End user device that secures an association of application to service policy with an application certificate check
Network service provisioning is described. Network service provisioning to a device includes a mechanism for ensuring that network services are available based upon one or more of appropriate traffic control, billing, and notification policies. Ensuring that the policies are properly enforced on a device is a focus of this paper. The enforcement policies can be on the device or in the network.
1. An end user device comprising:
one or more modems configured to connect to one or more access networks,
one or more device agents configured to:
store a plurality of application programs and a corresponding access network service policy associated with each of the application programs, each of the corresponding access network service policies comprising, for the corresponding application program:
information about a corresponding application credential associated with the corresponding application program, and
device agent instructions configured to govern at least an aspect of attempted or actual access network communication activity associated with the corresponding application program, and
for each given one of the plurality of application programs, perform the following operations in any order:
govern the at least an aspect of attempted or actual access network communication activity associated with the given application program, based at least in part on the corresponding device agent instructions for the given application program, and
check the given application's configuration using the corresponding information about the corresponding application credential and, in the case that the application configuration check does not pass, then take an action.
2. The end-user device of claim 1 , wherein, for one or more of the plurality of application programs, govern the at least an aspect of attempted or actual access network communication activity comprises controlling access network communication activity associated with the one or more of the plurality of application programs.
3. The end-user device of claim 2 , the one or more device agents further configured to identify a connected access network, and wherein controlling access network communication activity associated with the one or more of the plurality of application programs further comprises, for a given one of the one or more application programs and based on the corresponding device agent instructions for the given application program, controlling access network communication activity for at least one identified connected access network but not for at least one other identified connected access network.
4. The end-user device of claim 2 , wherein controlling access network communication activity associated with the one or more of the plurality of application programs further comprises, for a given one of the one or more application programs and based on the corresponding device agent instructions for the given application program, limiting background access network communication activity associated with the given application program.
5. The end-user device of claim 4 , wherein limiting background access network communication activity associated with the given application program comprises preventing the given application program from performing network communication based on the application operating in a background mode.
6. The end-user device of claim 5 , the one or more device agents further configured to identify a connected access network, and wherein preventing the given application program from performing network communication based on the application operating in a background mode further comprises preventing network communication for at least one identified connected access network but not for at least one other identified connected access network.
7. The end-user device of claim 5 , the one or more device agents further configured to determine that the given application program is operating in a background mode when the application is not selected by a device user to occupy a foreground of a user interface on the device and accept user interface input.
8. The end-user device of claim 2 , wherein controlling access network communication activity associated with the one or more of the plurality of application programs further comprises, for a given one of the one or more application programs and based on the corresponding device agent instructions for the given application program, limiting an amount of network service usage associated with network communication for the given application program.
9. The end-user device of claim 1 , the one or more device agents further configured to, using a device user interface and for one or more given ones of the plurality of device applications:
display to a user one or more access network service policy configuration options for the one or more given device applications;
accept at least one user selection from among the access network service policy configuration options; and
configuring at least an aspect of the corresponding access network service policy for a given one of the plurality of device applications based on the user selection.
10. The end-user device of claim 9 , wherein configuring at least an aspect of the corresponding access network service policy based on the user selection comprises configuring a conditional restriction on network communication for the given device application, the conditional restriction based on a connected network identification.
11. The end-user device of claim 10 , wherein the conditional restriction disallows network communication for the given device application based on a connected network identification.
12. The end-user device of claim 1 , wherein, for one or more of the plurality of application programs, govern the at least an aspect of attempted or actual access network communication activity comprises form an accounting measure of network access communication activity associated with a given one of the one or more application programs.
13. The end-user device of claim 1 , wherein, for one or more of the plurality of application programs, govern the at least an aspect of attempted or actual access network communication activity comprises provide a user notification to a user interface of the end-user device, the user notification containing an accounting measure of network access communication activity associated with a given one of the one or more application programs.
14. The end-user device of claim 1 , the one or more device agents further configured to obtain at least an aspect of at least one of the corresponding access network service policies from a user of the end-user device through a device user interface.
15. The end-user device of claim 1 , the one or more device agents further configured to obtain at least an aspect of at least one of the corresponding access network service policies from a network element.
16. The end-user device of claim 15 , the one or more device agents further configured to identify a potential or actual use of an access network by a candidate one of the plurality of device applications, and based on the identified potential or actual use, provide the information about the corresponding application credential of the candidate device application to the network element in order to obtain the at least an aspect of at least one of the corresponding access network service policies from a network element.
17. The end-user device of claim 1 , wherein for one or more of the plurality of device applications, the corresponding application credential is of a credential type selected from the group of credential types consisting of a configuration authentication certificate, a software security certificate, a software security signature, and information about a software security hash.
18. The end-user device of claim 1 , wherein to govern the at least an aspect of attempted or actual access network communication activity associated with a given application program comprises providing to the given application program, through an application interface function, an application service policy indication related to the corresponding access network service policy for the given application program.
19. The end-user device of claim 1 , wherein to govern the at least an aspect of attempted or actual access network communication activity associated with a given application program comprises to control an aspect of a traffic path used for network access communication activity associated with the given application program.
20. The end-user device of claim 1 , wherein to control an aspect of a traffic path comprises placing data packets corresponding to access network communication activity associated with the given application program in a corresponding data tunnel.