Security techniques for device assisted services
Security techniques for device assisted services are provided. In some embodiments, secure service measurement and/or control execution partition is provided. In some embodiments, implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control of the communications device use of a service on a wireless network, in which the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network; monitoring use of the service based on the service profile; and verifying the use of the service based on the monitored use of the service.
1. A method of operating a wireless end-user device, the method comprising:
connecting from a secure modem subsystem to a wireless cellular network;
connecting a first secure control channel from the secure modem subsystem through the wireless cellular network to a network service controller;
connecting a second secure control channel from a secure execution environment, separately secure from the secure modem subsystem, through the secure modem subsystem and the wireless cellular network to the network service controller;
receiving at the secure execution environment, via the second secure control channel, one or more messages from the network service controller, the one or more messages comprising one or more service policy settings;
storing the one or more service policy settings in a secure memory partition accessible only from the secure execution environment; and
enforcing, at least in part from the secure execution environment, a network service profile comprising the one or more service policy settings, to control the wireless end-user device use of a service on the wireless cellular network.
2. The method of claim 1 , wherein the network service profile is associated with a service plan that provides for access to the service on the wireless cellular network.
3. The method of claim 1 , wherein the secure modem subsystem comprises a modem control link and a modem local channel, and the first secure control channel connects the modem control link to the network service controller through the modem local channel, and wherein the secure execution environment comprises a host service control link, the second secure control channel coupled to the host service control link, the modem local channel providing secure communication between the modem control link and the host service control link.
4. The method of claim 1 , wherein the secure modem subsystem further comprises a modem agent accessible only by the network service controller through the first secure control channel.
5. The method of claim 4 , wherein the modem agent comprises a service measurement point for use of the service.
6. The method of claim 5 , further comprising the modem agent communicating a first report of the use of the service to the network service controller through the first secure control channel.
7. The method of claim 6 , further comprising the secure execution environment separately communicating a second report of the monitored use of the service through the second secure control channel.
8. The method of claim 1 , wherein the one or more service policy settings include an access control setting, a traffic control setting, and/or an admission control setting.
9. The method of claim 1 , wherein the one or more service policy settings include a network or device management communication setting.
10. The method of claim 1 , wherein the secure execution environment is implemented at least in part as a hardware partition.
11. The method of claim 1 , wherein the secure execution environment is implemented at least in part as a software partition.
12. The method of claim 1 , wherein the secure execution environment is implemented at least in part in a virtual machine executed on a processor.