Apparatus and method for mobile communications and computing

1. A wireless computing and communications device comprising:

an application processor configured to execute user applications; and

a first central processing unit (CPU) core comprising

a baseband processor configured to implement operations providing access to a wireless communications network; and

a communications management processor, in communication with the baseband processor via a first communications channel, and with the application processor via a second communications channel,

wherein the CPU core is configured to execute a virtual machine manager (VMM), wherein each one of the baseband processor and the communications management processor executes within a distinct virtual machine (VM) managed by the VMM, and

wherein the communications management processor is configured to operate in a separate security domain from the application processor, and to mediate all access to the wireless communications network by user applications executing on the application processor.

2. The device of claim 1 , wherein the application processor execute within a distinct VM managed by the VMM executing on the first CPU core.

3. The device of claim 1 which comprises a second CPU core, in communication with the first CPU core via an inter-core communications channel, wherein the baseband processor and communications management processor execute within distinct VMs managed by the VMM on the first CPU core, and the application processor executes on the second CPU core.

4. The device of claim 3 wherein the first and second CPU cores are located on a single IC chip.

5. The device of claim 3 wherein the first and second CPU cores are located on separate IC chips.

6. The device of claim 1 wherein the communications management processor is configured to implement a security management function, said security management function restricting access to a secure configuration data store to functions executing within the communications management processor security domain.

7. The device of claim 6 wherein the communications management processor is further configured to receive and verify requests to modify contents of the secure configuration data store from trusted sources in the wireless communications network, and trusted applications executing on the application processor, and to update the contents in the event that the verification is successful.

8. The device of claim 1 wherein the communications management processor is configured to implement a database management function, said database management function communicating with the application processor via the second communications channel and providing access to a data store to applications executing on the application processor.

9. The device of claim 8 wherein the database management function is configured to selectively provide read-only or read/write access by applications executing on the application processor to information held in the data store.

10. The device of claim 1 wherein the communications management processor is configured to implement a connection management function, the connection management function communicating with the baseband processor via the first communications channel to provide access to the wireless communications network in response to requests received via the second communications channel from applications executing on the application processor.

11. The device of claim 10 wherein operations provided by the connection management function in response to requests comprise one or more of: connection set-up; connection termination; connection status; virtual connection set-up; and virtual connection termination.

12. The device of claim 10 wherein the connection management function is further configured to provide access to the wireless communications network in response to requests received from functions executing within the communications management processor security domain.

13. The device of claim 1 wherein the communications management processor is configured to implement a policy enforcement function, said policy enforcement function policing communication flows between the application processor and the baseband processor via the first and second communications channels, and controlling the communications flows in accordance with associated rules.

14. The device of claim 13 wherein the communication flows comprise one or more of: data flows; voice flows; and text-messaging flows.

15. The device of claim 13 wherein the policy enforcement function is configured to receive the associated rules from one or more of:

a secure configuration data store within the communications management processor security domain;

the wireless communications network via the first communications channel; and

applications executing on the application processor via the second communications channel.

16. The device of claim 13 wherein each associated rule comprises a combination of one or more of:

an interface to which the rule is applied;

maximum and/or minimum sustained throughput per unit time;

maximum permissible burst rate;

packet size;

queuing mechanisms;

queue buffer sizes;

application types;

source/destination address;

source/destination port;

time schedules;

match actions; and

rule priority.

17. The device of claim 13 wherein each associated rule is applied to one or more of:

a corresponding application executing on the application processor;

all applications executing on the application processor; and

one or more communication flows.

18. The device of claim 13 wherein the policy enforcement function is further configured to control timing and/or rate of connection requests or transmissions to the wireless network according to wireless network configuration rules.

19. The device of claim 1 which comprises a diagnostics, monitoring and control function configured to provide one or more diagnostic/management interfaces accessible via the wireless network.

20. The device of claim 19 wherein diagnostic/management interfaces include one or more of SSH, SNMP, IEEE 802.1ag (ITU-T Y.1731), TR-069, OMA-DM and Web UI.

21. A method of operating a wireless computing and communications device comprising:

executing a virtual machine manager (VMM) on a first central processing unit (CPU) core of the wireless computing and communications device; and

executing wireless communications management functions by a communications management processor in communication with a baseband processor via a first communication channel and with an application processor via a second communication channel,

wherein each one of the baseband processor and the communications management processor executes within a distinct virtual machine (VM) managed by the VMM executing on the first CPU core,

wherein the baseband processor is configured to implement operations providing access to a wireless communications network, the application processor is configured to execute user applications, and

wherein the wireless communications management functions execute within a separate security domain from the application processor, and mediate all access to the wireless communications network by user applications executing on the application processor.

22. The method of claim 21 wherein the communications management functions comprise a security management function, and the method comprises the security management function restricting access to a secure configuration data store to functions executing within the communications management function security domain.

23. The method of claim 21 wherein the communications management functions comprise a database management function, and the method comprises the database management function communicating with the application processor via the second communications channel and providing access to a data store to applications executing on the application processor.

24. The method of claim 21 wherein the communications management functions comprise a connection management function, and the method comprises the connection management function communicating with the baseband processor via the first communications channel to provide access to the wireless communications network in response to requests received via the second communications channel from applications executing on the application processor.

25. The method of claim 21 wherein the communications management functions comprise a policy enforcement function, and the method comprises the policy enforcement function policing communication flows between the application processor and the baseband processor via the first and second communication channels and controlling the communication flows in accordance with associated rules.

26. The method of claim 21 wherein the communications management functions comprise a diagnostics, monitoring and control function, and the method comprises the diagnostics, monitoring and control function implementing one or more diagnostic/management interfaces accessible via the wireless communications network.