage, aggregation, mediation, feed 118, so the additional aggregation and mediation rules discussed above with respect to FIG. 5 are implemented as a new layer of rules in a new network function, shown as secondary DAS CDR aggregation mediation 118A, that is located between the billing system and the CDR storage, aggregation, mediation, feed 118. For example, this new network function (e.g., secondary DAS CDR aggregation mediation 118A) can reside in the network (as shown) or in the service processor 115, in the service controller 122, or elsewhere in the network or on the device.



FIG. 9 is a functional diagram illustrating a device based service processor 115 and a service controller 122 in accordance with some embodiments. For example, this provides relatively full featured device based service processor implementation and service controller implementation. As shown, this corresponds to a networking configuration in which the service controller 122 is connected to the Internet 120 and not directly to the access network 1610. As shown, a data plane (e.g., service traffic plane) communication path is shown in solid line connections and control plane (e.g., service control plane) communication path is shown in dashed line connections. As will be apparent, the division in functionality between one device agent and another is based on, for example, design choices, networking environments, devices and/or services/applications, and various different combinations can be used in various different implementations. For example, the functional lines can be re-drawn in any way that the product designers see fit. As shown, this includes certain divisions and functional breakouts for device agents as an illustrative implementation, although other, potentially more complex, embodiments can include different divisions and functional breakouts for device agent functionality specifications, for example, in order to manage development specification and testing complexity and workflow. In addition, the placement of the agents that operate, interact with or monitor the data path can be moved or re-ordered in various embodiments. For example, the functional elements shown in FIG. 9 are described below with respect to FIGS. 10 and 11.


As shown in FIG. 9, service processor 115 includes a service control device link 1691. For example, as device based service control techniques involving supervision across a network become more sophisticated, it becomes increasingly important to have an efficient and flexible control plane communication link between the device agents and the network elements communicating with, controlling, monitoring, or verifying service policy. In some embodiments, the service control device link 1691 provides the device side of a system for transmission and reception of service agent to/from network element functions. In some embodiments, the traffic efficiency of this link is enhanced by buffering and framing multiple agent messages in the transmissions. In some embodiments, the traffic efficiency is further improved by controlling the transmission frequency or linking the transmission frequency to the rate of service usage or traffic usage. In some embodiments, one or more levels of security or encryption are used to make the link robust to discovery, eavesdropping or compromise. In some embodiments, the service control device link 1691 also provides the communications link and heartbeat timing for the agent heartbeat function. As discussed below, various embodiments disclosed herein for the service control device link 1691 provide an efficient and secure solution for transmitting and receiving service policy implementation, control, monitoring and verification information with other network elements.


As shown in FIG. 9, the service controller 122 includes a service control server link 1638. In some embodiments, device based service control techniques involving supervision across a network (e.g., on the control plane) are more sophisticated, and for such it is increasingly important to have an efficient and flexible control plane communication link between the device agents (e.g., of the service processor 115) and the network elements (e.g., of the service controller 122) communicating with, controlling, monitoring, or verifying service policy. For example, the communication link between the service control server link 1638 of service controller 122 and the service control device link 1691 of the service processor 115 can provide an efficient and flexible control plane communication link, a service control link 1653 as shown in FIG. 9, and, in some embodiments, this control plane communication link provides for a secure (e.g., encrypted) communications link for providing secure, bidirectional communications between the service processor 115 and the service controller 122. In some embodiments, the service control server link 1638 provides the network side of a system for transmission and reception of service agent to/from network element functions. In some embodiments, the traffic efficiency of this link is enhanced by buffering and framing multiple agent messages in the transmissions (e.g., thereby reducing network chatter). In some embodiments, the traffic efficiency is further improved by controlling the transmission frequency and/or linking the transmission frequency to the rate of service usage or traffic usage. In some embodiments, one or more levels of security and/or encryption are used to secure the link against potential discovery, eavesdropping or compromise of communications on the link. In some embodiments, the service control server link 1638 also provides the communications link and heartbeat timing for the agent heartbeat function.


In some embodiments, the service control server link 1638 provides for securing, signing, encrypting and/or otherwise protecting the communications before sending such communications over the service control link 1653. For example, the service control server link 1638 can send to the transport layer or directly to the link layer for transmission. In another example, the service control server link 1638 further secures the communications with transport layer encryption, such as TCP TLS SSH version 1 or 2 or another secure transport layer protocol. As another example, the service control server link 1638 can encrypt at the link layer, such as using IPSEC, various possible VPN services, other forms of IP layer encryption and/or another link layer encryption technique.


As shown in FIG. 9, the service controller 122 includes an access control integrity server 1654. In some embodiments, the access control integrity server 1654 collects device information on service policy, service usage, agent configuration and/or agent behavior. For example, the access control integrity server 1654 can cross check this information to identify integrity breaches in the service policy implementation and control system. In another example, the access control integrity server 1654 can initiate action when a service policy violation or a system integrity breach is suspected.


In some embodiments, the access control integrity server 1654 (and/or some other agent of service controller 122) acts on access control integrity agent 1694 reports and error conditions. Many of the access control integrity agent 1654 checks can be accomplished by the server. For example, the access control integrity agent 1654 checks include one or more of the following: service usage measure against usage range consistent with policies (e.g., usage measure from the network and/or from the device); configuration of agents; operation of the agents; and/or dynamic agent download.


In some embodiments, the access control integrity server 1654 (and/or some other agent of service controller 122) verifies device service policy implementations by comparing various service usage measures (e.g., based on network monitored information, such as by using IPDRs or CDRs, and/or local service usage monitoring information) against expected service usage behavior given the policies that are intended to be in place. For example, device service policy implementations can include measuring total data passed, data passed in a period of time, IP addresses, data per IP address, and/or other measures such as location, downloads, email accessed, URLs, and comparing such measures expected service usage behavior given the policies that are intended to be in place.


In some embodiments, the access control integrity server 1654 (and/or some other agent of service controller 122) verifies device service policy, and the verification error conditions that can indicate a mismatch in service measure and service policy include one or more of the following: unauthorized network access (e.g., access beyond ambient service policy limits); unauthorized network speed (e.g., average speed beyond service policy limit); network data amount does not match policy limit (e.g., device not stop at limit without re-up/revising service policy); unauthorized network address; unauthorized service usage (e.g., VOIP, email, and/or web browsing); unauthorized application usage (e.g., email, VOIP, email, and/or web); service usage rate too high for plan, and policy controller not controlling/throttling it down; and/or any other mismatch in service measure and service policy. Accordingly, in some embodiments, the access control integrity server 1654 (and/or some other agent of service controller 122) provides a policy/service control integrity service to continually (e.g., periodically and/or based on trigger events) verify that the service control of the device has not been compromised and/or is not behaving out of policy.


As shown in FIG. 9, service controller 122 includes a service history server 1650. In some embodiments, the service history server 1650 collects and records service usage or service activity reports from the Access Network AAA Server 1621 and the Service Monitor Agent 1696. For example, although service usage history from the network elements can in certain embodiments be less detailed than service history from the device, the service history from the network can provide a valuable source for verification of device service policy implementation, because, for example, it is extremely difficult for a device error or compromise event on the device to compromise the network based equipment and software. For example, service history reports from the device can include various service tracking information, as similarly described above. In some embodiments, the service history server 1650 provides the service history on request to other servers and/or one or more agents. In some embodiments, the service history server 1650 provides the service usage history to the device service history 1618. In some embodiments, for purposes of facilitating the activation tracking service functions (described below), the service history server 1650 maintains a history of which networks the device has connected to. For example, this network activity summary can include a summary of the networks accessed, activity versus time per connection, and/or traffic versus time per connection. As another example, this activity summary can further be analyzed or reported to estimate the type of service plan associated with the traffic activity for the purpose of bill sharing reconciliation.


As shown in FIG. 9, service controller 122 includes a policy management server 1652. In some embodiments, the policy management server 1652 transmits policies to the service processor 115 via the service control link 1653. In some embodiments, the policy management server 1652 manages policy settings on the device (e.g., various policy settings as described herein with respect to various embodiments) in accordance with a device service profile. In some embodiments, the policy management server 1652 sets instantaneous policies on policy implementation agents (e.g., policy implementation agent 1690). For example, the policy management server 1652 can issue policy settings, monitor service usage and, if necessary, modify policy settings. For example, in the case of a user who prefers for the network to manage their service usage costs, or in the case of any adaptive policy management needs, the policy management server 1652 can maintain a relatively high frequency of communication with the device to collect traffic and/or service measures and issue new policy settings. In this example, device monitored service measures and any user service policy preference changes are reported, periodically and/or based on various triggers/events/requests, to the policy management server 1652. In this example, user privacy settings generally require secure communication with the network (e.g., a secure service control link 1653), such as with the policy management server 1652, to ensure that various aspects of user privacy are properly maintained during such configuration requests/policy settings transmitted over the network. For example, information can be compartmentalized to service policy management and not communicated to other databases used for CRM for maintaining user privacy.


In some embodiments, the policy management server 1652 provides adaptive policy management on the device. For example, the policy management server 1652 can issue policy settings and objectives and rely on the device based policy management (e.g., service processor 115) for some or all of the policy adaptation. This approach can require less interaction with the device thereby reducing network chatter on service control link 1653 for purposes of device policy management (e.g., network chatter is reduced relative to various server/network based policy management approaches described above). This approach can also provide robust user privacy embodiments by allowing the user to configure the device policy for user privacy preferences/settings so that, for example, sensitive information (e.g., geo-location data, website history) is not communicated to the network without the user's approval. In some embodiments, the policy management server 1652 adjusts service policy based on time of day. In some embodiments, the policy management server 1652 receives, requests or otherwise obtains a measure of network availability and adjusts traffic shaping policy and/or other policy settings based on available network capacity.


As shown in FIG. 9, service controller 122 includes a network traffic analysis server 1656. In some embodiments, the network traffic analysis server 1656 collects/receives service usage history for devices and/or groups of devices and analyzes the service usage. In some embodiments, the network traffic analysis server 1656 presents service usage statistics in various formats to identify improvements in network service quality and/or service profitability. In other embodiments, the network traffic analysis server 1656 estimates the service quality and/or service usage for the network under variable settings on potential service policy. In other embodiments, the network traffic analysis server 1656 identifies actual or potential service behaviors by one or more devices that are causing problems for overall network service quality or service cost.


As shown in FIG. 9, service controller 122 includes a beta test server 1658. In some embodiments, the beta test server 1658 publishes candidate service plan policy settings to one or more devices. In some embodiments, the beta test server 1658 provides summary reports of network service usage or user feedback information for one or more candidate service plan policy settings. In some embodiments, the beta test server 1658 provides a mechanism to compare the beta test results for different candidate service plan policy settings or select the optimum candidates for further policy settings optimization.


As shown in FIG. 9, service controller 122 includes a service download control server 1660. In some embodiments, the service download control server 1660 provides a download function to install and/or update service software elements (e.g., the service processor 115 and/or agents/components of the service processor 115) on the device, as described herein.


As shown in FIG. 9 service controller 122 includes a billing event server 1662. In some embodiments, the billing event server 1662 collects billing events, provides service plan information to the service processor 115, provides service usage updates to the service processor 115, serves as interface between device and central billing server 1619, and/or provides trusted third party function for certain ecommerce billing transactions.


As shown in FIG. 9, the Access Network AAA server 1621 is in network communication with the access network 1610. In some embodiments, the Access Network AAA server 1621 provides the necessary access network AAA services (e.g., access control and authorization functions for the device access layer) to allow the devices onto the central provider access network and the service provider network. In some embodiments, another layer of access control is required for the device to gain access to other networks, such as the Internet, a corporate network and/or a machine to machine network. This additional layer of access control can be implemented, for example, by the service processor 115 on the device. In some embodiments, the Access Network AAA server 1621 also provides the ability to suspend service for a device and resume service for a device based on communications received from the service controller 122. In some embodiments, the Access Network AAA server 1621 also provides the ability to direct routing for device traffic to a quarantine network or to restrict or limit network access when a device quarantine condition is invoked. In some embodiments, the Access Network AAA server 1621 also records and reports device network service usage (e.g., device network service usage can be reported to device service history 1618).


As shown in FIG. 9, the device service history 1618 is in network communication with the access network 1610. In some embodiments, the device service history 1618 provides service usage data records used for various purposes in various embodiments. In some embodiments, the device service history 1618 is used to assist in verifying service policy implementation. In some embodiments, the device service history 1618 is used to verify service monitoring. In some embodiments, the device service history 1618 is used to verify billing records and/or billing policy implementation. In some embodiments, the device service history 1618 is used to synchronize and/or verify the local service usage counter.


As shown in FIG. 9, the central provider billing server 1619 is in network communication with the access network 1610. In some embodiments, the central provider billing server 1619 provides a mediation function for central provider billing events. For example, the central provider billing server 1619 can accept service plan changes. In some embodiments, the central provider billing server 1619 provides updates on device service usage, service plan limits and/or service policies. In some embodiments, the central provider billing server 1619 collects billing events, formulates bills, bills service users, provides certain billing event data and service plan information to the service controller 122 and/or device 100.


As shown in FIG. 9, in some embodiments, modem selection and control 1811 selects the access network connection and is in communication with the modem firewall 1655, and modem drivers 1831, 1815, 1814, 1813, 1812 convert data traffic into modem bus traffic for one or more modems and are in communication with the modem selection and control 1811. In some embodiments, different profiles are selected based on the selected network connection (e.g., different service profiles/policies for WWAN, WLAN, WPAN, Ethernet and/or DSL network connections), which is also referred to herein as multimode profile setting. For example, service profile settings can be based on the actual access network (e.g., home DSL/cable or work network) behind the Wi-Fi not the fact that it is Wi-Fi (or any other network, such as DSL/cable, satellite, or T-1), which is viewed as different than accessing a Wi-Fi network at the coffee shop. For example, in a Wi-Fi hotspot situation in which there are a significant number of users on a DSL or T-1 backhaul, the service controller can sit in a service provider cloud or an MVNO cloud, the service controls can be provided by a VSP capability offered by the service provider or the service controller can be owned by the hotspot service provider that uses the service controller on their own without any association with an access network service provider. For example, the service processors can be controlled by the service controller to divide up the available bandwidth at the hotspot according to QoS or user sharing rules (e.g., with some users having higher differentiated priority (potentially for higher service payments) than other users). As another example, ambient services (as similarly described herein) can be provided for the hotspot for verified service processors.


In some embodiments, the service processor 115 and service controller 122 are capable of assigning multiple service profiles associated with multiple service plans that the user chooses individually or in combination as a package. For example, a device 100 starts with ambient services that include free transaction services wherein the user pays for transactions or events rather than the basic service (e.g., a news service, eReader, PND service, pay as you go session Internet) in which each service is supported with a bill by account capability to correctly account for any subsidized partner billing to provide the transaction services (e.g., Barnes and Noble may pay for the eReader service and offer a revenue share to the service provider for any book or magazine transactions purchased from the device 100). In some embodiments, the bill by account service can also track the transactions and, in some embodiments, advertisements for the purpose of revenue sharing, all using the service monitoring capabilities disclosed herein. After initiating services with the free ambient service discussed above, the user may later choose a post-pay monthly Internet, email and SMS service. In this case, the service controller 122 would obtain from the billing system 123 in the case of network based billing (or in some embodiments the service controller 122 billing event server 1622 in the case of device based billing) the billing plan code for the new Internet, email and SMS service. In some embodiments, this code is cross referenced in a database (e.g., the policy management server 1652) to find the appropriate service profile for the new service in combination with the initial ambient service. The new superset service profile is then applied so that the user maintains free access to the ambient services, and the billing partners continue to subsidize those services, the user also gets access to Internet services and may choose the service control profile (e.g., from one of the embodiments disclosed herein). The superset profile is the profile that provides the combined capabilities of two or more service profiles when the profiles are applied to the same device 100 service processor. In some embodiments, the device 100 (service processor 115) can determine the superset profile rather than the service controller 122 when more than one “stackable” service is selected by the user or otherwise applied to the device. The flexibility of the service processor 115 and service controller 122 embodiments described herein allow for a large variety of service profiles to be defined and applied individually or as a superset to achieve the desired device 100 service features.


As shown in FIG. 9, an agent communication bus 1630 represents a functional description for providing communication for the various service processor 115 agents and functions. In some embodiments, as represented in the functional diagram illustrated in FIG. 9, the architecture of the bus is generally multipoint to multipoint so that any agent can communicate with any other agent, the service controller or in some cases other components of the device, such user interface 1697 and/or modem components. As described below, the architecture can also be point to point for certain agents or communication transactions, or point to multipoint within the agent framework so that all agent communication can be concentrated, or secured, or controlled, or restricted, or logged or reported. In some embodiments, the agent communication bus is secured, signed, encrypted, hidden, partitioned and/or otherwise protected from unauthorized monitoring or usage. In some embodiments, an application interface agent (not shown) is used to literally tag or virtually tag application layer traffic so that the policy implementation agent(s) 1690 has the necessary information to implement selected traffic shaping solutions. In some embodiments, an application interface agent (not shown) is in communication with various applications, including a TCP application 1604, an IP application 1605, and a voice application 1602.


In some embodiments, device assisted services (DAS) techniques for providing an activity map for classifying or categorizing service usage activities to associate various monitored activities (e.g., by URL, by network domain, by website, by network traffic type, by application or application type, and/or any other service usage activity categorization/classification) with associated IP addresses are provided. In some embodiments, a policy control agent (not shown), service monitor agent 1696, or another agent or function (or combinations thereof) of the service processor 115 provides a DAS activity map. In some embodiments, a policy control agent, service monitor agent, or another agent or function (or combinations thereof) of the service processor provides an activity map for classifying or categorizing service usage activities to associate various monitored activities (e.g., by Uniform Resource Locator (URL), by network domain, by website, by network traffic type, by application or application type, and/or any other service usage activity classification/categorization) with associated IP addresses. In some embodiments, a policy control agent, service monitor agent, or another agent or function (or combinations thereof) of the service processor determines the associated IP addresses for monitored service usage activities using various techniques to snoop the DNS request(s) (e.g., by performing such snooping techniques on the device 100 the associated IP addresses can be determined without the need for a network request for a reverse DNS lookup). In some embodiments, a policy control agent, service monitor agent, or another agent or function (or combinations thereof) of the service processor records and reports IP addresses or includes a DNS lookup function to report IP addresses or IP addresses and associated URLs for monitored service usage activities. For example, a policy control agent, service monitor agent, or another agent or function (or combinations thereof) of the service processor can determine the associated IP addresses for monitored service usage activities using various techniques to perform a DNS lookup function (e.g., using a local DNS cache on the monitored device 100). In some embodiments, one or more of these techniques are used to dynamically build and maintain a DAS activity map that maps, for example, URLs to IP addresses, applications to IP addresses, content types to IP addresses, and/or any other categorization/classification to IP addresses as applicable. In some embodiments, the DAS activity map is used for various DAS traffic control and/or throttling techniques as described herein with respect to various embodiments. In some embodiments, the DAS activity map is used to provide the user various UI related information and notification techniques related to service usage as described herein with respect to various embodiments. In some embodiments, the DAS activity map is used to provide service usage monitoring, prediction/estimation of future service usage, service usage billing (e.g., bill by account and/or any other service usage/billing categorization techniques), DAS techniques for ambient services usage monitoring, DAS techniques for generating micro-CDRs (e.g., also referred to as service usage partition, service usage recording partition, service charging bucket, device generated CDRs, such as in the case where the device and not a network component are generating the usage records, ambient usage records, specialized service usage records, or other terms to indicate a service usage data record generated to provide a more refined or detailed breakdown of service usage for the device), and/or any of the various other DAS related techniques as described herein with respect to various embodiments.


In some embodiments, all or a portion of the service processor 115 functions disclosed herein are implemented in software. In some embodiments, all or a portion of the service processor 115 functions are implemented in hardware. In some embodiments, all or substantially all of the service processor 115 functionality (as discussed herein) is implemented and stored in software that can be performed on (e.g., executed by) various components in device 100. In some embodiments, it is advantageous to store or implement certain portions or all of service processor 115 in protected or secure memory so that other undesired programs (and/or unauthorized users) have difficulty accessing the functions or software in service processor 115. In some embodiments, service processor 115, at least in part, is implemented in and/or stored on secure non-volatile memory (e.g., non volatile memory can be secure non-volatile memory) that is not accessible without pass keys and/or other security mechanisms. In some embodiments, the ability to load at least a portion of service processor 115 software into protected non-volatile memory also requires a secure key and/or signature and/or requires that the service processor 115 software components being loaded into non-volatile memory are also securely encrypted and appropriately signed by an authority that is trusted by a secure software downloader function, such as service downloader 1663 as shown in FIG. 16. In some embodiments, a secure software download embodiment also uses a secure non-volatile memory. Those of ordinary skill in the art will also appreciate that all memory can be on-chip, off-chip, on-board and/or off-board.



FIG. 10 provides a table summarizing various service processer 115 functional elements in accordance with some embodiments. Many of these agents are similarly described above, and the table shown in FIG. 10 is not intended to be an exhaustive summary of these agents, nor an exhaustive description of all functions that the agents perform or are described herein, but rather FIG. 10 is provided as a summary aid in understanding the basic functions of each agent in accordance with some embodiments and how the agents interact with one another, with the service controller server elements, and/or with other network functions in certain embodiments to form a reliable device based service delivery solution and/or platform.



FIG. 11 provides a table summarizing various service controller 122 functional elements in accordance with some embodiments. Many of these agents/elements are similarly described above, and the table shown in FIG. 11 is not intended to be an exhaustive summary of these server elements, nor an exhaustive description of all functions that the elements perform or are described herein, but rather FIG. 11 is provided as a summary aid in understanding the basic functions of each element in accordance with some embodiments and how the elements interact with one another, certain network elements, and/or the service processor agents in certain embodiments to form a reliable device based service delivery solution and/or platform.



FIG. 12 illustrates a device stack providing various service usage measurement from various points in the networking stack for a service monitor agent, a billing agent, and an access control integrity agent to assist in verifying the service usage measures and billing reports in accordance with some embodiments. As shown in FIG. 12, several service agents take part in data path operations to achieve various data path improvements, and, for example, several other service agents can manage the policy settings for the data path service, implement billing for the data path service, manage one or more modem selection and settings for access network connection, interface with the user and/or provide service policy implementation verification. Additionally, in some embodiments, several agents perform functions to assist in verifying that the service control or monitoring policies intended to be in place are properly implemented, the service control or monitoring policies are being properly adhered to, that the service processor or one or more service agents are operating properly, to prevent unintended errors in policy implementation or control, and/or to prevent tampering with the service policies or control. As shown, the service measurement points labeled I through VI represent various service measurement points for service monitor agent 1696 and/or other agents to perform various service monitoring activities. Each of these measurement points can have a useful purpose in various embodiments described herein. For example, each of the traffic measurement points that is employed in a given design can be used by a monitoring agent to track application layer traffic through the communication stack to assist policy implementation functions, such as the policy implementation agent 1690, or in some embodiments the modem firewall agent 1655 or the application interface agent, in making a determination regarding the traffic parameters or type once the traffic is farther down in the communication stack where it is sometimes difficult or impossible to make a complete determination of traffic parameters. The particular locations for the measurement points provided in these figures are intended as instructional examples, and other measurement points can be used for different embodiments, as will be apparent to one of ordinary skill in the art in view of the embodiments described herein. Generally, in some embodiments, one or more measurement points within the device can be used to assist in service control verification and/or device or service troubleshooting.


In some embodiments, the service monitor agent and/or other agents implement virtual traffic tagging by tracking or tracing packet flows through the various communication stack formatting, processing and encryption steps, and providing the virtual tag information to the various agents that monitor, control, shape, throttle or otherwise observe, manipulate or modify the traffic. This tagging approach is referred to herein as virtual tagging, because there is not a literal data flow, traffic flow or packet tag that is attached to flows or packets, and the book-keeping to tag the packet is done through tracking or tracing the flow or packet through the stack instead. In some embodiments, the application interface and/or other agents identify a traffic flow, associate it with a service usage activity and cause a literal tag to be attached to the traffic or packets associated with the activity. This tagging approach is referred to herein as literal tagging. There are various advantages with both the virtual tagging and the literal tagging approaches. For example, it can be preferable in some embodiments to reduce the inter-agent communication required to track or trace a packet through the stack processing by assigning a literal tag so that each flow or packet has its own activity association embedded in the data. As another example, it can be preferable in some embodiments to re-use portions of standard communication stack software or components, enhancing the verifiable traffic control or service control capabilities of the standard stack by inserting additional processing steps associated with the various service agents and monitoring points rather than re-writing the entire stack to correctly process literal tagging information, and in such cases, a virtual tagging scheme may be desired. As yet another example, some standard communication stacks provide for unused, unspecified or otherwise available bit fields in a packet frame or flow, and these unused, unspecified or otherwise available bit fields can be used to literally tag traffic without the need to re-write all of the standard communication stack software, with only the portions of the stack that are added to enhance the verifiable traffic control or service control capabilities of the standard stack needing to decode and use the literal tagging information encapsulated in the available bit fields. In the case of literal tagging, in some embodiments, the tags are removed prior to passing the packets or flows to the network or to the applications utilizing the stack. In some embodiments, the manner in which the virtual or literal tagging is implemented can be developed into a communication standard specification so that various device or service product developers can independently develop the communication stack and/or service processor hardware and/or software in a manner that is compatible with the service controller specifications and the products of other device or service product developers.


It will be appreciated that although the implementation/use of any or all of the measurement points illustrated in FIG. 12 is not required to have an effective implementation, such as was similarly shown with respect to various embodiments described herein, various embodiments can benefit from these and/or similar measurement points. It will also be appreciated that the exact measurement points can be moved to different locations in the traffic processing stack, just as the various embodiments described herein can have the agents affecting policy implementation moved to different points in the traffic processing stack while still maintaining effective operation. In some embodiments, one or more measurement points are provided deeper in the modem stack where, for example, it is more difficult to circumvent and can be more difficult to access for tampering purposes if the modem is designed with the proper software and/or hardware security to protect the integrity of the modem stack and measurement point(s).


Referring to FIG. 12, describing the device communications stack from the bottom to the top of the stack as shown, the device communications stack provides a communication layer for each of the modems of the device at the bottom of the device communications stack. Example measurement point VI resides within or just above the modem driver layer. For example, the modem driver performs modem bus communications, data protocol translations, modem control and configuration to interface the networking stack traffic to the modem. As shown, measurement point VI is common to all modem drivers and modems, and it is advantageous for certain embodiments to differentiate the traffic or service activity taking place through one modem from that of one or more of the other modems. In some embodiments, measurement point VI, or another measurement point, is located over, within or below one or more of the individual modem drivers. The respective modem buses for each modem reside between example measurement points V and VI. In the next higher layer, a modem selection & control layer for multimode device based communication is provided. In some embodiments, this layer is controlled by a network decision policy that selects the most desirable network modem for some or all of the data traffic, and when the most desirable network is not available the policy reverts to the next most desirable network until a connection is established provided that one of the networks is available. In some embodiments, certain network traffic, such as verification, control, redundant or secure traffic, is routed to one of the networks even when some or all of the data traffic is routed to another network. This dual routing capability provides for a variety of enhanced security, enhanced reliability or enhanced manageability devices, services or applications. In the next higher layer, a modem firewall is provided. For example, the modem firewall provides for traditional firewall functions, but unlike traditional firewalls, in order to rely on the firewall for verifiable service usage control, such as access control and security protection from unwanted networking traffic or applications, the various service verification techniques and agents described herein are added to the firewall function to verify compliance with service policy and prevent tampering of the service controls. In some embodiments, the modem firewall is implemented farther up the stack, possibly in combination with other layers as indicated in other Figures. In some embodiments, a dedicated firewall function or layer is provided that is independent of the other processing layers, such as the policy implementation layer, the packet forwarding layer and/or the application layer. In some embodiments, the modem firewall is implemented farther down the stack, such as within the modem drivers, below the modem drivers, or in the modem itself. Example measurement point IV resides between the modem firewall layer and an IP queuing and routing layer. As shown, an IP queuing and routing layer is separate from the policy implementation layer where the policy implementation agent implements a portion of the traffic control and/or service usage control policies. As described herein, in some embodiments, these functions are separated so that a standard network stack function can be used for IP queuing and routing, and the modifications necessary to implement the policy implementation agent functions can be provided in a new layer inserted into the standard stack. In some embodiments, the IP queuing and routing layer is combined with the traffic or service usage control layer. For example, a combined routing and policy implementation layer embodiment can also be used with the other embodiments, such as shown in FIG. 12. Measurement point III resides between the IP queuing and routing layer and a policy implementation agent layer. Measurement point II resides between the policy implementation agent layer and the transport layer, including TCP, UDP, and other IP as shown. The session layer resides above the transport layer, which is shown as a socket assignment and session management (e.g., basic TCP setup, TLS/SSL) layer. The network services API (e.g., HTTP, HTTPS, FTP (File Transfer Protocol), SMTP (Simple Mail Transfer Protocol), POP3, DNS) resides above the session layer. Measurement point I resides between the network services API layer and an application layer, shown as application service interface agent in the device communications stack of FIG. 12.


As shown in FIG. 12, the application service interface layer is above the standard networking stack API and, in some embodiments, its function is to monitor and in some cases intercept and process the traffic between the applications and the standard networking stack API. In some embodiments, the application service interface layer identifies application traffic flows before the application traffic flows are more difficult or practically impossible to identify farther down in the stack. In some embodiments, the application service interface layer in this way assists application layer tagging in both the virtual and literal tagging cases. In the case of upstream traffic, the application layer tagging is straight forward, because the traffic originates at the application layer. In some downstream embodiments, where the traffic or service activity classification relies on traffic attributes that are readily obtainable, such as source address or URL, application socket address, IP destination address, time of day or any other readily obtained parameter, the traffic type can be identified and tagged for processing by the firewall agent or another agent as it initially arrives. In other embodiments, as described herein, in the downstream case, the solution is generally more sophisticated when a traffic parameter that is needed to classify the manner in which the traffic flow is to be controlled or throttled is not readily available at the lower levels of the stack, such as association with an aspect of an application, type of content, something contained within TLS, IPSEC or other secure format, or other information associated with the traffic. Accordingly, in some embodiments the networking stack identifies the traffic flow before it is fully characterized, categorized or associated with a service activity, and then passes the traffic through to the application interface layer where the final classification is completed. In such embodiments, the application interface layer then communicates the traffic flow ID with the proper classification so that after an initial short traffic burst or time period the policy implementation agents can properly control the traffic. In some embodiments, there is also a policy for tagging and setting service control policies for traffic that cannot be fully identified with all sources of tagging including application layer tagging.


As shown in FIG. 12, a service monitor agent, which is also in communication with the agent communication bus 1630, communicates with various layers of the device communications stack. For example, the service monitor agent, performs monitoring at each of measurement points I through VI, receiving information including application information, service usage and other service related information, and assignment information. An access control integrity agent is in communication with the service monitor agent via the agent communications bus 1630, as also shown.



FIG. 13 illustrates an embodiment similar to FIG. 12 in which some of the service processor is implemented on the modem and some of the service processor is implemented on the device application processor in accordance with some embodiments. In some embodiments, a portion of the service processor is implemented on the modem (e.g., on modem module hardware or modem chipset) and a portion of the service processor is implemented on the device application processor subsystem. It will be apparent to one of ordinary skill in the art that variations of the embodiment depicted in FIG. 13 are possible where more or less of the service processor functionality is moved onto the modem subsystem or onto the device application processor subsystem. For example, such embodiments similar to that depicted in FIG. 13 can be motivated by the advantages of including some or all of the service processor network communication stack processing and/or some or all of the other service agent functions on the modem subsystem (e.g., and such an approach can be applied to one or more modems). For example, the service processor can be distributed as a standard feature set contained in a modem chipset hardware of software package or modem module hardware or software package, and such a configuration can provide for easier adoption or development by device OEMs, a higher level of differentiation for the chipset or modem module manufacturer, higher levels of performance or service usage control implementation integrity or security, specification or interoperability standardization, and/or other benefits.


Referring to FIG. 13, describing the device communications stack from the bottom to the top of the stack as shown, the device communications stack provides a communication layer for modem MAC/PHY layer at the bottom of the device communications stack. Measurement point IV resides above the modem MAC/PHY layer. The modem firewall layer resides between measurement points IV and III. In the next higher layer, the policy implementation agent is provided, in which the policy implementation agent is implemented on the modem (e.g., on modem hardware). Measurement point II resides between the policy implementation agent and the modem driver layer, which is then shown below a modem bus layer. The next higher layer is shown as the IP queuing and routing layer, followed by the transport layer, including TCP, UDP, and other IP as shown. The session layer resides above the transport layer, which is shown as a socket assignment and session management (e.g., basic TCP setup, TLS/SSL) layer. The network services API (e.g., HTTP, HTTPS, FTP (File Transfer Protocol), SMTP (Simple Mail Transfer Protocol), POP3, DNS) resides above the session layer. Measurement point I resides between the network services API layer and an application layer, shown as application service interface agent in the device communications stack of FIG. 13.



FIGS. 14A though 14E illustrate various embodiments of intermediate networking devices that include a service processor for the purpose of verifiable service usage measurement, reporting, and billing reports in accordance with some embodiments. For example, FIGS. 14A through 14E illustrate various extended modem alternatives for access network connection through an intermediate modem or networking device combination that has a connection (e.g., LAN connection) to one or more devices 100.


In some embodiments, device 100 includes a 3G and/or 4G network access connection in combination with the Wi-Fi LAN connection to the device 100. For example, the intermediate device or networking device combination can be a device that simply translates the Wi-Fi data to the WWAN access network without implementing any portion of the service processor 115 as shown in FIG. 14A. In some embodiments, an intermediate device or networking device combination includes a more sophisticated implementation including a networking stack and some embodiments a processor, as is the case for example if the intermediate networking device or networking device combination includes a router function, in which case the service processor 115 can be implemented in part or entirely on the intermediate modem or networking device combination. The intermediate modem or networking device combination can also be a multi-user device in which more than one user is gaining access to the 3G or 4G access network via the Wi-Fi LAN connection. In the case of such a multi-user network, the access network connection can include several managed service links using multiple instantiations of service processor 115, each instantiation, for example, being implemented in whole or in part on device 100 with the intermediate modem or networking device combination only providing the translation services from the Wi-Fi LAN to the WWAN access network.


Referring now to FIGS. 14B through 14D, in some embodiments, the service processors 115 are implemented in part or in whole on the intermediate modem or networking device combination. In the case where the service processor 115 is implemented in part or in whole on the intermediate modem or networking device combination, the service processor 115 can be implemented for each device or each user in the network so that there are multiple managed service provider accounts all gaining access through the same intermediate modem or networking device combination. In some embodiments, the functions of service processor 115 are implemented on an aggregate account that includes the WWAN access network traffic for all of the users or devices connected to the Wi-Fi LAN serviced by the intermediate modem or networking device combination. In some embodiments, the central provider can also provide an aggregated account service plan, such as a family plan, a corporate user group plan and/or an instant hotspot plan. In the case where there is one account for the intermediate modem or networking device combination, the intermediate modem or networking device combination can implement a local division of services to one or more devices 100 or users in which the services are controlled or managed by the intermediate modem or networking device combination or the device 100, but the management is not subject to service provider control and is auxiliary to the service management or service policy implementation performed by service processors 115. In some embodiments, another service model can also be supported in which there is an aggregate service provider plan associated with one intermediate modem or networking device combination, or a group of intermediate modems or networking device combinations but where each user or device still has its own service plan that is a sub-plan under the aggregate plan so that each user or device has independent service policy implementation with a unique instantiation of service processor 115 rather than aggregate service policy implementation across multiple users in the group with a single instantiation of service processor 115.


As shown in FIG. 14B, in some embodiments, device 100 includes a Wi-Fi modem, a Wi-Fi modem combined with a 3G and/or 4G WWAN modem on intermediate modem or networking device combination 1510, and the intermediate modem or networking device combination forwards WWAN access network traffic to and from device 100 via the Wi-Fi link. For example, the service processor 115 can be implemented in its entirety on device 100 and the service provider account can be associated exclusively with one device. Similarly, as shown in FIG. 14C, such an implementation can be provided using a different access modem and access network, such as a 2G and/or 3G WWAN, DSL wire line, cable DOC SIS wire line or fiber wire line configuration in place of the 3G and/or 4G access network connection to the intermediate modem or networking device combination 1510. In addition, various other embodiments similarly use DSL as shown in FIG. 14D, USB, Ethernet, Bluetooth, or another LAN or point to point connection from device 100 to the intermediate modem or networking device combination 1510, or a femto cell modem and DSL/cable/T1/other combination as shown in FIG. 14E.



FIG. 15 illustrates a wireless network architecture for providing device assisted CDR creation, aggregation, mediation and billing including a proxy server(s) 270 in accordance with some embodiments. As shown, FIG. 2 includes a proxy server(s) 270 in communication with a 4G/3G/2G wireless network operated by, for example, a central provider. For example, the proxy server(s) 270 can be used to implement and/or assist in providing various techniques described herein, such as service usage measurement and/or other techniques as described herein.


In some embodiments, it may not be possible to accurately identify every network service access attempt or service usage (e.g., or traffic access) as belonging to a given service usage partition (e.g., a given ambient service usage, background network chatter usage, user service plan usage, emergency service usage, and/or other type of service usage). As used herein, the terms service usage partition, service usage recording partition, service charging bucket, and micro-CDRs are used interchangeably. Accordingly, it is desirable to provide a service charging bucket for traffic that is allowed and not definitively identified as belonging to a known service charging bucket. This allows for techniques to employ an “allow but verify” approach to traffic that is likely to be legitimately associated with an ambient service or a user service or a network service that is intended to be allowed, but is not definitively identified as being associated with an allowed service.


As an example, there may be a web site access associated with an ambient service that does not have a reference identifier or other traffic parameter that allows the service processor to associate it with the correct ambient service. In this case, a set of rules can be applied to determine if it is likely that the web site access is a legitimate access given the access control policies that are in place, and if it is the access can be allowed and the traffic usage either recorded in the ambient service charging bucket that it is suspected to be associated with, or the traffic usage can be charged to a network chatter service usage bucket, or the traffic usage can be charged to the user service usage bucket, or the traffic usage may be recorded in a “not classified but allowed” service charging bucket. In some embodiments, in which such traffic is charged to the “not classified but allowed” service usage charging bucket, additional verification measures are employed to ensure that the amount of traffic that is not classified but allowed does not grow too large or become a back-door for service usage errors. For example, the access control policy rules for allowing unclassified traffic can be relatively loose as long as the amount of service usage charges accumulating in the not classified charging bucket remains within certain bounds, and/or the rate of service usage charged to the not classified bucket remains within certain bounds, but if the not classified traffic becomes large or the rate of not classified traffic growth becomes large then the rules governing when to allow not classified traffic can be tightened.


As another example, a browser application can access a web site that is known to be an ambient service website, and that web site might serve back a series of traffic flows, some of which are associated with the ambient service website through URL identifiers that are known to be part of the website, and other traffic can be associated with the ambient service website by virtue of a referring website tag or header, and some traffic can be returned to the same application with a relatively close time proximity to the other traffic as being identified as ambient traffic. In this example, as long as the not classified traffic service charging bucket does not exceed a given pre-set policy limit on its size, and/or does not grow faster than a given pre-set policy rate, and/or is received within a certain pre-set policy period of time difference from the time that other ambient service charging bucket traffic is received, then the not classified traffic is continued to be allowed. However, if the not classified traffic amount or rate of growth exceeds the pre-set policy limits, or if the period of time between when verified ambient service traffic is received and the not classified traffic is received exceeds policy limits, then the not classified traffic can be blocked or other action can be taken to further analyze the not classified traffic.


In some embodiments, it is important to provide a hierarchy of service usage charging rules for the various service usage partitions on a device. As an example, for a given service plan there can be two ambient service charging buckets, a network chatter (e.g., or network overhead) service charging bucket, and a user service plan service charging bucket and it is desirable to make sure that no ambient services or network overhead service or unclassified service is charged to the user service plan, and it is also desirable to ensure that all known ambient service traffic is charged to the appropriate ambient service partner, and it is desirable to ensure that no network overhead service or unclassified service is charged to ambient service partners. In such situations, a service charging bucket hierarchy can be provided as follows: determine if a traffic flow (e.g., or socket) is associated with network overhead, and if so allow it and charge that service bucket, then determine if a traffic flow (or socket) is associated with ambient service #1, and if so allow it and charge that service bucket, then determine if a traffic flow (or socket) is associated with ambient service #2, and if so allow it and charge that service bucket, then determine if a traffic flow (or socket) is associated with not classified traffic, and if so allow it and charge that service bucket, then if the traffic is not associated with any of the above service charging buckets allow it and charge it to the user service plan charging bucket. In another example, if the user has not yet chosen to pay for a user service plan, then the same hierarchical access control and service charging policy can be used except the final step would be: then if the traffic is not associated with any of the above service charging buckets block the traffic. Hierarchical service charging bucket identification such as depicted in these examples can be a crucial aspect of a robust access control policy and/or service charging policy system. Many other access control policy hierarchies and service charging bucket policy hierarchies will now be apparent to one of ordinary skill in the art.


In some embodiments, the not classified traffic is charged according to service charging rules that rely on the most likely candidate service charging bucket for the traffic. As another example, if the not classified traffic is being delivered to the same application as other known ambient service traffic and the time difference between delivery of the known ambient service traffic and the not classified traffic is small, then the not classified traffic can be charged to the ambient service in accordance with a pre-set charging policy rule specifying these conditions. Other embodiments that will now be apparent to one of ordinary skill in the art. For example, another charging rule for not classified traffic could be to perform a pro-rata allocation of the not classified traffic to all of the other service charging buckets with the pro-rata allocation being based on the percentage of the total traffic used by the device for each service charging bucket. As another example, the not classified traffic can be charged to a subset of the service charging buckets for the device (e.g., all ambient services plus the network overhead service) in accordance with the pro-rata share for each service included in the pro-rata split.


In some embodiments, the user service plan agreement is structured so that the user acknowledges that ambient services in which the access connection to the service is sponsored, paid for, and/or partially subsidized by an entity other than the user are a benefit to the user, and/or the user acknowledges that there is no inherent right to free ambient services, and that the service usage accounting system may not always properly characterize usage for a sponsored or subsidized ambient service (e.g., or some other specialized service) in the correct accounting service charging bucket, and, thus, the user service plan account can be charged and/or billed with some of this traffic. By having the user acknowledge a service use agreement of this form then some ambient traffic can be charged to the user service plan account, including, for example, allowed but not classified traffic, excess ambient service usage beyond pre-set policy limits, ambient service usage during busy network periods or on congested network resources, and/or other criteria/measures. In some embodiments, the user might be notified that they are being charged for service activities that are sometimes subsidized or free to the user. As discussed above, it is important to ensure that a not classified service charging bucket does not become a back door for service charging errors or hacking. It will now be apparent to one of ordinary skill in the art that the not classified service usage charges can be verified in a variety of manners, including, for example, observing the size of the not classified service charging bucket as compared to other service usage charges on the device (e.g., total device service usage, ambient service usage, user bucket service usage, and/or other criteria/measures), capping the not classified bucket, and/or capping the rate of growth of the not classified bucket.


In some embodiments, it is important to verify not only that the total device service usage amount is correct, but that the service usage is being reported in the proper service charging buckets. For example, if the service processor software can be hacked so that it correctly reports the total service usage, but reports user service plan traffic under one or more ambient service buckets, then simply verifying that the total amount of service usage is correct will not be sufficient to prevent the device from obtaining free user service that can be charged to ambient service partners. There are a variety of direct and indirect embodiments to accomplish this verification of service charging bucket divisions. For example, in direct verification embodiments, one or more alternative measures of service usage are employed to cross-check the accuracy of the service charging bucket divisions. In indirect embodiments one of two classes of verification are employed: the size and rate of growth for service charging buckets is analyzed and compared to a pre-set group of policies to detect and/or modify service charging bucket growth that is out of policy; and/or the proper operation of the service processor elements involved in service charging bucket partitioning is verified.


Various embodiments involving direct verification of service charging bucket usage and/or accounting include the use of network based service usage measures such as CDRs, IPDRs, flow data records (e.g., FDRs—detailed reports of service usage for each service flow, such as network socket connection, opened and used to transmit data to or from the device), accounting records, interim accounting records or other similar usage records to verify that the device is within service policy and/or the device based service usage reports are accurate. Use of such network generated service usage records to directly verify service charging and/or proper service usage policy adherence are described herein. When network address destination and/or source information is available in these records, as described herein, this can be used in some embodiments to verify the service charging bucket accounting provided by the device service processor. In some embodiments, some types of service usage records include real-time data but not necessarily all of the useful information needed to help verify service charging bucket accounting, while other types of service usage records provide more detail (e.g., IP address for destination and source) but do not always arrive in real-time. For example, in some embodiments, FDRs are created each time a new service flow (e.g., network socket connection) is opened and then closed. At the time the service flow is closed, a (e.g., possibly time stamped) data usage record indicating source address, destination address and amount of data transmitted is created and sent to a charging aggregation function in the network. The charging aggregation function can then forward the FDRs to the service controller for verification or direct accounting of service charging bucket accounting. By comparing the FDR addresses with known ambient service traffic address associations, the partitioning of service charging buckets between one or more ambient services and other services such as a user service plan service charging bucket may be verified. However, in some cases it can be a long period of time for an FDR to be generated when a device service flow (e.g., socket) remains open for a long period of time, as in the case for example with a long file download, a peer to peer connection with a socket keep alive, or a proxy server service with a socket keep alive. In such cases, it can be disadvantageous to have large amounts of data to be transferred without an FDR to confirm device service processor based reports, and in some cases this can provide an opportunity for service processor service reporting hacks. This can be remedied in a variety of ways by using other network reported service usage information to augment the FDR information. For example, start and stop accounting records can sometimes be obtained in some embodiments from a network element such as a service gateway or the AAA servers (e.g., or other network equipment elements depending on the network architecture). Although start and stop records do not possess the detail of service usage information that FDRs, CDRs, IPDRs, interim accounting records or other service usage records posses, they do inform the service controller that a device is either connected to the network or has stopped connecting. If a device is connected to the network and is not transmitting device usage reports or heartbeats, then the service controller is alerted that an error or hacking condition is likely. As another example of how two or more types of network reported service usage information may be used to create a better real time or near real-time check on device service usage, if both FDRs and start/stop accounting records are available, the service controller can send a stop-then-resume service command to the device (e.g., or alternatively send a stop then resume service command to a network equipment element), which will cause the device to terminate all open service flows before re-initiating them, and once the service flows are stopped then the FDR flow records will be completed and transmitted for any service flows that were in process but unreported when the stop service command was issued. This will cause any long term open socket file transfers to be reported in the FDR flow records thus plugging the potential back door hole in the FDR service usage accounting verification method.


As another example showing how multiple types of network generated service usage accounting records may be used to complement each other and strengthen the verification of service charging bucket accounting partitions, interim data records can be used with FDRs. Interim data records are available in accordance with some embodiments, n which the interim data records are generated on a regularly scheduled basis by a network element (e.g., gateway, base station, HLR, AAA, and/or other network element/function). Interim data records are typically near real time records that report the aggregate traffic usage for the device as of a point in time, but often do not include traffic address information or other traffic details. In embodiments in which both interim accounting records and FDRs are available, when the interim accounting records are indicating service usage that is not being reported in the FDR stream this is evidence that a device has one or more long term socket connections that are open and are not terminating. In this case, the service controller can verify that the device based usage reports are properly accounting for the total amount of service usage reported by the interim accounting records, and/or the service controller can force an FDR report for the open sockets by issuing a stop-resume service command as similarly discussed above.


As described herein, other embodiments involving direct verification of service charging bucket accounting can be provided. One example is to route ambient service traffic to a proxy server or router programmed to support only the network access allowed for the ambient service and to account for the ambient service usage. Additional proxy servers or routers can be similarly programmed for each ambient service that is part of the device service plan, and in some embodiments, another proxy server or router is programmed to support traffic control and account for the user service plan service access. By comparing the service usage accounting for each of these proxy servers or routers, the device generated service charging bucket accounting can be directly verified. In some embodiments, the usage accounting provided by the proxy servers or routers is used directly for service usage accounting.


In some embodiments, ambient service partner feedback is used to verify service charging bucket accounting. For example, web servers used by ambient service partners to provide ambient services can identify a user device based on header information embedded in the HTML traffic, and then account for either the service used by the device during the ambient service sessions or account for the number of transactions the user completes. If service usage is recorded, then it can be reported to the service controller and be used directly to verify ambient service charging bucket accounting. If transactions are all that are recorded, then this can be reported to the service controller and the amount of ambient service used by the device can be compared with the number of transactions completed to determine if the ambient service usage is reasonable or should be throttled or blocked. It will now be apparent to one of ordinary skill in the art that other embodiments can be provided that employ more than one type of network generated service usage records to verify service usage accounting and/or verify service charging bucket accounting.


Other embodiments involving indirect methods for verifying or controlling service charging bucket accounting include monitoring the size and/or growth rate of ambient service usage. In some embodiments, the access control policy rules call for restricting a given ambient service access when the amount of service usage charges accumulating in the ambient service charging bucket exceed a pre-set policy limit, and/or when the rate of service usage for the ambient service exceeds a pre-set policy limit. For example, once these limits are reached, the ambient service can be throttled back for a period of time, blocked for a period of time, or charged to the user service plan charging bucket. In some embodiments, before these actions are taken the user UI can be used to notify the user of the service policy enforcement action. In some embodiments, indirect verification of service charging bucket accounting includes the various techniques described herein for verifying proper operation of the service processor agent software and/or protecting the service processor agent software from errors, manipulation, or hacking.


In some embodiments, the device service processor directs traffic destined for a given ambient service to a proxy server or router programmed to support that ambient service, and any traffic control policies and/or access control policies for the ambient service are implemented in the proxy server or router. For example, in such embodiments the proxy server or router can be programmed to only allow access to one or more ambient services that are authorized by the device service plan, with the proxy server or router controlling device access so that other network destinations cannot be reached. Continuing this example embodiment, the proxy server or router can account for the ambient service usage in an ambient service charging bucket as discussed elsewhere. In such proxy server or router ambient service control embodiments, the same traffic association techniques described elsewhere that allow incoming traffic associated with an ambient service website or other service to be identified, allowed or blocked, potentially throttled, and accounted for in a service charging bucket can be implemented in the proxy server or router programming. Such proxy server or router embodiments can also implement user service plan service charging buckets, user service plan traffic controls, and user service plan access control as discussed herein. In some embodiments, the proxy server or router analyzes the HTML traffic content of the traffic flows as described herein to perform such associations, traffic control and/or service usage accounting. Similarly, in some embodiments, a proxy server or router can provide the “surf-out” capabilities described herein by performing the same surf-out traffic associations (e.g., HTML branch reference associations and/or other branch associations) described herein. It will now be apparent to one of ordinary skill in the art that many of the adaptive ambient service control and service usage charging functions described herein for a service processor can be readily implemented with a proxy server or router that is appropriately programmed.


In some embodiments, routing of device traffic for one or more ambient services and/or user service plan services to a proxy server or router is accomplished by the device service processor using the device service processor traffic control embodiments described herein. In some embodiments, routing of device traffic for one or more ambient services and/or user service plan services to a proxy server or router is accomplished by dedicated network equipment such as the gateways (e.g. SGSN, GGSN, PDSN, or PDN), home agents, HLRs or base stations, with the network equipment being provisioned by a service controller (e.g., or other interchangeable network element with similar functions for this purpose) to direct the device traffic to the proxy server or router. In some embodiments, the ambient service traffic or the user service plan traffic is controlled by the proxy server according to a service plan policy set supplied by the service controller (e.g., or equivalent network function for this purpose). The traffic control service policy thus implemented by the proxy server can control traffic based on one or more of the following: period of time, network address, service type, content type, application type, QoS class, time of day, network busy state, bandwidth, and data usage.


In some embodiments, a proxy server or router is used to verify accounting for a given service, for example, an ambient service. In some embodiments, this is accomplished by the device service processor directing the desired service flows to a proxy server or router programmed to handle the desired service flows, with the proxy server or router being programmed to only allow access to valid network destinations allowed by the access control policies for the desired service, and the proxy server or router also being programmed to account for the traffic usage for the desired services. In some embodiments, the proxy service usage accounting may then be used to verify device based service usage accounting reported by the service processor. In some embodiments, the accounting thus reported by the proxy server or router can be used directly to account for service usage, such as ambient service usage or user service plan service usage.


In some embodiments, in which a proxy server is used for device service usage accounting, the proxy server maintains a link to the device service notification UI via a secure communication link, such as the heartbeat device link described herein. For example, the proxy server or router can keep track of device service usage versus service plan usage caps/limits and notify the user device UI through the device communication link (e.g., heartbeat link) between the service controller and the device. In some embodiments, the proxy server/router communicates with a device UI in a variety of ways, such as follows: UI connection through a device link (e.g., heartbeat link), through a device link connected to a service controller (e.g., or other network element with similar function for this purpose), presenting a proxy web page to the device, providing a pop-up page to the device, and/or installing a special portal mini-browser on the device that communicates with the proxy server/router. In some embodiments, the UI connection to the proxy server/router is used as a user notification channel to communicate usage notification information, service plan choices, or any of the multiple services UI embodiments described herein.


In some embodiments for the proxy server/router techniques for implementing service traffic/access controls and/or service charting bucket accounting, it is desirable to have the same information that is available to the service processor on the device, including, for example, application associated with the traffic, network busy state, QoS level, or other information about the service activity that is available at the device. For example, such information can be used to help determine traffic control rules and/or special services credit is due (e.g., ambient services credit). In some embodiments, information available on the device can be communicated to the proxy server/router and associated with traffic flows or service usage activities in a variety of ways. For example, side information can be transmitted to the proxy server/router that associates a traffic flow or service activity flow with information available on the device but not readily available in the traffic flow or service activity flow itself. In some embodiments, such side information may be communicated over a dedicated control channel (e.g., the device control link or heartbeat link), or in a standard network connection that in some embodiments can be secure (e.g., TLS/SSL, or a secure tunnel). In some embodiments, the side information available on the device can be communicated to the proxy server/router via embedded information in data (e.g., header and/or stuffing special fields in the communications packets). In some embodiments, the side information available on the device can be communicated to the proxy server/router by associating a given secure link or tunnel with the side information. In some embodiments, the side information is collected in a device agent or device API agent that monitors traffic flows, collects the side information for those traffic flows, and transmits the information associated with a given flow to a proxy server/router. It will now be apparent to one of ordinary skill in the art that other techniques can be used to communicate side information available on the device to a proxy server/router.


For example, just as the hierarchy of charging rules can be important for implementations in which the service processor is creating the service charging bucket accounting, it can also important in implementations that use a proxy server or router for service charging bucket accounting. Accordingly, various embodiments described herein for creating a hierarchy of service usage charging rules can be applied to proxy server or proxy router embodiments. It will be apparent to one of ordinary skill in the art that the service charging bucket embodiments and traffic control and access control embodiments described herein for allowed but not classified buckets apply equally to the proxy server/router embodiments. For example, pre-defined service policy rules can be programmed into the proxy server/router to control the traffic flows and/or place usage limits or access limits on an ambient service, or a user service plan service. It will also now be apparent to one of ordinary skill in the art that the embodiments described herein disclosing an initial allowed service access list, temporarily allowing additional service activities until they are determined to be allowed or not allowed, expanding the allowed service activity list, maintaining a not allowed service activity list and expanding the not allowed service activity list also apply equally to proxy server/router embodiments. Similarly, it will now be apparent to one of ordinary skill in the art that the proxy/server router embodiments can be employed to directly generate the service charging bucket (or micro-CDR) usage reports used to provide further detail and/or billing capabilities for service usage. In some embodiments, in which the device service processor directs traffic to a proxy server/router, there are advantageous design feature embodiments available that can reduce the need to provision network to detect and force specialized device service traffic to the appropriate proxy server/router. For example, this can be done by creating a “usage credit” system for the services supported by the proxy server/outer. Total service usage is counted on the one hand by the device service processor, or by other network equipment, or by both. Credit on the other hand for ambient service or other specialized access service usage that is not charged to the user is then provided for services that the device directs through the proxy server/router destination (e.g., URL or route hop) supporting the particular ambient service or other specialized access service. If the device correctly directs traffic to the proxy server/router, then the counting and/or access rules are correctly implemented by the proxy server/router. The service can be thus controlled and/or accounted for. When the service is accounted for, the proxy server/router reports the service charging bucket accounting back to the service controller (e.g., or other network equipment responsible for service charging bucket/micro CDR mediation) and the user service plan service charging bucket account can be credited for the services. Traffic that reaches the proxy server/router is controlled by the access rules and/or traffic control rules and/or QoS control rules of the proxy server/router programming, so there is no question regarding the type of service that is supported with the service charging buckets that are reported to mediation functions (e.g., mediation functions can be performed by one or more of service controller, usage mediation, billing, AAA, and/or HLR/home agent). As the proxy server/router is in the network and can be physically secured and protected from hacking, there is high confidence that the service control and/or charging rules intended for ambient services or some other specialized service are properly implemented and that the proxy server/router connection is being used for the intended service and not some other unintended hacked service. If the device is somehow hacked or otherwise in error so that the traffic is not directed through the appropriate proxy server/router, then the proxy server/router does not log the traffic in micro CDRs/buckets and no specialized service usage credit is sent to the mediation functions, so there is no usage credit deducted from the device user service plan service usage totals. Thus, the user pays for the services when the device is hacked to avoid the proxy server/router. The user account service agreement can specify that if the user tampers with software and traffic is not routed to servers then credit will not be provided and user plan will be charged.


In some proxy server/router embodiments, the usage credit is sometimes recorded by the proxy server/router detecting which device is performing the access. Device identification can be accomplished in a variety of ways including a header/tag inserted into the traffic by the device, a route in the network specified for that device, a secure link (e.g., TLS/SSL, IP Sec, or other secure tunnel), a unique device IP address or other credential (e.g., where proxy server/router has access to an active IP address look up function), a unique proxy server/router address and/or socket for the device.


In some embodiments, the coordination of the device service controller traffic control elements with a proxy server/outer can make it simpler to locate, install, provision and operate the proxy servers. The proxy server/routers do not need to be located “in line” with the access network because it is the device's responsibility to make sure the traffic is routed to the servers/routers or else there is not credit and the user account is charged. In some embodiments, this makes it unnecessary or reduces the need to force device traffic routes in carrier network. In some embodiments, the proxy server/routers can be located in carrier network or on the Internet. If the proxy server/routers are on Internet, then traffic can be authenticated in a firewall before being passed to server/routers to enhance security to attack.


In some embodiments, the service charging bucket recording software in the proxy server/router can be programmed into an ambient service partners network equipment directly thus eliminating the need for special apparatus. The ambient service partner's equipment (e.g., a web server, load balancer or router) can recognize the device using one of the techniques described above, aggregate the device service charging bucket accounting, and periodically send the usage accounting to the service controller or other network service usage mediation function.


Programming and/or provisioning the types of ambient services, user service plan services and/or specialized services disclosed in various embodiments described herein can be a complex process. In some embodiments, a simplified user programming interface, also referred to herein as a service design interface, is used to program the necessary policy settings for such services is desirable. For example, a service design interface is provided that organizes and/or categorizes the various policy settings that are required to set up an ambient service (e.g., or other service) including one or more of the following: a policy list of service activities that are allowed under the ambient service (e.g., or other service), access control policies, rules for implementing and/or adapting an allowed list of network destinations, rules for implementing and/or adapting a blocked list of network destinations, service charging bucket policies, user notification policies, service control, and/or service charging bucket verification policies, actions to be taken upon verification errors. In some embodiments, the required information for one or more of these policy sets is formatted into a UI that organizes and simplifies the programming of the policies. In some embodiments, the UI is partly graphical to help the user understand the information and what settings need to be defined in order to define the service. In some embodiments, the UI is created with an XML, interface. In some embodiments, the UI is offered via a secure web connection. In some embodiments, a basic service policy for an ambient service (e.g., or another service) is created that includes one or more of the above service policy settings, and then this service policy set becomes a list or an object that can be replicated and used in multiple service plan policy set definitions (e.g., “dragged and dropped” in a graphical UI). In some embodiments, the resulting set of policies created in this service design interface are then distributed to the necessary policy control elements in the network and/or on the device that act in coordination to implement the service policy set for a given device group. For example, if a service processor is used in conjunction with a service controller, then the service design interface can load the service policy settings subsets that need to be programmed on the service controller and the device service processor into the service controller, and the service controller loads the service controller policy settings subset into the service controller components that control the policies and loads the device policy settings subset to the devices that belong to that device group. In embodiments in which a proxy server/router is used to help control and account for services, in some embodiments, the service design interface loads the service policy settings subsets that need to be programmed on the proxy server/router into the proxy server/router. In embodiments where other network equipment (e.g., gateways, base stations, service usage recording/aggregation/feed equipment, AAA, home agent/HLR, mediation system, and/or billing system) need to be provisioned or programmed, in some embodiments, the service design interface also loads the appropriate device group policy subsets to each of the equipment elements. Accordingly, various techniques can be used as described herein to greatly simplify the complex task of translating a service policy set or service plan into all the myriad equipment and/or device settings, programming, and/or provisioning commands required to correctly implement the service. It will now be apparent to one of ordinary skill in the art that several of these techniques can similarly be used for the VSP service design interface.


Those of ordinary skill in the art will appreciate that various other rules can be provided for the rules engine as described herein. Those of ordinary skill in the art will also appreciate that the functions described herein can be implemented using various other network architectures and network implementations (e.g., using various other networking protocols and corresponding network equipment and techniques).


In device-assisted service (DAS) systems, end-user device agents can assist the network in policy implementation or enforcement. For example, device agents can assist the network in recordkeeping to allocate costs when end-user devices access data services over an access network, enforcing access control or service limit policies for the device, enforcing usage limits, or assisting in notification policies for information regarding network access services that are in communication with the device end user. If a device is configured with a device agent configured to assist the network in policy implementation or enforcement, there may be a device portion of a network policy that is enforced on the device and a network portion of an access network service policy that is enforced by network elements in the network. In some access networks, network-based systems are employed to implement the network portion of the access network service policy, such as, for example, to manage the authentication process of allowing a device onto a network or to determine one or more network policies that should be enforced by the network elements such as access control policy, service usage limits, service usage accounting or billing policy, or service usage notification policy.


To achieve an overall network service policy, the network portion of the access network service policy may be configured to work in conjunction with the device-based portion of the access network service policy to achieve an overall combined network service policy. If the device agents required to implement the device portion of the access network service policy are not present on the device or are not properly configured, then the overall combined network service policy can be in error or may not be possible to achieve, potentially resulting in an undesired network service policy implementation. In such cases, it is desirable for a network system to be employed to detect this condition and modify the network portion of an access network service policy enforced by the network-based elements so that a desired network service policy enforcement may be achieved.


In some embodiments, a device agent that can assist the network in policy implementation or enforcement may be termed a “device policy implementation agent,” which in some embodiments may be part of the service processor.


Examples of when it may be advantageous to adapt the network portion of an access network service policy in order to account for a missing or improperly configured service processor include but are not limited to: (i) a device credential has been moved to a device that does not have a service processor, (ii) a device credential has been moved to a device with a service processor with a different configuration than the service processor originally associated with the device credential, (iii) a device service processor has been tampered with or has an improper configuration.


In some embodiments, the service processor is used to assist in classifying service usage into sub-categories for the purpose of usage accounting policy enforcement, access control policy enforcement, service usage limits, or notification policy enforcement that differs according to the category. In some embodiments, the classification can be for one or more device applications. In some embodiments the classification can be for one or more network destinations. In some embodiments the classification can be for one or more network types. In some embodiments a classification of service usage (herein referred to as a sponsored service or an ambient service) can be performed to facilitate allocating access network costs, in whole or in part, associated with the sponsored or ambient service to a service sponsor, the service sponsor being an entity other than the device user.


What is needed is a network system that detects the presence and proper configuration of a service processor, or lack thereof, in the end-user device, wherein the service processor, if present, enforces a device portion of an access network service policy on a device configured with a device credential, and, if the service processor is present and properly configured, that causes a first network portion of an access network service policy to be enforced in the network, the first network portion of an access network service policy being configured to provide counterpart policy enforcement to a device portion of an access network service policy to achieve a first desired overall access network service policy; and if the service processor is not present and properly configured, that causes a second network portion of an access network service policy to be enforced in the network that is configured to operate without a device counterpart policy to achieve a second desired overall access network service policy.


In some embodiments, a network system is used to detect when unscrupulous users attempt to acquire free data services by tampering with a service processor in order to use one service and have the service usage accounting allocated to a second service that is sponsored. For example, if a device sends reports of its data usage to the network, a user might attempt to hack the device so that its reports contain information that is more favorable to the user than it should be, e.g., by reporting less data usage than the device actually used. As another example, a device may contain a “sponsored SIM” card or another credential that allows the device to use a fixed amount of data, possibly associated with a particular service, at a reduced charge or at no charge to the user. Unscrupulous users may attempt to find ways to increase their quantity of free or subsidized data usage with sponsored SIM cards.


Bandwidth limitations in the wireless access network are making unlimited data plans less attractive to service providers. At the same time, users of end-user devices want to have more control over their devices' data usage to control costs. The ability to track a device's data usage with high accuracy, on a more granular level than simply by measuring aggregate data usage, is an important enabler new service offerings that meet both of these needs. For example, accurate tracking of a device's data usage on a service-by-service or application-by-application basis, or on even finer levels, will allow service providers to offer a la carte service plans that allow users to choose customized application- or service-specific data plans.


Therefore, there is a need for security measures to prevent policy errors caused by changing device credentials, improper configuration of a service processor, or fraud in DAS systems. In particular, there is a need for tools that allow the network to detect fraudulent end-user device activity.


Disclosed herein are various embodiments to prevent, detect, or take action in response to moving a device credential from one device to another, improper configuration of a service processor, a missing service processor, or tampering with a service processor in device-assisted services (DAS) systems.


In some embodiments, the service controller in the network authenticates the service processor and checks that it is reporting the end-user device's usage in the expected manner, e.g., at expected times, including expected information, with expected indicia of authenticity, etc.


In some embodiments, when the end-user device reports usage, the service controller checks whether the reports sent by the service processor are consistent with reports from a trusted source, such as a network element.


In some embodiments, when the service controller detects fraudulent or potentially fraudulent activities, the service controller notifies a network administrator or network resource, which can then further evaluate the situation and decide how to respond. In some embodiments, the subscriber's billing rate is increased.


In some embodiments, a device client configured to implement a device portion of a network access service policy (e.g., an access control policy or traffic control policy, a device software or operating environment security policy, a service usage limit, a service accounting or charging policy, a service notification policy, or another policy) may be termed a “device policy implementation client,” which in some embodiments may be part of the service processor. Also without loss of generality, the term “service controller” may be used to refer to a service processor authentication and management system. Both the service processor and service controller may have functions in addition to those described herein.


In some embodiments, a device is configured with a properly configured service processor responsible for implementing or enforcing a device portion of a first access network service policy. In some embodiments, the device is configured without a properly configured service processor. In some embodiments, a service controller can be configured to determine whether the service processor is present on the device and, if so, whether it is properly configured.


In some embodiments, if the service controller determines that the device is configured with a properly configured service processor, the service controller causes a network based access network service policy enforcement system to implement or enforce a first network-based portion of the first access network service policy. In this case, because the service controller has verified that a properly configured service processor is present on the device, the service controller system operates under the premise that the device is properly implementing or enforcing the device portion of the first access network service policy. If, however, the service controller determines that a properly configured device service processor is not present on the device, the service controller causes a network-based access network service policy enforcement system to implement or enforce a second network based portion of the first access network service policy. In this case, the service controller system operates under the premise that the device is not properly implementing or enforcing a device portion of an access network service policy.


In some embodiments, an end-user device is configured with: (1) a wireless modem to connect to a wireless access network (or another network access modem to connect to another type of access network); (2) one or more device credential sources (e.g., a SIM card, a soft-SIM, a universal SIM, an IMSI source, a wireless modem, a phone number source, an IMEI source, an MEID source, a user password or PIN, a MAC address source, an IP address source, a secure device identifier source, a device secure communication encryption key source, etc.) that store a device credential and provide the device credential to one or more network service policy enforcement elements (e.g., AAA, HLR, PCRF, access network authentication system, admission system or log-in system) for the purpose of seeking or gaining admission to the wireless access network (or other access network); and (3) a service processor (e.g., a device client) configured to implement or enforce a device-based portion of a wireless access network service policy and communicate with a network-based service controller in order to provide service processor authentication information configured to allow verification that the service processor is present and properly configured on the device.


In some embodiments, a network-based system is configured with: (1) one or more network-based device authentication or admission elements (e.g., AAA, HLR, PCRF, access network authentication system, admission system, log-in system, etc.) configured to receive a device credential from an end-user device that is attempting to receive or is receiving access network services; (2) one or more service policy enforcement elements (e.g., a network gateway, router, GGSN, SGSN, proxy, charging element, notification trigger element, etc.) configured to implement an access network service policy that is associated with the device credential; (3) a service processor authentication and management system (e.g., a service controller) configured to receive service processor authentication information and use the information to verify that the service processor is present and properly configured on the device. In some embodiments, the service processor authentication and management system is further configured to: (a) in the event that the service processor is present and properly configured on the device, cause the access network service policy that is associated with the device credential to be executed as a first network portion of an access network service; or (b) in the event that the service processor is not present on the device and properly configured, cause the access network service policy that is associated with the device credential to be executed as a second network portion of an access network service.


Without loss of generality, in the following related embodiments the terms, “SIM card” and “SIM” are used to represent a device credential source. As would be appreciated by one of ordinary skill in the art, other device credential sources (e.g., a soft-SIM, a universal SIM, an IMSI source, a wireless modem, a phone number source, an IMEI source, an MEID source, a MAC address source, an IP address source, a secure device identifier source, a device secure communication encryption key source, etc.) can be interchanged with SIM card in many of the embodiments. For example, in embodiments in which a SIM card is moved from one device to another, another type of device credential could be moved instead (e.g., soft SIM, universal SIM, an IMSI source, a wireless modem, a phone number source, an IMEI source, an MEID source, a MAC address source, an IP address source, a secure device identifier source, a device secure communication encryption key source, etc.). As another example, when a user tampers with a service processor associated with a SIM, the user could be tampering with a service processor associated with another type of device credential (e.g., soft SIM, universal SIM, an IMSI source, a wireless modem, a phone number source, an IMEI source, an MEID source, a MAC address source, an IP address source, a secure device identifier source, a device secure communication encryption key source, etc.). There are many other example embodiments where the term “SIM” can be exchanged for another source of device credentials, with the embodiments being too numerous to list and yet evident to one of ordinary skill in the art in the context of the teachings herein.


In some embodiments, the one or more device credential sources include a SIM card. In some embodiments, the service controller can be configured to recognize which device or service processor the SIM is associated with, use the SIM and device association to look up a desired device portion of a wireless access network service policy, and communicate the policy to the appropriate device service processor. In some embodiments, the two different device portions of a wireless access network policy are determined according to a device group or user group service policy definition that includes one or more SIM credentials and/or one or more service processor credentials, and these policy definitions are entered in a virtual service provider work station that manages the service controller and/or device service processor policies.


In some embodiments, the service controller is configured to recognize when the SIM card from a first device with a first service processor has been moved to a second device with a second service processor. In some such embodiments, the service controller can be configured to recognize which device or service processor the SIM is associated with, use the SIM and device association to look up a desired network portion of a wireless access network service policy, and cause the network portion of a wireless access network service policy to be implemented or enforced in one or more network service policy enforcement elements. In some embodiments, the two different network portions of a wireless access network policy are determined according to a device group or user group service policy definition that includes one or more SIM credentials and/or one or more service processor credentials, and these policy definitions are entered in a virtual service provider work station that manages the service controller and/or network service policy enforcement element policies.


In some embodiments, the one or more device credential sources include a SIM card. In some embodiments, the service controller is configured to detect when a device user has moved the SIM card from a first device configured with a properly configured service processor to a second device that is not configured with a properly configured service processor. In some embodiments, the service controller can be configured to determine that the first device is configured with a properly configured service processor and communicate a device portion of a wireless access network service policy to the appropriate device service processor. In some embodiments, the device portion of a wireless access network policy is determined according to a device group or user group service policy definition that includes a SIM credential and/or a service processor credential, and these policy definitions are entered in a virtual service provider work station that manages the service controller and/or device service processor policies. In some embodiments, the service controller is configured to determine that the first device is configured with a properly configured service processor and cause a first network portion of a wireless access network service policy to be implemented or enforced in one or more network service policy enforcement elements. In some embodiments the service controller is configured to determine that the second device is not configured with a properly configured service processor and cause a second network portion of a wireless access network service policy to be implemented or enforced in one or more network service policy enforcement elements. In some embodiments, the device portion of a wireless access network policy is determined according to a device group or user group service policy definition that includes a SIM credential, and these policy definitions are entered in a virtual service provider work station that manages the service controller and/or network service policy enforcement element policies.


In some of these embodiments, the differences between the first network portion of a wireless access network service policy and the second network portion of a wireless access network service policy can include a difference in network access privileges, a difference in allowable network destinations, a difference in service usage accounting or billing for “bulk” access, a difference in service usage accounting or billing for a classification of access, a difference in service usage accounting rates or billing rates for “bulk” access, a difference in service usage accounting rates or billing rates for a classification of access, a difference in sponsored (ambient) service accounting or billing, a difference in service speed or quality, a difference in which networks the device or user has access to, a difference in the service usage notification that is provided to the end user, a difference in roaming service policies or permissions or accounting/billing rates, a quarantining of the device or user access capabilities, differences between (e.g., disabling or otherwise modifying) one or more features of device operation, or suspending the device from access to the network.


In some embodiments, a SIM and a service processor are associated with a classification of service usage and a corresponding device portion of access network service policy enforcement. The service controller is then responsible for properly authenticating the proper configuration of the service processor in association with the SIM in order to determine the appropriate network portion of network access service policy that should be enforced.


In some embodiments, a SIM and a service processor are associated with one or more application-specific services wherein the device network access service has policy elements that are specific to a device software or firmware application. A software or firmware application-specific service can include but is not limited to a service with specific policy elements associated with a user application program; an operating system program, library or function; a background application service such as an application update, content caching, software update or other background application service.


In some embodiments, a SIM and a service processor are associated with one or more network-destination-specific services wherein the device network access service has policy elements that are specific to a network destination or resource. A network destination or resource can include but is not limited to a server, gateway, destination address, domain, website or URL.


In some embodiments, a SIM and a service processor are associated with any combination of a device application, network destination or resource; a type of network; a roaming condition (e.g., a home or roaming network); a time period; a level of network congestion; a level of network quality-of-service (QoS); and a background or foreground communication.


In some embodiments, a SIM and a service processor are associated with one or more sponsored services (also referred to herein as ambient services), wherein a portion or all of the service usage accounting for one or more classifications of service usage are accounted to, charged to, or billed to a service sponsor rather than the device user or party who pays for the user service plan. The portion of service that is sponsored can be all of the device access or a portion or classification of the device access. In some embodiments, the classification of the sponsored portion of service (e.g., the identification of the portion of the device's use of the access network that should be allocated to the service sponsor) is accomplished on the device with a service processor. In some embodiments, the classification of the sponsored portion of service is accomplished in the network using DPI elements, gateway elements, server elements, proxy elements, website elements or web service elements. In some embodiments, the classification of the sponsored portion of service is accomplished with a classification policy implemented by a combination of a service processor on the device (e.g., steering a classification of service to a given network element via a re-direction, re-route, or tunnel [e.g. secure SSL, VPN, APN or other tunnel protocol]) and one or more network elements (e.g., DPI elements, gateway elements, server elements, proxy elements, website elements or web service elements). In some embodiments, the portion of service that is sponsored includes service for one device application or a group of device applications. In some embodiments, the portion of service that is sponsored includes service for a network destination or resource, a server or website, or a group of network destinations, servers or websites. In some embodiments, the portion of service that is sponsored includes service on a specific type of network. In some embodiments, the portion of service that is sponsored includes service on a home network or a roaming network. In some embodiments, the portion of service that is sponsored includes service during a time period. In some embodiments, the portion of service that is sponsored includes service for a certain range of network congestion. In some embodiments, the portion of service that is sponsored can include service for a certain range of network QoS. In some embodiments, the portion of service that is sponsored includes service for a network background or foreground data communication. In some embodiments, the portion of service that is sponsored includes any combination of device application, network destination or resource, a type of network, a roaming condition (e.g., home or roaming network), a time period, a level of network congestion, a level of network QoS, and a background or foreground communication.


In some embodiments, a SIM (or other source of user credential or device credential, as explained previously) is installed in or present in association with a device configured with a device service processor configuration that provides access network policy enforcement. In such embodiments, one or more network elements can implement or enforce a network-based portion of access network policy enforcement, and the device service processor can be configured to implement or enforce a device-based portion of access network policy enforcement. In some embodiments, one or more SIM credentials can be used at least in part to identify the network-based portion of access network policy. In some embodiments, one or more SIM credentials can be used at least in part to identify the device-based portion of access network policy.


In some embodiments that include a SIM module policy association, the policy enforcement includes one or more of access control policy enforcement, service usage limit, access accounting policy enforcement, and access service user notification policy enforcement. In some embodiments, the access control policy enforcement includes one or more of allowing, limiting, blocking, deferring, delaying or traffic shaping device network access for “bulk” access (e.g., “not classified” access), or one or more specific classifications of access network service activities. In some embodiments, the access accounting policy enforcement includes one or more of counting an amount of “bulk” (e.g., “unclassified”) access network service usage, or counting an amount of access network service usage for one or more specific classifications of access network service activities. In some embodiments, the access service notification policy enforcement includes one or more of notifying an end user when a pre-defined service usage condition occurs for “bulk” (e.g. “unclassified”) access network service usage or notifying an end user when a pre-defined service usage condition occurs for one or more specific classifications of access network service activities. Examples of specific classifications of access network service activities include access by an application or OS function, access to one or more network destinations or network resources (such as a web site, domain, IP address or other address identifier, URL, socket tuple, network server, network route or APN, network gateway or proxy, network content source or sub-network). Additional examples of specific classifications of access network service activities include device access to network services with different QoS service levels. In some embodiments, a portion of the policies associated with specific classifications of access network service are implemented or enforced with a device-based service processor, and other portions of access network service policy are enforced in one or more network-based elements.


In some embodiments in which one or more network elements implement or enforce a network-based portion of access network policy enforcement and a device service processor is configured to implement or enforce a device-based portion of access network policy enforcement, one or more device SIM credentials are identified and used at least in part to determine the policies enforced by the network. In such embodiments, the device service processor can be relied upon to implement or enforce certain aspects of access network service policy that are not implemented or enforced in the network.


In some embodiments, a first portion of access network service policy is determined at least in part by one or more SIM credentials and is implemented by one or more network elements, and a second portion of access network service policy is intended to be implemented by a device-based service processor, but the SIM is installed in a device that is not configured with a service processor capable of implementing the second portion of access network service policy. In some such embodiments, a network element identifies whether the SIM is installed in a device that is configured with a service processor capable of implementing the second portion of access network service policy intended to be implemented on the device. In some embodiments, the identification is accomplished by a network system that implements one or more of the following device configuration detection and network policy selection functions: (1) Identify when a SIM whose credentials are used at least in part to identify a network-based portion of access network policy is installed in a device configured to include a service processor capable of implementing or enforcing a device-based portion of access network service policy, and provision a first network-based service policy in one or more network-based policy enforcement elements that implement or enforce access network service policy; (2) Identify when a SIM whose credentials are used at least in part to identify the network-based portion of access network policy is installed in a device that is not configured to include a service processor capable of implementing or enforcing a device-based portion of access network service policy and implement a second network-based service policy in one or more network-based policy enforcement elements that implement or enforce access network service policy.


In some embodiments, when it is determined that a SIM whose credentials are used at least in part to identify the network-based portion of access network policy is installed in a device configured to include a service processor capable of implementing or enforcing a device-based portion of access network service policy, a network-based service policy provisioning system provisions a first network-based service policy into one or more network elements (e.g., programs or sends the policy to one or more network elements) and also provisions a device-based service policy into a device service processor. In some embodiments, when it is determined that a SIM whose credentials are used at least in part to identify the network-based portion of access network policy is installed in a device that is not configured to include a service processor capable of implementing or enforcing a device-based portion of access network service policy, a network-based service policy provisioning system provisions a second network-based service policy into one or more network elements, and there is no policy provisioning for a device-based service processor.


Such embodiments are advantageous, for example, when a device-based service processor is capable of implementing or enforcing a network access service policy that has fine grain classification aspects that are not otherwise implemented or enforced in the network. For example, in some embodiments a SIM is installed in a first device configuration that includes a device-based service processor capable of classifying access network service usage associated with one or more device software applications and enforce a policy for access control, service limit, access accounting or access service notification for that classification. In this case a first set of network-based access network service policies may be provisioned into the network elements that implement or enforce access network service policy. If the same SIM is installed in a second device configuration that does not include the described service processor capability, a second set of network-based access network service policies may be provisioned into the network elements that implement or enforce access network service policy. In such embodiments, the first device configuration can include a trusted access control or service limit policies in the service processor that determine the network access allowances for one or more applications, and the first network service policies are configured to facilitate this device-based application access control or service limitation. In contrast, the second device configuration, having no service processor, has no trusted access control or service limitation policies, and therefore the second network service policies may be configured in a manner that allows access only if the service plan or service account associated with the SIM (or second device or SIM user) includes permissions for “bulk” access, “unclassified” access, or access that is classified by the network and not by the device.


In some embodiments, the second network service policies are configured to modify the classification of network access services in accordance with capabilities that exist only in the network without the assistance of a device-assisted classification component.


In some embodiments, the second network service policies include a second access service accounting or charging rate that is different than the access service accounting or charging rate of the first network service policies. For example, the method of service accounting or service charging to the end user in the case where the SIM is installed in a device configuration that includes a service processor capability (e.g., the device is capable of performing service classification, accounting, control or notification functions) can be different than the method of service accounting or service charging to the end user in the case where the SIM is installed in a device configuration that does not include the service processor capability. For example, if the SIM is installed in a device configuration that includes a service processor capability, a given application (e.g., social networking application, email application, search application, voice application, news application, etc.) might have a first service accounting or charging policy defining a first charging measure (e.g., time-based usage for an application, website, content type, service type QoS class; or e.g., megabyte-based usage for an application, website, content type, service type QoS class, etc.) and/or first charging rate (e.g., $X per minute; or e.g., $Y per megabyte, etc.) when the device configuration includes a service processor capability, whereas when the SIM is not installed in a device configuration that includes a service processor capability, all traffic may be rated in the same manner (e.g., time-based or megabyte-based), potentially with a higher price. In some embodiments, when the SIM is not installed in a device configuration that includes a service processor capability, the device network access permissions are altered, or the device's communications may be quarantined or blocked.


In some embodiments, when a SIM is installed in a device with a first device configuration, the service processor is configured to differentially treat one or more classifications of access network service activities based on network congestion level, time of day, QoS level or background/foreground access (e.g., background content caching or background upload of device/user analytics, background software or OS updates, background application/server communications, etc.), but the same SIM can alternatively be installed in a device without such service processor capabilities (e.g., a device with a second device configuration). In such an embodiment, one or more of the network-based portions of access control or service limitation policy, network-based portion of accounting or charging policy, or network-based portion of user notification policy can be varied depending on whether the SIM is installed in a device with the first device configuration or the second device configuration. For example, if the SIM is recognized by the network in association with the first device configuration, a lower accounting rating or service usage price can be applied to traffic that is (i) allocated to background status, (ii) is controlled based on network congestion level, (iii) is controlled based on time of day, (iv) is controlled based on a lower QoS classification allowance, etc., whereas if the SIM is recognized by the network in association with the second device configuration, a single, potentially higher accounting rating or service usage price can be applied. In some embodiments, if the SIM is recognized by the network in association with the second device configuration the device network access permissions can be altered, or the device's communications can be quarantined or blocked.


In some embodiments, when a SIM is determined by a network element to be installed in a device configuration that includes a service processor service usage charging capability, one or more network elements are configured to zero-rate the device access (i.e., the one or more network elements will not apply the service usage accounting recorded by one or more network elements to the user's bill), and user service accounting or charging is turned over to a service controller that receives service usage accounting or charging information from the service processor.


In some embodiments, when a SIM is determined by a network element to be installed in a device configuration that includes a service processor capability to route, re-direct or otherwise steer traffic for one or more service activity classifications to one or more proxy gateway/servers, one or more network elements are configured to zero-rate the device access (i.e., the one or more network elements will not apply the service usage accounting recorded by one or more network elements to the user's bill), and user service accounting or charging is turned over to one or more proxy gateway/servers configured to account or charge for device service usage.


In some embodiments, when a SIM is determined by a network element to be installed in a device configuration that includes a service processor capability to route, re-direct or otherwise steer traffic for one or more service activity classifications to one or more proxy gateway/servers, the one or more proxy gateway/servers perform additional traffic access control or service limitation policy implementation or enforcement for the one or more classifications of service usage.


In some embodiments, when a SIM is determined by a network element to be installed in a device configuration that includes a service processor capability to route, re-direct or otherwise steer traffic for one or more service activity classifications to one or more proxy gateway/servers, the one or more proxy gateway/servers perform additional service usage classification for the purpose of service usage accounting, access control, service limiting or user notification.


In some embodiments, when a SIM is determined by a network element to be installed in a device configuration that does not include a service processor capability to route, re-direct or otherwise steer traffic for one or more service activity classifications to one or more proxy gateway/servers, network elements other than the proxy gateway/servers account for service usage, potentially at a different rate than when a SIM is determined by a network element to be installed in a device configuration that includes a service processor capability to route, re-direct or otherwise steer traffic for one or more service activity classifications.


In some embodiments in which the device configuration includes a service processor capability to route, re-direct or otherwise steer traffic for one or more service activity classifications to one or more proxy gateway/servers, the device routing, re-directing, or steering is accomplished by routing, re-directing, or steering the device traffic for one or more service usage classifications to a specific network destination or resource associated with the proxy gateway/server. In some embodiments, the routing, re-directing, or steering is accomplished using a secure tunnel through the network. In some embodiments the routing, re-directing, or steering is accomplished with a VPN or APN tunnel.


In some embodiments, a network-based service charging policy system is used in conjunction with a user service agreement confirmation system, wherein the user agreement confirmation system provides confirmation that the user has agreed to access service usage terms that stipulate a first rate of access service usage accounting or charging when a SIM is detected in association with a device configuration that includes a service processor capability, and a second rate of access service usage accounting or charging when a SIM is detected in association with a device configuration that does not include a service processor capability. In some embodiments, if a user removes or tampers with a device configuration that includes a service processor capability, or if a user installs a SIM in a device that is not configured with a service processor capability, the user service usage billing conditions are changed. In some embodiments, depending on the device configuration (e.g., with or without a service processor capability), the user is billed at a different rate for “bulk” service usage, or is billed at a different rate for one or more classifications of service usage.


In some embodiments, a network-based service charging policy system is used in conjunction with a user service agreement confirmation system, wherein the user agreement confirmation system provides confirmation that the user has agreed to access service usage terms that stipulate a first set of access service privileges when a SIM is detected in association with a device configuration that includes a service processor capability, and a second set of access service privileges when a SIM is detected in association with a device configuration that does not include a service processor capability. In some embodiments, if a user removes or tampers with a device configuration that includes a service processor capability, or if a user installs a SIM in a device that is not configured with a service processor capability, the user service usage permissions are modified. In some embodiments, this modification can include altering the allowed network destinations, altering the allowed network services, altering the allowed network resources, quarantining access or blocking access.


In some embodiments the presence of a device service processor in combination with a SIM results in the service controller providing advantageous network access services to the user. Examples include but are not limited to the sponsored services discussed herein, user-paid application-based services (e.g., user-paid services where access for one or more device applications is included in a service allowance with potentially lower cost than overall internet access), user-paid destination services (e.g., user-paid services where access for one or more network destinations or resources is included in a service allowance with potentially lower cost than overall internet access), roaming services (e.g., services that aid the user when the device is connected to a roaming network, such as by informing the user that she is roaming and asking if she wishes to continue or block roaming service usage, up to date roaming service usage indication or cost indication, roaming service rate indications, allowing a user to decide which device service usage classifications he wishes to allow while roaming, etc.), or service usage notification services (e.g., providing the user with an update of how much service usage or cost has been incurred, informing the user of what service plans are available, informing the user when a service plan sign up may be advantageous to the user based on an activity or group of activities the user is attempting, or providing the user with a set of service plan sign up choices that can be selected and purchased in a device user interface (UI), etc.). In some embodiments, these user services are made possible by the capabilities of the service processor on the device in conjunction with a specific configuration of a service controller or other network elements on an access service provider network.


In some embodiments, if the SIM for a first network service provider is removed from the device and another SIM for a second network or service provider is installed, the user may not have access to the same services. In some embodiments, the service processor on the device detects that the SIM has been changed and informs the user through a device user interface (UI) notification that if the user changes SIMS or service provider networks, the user will lose certain services. In some embodiments, the services that will be lost are listed in a UI notification. In some embodiments the UI notification states that if the user wishes to regain access to certain services, the user can re-install the original SIM.


In some embodiments, one or more network elements determine whether an end-user device has an active service processor. In some embodiments, a service controller in the network authenticates the service processor.


In some embodiments, the service controller performs authentication of the service processor to ensure that it is present and properly configured to implement a device portion of an access network service policy. FIGS. 16 and 17 show a system diagram for a device service processor to service controller communication link that can aid in secure communication and service processor authentication and verification functions.



FIG. 16 is a functional diagram illustrating service control device link 1691 of service processor 115 and the service control service link 1638 of service controller 122 in accordance with some embodiments. In particular, service control device link 1691 of service processor 115 and service control service link 1638 of service controller 122 as shown in FIG. 16 provide for secure control plane communication over service control link 1653 between service processor 115 and service controller 122 in accordance with some embodiments. Various embodiments include two or three layers of encryption in the service control link, with one embodiment or layer being implemented in the encrypt functions (2408, 2428) and decode functions (2412, 2422), and another embodiment or layer implemented in the transport services stack (2410, 2420). An optional third embodiment or layer of encryption is implemented below the transport services stack, for example, with IPSEC or another IP layer encryption, VPN or tunneling scheme. For example, various known security encryption techniques can be implemented in the encrypt functions (2408, 2428), with public/private or completely private keys and/or signatures so that very strong levels of security for service processor control plane traffic can be achieved even through the basic transport services (2410, 2420) implemented with standard secure or open Internet networking protocols, such as TLS or TCP. For example, the service processor agent communications local to the device can be conducted to and from the service controller elements via service control device link 1691 connection to agent communication bus 1630. The combination of service control device link 1691 and agent communication bus 1630, which in some embodiments is also securely encrypted or signed, provides a seamless, highly secure, asynchronous control plane connection between the service processor and service controller server elements and the service controller and service controller agents that works over a wide range of access networks, such as any access network that has the capability to connect IP or TCP traffic to another TCP or IP endpoint on the access network, another private network or over the Internet. As described herein, in some embodiments, agent communication bus 1630 also provides a fourth level of encrypted or signed communication to form a secure closed system on the device for agent to agent communication, for example, making it very difficult or practically impossible for software or applications to gain access to one or more of the a service processor agents on the device in any way other than service control device link 1691. In this way, in some embodiments, agent communication bus 1630 and the service processor agents can only be accessed by one another as necessary or permitted by agent communication policies, or by the service controller or other authorized network function with proper security credentials communicating over service control device link 1691. Additionally, in some embodiments, communications between a subset of two or more agents, or between one or more agents and one or more service controller server elements are encrypted with unique keys or signatures in such a way that a fourth level of security providing private point to point, point to multipoint, or multipoint to multipoint secure communication lines is provided.


In some embodiments, all of service control device link 1691 communications are transformed into a continuous control plane connection, with a frequency based on the rate of service usage, a minimum set period between connections, and/or other methods for establishing communication frequency. In some embodiments, this heartbeat function provides a continuous verification link by which the service controller verifies that the service processor and/or device are operating properly with the correct service policies being implemented. In view of the following heartbeat function embodiments described herein, it will be apparent to one of ordinary skill in the art that different approaches for implementing the various heartbeat embodiments are possible, and it will be clear that there are many ways to achieve the essential features enabling a reliable, sometimes continuous control link and verification function for the purpose of assisting control of service usage in a verifiable manner. As shown, inside service processor 115, service control device link 1691 includes heartbeat send counter 2402 in communication with agent communication bus 1630. For example, heartbeat send counter 2402 can provide a count for triggering when a service processor 115 communication (e.g., periodic communication based on a heartbeat mechanism) should be sent to service controller 122, and heartbeat buffer 2404, also in communication with agent communication bus 1630, buffers any such information for the next service processor 115 communication, in accordance with various heartbeat based embodiments, as similarly described herein. Heartbeat buffer 2404 is in communication with framing element 2406 and encrypt element 2408 for framing and encrypting any service processor 115 communications transmitted to service controller 122 by transport services stack 2410 over service control link 1653. Similarly, as shown inside service controller 122, service control server link 1638 includes heartbeat send counter 2434 in communication with service controller network 2440, and heartbeat buffer 2432, also in communication with service controller network 2440, which buffers any such information for the next service controller 122 communication, in accordance with various heartbeat based embodiments, as similarly described herein. Heartbeat buffer 2432 is in communication with framing element 2430 and encrypt element 2428 for framing and encrypting any such service controller 122 communications transmitted to service processor 115 by transport services stack 2420 over service control link 1653.


As also shown inside service processor 115 of FIG. 16, service control device link 1691 includes decode element 2412 for decoding any received service controller 122 communications (e.g., decrypting encrypted communications), unpack element 2414 for unpacking the received service controller 122 communications (e.g., assembling packetized communications), and agent route 2416 for routing the received service controller 122 communications (e.g., commands, instructions, heartbeat related information or status reports, policy related information or configuration settings and/or updates, challenge/response queries, agent refreshes and/or new software for installation) to the appropriate agent of service processor 115. Similarly, as shown inside service controller 122, service control server link 1638 also includes decode element 2422 for decoding any received service processor 115 communications (e.g., decrypting encrypted communications), unpack element 2424 for unpacking the received service processor 115 communications (e.g., assembling packetized communications), and agent route 2426 for routing the received service processor 115 communications (e.g., responses to instructions and/or commands, heartbeat related information or status reports, policy related information or configuration settings and/or updates, challenge/response queries, agent status information, network service/cost usage and/or any other reporting related information) to the appropriate agent of service controller 122. Accordingly, as described herein with respect to various embodiments, the various secure communications between service controller 122 and service processor 115 can be performed using the embodiment as shown in FIG. 16, and those of ordinary skill in the art will also appreciate that a variety of other embodiments can be used to similarly provide the various secure communications between service controller 122 and service processor 115 (e.g., using different software and/or hardware architectures to provide secure communications, such as using additional and/or fewer elements/functions or other design choices for providing such secure communications).


In some embodiments, an efficient and effective communication framing structure between the service processor and service controller is provided, and the following embodiments (e.g., as shown and described with respect to FIG. 17) teach such a structure that packs the various service processor agent control plane communications and the various service controller element control plane connections into a format that does not consume excessive bandwidth to enable a continuous control plane connection between the device and service controller. In some embodiments, an efficient and effective communication framing structure between the service processor and service controller is provided to buffer such communication messages for some period of time before framing and transmitting, such as in a heartbeat frequency that is based on rate of service usage. In some embodiments, an efficient and effective communication framing structure between the service processor and service controller is provided to allow for the frame to be easily packed, encrypted, decoded, unpacked and the messages distributed. In view of the various embodiments described herein, it will be apparent to one of ordinary skill in the art that many framing structures will work for the intended purpose of organizing or framing agent communications and the uniqueness and importance of combining such a system element with the device service controller functions, the service processor functions, the service control verification functions and/or the other purposes.



FIG. 17 is a functional diagram illustrating a framing structure of service processor communication frame 2502 and service controller communication frame 2522 in accordance with some embodiments. In particular, service control device link 1691 of service processor 115 and service control service link 1638 of service controller 122 (e.g., as shown in FIG. 16) provide for secure control plane communication over service control link 1653 between service processor 115 and service controller 122 using communication frames in the format of service processor communication frame 2502 and service controller communication frame 2522 as shown in FIG. 17 in accordance with some embodiments. As shown, service processor communication frame 2502 includes service processor framing sequence number 2504, time stamp 2506, agent first function ID 2508, agent first function message length 2510, agent first function message 2512, and, assuming more than one message is being transmitted in this frame, agent Nth function ID 2514, agent Nth function message length 2516, and agent Nth function message 2518. Accordingly, service processor communication frame 2502 can include one or more messages as shown in FIG. 17, which can depend on networking frame length requirements and/or other design choices. Similarly, as shown, service controller communication frame 2522 includes service controller framing sequence number 2524, time stamp 2526, agent first function ID 2528, agent first function message length 2530, agent first function message 2532, and, assuming more than one message is being transmitted in this frame, agent Nth function ID 2534, agent Nth function message length 2536, and agent Nth function message 2538. Accordingly, service controller communication frame 2522 can include one or more messages as shown in FIG. 17, which can depend on networking frame length requirements and/or other design choices.



FIGS. 18A through 18J, 19A through 19S, and 20A through 20E present numerous embodiments that can be used in isolation or in combination by a service controller in authenticating the service processor to ensure that it is present and properly configured to implement a device portion of an access network service policy. FIGS. 18A through 18J provide tables summarizing various service processor heartbeat functions and parameters (e.g., implemented by various agents, components, and/or functions implemented in software and/or hardware) in accordance with some embodiments. Many of these heartbeat functions and parameters are similarly described above, and the tables shown in FIGS. 18A through 18J are not intended to be an exhaustive summary of these heartbeat functions and parameters, but rather are provided as an aid in understanding these functions and parameters in accordance with some heartbeat based embodiments described herein.



FIGS. 19A through 19S provide tables summarizing various device based service policy implementation verification techniques in accordance with some embodiments. Many of these device based service policy implementation verification techniques are similarly described above, and the tables shown in FIGS. 19A through 19S are not intended to be an exhaustive summary of these device based service policy implementation verification techniques, but rather are provided as an aid in understanding these techniques in accordance with some device based service policy embodiments described herein.



FIGS. 20A through 20E provide tables summarizing various techniques for protecting the device based service policy from compromise in accordance with some embodiments. Many of these techniques for protecting the device based service policy from compromise are similarly described above, and the tables shown in FIGS. 20A through 20E are not intended to be an exhaustive summary of these techniques for protecting the device based service policy from compromise, but rather are provided as an aid in understanding these techniques in accordance with some device based service policy embodiments described herein.



FIG. 21 illustrates an example embodiment of a process to start or stop a data session with SGSN notification. End-user device 100 attempts to start a data session by sending a GPRS Attach message to SGSN 2230. SGSN 2230 notifies service controller 122 that end-user device 100 has started a data session. Service controller 122 waits for a pre-determined time, for example, one minute, to receive a login or authentication request from service processor 115. In some embodiments, service controller 122 sets a login timer. If service controller 122 receives the login or authentication request before the timer expires, it attempts to authenticate service processor 115.


One or more authentication errors may occur when service controller 122 attempts to authenticate service processor 115. For example, service processor 115 may have invalid credentials. As another example, service processor 115 may send invalid application or kernel signatures. As another example, service processor 115 may report end-user device “root” detection errors. As another example, service processor 115 may contact service controller 122 using an identifier that is already in use by a different end-user device.


If service controller 122 does not receive the request from service processor 115 within the pre-determined time, or if service controller 122 is unable to authenticate service processor 115 for some reason, service controller 122 assumes that either (1) end-user device 100 does not contain a service processor, and is therefore unable to participate in device-assisted services, or (2) although end-user device 100 has a service processor, service processor 115 has been disabled. Service controller 122 sends a notification (“No active SP” message) to data rating element 2220 to indicate that end-user device 100 does not have the ability to provide the information necessary for data mediation element 2210 to generate detailed data usage reports, e.g., “micro-CDRs.” In some embodiments, service controller 122 sends a trigger to the network to indicate that end-user device 100 should be charged for usage at “standard” bulk rates. In some embodiments, service controller 122 specifies a “standard” bulk rate charging code in the CDRs it sends to data mediation element 2210. In some embodiments, data rating element 2220 determines data usage by end-user device 100 based on carrier-based records.


If service controller 122 receives the login or authentication request from service processor 115 within the pre-determined time and successfully authenticates service processor 115, service controller 122 sends a notification (“Device OK” message) to data rating element 2220 to indicate that end-user device 100 has a service processor and is capable of supporting device-assisted services. In some embodiments, data rating element 2220 expects to receive “micro-CDR” reports from data mediation element 2210 when service controller 122 has determined that end-user device 100 has an active service processor. In some embodiments, data rating element 2220 determines usage based on the micro-CDRs, which contain more granular information than ordinary CDRs. For example, whereas an ordinary CDR might simply report that an end-user device used 100 Megabytes (MB) of data, a set of micro-CDRs might report that the end-user device used 15 MB of e-mail, 35 MB of social networking, and 50 MB of streaming video.


In some embodiments, data mediation element 2210 sends carrier-based usage reports (e.g., CDRs) to service controller 122. Service controller 122 queries usage database 2200 for device-based usage reports (e.g., micro-CDRs) for end-user device 100. Service controller 122 determines the data usage of end-user device 100 from the carrier-based usage reports. Service controller 122 determines the data usage of end-user device 100 from the device-based usage reports. Service controller 122 compares the usage determined from the carrier-based usage reports to the usage determined from the device-based usage reports. If service controller 122 determines that the two usage measures do not match (e.g., are not identical or are not within a threshold of each other), service controller 122 sends a notification (e.g., a fraud alert) to data rating element 2220 to indicate that the end-user device is in a fraud state, and data rating element 2220 should bill usage for end-user device 100 based on carrier-based usage reports. Service controller 122 sends the carrier-based usage reports and device-based usage reports to data mediation element 2210.


When the “GPRS detach” message is received by SGSN 2230, SGSN 2230 sends a notification to service controller 122 that the data session for end-user device 100 is closed.



FIG. 22 illustrates an example embodiment of a process to start or stop a data session with GGSN notification. The process is similar to that described with reference to FIG. 21, except in how the data session starts and ends. End-user device 100 starts a data session by sending data traffic to GGSN 2240. GGSN 2240 recognizes the start of a new data session and notifies service controller 122 that end-user device 100 has started a data session. When GGSN 2240 determines that the data session has closed, it sends a notification to service controller 122 that the data session for end-user device 100 is closed.


As discussed above, in some embodiments a device service processor can provide information to assist in classification of service usage for any combination of device application, network destination or resource, a type of network, roaming condition (e.g., home or roaming network), a time period, a level of network congestion, a level of network QoS, and a background or foreground communication. In some embodiments, when a service processor provides service usage for a classification of service usage involving one or more of device application, network destination or resource, a type of network, roaming condition (e.g., home or roaming network), a time period, a level of network congestion, a level of network QoS, and a background or foreground communication, service processor 115 generates a service usage report, called a “micro-CDR,” that is then communicated to a network element (e.g., a service controller). The micro-CDR provides a service usage accounting breakdown in finer detail (e.g., including information about a device application, network destination or resource, a type of network, roaming condition (e.g., home or roaming network), a time period, a level of network congestion, a level of network QoS, and a background or foreground communication) than a “bulk” CDR that does not provide such a usage accounting breakdown.


In some embodiments, a device is configured to receive access network services and is further configured to include a service processor capability to account for one or more service activity classifications and send the accounting to a service controller. In some embodiments the service controller is configured to communicate at least a portion of the service processor service accounting as a service usage credit to a service usage reconciliation system. Note that a service usage reconciliation system is also referred to herein in various embodiments as a service usage mediation system or similar term involving mediation. In some embodiments, the service usage reconciliation system is configured to remove a credit from a user service accounting or usage bill. In some embodiments, the service usage credit that is removed from a user service accounting or usage bill is allocated to sponsor service accounting or bill.


In some embodiments it is advantageous to reconcile the micro-CDR service usage accounting reports received from a service processor against a trusted source. In some embodiments, this is accomplished through a system that provides usage credit for one or more micro-CDR usage reports that are reconciled with or validated by a trusted source. In some embodiments, if such credit is provided, the corresponding usage is removed from the user “bulk” usage and re-assigned to the user according to service usage accounting rules associated with the micro-CDR classification. In some embodiments the micro-CDR accounting rules can be designed to account micro-CDR service usage report accounting to a paid user service classification (e.g., a device application based service accounting, a network destination or resource based service accounting, a roaming service usage accounting, etc.). In some embodiments, the micro-CDR accounting rules can be designed to account micro-CDR service usage report accounting to a sponsored service classification (e.g., a sponsored device application based service accounting, a sponsored network destination or resource-based service accounting, a sponsored background classification of service usage, a sponsored content source classification of service usage, a sponsored shopping service, etc.).


In some embodiments the trusted source used to validate micro-CDR service usage classification reports is an FDR (flow data record) source that reports a detailed level of classification that indicates network source or destination (e.g., domain, URL, IP address, etc.) and possibly one or more ports and protocols. In some embodiments, the source of the FDR is a network element. In some embodiments the source of the FDR is a device agent. In some embodiments, the agent that generates the FDR report is located in a secure execution environment on the device. In some embodiments, the agent that generates the FDR report is located in a secure hardware environment on the device. In some embodiments, the agent that generates the FDR report uses a secure transmission protocol with the service controller that is sequenced and signed and/or encrypted in a manner wherein if the sequence of FDR reports or the content of FDR reports is tampered with, then an FDR integrity violation may be detected by the service controller. In some embodiments, a communication from the service controller to the agent generating the FDR reports is sequenced and signed and/or encrypted in a manner wherein if the sequence of FDR reports or the content of FDR reports is tampered with, then an FDR integrity violation may be detected by the agent generating the FDR reports. In some embodiments, when the agent generating the FDR reports detects an FDR integrity violation, the agent generating the FDR reports causes device access to be quarantined or blocked for one or more access networks. In some embodiments, other device communication links than access network links can also be quarantined or blocked, including one or more of wired device access ports (e.g., Ethernet, USB, firewire, etc.), Bluetooth, WiFi, and near field communications.


In some embodiments, the trusted source used to validate micro-CDR service usage classification reports is a network-based element such as a server, gateway, proxy or router that processes the classification of service associated with the micro-CDR. In some embodiments, the network-based element classifies service usage associated with the micro-CDR, measures the service usage, and provides a service usage classification report back to a service controller so that it can be reconciled against the mirco-CDR reports.


In some embodiments, a device is configured to receive access network services and is further configured to include a service processor capability to route, re-direct or otherwise steer traffic for one or more service activity classifications to one or more proxy gateway/servers. In some such embodiments, a service usage reconciliation system is configured to receive device service usage information (e.g., a credit amount) from the one or more proxy gateway/servers, and the service usage information is used in removing an amount (e.g., a credit amount) from service usage allocated to or charged to a user bill by the service usage reconciliation system. In some embodiments, the device routing is accomplished by routing, re-directing, or steering device traffic for one or more service usage classifications to a specific network destination or resource associated with the proxy gateway/server. In some embodiments, the routing, re-directing, or steering is accomplished using a secure tunnel through the network. In some embodiments the routing, re-directing, or steering is accomplished using an SSL, VPN or APN tunnel.


In some embodiments, a device service processor classifies service usage according to a service classification policy and routes, re-directs, or steers the traffic associated with the classification policy to a network element (e.g., a server, gateway, proxy or router that processes the classification of service associated with the micro-CDR) that generates the micro-CDR for that service usage accounting. In this manner, the device can associate service usage for device applications or OS functions with a specific network destination that in turn further processes the traffic and generates the appropriate micro-CDRs that are sent to the service controller for reconciliation (e.g., mediation) as described above. The service processor can steer the traffic classified according to the classification policy by re-directing the traffic to the network destination associated with the appropriate network element, routing the traffic to the network destination associated with the appropriate network element, or tunneling or securely tunneling (e.g. SSL, VPN, APN) the traffic to the network destination associated with the appropriate network element.


In some embodiments, the trusted source used to validate micro-CDR service usage classification reports is a server or website that provides the service, and the validation is provided in the form of good customer feedback associated with a user credential, a service processor credential or a device credential that can be used to determine which device or user to provide the credit to. For example, if a website is associated with the service usage classification defined for a micro-CDR, and the website is visited by a device with a given device credential or user credential, and the website servers track the number of visits, number of transactions, amount of business generated, amount of data communicated or another measure of device interaction with the website, then a summary of this device interaction with the website can be communicated to the service controller and the service controller can provide credit for the micro-CDR.


In some embodiments, another means of limiting the possibility of improper service usage accounting due to improper configuration of a service processor or tampering with a service processor can be accomplished by capping the amount of service over a given period of time that is allowed for a given micro-CDR service usage classification category (e.g., by limiting the amount of service usage in a given period of time for one or more service usage classifications including a device application, network destination or resource, a type of network, a roaming condition (e.g., home or roaming network), a time period, a level of network congestion, a level of network QoS, or a background or foreground communication). In some embodiments, capping the amount of service over a given period of time that is allowed for a given micro-CDR service usage classification category is advantageous as a way of limiting service usage costs for a user-paid service that is based on a specific classification of service usage. In some embodiments, capping the amount of service over a given period of time that is allowed for a given micro-CDR service usage classification category is advantageous as a way of limiting service usage costs for a sponsored service that is based on a specific classification of service usage. In some embodiments, the possibility of service usage report tampering for one or more micro-CDR service usage classification categories is limited by combining reconciliation of service usage using one or more of start/stop accounting, CDR feedback, FDR feedback, etc., and setting a limit on the usage that is allowed for one or more of the micro-CDR service usage classification categories.


In some embodiments, the possibility of service usage report tampering for one or more micro-CDR service usage classification categories is limited by comparing the total service usage for all combined micro-CDR service usage classifications against the total amount of service used in bulk CDR reports received from a trusted source.


In some embodiments using associative classification (also referred to as adaptive ambient service usage classification), some service usage that can not be directly identified as belonging to a give micro-CDR service usage classification is assigned to the micro-CDR service usage classification based on one or more of: (i) time proximity with one or more known service usage flows identified as belonging to the micro-CDR classification, (ii) a maximum amount of service usage (e.g., byte count) that has occurred since one or more known service usage flows that belong the micro-CDR classification were identified, or (iii) the fact that the unidentified service usage is associated with the same application as one or more known service usage flows that belong to the micro-CDR classification.


In some such associative classification (adaptive ambient service classification) embodiments, service usage fraud exposure can be limited by setting a limit on the amount of service usage that can be “unaccounted for” so that if the majority of usage can be classified as belonging to a micro-CDR service usage classification category, the unaccounted-for service usage is allowed to be accounted for in the same micro-CDR accounting. In this manner, if fraudulent service usage activity results in a large percentage of service usage that is not known to be classified as belonging to the micro-CDR usage classification category, a micro-CDR accounting integrity violation can be declared. Service usage above the limits that cannot be reconciled (accounted for) can alternatively be accounted for (e.g., charged to the user) at an agreed-upon contract rate. In some embodiments, the agreed-upon rate is as high or higher than the rate for user paid bulk services (e.g., higher than the rate at which sponsored and specialized application or website based services are billed). In some embodiments, the user is sent a notification by the service controller that the user is being billed at the higher rate. In some embodiments, the user signs up to a service agreement wherein the user agrees to be billed at the higher rate in the event that the service processor is compromised or the micro-CDR accounting is compromised.


In some embodiments, the micro-CDR reports include the amount of service usage that was identified by the service processor as known to belong to the micro-CDR service usage category. In some embodiments, a flow identifier (e.g., domain, URL, IP address, port, or device application associated with [originating or terminating] the flow) can be provided in the micro-CDR reports for service usage known to belong to the micro-CDR classification. In some embodiments, the service controller samples or scans these “known good” micro-CDR flow identifiers to ensure that the flows do in fact belong to the micro-CDR service usage classification, and if they do not a micro-CDR accounting integrity violation can be declared. In some embodiments a flow identifier (e.g., domain, URL, IP address, port, or device application associated with [originating or terminating] the flow) can be provided in the micro-CDR reports for service usage that cannot be classified as belonging to the micro-CDR classification. In some embodiments, the service controller samples or scans these “unknown” micro-CDR flow identifiers to determine if the service destination patterns indicate fraudulent service usage that is inconsistent with micro-CDR classification policies, and if so a micro-CDR accounting integrity violation can be declared.


In some embodiments, a SIM that is expected to be installed in a device configured with a properly configured service processor is allocated a relatively small service usage cap in a network portion of an access network service usage policy so that the device can connect to the network and allow the service processor to authenticate with the service controller. By limiting the initial amount of service usage allowed prior to the service processor authentication with the service controller, it is not possible to get a large amount of service prior to ensuring that a properly configured service processor is present on the device. In some embodiments, once the device service processor is authenticated, an increment can be added to the usage limit in the network portion of the access network service policy. In some embodiments, additional usage limit increments can be added to the network portion of the access network service policy as device service processor generated CDRs, FDRs or micro-CDRs are received by the service controller. In some embodiments, if at any time the flow of CDRs, FDRs or micro-CDRs from the device is tampered with or stopped, the service controller stops incrementing the usage limit in the network portion of access network service policy, and the device access is denied. Alternatively, in some embodiments, rather than stopping service when a service processor is removed or tampered with, the network portion of the access network service policy calls for the application of a higher rate of billing as compared to one or more micro-CDR billing rates for micro-CDR credits provided by the service controller (e.g., user paid application based services, user paid website based services, user paid content services, sponsored application based services, sponsored website based services or sponsored content based services). In some embodiments, if the service processor ceases to send micro-CDRs to the service controller, the user ceases to be credited for the micro-CDR service usage and all usage is billed at a bulk rate that may be higher than the micro-CDR service rates.


In some embodiments, a SIM is provided or sold to a user wherein the SIM is associated with sponsored services that are based on network access service policies configured in the network policy enforcement elements and a service controller. In such embodiments, the problem arises that the SIM may be installed in a device that does not have a properly configured service processor, giving rise to the possibility that a user could receive unintended free services with the sponsored SIM. Embodiments described above can be used to limit the amount of access the SIM is allowed to receive prior to service processor authentication with the service controller by limiting the initial service usage amount allowed in the initial network portion of access network service policy. However, if a number of sponsored SIMs are readily available and inexpensive or free, a user could potentially swap several SIMs into the device and remove each SIM when the service controller fails to authenticate the service processor. In some embodiments, the service controller recognizes the SIM and a second device credential (e.g., an IMEI, a modem credential or a device credential) the first time the sponsored SIM acquires service usage and fails to authenticate the service processor for that device. Once the service processor fails to authenticate with the service controller, the service controller re-sets the network portion of the access network service policy to deny service the next time a SIM attempts to authenticate with the device credential associated with the original SIM.


In some embodiments, good customer feedback may be used as a micro-CDR credit source directly without a service processor on the device. For example, in some embodiments, a website is associated with the service usage classification defined for a micro-CDR, and the website or server that is visited by a device with a given device credential or user credential tracks one or more of the number of visits, number of transactions, amount of business generated, amount of data communicated or another measure of device interaction with the website or server, creates a summary report of this device interaction with the website or server, and then communicates the summary report to a service controller. The service controller can then reconcile the good customer feedback summary report of the device interaction with the website or server by applying a user service usage credit rating rule to deduct a bulk portion of service usage from the user account and add a classification of service usage to the user account that is rated for billing purposes by a rating rule for the given micro-CDR classification. Alternatively, the service controller can deduct a portion of the good customer micro-CDR service usage accounting or billing from the user account and add it to a sponsor entity account, such as the entity that provides the website or server service. In this way, a micro-CDR service usage charging system can be implemented in a network for classification service usage with specialized service usage classification rating, for both user paid classification and sponsored classifications, without the need for a service processor on the device.



FIG. 23 illustrates an exemplary embodiment with network system elements that can be included in a service controller system to facilitate a device-assisted services (DAS) implementation and the flow of information between those elements. FIG. 23 shows the flow of information to facilitate reconciliation of device-generated data usage records with network-generated (e.g., wireless network carrier-generated) data usage records associated with an end-user device. In addition, FIG. 23 shows the flow of information from a carrier to an end-user device for the purpose of publishing an offer set. A user of the end-user device may then select or act on the offer set.


Carrier-generated charging data records (CDRs) or real-time reporting records (RTRs) (or other real-time or near-real-time usage record formats such as, e.g., FDRs, batch processed usage records, continuous usage record event feeds or SMS formatted usage record messages) flow from carrier 2650 (which can be, e.g., a real time reporting system, a network gateway, a network usage charging system element, a AAA, an HLR, a billing element, etc.) to load balancer 2652 to RTR filtering element 2654.


In some embodiments, load balancer 2652 selects one of many CDR/RTR processing threads that are available in the service controller information processing system. In some embodiments, the processing thread is an asynchronous software or firmware program running on a gateway or server CPU. In some embodiments, the processing thread is a virtual machine processing thread that exists in a resource pool of gateway or server CPUs or virtual machines, which may include geographically separated or redundant resource pools. As illustrated in FIG. 23, each processing thread includes the functional steps of CDR/RTR filtering 2654, JMS queue 2656, CDR/RTR processor 2658 and the interface to CDR/RTR database 2660. In some embodiments, processing threads are asynchronous in that they are initiated when load balancer 2652 directs one or more CDR/RTR data transfers to the thread and terminated when the processed CDR/RTR information has been processed and deposited into CDR/RTR database 2660. Note that FIG. 23 shows only one of potentially many available CDR/RTR processing threads.


CDR/RTR filtering element 2654 selects the records that are associated with devices that include a device client that communicates with the service controller (e.g., the device client can be a service processor configured to provide service usage notification updates, on-device service plan purchase or activation with UI options display and user selection actions, device-assisted access control policy enforcement, device-assisted service usage charging policy enforcement, device-assisted service notification messages, etc.). In some embodiments, devices supporting DAS are identified by device credentials or user credentials that are communicated to the service controller as described herein, where the device credential or user credential are members of a device group or user group that is managed by the service controller.


In some embodiments, CDR/RTR filtering element 2654 may be used advantageously to quickly receive and acknowledge a CDR/RTR record to provide asynchronous functionality because of real-time processing requirements, server processing thread scalability and maintainability requirements, or server processing thread geographic redundancy requirements. In some embodiments, filtering eliminates unnecessary load on JMS queue 2656 and/or CDR/RTR database 2660. CDR/RTR filtering element 2654 places the records from end-user devices known to be configured with a device client (e.g., a service processor configured to provide service usage notification updates, on-device service plan purchase or activation with UI options display and user selection actions, device-assisted access control policy enforcement, device-assisted service usage charging policy enforcement, device-assisted service notification messages) that communicates with the service controller through Java messaging service (JMS) queue 2656. In some embodiments, CDR/RTR filtering element 2654 filters out device records for devices that may have a form of service processor, but the service processor has not properly authenticated with the service controller. In some embodiments, the device clients that are known to be configured with a device client that communicates with the service controller are determined by looking up a device credential or user credential associated with CDRs or RTRs in a device group or user group management database (e.g., in SDC database 2692 or subscriber management system 182 (shown, e.g., in FIGS. 1-3)).


JMS queue 2656 buffers the CDR/RTR information remaining after CDR/RTR filtering 2654 and allocates one or more CDRs/RTRs to a service usage processing thread in CDR/RTR processor 2658. In some embodiments, JMS queue 2656 is a persistent queue. In some embodiments, JMS queue 2656 is a primary messaging system between applications.


CDR/RTR processor 2658 retrieves the records from JMS queue 2656, transforms the records, and stores them in CDR/RTR database 2660. In some embodiments, CDR/RTR processor 2658 is an application or a process thread. In some embodiments, CDR/RTR processor 2658 pulls a CDR/RTR record from JMS queue 2656, transforms the record, and stores the transformed record in CDR/RTR database 2660 in one transaction in order to provide fault tolerance in the case of system failure. In some embodiments, CDR/RTR processor 2658 formats the CDR/RTR information to provide a common service usage information format to facilitate one or more of service usage processing, reporting, analysis, comparison, mediation and reconciliation operations performed within the service controller system. In some embodiments, CDR/RTR processor 2658 observes CDR/RTR time stamps and time synchronizes, time aligns, or time aggregates multiple CDR/RTR reports so that a more consistent measure of usage with a common time reference can be achieved within the service controller system for one or more of service usage processing, reporting, analysis, comparison, mediation and reconciliation purposes.


In some embodiments, end-user devices capable of DAS reporting (e.g., devices configured with a device client that communicates with the service controller, such as a service processor described herein) connect periodically or on occasion to usage reporting gateway 2672 to report their data usages. In some embodiments, DAS reporting information includes but is not limited to one or more of user service plan purchase or activation selection choices, device user service policy configuration preference selections (e.g., user-generated service policy assignments for applications, websites, network types, or home/roaming policies), DAS service usage reports, DAS device policy state reports, DAS software environment integrity reports, and other reports listed in the tables in FIGS. 18 through 20.


In some embodiments, DAS device usage reports and analytics flow from carrier device network 2668 (e.g., devices configured with service processors that are in communication with the service controller) to load balancer 2670 to usage reporting gateway 2672. In some embodiments, load balancer 2670 selects one of many usage reporting processing threads that are available in the service controller information processing system. In some embodiments, the usage reporting processing thread is an asynchronous software or firmware program running on a gateway or server CPU. In some embodiments, the usage reporting processing thread is a virtual machine processing thread that exists in a resource pool of gateway or server CPUs or virtual machines, which may include geographically separated or redundant resource pools. As illustrated in FIG. 23, each usage reporting processing thread consists of the functional steps of usage reporting gateway 2672, JMS queue 2674, report processor 2676, and the interface to usage report database 2678. In some embodiments, usage reporting processing threads are asynchronous in that they are initiated when load balancer 2670 directs one or more usage reporting data transfers to a thread and terminated when the processed usage reporting information has been processed and deposited into usage report database 2678. Note that FIG. 23 shows only one of potentially many available usage reporting processing threads.


Usage reporting gateway 2672 accepts reports from devices configured with a device client (e.g., a service processor configured to provide service usage notification updates, on-device service plan purchase or activation with UI options display and user selection actions, device assisted access control policy enforcement, device assisted service usage charging policy enforcement, device assisted service notification messages) that communicates with the service controller and places the reports on JMS queue 2674. In some embodiments, usage reporting gateway 2672 only accepts device reports from device service processors that have authenticated with the service controller system. In some embodiments, usage reporting gateway 2672 only accepts device reports from device service processors configured with device credentials or user credentials that are members of a device group or user group that is managed by the service controller. In some embodiments, usage reporting gateway 2672 rejects reports from end-user devices without authenticated service processors. In some embodiments, usage reporting gateway 2672 is an application or a process thread. In some embodiments, usage reporting gateway 2672 quickly receives and acknowledges end-user device reports. In some embodiments, usage reporting gateway 2672 provides asynchronous functionality that is advantageous to support real-time processing requirements.


In some embodiments, the end-user device is authenticated before reports are put onto JMS queue 2674. In some embodiments, JMS queue 2674 is a persistent queue. In some embodiments, JMS queue 2674 is a primary messaging system between applications.


Report processor 2676 retrieves reports from JMS queue 2674, transforms the reports, and stores the transformed reports in usage report database 2678. In some embodiments, report processor 2676 is an EAI. In some embodiments, report processor 2676 retrieves reports from JMS queue 2674, transforms the reports, and stores the transformed reports in usage report database 2678 in a single transaction in order to provide fault tolerance in case of system failure. In some embodiments, report processor 2676 formats the device usage report information to provide a common service usage information format to facilitate one or more of service usage processing, reporting, analysis, comparison mediation and reconciliation purposes internal processing and comparison within the service controller system. In some embodiments, report processor 2676 observes device usage report time stamps and time synchronizes, time aligns or time aggregates multiple device usage reports so that a more consistent measure of usage with a common time reference can be achieved within the service controller system for one or more of service usage processing, reporting, analysis, comparison mediation and reconciliation purposes.


In some embodiments, CDR/RTR filtering 2654, CDR/RTR processor 2658, report processor 2676, and usage reporting gateway 2672 share a host.


In some embodiments, micro-CDR generator 2680 retrieves records from CDR/RTR database 2660 and retrieves reports from usage report database 2678. In some embodiments, micro-CDR generator 2680 determines a service usage amount for a micro-CDR service usage classification, assigns a usage accounting identifier to the micro-CDR report that identifies the usage as being accounted to a device user for the device associated with a device credential or user credential, and reports this amount of service usage to the carrier network 2666 (in the exemplary embodiment of FIG. 23, through JMS queue 2662 and FTP or publisher 2664). In some embodiments, micro-CDR generator 2680 determines a service usage amount for a micro-CDR service usage classification, assigns a usage accounting identifier to the micro-CDR report that identifies the usage as being accounted to a service sponsor, and reports this amount of service usage to carrier network 2666. In some embodiments the micro-CDR for the sponsored service usage report also includes an identifier for a device credential or user credential. In some embodiments, the amount of service usage accounted for in the micro-CDR is mediated or reconciled off of a device or user bulk service usage accounting. In some embodiments, micro-CDR generator 2680 sends micro-CDRs to JMS queue 2662. In some embodiments, FTP or publisher 2664 retrieves micro-CDRs from JMS queue 2662 and pushes the micro-CDRs to carrier 2666.


In some embodiments, fraud analyzer 2682 retrieves records from CDR/RTR database 2660. In some embodiments, fraud analyzer 2682 retrieves reports form usage report database 2678. In some embodiments, fraud analyzer 2682 retrieves micro-CDRs from micro-CDR generator 2680. In some embodiments, fraud analyzer 2682 performs a fraud analysis using one or more of the record and report information sources consisting of CDR/RTR database 2660, usage report database 2678, and micro-CDR generator 2680. In some embodiments, fraud analyzer 2682 compares usage records associated with a specific device or user credential from one or more of CDR/RTR database 2660, usage report database 2678, and micro-CDR generator 2680 to determine if service usage is outside of pre-defined service usage policy behavior limits. In some embodiments, fraud analyzer 2682 compares service usage information associated with a specific device or user credential from one or more of CDR/RTR database 2660, usage report database 2678, and micro-CDR generator 2680 to determine if a pre-defined service usage limit has been reached or exceeded. In some embodiments, fraud analyzer 2682 compares service usage information associated with a specific device or user credential from one or more of CDR/RTR database 2660, usage report database 2678 and micro-CDR generator 2680 to determine if the specific device or user is exhibiting a service usage behavior that is outside of pre-defined statistical limits as compared to the service usage behavior of a device or user population. In some embodiments, fraud analyzer 2682 stores the results of its fraud analysis in data warehouse 2694. In some embodiments, fraud analyzer 2682 sends fraud alerts to carrier network 2666.


In some embodiments, a service design center is used to create service offers (e.g., service plan offers to purchase or activate a bulk service plan, an application specific service plan, an application group-specific service plan, a website service plan, a website-group service plan, etc.). In some embodiments, the service offers are published to DAS-enabled devices. To publish an offer to one or more devices in carrier device network 2668, carrier 2696 enters information in service design center 2690. Service design center (SDC) 2690 stores the offer set in SDC database 2692. The offer set then flows to device message queue 2688. In some embodiments, device message queue 2688 is a database-backed persistent queue. In some embodiments, when an end-user device with an authenticated service processor connects to offer set gateway 2686, offer set gateway 2686 pushes the offer set to the end-user device. In some embodiments, offer set gateway pushes the offer set to the end-user device at the next usage report. In some embodiments the new offer is an offer to purchase or activate a service plan, and the offer notification is configured with offer acceptance features that allow the device user to select an option to purchase or activate the service offer in the device UI.


In some embodiments, a list of service offers that are available to a device group or user group, wherein the list of service offers is created in a service design center user interface, is stored in SDC database 2692 and published to the devices that belong to the device group or user group.


In some embodiments, an offer set is defined in service design center (SDC) 2690. In some embodiments, this offer set includes multiple service plans that can be communicated to the device service processor for display to the device end user for service plan selection, purchase or activation through the device UI. In some embodiments, the offer set UI display is configured to allow the user to purchase or activate a service plan within the offer set in real-time or near-real-time. In some embodiments, the offer set information is received from the service controller and the offer set information is processed for UI display by a device service processor. In some embodiments, service processor offer set information processing and UI display is configured to allow the user to purchase or activate a service plan within the offer set in real-time or near-real-time. In some embodiments, the user's selection of a service plan for purchase or activation is communicated to the user via an offer set UI display that is configured by a service processor, and the service processor communicates with a service controller via a communication interface to the notification and offer set gateway 2686 to purchase or activate the service plan in real-time or near real-time. In some embodiments the notification and offer set gateway 2686 communicates the user selection of service plan to the offer user selection receiver 2710, which then causes the service plan policy enforcement settings corresponding to the user's service plan selection to be implemented by communicating the user's service plan selection to network provisioning system 160 (or subscriber management 182, order management 180, mobile wireless center 132, billing 123, etc.), which in turn communicates with carrier network 2712 to cause the proper service plan policy enforcement settings to be programmed in the various network elements responsible for service plan policy enforcement. In this manner, in some embodiments the network service policy enforcement required to implement the new service plan for the device can be provisioned in the various network elements responsible for network-based policy enforcement (e.g., aggregation/transport gateways 420 [e.g., PDN or GGSN], mobile wireless center 132 [e.g., HLR], AAA server 121, RAN/access gateway 410 [e.g., SGSN, PDSN], BSC 125). In some embodiments, the network service policy enforcement that implement the new service plan for the device can be provisioned in the various service processor device agents responsible for network based policy enforcement. In some embodiments, when the service plan policy provisioning is complete, the service controller communicates with the device service processor that the new service plan has been purchased or activated. In some embodiments, the service processor communicates a message from the service controller to the device UI that the new service plan has been purchased or activated.


In some embodiments, the service processor offer set information processing and UI display is configured to allow the user to purchase or activate a service plan within the offer set in real-time or near-real-time. In some embodiments, the user's selection of a service plan for purchase or activation is accepted by an offer set UI display that is configured by a service processor, and the service processor communicates with a service controller to allow the user to purchase or activate the service plan in real-time or near real-time, and the service plan policy settings are communicated by the service controller to the service processor so that the service processor policy enforcement agents that implement the new service plan for the device can be provisioned.


In some embodiments, the provisioning of the various network elements responsible for network-based policy enforcement (so that the device can receive the proper service plan allowances and policies) can take a considerable amount of time, for example minutes or even longer, and this can create a poor user experience that is not real-time or near-real-time. In such cases, the service controller can create a temporary service lease by provisioning a subset of the various network elements responsible for network based policy enforcement to allow for a temporary service plan that is put in place before all of the required network elements responsible for network-based policy enforcement and possibly service usage accounting or billing can be provisioned. For example, the temporary lease can provision some or all of the required traffic path or data path processing elements to allow the device service usage classifications that correspond to the allowable service usage classifications in the service plan that the user has selected, but do not account the usage to the correct service usage accounting or billing system configuration until the provisioning of the accounting or billing elements is complete. As another example, during the temporary service lease period before the provisioning of the accounting or billing elements is complete, the service controller can track service usage that is incurred during the temporary service lease period and, after the provisioning of the accounting or billing elements is complete, transfer the service usage that is incurred during the temporary service lease period to the appropriate service usage record database so that the usage incurred during the temporarily service lease period is properly accounted for or billed. In another example embodiment, during the temporary service lease the service controller causes a temporary service provisioning to take effect in the various network elements responsible for network access control, wherein the temporary service provisioning provides for all or a subset of the necessary data path provisioning required to allow the service plan allowances that correspond to the access control policies for the service plan the user has selected, and the service usage incurred during the temporary service lease period is accounted to a temporary accounting other than the final accounting that will be in effect once the provisioning of the new user-selected service plan is in full effect. In some embodiments, the temporary accounting is a catch bucket account that is configured to track device usage during the temporary lease period. In some embodiments, the temporary accounting has a service usage rating other than the service usage rating that will be in effect after the new user-selected service plan is fully provisioned (e.g., a zero-rated accounting). In some embodiments, the service usage during the temporary lease period is tracked and then transferred to the appropriate service accounting after the new user selected service plan is fully provisioned.


In some embodiments, some of the delay in activating a new service plan directly on a device UI can be related to performing a credit check or user service standing check for the user's credit credentials or service account credentials. In such cases, embodiments similar to those disclosed above can be used to provide a temporary service lease, possibly with temporary service accounting that is eventually transferred to the final usage accounting. If during the temporary service lease period an indication is returned to the service controller that the user's credit or user service standing is insufficient to provide the service plan the user has selected, then the user can be notified of this issue, possibly with instructions on how to resolve the issue, and the temporary service lease can be revoked, thus disabling the network access permissions that would have been provided to the device if the credit check had been approved and the final service plan provisioning had taken place. In such embodiments, the usage can be tracked during the temporary lease period prior to revoking the temporary lease, and this service usage can be accounted to an account used for the purpose of tracking usage lost due to failed credit checks or failed user service standing checks. In some embodiments, the usage incurred during a temporary lease that is eventually revoked due to a failed credit check or failed user service standing check can be accounted back to another user accounting or billing, and in some embodiments this is in accordance with a user service agreement.


As one of ordinary skill in the art will now recognize, prior to the time that the network can fully provision a new service plan selected by a device user on a device UI, there are many additional related embodiments too numerous to list here to facilitate rapidly enabling device network access permissions that are identical to or similar to the network access permissions the device would eventually be allowed after the new user selected service plan is fully provisioned so that the device user can enjoy a relatively short time delay from the time the user selects a service plan for purchase or activation on a device and the time the network is fully provisioned to implement the new service plan.


In some embodiments, the service processor is configured to display one or more service plan offers to the device end user, and the time at which this display takes place is determined by what the user is doing with the device or where the device is located (e.g., the end-user device attempts to access the network, an application on the device attempts to access the network, a given application or set of applications are used or attempted to be used, the device enters a roaming state, etc.). In some embodiments, the service processor determines the time at which the one or more service offers are to be displayed to the device user by detecting what the user is doing with the device or a condition of the device caused by the user (e.g., that the device is roaming, etc.).


In some embodiments, a service design center is used to create device user notification messages (e.g., a service offer message, a service usage notification message, a message indicating an amount of bulk service used, a notification indicating an amount of a micro-CDR service classification used, a notification indicating that a bulk usage limit has been reached, a notification indicating that a micro-CDR usage classification usage limit has been reached, etc.). In some embodiments, the notification messages are published to a device service processor (or a group of device service processors that belong to a device group or a user group), and the service processor determines when a trigger condition exists for displaying a specific notification message. In some embodiments, a service usage notification trigger condition (e.g., a state of device usage such as a state of bulk service usage or attempted usage, application usage or attempted usage, website usage or attempted usage, home/roaming usage or attempted usage, cellular/WiFi usage or attempted usage, etc.) is associated with each message. In some embodiments, the service processor on a device determines when the trigger condition has been met and displays a pre-stored notification message associated with the trigger condition. In some embodiments, a network element determines when the trigger condition has been met and uses the notification and offer set gateway 2686 via device message queue 2688 to transmit the notification message to the device for display by the device service processor. In some embodiments, a device service notification message includes a service usage update from CDR/RTR database 2660, which is sent through notification and offer set gateway 2686 via device message queue 2688. In some embodiments, a device service notification message includes a service usage update from micro-CDR generator 2680, which is sent through notification and offer set gateway 2686 via device message queue 2688. In some embodiments, service usage updates from one or more of CDR/RTR database 2660 or micro-CDR generator 2680 are sent through the notification and offer set gateway 2686 via device message queue 2688 on a recurring basis. In some embodiments, the recurring basis is based on a pre-determined amount of usage being reached (e.g., a pre-determined byte count, pre-determined time count or pre-determined percentage of a pre-determined limit, etc.). In some embodiments the recurring basis is based on a usage notification update frequency or time interval.



FIG. 24 illustrates an example embodiment of a service controller reconciliation processing procedure that may be used to detect fraud using information from the end-user device and information from a second source (explained below). Service processor 115 (not shown) or an application on end-user device 100 (not shown) generates usage measures 2300. Based on usage measures 2300, end-user device 100 sends first usage records to service controller 122, or service controller 122 requests first usage records from end-user device 100. Service controller 122 processes the first usage records in device usage record pre-processing 2310. In some embodiments, device usage record pre-processing 2310 modifies the format of the first usage records to facilitate one or more of service usage processing, reporting, analysis, comparison, mediation and reconciliation operations performed within the service controller system. In some embodiments, device usage record pre-processing 2310 observes the first usage records and time stamps and time synchronizes, time aligns or time aggregates multiple first usage records so that a more consistent measure of usage with a common time reference can be achieved within the service controller system for one or more of service usage processing, reporting, analysis, comparison, mediation and reconciliation purposes. Service controller 122 stores the first usage records in device usage records 2320.


A second source (not shown) generates or provides second service usage measures 2370. In some embodiments, the second source is a network element, such as a mediation element, a gateway, a real-time reporting element, a charging element, a billing element, or the like. In some embodiments, the second source is a database. In some embodiments, the second source is a roaming partner network element. In some embodiments, the second source is an element on end-user device 100 that generates secure device data records. In some embodiments, the second source is a partner network destination that provides information about customer usage of or transactions with that destination. In some embodiments, the second source is an application on end-user device 100.


Based on the second service usage measures, the second source sends second usage records (described below) to service controller 122, or service controller 122 obtains the second usage records from the second source. Service controller 122 processes the second usage records in record normalization, time reconciliation and pre-preprocessing 2360. In some embodiments, record normalization, time reconciliation and pre-preprocessing 2360 modifies the format of the second usage records to facilitate one or more of service usage processing, reporting, analysis, comparison, mediation and reconciliation operations performed within the service controller system. In some embodiments, record normalization, time reconciliation and pre-preprocessing 2360 observes the second usage records and time stamps and time synchronizes, time aligns or time aggregates multiple second usage records so that a more consistent measure of usage with a common time reference can be achieved within the service controller system for one or more of service usage processing, reporting, analysis, comparison, mediation and reconciliation purposes. Service controller 122 stores the second usage records in second source usage records 2350.


Service controller 122 applies reconciliation and verification processing algorithms 2340 to reconcile records in device usage records 2320 with records in second source usage records 2350 and to validate records in device usage records 2320. Service controller 122 stores information based on the results of reconciliation and verification processing algorithms 2340 in data warehouse 2330.


In some embodiments, reconciliation and verification processing algorithms 2340 reconcile detailed classifications of service usage (e.g., micro-CDRs) off of a bulk service usage accounting and onto a micro-CDR classification of service usage accounting. In some embodiments, reconciliation and verification processing algorithms 2340 accomplish charging for a detailed classifications of service usage by providing a detailed micro-CDR charging code identifier in the micro-CDR usage record communicated to the carrier network mediation or billing system. In some embodiments, reconciliation and verification processing algorithms 2340 accomplish charging for a detailed classification of service usage by mediating out (or subtracting) the amount of service usage reported in the micro-CDR from the amount of service usage accounted to bulk service usage. In some embodiments, reconciliation and verification processing algorithms 2340 sends charging data records (e.g., CDRs, micro-CDRs, etc.) to operator data mediation 2380.


In some embodiments, reconciliation and verification processing algorithms 2340 perform a fraud analysis using information from one or both of second source usage records 2350 and device usage records 2320. In some embodiments, reconciliation and verification processing algorithms 2340 compares usage records associated with a specific device or user credential from one or both of second source usage records 2350 and device usage records 2320 to determine if service usage is outside of pre-defined service usage policy behavior limits. In some embodiments, reconciliation and verification processing algorithms 2340 compares service usage information associated with a specific device or user credential from one or both of second source usage records 2350 and device usage records 2320 to determine if a pre-defined service usage limit has been reached or exceeded. In some embodiments, reconciliation and verification processing algorithms 2340 compares service usage information associated with a specific device or user credential from one or both of second usage records 2350 and device usage records 2320 to determine if the specific device or user is exhibiting a service usage behavior that is outside of pre-defined statistical limits as compared to the service usage behavior of a device or user population. In some embodiments, reconciliation and verification processing algorithms 2340 stores the results of its fraud analysis in data warehouse 2330. In some embodiments, reconciliation and verification processing algorithms 2340 sends fraud alerts to operator CRM system 2390 (e.g., a carrier fraud processing system, carrier personnel, a device user, a system administrator, etc.).


In some embodiments, the second usage records comprise information from multiple other measures or reports. In some embodiments, the second usage records are based on information, measures, or reports from end-user device 100. In some embodiments, the second usage records are based on information, measures, or reports from other end-user devices. In some embodiments, the second usage records are determined based on information, measures, or reports from one or more network elements (e.g., a base station, the RAN, the core, or using device-assisted means, etc.).


In some embodiments, the second usage records comprise a measure of bulk (e.g., aggregate or unclassified) data usage by end-user device 100. For example, in some embodiments, the second usage records comprise a bulk usage report, specific to end-user device 100, generated by the network, by an application service provider, or by a server. In some embodiments, the second usage records are based on information in one or more previous reports sent by end-user device 100.


In some embodiments, the second usage records comprise information associated with the access network state. In some embodiments, the second usage records are determined from network state tagged information. In some embodiments, the second usage records comprise information from a device data record (DDR), which may indicate the network busy state and the network type. In some embodiments, the second usage records are determined from DDR network state tagged information.


In some embodiments, the second usage records comprise information from flow data record. In some embodiments, the flow data record (FDR) reports a detailed level of service usage classification that indicates service usage broken down by network source or destination (e.g. domain, URL, IP address, etc.) and possibly one or more ports and protocols. In some embodiments, the FDR reports a detailed level of service usage classification that indicates usage broken down by device user application or OS application. In some embodiments, the FDR reports a detailed level of service usage classification that indicates service usage broken down by time of day, network congestion state or service QoS level. In some embodiments, the FDR reports a detailed level of service usage broken down by network type (e.g. 2G, 3G, 4G, WiFi, etc.). In some embodiments, the FDR reports a detailed level of service usage broken down by home or roaming network.


In some embodiments, the FDRs are sourced from a network element capable of classifying traffic (e.g., a deep packet inspection [DPI] gateway, a proxy server, a gateway or server dedicated to a given service classification, a good customer feedback source described elsewhere herein, etc.). In some embodiments, the second usage records are derived from a device service monitor. In some embodiments, the second usage records are derived from a trusted device service monitor. In some embodiments, the trusted device service monitor is located in a secure execution environment on the device that cannot be accessed by a user or user installed application software.


In some embodiments, the second usage records allow service controller 122 to determine whether the access behavior of end-user device 100, given the network state, indicates that end-user device 100 is implementing the correct policy controls. In some embodiments, service controller 122 confirms that service processor 115 is reporting the correct network state in its data usage reports. In some embodiments, a network element determines the correct network state based on a group of devices. The information is reported to service controller 122 or another suitable network function. Service controller 122 (or other suitable network function) characterizes portions of the sub-network (e.g., base stations, base station sectors, geographic areas, radio access network (RAN), etc.) based on the population of end-user devices connected to that sub-network portion. The network element can also gather network busy-state measures from network equipment, such as from base stations or by sampling the RAN, to determine the second measure.


In some embodiments, the second usage records provide information about a cap on the aggregate amount of data usage by end-user device 100. Service controller 122 verifies that the total data usage by end-user device 100, as reported in the first usage records, does not exceed the cap. If the first usage records provide data usage amounts for individual services used by end-user device 100, service controller 122 verifies that the sum of the usage amounts for the individual services does not exceed the cap.


In some embodiments, the network classifies FDRs to known service components, determines credits of classified usage for each service component, ensures that the service component usage does not exceed specified limits (or matches end-user device reports for the component), and checks whether the sum of the components matches the bulk measure.


There are several potentially fraudulent circumstances that may be detected by service controller 122 using one or more of the embodiments disclosed herein, such as the example embodiment illustrated in FIG. 24. In some embodiments, service controller 122 generates a fraud alert if it receives carrier-based usage reports from a network element and UDRs from service processor 115, but the usage counts contained in the reports are not in agreement within a specified tolerance. In order to generate a fraud alert under these circumstances, in some embodiments service controller 122 accounts for unsent usage reports that may still be on end-user device 100.



FIG. 25 illustrates an example embodiment that can be advantageous in cases where it is desirable to identify service usage classifications in the network for the purpose of providing a device user or service sponsor with the opportunity to pay for access network service usage that is classified by application or website. FIG. 25 also illustrates exemplary elements that, in some embodiments, provide for generation of micro-CDRs based on a network classification of micro-CDR service usage category. FIG. 25 also illustrates an exemplary means of transmitting the network generated micro-CDRs to carrier network 2666 for billing purposes. In some embodiments, the micro-CDRs generated in the network are used to implement user paid application plans, website plans or content type plans. In some embodiments, the micro-CDRs generated in the network are used to implement sponsored application plans, website plans or content type plans.


The exemplary system illustrated in FIG. 25 operates on the same principles as the exemplary system illustrated in FIG. 23. Detailed usage reporting for micro-CDR generation is obtained from an FDR source in carrier network 2698 (e.g., the source may be a DPI gateway, proxy server, dedicated service server, good customer feedback, etc.). The FDRs from the FDR source are passed by load balancer 2700 to detailed usage reporting gateway 2702. In some embodiments, detailed usage reporting gateway 2702 observes FDR time stamps, and time synchronizes, time aligns or time aggregates multiple FDR reports so that a more consistent measure of usage with a common time reference can be achieved within the service controller system for one or more of service usage processing, reporting, analysis, comparison, mediation and reconciliation purposes. The processed FDRs are passed by detailed usage reporting gateway 2702 to JMS queue 2704, which in turn passes them to detailed report processor 2706. The other functions in FIG. 25 are similar to those described in the context of FIG. 23. As would be appreciated by one of ordinary skill in the art, the exemplary embodiment of FIG. 25 provides the advantages of micro-CDR service usage accounting for user-paid application and website services or sponsored application or website services.


In some embodiments, the FDR (flow data record) reports a detailed level of service usage classification that indicates service usage broken down by network source or destination (e.g. domain, URL, IP address, etc.) and possibly one or more ports and protocols. In some embodiments, the FDR reports a detailed level of service usage classification that indicates usage broken down by device user application or OS application. In some embodiments, the FDR reports a detailed level of service usage classification that indicates service usage broken down by time of day, network congestion state or service QoS level. In some embodiments, the FDR reports a detailed level of service usage broken down by network type (e.g. 2G, 3G, 4G, WiFi, etc.). In some embodiments, the FDR reports a detailed level of service usage broken down by home or roaming network.


In some embodiments, the FDRs are sourced from a network element capable of classifying traffic (e.g., the source is a deep packet inspection [DPI] gateway, a proxy server, a gateway or server dedicated to a given service classification, etc.). In some embodiments, the FDRs are derived from a device service monitor. In some embodiments, the FDRs are derived from a trusted device service monitor. In some embodiments, the trusted device service monitor is located in a secure execution environment on the device that can not be accessed by a user or user installed application software.


In some embodiments, the FDRs not only report service usage that is attempted and allowed by a device, but also service usage that is attempted and not allowed by a device. In some embodiments, an FDR that reports service usage that is attempted but not allowed can include the various classification capabilities described herein. In this manner, an FDR can not only detect bulk service usage or classified service usage for an application, website, network type, etc., but can also detect when a user is attempting to gain access services for bulk services or classified services for an application, website, network type, etc.


In some embodiments, the micro-CDR usage accounting derived from network usage monitoring sources is fed back to a user service usage notification function in a device service processor in order to provide a service usage classification breakdown for user-paid application and website services or sponsored application or website services. This path is indicated in FIG. 25 by the dashed line connection from micro-CDR generator 2680 to device message queue 2688 and the subsequent processing and transmission of a micro-CDR service usage classification update to the device service processor vial notification and offer set gateway 2686.


In some embodiments, the service processor is configured to display one or more service plan offers to the device end user, and the time at which this display takes place is determined by what the user is doing with the device (e.g., the user attempts to access the network, an application on the device attempts to access the network, a given application or set of applications are used or attempted to be used, the device enters a roaming state, etc.). In some embodiments, the service controller determines the time at which the one or more service offers are to be displayed to the device user by detecting what the user is doing with the device. In some embodiments the service controller detects what the user is doing with the device by observing the access patterns or attempted access patterns in the FDRs or micro-CDRs. In some embodiments, the service controller observes FDRs that report an access service attempt from the device that was denied, and this triggers the service processor to initiate a device notification message that provides a service offer, and the service offer notification is transmitted via the notification and offer set gateway 2686. In some embodiments, the service controller observes FDRs that report an access service attempt from the device for a classification of service usage such as an application or website that was denied, and this triggers the service processor to initiate a device notification message that provides a service offer for an application service or a website service, and the service offer notification is transmitted via the notification and offer set gateway 2686.


In some embodiments, the interface protocols for notification and offer set gateway 2686 can be exposed to device OEMs or application developers in the form of an API. In some embodiments, the API for notification and offer set gateway 2686 provides for a uniform means for device application software or OS software developers to write various application software that can utilize a uniform interface for requesting from a service controller a listing of service offers that are available to a device and displaying the listing to the device user interface. In some embodiments, a list of service offers that are to be made available to a device group or user group is created using a service design center user interface, stored in an SDC database, and published to the API for notification and offer set gateway 2686. In some embodiments, the service plan enforcement policies for one or more of network access permissions or traffic control, service usage limitations, service usage charging or accounting, or service usage notification can also be configured in service design center 2690. In some embodiments, the API for notification and offer set gateway 2686 provides for a uniform means for device application software or OS software developers to write various application software that can utilize a uniform interface for providing user service plan choices for service purchase or activation in a device UI, collect the user choice and transmit the user choice to a service controller that then activates the new service for the device. In some embodiments, the available service plan listing or service plan purchase or activation user selection components of the API for notification and offer set gateway 2686 is created with an XML interface. In some embodiments, the available service plan listing or service plan purchase or activation user selection components of the API for notification and offer set gateway 2686 is offered via a secure web connection.


In some embodiments, the interface protocols for notification and offer set gateway 2686 can be exposed to sponsored device providers or sponsored application providers in the form of an API. In some embodiments, the API for notification and offer set gateway 2686 provides for a uniform means for sponsored service providers to develop device application software or OS software that can utilize a uniform interface for requesting from a service controller activation of a sponsored service plan for the device from a service controller. In some embodiments, the sponsored service plan offered and activated through the API is for sponsoring all device access. In some embodiments, the sponsored service plan offered and activated through the API is for sponsoring an application or group of applications. In some embodiments, the sponsored service plan offered and activated through the API is for sponsoring a website or group of websites. In some embodiments, the API for notification and offer set gateway 2686 provides for a uniform means for sponsored device application software or OS software developers to write various application software that can utilize a uniform interface for activating a sponsored service plan for the device, an application or a website.


In some embodiments the interface protocols for notification and offer set gateway 2686 can be exposed to device OEMs or application developers in the form of an API that provides a uniform interface for device application software or OS software to request service usage information updates from a service controller. In some embodiments, the service usage information updates are provided by the service controller in the form of bulk service usage. In some embodiments, the service usage information updates are provided by the service controller in the form of service usage classification or micro-CDR service usage updates. In some embodiments, a device user software application or OS function is configured to utilize a uniform interface for obtaining service usage updates from a service controller, and displaying the service usage updates to a device user interface. In some embodiments the service usage update displayed to the device UI is in the form of a gauge, meter, bar, amount used, amount remaining, percent used or percent remaining. In some embodiments, a device user software application or OS function is configured to utilize a uniform interface for obtaining service usage updates for a classification of service usage (e.g., an application classification or website classification, or another classification) from a service controller, and displaying the service usage updates to a device user interface. In some embodiments, a group of one or more service usage notifications that are to be provided by the API for notification and offer set gateway 2686 to devices that belong to a device group or user group are created using a service design center user interface, stored in SDC database 2692 and published to the API for notification and offer set gateway 2686. In some embodiments, the service plan notification policies (e.g., the conditions that trigger a given service usage notification and the information content of the notification) can also be configured in service design center 2692. In some embodiments, the service usage notification interface component of the API for notification and offer set gateway 2686 is created with an XML interface. In some embodiments, the service usage notification interface component of the API for notification and offer set gateway 2686 is offered via a secure web connection.


In some embodiments, the API for notification and offer set gateway 2686 comprises a secure interface that can only be accessed by providing a device credential corresponding to a known device or user account on the network (e.g. a SIM card credential, an IMSI, a phone number, an MDID, a signed API communication, an encrypted API communication or another form of secure device agent communication with the API). In some embodiments, the API for notification and offer set gateway 2686 comprises a secure interface that can only be accessed by providing a user credential corresponding to a known device or user account on the network (e.g. a user PIN, password, secure question answer, biometric credential or other secure user credential available in general only to a device user or an entity trusted by the device user). In some embodiments, the API for notification and offer set gateway 2686 comprises a secure interface that can only be accessed by providing an application credential (e.g. application certificate, signature, hash information, signed communication, encrypted communication, encrypted message or other application credential that securely identifies an application or OS function) corresponding to a known application that is allowed to access the API for notification and offer set gateway 2686. In some embodiments, a device software application or OS function must provide a secure device credential, secure application credential or secure user credential in accordance with a proper pre-defined API format to obtain service usage notification information from the API for notification and offer set gateway 2686. In some embodiments, a device software application or OS function must provide a secure device credential, secure application credential or secure user credential in accordance with a proper pre-defined API format to obtain service offer set information from the API for notification and offer set gateway 2686. In some embodiments, a device software application or OS function must provide a secure device credential, secure application credential or secure user credential in accordance with a proper pre-defined API format to communicate user service plan selection information to the API for notification and offer set gateway 2686. In some embodiments, a device software application or OS function must provide a secure device credential, secure application credential or secure user credential to the API for notification and offer set gateway 2686 in order to receive a sponsored service. In some embodiments, the API for notification and offer set gateway 2686 comprises a secured XML interface. In some embodiments, the API for notification and offer set gateway 2686 comprises a secure web connection.


Although the foregoing embodiments have been described in some detail for purposes of clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not restrictive.


INCORPORATION BY REFERENCE

The following U.S. applications are hereby incorporated by reference for all purposes: application Ser. No. 13/239,321, filed Sep. 21, 2011, entitled SERVICE OFFER SET PUBLISHING TO DEVICE AGENT WITH ON-DEVICE SERVICE SELECTION; application Ser. No. 13/237,827, filed Sep. 20, 2011, entitled ADAPTING NETWORK POLICIES BASED ON DEVICE SERVICE PROCESSOR CONFIGURATION, now U.S. Pat. No. 8,832,777 (issued Sep. 9, 2014); application Ser. No. 12/695,019, filed Jan. 27, 2010, entitled DEVICE ASSISTED CDR CREATION, AGGREGATION, MEDIATION AND BILLING, now U.S. Pat. No. 8,275,830 (issued Sep. 25, 2012); application Ser. No. 12/380,780, entitled AUTOMATED DEVICE PROVISIONING AND ACTIVATION, filed Mar. 2, 2009, now U.S. Pat. No. 8,839,388 (issued Sep. 16, 2014); application Ser. No. 12/380,778, filed Mar. 2, 2009, entitled VERIFIABLE DEVICE ASSISTED SERVICE USAGE BILLING WITH INTEGRATED ACCOUNTING, MEDIATION ACCOUNTING, AND MULTI-ACCOUNT, now U.S. Pat. No. 8,321,526 (issued Nov. 27, 2012); Provisional Application No. 61/206,354, entitled SERVICES POLICY COMMUNICATION SYSTEM AND METHOD, filed Jan. 28, 2009; Provisional Application No. 61/206,944, entitled SERVICES POLICY COMMUNICATION SYSTEM AND METHOD, filed Feb. 4, 2009; Provisional Application No. 61/207,393, entitled SERVICES POLICY COMMUNICATION SYSTEM AND METHOD filed Feb. 10, 2009; Provisional Application No. 61/207,739, entitled SERVICES POLICY COMMUNICATION SYSTEM AND METHOD filed Feb. 13, 2009; Provisional Application No. 61/270,353, filed on Jul. 6, 2009, entitled DEVICE ASSISTED CDR CREATION, AGGREGATION, MEDIATION AND BILLING; Provisional Application No. 61/264,126, filed Nov. 24, 2009, entitled DEVICE ASSISTED SERVICES ACTIVITY MAP; Provisional Application No. 61/384,456 entitled SECURING SERVICE PROCESSOR WITH SPONSORED SIMS, filed Sep. 20, 2010; and Provisional Application No. 61/385,020 entitled SERVICE USAGE RECONCILIATION SYSTEM OVERVIEW, filed Sep. 21, 2010.

Claims
  • 1. A network system, comprising: a service design center to create a service offer set;memory configured to store the service offer set, the service offer set identifying one or more service plans available to a wireless end-user device, the one or more service plans, upon provisioning for the wireless end-user device, enabling the wireless end-user device to communicate over a wireless access network;a near-real time device message queue configured to obtain the service offer set from memory; anda real-time gateway configured to: send information associated with the service offer set from the near-real time device message queue to the wireless end user device over the wireless access network, the information associated with the service offer set enabling the wireless end-user device to present, through a user interface of the wireless end-user device, one or more service plan selection options associated with the one or more service plans available to the wireless end-user device,receive an offer set user selection from the wireless end-user device, the offer set user selection indicating a user selection of at least one of the one or more service plan selection options, andprovision one or more network functions based on the offer set user selection.
  • 2. The network system recited in claim 1, wherein the system further comprises a service controller.
  • 3. The network system recited in claim 1, wherein the user interface is a first user interface, the service design center comprising a second user interface configured to accept service offer set design parameters, and wherein the service design center is further configured to provide the service offer set design parameters to the network system in a format that enables the network system to send the information associated with the service offer set to the wireless end-user device over the wireless access network.
  • 4. The network system recited in claim 1, wherein sending information associated with the service offer set to the wireless end-user device over the wireless access network comprises pushing the information associated with the service offer set to the end-user device.
  • 5. The network system recited in claim 1, wherein sending information associated with the service offer set to the wireless end-user device over the wireless access network comprises providing the information associated with the service offer set to the end-user device in response to a request from the end-user device.
  • 6. The network system recited in claim 1, wherein the real-time gateway includes an application programming interface (API), and wherein the real-time gateway is further configured to receive, through the API, a request from the wireless end-user device for information associated with the service offer set.
  • 7. The network system recited in claim 6, wherein the real-time gateway is further configured to receive, through the API, the offer set user selection from the wireless end-user device.
  • 8. The network system recited in claim 1, wherein at least one of the one or more network functions comprises a data path network access control element.
  • 9. The network system recited in claim 1, wherein at least one of the one or more network functions comprises a service accounting element or a billing element.
  • 10. The network system recited in claim 1, wherein at least one of the one or more network functions comprises a service processor agent policy enforcement element.
  • 11. The network system recited in claim 1, wherein the service offer set and/or the information associated with the service offer set is tailored for the wireless end-user device based on a wireless end-user device activity.
  • 12. The network system recited in claim 11, wherein the wireless end-user device activity comprises an attempt to access the wireless access network, an attempt to access a roaming access network, an attempt to use a particular application on the wireless end-user device, an attempt by the particular application on the wireless end-user device to access the wireless access network, a successful access to the wireless access network, a successful access to the roaming access network, a successful use of the particular application on the wireless end-user device, or a successful access to the wireless access network by the particular application on the wireless end-user device.
  • 13. The network system recited in claim 1, wherein the information associated with the service offer set is based on a location of the wireless end-user device.
  • 14. The network system recited in claim 1, wherein the real-time gateway is further configured to send wireless network usage information to the wireless end-user device.
  • 15. The network system recited in claim 1, wherein the real-time gateway is further configured to, based on a determination that a trigger condition has been met, send a notification to the wireless end-user device.
  • 16. The network system recited in claim 15, wherein the trigger condition is based on an activity by the wireless end-user device, the activity comprising one or more of an attempted or successful service usage, an attempted or successful application usage, an attempted or successful website access, an attempted or successful access to a roaming network, an attempted or successful access to a home network, an attempted or successful access to a cellular network, and an attempted or successful access to a WiFi network.
  • 17. The network system recited in claim 1, wherein the service offer set or the information associated with the service offer set is based on a characteristic of the wireless end-user device or associated with a user of the wireless end-user device.
US Referenced Citations (1496)
Number Name Date Kind
5131020 Liebesny et al. Jul 1992 A
5283904 Carson et al. Feb 1994 A
5325532 Crosswy et al. Jun 1994 A
5572528 Shuen Nov 1996 A
5577100 McGregor et al. Nov 1996 A
5594777 Makkonen et al. Jan 1997 A
5617539 Ludwig et al. Apr 1997 A
5630159 Zancho May 1997 A
5633484 Zancho et al. May 1997 A
5633868 Baldwin et al. May 1997 A
5754953 Briancon et al. May 1998 A
5774532 Gottlieb et al. Jun 1998 A
5794142 Vanttila et al. Aug 1998 A
5814798 Zancho Sep 1998 A
5889477 Fastenrath Mar 1999 A
5892900 Ginter et al. Apr 1999 A
5903845 Buhrmann et al. May 1999 A
5915008 Dulman Jun 1999 A
5915226 Martineau Jun 1999 A
5933778 Buhrmann et al. Aug 1999 A
5940472 Newman et al. Aug 1999 A
5974439 Bollella Oct 1999 A
5983270 Abraham et al. Nov 1999 A
6035281 Crosskey et al. Mar 2000 A
6038452 Strawczynski et al. Mar 2000 A
6038540 Krist et al. Mar 2000 A
6047268 Bartoli et al. Apr 2000 A
6058434 Wilt et al. May 2000 A
6061571 Tamura May 2000 A
6064878 Denker et al. May 2000 A
6078953 Vaid et al. Jun 2000 A
6081591 Skoog Jun 2000 A
6098878 Dent et al. Aug 2000 A
6104700 Haddock et al. Aug 2000 A
6115823 Velasco et al. Sep 2000 A
6119933 Wong et al. Sep 2000 A
6125391 Meltzer et al. Sep 2000 A
6141565 Feurerstein et al. Oct 2000 A
6141686 Jackowski et al. Oct 2000 A
6148336 Thomas et al. Nov 2000 A
6154738 Call Nov 2000 A
6157636 Voit et al. Dec 2000 A
6185576 McIntosh Feb 2001 B1
6198915 McGregor et al. Mar 2001 B1
6219786 Cunningham et al. Apr 2001 B1
6226277 Chuah May 2001 B1
6246870 Dent et al. Jun 2001 B1
6263055 Garland et al. Jul 2001 B1
6292828 Williams Sep 2001 B1
6317584 Abu-Amara et al. Nov 2001 B1
6370139 Redmond Apr 2002 B2
6381316 Joyce et al. Apr 2002 B2
6393014 Daly et al. May 2002 B1
6397259 Lincke et al. May 2002 B1
6401113 Lazaridis et al. Jun 2002 B2
6418147 Wiedeman Jul 2002 B1
6438575 Khan et al. Aug 2002 B1
6445777 Clark Sep 2002 B1
6449479 Sanchez Sep 2002 B1
6466984 Naveh et al. Oct 2002 B1
6477670 Ahmadvand Nov 2002 B1
6502131 Vaid et al. Dec 2002 B1
6505114 Luciani Jan 2003 B2
6510152 Gerszberg et al. Jan 2003 B1
6522629 Anderson, Sr. Feb 2003 B1
6532235 Benson et al. Mar 2003 B1
6532579 Sato et al. Mar 2003 B2
6535855 Cahill et al. Mar 2003 B1
6535949 Parker Mar 2003 B1
6539082 Lowe et al. Mar 2003 B1
6542500 Gerszberg et al. Apr 2003 B1
6542992 Peirce et al. Apr 2003 B1
6546016 Gerszberg et al. Apr 2003 B1
6563806 Yano et al. May 2003 B1
6570974 Gerszberg et al. May 2003 B1
6574321 Cox et al. Jun 2003 B1
6574465 Marsh et al. Jun 2003 B2
6578076 Putzolu Jun 2003 B1
6581092 Motoyama Jun 2003 B1
6591098 Shieh et al. Jul 2003 B1
6598034 Kloth Jul 2003 B1
6601040 Kolls Jul 2003 B1
6603969 Vuoristo et al. Aug 2003 B1
6603975 Inouchi et al. Aug 2003 B1
6606744 Mikurak Aug 2003 B1
6628934 Rosenberg et al. Sep 2003 B2
6631122 Arunachalam et al. Oct 2003 B1
6636721 Threadgill et al. Oct 2003 B2
6639975 O'Neal et al. Oct 2003 B1
6640097 Corrigan et al. Oct 2003 B2
6640334 Rasmussen Oct 2003 B1
6650887 McGregor et al. Nov 2003 B2
6651101 Gai et al. Nov 2003 B1
6654786 Fox et al. Nov 2003 B1
6654814 Britton et al. Nov 2003 B1
6658254 Purdy et al. Dec 2003 B1
6662014 Walsh Dec 2003 B1
6678516 Nordman et al. Jan 2004 B2
6683853 Kannas et al. Jan 2004 B1
6684244 Goldman et al. Jan 2004 B1
6690918 Evans et al. Feb 2004 B2
6697821 Ziff et al. Feb 2004 B2
6725031 Watler et al. Apr 2004 B2
6725256 Albal et al. Apr 2004 B1
6732176 Stewart et al. May 2004 B1
6735206 Oki et al. May 2004 B1
6748195 Phillips Jun 2004 B1
6748437 Mankude et al. Jun 2004 B1
6751296 Albal et al. Jun 2004 B1
6754470 Hendrickson et al. Jun 2004 B2
6757717 Goldstein Jun 2004 B1
6760417 Wallenius Jul 2004 B1
6763000 Walsh Jul 2004 B1
6763226 McZeal, Jr. Jul 2004 B1
6765864 Natarajan et al. Jul 2004 B1
6765925 Sawyer et al. Jul 2004 B1
6782412 Brophy et al. Aug 2004 B2
6785889 Williams Aug 2004 B1
6792461 Hericourt Sep 2004 B1
6829596 Frazee Dec 2004 B1
6829696 Balmer et al. Dec 2004 B1
6839340 Voit et al. Jan 2005 B1
6842628 Arnold et al. Jan 2005 B1
6873988 Herrmann et al. Mar 2005 B2
6876653 Ambe et al. Apr 2005 B2
6879825 Daly Apr 2005 B1
6882718 Smith Apr 2005 B1
6885997 Roberts Apr 2005 B1
6901440 Bimm et al. May 2005 B1
6920455 Weschler Jul 2005 B1
6922562 Ward et al. Jul 2005 B2
6928280 Xanthos et al. Aug 2005 B1
6934249 Bertin et al. Aug 2005 B1
6934751 Jayapalan et al. Aug 2005 B2
6947723 Gurnani et al. Sep 2005 B1
6947985 Hegli et al. Sep 2005 B2
6952428 Necka et al. Oct 2005 B1
6957067 Iyer et al. Oct 2005 B1
6959202 Heinonen et al. Oct 2005 B2
6959393 Hollis et al. Oct 2005 B2
6965667 Trabandt et al. Nov 2005 B2
6965872 Grdina Nov 2005 B1
6967958 Ono et al. Nov 2005 B2
6970692 Tysor Nov 2005 B2
6970927 Stewart et al. Nov 2005 B1
6982733 McNally et al. Jan 2006 B1
6983370 Eaton et al. Jan 2006 B2
6996062 Freed et al. Feb 2006 B1
6996076 Forbes et al. Feb 2006 B1
6996393 Pyhalammi et al. Feb 2006 B2
6998985 Reisman et al. Feb 2006 B2
7002920 Ayyagari et al. Feb 2006 B1
7007295 Rose et al. Feb 2006 B1
7013469 Smith et al. Mar 2006 B2
7017189 DeMello et al. Mar 2006 B1
7024200 McKenna et al. Apr 2006 B2
7024460 Koopmas et al. Apr 2006 B2
7027055 Anderson et al. Apr 2006 B2
7027408 Nabkel et al. Apr 2006 B2
7031733 Alminana et al. Apr 2006 B2
7032072 Quinn et al. Apr 2006 B1
7039027 Bridgelall May 2006 B2
7039037 Wang et al. May 2006 B2
7039403 Wong May 2006 B2
7039713 Van Gunter et al. May 2006 B1
7042988 Juitt et al. May 2006 B2
7043225 Patel et al. May 2006 B1
7043226 Yamauchi May 2006 B2
7043268 Yukie et al. May 2006 B2
7047276 Liu et al. May 2006 B2
7058022 Carolan et al. Jun 2006 B1
7058968 Rowland et al. Jun 2006 B2
7068600 Cain Jun 2006 B2
7069248 Huber Jun 2006 B2
7082422 Zirngibl et al. Jul 2006 B1
7084775 Smith Aug 2006 B1
7092696 Hosain et al. Aug 2006 B1
7095754 Benveniste Aug 2006 B2
7102620 Harries et al. Sep 2006 B2
7110753 Campen Sep 2006 B2
7113780 McKenna et al. Sep 2006 B2
7113997 Jayapalan et al. Sep 2006 B2
7120133 Joo et al. Oct 2006 B1
7133386 Holur et al. Nov 2006 B2
7133695 Beyda Nov 2006 B2
7136361 Benveniste Nov 2006 B2
7139569 Kato Nov 2006 B2
7142876 Trossen et al. Nov 2006 B2
7149229 Leung Dec 2006 B1
7149521 Sundar et al. Dec 2006 B2
7151764 Heinonen et al. Dec 2006 B1
7158792 Cook et al. Jan 2007 B1
7162237 Silver et al. Jan 2007 B1
7165040 Ehrman et al. Jan 2007 B2
7167078 Pourchot Jan 2007 B2
7174156 Mangal Feb 2007 B1
7174174 Boris et al. Feb 2007 B2
7177919 Truong et al. Feb 2007 B1
7180855 Lin Feb 2007 B1
7181017 Nagel et al. Feb 2007 B1
7191248 Chattopadhyay et al. Mar 2007 B2
7197321 Erskine et al. Mar 2007 B2
7200112 Sundar et al. Apr 2007 B2
7200551 Senez Apr 2007 B1
7203169 Okholm et al. Apr 2007 B1
7203721 Ben-Efraim et al. Apr 2007 B1
7203752 Rice et al. Apr 2007 B2
7212491 Koga May 2007 B2
7219123 Fiechter et al. May 2007 B1
7222190 Klinker et al. May 2007 B2
7222304 Beaton et al. May 2007 B2
7224968 Dobson et al. May 2007 B2
7228354 Chambliss et al. Jun 2007 B2
7236780 Benco Jun 2007 B2
7242668 Kan et al. Jul 2007 B2
7242920 Morris Jul 2007 B2
7245901 McGregor et al. Jul 2007 B2
7248570 Bahl et al. Jul 2007 B2
7251218 Jorgensen Jul 2007 B2
7260382 Lamb et al. Aug 2007 B1
7266371 Amin et al. Sep 2007 B1
7269157 Klinker et al. Sep 2007 B2
7271765 Stilp et al. Sep 2007 B2
7272660 Powers et al. Sep 2007 B1
7280816 Fratti et al. Oct 2007 B2
7280818 Clayton Oct 2007 B2
7283561 Picher-Dempsey Oct 2007 B1
7283963 Fitzpatrick et al. Oct 2007 B1
7286834 Walter Oct 2007 B2
7286848 Vireday et al. Oct 2007 B2
7289489 Kung et al. Oct 2007 B1
7290283 Copeland, III Oct 2007 B2
7310424 Gehring et al. Dec 2007 B2
7313237 Bahl et al. Dec 2007 B2
7315892 Freimuth et al. Jan 2008 B2
7317699 Godfrey et al. Jan 2008 B2
7318111 Zhao Jan 2008 B2
7320029 Rinne et al. Jan 2008 B2
7322044 Hrastar Jan 2008 B2
7324447 Morford Jan 2008 B1
7325037 Lawson Jan 2008 B2
7336960 Zavalkovsky et al. Feb 2008 B2
7340772 Panasyuk et al. Mar 2008 B2
7346410 Uchiyama Mar 2008 B2
7349695 Oommen et al. Mar 2008 B2
7353533 Wright et al. Apr 2008 B2
7356011 Waters et al. Apr 2008 B1
7356337 Florence Apr 2008 B2
7366497 Nagata Apr 2008 B2
7366654 Moore Apr 2008 B2
7369848 Jiang May 2008 B2
7369856 Ovadia May 2008 B2
7373136 Watler et al. May 2008 B2
7373179 Stine et al. May 2008 B2
7379731 Natsuno et al. May 2008 B2
7388950 Elsey et al. Jun 2008 B2
7389412 Sharma Jun 2008 B2
7391724 Alakoski et al. Jun 2008 B2
7395244 Kingsford Jul 2008 B1
7401338 Bowen et al. Jul 2008 B1
7403763 Maes Jul 2008 B2
7409447 Assadzadeh Aug 2008 B1
7409569 Illowsky et al. Aug 2008 B2
7411930 Montojo et al. Aug 2008 B2
7418253 Kavanah Aug 2008 B2
7418257 Kim Aug 2008 B2
7421004 Feher Sep 2008 B2
7423971 Mohaban et al. Sep 2008 B1
7428750 Dunn et al. Sep 2008 B1
7433362 Mallya et al. Oct 2008 B2
7440433 Rink et al. Oct 2008 B2
7444669 Bahl et al. Oct 2008 B1
7450591 Korling et al. Nov 2008 B2
7450927 Creswell et al. Nov 2008 B1
7454191 Dawson et al. Nov 2008 B2
7457265 Julka et al. Nov 2008 B2
7457870 Lownsbrough et al. Nov 2008 B1
7460837 Diener Dec 2008 B2
7466652 Lau et al. Dec 2008 B2
7467160 McIntyre Dec 2008 B2
7472189 Mallya et al. Dec 2008 B2
7478420 Wright et al. Jan 2009 B2
7486185 Culpepper et al. Feb 2009 B2
7486658 Kumar Feb 2009 B2
7493659 Wu et al. Feb 2009 B1
7496652 Pezzutti Feb 2009 B2
7499438 Hinman et al. Mar 2009 B2
7499537 Elsey et al. Mar 2009 B2
7502672 Kolls Mar 2009 B1
7505756 Bahl Mar 2009 B2
7505795 Lim et al. Mar 2009 B1
7508799 Sumner et al. Mar 2009 B2
7512128 DiMambro et al. Mar 2009 B2
7512131 Svensson et al. Mar 2009 B2
7515608 Yuan et al. Apr 2009 B2
7515926 Bu et al. Apr 2009 B2
7516219 Moghaddam et al. Apr 2009 B2
7522549 Karaoguz et al. Apr 2009 B2
7522576 Du et al. Apr 2009 B2
7526541 Roese et al. Apr 2009 B2
7529204 Bourlas et al. May 2009 B2
7535880 Hinman et al. May 2009 B1
7536695 Alam et al. May 2009 B2
7539132 Werner et al. May 2009 B2
7539862 Edgett et al. May 2009 B2
7540408 Levine et al. Jun 2009 B2
7545782 Rayment et al. Jun 2009 B2
7546460 Maes Jun 2009 B2
7546629 Albert et al. Jun 2009 B2
7548875 Mikkelsen et al. Jun 2009 B2
7548976 Bahl et al. Jun 2009 B2
7551921 Petermann Jun 2009 B2
7551922 Roskowski et al. Jun 2009 B2
7554983 Muppala Jun 2009 B1
7555757 Smith et al. Jun 2009 B2
7561899 Lee Jul 2009 B2
7562213 Timms Jul 2009 B1
7564799 Holland et al. Jul 2009 B2
7565141 Macaluso Jul 2009 B2
7574509 Nixon et al. Aug 2009 B2
7574731 Fascenda Aug 2009 B2
7577431 Jiang Aug 2009 B2
7580356 Mishra et al. Aug 2009 B1
7580857 VanFleet et al. Aug 2009 B2
7583964 Wong Sep 2009 B2
7584298 Klinker et al. Sep 2009 B2
7586871 Hamilton et al. Sep 2009 B2
7593417 Wang et al. Sep 2009 B2
7593730 Khandelwal et al. Sep 2009 B2
7599288 Cole et al. Oct 2009 B2
7599714 Kuzminskiy Oct 2009 B2
7602746 Calhoun et al. Oct 2009 B2
7606918 Holzman et al. Oct 2009 B2
7607041 Kraemer et al. Oct 2009 B2
7609650 Roskowski et al. Oct 2009 B2
7609700 Ying et al. Oct 2009 B1
7610047 Hicks, III et al. Oct 2009 B2
7610057 Bahl et al. Oct 2009 B2
7610328 Haase et al. Oct 2009 B2
7610396 Taglienti et al. Oct 2009 B2
7612712 LaMance Nov 2009 B2
7614051 Glaum et al. Nov 2009 B2
7617516 Huslak et al. Nov 2009 B2
7620041 Dunn et al. Nov 2009 B2
7620065 Falardeau Nov 2009 B2
7620162 Aaron et al. Nov 2009 B2
7620383 Taglienti et al. Nov 2009 B2
7627314 Carlson et al. Dec 2009 B2
7627600 Citron et al. Dec 2009 B2
7627767 Sherman et al. Dec 2009 B2
7627872 Hebeler et al. Dec 2009 B2
7633438 Tysowski Dec 2009 B2
7634388 Archer et al. Dec 2009 B2
7636574 Poosala Dec 2009 B2
7636626 Oesterling et al. Dec 2009 B2
7643411 Andreasen et al. Jan 2010 B2
7644151 Jerrim et al. Jan 2010 B2
7644267 Ylikoski et al. Jan 2010 B2
7644414 Smith et al. Jan 2010 B2
7647047 Moghaddam et al. Jan 2010 B2
7650137 Jobs et al. Jan 2010 B2
7653394 McMillin Jan 2010 B2
7656271 Ehrman et al. Feb 2010 B2
7657920 Arseneau et al. Feb 2010 B2
7660419 Ho Feb 2010 B1
7661124 Ramanathan et al. Feb 2010 B2
7664494 Jiang Feb 2010 B2
7668176 Chuah Feb 2010 B2
7668612 Okkonen Feb 2010 B1
7668903 Edwards et al. Feb 2010 B2
7668966 Klinker et al. Feb 2010 B2
7676673 Weller et al. Mar 2010 B2
7680086 Eglin Mar 2010 B2
7681226 Kraemer et al. Mar 2010 B2
7684370 Kezys Mar 2010 B2
7685131 Batra et al. Mar 2010 B2
7685254 Pandya Mar 2010 B2
7685530 Sherrard et al. Mar 2010 B2
7688792 Babbar et al. Mar 2010 B2
7693107 De Froment Apr 2010 B2
7693720 Kennewick et al. Apr 2010 B2
7697540 Haddad et al. Apr 2010 B2
7710932 Muthuswamy et al. May 2010 B2
7711848 Maes May 2010 B2
7719966 Luft et al. May 2010 B2
7720206 Devolites et al. May 2010 B2
7720464 Batta May 2010 B2
7720505 Gopi et al. May 2010 B2
7720960 Pruss et al. May 2010 B2
7721296 Ricagni May 2010 B2
7724716 Fadell May 2010 B2
7725570 Lewis May 2010 B1
7729326 Sekhar Jun 2010 B2
7730123 Erickson et al. Jun 2010 B1
7734784 Araujo et al. Jun 2010 B1
7742406 Muppala Jun 2010 B1
7746854 Ambe et al. Jun 2010 B2
7747240 Briscoe et al. Jun 2010 B1
7747699 Prueitt et al. Jun 2010 B2
7747730 Harlow Jun 2010 B1
7752330 Olsen et al. Jul 2010 B2
7756056 Kim et al. Jul 2010 B2
7756534 Anupam et al. Jul 2010 B2
7756757 Oakes, III Jul 2010 B1
7760137 Martucci et al. Jul 2010 B2
7760711 Kung et al. Jul 2010 B1
7760861 Croak et al. Jul 2010 B1
7765294 Edwards et al. Jul 2010 B2
7769397 Funato et al. Aug 2010 B2
7770785 Jha et al. Aug 2010 B2
7774323 Helfman Aug 2010 B2
7774412 Schnepel Aug 2010 B1
7774456 Lownsbrough et al. Aug 2010 B1
7778176 Morford Aug 2010 B2
7778643 Laroia et al. Aug 2010 B2
7792257 Vanier et al. Sep 2010 B1
7792538 Kozisek Sep 2010 B2
7792708 Alva Sep 2010 B2
7797019 Friedmann Sep 2010 B2
7797060 Grgic et al. Sep 2010 B2
7797204 Balent Sep 2010 B2
7797401 Stewart et al. Sep 2010 B2
7801523 Kenderov Sep 2010 B1
7801783 Kende et al. Sep 2010 B2
7801985 Pitkow et al. Sep 2010 B1
7802724 Nohr Sep 2010 B1
7805140 Friday et al. Sep 2010 B2
7805522 Schlüter et al. Sep 2010 B2
7805606 Birger et al. Sep 2010 B2
7809351 Panda et al. Oct 2010 B1
7809372 Rajaniemi Oct 2010 B2
7813746 Rajkotia Oct 2010 B2
7817615 Breau et al. Oct 2010 B1
7817983 Cassett et al. Oct 2010 B2
7822837 Urban et al. Oct 2010 B1
7822849 Titus Oct 2010 B2
7826427 Sood et al. Nov 2010 B2
7826607 de Carvalho Resende et al. Nov 2010 B1
7835275 Swan et al. Nov 2010 B1
7843831 Morrill et al. Nov 2010 B2
7843843 Papp, III et al. Nov 2010 B1
7844034 Oh et al. Nov 2010 B1
7844728 Anderson et al. Nov 2010 B2
7848768 Omori et al. Dec 2010 B2
7849161 Koch et al. Dec 2010 B2
7849170 Hargens et al. Dec 2010 B1
7849477 Cristofalo et al. Dec 2010 B2
7853255 Karaoguz et al. Dec 2010 B2
7853656 Yach et al. Dec 2010 B2
7856226 Wong et al. Dec 2010 B2
7860088 Lioy Dec 2010 B2
7865182 Macaluso Jan 2011 B2
7865187 Ramer et al. Jan 2011 B2
7868778 Kenwright Jan 2011 B2
7873001 Silver Jan 2011 B2
7873344 Bowser et al. Jan 2011 B2
7873346 Petersson et al. Jan 2011 B2
7873540 Arumugam Jan 2011 B2
7873705 Kalish Jan 2011 B2
7877090 Maes Jan 2011 B2
7881199 Krstulich Feb 2011 B2
7881697 Baker et al. Feb 2011 B2
7882029 White Feb 2011 B2
7882247 Sturniolo et al. Feb 2011 B2
7882560 Kraemer et al. Feb 2011 B2
7886047 Potluri Feb 2011 B1
7889384 Armentrout et al. Feb 2011 B2
7890084 Dudziak et al. Feb 2011 B1
7890111 Bugenhagen Feb 2011 B2
7894431 Goring et al. Feb 2011 B2
7899039 Andreasen et al. Mar 2011 B2
7899438 Baker et al. Mar 2011 B2
7903553 Liu Mar 2011 B2
7907970 Park et al. Mar 2011 B2
7911975 Droz et al. Mar 2011 B2
7912025 Pattenden et al. Mar 2011 B2
7912056 Brassem Mar 2011 B1
7920529 Mahler et al. Apr 2011 B1
7921463 Sood et al. Apr 2011 B2
7925740 Nath et al. Apr 2011 B2
7925778 Wijnands et al. Apr 2011 B1
7929959 DeAtley et al. Apr 2011 B2
7929960 Martin et al. Apr 2011 B2
7929973 Zavalkovsky et al. Apr 2011 B2
7930327 Craft et al. Apr 2011 B2
7930446 Kesselman et al. Apr 2011 B2
7930553 Satarasinghe et al. Apr 2011 B2
7933274 Verma et al. Apr 2011 B2
7936736 Proctor, Jr. et al. May 2011 B2
7937069 Rassam May 2011 B2
7937450 Janik May 2011 B2
7940685 Breslau et al. May 2011 B1
7940751 Hansen May 2011 B2
7941184 Prendergast et al. May 2011 B2
7944948 Chow et al. May 2011 B2
7945238 Baker et al. May 2011 B2
7945240 Klock et al. May 2011 B1
7945945 Graham et al. May 2011 B2
7948952 Hurtta et al. May 2011 B2
7948953 Melkote et al. May 2011 B2
7948968 Voit et al. May 2011 B2
7949529 Weider et al. May 2011 B2
7953808 Sharp et al. May 2011 B2
7953877 Vemula et al. May 2011 B2
7957020 Mine et al. Jun 2011 B2
7957381 Clermidy et al. Jun 2011 B2
7957511 Drudis et al. Jun 2011 B2
7958029 Bobich et al. Jun 2011 B1
7962622 Friend et al. Jun 2011 B2
7965983 Swan et al. Jun 2011 B1
7966405 Sundaresan et al. Jun 2011 B2
7969950 Iyer et al. Jun 2011 B2
7970350 Sheynman Jun 2011 B2
7970426 Poe et al. Jun 2011 B2
7974624 Gallagher et al. Jul 2011 B2
7975184 Goff et al. Jul 2011 B2
7978627 Taylor et al. Jul 2011 B2
7978686 Goyal et al. Jul 2011 B2
7979069 Hupp et al. Jul 2011 B2
7979889 Gladstone et al. Jul 2011 B2
7979896 McMurtry et al. Jul 2011 B2
7984130 Bogineni et al. Jul 2011 B2
7984511 Kocher et al. Jul 2011 B2
7986935 D'Souza et al. Jul 2011 B1
7987496 Bryce et al. Jul 2011 B2
7987510 Kocher et al. Jul 2011 B2
7990049 Shioya Aug 2011 B2
8000276 Scherzer et al. Aug 2011 B2
8000318 Wiley et al. Aug 2011 B2
8005009 McKee et al. Aug 2011 B2
8005459 Balsillie Aug 2011 B2
8005726 Bao Aug 2011 B1
8005913 Carlander Aug 2011 B1
8005988 Maes Aug 2011 B2
8010080 Thenthiruperai et al. Aug 2011 B1
8010081 Roskowski Aug 2011 B1
8010082 Sutaria et al. Aug 2011 B2
8010990 Ferguson et al. Aug 2011 B2
8015133 Wu et al. Sep 2011 B1
8015234 Lum et al. Sep 2011 B2
8019687 Wang et al. Sep 2011 B2
8019820 Son et al. Sep 2011 B2
8019846 Roelens et al. Sep 2011 B2
8019868 Rao et al. Sep 2011 B2
8019886 Harrang et al. Sep 2011 B2
8023425 Raleigh Sep 2011 B2
8024397 Erickson et al. Sep 2011 B1
8024424 Freimuth et al. Sep 2011 B2
8027339 Short et al. Sep 2011 B2
8031601 Feroz et al. Oct 2011 B2
8032168 Ikaheimo Oct 2011 B2
8032409 Mikurak Oct 2011 B1
8032899 Archer et al. Oct 2011 B2
8036387 Kudelski et al. Oct 2011 B2
8036600 Garrett et al. Oct 2011 B2
8044792 Orr et al. Oct 2011 B2
8045973 Chambers Oct 2011 B2
8046449 Yoshiuchi Oct 2011 B2
8050275 Iyer Nov 2011 B1
8050690 Neeraj Nov 2011 B2
8050705 Sicher et al. Nov 2011 B2
8059530 Cole Nov 2011 B1
8060017 Schlicht et al. Nov 2011 B2
8060463 Spiegel Nov 2011 B1
8064418 Maki Nov 2011 B2
8064896 Bell et al. Nov 2011 B2
8065365 Saxena et al. Nov 2011 B2
8068824 Shan et al. Nov 2011 B2
8068829 Lemond et al. Nov 2011 B2
8073427 Koch et al. Dec 2011 B2
8073721 Lewis Dec 2011 B1
8078140 Baker et al. Dec 2011 B2
8078163 Lemond et al. Dec 2011 B2
8085808 Brusca et al. Dec 2011 B2
8086398 Sanchez et al. Dec 2011 B2
8086497 Oakes, III Dec 2011 B1
8086791 Caulkins Dec 2011 B2
8090359 Proctor, Jr. et al. Jan 2012 B2
8090361 Hagan Jan 2012 B2
8090616 Proctor, Jr. et al. Jan 2012 B2
8091087 Ali et al. Jan 2012 B2
8094551 Huber et al. Jan 2012 B2
8095112 Chow et al. Jan 2012 B2
8095124 Balia Jan 2012 B2
8095640 Guingo et al. Jan 2012 B2
8095666 Schmidt et al. Jan 2012 B2
8098579 Ray et al. Jan 2012 B2
8099077 Chowdhury et al. Jan 2012 B2
8099517 Jia et al. Jan 2012 B2
8102814 Rahman et al. Jan 2012 B2
8103285 Kalhan Jan 2012 B2
8104080 Burns et al. Jan 2012 B2
8107953 Zimmerman et al. Jan 2012 B2
8108520 Ruutu et al. Jan 2012 B2
8108680 Murray Jan 2012 B2
8112435 Epstein et al. Feb 2012 B2
8116223 Tian et al. Feb 2012 B2
8116749 Proctor, Jr. et al. Feb 2012 B2
8116781 Chen et al. Feb 2012 B2
8122128 Burke, II et al. Feb 2012 B2
8122249 Falk et al. Feb 2012 B2
8125897 Ray et al. Feb 2012 B2
8126123 Cai et al. Feb 2012 B2
8126396 Bennett Feb 2012 B2
8126476 Vardi et al. Feb 2012 B2
8126722 Robb et al. Feb 2012 B2
8130793 Edwards et al. Mar 2012 B2
8131256 Martti et al. Mar 2012 B2
8131281 Hildner et al. Mar 2012 B1
8131840 Denker Mar 2012 B1
8131858 Agulnik et al. Mar 2012 B2
8132256 Bari Mar 2012 B2
8134954 Godfrey et al. Mar 2012 B2
8135388 Gailloux et al. Mar 2012 B1
8135392 Marcellino et al. Mar 2012 B2
8135657 Kapoor et al. Mar 2012 B2
8140690 Ly et al. Mar 2012 B2
8144591 Ghai et al. Mar 2012 B2
8145194 Yoshikawa et al. Mar 2012 B2
8146142 Lortz et al. Mar 2012 B2
8149748 Bata et al. Apr 2012 B2
8149823 Turcan et al. Apr 2012 B2
8150394 Bianconi et al. Apr 2012 B2
8150431 Wolovitz et al. Apr 2012 B2
8151205 Follmann et al. Apr 2012 B2
8155155 Chow et al. Apr 2012 B1
8155620 Wang et al. Apr 2012 B2
8155666 Alizadeh-Shabdiz Apr 2012 B2
8155670 Fullam et al. Apr 2012 B2
8156206 Kiley et al. Apr 2012 B2
8159520 Dhanoa et al. Apr 2012 B1
8160015 Rashid et al. Apr 2012 B2
8160056 Van der Merwe et al. Apr 2012 B2
8160598 Savoor Apr 2012 B2
8165576 Raju et al. Apr 2012 B2
8166040 Brindisi et al. Apr 2012 B2
8166554 John Apr 2012 B2
8170553 Bennett May 2012 B2
8174378 Richman et al. May 2012 B2
8174970 Adamczyk et al. May 2012 B2
8175574 Panda et al. May 2012 B1
8180333 Wells et al. May 2012 B1
8180881 Seo et al. May 2012 B2
8180886 Overcash et al. May 2012 B2
8184530 Swan et al. May 2012 B1
8184590 Rosenblatt May 2012 B2
8185088 Klein et al. May 2012 B2
8185093 Jheng et al. May 2012 B2
8185127 Cai et al. May 2012 B1
8185152 Goldner May 2012 B1
8185158 Tamura et al. May 2012 B2
8190087 Fisher et al. May 2012 B2
8190122 Alexander et al. May 2012 B1
8190675 Tribbett May 2012 B2
8191106 Choyi et al. May 2012 B2
8191116 Gazzard May 2012 B1
8191124 Wynn et al. May 2012 B2
8194549 Huber et al. Jun 2012 B2
8194553 Liang et al. Jun 2012 B2
8194572 Horvath et al. Jun 2012 B2
8194581 Schroeder et al. Jun 2012 B1
8195093 Garrett et al. Jun 2012 B2
8195153 Frencel et al. Jun 2012 B1
8195163 Gisby et al. Jun 2012 B2
8195661 Kalavade Jun 2012 B2
8196199 Hrastar et al. Jun 2012 B2
8200163 Hoffman Jun 2012 B2
8200200 Belser et al. Jun 2012 B1
8200509 Kenedy et al. Jun 2012 B2
8200775 Moore Jun 2012 B2
8200818 Freund et al. Jun 2012 B2
8204190 Bang et al. Jun 2012 B2
8204505 Jin et al. Jun 2012 B2
8204794 Peng et al. Jun 2012 B1
8208788 Ando et al. Jun 2012 B2
8208919 Kotecha Jun 2012 B2
8213296 Shannon et al. Jul 2012 B2
8213363 Ying et al. Jul 2012 B2
8214536 Zhao Jul 2012 B2
8214890 Kirovski et al. Jul 2012 B2
8219134 Maharajh et al. Jul 2012 B2
8223655 Heinz et al. Jul 2012 B2
8223741 Bartlett et al. Jul 2012 B1
8224382 Bultman Jul 2012 B2
8224773 Spiegel Jul 2012 B2
8228818 Chase et al. Jul 2012 B2
8229394 Karlberg Jul 2012 B2
8229914 Ramer et al. Jul 2012 B2
8230061 Hassan et al. Jul 2012 B2
8233433 Kalhan Jul 2012 B2
8233883 De Froment Jul 2012 B2
8233895 Tysowski Jul 2012 B2
8234583 Sloo et al. Jul 2012 B2
8238287 Gopi et al. Aug 2012 B1
8239520 Grah Aug 2012 B2
8242959 Mia et al. Aug 2012 B2
8244241 Montemurro Aug 2012 B2
8249601 Emberson et al. Aug 2012 B2
8254880 Aaltonen et al. Aug 2012 B2
8254915 Kozisek Aug 2012 B2
8255515 Melman et al. Aug 2012 B1
8255534 Assadzadeh Aug 2012 B2
8255689 Kim et al. Aug 2012 B2
8259692 Bajko Sep 2012 B2
8264965 Dolganow et al. Sep 2012 B2
8265004 Toutonghi Sep 2012 B2
8266249 Hu Sep 2012 B2
8266681 Deshpande et al. Sep 2012 B2
8270955 Ramer et al. Sep 2012 B2
8270972 Otting et al. Sep 2012 B2
8271025 Brisebois et al. Sep 2012 B2
8271045 Parolkar et al. Sep 2012 B2
8271049 Silver et al. Sep 2012 B2
8271992 Chatley et al. Sep 2012 B2
8275415 Huslak Sep 2012 B2
8275830 Raleigh Sep 2012 B2
8279067 Berger et al. Oct 2012 B2
8279864 Wood Oct 2012 B2
8280351 Ahmed et al. Oct 2012 B1
8280354 Smith et al. Oct 2012 B2
8284740 O'Connor Oct 2012 B2
8285249 Baker et al. Oct 2012 B2
8285992 Mathur et al. Oct 2012 B2
8291238 Ginter et al. Oct 2012 B2
8291439 Jethi et al. Oct 2012 B2
8296404 McDysan et al. Oct 2012 B2
8300575 Willars Oct 2012 B2
8301513 Peng et al. Oct 2012 B1
8306518 Gailloux Nov 2012 B1
8306741 Tu Nov 2012 B2
8307067 Ryan Nov 2012 B2
8307095 Clark et al. Nov 2012 B2
8315198 Corneille et al. Nov 2012 B2
8315593 Gallant et al. Nov 2012 B2
8315594 Mauser et al. Nov 2012 B1
8315718 Caffrey et al. Nov 2012 B2
8315999 Chatley et al. Nov 2012 B2
8320244 Muqattash et al. Nov 2012 B2
8320902 Moring et al. Nov 2012 B2
8320949 Matta Nov 2012 B2
8325638 Jin et al. Dec 2012 B2
8325906 Fullarton et al. Dec 2012 B2
8326319 Davis Dec 2012 B2
8326359 Kauffman Dec 2012 B2
8326828 Zhou et al. Dec 2012 B2
8331223 Hill et al. Dec 2012 B2
8331293 Sood Dec 2012 B2
8332375 Chatley et al. Dec 2012 B2
8332517 Russell Dec 2012 B2
8335161 Foottit et al. Dec 2012 B2
8339991 Biswas et al. Dec 2012 B2
8340625 Johnson et al. Dec 2012 B1
8340628 Taylor et al. Dec 2012 B2
8340678 Pandey Dec 2012 B1
8340718 Colonna et al. Dec 2012 B2
8346210 Balsan et al. Jan 2013 B2
8346923 Rowles et al. Jan 2013 B2
8347104 Pathiyal Jan 2013 B2
8347362 Cai et al. Jan 2013 B2
8347378 Merkin et al. Jan 2013 B2
8350700 Fast et al. Jan 2013 B2
8351592 Freeny, Jr. et al. Jan 2013 B2
8351898 Raleigh Jan 2013 B2
8352360 De Judicibus et al. Jan 2013 B2
8352630 Hart Jan 2013 B2
8352980 Howcroft Jan 2013 B2
8353001 Herrod Jan 2013 B2
8355570 Karsanbhai et al. Jan 2013 B2
8355696 Olding et al. Jan 2013 B1
8356336 Johnston et al. Jan 2013 B2
8358638 Scherzer et al. Jan 2013 B2
8358975 Bahl et al. Jan 2013 B2
8363658 Delker et al. Jan 2013 B1
8363799 Gruchala et al. Jan 2013 B2
8364089 Phillips Jan 2013 B2
8364806 Short et al. Jan 2013 B2
8369274 Sawai Feb 2013 B2
8370477 Short et al. Feb 2013 B2
8370483 Choong et al. Feb 2013 B2
8374090 Morrill et al. Feb 2013 B2
8374592 Proctor, Jr. et al. Feb 2013 B2
8375128 Tofighbakhsh et al. Feb 2013 B2
8375136 Roman et al. Feb 2013 B2
8379847 Bell et al. Feb 2013 B2
8380247 Engstrom Feb 2013 B2
8385199 Coward et al. Feb 2013 B1
8385896 Proctor, Jr. et al. Feb 2013 B2
8385964 Haney Feb 2013 B2
8385975 Forutanpour Feb 2013 B2
8386386 Zhu Feb 2013 B1
8391262 Maki et al. Mar 2013 B2
8391834 Raleigh Mar 2013 B2
8392982 Harris et al. Mar 2013 B2
8396458 Raleigh Mar 2013 B2
8396929 Helfman et al. Mar 2013 B2
8401968 Schattauer et al. Mar 2013 B1
8402165 Deu-Ngoc et al. Mar 2013 B2
8402540 Kapoor et al. Mar 2013 B2
8406427 Chand et al. Mar 2013 B2
8406736 Das et al. Mar 2013 B2
8406756 Reeves Mar 2013 B1
8407472 Hao et al. Mar 2013 B2
8407763 Weller et al. Mar 2013 B2
8411587 Curtis et al. Apr 2013 B2
8411691 Aggarwal Apr 2013 B2
8412798 Wang Apr 2013 B1
8413245 Kraemer et al. Apr 2013 B2
8418168 Tyhurst et al. Apr 2013 B2
8422988 Keshav Apr 2013 B1
8423016 Buckley et al. Apr 2013 B2
8429403 Moret et al. Apr 2013 B2
8429409 Wall et al. Apr 2013 B1
8437734 Ray et al. May 2013 B2
8441955 Wilkinson et al. May 2013 B2
8442015 Behzad et al. May 2013 B2
8443390 Lo May 2013 B2
8446831 Kwan et al. May 2013 B2
8447324 Shuman et al. May 2013 B2
8447607 Weider et al. May 2013 B2
8447980 Godfrey et al. May 2013 B2
8448015 Gerhart May 2013 B2
8452858 Wu et al. May 2013 B2
8461958 Saenz et al. Jun 2013 B2
8463194 Erlenback et al. Jun 2013 B2
8463232 Tuli et al. Jun 2013 B2
8468337 Gaur et al. Jun 2013 B2
8472371 Bari et al. Jun 2013 B1
8477778 Lehmann, Jr. et al. Jul 2013 B2
8483135 Cai et al. Jul 2013 B2
8483694 Lewis et al. Jul 2013 B2
8484327 Werner et al. Jul 2013 B2
8484568 Rados et al. Jul 2013 B2
8488597 Nie et al. Jul 2013 B2
8489110 Frank et al. Jul 2013 B2
8489720 Morford et al. Jul 2013 B1
8494559 Malmi Jul 2013 B1
8495181 Venkatraman et al. Jul 2013 B2
8495227 Kaminsky et al. Jul 2013 B2
8495360 Falk et al. Jul 2013 B2
8495700 Shahbazi Jul 2013 B2
8495743 Kraemer et al. Jul 2013 B2
8499087 Hu Jul 2013 B2
8571598 Valavi Jul 2013 B2
RE44412 Naqvi et al. Aug 2013 E
8500533 Lutnick et al. Aug 2013 B2
8503358 Hanson et al. Aug 2013 B2
8503455 Heikens Aug 2013 B2
8504032 Lott et al. Aug 2013 B2
8504574 Dvorak et al. Aug 2013 B2
8504687 Maffione et al. Aug 2013 B2
8504690 Shah et al. Aug 2013 B2
8504729 Pezzutti Aug 2013 B2
8505073 Taglienti et al. Aug 2013 B2
8509082 Heinz et al. Aug 2013 B2
8514927 Sundararajan et al. Aug 2013 B2
8516552 Raleigh Aug 2013 B2
8520589 Bhatt et al. Aug 2013 B2
8520595 Yadav et al. Aug 2013 B2
8521110 Rofougaran Aug 2013 B2
8521775 Poh et al. Aug 2013 B1
8522039 Hyndman et al. Aug 2013 B2
8522249 Beaule Aug 2013 B2
8522337 Adusumilli et al. Aug 2013 B2
8523547 Pekrul Sep 2013 B2
8526329 Mahany et al. Sep 2013 B2
8527410 Markki et al. Sep 2013 B2
8527662 Biswas et al. Sep 2013 B2
8528068 Weglein et al. Sep 2013 B1
8531954 McNaughton et al. Sep 2013 B2
8531995 Khan et al. Sep 2013 B2
8532610 Manning Cassett et al. Sep 2013 B2
8533775 Alcorn et al. Sep 2013 B2
8535160 Lutnick et al. Sep 2013 B2
8538394 Zimmerman et al. Sep 2013 B2
8538421 Brisebois et al. Sep 2013 B2
8538458 Haney Sep 2013 B2
8539544 Garimella et al. Sep 2013 B2
8539561 Gupta et al. Sep 2013 B2
8543265 Ekhaguere et al. Sep 2013 B2
8543814 Laitinen et al. Sep 2013 B2
8544105 Mclean et al. Sep 2013 B2
8548427 Chow et al. Oct 2013 B2
8548428 Raleigh Oct 2013 B2
8549173 Wu et al. Oct 2013 B1
8554876 Winsor Oct 2013 B2
8559369 Barkan Oct 2013 B2
8565746 Hoffman Oct 2013 B2
8566236 Busch Oct 2013 B2
8571474 Chavez et al. Oct 2013 B2
8571501 Miller et al. Oct 2013 B2
8571993 Kocher et al. Oct 2013 B2
8572117 Rappaport Oct 2013 B2
8572256 Babbar Oct 2013 B2
8583499 De Judicibus et al. Nov 2013 B2
8588240 Ramankutty et al. Nov 2013 B2
8589541 Raleigh et al. Nov 2013 B2
8589955 Roundtree et al. Nov 2013 B2
8594665 Anschutz Nov 2013 B2
8595186 Mandyam et al. Nov 2013 B1
8600895 Felsher Dec 2013 B2
8601125 Huang et al. Dec 2013 B2
8605691 Soomro et al. Dec 2013 B2
8615507 Varadarajulu et al. Dec 2013 B2
8619735 Montemurro et al. Dec 2013 B2
8620257 Qiu et al. Dec 2013 B2
8621056 Coussemaeker et al. Dec 2013 B2
8626115 Raleigh et al. Jan 2014 B2
8630314 York Jan 2014 B2
8631428 Scott et al. Jan 2014 B2
8634425 Gorti et al. Jan 2014 B2
8635164 Rosenhaft et al. Jan 2014 B2
8639215 McGregor et al. Jan 2014 B2
8644702 Kalajan Feb 2014 B1
8644813 Gailloux et al. Feb 2014 B1
8645518 David Feb 2014 B2
8655357 Gazzard et al. Feb 2014 B1
8656472 McMurtry et al. Feb 2014 B2
8660853 Robb et al. Feb 2014 B2
8666395 Silver Mar 2014 B2
8667542 Bertz et al. Mar 2014 B1
8670334 Keohane et al. Mar 2014 B2
8670752 Fan et al. Mar 2014 B2
8675852 Maes Mar 2014 B2
8676682 Kalliola Mar 2014 B2
8676925 Liu et al. Mar 2014 B1
8693323 McDysan Apr 2014 B1
8694772 Kao et al. Apr 2014 B2
8700729 Dua Apr 2014 B2
8701015 Bonnat Apr 2014 B2
8705361 Venkataraman et al. Apr 2014 B2
8706863 Fadell Apr 2014 B2
8713535 Malhotra et al. Apr 2014 B2
8713641 Pagan et al. Apr 2014 B1
8719397 Levi et al. May 2014 B2
8719423 Wyld May 2014 B2
8725899 Short et al. May 2014 B2
8730842 Collins et al. May 2014 B2
8731519 Flynn et al. May 2014 B2
8732808 Sewall et al. May 2014 B2
8739035 Trethewey May 2014 B2
8744339 Halfmann et al. Jun 2014 B2
8761711 Grignani et al. Jun 2014 B2
8780857 Balasubramanian et al. Jul 2014 B2
8787249 Giaretta et al. Jul 2014 B2
8793304 Lu et al. Jul 2014 B2
8804517 Oerton Aug 2014 B2
8804695 Branam Aug 2014 B2
8811338 Jin et al. Aug 2014 B2
8811991 Jain et al. Aug 2014 B2
8812525 Taylor, III Aug 2014 B1
8818394 Bienas et al. Aug 2014 B2
8819253 Simeloff et al. Aug 2014 B2
8825109 Montemurro et al. Sep 2014 B2
8826411 Moen et al. Sep 2014 B2
8831561 Sutaria et al. Sep 2014 B2
8837322 Venkataramanan et al. Sep 2014 B2
8838686 Getchius Sep 2014 B2
8838752 Lor et al. Sep 2014 B2
8843849 Neil et al. Sep 2014 B2
8845415 Lutnick et al. Sep 2014 B2
8849297 Balasubramanian Sep 2014 B2
8855620 Sievers et al. Oct 2014 B2
8862751 Faccin et al. Oct 2014 B2
8863111 Selitser et al. Oct 2014 B2
8868725 Samba Oct 2014 B2
8868727 Yumerefendi et al. Oct 2014 B2
8875042 Lejeune et al. Oct 2014 B2
8880047 Konicek et al. Nov 2014 B2
8891483 Connelly et al. Nov 2014 B2
8898748 Burks et al. Nov 2014 B2
8908516 Tzamaloukas et al. Dec 2014 B2
8929374 Tönsing et al. Jan 2015 B2
8930238 Coffman et al. Jan 2015 B2
8943551 Ganapathy et al. Jan 2015 B2
8948726 Smith et al. Feb 2015 B2
8949382 Cornell et al. Feb 2015 B2
8949597 Reeves et al. Feb 2015 B1
8955038 Nicodemus et al. Feb 2015 B2
8966018 Bugwadia et al. Feb 2015 B2
8971841 Menezes et al. Mar 2015 B2
8971912 Chou et al. Mar 2015 B2
8972537 Bastian et al. Mar 2015 B2
8977284 Reed Mar 2015 B2
8995952 Baker et al. Mar 2015 B1
9002342 Tenhunen et al. Apr 2015 B2
9014973 Ruckart Apr 2015 B2
9015331 Lai et al. Apr 2015 B2
9030934 Shah et al. May 2015 B2
9032427 Gallant et al. May 2015 B2
9049010 Jueneman et al. Jun 2015 B2
9064275 Lu et al. Jun 2015 B1
9105031 Shen et al. Aug 2015 B2
9111088 Ghai et al. Aug 2015 B2
9135037 Petrescu-Prahova et al. Sep 2015 B1
9137286 Yuan Sep 2015 B1
9172553 Dawes et al. Oct 2015 B2
9173090 Tuchman et al. Oct 2015 B2
9176913 Millet et al. Nov 2015 B2
9177455 Remer Nov 2015 B2
9282460 Souissi Mar 2016 B2
9286469 Kraemer et al. Mar 2016 B2
9286604 Aabye et al. Mar 2016 B2
9313708 Nam et al. Apr 2016 B2
9325737 Gutowski et al. Apr 2016 B2
9326173 Luft Apr 2016 B2
9344557 Gruchala et al. May 2016 B2
9363285 Kitamura Jun 2016 B2
9367680 Mahaffey et al. Jun 2016 B2
9402254 Kneckt et al. Jul 2016 B2
9413546 Meier et al. Aug 2016 B2
9418381 Ahuja et al. Aug 2016 B2
9501803 Bilac et al. Nov 2016 B2
9589117 Ali et al. Mar 2017 B2
9609459 Raleigh Mar 2017 B2
9634850 Taft et al. Apr 2017 B2
20010048738 Baniak et al. Dec 2001 A1
20010053694 Igarashi et al. Dec 2001 A1
20020013844 Garrett et al. Jan 2002 A1
20020022472 Watler et al. Feb 2002 A1
20020022483 Thompson et al. Feb 2002 A1
20020049074 Eisinger et al. Apr 2002 A1
20020099848 Lee Jul 2002 A1
20020116338 Gonthier et al. Aug 2002 A1
20020120370 Parupudi et al. Aug 2002 A1
20020120540 Kende et al. Aug 2002 A1
20020131397 Patel Sep 2002 A1
20020131404 Mehta et al. Sep 2002 A1
20020138599 Dilman et al. Sep 2002 A1
20020138601 Piponius et al. Sep 2002 A1
20020154751 Thompson et al. Oct 2002 A1
20020161601 Nauer et al. Oct 2002 A1
20020164983 Raviv et al. Nov 2002 A1
20020176377 Hamilton Nov 2002 A1
20020188732 Buckman et al. Dec 2002 A1
20020191573 Whitehill et al. Dec 2002 A1
20020199001 Wenocur et al. Dec 2002 A1
20030004937 Salmenkaita et al. Jan 2003 A1
20030005112 Krautkremer Jan 2003 A1
20030013434 Rosenberg et al. Jan 2003 A1
20030018524 Fishman et al. Jan 2003 A1
20030028623 Hennessey et al. Feb 2003 A1
20030046396 Richter et al. Mar 2003 A1
20030050070 Mashinsky et al. Mar 2003 A1
20030050837 Kim Mar 2003 A1
20030084321 Tarquini et al. May 2003 A1
20030088671 Klinker et al. May 2003 A1
20030133408 Cheng et al. Jul 2003 A1
20030134650 Sundar et al. Jul 2003 A1
20030159030 Evans Aug 2003 A1
20030161265 Cao et al. Aug 2003 A1
20030171112 Lupper et al. Sep 2003 A1
20030182420 Jones et al. Sep 2003 A1
20030182435 Redlich et al. Sep 2003 A1
20030184793 Pineau Oct 2003 A1
20030188006 Bard Oct 2003 A1
20030188117 Yoshino et al. Oct 2003 A1
20030220984 Jones et al. Nov 2003 A1
20030224781 Milford et al. Dec 2003 A1
20030229900 Reisman Dec 2003 A1
20030233332 Keeler et al. Dec 2003 A1
20030236745 Hartsell et al. Dec 2003 A1
20040019539 Raman et al. Jan 2004 A1
20040019564 Goldthwaite et al. Jan 2004 A1
20040021697 Beaton et al. Feb 2004 A1
20040024756 Rickard Feb 2004 A1
20040030705 Bowman-Amuah Feb 2004 A1
20040039792 Nakanishi Feb 2004 A1
20040044623 Wake et al. Mar 2004 A1
20040047358 Chen et al. Mar 2004 A1
20040054779 Takeshima et al. Mar 2004 A1
20040073672 Fascenda Apr 2004 A1
20040082346 Skytt et al. Apr 2004 A1
20040098715 Aghera et al. May 2004 A1
20040102182 Reith et al. May 2004 A1
20040103193 Pandya et al. May 2004 A1
20040107360 Herrmann et al. Jun 2004 A1
20040116140 Babbar et al. Jun 2004 A1
20040127200 Shaw et al. Jul 2004 A1
20040127208 Nair et al. Jul 2004 A1
20040127256 Goldthwaite et al. Jul 2004 A1
20040132427 Lee et al. Jul 2004 A1
20040133668 Nicholas, III Jul 2004 A1
20040137890 Kalke Jul 2004 A1
20040167958 Stewart et al. Aug 2004 A1
20040168052 Clisham et al. Aug 2004 A1
20040170191 Guo et al. Sep 2004 A1
20040176104 Arcens Sep 2004 A1
20040198331 Coward et al. Oct 2004 A1
20040203755 Brunet et al. Oct 2004 A1
20040203833 Rathunde et al. Oct 2004 A1
20040225561 Hertzberg et al. Nov 2004 A1
20040225898 Frost et al. Nov 2004 A1
20040236547 Rappaport et al. Nov 2004 A1
20040243680 Mayer Dec 2004 A1
20040243992 Gustafson et al. Dec 2004 A1
20040249918 Sunshine Dec 2004 A1
20040255145 Chow Dec 2004 A1
20040259534 Chaudhari et al. Dec 2004 A1
20040260766 Barros et al. Dec 2004 A1
20040267872 Serdy et al. Dec 2004 A1
20050007993 Chambers et al. Jan 2005 A1
20050009499 Koster Jan 2005 A1
20050021995 Lal et al. Jan 2005 A1
20050041617 Huotari et al. Feb 2005 A1
20050048950 Morper Mar 2005 A1
20050055291 Bevente et al. Mar 2005 A1
20050055309 Williams et al. Mar 2005 A1
20050055595 Frazer et al. Mar 2005 A1
20050060266 DeMello et al. Mar 2005 A1
20050060525 Schwartz et al. Mar 2005 A1
20050075115 Corneille et al. Apr 2005 A1
20050079863 Macaluso Apr 2005 A1
20050091505 Riley et al. Apr 2005 A1
20050096024 Bicker et al. May 2005 A1
20050097516 Donnelly et al. May 2005 A1
20050107091 Vannithamby et al. May 2005 A1
20050108075 Douglis et al. May 2005 A1
20050111463 Leung et al. May 2005 A1
20050128967 Scobbie Jun 2005 A1
20050135264 Popoff et al. Jun 2005 A1
20050163320 Brown et al. Jul 2005 A1
20050166043 Zhang et al. Jul 2005 A1
20050183143 Anderholm et al. Aug 2005 A1
20050186948 Gallagher et al. Aug 2005 A1
20050198377 Ferguson et al. Sep 2005 A1
20050216421 Barry et al. Sep 2005 A1
20050228985 Ylikoski et al. Oct 2005 A1
20050238046 Hassan et al. Oct 2005 A1
20050239447 Holzman et al. Oct 2005 A1
20050245241 Durand et al. Nov 2005 A1
20050246282 Naslund et al. Nov 2005 A1
20050250508 Guo et al. Nov 2005 A1
20050250536 Deng et al. Nov 2005 A1
20050254435 Moakley et al. Nov 2005 A1
20050266825 Clayton Dec 2005 A1
20050266880 Gupta Dec 2005 A1
20060014519 Marsh et al. Jan 2006 A1
20060019632 Cunningham et al. Jan 2006 A1
20060020787 Choyi et al. Jan 2006 A1
20060026679 Zakas Feb 2006 A1
20060030306 Kuhn Feb 2006 A1
20060034256 Addagatla et al. Feb 2006 A1
20060035631 White et al. Feb 2006 A1
20060040642 Boris et al. Feb 2006 A1
20060045245 Aaron et al. Mar 2006 A1
20060048223 Lee et al. Mar 2006 A1
20060068796 Millen et al. Mar 2006 A1
20060072451 Ross Apr 2006 A1
20060072550 Davis et al. Apr 2006 A1
20060072646 Feher Apr 2006 A1
20060075506 Sanda et al. Apr 2006 A1
20060085543 Hrastar et al. Apr 2006 A1
20060095517 O'Connor et al. May 2006 A1
20060098627 Karaoguz et al. May 2006 A1
20060099970 Morgan et al. May 2006 A1
20060101507 Camenisch May 2006 A1
20060112016 Ishibashi May 2006 A1
20060114821 Willey et al. Jun 2006 A1
20060114832 Hamilton et al. Jun 2006 A1
20060126562 Liu Jun 2006 A1
20060135144 Jothipragasam Jun 2006 A1
20060136882 Noonan et al. Jun 2006 A1
20060143066 Calabria Jun 2006 A1
20060143098 Lazaridis Jun 2006 A1
20060156398 Ross et al. Jul 2006 A1
20060160536 Chou Jul 2006 A1
20060165060 Dua Jul 2006 A1
20060168128 Sistla et al. Jul 2006 A1
20060173959 McKelvie et al. Aug 2006 A1
20060174035 Tufail Aug 2006 A1
20060178917 Merriam et al. Aug 2006 A1
20060178918 Mikurak Aug 2006 A1
20060178943 Rollinson Aug 2006 A1
20060182137 Zhou et al. Aug 2006 A1
20060183462 Kolehmainen Aug 2006 A1
20060190314 Hernandez Aug 2006 A1
20060190987 Ohta et al. Aug 2006 A1
20060199608 Dunn et al. Sep 2006 A1
20060200663 Thornton Sep 2006 A1
20060206709 Labrou et al. Sep 2006 A1
20060206904 Watkins et al. Sep 2006 A1
20060218395 Maes Sep 2006 A1
20060233108 Krishnan Oct 2006 A1
20060233166 Bou-Diab et al. Oct 2006 A1
20060236095 Smith et al. Oct 2006 A1
20060242685 Heard et al. Oct 2006 A1
20060258341 Miller et al. Nov 2006 A1
20060277590 Limont et al. Dec 2006 A1
20060291419 McConnell et al. Dec 2006 A1
20060291477 Croak et al. Dec 2006 A1
20070005795 Gonzalez Jan 2007 A1
20070019670 Falardeau Jan 2007 A1
20070022289 Alt et al. Jan 2007 A1
20070025301 Petersson et al. Feb 2007 A1
20070033194 Srinivas et al. Feb 2007 A1
20070033197 Scherzer et al. Feb 2007 A1
20070036312 Cai et al. Feb 2007 A1
20070055694 Ruge et al. Mar 2007 A1
20070060200 Boris et al. Mar 2007 A1
20070061243 Ramer et al. Mar 2007 A1
20070061800 Cheng et al. Mar 2007 A1
20070061878 Hagiu et al. Mar 2007 A1
20070073899 Judge et al. Mar 2007 A1
20070076616 Ngo et al. Apr 2007 A1
20070093243 Kapadekar et al. Apr 2007 A1
20070100981 Adamczyk et al. May 2007 A1
20070101426 Lee et al. May 2007 A1
20070104126 Calhoun et al. May 2007 A1
20070109983 Shankar et al. May 2007 A1
20070111740 Wandel May 2007 A1
20070130283 Klein et al. Jun 2007 A1
20070130315 Friend et al. Jun 2007 A1
20070140113 Gemelos Jun 2007 A1
20070140145 Kumar et al. Jun 2007 A1
20070140275 Bowman et al. Jun 2007 A1
20070143824 Shahbazi Jun 2007 A1
20070147317 Smith et al. Jun 2007 A1
20070147324 McGary Jun 2007 A1
20070155365 Kim et al. Jul 2007 A1
20070165630 Rasanen Jul 2007 A1
20070168499 Chu Jul 2007 A1
20070171856 Bruce et al. Jul 2007 A1
20070174490 Choi et al. Jul 2007 A1
20070191006 Carpenter Aug 2007 A1
20070192460 Choi et al. Aug 2007 A1
20070198656 Mazzaferri et al. Aug 2007 A1
20070201502 Abramson Aug 2007 A1
20070213054 Han Sep 2007 A1
20070220251 Rosenberg et al. Sep 2007 A1
20070226225 Yiu et al. Sep 2007 A1
20070226775 Andreasen et al. Sep 2007 A1
20070234402 Khosravi et al. Oct 2007 A1
20070243862 Coskun et al. Oct 2007 A1
20070248100 Zuberi et al. Oct 2007 A1
20070254646 Sokondar Nov 2007 A1
20070254675 Zorlu Ozer et al. Nov 2007 A1
20070255769 Agrawal et al. Nov 2007 A1
20070255797 Dunn et al. Nov 2007 A1
20070255848 Sewall et al. Nov 2007 A1
20070257767 Beeson Nov 2007 A1
20070259656 Jeong Nov 2007 A1
20070259673 Willars et al. Nov 2007 A1
20070263558 Salomone Nov 2007 A1
20070266422 Germano et al. Nov 2007 A1
20070274327 Kaarela et al. Nov 2007 A1
20070280453 Kelley Dec 2007 A1
20070282896 Wydroug et al. Dec 2007 A1
20070293191 Mir et al. Dec 2007 A1
20070294395 Strub et al. Dec 2007 A1
20070294410 Pandya et al. Dec 2007 A1
20070297378 Poyhonen et al. Dec 2007 A1
20070298764 Clayton Dec 2007 A1
20070299965 Nieh et al. Dec 2007 A1
20070300252 Acharya et al. Dec 2007 A1
20080005285 Robinson et al. Jan 2008 A1
20080005561 Brown et al. Jan 2008 A1
20080010379 Zhao Jan 2008 A1
20080010452 Holtzman et al. Jan 2008 A1
20080018494 Waite et al. Jan 2008 A1
20080022354 Grewal et al. Jan 2008 A1
20080025230 Patel et al. Jan 2008 A1
20080032715 Jia et al. Feb 2008 A1
20080034063 Yee Feb 2008 A1
20080034419 Mullick et al. Feb 2008 A1
20080039102 Sewall et al. Feb 2008 A1
20080049630 Kozisek et al. Feb 2008 A1
20080050715 Golczewski et al. Feb 2008 A1
20080051076 O'Shaughnessy et al. Feb 2008 A1
20080052387 Heinz et al. Feb 2008 A1
20080056273 Pelletier et al. Mar 2008 A1
20080059474 Lim Mar 2008 A1
20080059743 Bychkov et al. Mar 2008 A1
20080060066 Wynn et al. Mar 2008 A1
20080062900 Rao Mar 2008 A1
20080064367 Nath et al. Mar 2008 A1
20080066149 Lim Mar 2008 A1
20080066150 Lim Mar 2008 A1
20080066181 Haveson et al. Mar 2008 A1
20080070550 Hose Mar 2008 A1
20080077705 Li et al. Mar 2008 A1
20080080457 Cole Apr 2008 A1
20080081606 Cole Apr 2008 A1
20080082643 Storrie et al. Apr 2008 A1
20080083013 Soliman et al. Apr 2008 A1
20080085707 Fadell Apr 2008 A1
20080089295 Keeler et al. Apr 2008 A1
20080089303 Wirtanen et al. Apr 2008 A1
20080095339 Elliott et al. Apr 2008 A1
20080096559 Phillips et al. Apr 2008 A1
20080098062 Balia Apr 2008 A1
20080109679 Wright et al. May 2008 A1
20080120129 Seubert et al. May 2008 A1
20080120668 Yau May 2008 A1
20080120688 Qiu et al. May 2008 A1
20080125079 O'Neil et al. May 2008 A1
20080126287 Cox et al. May 2008 A1
20080127304 Ginter et al. May 2008 A1
20080130534 Tomioka Jun 2008 A1
20080130656 Kim et al. Jun 2008 A1
20080132201 Karlberg Jun 2008 A1
20080132268 Choi-Grogan et al. Jun 2008 A1
20080134330 Kapoor et al. Jun 2008 A1
20080139210 Gisby et al. Jun 2008 A1
20080147454 Walker et al. Jun 2008 A1
20080160958 Abichandani et al. Jul 2008 A1
20080162637 Adamczyk et al. Jul 2008 A1
20080162704 Poplett et al. Jul 2008 A1
20080164304 Narasimhan et al. Jul 2008 A1
20080166993 Gautier et al. Jul 2008 A1
20080167027 Gautier et al. Jul 2008 A1
20080167033 Beckers Jul 2008 A1
20080168275 DeAtley et al. Jul 2008 A1
20080168523 Ansari et al. Jul 2008 A1
20080177998 Apsangi et al. Jul 2008 A1
20080178300 Brown et al. Jul 2008 A1
20080183812 Paul et al. Jul 2008 A1
20080184127 Rafey et al. Jul 2008 A1
20080189760 Rosenberg et al. Aug 2008 A1
20080201266 Chua et al. Aug 2008 A1
20080207167 Bugenhagen Aug 2008 A1
20080212470 Castaneda et al. Sep 2008 A1
20080212751 Chung Sep 2008 A1
20080219268 Dennison Sep 2008 A1
20080221951 Stanforth et al. Sep 2008 A1
20080222692 Andersson et al. Sep 2008 A1
20080225748 Khemani et al. Sep 2008 A1
20080229385 Feder et al. Sep 2008 A1
20080229388 Maes Sep 2008 A1
20080235511 O'Brien et al. Sep 2008 A1
20080240373 Wilhelm Oct 2008 A1
20080250053 Aaltonen et al. Oct 2008 A1
20080256593 Vinberg et al. Oct 2008 A1
20080259924 Gooch et al. Oct 2008 A1
20080262798 Kim et al. Oct 2008 A1
20080263348 Zaltsman et al. Oct 2008 A1
20080268813 Maes Oct 2008 A1
20080270212 Blight et al. Oct 2008 A1
20080279216 Sharif-Ahmadi et al. Nov 2008 A1
20080282319 Fontijn et al. Nov 2008 A1
20080293395 Matthews et al. Nov 2008 A1
20080298230 Luft et al. Dec 2008 A1
20080305793 Gallagher et al. Dec 2008 A1
20080311885 Dawson et al. Dec 2008 A1
20080313315 Karaoguz et al. Dec 2008 A1
20080313730 Iftimie et al. Dec 2008 A1
20080316923 Fedders et al. Dec 2008 A1
20080318547 Ballou et al. Dec 2008 A1
20080318550 DeAtley Dec 2008 A1
20080319879 Carroll et al. Dec 2008 A1
20080320497 Tarkoma et al. Dec 2008 A1
20090005000 Baker et al. Jan 2009 A1
20090005005 Forstall et al. Jan 2009 A1
20090006116 Baker et al. Jan 2009 A1
20090006200 Baker et al. Jan 2009 A1
20090006229 Sweeney et al. Jan 2009 A1
20090013157 Beaule Jan 2009 A1
20090016310 Rasal Jan 2009 A1
20090036111 Danford et al. Feb 2009 A1
20090042536 Bernard et al. Feb 2009 A1
20090044185 Krivopaltsev Feb 2009 A1
20090046707 Smires et al. Feb 2009 A1
20090046723 Rahman et al. Feb 2009 A1
20090047989 Harmon et al. Feb 2009 A1
20090048913 Shenfield et al. Feb 2009 A1
20090049156 Aronsson et al. Feb 2009 A1
20090049518 Roman et al. Feb 2009 A1
20090054030 Golds Feb 2009 A1
20090065571 Jain Mar 2009 A1
20090067372 Shah et al. Mar 2009 A1
20090068984 Burnett Mar 2009 A1
20090070379 Rappaport Mar 2009 A1
20090077622 Baum et al. Mar 2009 A1
20090079699 Sun Mar 2009 A1
20090113514 Hu Apr 2009 A1
20090125619 Antani May 2009 A1
20090132860 Liu et al. May 2009 A1
20090149154 Bhasin et al. Jun 2009 A1
20090157792 Fiatal Jun 2009 A1
20090163173 Williams Jun 2009 A1
20090172077 Roxburgh et al. Jul 2009 A1
20090180391 Petersen et al. Jul 2009 A1
20090181662 Fleischman et al. Jul 2009 A1
20090197585 Aaron Aug 2009 A1
20090197612 Kiiskinen Aug 2009 A1
20090203352 Fordon et al. Aug 2009 A1
20090217364 Salmela et al. Aug 2009 A1
20090219170 Clark et al. Sep 2009 A1
20090248883 Suryanarayana et al. Oct 2009 A1
20090254857 Romine et al. Oct 2009 A1
20090257379 Robinson et al. Oct 2009 A1
20090271514 Thomas et al. Oct 2009 A1
20090282127 LeBlanc et al. Nov 2009 A1
20090286507 O'Neil et al. Nov 2009 A1
20090287921 Zhu et al. Nov 2009 A1
20090288140 Huber et al. Nov 2009 A1
20090291665 Gaskarth et al. Nov 2009 A1
20090299857 Brubaker Dec 2009 A1
20090307696 Vals et al. Dec 2009 A1
20090307746 Di et al. Dec 2009 A1
20090315735 Bhavani et al. Dec 2009 A1
20090320110 Nicolson et al. Dec 2009 A1
20100010873 Moreau Jan 2010 A1
20100017506 Fadell Jan 2010 A1
20100020822 Zerillo et al. Jan 2010 A1
20100027469 Gurajala et al. Feb 2010 A1
20100027559 Lin et al. Feb 2010 A1
20100030890 Dutta et al. Feb 2010 A1
20100041364 Lott et al. Feb 2010 A1
20100041365 Lott et al. Feb 2010 A1
20100042675 Fujii Feb 2010 A1
20100043068 Varadhan et al. Feb 2010 A1
20100069074 Kodialam et al. Mar 2010 A1
20100071053 Ansari et al. Mar 2010 A1
20100075666 Garner Mar 2010 A1
20100080202 Hanson Apr 2010 A1
20100082431 Ramer et al. Apr 2010 A1
20100103820 Fuller et al. Apr 2010 A1
20100113020 Subramanian et al. May 2010 A1
20100121744 Belz et al. May 2010 A1
20100131584 Johnson May 2010 A1
20100142478 Forssell et al. Jun 2010 A1
20100144310 Bedingfield Jun 2010 A1
20100151866 Karpov et al. Jun 2010 A1
20100153781 Hanna Jun 2010 A1
20100167696 Smith et al. Jul 2010 A1
20100188975 Raleigh Jul 2010 A1
20100188990 Raleigh Jul 2010 A1
20100188992 Raleigh Jul 2010 A1
20100188994 Raleigh Jul 2010 A1
20100190469 Vanderveen et al. Jul 2010 A1
20100191576 Raleigh Jul 2010 A1
20100191612 Raleigh Jul 2010 A1
20100191846 Raleigh Jul 2010 A1
20100192170 Raleigh Jul 2010 A1
20100192212 Raleigh Jul 2010 A1
20100195503 Raleigh Aug 2010 A1
20100197268 Raleigh Aug 2010 A1
20100198698 Raleigh et al. Aug 2010 A1
20100198939 Raleigh Aug 2010 A1
20100235329 Koren et al. Sep 2010 A1
20100241544 Benson et al. Sep 2010 A1
20100248719 Scholaert Sep 2010 A1
20100284327 Miklos Nov 2010 A1
20100284388 Fantini et al. Nov 2010 A1
20100287599 He Nov 2010 A1
20100311402 Srinivasan et al. Dec 2010 A1
20100318652 Samba Dec 2010 A1
20100325420 Kanekar Dec 2010 A1
20110004917 Salsa et al. Jan 2011 A1
20110013569 Scherzer et al. Jan 2011 A1
20110019574 Malomsoky et al. Jan 2011 A1
20110071854 Medeiros Mar 2011 A1
20110081881 Baker et al. Apr 2011 A1
20110082790 Baker et al. Apr 2011 A1
20110110309 Bennett May 2011 A1
20110126141 King et al. May 2011 A1
20110145920 Mahaffey et al. Jun 2011 A1
20110159818 Scherzer et al. Jun 2011 A1
20110173678 Kaippallimalil et al. Jul 2011 A1
20110177811 Heckman et al. Jul 2011 A1
20110195700 Kukuchka et al. Aug 2011 A1
20110238545 Fanaian et al. Sep 2011 A1
20110241624 Park et al. Oct 2011 A1
20110252430 Chapman et al. Oct 2011 A1
20110264923 Kocher et al. Oct 2011 A1
20110277019 Pritchard, Jr. Nov 2011 A1
20120020296 Scherzer et al. Jan 2012 A1
20120029718 Davis Feb 2012 A1
20120101952 Raleigh et al. Apr 2012 A1
20120108225 Luna et al. May 2012 A1
20120144025 Melander et al. Jun 2012 A1
20120155296 Kashanian Jun 2012 A1
20120166364 Ahmad et al. Jun 2012 A1
20120166604 Fortier et al. Jun 2012 A1
20120196644 Scherzer et al. Aug 2012 A1
20120238287 Scherzer Sep 2012 A1
20120330792 Kashanian Dec 2012 A1
20130024914 Ahmed et al. Jan 2013 A1
20130029653 Baker et al. Jan 2013 A1
20130030960 Kashanian Jan 2013 A1
20130058274 Scherzer et al. Mar 2013 A1
20130065555 Baker et al. Mar 2013 A1
20130072177 Ross et al. Mar 2013 A1
20130084835 Scherzer et al. Apr 2013 A1
20130095787 Kashanian Apr 2013 A1
20130103376 Gaddam et al. Apr 2013 A1
20130111572 Gaddam et al. May 2013 A1
20130117140 Kashanian May 2013 A1
20130117382 Gaddam et al. May 2013 A1
20130144789 Aaltonen et al. Jun 2013 A1
20130149994 Gaddam et al. Jun 2013 A1
20130183937 Neal et al. Jul 2013 A1
20130326356 Zheng et al. Dec 2013 A9
20140073291 Hildner et al. Mar 2014 A1
20140241342 Constantinof Aug 2014 A1
20150181628 Haverinen et al. Jun 2015 A1
Foreign Referenced Citations (110)
Number Date Country
2688553 Dec 2008 CA
1310401 Feb 2000 CN
1345154 Apr 2002 CN
1508734 Jun 2004 CN
1538730 Oct 2004 CN
1567818 Jan 2005 CN
101035308 Mar 2006 CN
1801829 Jul 2006 CN
1802839 Jul 2006 CN
1889777 Jul 2006 CN
101155343 Sep 2006 CN
1867024 Nov 2006 CN
1878160 Dec 2006 CN
1878160 Dec 2006 CN
1937511 Mar 2007 CN
101123553 Sep 2007 CN
101080055 Nov 2007 CN
101115248 Jan 2008 CN
101127988 Feb 2008 CN
101183958 May 2008 CN
101335666 Dec 2008 CN
101341764 Jan 2009 CN
101815275 Aug 2010 CN
1098490 May 2001 EP
1289326 Mar 2003 EP
1463238 Sep 2004 EP
1503548 AL Feb 2005 EP
1545114 Jun 2005 EP
1545114 Jun 2005 EP
1739518 Jan 2007 EP
1772988 Apr 2007 EP
1850575 Oct 2007 EP
1887732 Feb 2008 EP
1887732 Feb 2008 EP
1942698 Jul 2008 EP
1978772 Oct 2008 EP
2007065 Dec 2008 EP
2007065 Dec 2008 EP
2026514 Feb 2009 EP
2466831 Jun 2012 EP
3148713 Mar 2001 JP
2005339247 Dec 2005 JP
2006-041989 Feb 2006 JP
2006155263 Jun 2006 JP
2006-197137 Jul 2006 JP
2006-344007 Dec 2006 JP
2007-318354 Dec 2007 JP
2008-301121 Dec 2008 JP
2009-111919 May 2009 JP
2009-212707 Sep 2009 JP
2009-218773 Sep 2009 JP
2009-232107 Oct 2009 JP
20040053858 Jun 2004 KR
1998058505 Dec 1998 WO
1999027723 AL Jun 1999 WO
1999065185 Dec 1999 WO
0208863 Jan 2002 WO
2002045315 Jun 2002 WO
2002067616 Aug 2002 WO
2002067616 Aug 2002 WO
2002093877 Nov 2002 WO
2003014891 Feb 2003 WO
2003017063 Feb 2003 WO
2003017063 Feb 2003 WO
2003017065 Feb 2003 WO
2003017065 Feb 2003 WO
2003058880 Jul 2003 WO
2004028070 Apr 2004 WO
2004064306 Jul 2004 WO
2004077797 Sep 2004 WO
2004095753 Nov 2004 WO
2005008995 Jan 2005 WO
2005053335 Jun 2005 WO
2005083934 Sep 2005 WO
2006004467 Jan 2006 WO
2006004784 Jan 2006 WO
2006012610 Feb 2006 WO
2006050758 May 2006 WO
2006073837 Jul 2006 WO
2006077481 Jul 2006 WO
2006093961 Sep 2006 WO
2006120558 Nov 2006 WO
2006130960 Dec 2006 WO
2007001833 Jan 2007 WO
2007014630 Feb 2007 WO
2007018363 Feb 2007 WO
2007053848 May 2007 WO
2007068288 Jun 2007 WO
2007069245 Jun 2007 WO
2007097786 Aug 2007 WO
2007107701 Sep 2007 WO
2007120310 Oct 2007 WO
2007124279 Nov 2007 WO
2007126352 Nov 2007 WO
2007129180 Nov 2007 WO
2007133844 Nov 2007 WO
2008017837 Feb 2008 WO
2008051379 May 2008 WO
2008066419 Jun 2008 WO
2008080139 Jul 2008 WO
2008080430 Jul 2008 WO
2008099802 Aug 2008 WO
2009008817 Jan 2009 WO
2009091295 Jul 2009 WO
2010088413 Aug 2010 WO
2010128391 Nov 2010 WO
2011002450 Jan 2011 WO
2011002450 Jan 2011 WO
2011149532 Dec 2011 WO
2012047275 Apr 2012 WO
Non-Patent Literature Citations (71)
Entry
Android Cupcake excerpts, The Android Open Source Project, Feb. 10, 2009.
Ahmed et al., “A Context-Aware Vertical Handover Decision Algorithm for Multimode Mobile Terminals and Its Performance,” BenQ Mobile, Munich Germany; University of Klagenfurt, Klagenfurt, Austria; 2006.
Kassar et al., “An overview of vertical handover decision strategies in heterogeneous wireless networks,” ScienceDirect, University Pierre & Marie Curie, Paris, France, Jun. 5, 2007.
Schiller et al., “Location-Based Services,” The Morgan Kaufmann Series in Data Management Systems, 2004.
Sadeh et al., “Understanding and Capturing People's Privacy Policies in a Mobile Social Networking Application,” ISR School of Computer Science, Carnegie Mellon University, 2007.
Jing et al., “Client-Server Computing in Mobile Environments,” GTE Labs. Inc., Purdue University, ACM Computing Surveys, vol. 31, No. 2, Jun. 1999.
Rivadeneyra et al., “A communication architecture to access data services through GSM,” San Sebastian, Spain, 1998.
Loopt User Guide, metroPCS, Jul. 17, 2008.
“Jentro Technologies launches Zenlet platform to accelerate location-based content delivery to mobile devices,” The Mobile Internet, Boston, MA, Feb. 2008.
“Ads and movies on the run,” the Gold Coast Bulletin, Southport, Qld, Jan. 29, 2008.
Richtel, “Cellphone consumerism; If even a debit card is too slow, now you have a new way to act on impulse: [National Edition],” National Post, Canada, Oct. 2, 2007.
Kim, “Free wireless a high-wire act; MetroFi needs to draw enough ads to make service add profits,” San Francisco Chronicle, Aug. 21, 2006.
Koutsopoulou et al., “Charging, Accounting and Billing Management Schemes in Mobile Telecommunication Networks and the Internet,” IEEE Communications Surveys & Tutorials, First Quarter 2004, vol. 6, No. 1.
Sun et al., “Towards Connectivity Management Adaptability: Context Awareness in Policy Representation and End-to-end Evaluation Algorithm,” Dept. of Electrical and Information Engineering, Univ. of Oulu, Finland, 2004.
Sabat, “The evolving mobile wireless value chain and market structure,” Nov. 2002.
Nuzman et al., “A compund model for TCP connection arrivals for LAN and WAN applications,” Oct. 22, 2002.
Kuntze et al., “Trustworthy content push,” Fraunhofer-Institute for Secure Information Technology SIT; Germany; WCNC 2007 proceedings, IEEE.
Blackberry Mobile Data System, version 4.1, Technical Overview, 2006.
Client Guide for Symantec Endpoint Protection and Symantec Network Access Control, 2007.
Ehnert, “Small application to monitor IP trafic on a Blackberry—1.01.03”, Mar. 27, 2008; http://www.ehnert.net/MiniMoni/.
NetLimiter Lite 4.0.19.0; http://www.heise.de/download/netlimiter-lite-3617703.html from vol. 14/2007.
Muntermann et al., “Potentiale und Sicherheitsanforderungen mobiler Finanzinformationsdienste und deren Systeminfrastrukturen,” Chair of Mobile Commerce & Multilateral Security, Goethe Univ. Frankfurt, 2004.
Kasper et al., “Subscriber Authentication in mobile cellular Networks with virtual software SIM Credentials using Trusted Computing,” Fraunhofer-Institute for Secure Information Technology SIT, Darmstadt, Germany; ICACT 2008.
Fujitsu, “Server Push Technology Survey and Bidirectional Communication in HTTP Browser,” Jan. 9, 2008 (JP).
Roy et al., “Energy Management in Mobile Devices with the Cinder Operating System”, Stanford University, MIT CSAIL, Jun. 3, 2010.
Windows7 Power Management, published Apr. 2009.
Quintana, David, “Mobile Multitasking,” Apr. 14, 2010.
Open Mobile Alliance (OMA), Push Architecture, Candidate Version 2.2; Oct. 2, 2007; OMA-AD-Push-V2_2-20071002-C.
VerizonWireless.com news, “Verizon Wireless Adds to Portfolio of Cosumer-Friendly Tools With Introduction of Usage Controls, Usage Controls and Chaperone 2.0 Offer Parents Full Family Security Solution,” Aug. 18, 2008.
“The Construction of Intelligent Residential District in Use of Cable Television Network,” Shandong Science, vol. 13, No. 2, Jun. 2000.
“Communication Concepts for Mobile Agent Systems,” by Joachim Baumann et al.; Inst. of Parallel and Distributed High-Performance Systems, Univ. of Stuttgart, Germany, pp. 123-135, 1997.
“Prevent iCloud Documents & Data from using your data plan,” Oct. 26, 2011; CNET webarchive, by Jason Cipriani.
“3rd Generation Partnership Project; Technical Specification Group Services and System Aspects; Policy and charging control architecture (Release 11),” 3GPP Standard; 3GPP TS 23.203 v11.6.0; Sophia Antipolis, France; pp. 1-177; Jun. 2012.
“End to End QoS Solution for Real-time Multimedia Application;” Computer Engineering and Applications, 2007, 43 (4): 155-159, by Tan Zu-guo, Wang Wen-juan; Information and Science School, Zhanjian Normal College, Zhan jiang, Guangdong 524048, China.
“ASA/PIX: Allow Split Tunneling for VPN Clients on the ASA Configuration Example,” Document ID 70917, Jan. 10, 2008.
Dixon et al., Triple Play Digital Services: Comcast and Verizon (Digital Phone, Television, and Internet), Aug. 2007.
3rd Generation Partnership Project; “Technical Specification Group Services and System Aspects; IP Flow Mobility and seamless WLAN offload; Stage 2,” Release 10, Document No. 3GPP TS 23.261, V1.0.0, Mar. 2010.
3rd Generation Partnership Project, “Technical Specification Group Core Network and Terminals; Access Network Discovery and Selection Function (ANDSF) Management Object (MO),” Release 9, Document No. 3GPP TS 24.312, V9.1.0, Mar. 2010.
Ahmed et al., “Multi Access Data Network Connectivity and IP Flow Mobility in Evolved Packet System (EPS),” 2010 IEEE.
Extended European Search Report dated Mar. 14, 2016 from International Serial No. PCT/US2011/052662, EP Application No. 11827494.3.
3rd Generation Partnership Project, “Technical Specification Group Services and System Aspects; General Packet Radio Service (GPRS) Enhancements for Evolved Universal Terrestrial Radio Access Network (E-UTRAN) Access,” Release 8, Document No. 3GPP TS 23.401, V8A.0, Dec. 2008.
3rd Generation Partnership Project, “Technical Specification Group Services and System Aspects; Policy and Charging Control Architecture,” Release 8, Document No. 3GPP TS 23.203, V8A.0, Dec. 2008.
Alonistioti et al., “Intelligent Architectures Enabling Flexible Service Provision and Adaptability,” 2002.
Amazon Technologies, Inc., “Kindle™ User's Guide,” 3rd Edition, Copyright 2004-2009.
Chandrasekhar et al., “Femtocell Networks: A Survey,” Jun. 28, 2008.
Chaouchi et al., “Policy Based Networking in the Integration Effort of 4G Networks and Services,” 2004 IEEE.
Cisco Systems, Inc., “Cisco Mobile Exchange (CMX) Solution Guide: Chapter 2—Overview of GSM, GPRS, and UMTS,” Nov. 4, 2008.
Dikaiakos et al., “A Distributed Middleware Infrastructure for Personalized Services,” Nov. 24, 2003.
European Commission, “Data Roaming Tariffs—Transparency Measures,” [online] retrieved from http://web.archive.org/web/20081220232754/http://ec.europa.eu/information_society/activities/roaming/data/measures/index_en.htm, Dec. 20, 2008 [retrieved May 16, 2012].
Farooq et al., “An IEEE 802.16 WiMax Module for the NS-3 Simulator,” Mar. 2-6, 2009.
Han et al., “Information Collection Services for Qos-Aware Mobile Applications,” 2005.
Hartmann et al., “Agent-Based Banking Transactions & Information Retrieval—What About Performance Issues?” 1999.
Hewlett-Packard Development Company, LP, “IP Multimedia Services Charging,” white paper, Jan. 2006.
Hossain et al., “Gain-Based Selection of Ambient Media Services in Pervasive Environments,” Mobile Networks and Applications. Oct. 3, 2008.
Knight et al., “Layer 2 and 3 Virtual Private Networks: Taxonomy, Technology, and Standarization Efforts,” IEEE Communications Magazine, Jun. 2004.
Koutsopoulou et al., “Middleware Platform for the Support of Charging Reconfiguration Actions,” 2005.
Kyriakakos et al., “Ubiquitous Service Provision in Next Generation Mobile Networks,” Proceedings of the 13th IST Mobile and Wireless Communications Summit, Lyon, France, Jun. 2004.
Li, Yu, “Dedicated E-Reading Device: The State of the Art and the Challenges,” Scroll, vol. 1, No. 1, 2008.
Nilsson et al., “A Novel MAC Scheme for Solving the QoS Parameter Adjustment Problem in IEEE802.11e EDCA,” Feb. 2006.
Oppliger, Rolf, “Internet Security: Firewalls and Bey,” Communications of the ACM, May 1997, vol. 40. No. 5.
Rao et al., “Evolution of Mobile Location-Based Services,” Communication of the ACM, Dec. 2003.
Steglich, Stephan, “I-Centric User Interaction,” Nov. 21, 2003.
Van Eijk, et al., “GigaMobile, Agent Technology for Designing Personalized Mobile Service Brokerage,” Jul. 1, 2002.
Zhu et al., “A Survey of Quality of Service in IEEE 802.11 Networks,” IEEE Wireless Communications, Aug. 2004.
Anton, B. et al., “Best Current Practices for Wireless Internet Service Provider (WISP) Roaming”; Release Date Feb. 2003, Version 1.0; Wi-Fi Alliance—Wireless ISP Roaming (WISPr).
Ruckus Wireless—White Paper; “Smarter Wi-Fi for Mobile Operator Infrastructures” 2010.
Accuris Networks, “The Business Value of Mobile Data Offload—a White Paper”, 2010.
Wireless Broadband Alliance, “WISPr 2.0, Apr. 8, 2010”; Doc. Ref. No. WBA/RM/WISPr, Version 01.00.
Thurston, Richard, “WISPr 2.0 Boosts Roaming Between 3G and Wi-Fi”; Jun. 23, 2010; Web page from zdnet.com; Zdnet.com/wispr-2-0-boosts-roaming-between-3g-and-wi-fi-3040089325/.
Wi-Fi Alliance Technical Committee Hotspot 2.0 Technical Task Group, “Hotspot 2.0 (Release 1) Technical Specification—Version 1.0.0”; 2012.
Wi-Fi Alliance Hotspot 2.0 Technical Task Group, “Wi-Fi Certified Passpoint™ (Release 1) Deployment Guidelines—Version 1.0—Oct. 2012”.
Related Publications (1)
Number Date Country
20170208459 A1 Jul 2017 US
Provisional Applications (20)
Number Date Country
61389547 Oct 2010 US
61385020 Sep 2010 US
61387243 Sep 2010 US
61387247 Sep 2010 US
61407358 Oct 2010 US
61418507 Dec 2010 US
61418509 Dec 2010 US
61420727 Dec 2010 US
61422565 Dec 2010 US
61422572 Dec 2010 US
61422574 Dec 2010 US
61435564 Jan 2011 US
61472606 Apr 2011 US
61384456 Sep 2010 US
61270353 Jul 2009 US
61264126 Nov 2009 US
61206354 Jan 2009 US
61206944 Feb 2009 US
61207393 Feb 2009 US
61207739 Feb 2009 US
Divisions (1)
Number Date Country
Parent 13239321 Sep 2011 US
Child 14551809 US
Continuations (1)
Number Date Country
Parent 14551809 Nov 2014 US
Child 15416351 US
Continuation in Parts (4)
Number Date Country
Parent 13237827 Sep 2011 US
Child 13239321 US
Parent 12380780 Mar 2009 US
Child 13237827 US
Parent 12695019 Jan 2010 US
Child 12380780 US
Parent 12380778 Mar 2009 US
Child 12695019 US