End user device that secures an association of application to service policy with an application certificate check

What is this patent about?

’930 is related to the field of wireless network management and service policy enforcement. Specifically, it addresses the technical challenge of managing how individual applications on a mobile device consume network resources, particularly in scenarios where service providers or third parties wish to sponsor, restrict, or differentially bill for specific application traffic without relying solely on centralized network-based inspection.

The underlying idea behind ’930 is to move the intelligence of application identification and policy enforcement directly onto the end-user device while maintaining a secure link to the network. By using a device agent to verify the identity of an application through specific credentials, the system ensures that network access policies are applied only to legitimate, authenticated software, thereby preventing fraud and ensuring that sponsored or restricted data usage is accurately attributed.

The claims of ’930 focus on a wireless end-user device equipped with a service policy engine that stores application-specific credentials and corresponding agent instructions. The independent claim describes a mechanism where the device receives these credentials from a network element and performs a credential check to verify a match with a local application. Once a correct correspondence is confirmed, the device agent applies specific instructions to manage the application's Internet data communication over a wireless access network.

In practice, the invention works by intercepting or monitoring application-level connection attempts and comparing the application's signature or hash against the authorized credential information provided by the service controller. If the application is verified, the device agent can allow, throttle, or account for the traffic according to the downloaded policy. This allows for granular control, such as permitting a sponsored e-reader application to access a specific bookstore for free while charging other data usage to the user's bulk data plan.

This approach differs from prior solutions by eliminating the need for expensive and privacy-invasive Deep Packet Inspection (DPI) at the network core. Instead of the network trying to guess which application generated a packet based on traffic patterns, the device provides definitive identification. This decentralized model scales more effectively for carriers and enables a flexible Application Service Provider Interface (ASPI), allowing developers to bundle specific connectivity policies directly with their apps across different network types like 3G, 4G, and Wi-Fi.