Adapting network policies based on device service processor configuration
Disclosed herein are various embodiments to prevent, detect, or take action in response to the moving a device credential from one device to another, the improper configuration of a service processor, a missing service processor, or the tampering with a service processor in device-assisted services (DAS) systems.
1. A network system, comprising:
one or more network elements configured to receive a device credential and request to connect to a network from an end-user device having a service processor, and,
based on the request, device credential, and a network service usage policy, allow the device to connect to the network with an initial service usage limit sufficient to allow the device to contact, through the network, a service processor authentication and management system to authenticate, the initial service usage limit insufficient to allow the device to obtain a significant amount of network services prior to authenticating; and
the service processor authentication and management system, configured to:
obtain service processor authentication information for the end-user device service processor,
using the service processor authentication information, facilitate execution of an end-user device service processor authentication procedure, and
upon successful completion of the end-user device service processor authentication procedure, signal the one or more network elements to increase or remove the initial service usage limit.
2. The network system of claim 1 , wherein configured to signal the one or more network elements to increase or remove the initial service usage limit comprises configured to signal the one or more network elements to add an increment of allowed service usage to the service usage limit.
3. The network system of claim 2 , wherein the service processor authentication and management system is further configured to, after signaling the one or more network elements to add an increment of allowed service usage to the service usage limit, accept a flow of data usage records from the end-user device service processor.
4. The network system of claim 3 , wherein the service processor authentication and management system if further configured to, while a flow of data usage records continues, verify the integrity of at least a portion of the flow of data usage records, and, upon successful integrity verification, signal the one or more network elements to add additional increments of allowed service usage to the service usage limit so as to allow the end-user device to continue accessing network services.
5. The network system of claim 4 , wherein the service processor authentication and management system is further configured to, upon either of unsuccessful integrity verification and a stoppage in the flow of data usage records, signal the one or more network elements to change the network service usage policy applied to the end-user device.
6. The network system of claim 5 , wherein the change in the network service usage policy disallows access to the network.
7. The network system of claim 5 , wherein the change in the network service usage policy bills network usage for the end-user device at a higher rate.
8. The network system of claim 4 , wherein at least a portion of the flow of data usage records indicate a sponsored background classification of service usage.
9. The network system of claim 4 , wherein at least a portion of the flow of data usage records indicate a classification of service usage that differentiates between background and foreground communication.
10. The network system of claim 9 , wherein at least a portion of the flow of data usage records indicate a classification of service usage that differentiates according to which of a plurality of device applications is responsible for respective portions of the service usage.
11. The network system of claim 4 , wherein at least a portion of the flow of data usage records indicate a classification of service usage that differentiates according to which of a plurality of device applications is responsible for respective portions of the service usage.
12. The network system of claim 4 , wherein at least a portion of the flow of data usage records indicate a classification of service usage that differentiates according to a network destination or resource accessed for respective portions of the service usage.
13. The network system of claim 4 , wherein at least a portion of the flow of data usage records indicate a classification of service usage that differentiates according to a type of network used for respective portions of the service usage.
14. The network system of claim 3 , further comprising an intermediate message server link in direct communication with the end-user device service processor, where configured to accept a flow of data usage records from the end-user device service processor comprises configured to accept the flow as messages from the intermediate message server link.
15. The network system of claim 14 , wherein the flow of messages from the intermediate message server link are encrypted with unique keys shared between an agent on the end-user device and the service processor authentication and management system.
16. The network system of claim 1 , wherein the end-user device service processor comprises a service processor configuration stored on a Subscriber Identity Module (SIM) installed in the end-user device.
17. The network system of claim 16 , wherein the SIM and service processor are associated with one or more sponsored network services.
18. The network system of claim 17 , wherein the one or more sponsored network services include network service for one or more device applications.