Virtual operator network

Abstract

A method (500) for a virtual network (30) for a mobile device (110) includes, for a mobile device executing a user application (116) and connected simultaneously to a first wireless network (120) and a second wireless network, selecting a remote server (130) from a plurality of remote servers. The method also includes establishing a virtual network between the mobile device and the selected remote server, the virtual network including at least one tunnel (122) between the mobile device and the selected remote server over the first wireless network and the second wireless network. The method also includes sending data from the user application to the selected remote server (50) over the virtual network. The data, when received by the selected remote server, causes the selected remote server to route the data to a destination server (60).

Description

Technical Field

[0001] The present disclosure relates to a virtual carrier network of user equipment. Background Art

[0002] Mobile devices (e.g., smartphones) and other user devices typically offer many different wireless connection technologies (e.g., cellular, Wi-Fi, Bluetooth, etc.). To reduce the cost of mobile data, mobile network operators (MNOs) and mobile virtual network operators (MNVOs) often mediate additional lower-cost networks (e.g., Wi-Fi networks) and offload customer mobile data from cellular connections (e.g., 4G, 5G, etc.) to lower-cost networks when possible. Modern mobile operating systems do not provide convenient mobility solutions or user experiences for multiple operator networks. Summary of the invention

[0003] One aspect of the present disclosure provides a virtual operator network for a mobile device. The method includes, for a mobile device that executes a user application and is simultaneously connected to a first wireless network associated with a mobile virtual network operator (MVNO) and a second wireless network associated with the same MVNO, selecting a remote server from a plurality of remote servers by data processing hardware. Each of the plurality of remote servers is associated with a geographic location. The method also includes establishing a virtual network between the mobile device and the selected remote server by data processing hardware. The virtual network includes at least one tunnel on the first wireless network between the mobile device and the selected remote server and at least one tunnel on the second wireless network between the mobile device and the selected remote server. The method also includes sending data from the user application to the selected remote server by the data processing hardware via one of the at least one tunnels on the first wireless network between the mobile device and the selected remote server or via one of the at least one tunnels on the second wireless network between the mobile device and the selected remote server. When the data is received by the selected remote server, the selected remote server routes the data to the destination server.

[0004] Implementations of the present disclosure may include one or more of the following optional features. In some implementations, at least one tunnel between a mobile device and a selected remote server on a first wireless network includes a first tunnel supporting data for a first service and a second tunnel supporting data for a second service. At least one tunnel between a mobile device and a selected remote server on a second wireless network may include a third tunnel supporting data for the first service and a fourth tunnel supporting data for the second service. In this implementation, sending data from a user application to a selected remote server via a virtual network includes selecting the first tunnel or the second tunnel between the mobile device and the selected remote server via the first wireless network or selecting the third tunnel or the fourth tunnel between the mobile device and the selected remote server via the second wireless network based on the user application.

[0005] In some examples, the first service includes an Internet service and the second service includes a tethering service. Optionally, the method further includes: after sending the data from the user application to the selected remote server, connecting the mobile device to a third wireless network through the data processing hardware. The third wireless network includes a user wireless fidelity (Wi-Fi) network. In this example, the method further includes sending the data from the user application to the destination server through the data processing hardware on the third wireless network.

[0006] Selecting a remote server from a plurality of remote servers may be based on the geographic location of each of the plurality of remote servers. In some embodiments, the method further includes, before selecting the remote server from the plurality of remote servers, selecting a preferred wireless network from the first wireless network or the second wireless network based on network preferences by data processing hardware. Here, selecting the remote server from the plurality of remote servers is based on the selected preferred wireless network. In some examples, the method further includes, after selecting the preferred wireless network, selecting a second remote server from the plurality of remote servers by data processing hardware based on the geographic location of each of the plurality of remote servers. The method may also include establishing a second virtual network between the mobile device and the selected second remote server by data processing hardware, and sending data from the user application to the selected second remote server on the second virtual network by data processing hardware. The data, when received by the selected second remote server, causes the selected second remote server to route the data to the destination server.

[0007] Optionally, the user application includes a virtual private network (VPN) application. The destination server may include a VPN server associated with the VPN application. In some embodiments, the method further includes determining, by data processing hardware, whether the first wireless network is associated with the same MVNO as the second wireless network. In some examples, the first wireless network includes a cellular network and the second wireless network includes a Wireless Fidelity (Wi-Fi) network.

[0008] Another aspect of the present disclosure provides a system for establishing a virtual operator network for a mobile device. The system includes data processing hardware of a mobile device and memory hardware that communicates with the data processing hardware. The memory hardware stores instructions that cause the data processing hardware to perform operations when executed on the data processing hardware. The operation includes, for a mobile device that executes a user application and is simultaneously connected to a first wireless network associated with a mobile virtual network operator (MVNO) and a second wireless network associated with the same MVNO, selecting a remote server from a plurality of remote servers. Each of the plurality of remote servers is associated with a geographic location. The operation also includes establishing a virtual network between the mobile device and the selected remote server. The virtual network includes at least one tunnel on the first wireless network between the mobile device and the selected remote server and at least one tunnel on the second wireless network between the mobile device and the selected remote server. The operation also includes sending data from the user application to the selected remote server via one of the at least one tunnel on the first wireless network between the mobile device and the selected remote server or via one of the at least one tunnel on the second wireless network between the mobile device and the selected remote server. The data causes the selected remote server to route the data to the destination server when received by the selected remote server.

[0009] This aspect may include one or more of the following optional features. In some embodiments, at least one tunnel between the mobile device and the selected remote server on the first wireless network includes a first tunnel supporting data for a first service and a second tunnel supporting data for a second service. At least one tunnel between the mobile device and the selected remote server on the second wireless network may include a third tunnel supporting data for the first service and a fourth tunnel supporting data for the second service. In this embodiment, sending data from a user application to a selected remote server via a virtual network includes selecting the first tunnel or the second tunnel between the mobile device and the selected remote server via the first wireless network or selecting the third tunnel or the fourth tunnel between the mobile device and the selected remote server via the second wireless network based on the user application.

[0010] In some examples, the first service includes an Internet service and the second service includes a tethered service. Optionally, the operation also includes: after sending the data from the user application to the selected remote server, connecting the mobile device to a third wireless network. The third wireless network includes a user wireless fidelity (Wi-Fi) network. In this example, the operation also includes sending the data from the user application to the destination server on the third wireless network.

[0011] Selecting a remote server from a plurality of remote servers may be based on the geographic location of each of the plurality of remote servers. In some embodiments, the operation further includes, before selecting the remote server from the plurality of remote servers, selecting a preferred wireless network from the first wireless network or the second wireless network based on network preferences. Here, selecting the remote server from the plurality of remote servers is based on the selected preferred wireless network. In some examples, the operation further includes, after selecting the preferred wireless network, selecting a second remote server from the plurality of remote servers based on the geographic location of each of the plurality of remote servers. The operation may also include establishing a second virtual network between the mobile device and the selected second remote server, and sending data from the user application to the selected second remote server on the second virtual network. The data, when received by the selected second remote server, causes the selected second remote server to route the data to the destination server.

[0012] Optionally, the user application includes a virtual private network (VPN) application. The destination server may include a VPN server associated with the VPN application. In some embodiments, the operation also includes determining whether the first wireless network is associated with the same MVNO as the second wireless network. In some examples, the first wireless network includes a cellular network and the second wireless network includes a Wireless Fidelity (Wi-Fi) network.

[0013] The details of one or more embodiments of the disclosure are set forth in the accompanying drawings and the description below. Other aspects, features, and advantages will be apparent from the description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Figure 1 is a schematic diagram of an example system for providing a virtual carrier network for mobile devices over two or more carrier wireless networks.

[0015] Figure 2 is a schematic diagram of exemplary components of a virtual operator network manager.

[0016] Figure 3 is a schematic diagram of a virtual operator network manager and a user network manager.

[0017] Figure 4A and4B The diagram is a diagram of a virtual operator network manager switching a mobility anchor point.

[0018] Figure 5 is a flow diagram of an example arrangement of operations of a method for providing a virtual operator network for a mobile device.

[0019] Figure 6 is a schematic diagram of an example computing device that can be used to implement the systems and methods described herein.

[0020] Like reference numbers in the various drawings indicate like elements. DETAILED DESCRIPTION

[0021] Carriers, such as mobile network operators (MNOs) and mobile virtual network operators (MVNOs), are increasingly providing connectivity over multiple heterogeneous network types (e.g., cellular and Wi-Fi networks). Carriers can use opportunistic data offload to reduce data costs by shifting traffic to cheaper networks (e.g., from cellular to Wi-Fi). However, conventional mobile operating systems (OS) do not provide abstraction of the underlying networks, which can result in poor user experience and / or decreased connectivity when mobile devices switch between networks.

[0022] Current techniques for addressing this problem typically involve extending a virtual private network (VPN) across multiple wireless networks to a remote VPN server. While this does provide some network abstraction for users and mobile devices, it also has some disadvantages. For example, VPN aggregates traffic from all networks connected to the mobile device, including user-mediated networks (e.g., home Wi-Fi networks). Since data on user-mediated networks must now go through the VPN service, this creates privacy issues and typically requires at least the user's consent. In addition, VPNs do not provide any mobility for multiple profiles or different data services (e.g., tethering) on ​​the user's device. That is, typically all profiles and all data services must use the same VPN. As yet another example, VPNs restrict users from using their own VPN applications. In addition, in many cases, VPNs are user-controllable and therefore can only provide a leaky abstraction at best.

[0023] Embodiments herein relate to a virtual operator network manager that is executed on a user device to establish a virtual network (e.g., a virtual operator network) between the user device and multiple wireless networks associated with a wireless network operator (e.g., a mobile virtual network operator (MVNO)). The virtual network includes a remote server selected from a plurality of remote servers to serve as a mobility anchor. The virtual network also includes one or more tunnels between the user device and the selected remote server. An application executed on the user device sends and receives data to the selected remote server through the one or more tunnels of the virtual network, and the selected remote server routes the data to a destination server.

[0024] Reference now Figure 1 In some embodiments, an example wireless communication environment (e.g., system) 100 includes a mobile device 110 (also referred to herein as a "user device") that communicates with an external network 40 simultaneously through at least two wireless networks 120, 120a-b. For example, the user device 110 can communicate with the external network 40 through a carrier cellular network 120a and a carrier Wi-Fi network 120b. These wireless networks 120 are merely illustrative, and the user device 110 can communicate with the external network 40 using any number of other types of wireless networks (e.g., Citizens Broadband Radio Service (CBRS), Bluetooth, etc.). The carrier cellular network 120a may include a general packet radio service (GPRS) network, a universal mobile telecommunications system (UMTS) network, a high speed packet access (HSPA) network, an enhanced HSPA (H+) network, a global system for mobile communications (GSM) enhanced data rates (EDGE) network, a long term evolution (LTE) radio access network (RAN) (e.g., 4G / 5G LTE) or a 5G NR (new radio) network, which supports, for example, radio transmission of data packets 50 (also referred to herein as "data") and / or other services from the external network 40 to the user device 110 through a base station such as a macro cell evolved node B (MeNB). The Wi-Fi network 120b may include any version of Wi-Fi (e.g., 802.11n, 802.11ac, etc.) that also supports radio transmission of data packets 50. In some examples, the user device 110 is simultaneously connected to multiple wireless networks 120 of the same type. For example, the user device 110 may include the capability to simultaneously connect to two separate operator cellular networks 120a operated by different operators 70 or multiple operator Wi-Fi networks 120b with different access points.

[0025] The carrier cellular network 120a is associated with a mobile network operator (MNO) or a mobile virtual network operator (MNVO) that provides wireless communication services to subscribing user devices 110 through the carrier cellular network 120a. An MNO or MVNO may also be referred to as a wireless service provider, a wireless operator, a cellular company, a mobile network operator, or a mobile network operator. The term "carrier" may be used herein to refer to an MNO or an MVNO. The term "wireless network operator" may be used herein to refer to an entity that operates or coordinates a wireless network 120, which may include an operator (e.g., an MNO or MVNO) that operates / coordinates a carrier-mediated wireless network 120 or a user 10 that operates / coordinates a user-mediated wireless network 120.

[0026] As used herein, an operator-coordinated wireless network 120 (also referred to herein simply as "operator wireless network 120") includes any wireless network 120 managed or coordinated or controlled by a single specific operator 70 (e.g., an MNO or MVNO) to which a user device 110 subscribes to services provided by that operator. That is, the user 10 does not control or manage the wireless network 120. An operator-coordinated network 120 is a network for which an operator has provided credentials, such as a SIM profile provided by the operator or an operator-provided application that can be authenticated by a SIM profile provided by the operator has provided credentials. For example, a SIM profile provided on a universal integrated circuit card (UICC) allows a user device 110 to attach to and authenticate with an operator cellular network 120a. Alternatively, an operator application is authenticated by an operating system (OS) 111 to access a SIM profile. The operator application can be cryptographically signed using the operator's private key and authenticated by an application signature contained in the SIM profile. The operator application is authorized by the operating system 111 to provide credentials for accessing, for example, an operator Wi-Fi access point. In some examples, an authenticated operator application may provide a WPA password or Hotspot 2.0 certificate; or, for open networks that do not require credentials to connect to an access point, the operator enables the user device 110 to connect to the access point without user intervention, or enables a suggestion to the user to connect to the network, which the user can accept or decline. In the case of an operator-coordinated connection to an open wireless network 120, additional steps may be required to satisfy the requirements of a "captive portal" to obtain Internet access, such as accepting terms and conditions, or providing a password or other login information. For operator-coordinated connections to an open network 120 using a captive portal, the operator may accept the terms on behalf of the user or provide an email address, password, or other login information in an automated manner. Automated means may mean providing login information through a protocol such as WISPr or through automatic submission of a web form. A single user device 110 may support multiple operator-coordinated wireless networks 120 simultaneously.

[0027] A user-coordinated wireless network 120 includes any wireless network 120 associated with a wireless network operator (e.g., a carrier) 70 to which the user device 110 is not explicitly subscribed, such that the user-coordinated wireless network 120 is ultimately managed or coordinated or controlled by the user 10. A user-coordinated network is one for which the user has provided their own credentials (if necessary) (e.g., a WPA password or a user-installed certificate (e.g., a Hotspot 2.0 certificate)) to connect to, for example, an access point; or, for an open network that does not require credentials to connect to an access point, the user has taken an affirmative action to connect to the network, such as selecting the network from a list or accepting a suggestion made by the operating system. Any selection can only occur when the device is first exposed to the network. On a user-coordinated open network, additional manual steps may be required to satisfy "captive portal" requirements to gain Internet access, such as accepting terms and conditions, or providing an email address, password, or other login information.

[0028] A single device (e.g., an access point) can provide access to both a user-coordinated network and an operator-coordinated network. A user who owns, rents, or controls an AP can enable other users to use the access point to access the Internet, for example, the user creates a WEP password to provide to other users. The access point provides access to the user-coordinated network when accessed in this manner. A cable service provider or DSL service provider can operate an operator-coordinated network service from the same access point. Devices with HS2.0 certificates provided by the operator app (applet) will automatically connect to the same access point. No user intervention or password is required.

[0029] In an example where a user has an Internet service contract provided by a wireless network operator 70 corresponding to an Internet service provider (ISP) and can therefore select any one of a plurality of different wireless-enabled user devices 110 to connect to the Internet service at any given time, the wireless network 120 (e.g., operator Wi-Fi network 120b) that the selected user device 110 accesses to use the Internet service corresponds to the user-coordinated wireless network 120. Here, the user 10 can control a modem connected to the Internet service and a wireless access point (AP) (e.g., a wireless router) that communicates with the modem to provide a local area network (LAN), and the selected user device 110 can establish a wireless connection with the LAN to use the Internet service. In other examples, the user-coordinated wireless network 120 can simply include a Bluetooth connection (or other wireless connection) between the user device 110 and another device that is close to the user device 110. On the other hand, when a specific user device 110 associated with the user 10 subscribes to wireless communication services provided by a specific operator 70 (e.g., an MNO or MVNO), the wireless network 120 (e.g., a cellular and / or operator Wi-Fi network 120a, 120b) accessed by the subscribing user device 110 to receive the wireless communication services corresponds to the operator-coordinated wireless network 120. In some embodiments, a subscriber identity module (SIM) installed on the user device 110 includes a profile, which is defined by the specific operator 70 to enable and authenticate the user device 110 to connect to the operator-coordinated wireless network 120 associated with the specific operator 70. However, if the user 10 wants to connect other user devices 110 to these operator-coordinated wireless networks 120 associated with the specific operator 70, each of these other user devices 110 must be individually subscribed to the wireless communication services provided by the specific operator 70. In these embodiments, the user device 110 can freely connect to the user-coordinated wireless network 120 associated with one or more wireless network operators 70 other than the specific operator 70. Although in the illustrated example the user device 110 is depicted as a mobile device 110 , the user device 110 may include any device capable of connecting to the wireless network 120 , such as, but not limited to, a tablet computer, a laptop computer, a desktop computer, a smart watch, a smart speaker, a smart display, a smart appliance, etc.

[0030] The user device 110 includes computing resources 112 (e.g., data processing hardware) and / or storage resources 114 (e.g., memory hardware). The data processing hardware 112 executes an operating system 111 and one or more user software applications 116. The data processing hardware 112 also executes a virtual operator network manager 150. In some embodiments, the operating system 111 executes the functions of the virtual operator network manager 150.

[0031] User device 110 may use a variety of different operating systems 111. In the example where user device 110 is a mobile device, user device 110 may run an operating system including, but not limited to, the operating system developed by Google Inc. Developed by Apple Or WINDOWS developed by Microsoft Therefore, the operating system 111 running on the user device 110 may include but is not limited to or Windows In some examples, the user device can run an operating system including, but not limited to, MICROSOFT Apple's MAC or Linux.

[0032] The user equipment 110 also includes at least one modem 165 (also referred to as a baseband or baseband processor). The modem 165 includes one or more antennas that enable the user equipment to communicate wirelessly with the operator wireless network 120. The modem 165 can communicate with one or more radios operating at multiple frequencies (e.g., 700 MHz, 900 MHz, 2.4 GHz, 5.0 GHz, etc.) simultaneously. The modem 165 may include various components (processors, memory, etc.) that provide transmit and receive functionality. In some embodiments, the data processing hardware 112 includes the modem 165. That is, in some examples, tasks performed by the data processing hardware 112 may be performed by the modem 165 instead, and vice versa.

[0033] The user device 110 also includes one or more corresponding subscriber identification modules (SIMs) 118 for identifying the user device 110 and connecting it to a wireless network 120 coordinated by a certain type of operator. For example, the SIM 118 may include a corresponding SIM profile having credentials for authorizing the user device 110 to connect to the operator cellular network 120a to access the destination server 60 through the external network 40. Similarly, the SIM 118 may include one or more additional SIM profiles having corresponding credentials for authorizing the user device 110 to connect to wireless networks 120 coordinated by other operators managed by a wireless network operator 70 other than the network operator managing the operator cellular network 120a. In some examples, the one or more SIMs 118 include any combination of one or more embedded SIMs (eSIMs) and one or more physical SIMs.

[0034] A virtual operator network manager 150 (also referred to herein as a "VCN manager 150") establishes a virtual network 30, 30a-b (also referred to herein as a "virtual operator network" or "VCN") between a user device 110 and a remote server 130, 130a-b. As discussed in more detail below, the VCN manager 150 selects a remote server 130 from a plurality of remote servers 130. Each remote server 130 may be associated with a geographic location. In some examples, the geographic locations are different. For example, a first remote server 130a is associated with a geographic location that is at or near a geographic location associated with a data center supporting an operator cellular network 120a. That is, a data packet 50 traversing the operator cellular network 120a is processed by one or more servers (not shown) associated with the operator cellular network 120a. The first remote server 130a may be geographically located near (e.g., "co-sited" or "co-located") one or more servers associated with a data center supporting the operator cellular network 120a. Similarly, the second remote server 130b can be geographically located at or near a data center supporting the operator Wi-Fi network 120b. In other examples, multiple remote servers 130 have the same geographical location. For example, a data center associated with the wireless network 120 includes multiple remote servers 130.

[0035] The VCN manager 150 establishes a virtual network 30 between the mobile device 110 and the selected remote server 130. For example, when the VCN manager 150 selects the first remote server 130a, the VCN manager 150 establishes a first virtual network 30, 30a between the mobile device 110 and the first remote server 130a. Alternatively, when the VCN manager 150 selects the second remote server 130b, the VCN manager 150 establishes a second virtual network 30, 30b between the mobile device 110 and the second remote server 130b. The virtual network 30 includes at least one tunnel 122, 122Aa-n between the mobile device 110 and the selected remote server 130 on a first wireless network 120a (e.g., an operator cellular network 120a) and at least one tunnel 122, 122Ba-n between the mobile device 110 and the selected remote server 130 on a second wireless network 120b (e.g., an operator Wi-Fi network 120b). Each tunnel 122 establishes dedicated network communications over its corresponding wireless network 120 through encapsulation (e.g., using Internet Security Protocol (IPSec), etc.). Each tunnel 122 can independently establish secure communications between the user device 110 and the selected remote server 130, which can include performing key exchanges (e.g., via Internet Key Exchange (IKE)) and establishing encryption and other secure communication procedures. In some embodiments, with the configuration provided by one or more wireless network operators 70 (e.g., via (one or more) SIM 118), the VCN manager 150 uses the IKE library as the control plane and uses IPSec as the data plane. Note that these protocols are merely exemplary and the VCN manager 150 can implement any other protocol.

[0036] The user device 110 executes a user software application 116 that communicates with the destination server 60. For example, the user software application 116 includes an Internet browser, a game application, a messaging application, an email application, and / or any other application that communicates with other devices (e.g., the destination server 60) that are remote from the user device 110 via the wireless network 120. In some examples, the user software application 116 includes a user VPN application and the destination server 60 includes a VPN server associated with the VPN application. The VCN manager 150 sends the data packet 50 from the user software application 116 to the selected remote server 130 through the virtual network 30 via one of the tunnels 122 on one of the operator wireless networks 120 connected to the user device 110. The selected remote server 130, upon receiving the data packet 50, forwards the data packet 50 to the destination server 60 through the external network 40. Similarly, the data packets 50 received by the selected remote server 130 from the destination server 60 (via the external network 40) are sent (via the tunnel 122) to the user device 110 and the user software application 116, thereby establishing two-way communication between the user software application 16 and the destination server 60 via one or more of the wireless networks 120 and the external network 40.

[0037] The external network 40 may be independent of any network associated with the user device 110 or the operator 70 operating the wireless network 120. The destination server 60 may be any remote server to which or from which the user software application 116 executing on the user device 110 sends or receives the data packets 50. For example, the destination server 60 may be a web server that hosts web content.

[0038] A software application (i.e., software resource) may refer to computer software that enables a computing device to perform tasks. In some examples, a software application may be referred to as an "application," "app," or "program." Example applications include, but are not limited to, system diagnostic applications, system management applications, system maintenance applications, word processing applications, spreadsheet applications, messaging applications, media streaming applications, social networking applications, and gaming applications.

[0039] Reference now Figure 2In some embodiments, the user device 110 executes different user software applications (i.e., service applications) 116 for different services and / or capabilities. For example, the user device 110 executes a first service application 116, 116A that requires or uses a first service or capability. The first service application 116A may include a user application that requires access to the Internet, such as a browser or email application. The user device 110 may also execute a second service application 116, 116B that requires or uses a second service or capability. For example, the second service application 116B includes a platform application (e.g., an OS application), such as a tethering application that tethers the user device 110 to other nearby devices. The user device 110 may execute any combination of various types of service applications 116 (e.g., third service applications) that support or require further services or capabilities such as short message service (SMS), multimedia messaging service (MMS), rich communication service (RCS), assisted global positioning system (GPS), voice over Internet protocol (VoIP), etc.

[0040] In some examples, the VCN manager 150 includes one or more service connectors 210, 210a-b, each service connector interfacing with one or more types of service applications 116. For example, the first service connector 210a receives data packets 50 from the first service application 116A, and the second service connector 210b receives data packets 50 from the second service application 116B. Each service connector 210 can establish a tunnel 122 between the user device 110 and the selected remote server 130 for each wireless network 120. In the illustrated example, the first service connector 210a establishes a first tunnel 122a between the user device 110 and the selected remote server 130 on the first wireless network 120a for data 50 received from the first service application 116A. The second service connector 210b establishes a second tunnel 122b between the user device 110 and the selected remote server (i.e., the selected mobility anchor) 130 on the first wireless network 120a for data 50 received from the second service application 116B. Similarly, the first service connector 210a establishes a third tunnel 122c between the user device 110 and the selected remote server 130 on the second wireless network 120b for data 50 received from the first service application 116A, and the second service connector 210b establishes a fourth tunnel 122d between the user device 110 and the selected remote server 130 on the second wireless network 120b for data 50 received from the second service application 116b.

[0041] Thus, in this example, the tunnel 122 between the user device 110 and the selected remote server 130 on the first wireless network 120a includes a first tunnel 122a supporting data 50 of a first service (e.g., an Internet service) transmitted by the first service application 116A and a second tunnel 122b supporting data 50 of a second service (e.g., a tethered service) transmitted by the second service application 116B. Similarly, the tunnel 122 between the user device 110 and the selected remote server 130 on the second wireless network 120b includes a third tunnel 122c supporting data 50 of the first service transmitted by the first service application 116A and a fourth tunnel 122d supporting data 50 of the second service transmitted by the second service application 116B. In some embodiments, the VCN manager 150 selects the first tunnel 122a or the second tunnel 122b between the user device 110 and the selected remote server 130 via the first wireless network 120a, or selects the third tunnel 122c or the fourth tunnel 122d between the user device 110 and the selected remote server 130 via the second wireless network 120b, based on the corresponding user software application 116 (e.g., which user software application 116 sends the data 50), to transmit the data 50 from the service application 116 to the selected remote server 130 through the virtual network 30.

[0042] The service connector 210 abstracts the physical wireless network 120 from the user software application 116 (i.e., regardless of which tunnel 122 or physical wireless network 120 the service connector 210 chooses to send the data 50, the connection appears the same to the user software application 116), while maintaining the flexibility of isolating data services. The wireless network operator 70 and / or the user 10 may use data service isolation for a variety of reasons, including pricing, priority, subscription level, etc. For example, an MNO or MVNO may bill or track data 50 sent through a tethered service separately from standard Internet data 50, even if both services ultimately communicate with the same destination server 60. At the same time, the network abstraction provided by the service connector 210 allows the VCN manager 150 to unilaterally select which wireless network 120 to send the data 50 over without affecting the user software application 116, because the VCN manager 150 instead provides a single virtualized network connection to the user software application 116. Therefore, there is no strict correlation between the services provided by the virtual network 30 and the underlying physical wireless network 120. That is, the VCN manager 150 can use a single tunnel 122 to tunnel all services or break each individual service into a different independent tunnel 122. In other words, the tunnel 122 can expose, remap services, or hide services from virtual endpoints. When connected to the 5G wireless network 120 and 5G slicing is in effect, the VCN manager 150 can treat each slicing as an underlying service and can remap the exposed services appropriately.

[0043] In some embodiments, the VCN manager 150 only provides the virtual network 30 to the user 10 and the user software application 116, such that the user 10 and / or the user software application 116 have no visibility or control over the physical carrier wireless network 120 and only interface with a connection to the virtual network 30. Thus, regardless of the underlying wireless network 120 used, the VCN manager 150 provides the user 10 and / or the user software application 116 with a consistent network connection that provides continuous and reliable connectivity, and the VCN manager 150 treats the physical wireless network 120 as an implementation detail and protects the data 50 transmitted over the wireless network 120.

[0044] Because each service connector 210 can establish multiple tunnels 122, each tunnel 122 supports different capabilities, entities such as MVNOs can configure their networks as flexibly as possible. For example, MNO-bound services can continue to operate normally, while service connector 210 specifically tunnels MVNO-bound services.

[0045] In some embodiments, the VCN manager 150 restricts or otherwise blocks certain user software applications 116 from accessing certain physical wireless networks 120 or service connectors 210. That is, the VCN manager 150 may impose access restrictions 116 on some or all user software applications executing on the user device 110. For example, the VCN manager 150 may restrict advanced user software applications 116 (e.g., email applications) from all service connectors 210 except for service connectors 210 that support Internet capabilities. That is, the VCN manager 150 may restrict email applications from accessing, for example, service connectors 210 that support tethering. In yet another example, the VCN manager 150 may restrict operator applications 160 (i.e., applications associated with a particular wireless network operator 70) from accessing wireless networks 120 of other operators. That is, the service connector 210 may aggregate connections only to wireless networks 120 operated by the same operator 70 and prohibit service applications (i.e., operator applications) 116 from accessing other operator wireless networks 120 when the user device 110 is connected to wireless networks 120 from more than one wireless network operator 70. Optionally, VCN manager 150 limits user software applications 116 access or visibility to location-sensitive wireless networks 120 (eg, carrier Wi-Fi networks) unless user software applications 116 provide location permission.

[0046] In some embodiments, the VCN manager 150 determines the wireless network operator 70 associated with each wireless network 120 connected to the user device 110. In some examples, the VCN manager 150 determines whether the first wireless network 120a is associated with the same network operator 70 as the second wireless network 120b. For example, the VCN manager 150 can query one or more operator applications 116 installed and / or executed on the user device 110. The operator applications 116 can each be associated with a specific operator / wireless network operator 70 (e.g., an MNO or MVNO). The wireless network operator 70 can digitally sign the operator application 116, and the VCN manager 150 can verify the digital signature through a cryptographic key stored or associated with the SIM 118 of the user device 110.

[0047] VCN manager 150 may classify each user software application 116 and determine access restrictions based on the classification. For example, VCN manager 150 may classify applications 116 as platform (i.e., OS) applications, system applications, operator applications, and user applications. VCN manager 150 may control what wireless networks 120 and service connectors 210 are visible and / or accessible based on the classification of user software applications 116.

[0048] In some examples, the VCN manager 150 manages the virtual network 30 across multiple profiles defined by one or more SIMs 118 of the user device 110. For example, some users 10 may include both a work profile and a personal profile on the user device 110. These profiles may subscribe to the same or different wireless network operators 70. The VCN manager 150 may adjust which wireless networks 120 are included in the virtual network 30, preferred wireless networks, etc. based on the currently active profile(s).

[0049] Reference now Figure 3 , in some embodiments, the user device 110 is connected to a user-coordinated network 120, 120U, such as a home Wi-Fi network. Here, in addition to the VCN manager 150, the user device 110 also executes a user network manager 310. In this example, the user software application 116 (and / or the user 10 and / or the OS 111) selects to communicate with the destination server 60 via the VCN manager 150 through the virtual network 30 (i.e., one of the operator wireless networks 120) or via the user-coordinated network 120U through the user network manager 310. That is, in some examples, the user-coordinated network 120U is independent of the VCN manager 150 and the virtual network 30. The user network manager 310 sends the data packet 50 from the user device 110 to the destination server 60 via the user-coordinated network 120U to the destination server 60 (and possibly through additional external networks) and bypasses the VCN manager 150, the virtual network 30, and the selected remote server 130. Thus, data 50 traversing the user-mediated network 120U is not received by the remote server 130 , which alleviates privacy and consent issues.

[0050] Reference now Figure 4AIn some embodiments, the VCN manager 150 selects a remote server 130 based on a different geographic location of each of the plurality of remote servers 130. In the illustrated example, the user device 110 is located at the residence 410 of the user 10 and is within range of the operator Wi-Fi network 120b. Based on the network preferences 450, the VCN manager 150 selects the operator Wi-Fi network 120b as the preferred wireless network 120 over the operator cellular network 120a. The network preferences 450 may include factors such as cost, reliability, latency, congestion, bandwidth, location, transmission type, domain name system (DNS) privacy, cellular radio access technology (RAT), signal strength, current active link, link unreliability, movement or speed of the user device 110, and the like. For example, when in range, the operator Wi-Fi network 120b tends to be cheaper and more reliable than the operator cellular network 120a, and thus the operator Wi-Fi network 120b is sometimes preferred over the operator cellular network 120a when available. The VCN manager 150 may receive network statistics for one or more of the connected wireless networks 120 that affect the network preferences 450. The wireless network operator 70 may indicate a portion of the network preferences 450 (eg, via the user software application 116 or the SIM 118).

[0051] VCN manager 150 may select a remote server 130 based on the selected preferred wireless network and / or the geographic location of remote server 130. Figure 4A In an example of, remote server 130b is geographically located at or near a data center of carrier Wi-Fi network 120b, and remote server 130a is geographically located at or near a different data center of carrier cellular network 120a. In the event that user device 110 primarily sends data 50 via carrier Wi-Fi network 120b, as opposed to carrier cellular network 120a (e.g., due to the geographic location of user device 110, preferred wireless network 120, network preference 450, etc.), VCN manager 150 selects remote server 130b over, for example, remote server 130a because remote server 130b is closer to the carrier Wi-Fi network data center, which provides generally reduced latency for data 50 due to the shorter distance that data 50 must travel.

[0052] After selecting the remote server 130b, the VCN manager 150 establishes the virtual network 30 between the user device 110 and the selected remote server 130b via the tunnel 122 on both the carrier cellular network 120a and the carrier Wi-Fi network 120b. The user software application 116 sends the data 50 via the tunnel 122 to the selected remote server 130b, which in turn routes the data 50 to the destination server 60 through the external network 40.

[0053] Reference now Figure 4B , in this example, the user 10 is traveling via vehicle 420. Here, the VCN manager 150 may select a second remote server from the plurality of remote servers 130 based on the different geographic locations of each of the plurality of remote servers 130. For example, due to the movement of the user device 110 within the vehicle 420, the operator Wi-Fi network 120b is no longer a viable preferred wireless network 120 and the operator cellular network 120a becomes the preferred wireless network 120. In some examples, this causes the VCN manager 150 to select a new “mobility anchor” (i.e., remote server 130) that is more suitable for the new preferred wireless network 120. Here, the VCN manager 150 selects remote server 130a over remote server 130b because remote server 130a is geographically located at or near a data center of the operator cellular network 120a.

[0054] In some embodiments, the VCN manager 150 establishes a second virtual network 30 between the user device 110 and the selected remote server 130a over the operator cellular network 120a and the operator Wi-Fi network 120b via the tunnel 122. The user software application 116 sends data 50 to the selected remote server 130a via the tunnel 122, which in turn routes the data 50 to the destination server 60 via the external network 40.

[0055] The VCN manager 150 may select a different remote server 130 (i.e., a mobility anchor) for many other reasons. For example, when a remote server requires maintenance or suffers a failure, the VCN manager 150 may select a different remote server 130. The VCN manager 150 may select a different remote server 130 based on bit-miles, latency, and throughput issues. The VCN manager 150 may maintain the first virtual network 30 with the previously selected remote server 130 (i.e., maintain two separate virtual networks 30) after establishing the second virtual network 30 with the newly selected remote server 130 to maintain mobility for a period of time before terminating the first virtual network 30. That is, the mobility anchor may be deprecated for a period of time before termination. The VCN manager 150 may select a remote server 130 (i.e., a mobility anchor) based on the services supported by the remote server 130. That is, not all remote servers 130 may support all services. Some geographic locations may include multiple remote servers 130, and each remote server 130 may support a different set of services with some overlap or no overlap. Thus, the VCN manager 150 may select a remote server 130 even in the same geographic location for certain services or for other purposes such as load balancing, maintenance, and the like.

[0056] Thus, the VCN manager 150 provides a single unified network abstraction over one or more physical wireless networks 120 and migrates network connectivity between the physical wireless networks 120 for the user 10 and the user software application 116. The VCN manager 150 virtualizes each data service (e.g., Internet, MMS, tethering, VoIP, etc.) provided simultaneously by the user device 110 and appropriately maps each service to the physical operator wireless network 120 connected to the user device 110. This allows the VCN manager 150 to fully simulate a cellular network connection to both the user 10 and the user software application 116. The VCN manager 150 can handoff between different mobility anchors (i.e., remote servers 130) to provide the MNO or MVNO with the ability to load balance, perform maintenance, and perform geographic optimization. The VCN manager 150 minimizes performance overhead compared to conventional virtualization layers while also allowing the wireless network operator 70 to improve network reliability by switching to different mobility anchors during network or infrastructure changes. Although the examples herein generally show user device 110 communicating with first wireless network 120a and second wireless network 120b, user device 110 and VCN manager 150 may connect to and manage any number of operator wireless networks 120.

[0057] Figure 5is a flow chart of an exemplary arrangement of operations of a method 500 for establishing a virtual operator network with a mobile device 110. The method 500 includes, at operation 502, for a mobile device 110 executing a user application 116 and simultaneously connected to a first wireless network 120a associated with a mobile virtual network operator (MVNO) and a second wireless network 120b associated with the same MVNO, selecting, by the data processing hardware 112, one of a plurality of remote servers 130. Each remote server 130 of the plurality of remote servers 130 is associated with a different geographic location.

[0058] At operation 504, the method 500 includes establishing, by the data processing hardware 112, a virtual network 30 between the mobile device 110 and the selected remote server 130. The virtual network 30 includes at least one tunnel 122 between the mobile device 110 and the selected remote server 130 on the first wireless network 120a and at least one tunnel 122 between the mobile device 110 and the selected remote server 130 on the second wireless network 120b.

[0059] At operation 506, the method 500 includes sending data 50 from the user software application 116 to the selected remote server 130 through the virtual network 30 via one of the at least one tunnels 122 on the first wireless network 120a between the mobile device 110 and the selected remote server 130 or via one of the at least one tunnels 122 on the second wireless network 120b between the mobile device 110 and the selected remote server 130 through the data processing hardware 122. The data 50, when received by the selected remote server 130, causes the selected remote server 130 to route the data to the destination server 60.

[0060] Figure 6 6 is a schematic diagram of an example computing device 600 that can be used to implement the systems and methods described in this document. Computing device 600 is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The components shown here, their connections and relationships, and their functions are merely exemplary and are not meant to limit implementations of the inventions described and / or claimed in this document.

[0061] The computing device 600 includes a processor 610, a memory 620, a storage device 630, a high-speed interface / controller 640 connected to the memory 620 and a high-speed expansion port 650, and a low-speed interface / controller 660 connected to a low-speed bus 670 and the storage device 630. Each of the components 610, 620, 630, 640, 650, and 660 is interconnected using various buses and can be installed on a common motherboard or in other appropriate ways. The processor 610 can process instructions for execution within the computing device 600, including instructions stored in the memory 620 or on the storage device 630, to display graphical information for a graphical user interface (GUI) on an external input / output device such as a display 680 connected to the high-speed interface 640. In other embodiments, multiple processors and / or multiple buses and multiple memories and multiple types of memories can be used as appropriate. In addition, multiple computing devices 600 can be connected, each device providing part of the necessary operations (for example, as a server group, a blade server group, or a multi-processor system).

[0062] Memory 620 stores information non-temporarily within computing device 600. Memory 620 may be a computer-readable medium, a volatile memory unit(s), or a non-volatile memory unit(s). Non-temporary memory 620 may be a physical device used to store programs (e.g., sequences of instructions) or data (e.g., program state information) on a temporary or permanent basis for use by computing device 600. Examples of non-volatile memory include, but are not limited to, flash memory and read-only memory (ROM) / programmable read-only memory (PROM) / erasable programmable read-only memory (EPROM) / electrically erasable programmable read-only memory (EEPROM) (e.g., commonly used for firmware, such as bootloaders). Examples of volatile memory include, but are not limited to, random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), phase change memory (PCM), and disk or tape.

[0063] The storage device 630 can provide mass storage for the computing device 600. In some embodiments, the storage device 630 is a computer readable medium. In various embodiments, the storage device 630 can be a floppy disk device, a hard disk device, an optical disk device or a tape device, a flash memory or other similar solid-state memory device or device array, including a device in a storage area network or other configuration. In other embodiments, a computer program product is tangibly embodied in an information carrier. The computer program product contains instructions that perform one or more methods (such as the methods described above) when executed. The information carrier is a computer or machine readable medium, such as a memory 620, a storage device 630, or a memory on a processor 610.

[0064] The high-speed controller 640 manages bandwidth-intensive operations of the computing device 600, while the low-speed controller 660 manages less bandwidth-intensive operations. Such a division of responsibilities is exemplary only. In some embodiments, the high-speed controller 640 is coupled to the memory 620, the display 680 (e.g., through a graphics processor or accelerator), and to a high-speed expansion port 650 that can accept various expansion cards (not shown). In some embodiments, the low-speed controller 660 is coupled to the storage device 630 and the low-speed expansion port 690. The low-speed expansion port 690 can include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet), and can be coupled to one or more input / output devices, such as a keyboard, a pointing device, a scanner, or a network device (such as a switch or router), for example, through a network adapter.

[0065] As shown, computing device 600 may be implemented in a variety of different forms. For example, it may be implemented as a standard server 600a or multiple times in a group of such servers 600a, as a laptop computer 600b, or as part of a rack server system 600c.

[0066] Various implementations of the systems and techniques described herein can be implemented in digital electronic and / or optical circuits, integrated circuits, specially designed ASICs (application specific integrated circuits), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system that includes at least one programmable processor, which can be special purpose or general purpose, coupled to receive data and instructions from and transmit data and instructions to a storage system, at least one input device, and at least one output device.

[0067] These computer programs (also referred to as programs, software, software applications, or code) include machine instructions for a programmable processor and may be implemented in high-level procedural and / or object-oriented programming languages ​​and / or in assembly / machine language. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any computer program product, non-transitory computer-readable medium, apparatus, and / or device (e.g., disk, optical disk, memory, programmable logic device (PLD)) for providing machine instructions and / or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term "machine-readable signal" refers to any signal for providing machine instructions and / or data to a programmable processor.

[0068] The processes and logic flows described in this specification can be performed by one or more programmable processors (also referred to as data processing hardware), which execute one or more computer programs to perform functions by operating on input data and generating outputs. The processes and logic flows can also be performed by dedicated logic circuits, such as FPGAs (field programmable gate arrays) or ASICs (application-specific integrated circuits). Processors suitable for executing computer programs include, for example, general-purpose and special-purpose microprocessors, and any one or more processors of any kind of digital computer. Typically, the processor will receive instructions and data from a read-only memory or a random access memory or both. The basic elements of a computer are a processor for executing instructions and one or more memory devices for storing instructions and data. Typically, a computer will also include or be operatively connected to receive data from one or more mass storage devices (e.g., magnetic disks, magneto-optical disks, or optical disks) for storing data or to transfer data to the one or more mass storage devices or to receive and transmit data. However, a computer does not necessarily have such a device. Computer readable media suitable for storing computer program instructions and data include all forms of nonvolatile memory, media and memory devices, including, for example, semiconductor memory devices, such as EPROM, EEPROM and flash memory devices; magnetic disks, such as internal hard disks or removable disks; magneto-optical disks; and CD ROM and DVD-ROM disks. The processor and memory may be supplemented by or incorporated in special purpose logic circuitry.

[0069] To provide interaction with a user, one or more aspects of the present disclosure may be implemented on a computer having a display device, such as a CRT (cathode ray tube), LCD (liquid crystal display) monitor, or touch screen, and optionally having a keyboard and a pointing device (e.g., a mouse or trackball), for displaying information to a user, and the user may provide input to the computer through the keyboard and pointing device. Other kinds of devices may also be used to provide interaction with a user; for example, the feedback provided to the user may be any form of sensory feedback, such as visual feedback, auditory feedback, or tactile feedback; and input from the user may be received in any form, including sound, voice, or tactile input. In addition, the computer may interact with a user by sending and receiving documents to and from a device used by the user; for example, by sending a web page to a web browser in response to a request received from a web browser on a user's client device.

[0070] Many embodiments have been described. However, it should be understood that various modifications can be made without departing from the spirit and scope of the present disclosure. Therefore, other embodiments are within the scope of the appended claims.

Claims

1. A method for providing a virtual network for a mobile device, the method comprising: selecting, by data processing hardware of a mobile device executing a user application, one of a first wireless network associated with a mobile virtual network operator MVNO and a second wireless network associated with the same MVNO; selecting, by the data processing hardware, a remote server from a plurality of remote servers based on the one of the first wireless network and the second wireless network, the first wireless network and the second wireless network both being associated with the same MVNO, each remote server in the plurality of remote servers being associated with a geographic location; establishing, by the data processing hardware, a virtual network between the mobile device and the selected remote server, the virtual network comprising at least one tunnel between the mobile device and the selected remote server over the one of the first wireless network and the second wireless network; and Data is sent from the user application to the selected remote server through the data processing hardware, via one of the at least one tunnel between the mobile device and the selected remote server on one of the first wireless network and the second wireless network, and through the virtual network, the data causing the selected remote server to route the data to a destination server when received by the selected remote server.

2. The method according to claim 1, wherein: at least one tunnel between the mobile device and the selected remote server on the first wireless network includes a first tunnel supporting data for a first service and a second tunnel supporting data for a second service; the at least one tunnel between the mobile device and the selected remote server on the second wireless network comprising a third tunnel supporting data for the first service and a fourth tunnel supporting data for the second service; and Sending data from the user application to the selected remote server through the virtual network includes: selecting the first tunnel or the second tunnel between the mobile device and the selected remote server via the first wireless network based on the user application, or selecting the third tunnel or the fourth tunnel between the mobile device and the selected remote server via the second wireless network.

3. The method according to claim 2, wherein: The first service comprises an Internet service and the second service comprises a tethered service.

4. The method according to any one of claims 1 to 3, further comprising: After sending the data from the user application to the selected remote server: connecting the mobile device to a third wireless network via the data processing hardware, the third wireless network comprising a user Wireless Fidelity Wi-Fi network; and Data is sent from the user application to the destination server over the third wireless network by the data processing hardware.

5. The method according to any one of claims 1 to 4, wherein: Selecting the remote server from the plurality of remote servers is based on a geographic location of each remote server in the plurality of remote servers.

6. The method of claim 5, further comprising, before selecting the remote server from the plurality of remote servers: selecting, by the data processing hardware, a preferred wireless network from the first wireless network or the second wireless network based on network preference, in, The selection of the remote server from among the plurality of remote servers is based on the selected preferred wireless network.

7. The method of claim 6, further comprising, after selecting the preferred wireless network: selecting, by the data processing hardware, a second remote server from the plurality of remote servers based on a geographic location of each remote server in the plurality of remote servers; establishing, by the data processing hardware, a second virtual network between the mobile device and a selected second remote server; and Data is sent from the user application to the selected second remote server over the second virtual network by the data processing hardware, which, when received by the selected second remote server, causes the selected second remote server to route the data to the destination server.

8. The method according to any one of claims 1 to 7, wherein: The user application comprises a virtual private network (VPN) application, and wherein the destination server comprises a VPN server associated with the VPN application.

9. The method of any one of claims 1-8, further comprising determining, by the data processing hardware, whether the first wireless network is associated with the same MVNO as the second wireless network.

10. The method according to any one of claims 1 to 9, wherein: The first wireless network comprises a cellular network, and the second wireless network comprises a Wireless Fidelity (Wi-Fi) network.

11. A system for providing a virtual network for a mobile device, the system comprising: Data processing hardware in mobile devices; and memory hardware in communication with the data processing hardware, the memory hardware storing instructions that, when executed on the data processing hardware, cause the data processing hardware to perform operations comprising: selecting, for a mobile device executing a user application, one of a first wireless network associated with a mobile virtual network operator (MVNO) and a second wireless network associated with the same MVNO; selecting a remote server from a plurality of remote servers based on the one of the first wireless network and the second wireless network, the first wireless network and the second wireless network both being associated with the same MVNO, each remote server of the plurality of remote servers being associated with a geographic location; establishing a virtual network between the mobile device and the selected remote server, the virtual network comprising at least one tunnel between the mobile device and the selected remote server over the one of the first wireless network and the second wireless network; and Data is sent from the user application to the selected remote server through the virtual network via one of the at least one tunnel between the mobile device and the selected remote server on the one of the first wireless network and the second wireless network, the data when received by the selected remote server causing the selected remote server to route the data to a destination server.

12. The system of claim 11, wherein: the at least one tunnel between the mobile device and the selected remote server over the first wireless network comprising a first tunnel supporting data for a first service and a second tunnel supporting data for a second service; the at least one tunnel between the mobile device and the selected remote server on the second wireless network comprising a third tunnel supporting data for the first service and a fourth tunnel supporting data for the second service; and Sending data from the user application to the selected remote server through the virtual network includes: based on the user application, selecting the first tunnel or the second tunnel between the mobile device and the selected remote server via the first wireless network or selecting the third tunnel or the fourth tunnel between the mobile device and the selected remote server via the second wireless network.

13. The system according to claim 12, wherein: The first service comprises an Internet service and the second service comprises a tethered service.

14. The system according to any one of claims 11 to 13, wherein: The operations further include, after sending the data from the user application to the selected remote server: connecting the mobile device to a third wireless network, the third wireless network comprising a user Wireless Fidelity Wi-Fi network; and Data is sent from the user application to the destination server over the third wireless network.

15. The system according to any one of claims 11 to 14, wherein: Selecting the remote server from the plurality of remote servers is based on a geographic location of each remote server in the plurality of remote servers.

16. The system of claim 15, wherein: The operations further include: before selecting the remote server from the plurality of remote servers: selecting a preferred wireless network from the first wireless network or the second wireless network based on network preference, Wherein, selecting the remote server from among the plurality of remote servers is based on a selected preferred wireless network.

17. The system of claim 16, wherein: The operation further includes: after selecting the preferred wireless network: selecting a second remote server from the plurality of remote servers based on a geographic location of each remote server in the plurality of remote servers; Establishing a second virtual network between the mobile device and the selected second remote server; and sending data from the user application to the selected second remote server on the second virtual network, wherein the data, when received by the selected second remote server, causes the selected second remote server to route the data to the destination server.

18. The system according to any one of claims 11 to 17, wherein: The user application comprises a virtual private network (VPN) application, and wherein the destination server comprises a VPN server associated with the VPN application.

19. The system according to any one of claims 11 to 18, wherein: The operations also include determining whether the first wireless network is associated with the same MVNO as the second wireless network.

20. The system according to any one of claims 11 to 19, wherein: The first wireless network comprises a cellular network, and the second wireless network comprises a Wireless Fidelity (Wi-Fi) network.

Images