JP2014500989A - Secure device data record - Google Patents

Abstract

A secure device data record (DDR) is provided. In some embodiments, a secure DDR system includes a processor of a wireless communication device that wirelessly communicates with a wireless network, wherein the processor is configured with a secure execution environment, the secure execution environment of the wireless communication device with the wireless network. Configured to monitor service usage and generate a plurality of device data records for monitored service usage of a wireless communication device with a wireless network, each device data record being associated with a unique sequence order identifier, and secure DDR The system includes a memory coupled to the processor and configured to provide instructions to the processor. In some embodiments, the secure execution environment is located in an application processor, a modem processor, and / or a subscriber identity module (SIM).
[Selection] Figure 1

Description

  With the advent of mass market digital communications and content distribution, many access networks such as wireless networks, cable networks, and DSL (Digital Subscriber Line) networks are in a difficult position in terms of user capacity, e.g., EVDO (evolution Data optimization), HSPA (high-speed packet access), LTE (long-term evolution), WiMax (Worldwide Interoperability for Microwave Access), and Wi-Fi (Wireless Fidelity) wireless network user capacities are increasingly constrained. Wireless network capacity will increase with new high capacity wireless radio access technologies such as MIMO (multiple input multiple output) and more frequency spectrum introduced in the future, but these capacity acquisitions will increase It is likely that the capacity will be less than necessary to meet the growing demand for digital networks.

  Similarly, wired line access networks such as cable and DSL may have a higher average capacity per user, but the trend of wired line user service consumption habits is that the free network capacity is consumed quickly and the overall network service experience Is heading towards very high bandwidth applications. This trend also has a negative impact on service provider benefits, as some components of service provider costs increase with increasing bandwidth.

  Various embodiments of the invention are disclosed in the following detailed description and the accompanying drawings.

FIG. 1 shows a high-level diagram of an advanced wireless service platform end-to-end DDR reporting and processing system according to some embodiments. FIG. 2 illustrates a process for booting, executing, and updating DDR firmware, according to some embodiments. FIG. 3 illustrates the architecture of a secure embedded DDR processor in an APU implementation according to some embodiments. FIG. 4 illustrates another architecture of a secure embedded DDR processor in an APU implementation with a modem bus driver, according to some embodiments. FIG. 5 illustrates another architecture of a secure embedded DDR processor in an APU implementation with a modem bus driver, according to some embodiments. FIG. 6 illustrates the architecture of a secure embedded DDR processor in an MPU implementation according to some embodiments. FIG. 7 illustrates another architecture of a secure embedded DDR processor in an MPU implementation according to some embodiments. FIG. 8 illustrates the architecture of a secure embedded DDR processor at the APU and a data path security verifier (DPSV) at the MPU implementation according to some embodiments. FIG. 9 illustrates the architecture of a secure embedded DDR processor in a subscriber identity module (SIM) and a data path security verifier (DPSV) in an MPU implementation according to some embodiments. FIG. 10 illustrates another architecture of a secure embedded DDR processor in a subscriber identity module (SIM) and a data path security verifier (DPSV) in an MPU implementation according to some embodiments. FIG. 11 illustrates another architecture of a secure embedded DDR processor in a subscriber identity module (SIM) and a data path security verifier (DPSV) in an MPU implementation according to some embodiments. FIG. 12 illustrates a secure boot sequence flow diagram according to some embodiments. FIG. 13 illustrates a functional diagram for passing a DDR service processor mailbox message between a secure memory area and a non-secure memory area, according to some embodiments. FIG. 14 illustrates a DDR processor service controller session authentication and verification flow diagram according to some embodiments. FIG. 15 illustrates a flow diagram of a secure device data record that implements device assistance services (DAS) according to some embodiments. FIG. 16 illustrates an advanced wireless service platform end-to-end DDR reporting and processing system according to some embodiments.

  The present invention is provided by a process, apparatus, system, composition, computer program product embodied in a computer readable storage medium, and / or memory coupled to and / or coupled to a processor. Can be implemented in a number of ways, including a processor such as a processor configured to execute instructions. In this specification, these embodiments, or any other form that the invention may take, may be referred to as techniques. In general, the order of the steps of disclosed processes may be altered within the scope of the invention. Except as otherwise noted, a component such as a processor or memory that is described as being configured to perform a task is a generic component that is temporarily configured to perform a task at a given time Or it may be implemented as a dedicated component manufactured to perform a task. As used herein, the term “processor” refers to one or more devices, circuits, and / or processing cores configured to process data, such as computer program instructions.

  A detailed description of one or more embodiments of the invention is provided below along with accompanying figures that illustrate the principles of the invention. While the invention will be described in connection with such embodiments, the invention is not limited to any embodiment. The scope of the invention is limited only by the claims and the invention encompasses numerous alternatives, modifications, and equivalents. In order to provide a thorough understanding of the present invention, numerous specific details are set forth in the following description, but these details are provided by way of example, and the present invention may It may be practiced according to the claims without some or all. For the purpose of clarity, technical material that is known in the technical fields related to the invention has not been described in detail so that the invention is not unnecessarily obscured.

  In some embodiments, a secure device data record (DDR) is provided. In some embodiments, a secure DDR for device assistance services is provided. In some embodiments, the secure DDR of the device-assisted service provides a service usage monitoring for the wireless communication device (e.g., based on a 5-tuple of source address, port address, destination address, destination port, and protocol). Based network service usage monitoring). In some embodiments, the secure DDR of the device support service may be used to monitor wireless communication device wireless connections and other input / output (I / O) connections or port service usage (eg, source address, port address, destination address, Monitoring of network service usage based on firmware, such as based on destination port and protocol 5-tuple. In some embodiments, a secure DDR system includes a processor of a wireless communication device that wirelessly communicates with a wireless network, wherein the processor is configured with a secure execution environment, the secure execution environment of the wireless communication device with the wireless network. Configured to monitor service usage and generate multiple device data records for monitored service usage of a wireless communication device with a wireless network, each device data record being associated with a unique sequence order identifier and secure The DDR system includes a memory coupled to the processor and configured to provide instructions to the processor. In some embodiments, a secure DDR system includes a processor of a wireless communication device that wirelessly communicates with a wireless network, the processor being configured with a secure execution environment, wherein the secure execution environment is a wide area wireless network (eg, 2G, 3G, 4G etc.), WiFi network or connection, USB network or connection, Ethernet network or connection, Firewire connection, Bluetooth connection, near field communication (NFC) connection, or another I / O connection or port, but these Monitor service usage of a wireless communication device with one or more of the network and device I / O connections, not limited to, and generate a plurality of device data records of the monitored service usage of the wireless communication device with the wireless network. Each configured as The location data record associated unique sequence order identifier, secure DDR system, coupled to the processor, including a memory configured to provide instructions to processor. In some embodiments, a secure execution environment that includes a secure DDR processor is located in an application processor, a modem processor, and / or a subscriber identity module (SIM).

  In many of the disclosed embodiments, the secure device data record processing system is a wide area wireless network connection (eg, 2G, 3G, or 4G connection) or wide area wireless modem (eg, 2G, 3G, or 4G modem) to the device. It acts on the communication that flows through. As will be appreciated by those skilled in the art, a secure device data record processing system may include one or more additional I / O networks, connections, ports, or modems (eg, WiFi networks, connections, ports, or modems, USB Network, connection, port or modem, Ethernet network, connection, port or modem, Firewire network, connection, port or modem, Bluetooth network, connection, port or modem, near field communication (NFC) network, connection, It can also act on communications flowing through a port or modem, or another I / O connection, port or modem).

  In some embodiments, a secure DDR system includes a processor of a wireless communication device that wirelessly communicates with a wireless network, the processor being configured with a secure execution environment, the secure execution environment being a wireless network (and possibly one of the devices). Service usage of the wireless communication device with one or more additional I / O connections) and monitoring of the wireless communication device with the wireless network (and possibly one or more additional I / O connections of the device). A plurality of device data records for each service use, each device data record being one of an ordered sequence of device data records, each sequential device data record being a service of the device data record Provides accounting for service usage across usage intervals, and each device data record has a secure, unique Sequence sequence identifier is associated with the secure DDR system, coupled to the processor, including a memory configured to provide instructions to processor. In this way, communication activity over the device radio access network connection (or other I / O port communication connection) is securely monitored, reported to the network server, further processed, and the device access service policy is enforced accordingly. Or whether the malicious software in the device operating environment is accessing the network (or other I / O connection or port). In some embodiments, secure execution, including a secure DDR processor environment, is located in an application processor, modem processor, and / or subscriber identity module (SIM).

  In some embodiments, the communication channel that sends the secure device data record to the network server for further analysis and processing includes a secure message receipt feedback loop, and if the secure message feedback loop is interrupted, the device environment security error condition Is detected and countermeasures are taken. In some embodiments, the ordered sequence of device data records is communicated to the service controller using a signed or encrypted communication channel. In some embodiments, the service controller observes device data records to determine compliance with access policies for device-based access networks (or other I / O connections or ports). In some embodiments, the service controller also observes the integrity of the ordered sequence of device data records to determine whether the device data record has been tampered with or omitted. In some embodiments, if the service processor determines that the device data record has not been tampered with or omitted, the service controller returns a signed or encrypted device data record receipt message. To do. In some embodiments, if the service processor determines that the device data record has been tampered with or omitted, the service controller returns an error message, or a signed or encrypted device data record. Do not reply receipt message. In some embodiments, the secure DDR system receives an error message from the service controller, or receives a signed or encrypted device data record receipt message within a specified time period, or a specified number of transmitting device data records. (I) generate a device configuration error message and send it to the security administrator or server, or (ii) connect to the wireless network of the wireless communication device ( Or other I / O connections or ports) are blocked or restricted to a predefined set of safe destinations. In this way, the device service processor, device operating environment, device operating system, or device software generates wireless network (or other I / O port) access service usage features that do not comply with expected or allowed policies. If tampered to do so, a device configuration error message can be generated, or device wireless network access (or other I / O connection access) can be restricted or blocked. Such embodiments may be useful in securing device-based network access (or I / O control) policies, and are also useful in identifying tampered device software or any malware present in the device. It can be. In some embodiments, limiting wireless network access (or other I / O access) allows access to a sufficient number of network destinations or resources to allow further analysis or troubleshooting of device configuration error conditions. Restrict.

  Various techniques for providing device support services (DAS) are being co-pending under the name AUTOMATED DEVICE PROVISIONING AND ACTIVATION filed March 2, 2009, published as US 2010/0192212. No. 12 / 380,780 (Attorney Docket No. RALEP007), US Patent Application Publication No. 2010/0197266, published on January 27, 2010, DEVICE ASSISTED CDR CREATION , AGGREGATION, MEDIATION, AND BILLING, co-pending US patent application Ser. No. 12 / 695,019, and US Patent Application Publication No. 2010/0199325. Which is disclosed in co-pending US patent application Ser. No. 12 / 694,445 entitled SECURITY TECHNIQUES FOR DEVICE ASSISTED SERVICES, filed Jan. 27, 2010, which was published as No. 1 Which is incorporated herein by reference.

  In some embodiments, a DDR processor is provided to a wireless communication device (eg, a cellular phone, a smartphone, a laptop, a PDA, a gaming device, a music device, as described herein with respect to various embodiments). To assist in the implementation of Device Assistance Services (DAS) with respect to wireless network service usage of wireless communication devices such as tablets, computers, and / or any other device with wireless communication access). In some embodiments, a secure DDR processor (eg, implemented / executed in a secure execution environment) is provided. In some embodiments, the DDR processor is secured using various techniques described herein. In some embodiments, the DDR processor includes a DDR generator. In some embodiments, the DDR processor generates DDR. In some embodiments, the DDR processor reports the DDR to a network element (eg, service controller, DDR network storage system, and / or another network element). In some embodiments, the secure DDR processor reports the DDR to a device element / function such as a service processor, and the device element / function aggregates the DDR into a report (eg, or service processor report) (eg, other Service usage and / or other information), communicate to the network element. In some embodiments, DDR as well as service processor reports are generated and communicated to network elements. In some embodiments, the DDR processor is secured using various techniques described herein.

  In some embodiments, DDR is a service usage that is assisted and / or monitored based on a device (eg, a specified time interval) as described herein with respect to various embodiments. And / or based on various criteria such as events). In some embodiments, DDR is reported periodically. In some embodiments, DDR is reported based on events and / or requests from a network element (eg, service controller or another network element / function). In some embodiments, the DDR is communicated to a device service processor (eg, or another device element / function), and the device service processor aggregates such DDRs and provides a service usage report that includes such DDRs. Provide periodically or provide such service usage reports based on requests and / or events. In some embodiments, each DDR includes a unique identifier (eg, a unique sequence identifier). In some embodiments, the loss of DDR can be detected using a unique identifier (eg, the sequence count and / or time stamp information associated with each DDR, with sequence count and / or time stamp information). Information can be used to detect potentially suspicious service usage, such as missing, delayed, and / or compromised device data records, and is suspected as described herein If a service usage event is detected, a response / correction action can be taken). In some embodiments, if the DDR is not received within a certain time period, the access controller is activated to limit network access until the DDR is generated and reported accordingly (eg, service controller etc. If the network element sends a keep-alive signal to the device, implements a time-out period that verifies reception from the appropriately generated and verified DDR device, and does not receive the keep-alive signal in the specified time period, A device-based secured access controller can implement limited network access control functions).

  In some embodiments, a DDR network storage system is provided as described herein with respect to various embodiments. In some embodiments, based on a DDR network storage system and a DDR coordination function (eg, CDR, micro CDR, and / or DDR records and / or DDR reports or other devices such as IPDR or other service usage reports and (Or coordinate network based service usage reports). In some embodiments, the network based coordination function coordinates DDR (eg, aggregate DDR and / or DDR report) with service usage measurement based on one or more networks. In some embodiments, the network based coordination function coordinates DDR with service usage measurements based on two or more networks. In some embodiments, the network-based coordination function may measure service usage based on two or more networks based on DDR (eg, measurements based on CDR, FDR, IPDR, DPI, including NBS and / or QoS traffic related events, And / or service usage measurement based on other networks). In some embodiments, network-based coordination functions may use service usage measurements based on more than one device (eg, DDR, service processor reports, and / or other traffic-related events such as NBS and / or QoS) Coordinate device-based service usage measurement with network-based service usage measurement. In some embodiments, the network based coordination function coordinates service usage measurements based on two or more devices with service usage measurements based on two or more networks. In some embodiments, the network-based coordination function is secured based on various techniques described herein, such as one of the device-based service usage measurements (eg, secure DDR, Coordinate service usage measurements based on two or more devices (and / or deemed trusted) and one or more of the service usage measurements based on other devices are not secured (eg, in a secure execution environment) Service processor reports generated by service processors that are not implemented etc. are not fully trusted). In some embodiments, the reconciliation function is based on a variety of different reporting formats, such as time measurement intervals, measurement units, and / or other different criteria used in different service usage measurements based on different devices and networks. adjust.

  In some embodiments, a secure access controller is provided as described herein with respect to various embodiments. In some embodiments, the DDR processor includes a secure access controller. In some embodiments, secure access control may be used for open network access if a wireless communication device using DAS does not generate and report secure DDR until the device generates and reports secure DDR as appropriate. Guarantee that you have no.

  In some embodiments, the DDR processor includes a secured network busy condition (NBS) monitoring and reporting function as described herein with respect to various embodiments. In some embodiments, the network element aggregates NBS information received from one or more wireless communication devices from the same sector and / or various sectors within the service perimeter, and the same network busy state rules (e.g., Access control, billing, and notification) and / or modify existing NBS rules accordingly.

  In some embodiments, a secured boot sequence is provided. In some embodiments, the secured boot sequence ensures that the DDR processor is secured and appropriately generates DDR before providing open network access control to the wireless communication device. In some embodiments, the secure boot sequence includes using a secure access controller to limit network access until the secure boot sequence is complete. In some embodiments, the secure boot sequence includes verifying the DDR ACK and receipt frame.

  In some embodiments, a processor of a wireless communication device that wirelessly communicates with a wireless network is provided, the processor is configured with secure software or firmware instruction execution environment, and the program in the secure software or firmware instruction execution environment is stored in the wireless network. And configured to generate a plurality of device data records (DDR) of the monitored service usage of the wireless communication device with the wireless network, and the device data record is monitored. A secure device data record for service use, where each device data record forms part of an ordered sequence of device data records, and each sequential device data record provides accounting for service usage over the service usage interval of the device data record. , Each equipment The data record, which is also a secured uniquely sequence order identifier was is associated.

  In some embodiments, the device data record sequence forms a continuous uninterrupted report of device service usage while the device is active on the network. In some embodiments, the secure software or firmware instruction execution environment is arranged and configured to access the network only through a data path monitored by a program in the secure software or firmware instruction execution environment. In some embodiments, the secure software or firmware instruction execution environment is located in a modem processor (eg, MPU). In some embodiments, the secure software or firmware instruction execution environment is located on an application processor (eg, APU). In some embodiments, the secure software or firmware instruction execution environment is located in a subscriber identity module (SIM) (eg, a SIM card). In some embodiments, the secure software or firmware instruction execution environment is located in a combination of APU, MPU, and / or SIM.

  In some embodiments, the device data record may use various encryption techniques described herein, such as using one or more of the following: encryption, digital signature, and integrity check. Secured using.

  In some embodiments, a DDR processor located in a secure execution environment is configured to communicate a device data record sequence to a device data record storage function, such as within a network element (eg, a service controller), and a unique The plurality of secure device data records in combination with the sequence identifier provides traceability that identifies whether one or more usage records have been tampered with or omitted from the data record sequence sent to the storage function. In some embodiments, the unique sequence identifier is: sequence count, timestamp, start time indicator, stop time indicator, continuous time interval identifier, and aggregate usage count at the start or end of the record, reference time, or Includes one or more of the elapsed time at the start or end of the record.

  In some embodiments, the generation of a new device data record is determined by one or more of the following: a predetermined time, an elapsed time period, an elapsed time period from the last report, from the last report Maximum limit for elapsed time period, amount of one or more aspects of aggregate data usage, amount of one or more aspects of data usage from the last report, one or more of data usage from the last report Maximum limit on aspects, DDR generation request, limit on maximum amount of memory or storage medium required to contain or process DDR information before transmission, device power on or off, modem or device subsystem power On or off, entering or exiting the power saving state of the modem or device subsystem, with the network element or server of the device or device subsystem Transition proof, or one or more of the starting event detected by the service use activities, or service discovery use record tampering or unauthorized event, or to a new network busy and / or QoS traffic event.

  In some embodiments, an element / function based on a DDR processor, service processor, or another device transmits a DDR based on one or more of the following: maximum time increment, maximum service usage increment, service Polling from the processor and / or polling from the service controller. In some embodiments, a maximum time increment in DDR transmission is established to ensure that there is minimal or no hijackable service when service controller authentication is performed. In some embodiments, at least a portion of the restricted network service activity set is the ability of the device to access the network after the service controller is authenticated using the service processor and the proper operation of the secure DDR generator is verified. Access to the service controller or other network elements needed to manage the network. In some embodiments, at least a portion of the restricted network service activity set includes access to a minimum roaming network service activity set necessary for the roaming network to initiate the process of authenticating device access privileges. In some embodiments, at least a portion of the restricted network service activity set includes access to a minimum roaming network service activity set necessary for the enterprise network to initiate the process of authenticating device access privileges. In some embodiments, at least a portion of the restricted network service activity set includes access to the minimum roaming network service activity set necessary for the MVNO network to initiate the process of authenticating device access privileges. In some embodiments, at least a portion of the more generous service activity set is that access to at least one subset of services available in the roaming network is possible. In some embodiments, access to at least one subset of services available in the MVNO network is possible. In some embodiments, at least a portion of the more generous service activity set is access to at least one subset of services available in the enterprise network.

  In some embodiments, the device data record service usage information includes one or more of the following measurements: voice service (eg, VOIP) usage record; text service usage record; data network service usage record; data Network flow data record; data network general purpose; aggregate or bulk service usage record; service usage at least partially classified by far-end destination; at least partially classified by layer 3 network communication information such as IP address or ATM address Service usage record; service usage at least partially classified by layer 4 network communication information such as IP address and port combination; network based network such as FDR, CDR, or IPDR Data network service usage record comparable to flow data records based on network; service usage at least partially classified by date and time; service usage at least partially classified by geographic location; by active network serving device Service usage at least partially classified; service usage at least partially classified by a roaming network connected to the device; service usage at least partially classified by network busy state or network configuration; at least partially QoS Service use classified by: at least partially classified by layer 7 network communication information such as server name, domain name, URL, referrer host, or application service flow information Service usage record; service usage at least partially classified by network communication protocols such as TCP, UDP, DNS, SMTP, IMAP, POP, FTP, HTTP, HTML, VOIP; application name, application identifier assigned by the operating system Or service usage at least partially categorized by another application identifier that is unique to the application acquisition or request service (eg, device user identifier such as Android user ID on Android-based devices); and at least partially service activity Service use classified by.

  In some embodiments, a DDR processor located in a secure execution environment is configured to send device data records to a network element (eg, a storage function located in the network). In some embodiments, a DDR processor located in a secure execution environment includes a secure communication channel over a secure software or firmware instruction execution environment and a storage function (eg, a network element such as a service controller) located in a network. The communication channel security protocol is configured to avoid tampering of secure device data records (DDR). In some embodiments, a DDR processor located in secure execution is configured to perform an authentication sequence or process with a network element (eg, service controller), and a secure device data record sequence start message is sent to the network destination. Sent, and then the secure protocol record is sent after the authentication protocol exchange sequence authenticates the network element.

  In some embodiments, a DDR processor located in a secure execution environment is configured to perform the following: send a device data record sequence to a network element (eg, via a secure channel); secure access A controller is implemented to limit network access to a predetermined subset of available network destinations; receive secure messages from a trusted network element (eg, directly from a network element or secure execution environment from a network element) Verified (e.g., secured accordingly) to acknowledge receipt of one or more secure device data records or to acknowledge the access network authentication sequence; The secure access controller allows unrestricted or unrestricted access to the network; acknowledges receipt of one or more secure device data records, or access network authentication. If a verified message that acknowledges the sequence is not received, the secure access controller acknowledges receipt of one or more secure device data records or receives a verified message that acknowledges the access network authentication sequence. Until then, restrict access to a predetermined set of network destinations or functions.

  In some embodiments, a DDR processor located in a secure execution environment is configured with an access controller, and the access controller receives a predetermined maximum amount of time for receiving one or more secure device data records or authentication sequences. The time when the first message to acknowledge is received by the DDR processor in the secure execution environment and the second message to acknowledge receipt of one or more secure device data records or authentication sequences is Between the time received by the DDR processor in the DDR processor, or the time when the DDR processor in the secure execution environment sent one or more secure device data records, and one or more DDR processors in the secure execution environment Secure device data record Restricts access to a given set of network destinations or functions if it has passed between the time of receipt of a message acknowledging receipt of the authentication sequence, otherwise the access controller may restrict or restrict access to the network. Allow loose access.

  In some embodiments, a DDR processor located in a secure execution environment first sends a device data record to a second program function located on the device, and then the second program function is sent to the device data record. Is transferred to the device data record storage function arranged in the network, so that the device data record is transmitted to the device data record storage function arranged in the network. In some embodiments, the DDR processor located in the secure execution environment is configured to provide a second service usage report sequence in addition to the secure device data record sequence. In some embodiments, another client function / element (eg, service processor function / element or agent) is configured to provide a second service usage report sequence in addition to the secure device data record sequence. In some embodiments, the second service usage report sequence includes a service usage classification that is at least partially different from the secure device data record. In some embodiments, the difference in device data usage classification is, at least in part, that certain records are: application information, layer 7 network information, service flow association information, user-defined input information, network busy state information Including one or more of the active network information or other information and not including the other record.

  In some embodiments, a DDR processor located in a secure execution environment is configured to transmit a device data record sequence and a second device data record sequence so that reconciliation of the two records can be simplified. The In some embodiments, the DDR processor located in the secure execution environment includes one or more measurement interval start and stop times of the second service usage report and one of the secure device data records. Or configured to provide a second service usage report sequence to provide a rough alignment with the plurality of measurement intervals.

  In some embodiments, a DDR processor located in a secure execution environment creates and records a network performance characterization based on monitoring service usage of a wireless communication device with a wireless communication network, network performance Multiple networks, including network performance statistics sequences created at different times, analyzing the characterization of the network and summarizing in one or more network performance statistics that characterize the network performance level or congestion level experienced by the device Generating a performance report message, wherein the network performance report message is a secured network performance report and is configured to send a secured network performance report to a storage function located in the network. The

  In some embodiments, a network device configured as a device data record storage and processing function for wireless communication with a wireless network, each wireless device including a secure device data record generator, for wireless communication with a plurality of wireless communication devices A processor, providing an individual secure communication channel between each of the plurality of secure device data record processors and the network device, so that the communication channel security protocol can detect tampering of the device data recorder. Receiving a plurality of device data records from each secure device data record processor via a secure communication channel, wherein the plurality of secure device data records are monitored by a wireless communication device with a wireless network. Service usage service Each device data record is part of an ordered sequence of device data records, each sequential device data record provides an uninterrupted accounting of service usage over the service usage interval of the device data record, Data record sequences provide continuous and continuous reporting of device service usage, each device data record has a unique sequence order identifier associated with it, and a device data record storage function that stores the device data record sequence for each device. Providing, for each device, analyzing the sequence stored in the device data record and verifying that the information in the service usage record is appropriately configured according to the secure communication channel protocol, One or more of One or more of the device data records are originally transmitted from the device by determining whether or not all the secure continuous sequence identifiers of the aggregate sequence are present in the sequence for each device. Determining whether a device data record sequence has been deleted or blocked, and if any device data record has been corrupted, delayed or deleted, set a fraud detection error on that device and A processor further configured to restrict access and notify a network device or network administrator that further action is to be taken.

  In some embodiments, the secure device data record included in the device data record sequence includes a secure network performance report that characterizes network performance or congestion when the secure device data record is generated. In some embodiments, the device data record sequence is used, at least in part, as a record of service usage that forms an input factor within business logic or rules used to calculate service usage charges. In some embodiments, the device data record sequence is at least partially within business logic or rules used to determine whether one or more device access network service policies are in place as appropriate. Used as a record of service usage that forms the input factor. In some embodiments, the device data record sequence is used as a service usage record that forms an input factor in updating an end user service usage notification message, a service usage notification indication, or a service purchase message trigger event.

  In some embodiments, the network device processor is further configured to receive a device data record sequence from the second device program function, after which the device data record is transferred from the secure device data record generator. In some embodiments, the network device processor is further configured to receive a second service usage data record sequence from the second device program function. In some embodiments, the two device data record sequences are at least partially different (eg, use of classification parameters: layer 3/4 and / or layer 7) over the same (or approximately the same or overlapping) time span. Holds usage classification. In some embodiments, the network device processor is further configured to compare the two data record sequences and determine whether the two service usage report sequences match each other within allowed tolerances. .

  In some embodiments, the secure device data record includes corresponding layer 7 classification information (eg, domain name, application identifier, HTTP information, association classification, and / or book) received from a service processor included in the DDR report. 5 tuple classification information (eg source address, port address, destination address, destination port, and protocol) can be accompanied by, for example, a service controller (eg Or to another network element) to assist in service usage coordination and / or verification using various techniques described herein. In some embodiments, one or more of the service usage adjustment and / or verification operations that use layer 7 classification information and 5-tuple classification information are locally performed at the client (eg, within a secure execution area). Executed. In some embodiments, one or more of the service usage adjustment and / or verification operations that use layer 7 classification information and 5-tuple classification information are locally performed at the client (eg, within a secure execution area). One or more of the service usage adjustment and / or verification operations that are performed and use the layer 7 classification information and the 5-tuple classification information are in a network (eg, in one or more network elements such as a service controller). Executed in

  In some embodiments, the match criteria portion determines whether the two service usage report sequences match at the reported network performance level or network congestion level. In some embodiments, the tolerance limit is based on total data usage over the usage interval of two data record sequences.

  In some embodiments, the network device processor may include one or more classification categories in the second service usage record sequence that may be coordinated with service usage in one or more classification categories in the secure device data record sequence. Further configured to identify service usage. In some embodiments, the criteria in the classification category adjustment includes determining whether the two service usage report sequences match at the report network performance level or the network congestion level.

  In some embodiments, the network device processor is further configured to identify service usage from a second service usage record sequence that cannot be adjusted using a known service usage classification in the secure device data record sequence. The In some embodiments, the classification category adjustment criteria includes determining whether the two service usage report sequences match within the reported network performance level or network congestion level.

  In some embodiments, the minimum allowable limit is a quantity, i.e., one in a second service usage record sequence that can match or be correlated to one or more classification categories in the secure device data record sequence. Imposed on the relative amount or percentage of service usage of one or more classification categories. In some embodiments, if the minimum allowable limit is not met, the fraud detection error flag for the device is set to limit network access and notify the network device or network administrator to take further action.

  In some embodiments, the maximum allowable limit does not match the quantity, ie, one or more classification categories in the secure device data record sequence, or in the second service usage record sequence that cannot be correlated. Charged for the relative amount or percentage of service usage of one or more classification categories. In some embodiments, if the maximum allowable limit is exceeded, the device's fraud detection error flag is set to limit network access and notify the network device or network administrator to take further action.

  In some embodiments, the network device processor may ensure that the service usage report of the secure device data record sequence matches one or more device service usage enforcement policies that it is intended to impose within predetermined tolerance limits. Further configured to determine whether or not. In some embodiments, if an acceptable limit is exceeded, the device's fraud detection error flag is set to limit network access and notify the network device or network administrator to take further action. In some embodiments, the network device processor may include one or more device service usage enforcement policies that the service usage reports of the second device service usage report sequence are intended to impose within predetermined tolerance limits. Further configured to determine whether they match. In some embodiments, if an acceptable limit is exceeded, the device's fraud detection error flag is set to limit network access and notify the network device or network administrator to take further action.

  In some embodiments, the network device processor is further configured to provide one or more secure messages to each of a plurality of device programs executing in a secure software or firmware instruction execution environment, Acknowledge receipt of one or more secure device data records or acknowledge access network authentication sequence. In some embodiments, the network device processor has a network that is unrestricted or unrestricted for a period of time that is predetermined or specified in a message to a program running in a secure software or firmware execution environment for each device. A series of secure messages that directly or implicitly command access is further configured to be sent from the network device processor to a program executing in a secure software or firmware instruction execution environment. In some embodiments, the network device processor sends a secure message to each device that instructs a program running in a secure software or firmware instruction execution environment to restrict access to a predetermined network destination set or feature set. Further configured to transmit.

  In some embodiments, secure network busy status (NBS) monitoring and reporting is provided. In some embodiments, secure NBS monitoring and reporting is useful for NBS billing and control enforcement. In some embodiments, a processor of a wireless communication device that wirelessly communicates with a wireless network, wherein a secure software or firmware instruction execution environment is configured, and the DDR processor in the secure execution environment is configured of the wireless communication device with the wireless network. Monitor service usage; create and record network performance characterization based on monitoring service usage of the wireless communication device with the wireless communication network; analyze network performance characterization; network experienced by the device A network performance statistics message including network performance statistics sequences created at different times, comprising one or more network performance statistics characterizing the performance level or congestion level of the network in summary form; Performance lipo You bet message is a secured network performance reports, and sending a Securing network performance reports to arranged storage function to the network, configured to perform.

  In some embodiments, the measurement of network busy state or network congestion includes network access attempt count, access success count, access failure count, delay from access attempt to access success, network throughput data rate, data error rate, packet error. Rate, packet repeat rate, one-way or round-trip delay, one-way or round-trip delay jitter, TCP traffic backoff parameters, TCP window parameters, modem channel quality, modem channel power, modem channel signal-to-noise ratio, modem radio data rate, or network throughput This is done by observing one or more of the ratio of data rate to modem wireless data rate and the subnetwork of the network to which the device is connected.

  In some embodiments, the measurement of service usage is obtained from observation of network traffic generated by the service usage of the device user. In some embodiments, service usage measurement communicates one or more network traffic sequences between a device and a network function, and uses a subset of service usage monitoring that includes the network traffic sequences, Obtained from creating and recording performance characterization.

  In some embodiments, a network processor configured as a device secure network performance record storage and processing function for wireless communication with a wireless network in wireless communication with a plurality of wireless communication devices, wherein each wireless device is secure Including a network performance record generator, wherein the network device process is to provide an individual secure communication channel between each of the plurality of secure network performance record generators and the network device, wherein the communication channel security protocol is secured Being configured to detect tampering of network performance records; receiving a plurality of secure network performance records from each secure network performance record generator via a secure communication channel; Provides network secure statistics, where the network performance statistics are network performance statistics that provide an indication of the network performance level or congestion level experienced by the device, and the secure network performance record sequence for each device is stored Identify the sub-network of the network to which each device is connected, analyze the secure network performance records received from multiple devices connected to the same sub-network, and aggregate the performance level or congestion level of the sub-network Identifying the performance level or congestion level aggregate feature of other subnetworks connected to the network, performing the same operation, and the aggregate feature of the performance level or congestion level of each characterized subnetworks The result Remember, provide the stored results to other network devices or functions, and if any device data record is damaged, delayed or deleted, set the fraud detection error flag for that device; A processor further configured to restrict network access and to notify a network device or network administrator to take further measures.

  In some embodiments, a network performance characterization system is provided. In some embodiments, the network performance characterization system includes a processor of a wireless communication device that wirelessly communicates with a wireless network, wherein the processor is configured with a secure software or firmware instruction execution environment, and within the secure software or firmware instruction execution environment The program communicates a plurality of secured traffic sequences between the device and the network device, and includes: a predetermined time or time interval, a service use event or service use status generated by the device, and the network device. A network device program configured to initiate each traffic sequence based on one or more of the responses to the communicated message and securely communicate with a program (eg, a DDR processor) in the secure execution environment. Sessa monitors multiple secure traffic sequences between wireless networks and wireless communication device service usage, uses secure traffic sequence monitoring results to create and record network performance characterization, and network performance characteristics A plurality of network performance statistics summarizing the performance characterization into one or more network performance statistics providing an indication of the network performance level or congestion level experienced by the device, including network performance statistics sequences generated at different times Configured to generate a network performance report, the network performance report is stored in a network performance report storage function, and the network performance report storage function is provided to other network devices or functions.

  In some embodiments, DDR is applied to one or more of the following activities: service billing, service control, and / or access control; service usage measurements (eg, service usage fraud and scalability) Device measurement); verification of monitored service usage; verification that service usage control policies are in place for devices; and source of performance monitoring and / or measurement.

  In some embodiments, DDR is based on configured time intervals; based on configured usage size (eg, based on device buffer size limits or performance size limits or other criteria); modem resources In response to a request from a service processor executing on the application processor of the wireless communication device; e.g., a usage threshold such as out of memory or reaching a memory threshold limit; In response to a request from the service controller (eg, directly or indirectly through a service processor running on the application / general purpose processor of the wireless communication device) to the network element;

  In some embodiments, an adjustment process is provided that coordinates multiple device data records and service processor usage reports of monitored wireless communication devices to verify service usage reported on each of the monitored wireless communication devices. And the process includes one or more of the following: each service processor receiving a data report from each of a plurality of monitored wireless communication devices and over a predefined time period or received Service processor based on usage reports and associated device data records, or based on predefined service usage / bulk sample volume, or based on predefined time periods, or based on service policy validation settings Receive usage report; monitored wireless communication device is tampered with Verify that it has not been or has been compromised (eg, missing, altered, delayed, and / or unadjusted DDR or mismatch beyond the tolerance of the received micro-CDR and DDR); monitored Verifying that the service usage of the wireless communication device complies with the associated service policy and / or service plan; the traffic of the service policy / service plan with which the monitored wireless communication device is associated over a period of time Verify that control policies (eg, QoS, NBS, throttling) were implemented as appropriate; service usage received using multiple device data records and service processor usage reports received for each monitored wireless communication device Verify measurement accuracy; adjust using tolerance threshold. In some embodiments, the tolerance threshold (e.g., based on a fixed amount, a percentage) is a device data record and service processor received during a synchronized and monitored time period that includes one or more of the following: Explaining discrepancies with usage reports: configuration in the adjustment process of service usage that cannot be correlated to tolerances configured by service providers, unclassified service usage in received device data records and / or known service activity Tolerances, redirected service usage activities of content delivery network services, and / or other possible differences and / or differences.

  In some embodiments, the coordination engine performs one or more of the following: 1 describing synchronization errors or traffic classification errors over time (eg, training period, periodic refinement using heuristics) Determine one or more patterns; determine whether the received device data record is appropriately associated within a policy usage activity (eg, reverse DNS lookup, whitelist, or web crawler); similar to service processor classification Perform a classification operation (eg, layer 7 service usage activity classification as reported in micro CDR / uCDR) on the received multiple device data records, and then use the received multiple device data records Group into service activity classifications used by the service processor; Identify the service usage measurement in the service processor usage report of the service activity classification, and then identify the percentage of each service usage activity that can be verified by classifying the service usage measurement in the received device data record; Perform adaptive ambient techniques (eg, use threshold-based comparison techniques that use reverse DNS for DDR and packet classification, then host funding services, all whitelisted host names, all unknown Perform a comparison (with an acceptable error rate) using the authorized usage rate of the host name and the synchronization error tolerance to identify potential fraud situations, below: in the service plan classification definition part Some funding services, user (eg open access) services, carrier services, network protection services (eg A third service that performs one or more adjustments of the network service / delayable to protect network bandwidth / resources for foreground / high priority services) Coordinate using usage measurements (eg, network based CDR, FDR, and / or IPDR) In some embodiments, the secure device data record is received from a service processor included in the DDR report, a 5-tuple classification Information (eg, source address, port address, destination address, destination port, and protocol) along with corresponding layer 7 classification information (eg, domain name, application identifier, HTTP information, association classification, and / or Other information mentioned) can be accompanied by examples For example, these information can be transmitted to a service controller (eg, or another network element) to assist in service usage coordination and / or confirmation using various techniques described herein.

  In some embodiments, the DDR includes one or more of the following: a source tuple, a port address, a destination address, a destination port, and a 5-tuple that includes a protocol (eg, inbound and outbound) and a byte count Use classification information, and the following: use measurement difference, time synchronization difference, and / or information that is not available in the DDR processor classifier (eg, application information in the DDR processor, association information, simpler classification implementation / algorithm, etc.) One or more tolerance threshold accounts of information classified by the service processor. In some embodiments, the service processor usage report is not included in the receiving device data record: Layer 7 monitoring service usage information (eg, domain name, application identifier, HTTP information, association classification, and / or Only a certain percentage of the receiver data records are identified as traffic associated with the service usage activity, and are not dependent on the activity for each service usage activity. The allowed amount of classified traffic is provided (eg, Amazon is “closed” while CNN is very diverse), and the sum of all unclassified allowed amounts is the total unclassified receiver data record information. The tolerance is relaxed at the first time interval, the tolerance is tightened at the second time interval, and the second Time interval is longer than the first time interval. In some embodiments, the secure device data record corresponds with 5-tuple classification information (eg, source address, port address, destination address, destination port, and protocol) received from the service processor included in the DDR report. Layer 7 classification information (e.g., domain name, application identifier, HTTP information, association classification, and / or other information described herein) can be accompanied, for example, by the service controller (e.g., or To other network elements) to assist in service usage coordination and / or confirmation using the various techniques described herein.

Advanced Wireless Service Platform (AWSP)
In some embodiments, an advanced wireless service platform (AWSP) is provided. In some embodiments, the AWSP provides an enhanced networking technology platform that supports existing services and various new Internet and data services as described herein with respect to various embodiments. Performance is also provided for wireless networks (eg, 4G, 3G, and / or 2G networks). In some embodiments, the wireless device, processor, firmware (eg, DDR firmware as described herein with respect to various embodiments), and software may be as described herein with reference to various embodiments. Provide an enhanced role in wireless network service policies for billing, access control, and service notification for implementing AWSP.

  In some embodiments, the AWSP supports a wide range of machine services, devices, and applications to the consumer, enterprise, and machine markets as described herein with respect to various embodiments. In some embodiments, AWSP supports various device types including: 4G and 3G smartphones, 4G and 3G feature phones, 4G and 3G USB dongles and cards, 4G-WiFi and 3G-WiFi bridge devices, 4G and 3G notebook and netbook computing devices, 4G and 3G slate computing devices, 4G and 3G consumer electronic devices (eg, cameras, personal navigation devices, music players, and home power meters), and machines to machine devices ( For example, various types of consumer and industrial devices with minimal user interface (UI) performance such as geolocation tracking devices, parking meters, and vending machines).

  In some embodiments, the AWSP includes a device data record (DDR) processor. In some embodiments, the DDR processor is an AWSP compliant processor (eg, compatible with AWSP, such as through a wireless carrier AWSP chipset certification program, supports AWSP, and is approved by AWSSP, and / or Firmware integrated into a secure hardware execution environment within an AWSP certified processor or processor set). In some embodiments, an AWSP-compliant processor is certified as a qualified processor for proper service provision via the AWSP, as described herein with respect to various embodiments.

  In some embodiments, a DDR firmware developer kit (DDR FDK) is provided. In some embodiments, the DDR FDK includes firmware code (eg, written in C), detailed DDR processor specification, detailed chipset secure execution environment (SEE) specification, DDR processor chipset test criteria, and DDR Includes processor chipset certification procedure. For example, an approved chipset partner may integrate DDR firmware into a chipset verification device (CCD) of an approved or certified processor (eg, a chipset approved or certified under the AWSP chipset certification program). Can do. In some embodiments, the CCD includes an approved chipset partner chipset board support package (BSP) of the smartphone / feature phone device that includes the chipset submitted to the AWSP chipset certification program. In some embodiments, the CCD includes a smartphone / feature phone that includes an approved chipset partner chipset submitted to the AWSSP chipset certification program. In some embodiments, various operating systems (OS) are supported (eg, Linux, Android, Apple, Microsoft, Palm / HP, Symbian, and / or various other operating systems and / or platforms).

  In some embodiments, the enhancement features include service processor (SP) kernel program and application integration. In some embodiments, in addition to the DDR firmware, a service processor software developer kit (SP SDK) is provided. In some embodiments, the SP SDK includes software and descriptive information that integrates the SP SDK kernel program and application software into the device OEM, as described herein with respect to various embodiments. In some embodiments, the approved chipset partner CCD uses a wireless carrier 3G (EVDO / UMTS) using a mutually agreeable WWAN wireless modem chipset that has been proven to work with wireless carrier networks. Connect to network or wireless carrier 4G LTE network.

DDR Processor Overview In some embodiments, the DDR processor is implemented in secure firmware embedded in either an application processor unit (APU) or a modem processor unit (MPU). In some embodiments, the DDR processor is provided as device firmware that is manufactured and installed by the OEM at the time of manufacture. In some embodiments, the DDR processor monitors input and output IP packets and collects various statistics (eg, device data records (DDR)). In some embodiments, the DDR is in part a record of the amount of data transmitted along the IP flow or service usage along the IP flow. In some embodiments, an IP flow is specified by source address, destination address, source port, destination port, and protocol type. In some embodiments, the secure device data record is associated with an IP flow (eg, source address, port address, destination address, destination port, and protocol) received from the service processor and corresponding layer 7 classification information (eg, Domain name, application identifier, HTTP information, association classification, and / or other information as described herein). In some embodiments, DDR also includes other types of classification of network service usage, as described herein with respect to various embodiments. In some embodiments, the DDR also includes various statistics related to or based on network service usage, as described herein with respect to various embodiments. In some embodiments, the DDR may be used in home and roaming network situations for various service usage accounting, access control, and service policy enforcement verification functions, as described herein for the various embodiments. Used in 2G, 3G, and 4G wireless networks.

  FIG. 1 shows a high-level diagram of an advanced wireless service platform end-to-end DDR reporting and processing system according to some embodiments. In FIG. 1, four DDR implementation options are shown for securely embedding a DDR processor (eg, DDR processor firmware and / or functionality) into an APU chipset or MPU chipset. Each of these three options is described below at a high level and in more detail in the following sections.

  In some embodiments, the wireless communication device includes a DDR processor 114 in a secure execution environment. In some embodiments, the DDR processor 114 may perform DDR generator functions (eg, other elements / functions and / or other in a device such as the service controller 122) as described herein with respect to various embodiments. To generate a secure DDR that can be reported to other network elements / functions). Various architectures are provided for implementing a DDR processor in a secure execution environment.

  The device architecture 101 includes a DDR processor 114 in the data path security zone 140 as shown (eg, located in an application / general purpose unit (APU)). Application program 130 is monitored using service processor application program 112 (eg, monitoring based on service usage). The kernel program 132 is monitored using the service processor kernel program 113. An operating system (OS) 134 resides on the network stack 136 for network access and is monitored by the DDR processor 114 for any network access through the modem bus driver / physical bus 142. As shown, 3G or 4G wireless network access is provided to the 3G or 4G network through the 3G or 4G modem 150, respectively. This device architecture and similar device architectures are described in more detail later in this document.

  The device architecture 102 includes a DDR processor 114 in the data path security zone 143 as shown (eg, located in a modem processor unit (MPU)). The device architecture 102 is similar to the device architecture 101 except that the data path security zone 143 is located in the 3G or 4G modem 151 in the device architecture 102. Network communication via modem 151 through modem bus driver / physical bus 149 and modem I / O 156 is monitored using DDR processor 114 for any network access through modem data path / signal processing 154. This device architecture and similar device architectures are described in more detail later in this document.

  The device architecture 103 includes a DDR processor 114 in the data path security zone 145 as shown (eg, located in another processor / memory such as an APU or SIM card). The device architecture 103 does not require the modem bus driver / physical bus of the APU to be in the secure zone in the device architecture 103. Instead, the data path security verifier 152 is included in the data path security zone 147 in the MPU. Similar to device architecture 101, except that network access is limited only to traffic that has been monitored by DDR processor 114 within the APU. This device architecture and similar device architectures are described in more detail later in this document.

  Device architecture 103A includes a DDR processor 114 in data path security zone 918 (eg, located within SIM 913) as shown. Device architecture 103A is similar to device architectures 101 and 102, except that device architecture 103A, like device architecture 103, has two data path security zones. The data path security zone 143 is arranged in the 3G or 4G modem 151, and the data path security zone 918 is arranged in the SIM 913. In the device architecture 103A, the modem bus driver / physical bus 149 does not need to be in the secure zone; instead, the data path security verifier 152 is included in the data path security zone 143 in the MPU, and the DDR processor in the SIM 913. Restrict network access to only traffic that has been monitored by 114. This device architecture and similar device architectures are described in more detail later in this document. Device architecture 103A allows the carrier to have full control over the DDR processor functions because the industry considers the SIM to be a “carrier-owned” entity on the device.

  As will be appreciated by those skilled in the art, together with an MPU accompanied by a DDR processor 114, it can be embedded in the secure zone of any other functional processor for network access. Such functional processors that can embed the DDR processor 114 include, for example, video processors, audio processors, display processors, location (eg, GPS) processors, and other dedicated processors such as digital signal processors (DSPs), microprocessors, etc. And general purpose processors.

  In some embodiments, a service controller 122 is provided, as shown. In some embodiments, the service controller 122 is provided as an AWSSP network server cloud system. In some embodiments, the service controller 122 is provided as an AWSSP network server cloud system that is used to perform one or more of the following; collection of device service usage reports; device based on network service policy Management of specific aspects; confirmation of network busy status (NBS) of various base stations on the network (eg, wireless network); user notification and service plan selection UI process configured on the device (eg, wireless communication device) Management; and management of specific aspects of service fraud detection. In some embodiments, as shown, the service controller 122 includes secure DDR processing, usage coordination, and fraud detection functions 124. In some embodiments, the service controller 122 communicates monitored service usage (eg, service usage adjusted based on processed and adjusted secure DDR) to the network service usage reporting system 180. In some embodiments, reported service usage is aggregated and communicated to network billing system 190 (eg, for billing for reported service usage).

  In some embodiments, the service controller 122 communicates with various device-based elements of the AWSP system. In some embodiments, the service controller 122 communicates with various device-based elements of the AWSSP system, including: a DDR processor 114 and a service processor. In some embodiments, the service processor 112 includes an application service processor 112 (eg, application space or framework space program) and a kernel service processor 113 (eg, kernel space or driver space program). In some embodiments, application service processor 112 and kernel service processor 113 are executed or implemented within the OS partition of an application processor unit (APU) of a device (eg, a wireless communication device). In some embodiments, the service processor is generally not in a secure execution area.

  In some embodiments, the service processor may collect network busy state (NBS) information, service usage classification and reporting, specific network service policy enforcement functions, and as described herein with respect to various embodiments, and And / or perform various functions of the carrier network including specific user notification functions and roaming access policy enforcement functions. In some embodiments, the service processor determines a carrier (eg, a wireless network service or other service service provider) in determining how to provide optimized services, information, and / or content to a user. Record and report supporting device service usage information.

  In some embodiments, the DDR processor 114 communicates the DDR to the service controller 122. In some embodiments, the DDR processor 114 communicates the DDR to the service controller 122 via the Internet, a carrier network, and / or other networks. In some embodiments, the DDR processor 114 does not send the DDR directly to the service controller 122; instead, the DDR processor 114 forwards the DDR to the service processor. The service processor then forwards or replays the DDR to the service controller 122, and in some embodiments, additional service usage reports and / or other service policy management and user notification communications generated or received by the service processor. At the same time, the DDR is transferred or reproduced to the service controller 122.

  For example, the APU OS execution environment is generally not considered secure or reliable, although the service processor can be protected by the OS and / or other security elements in the system. Further, the network data path between the DDR processor 114 and the service processor is generally not considered secure or reliable, and the data path between the service processor and the service controller 122 is not considered secure or reliable. Accordingly, in some embodiments, DDR processor 114 and service controller 122 provide encryption links from DDR processor 114 to service controller 122 using encryption techniques. In some embodiments, DDR processor 144 is considered secure and reliable based on various implementations and techniques, as described herein with respect to various embodiments. In some embodiments, various techniques for securing the service usage monitoring and control performed by the DDR processor 114 on the network data path and securing the DDR reporting channel from the DDR processor 114 to the service controller 122 are described in various embodiments. Embodiments are described herein.

  In some embodiments, the secure access controller function within the DDR processor 114 is utilized as described below to manage the device network managed by the DDR processor 114 when the DDR flow is tampered with or blocked. Ensures that the access data path connection is limited only to network destinations required to manage communication with the service controller 12 of the DDR processor 114. In some embodiments, the access controller function in the DDR processor 114 receives feedback from the service controller 122 to restrict access or allow full access. For example, a restricted access list (eg, a list of access list host names, IP addresses, and / or other identifiers) may be pre-provisioned within the DDR processor SEE, or as described in more detail herein. Can be configured through a secure path.

  In some embodiments, secure, reliable and reliable transmission of DDR from DDR processor 114 is provided by DDR reporting techniques including: (1) DDR processor firmware is secured within secure execution environment (SEE) And (2) the data path between the DDR processor and the wireless modem antenna connection (eg, 3G or 4G network modem antenna connection) is secured, and malware or software is installed in the DDR processor data path. (3) The DDR sent from the DDR processor 114 to the service controller 122 is integrity checked to protect it from tampering or playback, and (4) a unique DDR report. Sequence identifier Tsu DOO and the authentication process is used between the authentication session keep alive timer in combination with DDR processor 114 and service controller 122 verifies maintain a secure connection between the DDR processor 114 and service controller 122. For example, if a secure session or DDR record flow between the DDR processor 114 and the service controller 122 is interrupted, the secure access control function in the DDR processor 114 may allow access to the modem data path to be transmitted to the DDR processor 114 and the service. The network destination required to re-establish a securely authenticated session with the controller 122 can be limited.

  In some embodiments, the DDR processor 114 also includes a secure network busy state monitoring function (eg, an NBS monitor), as also described herein with respect to various embodiments. In some embodiments, the NBS monitor records and reports various network and modem performance parameters, and also calculates and reports a measure of network congestion, referred to herein as network busy condition (NBS). In some embodiments, the NBS is a measurement that indicates the level of network congestion at a given base station sector over a given measurement time interval. In some embodiments, this information is all contained in a network busy state report (NBSR), which is part of the DDR message report sent to the service controller 122 via the service processor 112.

Overview of Secure Image Programming, Secure Boot, Secure Execution, and Secure Firmware Update In some embodiments, the DDR processor system includes a dedicated secure execution environment (SEE) within an application processor unit (APU) or modem chipset. In some embodiments, SEE provides for secure and reliable generation of DDR as described herein. The basic functions of SEE according to some embodiments are described below.

  In some embodiments, the SEE is a secure memory execution partition that is not accessible to any external program, bus, or device port. In some embodiments, the secure memory execution partition includes a code space and a data space. In some embodiments, the secure boot loader is executed within SEE. In some embodiments, the only other code image allowed to run on SEE is a secure image, which means a digitally signed image whose signature has been verified by a secure boot loader. In some embodiments, the secure boot loader is programmed into non-volatile memory within the on-chip SEE during device manufacture. For example, a secure boot loader can fetch a secure image from non-volatile memory and install it in SEE to be reliable and secure. In some embodiments, the secure boot loader is the only element that can load an image into SEE.

  In some embodiments, the DDR processor 114 is implemented as a secure image. The installation of the DDR processor on the SEE using the secure boot loader is described below. Other secure images can be installed as well, as will be apparent to those skilled in the art in view of the embodiments described herein.

  In some embodiments, the DDR processor image is digitally signed by the device OEM. For example, the secure boot loader can verify the signature using a boot loader verification key and reject the image if the signature is invalid. In some embodiments, the boot loader verification key is a 2048 bit RSA public key embedded within the secure boot loader image.

  In some embodiments, the signed DDR processor image is stored in on-chip non-volatile memory. In some embodiments, the signed DDR processor image is stored in off-chip non-volatile memory (eg, if the on-chip storage capacity of the chipset is too small to store this image).

  FIG. 2 illustrates a process for booting, executing, and updating DDR firmware, according to some embodiments. As shown in FIG. 2, at 210, when the device boots, the secure boot loader fetches the DDR processor image from non-volatile memory, installs it in SEE, and executes it. In some embodiments, during installation and before execution, the secure boot loader verifies the digital signature of the DDR processor image using a boot loader verification key. If the signature is invalid, no execution takes place, an error message is sent via the service processor to the secure controller, and the secure boot loader is written to the previously stored image as described herein for various embodiments. Try to fall back.

  In some embodiments, the data path from the non-secure OS stack element monitored and controlled by the DDR processor to the modem must enter the SEE and be provided to the DDR processor as shown at 220 in FIG. Don't be. The OS stack data destined for the modem is transferred to the SEE memory, and the secure DDR processor program parses and acts on the data destined for the modem as described herein with respect to various embodiments. To do. In some embodiments, the DDR processor includes a secure data interface from the SEE to the modem data path so that there is no data path that avoids SEE (eg, avoids detection and / or monitoring by the DDR processor). Examples of secure execution partitions and data interface solutions include custom or proprietary solutions such as from trusted APIs, ARM Trust Zone, Intel Smart & Secure, or chipset suppliers for specific chipsets.

  In some embodiments, the communication channel (eg, DDR mailbox) is connected to a DDR processor program running in SEE and a non-secure OS environment (eg, application space or user space, as shown at 230 in FIG. ) To provide communication with the service processor application program being executed. An example technique for providing a DDR mailbox is a DMA channel, a logical channel (eg, endpoint) in a modem bus driver (eg, USB interface) between the APU and the MPU, an existing logic between the APU and the MPU. Includes shared memory that uses a piggyback channel over the channel.

  In some embodiments, the DDR processor firmware image is updated as shown at 240 in FIG. In some embodiments, the DDR processor firmware image is over-the-air (OTA) and OEM supported by chipset suppliers via network (OTN) update of chipset non-volatile memory firmware image provided by device OEM. It is updated using a process. In some embodiments, the DDR processor may be loaded by the secure boot loader during the initial power-up cycle, upon exiting the power save state, and / or at any other time when the download can be performed securely. Stored with the chipset secure firmware driver. In some embodiments, the DDR processor requires sufficient memory space to accommodate one currently running image, a newly downloaded image, and at least two images (eg, each image is , 0.5MB or other specified size limit, etc.). In some embodiments, the secure boot loader includes a firmware image switch that uses the new image after the download is complete. For example, the image switch feature can fall back to switching back to the current image if the new image is an invalid signature or the new image is older than the current image, as indicated by the revision number included in each image. System can be included. The current image can be retained until the new image is accepted at least by the secure boot loader.

Overview of DDR Processor Implementation Embodiments As described herein by various embodiments, different configurations are used for secure embedded DDR firmware included in APU implementation, MPU implementation, and APU / MPU combination implementation (e.g. , Within the AWSP chipset), a DDR processor can be provided. Those skilled in the art will appreciate that a variety of similar and other secure partition configurations that provide secure embedded DDR firmware may be provided in view of the various embodiments described herein.

  In some embodiments, an APU chipset such as the APU implementation shown in device architecture 101 where DDR processor 114 and modem bus driver and physical bus 142 are implemented in data path security zone 140 as shown in FIG. A DDR processor is provided using integration into SEE and non-volatile memory. The DDR processor is a 2G, 3G, or 4G modem data path directly below the modem driver data path processing function and above the modem bus driver data path processing function (eg, typically a USB driver, SDIO driver, or similar bus drive function). Securely implemented with For example, using this approach to secure the entire data path under the DDR processor through a modem bus driver and a 2G, 3G, or 4G network modem, avoiding a data path that avoids DDR processor data path processing. Can do.

  In some embodiments, as shown in FIG. 1, 2G, such as the MPU implementation shown in device architecture 102 where DDR processor 114 and modem datapath and signal processing 154 are implemented in datapath security zone 143, A DDR processor is provided using 3G or 4G MPU chipset SEE and integration into non-volatile memory. The DDR processor is securely implemented with a 2G, 3G, or 4G modem data path directly below the modem bus driver and logical channel interface. For example, using this approach, the entire data path to the 2G, 3G, or 4G network under the DDR processor is secured, and data paths that avoid DDR processor data path processing are avoided.

  In some embodiments, as shown in FIG. 1, DDR processor 114 is implemented in data path security zone 145 and data path security verifier 152 and modem data path and signal processing 154 are implemented in data path security zone 147. As with the APU and MPU implementations shown in the device architecture 103, a DDR processor is provided using APU chipset SEE and integration into non-volatile memory. The DDR processor is securely implemented in a 2G, 3G, or 4G modem data path somewhere below the OS stack and above the modem bus driver. For example, this approach is not used to secure the entire data path under the DDR processor through a modem bus driver and a 2G, 3G, or 4G network modem, but between the DDR processor and the modem radio network access connection. The data path is secured by checking the integrity of the data flowing between the DDR processor and the data path security verifier (DPSV) 152 function. Any data path information not described as appropriate and not integrity checked is not transmitted over the wireless network connection. For example, this approach eliminates the need to secure data path elements other than APU firmware, hardware, and DDR processors.

Embedded DDR Processor Implementation in Application Processor In some embodiments, service usage monitoring and monitoring for multiple wireless modems can be performed by embedding the DDR processor in an application processor (APU) (eg, a smartphone APU or other wireless communication device APU). A single secure DDR processor location is provided for a radio network data path that provides access control (eg, 2G / 3G / 4G radio network data path or other device I / O connection or port). The APU implementation approach also allows APU chipset suppliers who do not necessarily have WAN modem components or technologies to implement solutions that comply with the various AWSP techniques described herein. In addition, APU implementation techniques generally allow for easier OTA and OTN firmware updates (eg, the provision in a particular MPU implementation may be more complex) as described herein. Many disclosed embodiments describe DDR APU implementations in which DDR operates on communication flows through one or more wide area networks, connections, or modems. As will be appreciated by those skilled in the art, an APU embodiment of a secure device data record processing system may include one or more additional I / O networks, connections, ports, or modems (eg, WiFi networks, connections, ports, Or modem: USB network, connection, port or modem, Ethernet network, connection, port or modem, Firewire network, connection, port or modem, Bluetooth network, connection, port or modem, near field communication (NFC) Network, connection, port, or modem, or another I / O connection, port, or modem).

  Referring to the device architecture 101 shown in FIG. 1, the DDR processor is embedded in the APU chipset SEE and non-volatile memory as described above. A secure data path environment, shown as data path security zone 140 along with DDR processor SEE, includes a DDR processor 114 and a modem bus driver and physical bus 142. For example, if the modem bus driver / physical bus to the modem is secured (eg, or otherwise inaccessible) from malware or firmware that attempts to circumvent the DDR processor 114, the modem itself ( For example, there is no need to secure a 3G modem or 4G modem 150). In particular, the DDR processor 114 is 2G, 3G, or 4G directly below the modem driver data path processing function and above the modem bus driver data path processing function (eg, typically a USB driver, SDIO driver, or similar bus driver function). Implemented securely in the modem data path. In some embodiments, the entire data path under the DDR processor 114 through the modem bus driver and 2G, 3G, or 4G modem is secured to avoid data paths that avoid DDR processor data path processing. In some embodiments, the device network connection or I via a data path processing function (eg, typically a USB driver, SDIO driver, Ethernet driver, Firewire driver, WiFi driver, Bluetooth driver, or near field communication driver). All information communicated from the device via the / O port is observed (and possibly processed to apply the policy), classified or reported as it passes through the DDR processor block. Thus, in some embodiments, the modem bus driver is secured with DDR SEE, or its own SEE, or modem bus driver code, and the data path is to software or firmware on the APU that can bypass the DDR processor 114. Must be inaccessible.

  FIG. 3 illustrates the architecture of a secure embedded DDR processor in an APU implementation according to some embodiments. In particular, FIG. 3 illustrates the main functional elements in an APU-based solution according to some embodiments, where the DDR processor 114 resides in the SPU of the APU along with other APU secure programs, and the service processor application program 112 The communication channel of the DDR processor to is via a shared mailbox (eg, shared memory). FIG. 3 also shows an interface to non-volatile memory (eg, for downloading software), where secure boot code is present and all secure code is first verified with digital signatures before the download is considered complete. To be guaranteed. In some embodiments, the data path is a separate interface and data frames are sent to the secure environment of the DDR processor to obtain access and perform DDR usage measurements in addition to controlling restricted or unrestricted network access. Run.

  Referring to FIG. 3, the APU can be logically divided into an APU chipset application program 302, an APU chipset kernel program 304, and a secure execution environment (SEE) shown as an APU secure execution environment 306. APU secure execution environment 306 communicates with network elements / functions (eg, service controller 122 and / or other elements / functions) (eg, using secure communication techniques as described herein). In some embodiments, the secure program non-volatile (NV) memory 340 is fetched by a secure boot loader residing in the APU secure execution environment (SEE) 306 prior to performing code execution as described herein, It includes an OS / OEM secure device system program file 342, a secure DDR processor program file 346, and an APU secure device system program file 348 that can be downloaded to the SEE memory.

  The APU chipset application program 302 includes a user application program 130, a service processor application program 112 (eg, performing various service processor functions that do not need to be implemented in the kernel as described herein), and OEM applications. A program 310 is included. The APU chipset kernel program 304 is an OEM kernel program 312, eg, a service processor kernel program 113 that performs various service processor functions preferably implemented in the kernel as described herein), an APU system kernel program 314, as well as APU device drivers and other BSP kernel programs 316. As also shown, OS 134 includes user / application space and kernel space implementation portions, as will be apparent to those skilled in the art. Network access (eg, 3G or 4G wireless network access) is communicated through an APU network stack device driver 318 that resides in kernel space 304 as shown.

  The APU SEE 306 includes a secure execution memory 322 that executes / stores a secure DDR processor program 326, an APU secure device system program (eg, modem bus driver, modem driver) 328, and an OS / OEM secure device system program 330. The APU SEE 306 also includes a program signature verifier 332 that verifies the secure DDR processor program 326 and / or other secure programs in the secure execution memory 322 as described herein. APU SEE 306 also includes NV memory I / O 334 as shown. The APU SEE 306 also includes a secure execution boot loader updater (eg, secure onboard NVRAM) 336 that performs a secure execution boot process and a secure update process as described herein.

  In some embodiments, the network data path 324 of any user or kernel mode application or service is communicated from the APU networking stack device driver 318 and monitored using the secure DDR processor program 326.

  As described further herein, secure DDR processor program 326 communicates to service processor application program 112 using DDR mailbox functions and communication channels, as indicated via DDR mailbox data 320. Is done. In some embodiments, the DDR mailbox function provides a secure communication channel using various techniques described herein. In some embodiments, the DDR mailbox function is used to communicate the secure DDR generated using the secure DDR processor program 326 that monitors network service usage to the service processor application program 112. In some embodiments, the service processor application program 112 communicates the secure DDR to a network element / function such as the service controller 122. In some embodiments, the service processor application program 112 is monitored by a secure DDR service processor report (e.g., application based monitoring / layer 7 or application layer based monitoring, as described herein). , Including device based micro CDR / uCDR) based on service usage, service processor application program 112, and / or service processor kernel program 113, to a network element / function such as service controller 122. In some embodiments, the service processor application program 112 communicates service processor reports that overlap the secure DDR and / or span a time period / interval (eg, two DAS by a service controller or other network element / function). Useful for adjusting device support service usage monitoring based on support service usage measurements).

  FIG. 4 illustrates another architecture of a secure embedded DDR processor in an APU implementation with a modem bus driver, according to some embodiments. In particular, FIG. 4 may be implemented in an APU secure operating environment with a modem bus driver 428 (eg, a 2G, 3G, or 4G modem bus driver). The DDR processor 114 monitors IP packets input to and output from a modem bus driver 428 (eg, USB driver / controller), and the modem bus driver 428 wirelessly uses a 2G / 3G / 4G modem 440 as shown. Wireless network access is provided to modem bus 432 via secure data path 430 for access. In some embodiments, the DDR processor 114 may be a device I / O driver (eg, typically a USB driver, 2G / 3G / 4G modem driver, SDIO driver, Ethernet driver, Firewire driver, WiFi driver, Bluetooth driver, or proximity driver). The device I / O driver provides device I / O access via a data path using secure DDR data path processing or monitoring.

  Similarly, as described above, the secure execution bootloader updater 336 loads the DDR processor 114 and modem bus driver image from the non-volatile (NV) memory 334 to the execution memory in the SEE, shown as the DDR secure execution memory 420. (For example, after code signature verification using the secure program signature verifier 332). The DDR processor 114 and the modem bus driver image and other secure images are all part of a secure boot loader that is to be signature verified before such a load is performed.

  As shown, the DDR processor is placed alongside the 2G, 3G, or 4G modem data path, and all traffic between the OS stack and the 2G, 3G, or 4G network is monitored by the DDR processor 114. A DDR processor OS stack data path interface 424 is provided that bridges the DDR secure execution environment (SEE) 420 and the non-secure OS stack in the kernel. A DDR processor modem data path interface 426 is also provided which similarly connects the DDR processor 114 to the modem data path provided by the modem bus driver 428. In some embodiments, the DDR processor 114 is provided alongside the data path and implements the access controller function as described herein rather than a simple clone / monitor / drop function, for example, Maintains network access integrity when DDR reports are tampered with or blocked from reaching service controller 122, or when DDR processor 114 is tampered with or when service processor 112 is tampered with To do.

  As also shown, a DDR processor mailbox interface 422 is provided that implements a mailbox function that passes DDR mailbox data 320 between the secure DDR SEE 420 and the non-secure service processor application 112. As will be apparent to those skilled in the art in view of the various embodiments described herein, the DDR mailbox function can be implemented in various ways.

  In some embodiments, the DDR processor and USB driver are executed in a secure environment on an application processor chipset, such as DDR secure execution memory 420. In some embodiments, the secure environment includes DDR processor code or modem bus driver / controller code (eg, USB driver / controller or 2G / 3G / 4G modem driver / controller, SDIO driver / controller, Ethernet driver / controller, Firewire). Another device I / O driver / controller such as a driver / controller, a WiFi driver / controller, a Bluetooth driver / controller, or a near field communication driver / controller) is warranted that it cannot be authorized or replaced. In some embodiments, the secure environment is from a DDR processor to a physical modem bus driver (eg, USB port, Ethernet port, Firewire port, WiFi port, Bluetooth port, NFC port, or another I / O bus port). It also ensures that the data path is separated from the firmware outside the secure environment. That is, firmware outside the secure environment has no ability to affect the accurate collection of statistics by the DDR processor. In some embodiments, the secure environment further ensures that no code other than the DDR processor has the ability to access sensitive cryptographic storage such as keys. For example, this may include protecting confidential memory from debug monitors and / or other monitoring / access activities or techniques. As will be apparent to those skilled in the art, not only the DDR processor but also the APU firmware must be secured and must not contain bugs or vulnerabilities that can be exploited to allow unauthorized access. For example, a common attack is a buffer overflow, where an attacker chooses an input that causes an unchecked buffer to exceed its limit, resulting in an unexpected behavior that can be exploited by the attacker.

  There are various examples of APU chipset SEE implementation techniques that can be used to meet these requirements described above. For example, a conventional CPU having upgradeable firmware (eg, including a DDR processor) can be provided. The firmware can be stored in non-volatile (NV) memory, or can be stored in flash memory, and the flash memory can be reprogrammed / updated with new or upgraded firmware. Firmware can be installed at the time of manufacture and, by design, provides a compliant secure environment. Strict quality assurance testing is required to ensure that bugs are unlikely to provide a means to compromise the secure environment. A new firmware image can only be accepted for installation if it has a valid digital signature. Including version control checks, rollback to previous versions can be avoided. The firmware that verifies the signature and version resides in firmware that can also be upgraded. As another example, a security partitioned CPU such as ARM Trustzone or Intel Smart & Secure (eg, or another suitable alternative that includes a potentially superior custom security environment CPU partitioning technique) may be provided. DDR processor, modem bus driver (e.g. USB driver / controller or 2G / 3G / 4G modem driver / controller, SDIO driver / controller, Ethernet driver / controller, Firewire driver / controller, WiFi driver / controller, Bluetooth driver / controller, or Another device I / O driver / controller, such as a near field communication driver / controller, and any intervening code can be executed in a secure partition, such as a secure mode of Trustzone (eg, Smart & Secure). The secure boot procedure includes a DDR processor, a modem bus driver (eg, USB driver / controller or 2G / 3G / 4G modem driver / controller, SDIO driver / controller, Ethernet driver / controller, Firewire driver / controller, WiFi driver / controller, Bluetooth The driver / controller or another device I / O driver / controller such as a near field communication driver / controller) and intervening code can be included in the digitally signed and version-controlled code image. In such an approach, the hardware firewall can protect sensitive cryptographic storage from normal mode firmware. The hardware firewall also ensures that normal mode firmware cannot tamper with the data path between the DDR processor and the physical modem bus driver (eg, USB port), and therefore, as described herein, service usage Avoid interference with the collection of measurement data and / or statistics.

  FIG. 5 illustrates another architecture of a secure embedded DDR processor in an APU implementation with a modem bus driver, according to some embodiments. In particular, FIG. 5 is similar to FIG. 4 except that the 2G / 3G or 4G modem APU stack driver 410 is located in the DDR secure execution memory 420 instead of the APU kernel space 404, as shown in FIG. It is.

Embedded DDR Processor Implementation with Modem Processor In some embodiments, in MPU implementation, the DDR processor resides in the modem processor along with other secure modem data path processing code and hardware functions. For example, in a secure DDR processor implementation based on MPU, when the data path below the modem bus driver interface is secured, hacking the device and creating a data path that reaches the network by avoiding the DDR processor Is relatively difficult. In some MPU chipset families, implementing a secure execution environment, a secure boot loader, and secure non-volatile memory are some APU families that do not have standard hardware security partition features such as ARM Trust Zone and Intel Smart & Secure. Compared to the case where the same function is performed, it may be easier. Furthermore, the MPU implementation can have less interaction with the OS kernel build than the APU implementation. In some embodiments using MPU implementations, the DDR processor 114 may be a wireless wide area network modem such as a 2G, 3G, or 4G modem or USB modem, Ethernet modem, Firewire modem, WiFi modem, Bluetooth modem, NFC modem, or another Residing in a local area or personal area modem such as an I / O modem. Although many of the described embodiments relate to MPU implementations having wireless wide area network modems, as will be appreciated by those skilled in the art, other variations, including other I / O device modems, are within the scope of this disclosure. It is possible without departing from.

  However, it should also be observed that in an MPU DDR processor implementation, the modem processor environment may not have a CPU with the same performance and secure execution memory space as the APU solution. This obvious drawback can be mitigated by designing and optimizing DDR processor firmware with a small code memory size and CPU performance requirements that are usually appropriate for a relatively low power modem processor chipset CPU. As described above, the OTA and OTN update process may be more complex than achieved by a particular APU chipset supplier and OEM secure device system program file 342.

  FIG. 6 illustrates the architecture of a secure embedded DDR processor in an MPU implementation according to some embodiments. In particular, FIG. 6 shows an MPU implementation that includes an embedded DDR processor and a modem data path from the DDR processor to the network in the data path security zone. In this approach, DDR processor 114 is embedded in secure execution memory (630) of secure execution environment (SEE) 604 and modem chipset (eg, 3G or 4G MPU chipset). As shown, the data path security zone, along with modem data path processing and modem signal processing performed between the DDR processor and the antenna to ensure that malware or firmware cannot bypass the DDR processor, 114. In some embodiments, the DDR processor 114 is securely implemented in the 3G or 4G modem data path directly below the modem bus driver 610 and the logical channel interface, and the entire data path to the 3G or 4G network under the DDR processor 114. Is secured to avoid data paths that avoid DDR processor data path processing.

  Similar to the APU-based approach described above, FIG. 6 shows the DDR processor 114 via the network data path 632, along with other secure modem code 634, modem networking protocol code 636 under DDR, and modem data path processing 638 under DDR. Figure 2 illustrates the main functional blocks in a modem-based solution that resides in the use of a modem's SEE monitor service, and the communication channel of the DDR processor to the service processor application program is via a shared mailbox (eg, served by a USB endpoint) . This interface can use a separate logical communication channel or can piggyback over an existing logical communication channel between the APU and the MPU. In some embodiments, the recipient of DDR mailbox data 320 is service processor application code.

  As also shown in FIG. 6, the interface to non-volatile memory in the presence of secure boot code (eg for software / firmware download / update) The secure code is first verified to be digital signature verified. In the data path, in addition to controlling restricted or unrestricted network access, the DDR processor transmits data frames to the secure environment in order to obtain access and perform DDR usage measurements.

  The modem chipset non-secure execution environment 602 includes a modem bus communication driver 610. In some embodiments, a logical communication channel for modem data path traffic 622 over DDR modem data path processing 624 is also provided. In some embodiments, a logical communication channel for modem control settings and status report 612, modem status data 614, modem control data 616, modem diagnostic data 618, and other non-secure modem functions 620.

  FIG. 7 shows another architecture of a secure embedded DDR processor in an MPU implementation. In particular, FIG. 7 shows how the DDR processor 114 is implemented in an MPU secure operating environment, where the data path through 3G or 4G modem network processing and signal processing is up to the antenna and other than the DDR processor. Secured from access from other software or firmware. In some embodiments, the secure boot loader process operates as described above as well.

  As shown, an APU chipset application program 702 that includes DDR mailbox data 710 communicated to the service processor application program 112, as also described herein. The APU chipset kernel program 704, as shown, is a 3G / 4G modem APU stack interface 712 for communicating to the 3G or 4G modem bus driver 722 of the modem chipset non-secure execution environment 706 via the modem bus 718, as shown. A service processor kernel program 113 is included, along with an APU stack interface 714 to other modems and a 3G or 4G modem bus driver 716.

  In some embodiments, the DDR processor 114 alongside the data path enables secure network / service usage measurement and / or access control, as also described herein with respect to various embodiments. In some embodiments, a DDR processor OS stack data interface (IF) 728 is provided, which is (potentially) within the DDR secure execution environment (SEE) and the modem chipset non-secure execution environment 706. It bridges the non-secure modem bus driver interface 722. As also shown, a DDR processor modem data path interface 730 is provided which similarly connects the DDR processor 114 to modem data path processing and modem signal processing 740 performed between the DDR and the antenna. To do. As described herein, the DDR is aligned with the data path, eg, if the DDR report is tampered or the service controller is blocked from reaching, or if the DDR processor is tampered with, or the service If the processor is tampered with, it is not a simple clone / monitor / drop function as it also implements an access controller function as described herein to maintain the integrity of network access.

  As also shown, a mailbox function is provided that passes data between the secure DDR SEE 725 and the non-secure service processor application program 112. In particular, DDR processor mailbox interface (IF) 724 communicates with DDR mailbox 720, which is located in modem non-chipset non-secure execution environment 706. DDR mailbox data 710 is shown as being provided to non-secure service processor application program 112 and, as shown, is provided through a modem communication path via modem bus driver 722 and modem bus 718. A DDR processor mailbox interface (IF) 724 communicates with the DDR processor 114 and is located in the DDR SEE 725. As will be apparent to those skilled in the art in view of the various embodiments described herein, the mailbox function can be implemented in various ways. As also described above with respect to various APU-based embodiments, according to some embodiments, the secure region includes all data path processing steps under the DDR processor, to a network that avoids the DDR processor. There is no data path through the modem.

  In some embodiments, the DDR processor is executed in a secure environment in MPU-based embodiments, as also described above for APU-based embodiments. In some embodiments, the secure environment ensures that DDR processor code cannot be replaced or changed without permission. In some embodiments, the secure environment also ensures that the data path from the DDR processor to the antenna is isolated from firmware outside the secure environment. That is, firmware outside the secure environment has no ability to affect the accurate collection of statistics by the DDR processor. In some embodiments, the secure environment further ensures that no code other than the DDR processor has the ability to access sensitive cryptographic storage such as keys. For example, this may include protecting confidential memory from debug monitors and / or other monitoring / access activities or techniques. As will be appreciated by those skilled in the art, not only the DDR processor, but also the MPU firmware must be secured and must not contain bugs or vulnerabilities that can be exploited to allow unauthorized access. For example, a common attack is a buffer overflow, where an attacker chooses an input that causes an unchecked buffer to exceed its limit, resulting in an unexpected behavior that can be exploited by the attacker.

  Examples of secure execution environment (SEE) implementations in MPU embodiments include those described above with respect to various secure execution environment (SEE) implementations in APU embodiments as well.

Embedded DDR Processor with Application Processor Combined with Modem Processor Data Path Security Verifier In some embodiments, as shown in device architecture 103 of FIG. 1, the DDR processor is embedded in a SEE APU chipset and data A path security verifier (DPSV) is embedded in the MPU chipset. For example, DPSV can use encryption techniques to achieve a secure and reliable data path between a secure DDR processor and a modem network antenna connection. This avoids data connections between malicious software or firmware and the network without having to secure the modem data, physical modem bus, and modem data path elements above the DPSV element. A secure channel binding is created by establishing a secure communication channel between the DDR processor and the DPSV, thereby preventing unauthorized software or firmware from gaining access to the modem bus interface to avoid the DDR processor Even so, only network data path flows securely processed by the DDR processor can reach 3G or 4G modem connections to the radio access network. If unauthorized software or firmware bypasses the DDR processor and communicates the intended non-secure data path information to the modem, the DPSV will not process the network data path that has not been processed by the DDR processor and is not secured by encryption. Cut off.

  FIG. 8 illustrates the architecture of a secure embedded DDR processor at the APU and a data path security verifier (DPSV) at the MPU implementation according to some embodiments. In particular, as shown in FIG. 8, the DDR processor 114 is embedded in the APU chipset SEE, and a second accompanying firmware image, referred to herein as a data path security verifier (DPSV) 836, is stored in the PMU chipset SEE ( For example, it is embedded in 3G or 4G MPU chipset SEE). As also shown, there are two data path security zones, one containing only the DDR processor, and the other between the DDR and the antenna, to ensure that malware or firmware bypasses the DDR processor. DPSV is included with the modem data path processing and modem signal processing performed in (eg, this second data path security zone is similar to the data path security zone of a DDR processor modem only).

  As mentioned above, this approach does not require the APU 3G or 4G modem bus drive / physical bus to be secured. For example, some vendors and / or chipset suppliers (eg, AWSSP APU chipset suppliers) create two firmware images and two data path security zones between the DDR processor SEE and the modem antenna connection. It can be considered easier than securing the data path between. Compared to the approach based on APU implementation, the APU firmware is somewhat simpler and can eliminate the security design work involved in securing the modem bus drive / physical bus. Compared to approaches based on MPU implementations, it can be difficult to secure the data path from the DDR processor through the modem bus driver, the modem physical bus, and the modem itself. In some MPU chipsets, it may also be necessary to simplify or reduce the number of secure firmware program images required by the MPU, as also described above. Simpler and fewer firmware can reduce the frequency of updates required, or perhaps eliminate updates collectively. The APU DDR processor and MPU DPSV implementation described herein reduces the firmware required by the MPU to DPSV. This allows more complex data path processing by the DDR processor to be performed on the APU, (i) secure firmware execution memory is larger than normal, CPU performance is higher than normal, and (ii) firmware update system is usually more High performance and higher flexibility. However, there are also disadvantages associated with the APU DDR processor and MPU DPSV implementation approach. The main drawback is that the firmware generally must be embedded in both the wireless network chipset (MPU) and the device application processor (APU) chipset.

  As shown in FIG. 8, the first SEE 810 is implemented with an APU chipset, which includes a DDR processor 114, and also as described herein, an OS stack data path interface and / or The modem data path interface 818 is used to securely monitor communications from the APU stack driver 806 of the 2G / 3G / 4G modem. The second SEE 832 is implemented with an MPU chipset, which includes a data path security verification (DPSV) program 836. The DPSV 836 is on the modem's data path as shown. For example, the DPSV function is fairly simple: DPSV 836 only passes data path information that has been processed and acknowledged by DDR processor 114. The DPSV 836 is directed to the DDR processor 114 so that it knows the secret session key of the DDR processor data path and can receive an acknowledgment from the DDR processor 114. The DDR processor 114 binds a secure data path channel to the DPSV 836 and the DPSV 836 provides various techniques herein to ensure that all 3G or 4G modem network service usage is monitored and processed accordingly.

  Referring to APU SEE 810, program signature verifier 820, non-volatile memory I / O 822, and secure execution bootloader updater 824, as also described herein with respect to various embodiments. APU SEE 810 also includes DDR secure execution memory 812. The DDR secure execution memory 812, as shown, monitors the data path through the OS stack data path interface 816 and the modem data path interface 818 for data path communication to the modem bus 818 via the modem bus driver 826. including. The DDR secure execution memory 812 also includes a DDR processor mailbox interface that provides DDR mailbox data 810 from the DDR processor 114 to the service processor application program 112, as shown and described herein. Similarly, DPSV 836 uses DPSV mailbox interface 842 as a communication channel to authenticate DDR processor 114 and establishes a secret session key to be used for message integrity checks between the two. Various techniques for implementing security binding between the DDR processor 114 and the DPSV 836 are described herein.

  In some embodiments, the DDR processor is executed in a secure environment in an APU-based embodiment, as described above with respect to the APU-based embodiment as well. In some embodiments, the secure environment ensures that DDR processor code cannot be replaced or changed without permission. In some embodiments, the secure environment further ensures that no code other than the DDR processor has the ability to access sensitive cryptographic storage such as keys. For example, this may include protecting confidential memory from debug monitors and / or other monitoring / access activities or techniques. As will be apparent to those skilled in the art, not only the DDR processor, but also the APU firmware must be secured and must not contain bugs or vulnerabilities that can be exploited to allow unauthorized access. For example, a common attack is a buffer overflow, where an attacker chooses an input that causes an unchecked buffer to exceed its limit, resulting in an unexpected behavior that can be exploited by the attacker.

  Similarly, in some embodiments, DPSV is implemented in a secure environment. In some embodiments, the secure environment ensures that DPSV code cannot be replaced or changed without permission. In some embodiments, the secure environment further ensures that code other than DPSV does not have the ability to access sensitive cryptographic storage such as keys. In some embodiments, the secure environment further ensures that any code does not have the proper cryptographic function of DPSV or the ability to interfere with communication between DPSV and DDR processor. For example, this may include protecting confidential memory from debug monitors and / or other monitoring / access activities or techniques. As will be apparent to those skilled in the art, not only DPSV, but also MPU firmware must be secured and must not contain bugs or vulnerabilities that can be exploited to allow unauthorized access. For example, a common attack is a buffer overflow, where an attacker chooses an input that causes an unchecked buffer to exceed its limit, resulting in an unexpected behavior that can be exploited by the attacker.

  In some embodiments, the APU includes a data path processor (DPP), which includes a DDR processor function that is secured with APU SEE as described herein. In some embodiments, the APU DPP also includes other service monitoring functions, control functions, and notification functions. In some embodiments, the modem includes a data path security verifier (DPSV) that secures the path between the APU DPP and the modem network data path so that only the DPP has other software, firmware, Even if the bus or port has access to the modem, it can be transmitted over the modem. In some embodiments, the modem DPSV is one of similar or other techniques apparent to those skilled in the art in view of the techniques described herein and / or the various embodiments described herein. Or more than one is directed to APU DPP. For example, APU DPP provides a secure data path to a modem network connection that cannot be circumvented by device software, firmware, buses, or ports. This can be a hardwired data path via a hardware design or a data path secured using a secure firmware or software execution environment of all data path elements below the APU DPP. The APU DPP and modem exchange public keys and / or digital certificates, then perform a key exchange process to authenticate each other so that the secret shared session key is used as the basis for the message integrity check Will be.

  When a secret shared session key is established between APU DPP and DSPV, APU DPP uses the session key to add an integrity check to each frame to be sent, and the modem uses the session key. Verify the integrity check. The modem allows transmission of only frames with a valid integrity check and blocks frames that do not contain a valid integrity check, which means that only frames processed by APU DPP are transmitted. . Similarly, the modem DPSV uses the session key to add an integrity check to each received frame, and the APU DPP uses the session before sending the frame to an upper layer (eg, application layer, etc.). Verify the integrity check.

  In some embodiments, the modem downstream data path message between DPSV and DPP is secured. In some embodiments, the APU DPP upstream message includes downstream sequence information so that the modem DPSV can confirm that the APU DPP has received all downstream packets and if not The modem DPSV can notify the APU DPP, service controller, and / or take measures such as access restrictions and / or other appropriate measures.

  In some embodiments, the APU DPP generates a secure DDR and communicates the secure DDR to the service controller in a sequenced and secure manner as described herein with respect to various embodiments.

  In some embodiments, the service processor application and / or service processor kernel program associates with which application which socket / flow belongs to which application (eg, with respect to application usage monitoring, billing, and / or control) The APU DPP knows which application is generating or receiving traffic, billing, traffic control, and / or user notification Supports application classification tags for policies.

  In some embodiments, the APU DPP performs various functions. In some embodiments, the APU DPP can perform DDR processor functions. The APU DPP can perform any or all of the service monitoring functions of the billing agent (CA) and / or policy decision agent (PDA). APU DPP can count all network traffic, and in some embodiments traffic by application and / or destination, NBS, date and time, active network, and / or various other criteria described herein. Classify. APU DPP can generate a billing record. The APU DPP can communicate a billing record to a service controller (eg, or another network billing function) and / or a device notification UI.

  In some embodiments, the APU DPP performs access controller functions. For example, the APU DPP can instruct the service processor application and / or kernel program to allow, block / kill, or background the application or destination. The service processor application and / or kernel program allows / blocks the application by manipulating application access to the network, by interrupting the application program boot / start sequence, or by pausing / resuming the application Or it can be backgrounded. The service processor application and / or kernel program can execute a suspend function (eg, Android activity manager and / or service manager function) by reprogramming or suspending an application management function in the OS. The APU DPP instructs the service processor application / kernel program to control the application and / or traffic, or directly controls traffic within the DPP. The APU DPP can perform the policy enforcement functions described herein with respect to various embodiments.

  In some embodiments, the APU DPP may perform NBS monitoring functions and / or reporting functions. For example, APU DPP can detect NBS, modem performance parameters, network assets included in the link, and / or geolocation information.

  In some embodiments, the APU DPP obtains network time from the network using a “secure” ping loop system and verifies that the network time stamp is not interrupted or delayed. For example, the APU DPP may have a reliable local clock, or may execute a ping loop each time a report is started and / or every time a report is stopped.

  Examples of secure execution environment (SEE) implementations in APU DDR processor and MPU DPSV embodiments include those described above with respect to various secure execution environment (SEE) implementations in APU embodiments. Specific examples are also listed below. Examples of commercially available APUs include: Solutions based on Intel Atom (eg, Z5xx, Z6xx, D4xx, D5xx series) using Intel Trusted Execution Technology with TPM support; and ARM Trusted Zone Architect Based solution. Examples of APU specification requirements may include common hardware security blocks (eg, AES, DES, RSA, Diffie-Hellman, SHA, and random generator). Examples of commercially available MPUs include: EVDO chipset based solutions (eg, ARM11 based CPU architectures including ARM Trusted Zone Architecture with many common hardware cryptographic blocks); HSPA chipset based solutions Solutions (eg, CPU architecture based on Snapdragon / ARM including ARM Trusted Zone Architecture with many common hardware cryptographic blocks); and solutions based on LTE chipset (eg ARM Trusted with many common hardware cryptographic blocks) CPU architecture based on Snapdragon / ARM including Zone Architecture).

  FIG. 9 illustrates the architecture of a secure embedded DDR processor and data path security verifier (DPSV) in a subscriber identity module (SIM) in an MPU implementation according to some embodiments. In particular, as shown in FIG. 9, DDR processor 114 is embedded in SIMSEE 918 and data path security verifier (DPSV) 936 is embedded in MPU chipset SEE 932 (eg, 3G or 4G MPU chipset SEE). Data communication from the APU as described herein, including the mailbox function, uses the SIM bus driver 911 and communicates using the modem SIM bus 912 as shown.

  As shown in FIG. 9, the first SEE 918 is implemented in the SIM 913, which uses the OS stack data path interface 924 and / or the modem data path interface 926, as also described herein. A DDR processor 114 that securely monitors communications from the modem SIM bus 912 to the SIM bus driver 916. Mailbox functionality is similarly provided as described herein using DDR processor mailbox interface 922, DDR mailbox data 914, and DDR mailbox data 910, as shown.

  As also shown in FIG. 9, the data path communication to the 3G / 4G modem bus driver 934, 3G / 4G modem data path and signal processing element 938 via the modem SIM bus 913 is as described herein. Monitored using modem SIM data security verifier 936. The modem SIM data security verifier 936 is implemented in the modem chipset SEE932 of the modem chipset / MPU 930 as shown. In addition, there is a DPSV mailbox 842 that provides a communication channel to the APU, and the final destination is a DDR processor in the SIM that performs authentication and verification of the secret session key to be used as the basis for the message integrity check.

  In some embodiments, the SIM includes a data path processor (DPP) that embeds a DDR function that is secured within the SIM SEE. For example, SIM DPP can also include other service monitoring, control, and notification functions. In some embodiments, the modem can communicate with the SIM DPP and the modem network data path so that only DPP can be transmitted over the modem if other software, firmware, buses, or ports have access to the modem. A data path security verifier (DPSV) that secures the path between them.

  In some embodiments, the modem DPSV is directed to the SIM DPP by similar or other techniques that will be apparent to those skilled in the art in view of the following techniques and / or various embodiments described herein.

  For example, SIM DPP can be provided in a secured data path to a modem network connection that can be avoided by device software, firmware, bus, or port. The secured data path may be a hardwired data path through hardware design, or the data path may be secured using secure firmware or software execution environment to all data path elements below the SIM DPP. Also good. In some embodiments, communication between DPSV 936 and DDR processor 114 is secured using various secure communication techniques as described herein. In some embodiments, the DPSV has a unique private / public key pair and a digital certificate (cert) that proves the authenticity of the public key. The DDR processor has a unique private / public key pair and a digital certificate (cert) that proves the authenticity of the public key. The DPSV and DDR processors exchange the public key and cert, then perform a key exchange process that authenticates each other, resulting in a secret shared session key being generated. The DDR processor receives the upstream network data flow from the device OS networking stack, adds the integrity check to each upstream data message using the session key and sends it to the DPSV. The DPSV blocks any upstream data path information that does not have a valid integrity check from the DDR processor and informs the DDR processor that it is receiving invalid upstream data so that the DDR processor The service controller may be notified of a possible fraud event. The DPSV receives the downstream network data flow and uses the session key to add an integrity check to each downstream data message and send it to the DDR processor. Each downstream data message is, for example, sequenced so that the data message cannot be blocked or played back without being detected by the DDR processor. If the DDR processor receives a downstream data message with an invalid integrity check, it rejects the message and notifies the service controller of a possible fraud event. The DDR processor acknowledges each unrejected downstream data message in the next upstream data message to send to the DPSV. If the DPSV stops receiving the downstream data message acknowledgment, it will block the downstream network data flow and notify the DDR processor so that the DDR processor can notify the service controller of a possible fraud event. The DDR processor securely sends the DDR report to the service controller by the service processor as described herein with respect to various embodiments.

  In some embodiments, the modem downstream data path messages between DPSV and DPP are sequenced. In some embodiments, the SIM DPP upstream message includes downstream sequence information so that the modem DPSV can confirm that the SIM DPP has received all downstream packets and has received all downstream packets. If not, the modem DPSV can notify the SIM DPP, the service controller, and / or take measures such as access restriction or another appropriate measure.

  In some embodiments, the SIM-MPU interface is a physical interface (eg, a bus). In some embodiments, the SIM-MPU interface is a logical interface (eg, via untrusted APU). In some embodiments, the SIM is a logically independent security hardware module (eg, in a secure execution environment) embedded in any device processing element (eg, SIM, video processor, audio processor, display processor, etc.). Part).

  In some embodiments, SIM and MPU exchanges include several components. In some embodiments, each MPU and SIM has its own public / private encryption key along with the certificate. In some embodiments, the MPU and SIM exchange keys using a key exchange protocol. In some embodiments, this key exchange occurs over the physical bus between the MPU and the SIM. In some embodiments, this key exchange occurs over a logical bus (eg, via an untrusted APU). Such key exchange protocols are well known in the art and will not be described herein. In some embodiments, the MPU and SIM establish a shared session key after authenticating each other with a certificate. In some embodiments, the MPU and SIM initialize the transmit count value to zero, initialize the receive count value to zero, initialize the maximum transmit count value to integer N, and initialize the maximum receive count value to integer M. Turn into. In some embodiments, the values of M and N are the same. In some embodiments, the values of M and N are implementation dependent and can be determined based on the MPU transmit and receive packet processing capabilities. For example, by choosing 3 for M and 2 for N, the SIM block is expected to obtain an ACK frame from the MPU before receiving 4 packets and before sending 3 packets, otherwise , The SIM concludes that fraud has occurred and notifies the network element.

  In some embodiments, the MPU sends only the relevant portion of the transmission frame to the SIM for each output packet, reducing SIM processing requirements. In some embodiments, the relevant portion of the transmission frame includes a header, a transmission count, and an integrity check. In some embodiments, the header includes information such as one or more of a source address, a destination address, a source port, a destination port, a protocol tag, and a packet length in bytes. In some embodiments, the transmission count counts transmitted frames and increments every transmission frame. In some embodiments, the integrity check is determined by hashing one or more of the session key, header, and transmission count.

  In some embodiments, the MPU also sends only the relevant portion of the received frame to the SIM for each incoming packet. In some embodiments, the relevant portion of the received frame includes a header, a reception count, and an integrity check. In some embodiments, the header is the same as the header of the transmission frame (eg, one or more of a source address, a destination address, a source port, a destination port, a protocol tag, and a packet length in bytes). It is. In some embodiments, the receive count is incremented each time a frame is received. In some embodiments, the integrity check is determined by hashing one or more of the session key, header, and transmission count.

  In some embodiments, the frame acknowledgment (eg, ACK) is the sum of the maximum transmission count, the maximum reception count, and the integrity check. In some embodiments, the maximum transmission count is set to (transmission count + N), and the transmission count is the transmission count from the most recent transmission frame. In some embodiments, the maximum reception count is set to (reception count + M), and the reception count is the reception count from the latest received frame. In some embodiments, the integrity check is determined by hashing one or more of the session key, the maximum transmission count, and the maximum reception count.

  In some embodiments, the MPU-SIM interface is a logical channel (eg, via untrusted APU). In some embodiments, on the sending side, the APU sends a SIM to the SIM one of a transmission frame header (e.g., source address, destination address, source port, destination port, protocol tag, and packet length in bytes or Send multiple) only. In some embodiments, the SIM returns a transmission count, maximum reception count (eg, reception count + M), and integrity check to the APU. In some embodiments, the SIM increments the value of the transmission count every transmission frame. In some embodiments, the SIM determines the integrity check by hashing one or more session keys, headers, transmission frame counts, and maximum reception counts. In some embodiments, the APU adds the header and frame body to the SIM carrier transmit count, maximum receive count, and integrity check and sends the result to the MPU. In some embodiments, the MPU sends only one frame at a time that passes the integrity check. In such embodiments, the MPU may not use a maximum transmission count.

  In some embodiments, the MPU-SIM interface is a logical channel (eg, via untrusted APU). In some embodiments, on the receiving side, the MPU sends a header to the APU (eg, one or more of a source address, destination address, source port, destination port, protocol tag, and packet length in bytes). Send the reception count, integrity check, and frame body. In some embodiments, the reception count is incremented for each received packet. In some embodiments, it is determined by hashing one or more of the session key, header, and reception count. In some embodiments, the APU is a header (eg, one or more of a source address, a destination address, a source port, a destination port, a protocol tag, and a packet length in bytes), a reception count, and integrity. Send only sex check to SIM. In some embodiments, the MPU may process more than one received frame before obtaining SIM configuration feedback. In some embodiments, a SIM ACK frame (eg, an indication of the maximum reception count) is piggybacked into the frame as described herein.

  In some embodiments, the MPU sends the entire data frame to the SIM, which adds an integrity check to be verified at the sending and receiving sides. In some embodiments, the DSPV engine adds an integrity check to the data frame and sends it to the SIM. In such an embodiment, the SIM interface with the APU and the SIM (DDR processor) are in the middle of the data exchange.

  In some embodiments, in each transmission frame, the MPU increments the transmission count and compares the value with the value of the maximum transmission count obtained from the latest frame acknowledgment. In some embodiments, if the transmission count is greater than the maximum transmission count, the MPU determines that the SIM has not received valid transmission frame data. In some embodiments, the MPU notifies the network element (eg, a trusted entity such as a service controller) that a fraud has occurred after determining that the SIM has not received valid transmission frame data.

  In some embodiments, if the MPU detects an invalid integrity check in the frame acknowledgment, or if the SIM detects an invalid integrity check in the transmitted frame, the MPU or SIM performs malicious behavior. It is judged that In some embodiments, if the MPU or SIM determines that a malicious behavior is taking place, it notifies a network element (eg, a trusted entity such as a service controller) that the fraud has taken place. . In some embodiments, if the MPU or SIM does not determine that the malicious behavior is taking place, the SIM updates the DDR data collection using the header from the transmitted frame and sends the result to the network element. Report.

  In some embodiments, at each received frame, the MPU increments the receive count and compares the value with the value of the maximum receive count obtained from the latest frame acknowledgment. In some embodiments, if the reception count is greater than the maximum reception count, the MPU determines that the SIM has not received valid received frame data. In some embodiments, the MPU notifies the network element (eg, a trusted entity such as a service controller) that a fraud has occurred after determining that the SIM has not received valid received frame data.

  In some embodiments, if the MPU detects an invalid integrity check in the frame acknowledgment, or if the SIM detects an invalid integrity check in the received frame, the MPU or SIM performs malicious behavior. It is judged that In some embodiments, if the MPU or SIM determines that a malicious behavior is taking place, it notifies a network element (eg, a trusted entity such as a service controller) that the fraud has taken place. . In some embodiments, if the MPU or SIM does not determine that the malicious behavior is taking place, the SIM updates the DDR data collection using the header from the received frame and sends the result to the network element. Report.

  In some embodiments, the SIM DPP generates a secure DDR and is securely sequenced as described herein for various embodiments to securely communicate the secure DDR to the service controller.

  In some embodiments, the service processor application and / or service processor kernel program informs the SIM DPP which sockets / flows belong to which application, so that the SIM DPP may And generating application classification tags for billing, traffic control, and / or notification policies.

  In some embodiments, the SIM DPP performs various functions as described herein. For example, SIM DPP can perform DDR processor functions. The SIM DPP can perform any or all of the service monitoring functions of the billing agent (CA) and / or policy decision agent (PDA). SIM DPP can count all network traffic and in some cases classify traffic by application and / or destination, NBS, date and time (TOD), active network, and / or various other criteria. The SIM DPP can generate a billing record. The SIM DPP can communicate a billing record to a service controller (eg, or another network billing function) and / or a device notification UI.

  As another example, the SIM DPP can perform various access controller functions. The SIM DPP can instruct the service processor application and / or kernel program to allow, block / kill, or background the application or destination. Service processor applications and / or kernel programs allow and block applications by manipulating application access to the network, by interrupting the application program boot / start sequence, or by pausing / resuming applications / Kill, or background. The service processor application and / or kernel program can execute a suspend function (eg, Android activity manager and / or service manager function) by reprogramming or suspending an application management function in the OS. As an example, the SIM DPP instructs the service processor application / kernel program to control the application and / or traffic, or directly controls the traffic within the DPP. The SIM DPP can also perform the policy enforcement functions described herein.

  As yet another example, the SIM DPP may perform NBS monitoring functions and / or reporting functions. The SIM DPP can detect NBS, modem performance parameters, network assets included in the link, and / or geolocation information.

  As a further example, SIM DPP obtains network time from the network using a “secure” ping loop system and verifies that the network time stamp is not interrupted or delayed. For example, the SIM DPP may have a reliable local clock or may execute a ping loop each time a report is started and / or every time a report is stopped.

  FIG. 10 illustrates another architecture of a secure embedded DDR processor and data path security verifier (DPSV) in a subscriber identity module (SIM), according to some embodiments. In some applications, it may be desirable to place the DDR processor on a stand-alone chipset that is attached to an APU or MPU chipset, such as a SIM card. FIG. 10 illustrates such an implementation according to some embodiments. For example, an embedded DDR processor can be implemented on a smartphone APU chipset in combination with a data path security verifier (DPSV) implemented on a 3G or 4G wireless modem chipset.

  In some embodiments, as shown in FIG. 10, a hardware or firmware secure data path between the DDR processor and the modem DPSV is not required, in which case the DDR processor provides the data path logical channel transfer function to the APU. Implemented in a SIM card (eg, or another stand-alone security chipset) by providing mailbox data communication functions between the service controller and the DDR processor and connecting via the SIM data bus The Furthermore, the DDR processor report to the service controller can be secured without any system elements on the APU being secured by the hardware assisted secure execution environment (SEE).

  Referring to FIG. 10, secure DDR processor 114 is located in DDR secure execution memory 1042 of SIM secure execution environment 1040 on the SIM as shown, as also described above with respect to FIG. The APU architecture is shown with respect to FIG. 9 except that an APU SIM to the modem bus transfer function 1012 and APU bus driver function 1014 is added to the APU of the APU chipset kernel program 1004 as shown in FIG. And is similar to the architecture described above. Secure DPSV 1026 is located in modem modem chipset 1024 and uses 3G / 4G modem data path and signal processing element 1028 to monitor communications from 3G / 4G modem bus driver as described above with respect to FIG. To do. However, in FIG. 10 as compared to FIG. 9, the MPU and SIM are separate hardware or chipsets that communicate with the APU via independent communication buses. In particular, the MPU communicates with the APU via the modem bus 1018 using the 3G / 4G modem bus driver 1022, the APU modem bus driver 1014, and the APU SIM 1012 to the modem bus transfer function, as shown. The SIM communicates with the APU using the SIM bus driver 1032 and SIM bus driver 1010 via the SIM bus 1016 as shown. The DPSV authenticates the DDR processor 114 in the SIM using the DPSV mailbox 842 as a communication channel and the connection is established in the APU. As shown, the APU has two communication channels: a first communication channel with a DDR processor and a second communication channel with DPSV.

  In some embodiments, a first logical communication channel is created via the SIM bus 1016 between the service processor DDR mailbox 910 on the APU and the DDR mailbox 1034 on the SIM, which is shown. As such, the communication between the service processor (eg, service processor application program 112 and / or service processor kernel program 113) and DDR processor 114 is communicated to DDR processor mailbox interface 1044, DDR mailbox data 1034, SIM bus driver 1032. Use to support. A second logical data channel is created via the SIM bus 1016 between the OS networking stack and the DDR processor 114, which uses the OS stack path interface 1046, the SIM bus driver 1032 as also shown. Thus, a logical channel intended for all OS networking stack communications with 3G or 4G networks. A third logical communication channel is created between the SIM DDR processor 114 and the modem DPSV 1026. This third logical communication channel includes a SIM bus interface (eg, a modem data path interface 1048 to the SIM bus driver 1032) located on the SIM and a SIM bus located on the APU, as also shown. It is formed by transferring data between the driver 1010, the shim-to-modem bus transfer function 1012 arranged in the APU, the modem bus driver 1014 arranged in the APU, and the modem bus interface 1022 arranged in the modem. .

  In some embodiments, communication between DPSV 1026 and DDR processor 114 is secured using various secure communication techniques as described herein. In some embodiments, the DPSV has a unique private / public key pair and a digital certificate (cert) that proves the authenticity of the public key. The DDR processor has a unique private / public key pair and a digital certificate (cert) that proves the authenticity of the public key. The DPSV and DDR processors exchange the public key and cert, and then perform a key exchange process that authenticates each other and generates a secret shared session key. The DDR processor receives the upstream network data flow from the device OS networking stack, adds the integrity check to each upstream data message using the session key and sends it to the DPSV. The DPSV blocks any upstream data path information that does not have a valid integrity check from the DDR processor and informs the DDR processor that it is receiving invalid upstream data so that the DDR processor The service controller may be notified of a possible fraud event. The DPSV receives the downstream network data flow and uses the session key to add an integrity check to each downstream data message and send it to the DDR processor. Each downstream data message is, for example, sequenced so that the data message cannot be blocked or played back without being detected by the DDR processor. If the DDR processor receives a downstream data message with an invalid integrity check, it rejects the message and notifies the service controller of a possible fraud event. The DDR processor acknowledges each unrejected downstream data message in the next upstream data message and sends it to the DPSV. If the DPSV stops receiving the downstream data message acknowledgment, it will block the downstream network data flow and notify the DDR processor so that the DDR processor can notify the service controller of a possible fraud event. The DDR processor securely sends the DDR report to the service controller by the service processor as described herein with respect to various embodiments.

  In some embodiments, the DDR sent from the DDR processor to the service controller is integrity checked and sequenced so that it cannot be tampered with or replayed. An authentication process between the DDR processor and service controller combined with a unique DDR report sequence identifier and a set of authentication session keep-alive timers is used to maintain and verify a secure connection between the DDR processor and the service controller. When the secure session or DDR record flow between the DDR processor and the service controller is interrupted, the access control function in the DDR processor securely authenticates the access of the 3G or 4G modem data path between the DDR and the service controller. Restrict network destinations needed to re-establish established sessions.

  FIG. 11 illustrates another architecture of a secure embedded DDR processor and data path security verifier (DPSV) in a subscriber identity module (SIM) in an MPU implementation, according to some embodiments. FIG. 11 is similar to FIG. 9 except that the SIM data path interface 1110 is provided to communicate directly with the 3G or 4G modem bus driver 934 on the MPU from the SIM, as shown. SIM communication as also described herein with respect to an APU that includes a mailbox function uses a SIM data path interface 1110, 3G or 4G modem bus driver 934 using a modem bus 1112 as shown. Communicate with the modem bus driver 911 and the APU stack interface of the 3G or 4G modem 906.

  In some embodiments, various other architectures, including various other locations of the DDR processor, may be used as will be apparent to those skilled in the art in view of the embodiments described herein. Can be provided using techniques.

  In some embodiments, various other architectures, including DDR processors and / or other various locations of DPSV, will now be apparent to those skilled in the art in view of the embodiments described herein, These and similar techniques can be used to provide.

  For example, the DDR processor (eg, and / or various securing elements of the service processor) may be located in various other locations (eg, various secure operating environments) including network access policy enforcement at a higher level of the network stack. can do. In particular, certain functions performed by the service processor without hardware security can be located in the hardware secured execution memory. Such functions may include 3G and 4G network data path processing and usage reporting functions, 3G and 4G network application access management and usage reporting functions, and 3G and 4G service user notification and customer activity status functions.

  FIG. 16 illustrates an embodiment where the secure execution environment (referred to as data path security zone 140 or SEE in FIG. 16) includes a secure service processor element 1604. FIG. 16 shows various device I / O ports numbered # 1- # N (for example, perhaps 2G, 3G, 4G, WiFi, Ethernet, USB, Firewire, Bluetooth, and NFC, Several I / O modems 250 are shown. The modem bus driver / physical layer bus 142 is located in the secure execution environment (data path security zone 140), so that the secure execution environment includes the secure service processor element 1604 and the secure service processor element 1604 and the device I / O port. Protect the data path. In some embodiments, the secure service processor element 1604 includes policy enforcement, I / O port communication activity monitoring and reporting, I / O port communication control or traffic control, application activity monitoring, application control, application access control or traffic control. A malicious or unauthorized user including, but not limited to, secure service processor elements responsible for network destination monitoring and reporting, network destination access control or traffic control, and device environment monitoring and integrity verification It includes the portion of the service processor that it is desired to protect against tampering or configuration changes. The network stack 136 is also shown in FIG. 16 in a secure execution environment, but generally the data path below the monitoring point of the secure service processor element 1604 and the I / O modem 250 is secured (eg, illegal data Not all network stack functions need to be implemented in a secure execution environment (unless path access is available or not allowed). In the embodiment shown in FIG. 16, secure service processor element 1604 interacts with network stack 136 to implement the various I / O port activity monitoring and control functions described herein. A non-secure service processor element 1602 is also included, but is not limited to user interface elements.

  In some embodiments, using a secure execution environment partitioning technique, a large portion or the entire service processor function is implemented in a hardware secured execution environment within an APU or MPU. In some embodiments, using secure CPU partitioning technology, a large portion or the entire service processor function is implemented in a hardware secured execution environment within an APU or MPU. As an example embodiment, service processor functions that can be executed in a secure execution environment include 2G, 3G, or 4G networks (and / or other I / O ports such as Ethernet, WiFi, USB, Firewire, Bluetooth, or NFC). Policy enforcement operations in accordance with a policy instruction set stored in a secure execution environment, such as one or more management policies), which includes application access management, application traffic processing, application access monitoring and reporting. Or application access service accounting and reporting. As another example embodiment, a secure service processor element function that is executable within a secure execution environment includes a management policy for one or more applications, and the policy is configured to execute an application according to a policy instruction set stored in the secure execution environment. Specify whether to block, allow, or throttling. As another example embodiment, a secure service processor element function executable in a secure execution environment includes a management policy for one or more applications, the policy may include application activity monitoring and reporting or operating environment monitoring and reporting (eg, , Monitoring the security status or the presence of malware in the device operating environment). As another example embodiment, a secure service processor element function executable within a secure execution environment may include a website, domain, URL, IP and / or TCP address, server name, other device, or content source. One or more possible network destination or resource management policies, including access management, traffic control, access monitoring or access service accounting. As another example embodiment, a secure service processor element function executable in a secure execution environment includes a management policy for one or more roaming access networks. As another example embodiment, secure service processor element functionality executable in a secure execution environment includes one or more of one or more of 2G, 3G, 4G, and / or other I / O ports. Includes communication activity monitoring and reporting on device I / O connections. In some embodiments, secure service processor element functions executable in a secure execution environment include one or more of one or more 2G, 3G, 4G, and / or other I / O ports. Includes monitoring, classification (eg, identification of applications and / or network destinations associated with I / O port activity), and reporting on one or more device I / O connections. In some embodiments, a service controller located in a network communicates a policy instruction set stored in a secure execution environment to a secure service processor element via a secure communication link as described herein. Provided by. In some embodiments, these policy enforcement actions, including reporting, can be performed by a service that places the report in a network via a secure communication link to a secure execution environment as described herein for further processing of the report. Transmitting to the controller. In some embodiments, sending the report to the service controller located in the network via a secure communication link to the secure execution environment includes an authenticated secure sequencing and receiving protocol as described herein. be able to.

  As another example embodiment, a secure service processor element function executable in a secure execution environment (i) identifies traffic associated with a particular application or group of applications and identifies 2G, 3G, and 4G application access policies (eg, One or more, such as, allow, block, throttling, postpone to send later, applying a given QoS level) or service usage accounting (and / or Ethernet, WiFi, USB, Firewire, Bluetooth, or NFC) A secure application manager that differentially manages one or more of (accounting for application access by other I / O ports), and (ii) identifying when an application is attempted to run in an application policy set (Iii) 3G and 4G application access (and / or according to the network access policy set by the service controller and the network busy state specified by the device) Or a secure application manager that differentially manages application access or service usage accounting for one or more other I / O ports), and (iv) application identifier, layer 7 destination, layer 3/4 destination, and network busy One or more of 3G and 4G network traffic classified and processed according to the state may be included. In some embodiments, securing such service processor functions comprises (i) various operating environment techniques disclosed herein in a secure execution environment, whereby the service processor is at a lower level. Achieves the same degree of protection from hacking and malware as described for stack processing (eg, DDR processor SEE embodiments described herein), and (ii) DDR processor (eg, and / or service processor element) and modem Protect or secure the data path with the antenna connection from tampering or tampering by device malware, and (iii) provide sufficient secure or protected memory to perform more advanced data path processing functions By providing a secure execution environment CPU cycle It is possible.

  In some embodiments, secure communication between a network-based service controller operating in a secure execution environment of a device connected to a wide area access network and the device-based secure service processor element may include one or more I / Os. Secure (in I / O ports including, but not limited to 2G, 3G, 4G, Ethernet, WiFi, USB, Firewire, Bluetooth, or NFC) secure service processor element I / O activity monitor record secure ( (Or reliable) transport, secure communication includes a secure message receipt feedback loop. In some embodiments, if the secure message feedback loop is prevented, a secure service processor element secure communication channel error condition is detected and countermeasures are taken. In some embodiments, an ordered sequence of secure service processor element I / O activity reports is communicated to the service controller using a signed or encrypted communication channel to prevent the ordered sequence, or If tampered, a device secure service processor element secure communication channel error situation is detected and countermeasures are taken. In some embodiments, the service controller observes the integrity of the ordered sequence of secure service processor element I / O activity reports to determine whether device data records have been tampered with or omitted. . In some embodiments, if the secure service processor element determines that the I / O activity monitor record has not been tampered with or omitted, the service controller may receive a signed or encrypted I / O activity monitor record receipt. Return the message. In some embodiments, if the secure service processor element determines that the I / O activity monitor record has been tampered with or omitted, the service controller returns an error message or is signed or encrypted. I / O activity monitor record receipt message is not returned. In some embodiments, the secure service processor element receives an error message from the service controller, or receives a signed or encrypted I / O activity monitor record receipt message within a specific time period, or a specific number of If it is not received in the transmission I / O activity monitor record, or while a certain amount of communication information is processed, a (i) device configuration error message is generated and sent to the security administrator or server and / or (ii) ) One or more of the wireless network connection or other I / O connections or ports of the wireless communication device are blocked or restricted to a predetermined set of safe destinations. In this way, the device secure service processor element, device operating environment, device operating system, or device software generates a wireless network or other I / O port access service usage feature that does not comply with the expected policy or authorization policy. Device tampering messages can be generated, or device wireless network access or other I / O connection access can be restricted or blocked. Such embodiments may be useful in securing device-based network access (or I / O control) policies, identifying device software that is tampered with or any malware present on the device. It can also be useful in doing so. In some embodiments, wireless network access or other I / O access is for access to a limited number of network destinations or resources sufficient to allow further analysis or troubleshooting of device configuration error conditions. Limited.

  In some embodiments, a secure service processor element that executes in a secure execution environment and communicates with a service controller via a secure communication link that includes a secure message receipt feedback loop may be used for device application and / or I / O port activity. Observe and generate one or more of the following device activity reports: service usage report, service usage report including service usage classification, application service usage report, network destination service usage report, service usage including network type identifier Report, service usage report including location identifier, application access monitoring report, application access service accounting report, application activity monitoring report, Operating environment monitoring report.

  In some embodiments, a secure service processor element that executes in a secure execution environment and communicates with a service controller via a secure communication link that includes a secure message receipt feedback loop may be used for device application and / or I / O port activity. Observe and generate roaming network service usage reports.

  In some embodiments, the service controller observes a secure service processor element I / O activity record to determine whether the device complies with service controller policy conditions. In some embodiments, determining whether the device is compliant with service controller policy conditions includes verifying that the device secure service processor element is enforcing the device policy accordingly. In some embodiments, the device policy that is verified is a network access service policy enforcement set. In some embodiments, the device policy to be verified is one or more policy sets of network access control or traffic control, network application control, network destination control, network charge accounting or accounting, and network service usage notification. A network access service policy enforcement set including a network access service plan policy enforcement set. In some embodiments, the device policy that is verified is whether the device application activity follows a predetermined policy set (e.g., all allowed applications accessing the network or other I / O ports). Or whether the application accessing the network or other I / O port is behaving according to the expected policy behavior). In some embodiments, device policy verification includes whether the device is accessing an approved network or an unapproved network. In some embodiments, device policy verification is performed when the device is communicating with specified content through one or more authorized wireless connections or other I / O ports, or is not authorized 1 Or in communication with specified content via one or more wireless networks or I / O ports. In some embodiments, device policy verification is whether the device is communicating with specified content over a secure link that is authorized via one or more wireless connections or other I / O ports. Or in communication with specified content via a non-secure link. In some embodiments, device policy validation includes whether the device is communicating from an authorized location or from an unauthorized location. In some embodiments, the device policy verification includes whether the device operating environment monitoring report indicates that the device operating environment is free of any malicious software or erroneous operating conditions.

  In some embodiments, the secure service processor element 1604 is implemented in a secure execution environment (data path security zone 140) located on a SIM card. The various embodiments described in connection with FIGS. 9, 10, and 11 and the associated disclosure simply replace DDR processor 114 with a secure service processor element, as will be appreciated by those skilled in the art. Utilizing the description of the form helps to implement the secure service processor element 1604 on the SIM card. This allows for advanced device wide area network access control or billing functionality implemented with SIM cards that can be controlled and distributed by the network operator, as described in the context of various secure service processor element embodiments. .

  Thus, additional embodiments of various aspects of DDR processor functional operation are provided.

DDR Firmware Installation, Security Credential Configuration, and Update FIG. 12 illustrates a secure boot sequence flow diagram according to some embodiments. In some embodiments, once reset and / or powered on at 1202, the system (eg, APU, SIM, and / or MPU, DDR is embedded in the wireless communication device) 1204. , By performing a secure boot (eg, executing a secure boot code). As part of Secure Boot, initialization routines are executed to configure system parameters (eg, configure registers to ensure secure areas such as HW / firmware firewall memory), and to configure secure / normal area boundaries and interfaces. Establish. The secure boot code also has access to the root of trust hidden in all other firmware / software. At 1206, a public key certificate verification step is performed, and secure boot downloads and verifies its own public key (eg, using a hash technique), and then at 1206, all secure code is published. Download the key. At 1208, secure boot proceeds to download and verify / verify the digital signature of any secure software package (e.g., including a DDR processor including a DDR generator) before allowing normal software routines to be downloaded. . For example, this can be done using a chain of trust with a root of trust as a scaffold. At 1210, secure boot determines whether all signatures have been verified as appropriate. If any digital signature fails, the secure boot is reset as shown at 1202, as shown at 1212 (eg, the watchdog timer expires) and / or the platform has a new image. Keep idle and loop until you get 100 million. If all digital signatures are verified as appropriate, secure boot proceeds to other downloads (eg, including applications) at 1214. Proceeding to normal operation, secure boot is complete at 1216. At 1218, it is determined whether there is a new image. If not, normal operation continues at 1216. If a new secure software image is downloaded (for example, the image is stored in a new area of flash memory with the “secure” flag set), the system returns to the reset state, causing Secure Boot to load the new image. Before the new image becomes the current image (eg, based on a flag), the digital signature of the image is verified.

Mailbox Communication Channel Between Service Processor and DDR Processor FIG. 13 illustrates a functional diagram for passing a DDR service processor mailbox message between a secure memory area and a non-secure memory area, according to some embodiments. In some embodiments, a logical communication channel is provided between DDR processor 1314 and service processor 1312 to send a secure DDR message (eg, a DDR message handle) to a service controller (eg, a service processor communication agent). Through). In some embodiments, this logical communication channel is referred to as a DDR mailbox data functional element / block in the various embodiments described herein. For example, to facilitate implementation, it may be assumed that a DDR processor does not have its own IP address and can therefore only send messages to the service controller through the service processor using this logical channel. it can. The logical channel can be based on a shared memory (eg, normal region) architecture shown as normal region shared memory 1310. As described herein with respect to various embodiments, the DDR message is encrypted and can only be decrypted by the service controller. This logical channel can also be used by the service controller to send new DDR software updates.

  In some embodiments where the DDR processor is located on the APU, the APU's direct memory access (DMA) engine can be used to access the shared memory via both the service processor and the DDR processor.

  In some embodiments where the DDR processor is located in the MPU, a modem interface is provided to support additional logical channels (eg, 2G / 3G / 4G USB endpoints) to meet this requirement. In some embodiments, the logical channel is piggybacked on top of the existing configuration and a status channel that provides a control channel between the APU and the MPU.

DDR Processor Record Generator In some embodiments, the duration of the DDR report is a measurement period. The measurement period is generally continuous, meaning that the next period starts immediately after the end of the current period and there is no traffic between the periods. At the start of the period, all previous DDRs are deleted. During the period, each observed IP flow creates an entry in the table, so the DDR table grows. If the DDR store exceeds a predefined threshold or if a DDR report is requested by the service processor, the period ends. DDR data that has not yet been transmitted to the service processor application remains in memory for the power cycle and battery pull.

  In some embodiments, at the end of the measurement period, a DDR report is prepared by the DDR processor and sent to the service processor. For example, various secure communications and / or encryption techniques are used to ensure that the report content is kept private and that much tampering of the DDR report is detected by the service controller. can do.

  In some embodiments, the report also includes a time stamp that identifies the start and end of the measurement period. The time stamp is calibrated and verified through periodic handshaking with the service controller to ensure that the DDR processor time base has not changed. Data compression can be used to minimize the size of the report.

  In some embodiments, each DDR report message includes a unique sequence identifier that allows the service controller to determine whether any DDR has been blocked from the sequence. The report is stored by the service processor and subsequently transferred to the service controller. Data stored by the service processor remains in memory across power cycles and battery pulls.

  In some embodiments, the DDR processor resides on the modem and a secure DDR usage report is then sent to the service processor (eg, a communication agent within the service processor) and sent to the service controller.

DDR Processor Access Controller FIG. 14 illustrates a DDR processor service controller session authentication and verification flow diagram according to some embodiments. In some embodiments, when the DDR processor is reset and / or powered on, an access control function such as an access controller restricts network access (eg, a small number including certain carrier / wireless service provider services). (For preconfigured IP addresses and / or hostnames only).

  In some embodiments, the access controller ensures that the service processor sends the DDR correctly to the service controller. If the DDR flow is blocked or tampered, the access controller blocks cellular (eg, managed WiFi) wireless network access until the proper flow of DDR is restored. In some embodiments, network access restrictions apply only to network access maintained and managed by a network operator. For example, this feature can be disabled for WiFi access that is not managed by a network operator.

  In some embodiments, the access controller obtains feedback from the service controller when the modem is authenticated via AAA (eg, via a PPP session) after initial power-up and / or recovery from power savings. And limited to restricted network access until open access is granted (eg, based on IP address / hostname set and / or other criteria). While traffic is flowing and the DDR processor is sending DDR records / reports, it always expects to receive a secure DDR ACK frame to allow open access, otherwise it goes back into restricted access.

  Referring now to FIG. 14, when reset and / or initially powered up or powered after a power save mode, the process begins as indicated at 1402. At 1404, the access controller restricts network access to a limited stream (eg, preconfigured or configured in a secure region. At 1406, the access controller waits for feedback to release network access from the service controller. At 1408, it is determined whether feedback has been received from the service controller, otherwise, the process returns to 1406 and continues to wait for feedback from the service controller. If the secure service controller feedback is verified and / or verified as appropriate (as described in the document), at 1410 the access controller releases the network access. Then, the transmission of the DDR report is started, and it is determined in 1412 whether a DDR ACK frame has been received in response to such a DDR report. If access is restricted: If a DDR ACK frame is received (eg, and the secured DDR ACK frame is verified and / or verified as appropriate, as described herein), at 1414 the access controller Continue to maintain open network access and send DDR reports.

DDR Processor Network Busy Status (NBS) Monitor In some embodiments, the Network Busy Status (NBS) monitor may be configured for network busy status (e.g., for storage, network congestion analysis, and / or service billing and control policy security). Or a secure firmware program element in the DDR processor that monitors, records and / or reports securely to the service controller. For example, the NBS monitor may perform one or more of the following functions within the SEE: active network information (eg, active network type, home / roaming, current carrier, base station, and / or base Station sector) recording, network access attempts and success monitoring, network speed monitoring, round trip time delay monitoring, packet error rate monitoring, modem performance parameter monitoring (eg, RF channel, RF signal strength and variability, SNR) , Raw modem bit rate, raw modem bit error rate, and / or channel bandwidth), implementation of algorithms to classify network busy conditions, and network busy condition history reporting in DDR.

Bind and secure secure communication channel between DDR processor and service controller In some embodiments, secure communication channel bind and secure between DDR processor and service controller is provided as described below. . The DDR processor has a unique private / public key pair and a digital certificate (cert) that proves the authenticity of the public key. The service controller has a unique private / public key pair. Public keys are well known and are included in DDR processor code images. The DDR processor sends the public key and cert to the service controller, and the two perform a key exchange process in which they authenticate each other so that a secret shared session key is generated. The DDR processor uses the session key to encrypt the DDR record sent to the service controller and adds an integrity check to the message sent to the service controller. The service controller uses the session key to add an integrity check to the message sent to the DDR processor.

  As will be apparent to those skilled in the art in view of the various embodiments described herein, various other secure communications and cryptographic techniques may be used to bind secure communications between the DDR processor and the service controller and Security can be provided.

Bind and secure secure communication channel between DDR processor and DPSV in APU / MPU implementation In some embodiments, secure communication channel bind and secure between DDR processor and DPSV in APU / MPU implementation Is provided as described below. The DPSV has a unique private / public key pair and a digital certificate (cert) that proves the authenticity of the public key. The DDR processor has a unique private / public key pair and a digital certificate (cert) that proves the authenticity of the public key. The DPSV and DDR processors exchange the public key and cert, and then perform a key exchange process that authenticates each other and generates a secret shared session key. The DDR processor receives the upstream network data flow from the device OS networking stack, adds the integrity check to each upstream data message using the session key and sends it to the DPSV. The DPSV blocks any upstream data path information that does not have a valid integrity check from the DDR processor and informs the DDR processor that it is receiving invalid upstream data so that the DDR processor The service controller may be notified of a possible fraud event. The DPSV receives the downstream network data flow and uses the session key to add an integrity check to each downstream data message and send it to the DDR processor. Each downstream data message is sequenced so that it cannot be blocked or replayed without being detected by the DDR processor. If the DDR processor receives a downstream data message with an invalid integrity check, it rejects the message and notifies the service controller of a possible fraud event. The DDR processor acknowledges each unrejected downstream data message in the next upstream data message and sends it to the DPSV. If the DPSV stops receiving the downstream data message acknowledgment, it will block the downstream network data flow and notify the DDR processor so that the DDR processor can notify the service controller of a possible fraud event. The DDR processor securely sends the DDR report to the service controller by the service processor as described herein with respect to various embodiments. The DDR sent from the DDR processor to the service controller is integrity checked and sequenced to prevent tampering or playback. A secure connection between the DDR processor and the service controller is maintained and verified using an authentication process between the DDR processor and the service controller in combination with a unique DDR report sequence identifier and a set of authentication session keep-alive timers. If the secure session or DDR record flow between the DDR processor and the service controller is interrupted, the access controller function in the DDR processor can access the 2G, 3G, or 4G modem data path between the DDR and the service controller. Restrict network destinations needed to re-establish a securely authenticated session.

  As will be apparent to those skilled in the art in view of the embodiments described herein, a variety of other secure communications and cryptographic techniques may be used between the DDR processor and DPSV in an APU / MPU implementation. Secure communication channel binding and securing can be provided.

DDR Processor OEM Programming Security Requirements In some embodiments, a DDR processor code signature is provided. In particular, the DDR processor code image is digitally signed by the device OEM. The signature is verified by the secure boot loader using a fixed public key embedded in the secure boot loader code image. This imposes security requirements for the OEM to operate with a secure code signature function that keeps the confidentiality of the fixed signature key. The OEM ensures that only authorized persons can access the code signing function and only do so for legitimate DDR processor images.

  In some embodiments, a random seed of the DDR device private key is provided. In particular, a secret / public key pair called a DDR device key is assigned when the device is manufactured. The DDR device key is unique to each device and is used to establish a secure communication link to the service controller. For example, the DDR device key can be a Diffie-Hellman key pair with a 1024 bit modulo, 1024 bit base, and a 128 bit secret exponent. The secret index (DDR device secret key) of the DDR device key is unique to each device, and is stored in, for example, 128 bits of an on-chip nonvolatile memory (for example, OTP memory) in the SEE. The modulo and base are common to all devices and are embedded in the DDR processor image. The public portion of the DDR device key (eg, DDR device public key) is not permanently stored, but instead is calculated by the DDR processor using the modulo, base, and secret exponents. The DDR processor includes a factory initialization routine that is executed while the device is initialized and tested at the factory. The factory initialization routine generates a DDR device private key and programs it into the SEE non-volatile memory. The DDR device private key never leaves the device and can only be accessed by the DDR processor. The factory initialization routine calculates the DDR device public key and exports it to the factory tester. For example, the factory tester can provide a 128-bit random string that is used by the factory initialization routine as a seed for generating the DDR device private key. This requires that the factory tester includes or has access to a high quality random bit source. Various suitable methods such as FIPS 140-2 ("deterministic random number generator") seeded with the output of a hardware random source can be used.

  In some embodiments, during device manufacture, a digital certificate called a DDR device certificate is assigned to the device. The DDR device certificate is unique to each device and is used to establish a secure communication link to the service controller. The contents of the DDR device certificate include the DDR device public key. The DDR device certificate is signed by a certificate issuing authority, and when establishing a secure link, the signature is verified by the service controller. The DDR device certificate is not sensitive information and can be stored, for example, in on-chip or off-chip non-volatile memory. The OEM issues a DDR device certificate for the DDR device public key exported by the factory initialization routine, which imposes security requirements on which the OEM operates or has access to the certificate authority (CA). Is done. If the OEM chooses to access the outsource CA, the OEM's main obligation is that the device has a DDR device public key that can only be requested by an authorized person and that is legitimately exported by the FI routine. It is guaranteed to do it only against. When an OEM chooses to operate a CA, the OEM has the additional obligation of maintaining the security of the CA, particularly maintaining the confidentiality of the CA's fixed key that signs the certificate.

  Various other security techniques may be used or required for OEM programming of the DDR processor, as will be apparent to those skilled in the art in view of the embodiments described herein.

  FIG. 15 illustrates a flow diagram of a secure device data record that implements device assistance services (DAS) according to some embodiments. At 1502, the process begins. At 1504, service usage of the wireless communication device with the wireless network is monitored (eg, using a monitoring technique based on a DAS client, including various techniques described herein for the implementation of secure DDR). . At 1506, a secure device data record of monitored service usage of a wireless communication device with a wireless network is generated. In some embodiments, each device data record is one of an ordered sequence of device data records, each sequential device data record providing accounting for service usage over the service usage interval of the device data record. Each device data record is associated with a secured unique sequence order identifier. At 1508, the device data record (DDR) is adjusted and verified using various adjustment and verification techniques described herein. For example, the DDR can be verified using a unique sequence order identifier (eg, and other various integrity check based techniques as described herein for various embodiments). As another example, DDR may be compared to service processor reports (eg, layer 7 classification reports) and / or network-based service usage reports (eg, CDR or It can be adjusted with other service usage reports by comparison with network flow records such as IPDR. At 1510, the process ends (e.g., service usage monitoring can be repeated repeatedly).

Exemplary Service Policy Verification Combinations In some embodiments, a communication device includes one or more communication I / O ports, at least one of which is a wide area network connection port, and a storage device that stores device communication activity policies; A secure execution environment inaccessible to user application software and one or more secure data path processing agents that execute in the secure environment and perform device data communication activities on one or more device I / O ports Generate device data records summarizing aspects of device communication activities that monitor and provide information suitable for verifying that device policy enforcement clients are implementing device communication activity policies as appropriate, via a wide area network connection Network device data records via a reliable communication link One or more secure data path processing agents configured to communicate to the element and one or more secure data path processing agents and one or more I / O ports that the device user application software cannot access A reliable data path between and. In some embodiments, the data path is reliable because tampering or change of data on the data path can be detected. In some embodiments, intermediate elements on the data path cannot modify or tamper with data without detection. In some embodiments, the data path is trusted because the data sent via the data path is signed. In some embodiments, the trusted data path between the one or more secure data path processing agents and the one or more I / O ports is further configured to secure communications by encryption. The

  In some such embodiments, the trusted communication link includes a secure message receipt feedback loop.

  In some embodiments, the one or more secure data path processing agents are further configured to restrict access to one or more device I / O ports and the secure message receipt feedback loop indicates an error One or more secure data path processing agents restrict access to one or more device I / O ports. In some embodiments, a network element configured to provide an error handling service to a device when a secure message receipt feedback loop error condition exists due to access restrictions of one or more device I / O ports; Can communicate.

  In some embodiments, the communication device receives a device communication activity policy from the network element. In some embodiments, the device communication activity policy includes an application activity monitoring policy. In some embodiments, the device communication activity policy includes a network destination, address, or resource monitoring policy.

  In some embodiments, the information suitable for verifying that the device policy enforcement client is enforcing the device communication activity policy accordingly includes one or more device I / O port communication activity records.

  In some embodiments, the secure execution environment and one or more secure data path processing agents are located in a secure execution partition that is controlled by an application processor. In some embodiments, the secure execution environment and one or more secure data path processing agents are located in a secure execution partition that is controlled by an operating system or secure partitioning software. In some embodiments, the secure execution environment and one or more secure data path processing agents are located in a secure execution partition that is controlled by a modem processor. In some embodiments, the secure execution environment and one or more secure data path processing agents are located on a SIM card.

  In some embodiments, the wide area network is a wireless network, and information suitable for verifying that the device policy enforcement client is properly implementing the device communication activity policy includes a device wireless network service usage record.

  In some embodiments, the wide area network is a wireless network and the device communication activity policy includes a network access control policy for the wireless network. In some such embodiments, the wireless network access control policy is one or more sets of control policies for one or more applications operating on the device. In some embodiments, the wireless network access control policy is one or more specific access control policy sets of one or more network destinations, addresses, or resources accessible via the wireless network. In some embodiments, the wireless network is a roaming network and the network access control policy defines a policy that is specific to the device roaming network connection status and different from the home network connection status.

  In some embodiments, the wide area network is a wireless network and the device communication activity policy includes a network access service usage accounting policy for the wireless network. In some such embodiments, the network access usage accounting policy is a set of one or more service usage accounting policies for one or more applications running on the device. In some embodiments, the network access service usage accounting policy is a set of one or more service usage accounting policies for one or more network destinations, addresses, or resources accessible via the wireless network. In some embodiments, the wireless network is a roaming network and the network access service usage accounting policy defines a service usage accounting policy that is specific to the device roaming net arc connection status and different from the home network connection status. In some embodiments, the device communication activity policy requires an access network service cost acknowledgment or payment indication from the device user, and if the user does not provide a service cost acknowledgment or payment indication, the device roaming network access privilege is granted. Further including limiting.

  In some embodiments, a network system includes a memory configured to store device communication activity, a reliable communication link to one or more secure data path processing agents over a wide area network, and a wide area network. A communication link to the device policy enforcement client via the policy verification processor, wherein the policy verification processor (i) stores the device data record; (ii) device data from the communication device via the trusted communication link; The device data record is information that summarizes aspects of device communication activity that provides information suitable for verifying that the device policy enforcement client is appropriately implementing the device communication activity policy. (Iii) included in the device data record Analyzing the information to determine whether the device policy enforcement client is properly implementing the device communication activity policy, and (iv) analysis is not properly implementing the device communication activity policy by the device policy enforcement client. If so, it is configured to take error handling measures.

  In some embodiments, the trusted communication link includes a secure message receipt feedback loop. In some embodiments, the network system further comprises an error handling processor that detects when an error condition exists using a secure message receipt feedback loop and flags the error to the administrator or error tracking system. Notify the situation, communicate with the device, analyze the error, or provide an error message to the device user.

  In some embodiments, the network system communicates a device communication activity policy to the device. In some embodiments, the device communication activity policy includes an application activity monitoring policy. In some embodiments, the device communication activity policy includes a netarc destination, address, or resource monitoring policy.

  In some embodiments, the information suitable for verifying that the device policy enforcement client is enforcing the device communication activity policy accordingly includes one or more device I / O port communication activity records.

  In some embodiments, the wide area network is a wireless network, and information suitable for verifying that the device policy enforcement client is properly implementing the device communication activity policy includes a device wireless network service usage record.

  In some embodiments, the wide area network is a wireless network and the device communication activity policy includes a network access control policy for the wireless network. In some such embodiments, the wireless network access control policy is a set of one or more control policies for one or more applications running on the device. In some embodiments, the wireless network access control policy is a set of one or more specific access control policies of one or more network destinations, addresses, or resources accessible via the wireless network. In some embodiments, the wireless network is a roaming network and the network access control policy defines a policy that is specific to the device roaming network connection status and different from the home network connection status.

  In some embodiments, the wide area network includes a wireless network and the device communication activity policy includes a network access service usage accounting policy for the wireless network. In some such embodiments, the network access service usage accounting policy is a set of one or more service usage accounting policies for one or more applications running on the device. In some embodiments, the network access service usage accounting policy is a set of one or more service usage accounting policies for one or more network destinations, addresses, or resources accessible via the wireless network. In some embodiments, the wireless network is a roaming network and the network access service usage accounting policy defines a service usage accounting policy that is specific to the device roaming network connection status and different from the home network connection status.

Exemplary Combinations Using Receipt Feedback Loops In some embodiments, the communication device is inaccessible to user application software and one or more I / O ports, at least one of which is a wide area network connection port A secure execution environment and one or more secure data path processing agents that (i) execute in the secure environment and (ii) monitor communication activity at one or more device I / O ports (Iii) generating device data records summarizing aspects of device I / O port communication activity; (iv) communicating device data records to network elements via a reliable communication link via a wide area network connection A reliable communication link is a secure message receipt file. One or more secure data path processing agents including a loopback loop and receiving a successful transmission receipt of the verified data record from the network element successfully transmitted to the network element; (v) a transmitted device data record And (vi) tracking one or more successful transmission receipts of the corresponding transmitted device data record, the device data record to the network element via a reliable communication link, and One or more secure data path processing agents configured to restrict access to one or more device I / O ports and device user if not received within a specified event interval after transmission Application software is not accessible , And a reliable data path between the one or more secure data path processing agents and one or more I / O ports. In some embodiments, due to access restrictions on one or more device I / O ports, the communication device is still configured to provide error handling services to the device when a secure message receipt feedback loop error condition exists. Can communicate with the network element In some such embodiments, the specified event interval includes a time agency, the number of records sent, or the number of communications with a network element.

  In some embodiments, the secure execution environment and one or more secure data path processing agents are located in a secure execution partition that is controlled by an application processor. In some embodiments, the secure execution environment and one or more secure data path processing agents are located in a secure execution partition that is controlled by a modem processor. In some embodiments, the secure execution environment and one or more secure data path processing agents are located on a SIM card.

  In some embodiments, the aspect of device I / O port communication activity summarized in the device data record includes an overview of device application access activity. In some embodiments, the aspect of device I / O port communication activity summarized in the device data record includes an overview of device network access activity. In some embodiments, the aspect of device I / O port communication activity summarized in device data records includes an overview of device content communication activity.

  In some embodiments, the network system comprises a reliable communication link to one or more secure data path processing agents over a wide area network to receive the device data record, the device data record being a device I / A reliable communication link includes a secure message receipt feedback loop, including an overview of aspects of O-port communication activity, in which a network-based system is successfully received and verified by a network-based system The transmission receipt is transmitted to one or more secure data path processing agents, and the network system comprises a storage system for storing device data records. In some embodiments, the network system further comprises an error processing processor that detects when an error condition exists using a secure message receipt feedback loop and, after detecting the error, the error condition is Notify the error tracking system with a flag. In some embodiments, the network system further comprises a system that communicates with the device during an error situation to analyze the error situation or provide an error message to the device user.

  In some embodiments, the network system further comprises a device data record analyzer, wherein the device data record analyzer includes (i) a device I / O port communication activity policy that includes allowed device I / O port communication behavior. And (ii) compare the device data record with the I / O port communication activity policy, and (iii) the I / O port communication activity where the device data record is outside the behavior limit specified in the I / O port communication activity policy. Is configured to declare an I / O port activity error status.

  In some embodiments, the aspect of device I / O port communication activity summarized in the device data record includes an overview of device application access activity. In some embodiments, the aspect of device I / O port communication activity summarized in the device data record includes an overview of device network access activity. In some embodiments, the aspect of device I / O port communication activity summarized in device data records includes an overview of device content communication activity.

Exemplary Combinations Using a SIM Card In some embodiments, a communication device stores one or more communication I / O ports including at least one wide area network connection port and a device communication activity policy And a SIM card, wherein the SIM card includes: (i) a secure execution environment in which user application software is inaccessible; (ii) one or more of I / O ports executed in the secure execution environment One or more secure data path processing agents configured to act on device data path communication with and enforce a device communication activity policy; and (iii) one or more secure data path processing agents Reliable data path link for data PS acquisition communication from one to multiple I / O port modems And the one or more port modems include a secure modem processor execution environment that is inaccessible to user application software. In some embodiments, the one or more secure data path processing agents are further configured with a reliable communication link to the network element via the wide area network connection port.

  In some such embodiments, the device communication activity policy is a device I / O port communication reporting policy and the one or more secure data path processing agents: (i) one or more I / O ports Further monitoring and / or reporting communication activity performed at (ii) creating a device data record summarizing the communication activity and (iii) transmitting the device data record to a network element via a reliable communication link. Composed. In some embodiments, monitoring and / or reporting communication activity includes monitoring data usage. In some embodiments, monitoring and / or reporting data usage includes a classification of accessed netarc destinations in connection with data usage. In some embodiments, monitoring and / or reporting data usage includes a classification of device applications that generate data usage. In some embodiments, monitoring communication activity includes monitoring roaming service usage. In some embodiments, monitoring communication activity includes monitoring service usage of one or more QoS classes. In some embodiments, monitoring communication activity includes monitoring voice usage.

  In some embodiments, the service processor is further configured to collect application information from the device agent.

  In some embodiments, the device communication activity policy is a device I / O port communication control policy, and the service processor monitors (i) communication activity performed on one or more I / O ports, and (ii) ) Further configured to enforce an I / O port communication policy at one or more I / O ports;

  In some embodiments, the communication control policy specifies a control policy for one or more network destinations. In some embodiments, the communication control policy specifies a control policy for one or more device applications. In some embodiments, the communication control policy specifies a control policy for the roaming network. In some embodiments, the communication control policy specifies a control policy for the QoS service class.

  In some embodiments, reliable data path communication between one or more secure data path processing agents and one or more I / O port modems is by signing or encryption using a shared key. Secured. In some embodiments, the one or more secure data path processing agents are further configured with a trusted communication link to the network element via the wide area network connection port, and the shared key is obtained from the network element.

  Although the embodiments have been described in some detail for clarity of understanding, the invention is not limited to the details provided. There are many alternative ways of implementing the invention. The disclosed embodiments are illustrative and not limiting.

Claims (28)

In communication equipment,
One or more communication input / output (I / O) ports, wherein at least one of the one or more communication I / O ports is configured to connect the communication device to a wide area network. One or more communication input / output (I / O) ports that are wide area network ports;
A memory configured to store a device communication activity policy;
A secure execution environment configured to prevent access to user application software;
One or more secure data path processing agents,
Executing in the secure execution environment;
Monitoring device data communication activity through at least one of the one or more communication I / O ports;
Generating a device data record including information about the device data communication activity through at least one of the one or more communication I / O ports, wherein the communication device communicates with the device Being configured to assist a network element in determining whether it is operating or was operating according to an activity policy, and the one or more data path processing agents and the network element Sending the device data record to the network element via a reliable communication link between,
One or more secure data path processing agents configured to:
A reliable data path between the one or more data path processing agents and the wide area network port;
A communication apparatus comprising:   2. The communication device according to claim 1, wherein the policy enforcement client on the communication device determines whether the communication device is operating or has been operating according to the device communication activity policy. A communication apparatus comprising determining whether or not a communication activity policy is appropriately implemented.   The communication device according to claim 1, wherein the reliable communication link includes a secure message receipt feedback loop.   4. The communication device according to claim 3, wherein the one or more secure data path processing agents are configured so that at least one of the one or more communication I / O ports is based on information from the secure message reception feedback loop. A communication device further configured to limit data transmission or data reception by the communication device through one.   5. The communication device of claim 4, wherein the at least one restricted device I / O port is configured to provide an error handling instruction to the communication device when a secure message receipt feedback loop error condition exists. A communication device configured to communicate with a network element.   The communication device of claim 1, further configured to receive the device communication activity policy from a network element.   The communication device of claim 1, wherein information configured to assist a network element in determining whether the communication device is operating or was operating according to the device communication activity policy. A communication device comprising a communication activity record of at least one of the one or more communication I / O ports.   2. The communication device according to claim 1, wherein the device communication activity policy includes an application activity monitoring policy.   The communication device of claim 1, wherein the device communication activity policy includes a policy configured to monitor a network destination, address, or resource.   2. The communication device according to claim 1, wherein the secure execution environment and the one or more secure data path processing agents are arranged in a secure execution partition controlled by an application processor.   The communication device according to claim 1, wherein the secure execution environment and the one or more secure data path processing agents are arranged in a secure execution partition controlled by an operating system or secure partition software. Communication device.   The communication device according to claim 1, wherein the secure execution environment and the one or more secure data path processing agents are arranged in a secure execution partition controlled by a modem processor.   2. The communication device according to claim 1, wherein the secure execution environment and the one or more secure data path processing agents are arranged on a SIM card.   The communication device according to claim 1, wherein the wide area network is a wireless network, and in determining whether the communication device is operating or has been operating according to the device communication activity policy, A communication device, wherein the information configured to support includes a device wireless network service usage record.   2. The communication apparatus according to claim 1, wherein the wide area network is a wireless network, and the apparatus communication activity policy includes a network access control policy for the wireless network.   16. The communication device of claim 15, wherein the wireless network access control policy includes one or more control policies of one or more applications that are operating or operable on the communication device. A communication device.   16. The communication device according to claim 15, wherein the wireless network access control policy includes one or more access control policies for one or more network destinations, addresses, or resources accessible via the wireless network. A communication device.   16. The communication device according to claim 15, wherein the wireless network is a roaming network, and the network access control policy is a first control policy when the communication device is in a roaming state and the communication device is in the roaming state. A communication device comprising a second control policy in the absence of the second control policy.   2. The communication apparatus according to claim 1, wherein the wide area network is a wireless network, and the apparatus communication activity policy includes a network access service usage accounting policy for the wireless network.   20. The communication device of claim 19, wherein the network access service usage accounting policy includes one or more service usage accounting policies for one or more applications running on the communication device. apparatus.   20. The communication device of claim 19, wherein the network access service usage accounting policy is one or more services associated with one or more network destinations, addresses, or resources accessible via the wireless network. A communication device comprising a usage accounting policy.   20. The communication device according to claim 19, wherein the wireless network is a roaming network, and the network access service usage accounting policy includes a first usage accounting policy and the communication device when the communication device is in a roaming state. A communication apparatus that defines a second usage accounting policy when not in a roaming network. 23. The communication device according to claim 22, wherein the first usage accounting policy is:
Request an access network service cost acknowledgment or payment indication from the device user;
A communication device configured to restrict access to the roaming network by the communication device if the device user does not provide the service cost acknowledgment or payment indication. In communication equipment,
One or more communication input / output (I / O) ports, wherein at least one of the one or more communication I / O ports is configured to connect the communication device to a wide area network. One or more communication input / output (I / O) ports that are wide area network ports;
A secure execution environment configured so that user application software is inaccessible;
One or more secure data path processing agents,
Executing in the secure execution environment;
Monitoring device data communication activity through at least one of the one or more communication I / O ports;
Generating a device data record that includes information about the device data communication activity through at least one of the one or more communication I / O ports;
Sending the device data record to the network element via a reliable communication link between the one or more data path processing agents and the network element;
Monitoring communication transmitted by the network element over the reliable communication link, and the device data record over the reliable communication link within the network element within a specified event interval. The one or more secure data path processing agents have not detected a secure message receipt in the communication from the network element transmitted over the reliable communication link, Restricting access to at least one of the one or more communication I / O ports;
One or more secure data path processing agents configured to:
A reliable data path between the one or more data path processing agents and the wide area network port;
A communication apparatus comprising:   25. The communication apparatus according to claim 24, wherein the specified event interval includes a time period, the number of transmission records, or the number of times of communication with the network element. In communication equipment,
One or more communication input / output (I / O) ports, wherein at least one of the one or more communication I / O ports is configured to connect the communication device to a wide area network. One or more communication input / output (I / O) ports that are wide area network ports;
A memory configured to store a device communication activity policy;
SIM card,
The SIM card comprises:
A secure execution environment configured to prevent access to user application software;
One or more secure data path processing agents,
Executing in the secure execution environment;
Monitoring data communication activity through at least one of the one or more communication I / O ports, and supporting enforcement of the device communication activity policy based on the monitored data communication activity One or more secure data path processing agents configured to take measures against:
A reliable data path between the service processor and one or more I / O port modems;
And a secure modem processor execution environment configured such that the one or more I / O port modems are inaccessible to user application software. In the network system,
A memory configured to store a device communication activity policy;
A policy validation processor;
The policy validation processor comprises:
Receiving a device data record via a reliable communication link between the network system and a device data record generator on a communication device, wherein the device data record is for data communication activity by the communication device; Including information, wherein the information is configured to assist the policy verification processor in determining whether the communication device is or has been operating according to the device communication activity policy;
Determining whether or not the communication device is operating according to the device communication activity policy based on the device data record; and wherein the communication device is operating according to the device communication activity policy If it is determined that it is not or not working, start an error handling operation;
A network system configured to perform:   28. The network system according to claim 27, wherein the policy enforcement client on the communication device determines whether the communication device is operating or has been operating in accordance with the device communication activity policy. A network system comprising determining whether or not a communication activity policy is appropriately implemented.

Images