Mobile Device With In-Situ Network Activity Management
A wireless end-user device divides the functions of a network data policy management function between kernel and user-space processes. The kernel process is efficient at implementing control policies (block/allow/rate limit/usage limit) and counting policies for flows, but relies on the user-space process to classify flows and supply the control and counting policies for each flow. The kernel process allows the majority of the network data policy management function to run in a secure, power-efficient manner, with the user-space process remaining flexible and potentially sophisticated in classification capability, while having limited access to detailed packet flow information.
1 . A non-transitory computer media comprising computer instructions for execution in an operating system kernel, the instructions, when executed, performing a method comprising:
maintaining a plurality of data buckets, each data bucket containing a respective data count;
inspecting the packets of a plurality of network packet data flows at a point in a network stack;
receiving, from a user space process, a data allotment, identified with a first one of the data buckets;
associating the first data bucket with the data allotment;
receiving, from the user space process, a first instruction to associate a first one of the network packet data flows with the first data bucket;
for each packet inspected in the first network packet data flow,
making a determination as to whether the data count of the first data bucket, adjusted for the data count of that packet, would at least reach a depletion limit;
based on the determination indicating that the adjusted data count of the first data bucket would not at least reach the depletion limit, allowing the packet to continue through the network stack, and updating the data count of the first data bucket to account for the data count of that packet, and
based on the determination indicating that the adjusted data count of the first data bucket would at least reach the depletion limit, notifying the user space process of a depletion event status of the first data bucket; and
reporting to the user space process, at a time that a depletion event status is not current for the first data bucket, a current data count of the first data bucket.