Wireless end-user device with divided user space/kernel space traffic policy system
A wireless end-user device operates a network data traffic classifier and a policy enforcer in a kernel space and a service monitoring and reporting agent and a policy control agent in the user space. The user can accordingly view and set application network data traffic policies and view application network data usage, with the traffic classification/policy enforcement functions provided securely and efficiently within the kernel, through which the network data traffic flows to a modem.
1. A wireless end-user device comprising:
a wireless network modem;
one or more processors to execute computer instructions for one or more processes in a kernel space of an operating system and one or more processes in a user space of an operating system, the one or more kernel space processes comprising
a classifier to apply classification rules that associate respective application data streams directed to and/or from the wireless network modem with respective matching sets of one or more policy enforcer actions, and
a policy enforcer to perform the matching set of one or more policy enforcer actions for each respective application data stream,
the one or more user space processes comprising
a service monitoring and reporting agent to receive usage counting counts from the policy enforcer, the usage counting counts reflecting wireless modem data usage attributed to the respective application data streams, and
a policy control agent to adapt service access policies into classification rules for the classifier and policy enforcer actions for the policy enforcer, the policy control agent further to communicate the classification rules and policy enforcer actions to the kernel space for use by the classifier and policy enforcer; and
a non-volatile memory to store the computer instructions.
2. The wireless end-user device of claim 1 , the one or more kernel space processes further comprising a network stack to exchange application data streams with the wireless network modem, the network stack in communication with the policy enforcer.
3. The wireless end-user device of claim 1 , further comprising a user interface, the one or more user space processes further comprising a network usage dashboard user application in communication with the service monitoring and reporting agent and the policy control agent.
4. The wireless end-user device of claim 3 , the network usage dashboard user application providing an interface for a user to set a service access policy for a given service type based on an amount of data usage, the network usage dashboard user application communicating a user-set service access policy to the policy control agent.
5. The wireless end-user device of claim 4 , wherein the user-set service access policy comprises an alert to occur when the amount of data usage for the given service data type reaches a threshold.
6. The wireless end-user device of claim 4 , wherein the user-set service access policy comprises a wireless modem data block to occur for the given service data type when the amount of data usage for the given service data type reaches a threshold.
7. The wireless end-user device of claim 3 , the network usage dashboard user application providing an interface for a user to view individual data usage for each of a plurality of services classified according to the classification rules, the individual data usage based on the usage counting counts received by the service monitoring and reporting agent.
8. The wireless end-user device of claim 3 , the one or more user space processes further comprising a user interface communication agent to provide alerts and/or notifications to the network usage dashboard user application, based on application of the service access policies.
9. The wireless end-user device of claim 1 , the one or more user space processes further comprising a communication manager to communicate with a network-based service controller, the communication manager receiving at least one of the service access policies from the network-based service controller, and supplying the at least one of the service access policies to the policy control agent.
10. The wireless end-user device of claim 1 , wherein at least one of the classification rules and matching set of one or more policy enforcer actions classifies a given application data stream as a background service and blocks the data stream accordingly.
11. The wireless end-user device of claim 10 , wherein the given application data stream is classified as a background service because it is associated with a hidden application that is running but not currently being interacted with by a device user.
12. The wireless end-user device of claim 1 , the policy control agent further to listen for an application start intent, the policy control agent responding to a given application start intent by, for a given application associated with the given application start intent, communicating one or more classification rules and/or policy enforcer actions associated with the given application to the kernel space.
13. The wireless end-user device of claim 1 , wherein the classification rules applied by the classifier to a given application data stream are based on an Access Point Name to be used by the given application data stream.
14. The wireless end-user device of claim 1 , wherein the classification rules applied by the classifier are applied based on an application and/or process identifier associated with a given application data stream.