Secure Service Profiles for Device-Assisted Network Access Control
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing access networks face capacity constraints due to increasing digital networking demand, leading to degraded network service experiences and higher service provider costs, while existing security solutions do not adequately protect device-assisted services from hacking, malware, and unauthorized access.
Innovation Solution
Implementing a secure execution environment with hardware-based partitions and encrypted communication links to protect device-assisted service agents, ensuring secure measurement and control of service usage, and integrating these agents into the CPU/processor to enhance access control integrity.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If device-assisted services are implemented to measure and control service usage, then network resource allocation is optimized and service provider costs are reduced, but the system becomes vulnerable to hacking, malware, and unauthorized access
Solution Approach 1:
The system divides the device architecture into separate execution environments: a protected execution environment for service agents and an unprotected environment for applications. This segmentation isolates security-critical components from potential threats, allowing service measurement and control functions to operate securely while maintaining network optimization capabilities.
Solution Approach 2:
The patent applies different security properties to different parts of the system. The protected execution environment implements strict access controls and security policies, while the unprotected environment allows greater flexibility for applications. This local differentiation of security quality enables both security and functionality to coexist.
2Reliability
If hardware-based partitions and encrypted communication links are implemented to secure device-assisted services, then access control integrity is enhanced and unauthorized access is prevented, but device complexity increases
Solution Approach 1:
The system implements asymmetric security measures where only specific critical components (service agents) require protected execution environments and encrypted communication links, while other components (applications) operate in unprotected environments. This asymmetric approach provides necessary security without uniformly increasing complexity across the entire device.
Solution Approach 2:
The protected execution environment acts as an intermediary layer between the unprotected application environment and the security-critical service measurement and control functions. This intermediary provides secure communication channels and access control mechanisms, isolating the complexity of security implementation to a dedicated layer rather than permeating the entire system.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
Security techniques for device assisted services are provided. In some embodiments, secure service measurement and/or control execution partition is provided. In some embodiments, implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control o f the communications device use of a service on a wireless network, in which the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network; monitoring use of the service based on the service profile; and verifying the use of the service based on the monitored use of the service.