Security techniques for device assisted services
Security techniques for device assisted services are provided. In some embodiments, secure service measurement and/or control execution partition is provided. In some embodiments, implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control of the communications device use of a service on a wireless network, in which the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network; monitoring use of the service based on the service profile; and verifying the use of the service based on the monitored use of the service.
1. A system, comprising:
a processor of a communications device configured to:
implement a service profile executed at least in part in a secure execution environment for assisting control of the communications device use of a service on a wireless network, wherein the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network;
operate a host service control link in the secure execution environment to connect securely to a network service controller through a first control channel, the host service control link to receive one or more messages from the network service controller through the first control channel, and based on the one or more messages, to update one or more of the service policy settings;
monitor use of the service based on the service profile; and
verify the use of the service based on the monitored use of the service;
a memory of the communications device coupled to the processor and configured to provide the processor with instructions, the memory comprising a secure partition accessible only from the secure execution environment; and
a secure modem subsystem including:
a wireless modem to communicate with the wireless network;
a modem control link to connect securely to the network service controller through a second control channel.
2. The system of claim 1 , wherein the second control channel connects the modem control link to the network service controller through a modem local channel on the communications device, the modem local channel providing secure communication between the modem control link and the host service control link.
3. The system of claim 1 , wherein the second control channel is separately secured from the first control channel.
4. The system of claim 1 , wherein the secure modem subsystem further comprises a modem agent accessible only by the network service controller through the second control channel.
5. The system of claim 4 , wherein the modem agent comprises a service measurement point for use of the service.
6. The system of claim 5 , wherein the modem agent communicates a report of the use of the service to the network service controller through the second control channel.
7. The system of claim 6 , wherein the processor separately communicates a report of the monitored use of the service from the secure execution environment through the first control channel.
8. The system of claim 1 , wherein the one or more service policy settings updated through the host service control link include an access control setting, a traffic control setting, and/or an admission control setting.
9. The system of claim 1 , wherein the one or more service policy settings updated through the host service control link include a network or device management communication setting.
10. The system of claim 1 , wherein the secure execution environment is implemented at least in part as a hardware partition.
11. The system of claim 1 , wherein the secure execution environment is implemented at least in part as a software partition.
12. The system of claim 1 , wherein the secure execution environment is implemented at least in part in a virtual machine executed on the processor.