Abstract: Security techniques for device assisted services are provided. In some embodiments, secure service measurement and/or control execution partition is provided. In some embodiments, implementing a service profile executed at least in part in a secure execution environment of a processor of a communications device for assisting control of the communications device use of a service on a wireless network, in which the service profile includes a plurality of service policy settings, and wherein the service profile is associated with a service plan that provides for access to the service on the wireless network; monitoring use of the service based on the service profile; and verifying the use of the service based on the monitored use of the service.

Abstract: A uniform wireless network service selection information exchange interface system is provided to facilitate a consistent user experience across multiple wireless networks that may have different service plan activation or service plan purchase processes. Network detection of service usage anomalies based on device-based data usage reports is provided to enable the network to determine whether an end-user device is likely operating in accordance with the established policy, or whether the end-user device may be operating fraudulently.

Abstract: A wireless mobile end-user device is disclosed to receive from one or more computing devices a purchase confirmation request for an electronic mobile commerce transaction, and in response to receiving the purchase confirmation request, provide information relating to the electronic mobile commerce transaction to a device user, and a request to the device user for a user approval of the electronic mobile commerce transaction, receive the user approval by receiving a biometric response from the device user locally, and send an instruction to cause a secure service downloader to communicate a unique security key from a secure dedicated memory partition, via a secure communication link, in connection with a billing event that relates to the electronic mobile commerce transaction, where the unique security key is not accessible by an application processor.

Abstract: One or more servers are disclosed to transmit, via a secure connection a device, a first signed certificate to the device to confirm a compatible and approved server status, receive, via the secure connection, a second signed certificate from the device to confirm a compatible and approved device status, determine whether the device is configured to authorize, mobile commerce transactions billed through a central billing process, transmit, via the secure connection, a purchase confirmation request for a mobile commerce transaction, the purchase confirmation request provides information relating to the transaction including an amount, and the purchase confirmation request triggers a request for the approval by the device user requiring a biometric authentication of the device user locally, and receive a purchase confirmation for the mobile commerce transaction.

Abstract: Device Assisted Services (DAS) for protecting network capacity is provided. In some embodiments, DAS for protecting network capacity includes monitoring a network service usage activity of the communications device in network communication; classifying the network service usage activity for differential network access control for protecting network capacity; and associating the network service usage activity with a network service usage control policy based on a classification of the network service usage activity to facilitate differential network access control for protecting network capacity.

Abstract: A technique involves modular storage of network service plan components and provisioning of same. A subset of the capabilities of a service design system can be granted to a sandbox system to enable customization of service plan offerings or other controls.

Abstract: Wireless offloading provides tools to a service provider to encourage or direct a subscriber to offload from a first network, e.g., a cellular network, to a second network, e.g., a Wi-Fi network. The cellular service provider can use network data to determine wireless offloading priorities for cellular subscribers on an individual or group basis. The cellular service provider may use wireless network data it has and/or wireless network data it learns about networks from the wireless devices (which may obtain Wi-Fi network data from beacon frames of Wi-Fi networks or active scanning and which may report to the cellular service provider). Each wireless device can be given scanning assignments to ensure that the reporting task is shared among subscribers or adjusted to fill in gaps in data. With the network data, the cellular service provider is capable of generating useful prioritized network lists for wireless devices, either individually or as a group.

Abstract: Wireless offloading provides tools to a service provider to encourage or direct a subscriber to offload from a first network, e.g., a cellular network, to a second network, e.g., a Wi-Fi network. The cellular service provider can use network data to determine wireless offloading priorities for cellular subscribers on an individual or group basis. The cellular service provider may use wireless network data it has and/or wireless network data it learns about networks from the wireless devices (which may obtain Wi-Fi network data from beacon frames of Wi-Fi networks or active scanning and which may report to the cellular service provider). Each wireless device can be given scanning assignments to ensure that the reporting task is shared among subscribers or adjusted to fill in gaps in data. With the network data, the cellular service provider is capable of generating useful prioritized network lists for wireless devices, either individually or as a group.

Abstract: Adaptive ambient services are provided. In some embodiments, an adaptive ambient service includes providing an ambient service profile. In some embodiments, an ambient service includes implementing an ambient service profile for assisting control of the communications device use of an ambient service on a wireless network, in which the ambient service profile includes a plurality of service policy settings, and in which the ambient service profile is associated with an ambient service plan that provides for initial access to the ambient service with limited service capabilities prior to activation of a new service plan; monitoring use of the ambient service based on the ambient service profile; and adapting the ambient service profile based on the monitored use of the ambient service.

Abstract: Devices, systems, and non-transitory computer-readable storage media for updating wireless device credentials, the wireless device comprising: a user interface, memory configured to store one or more credentials for enabling the wireless device to obtain one or more services over a wireless access network, and one or more processors configured to execute one or more machine-executable instructions that, when executed by the one or more processors, cause the one or more processors to obtain an indication of a user request to replace a particular credential with a target credential, detect a network-provisioning state change, determine that the particular credential does not match the target credential, initiate a programming session with a network element over a wireless access network, obtain an updated credential from the network element, and assist in storing the updated credential in memory.

Abstract: An end-user device including a service control device link agent, a memory configured to store a first encryption key, a modem configured to enable communications with a network system over a service control link, and a plurality of device agents communicatively coupled to the service control device link agent, each of the plurality of device agents identifiable by an associated one of a plurality of device agent identifiers. The service control device link agent configured to receive an encrypted agent message from a network element of the network system, decrypt the encrypted agent message, using the first encryption key, to obtain an agent message having a device agent identifier and message content for delivery to a device agent identified by the device agent identifier, the message content being from a server communicatively coupled to the network element, and deliver the message content to the device agent.

Abstract: There is provided a wireless end-user device including a wireless wide area network (WWAN) modem, a memory storing a WWAN network access policy including one or more first policy instructions associated with a first software application, and one or more processors to provide, using the WWAN modem, one or more network data traffic flows between the wireless end-user device and the WWAN, associate the first software application with a first one of the one or more network data traffic flows, and when (i) the wireless end-user device communicates or attempts to communicate data over the WWAN, and (ii) the first software application is associated with the first one of the one or more network data traffic flows, apply the one or more first policy instructions associated with the first software application to the first one of the one or more network data traffic flows.

Abstract: Adaptive ambient services are provided. In some embodiments, an adaptive ambient service includes providing an ambient service profile. In some embodiments, an ambient service includes implementing an ambient service profile for assisting control of the communications device use of an ambient service on a wireless network, in which the ambient service profile includes a plurality of service policy settings, and in which the ambient service profile is associated with an ambient service plan that provides for initial access to the ambient service with limited service capabilities prior to activation of a new service plan; monitoring use of the ambient service based on the ambient service profile; and adapting the ambient service profile based on the monitored use of the ambient service.

Abstract: Devices, systems, and non-transitory computer-readable storage media for updating wireless device credentials, the wireless device comprising: a user interface, memory configured to store one or more credentials for enabling the wireless device to obtain one or more services over a wireless access network, and one or more processors configured to execute one or more machine-executable instructions that, when executed by the one or more processors, cause the one or more processors to obtain an indication of a user request to replace a particular credential with a target credential, detect a network-provisioning state change, determine that the particular credential does not match the target credential, initiate a programming session with a network element over a wireless access network, obtain an updated credential from the network element, and assist in storing the updated credential in memory.

Abstract: Secure architectures and methods for improving the security of mobile devices are disclosed. Also disclosed are apparatuses and methods to detect and mitigate fraud in device-assisted services implementations.

Abstract: Disclosed herein are various embodiments for publishing a service offer set to a device agent on an end-user device and for on-device selection of a service. In some embodiments, a network system publishes a service offer set to an end-user device over a wireless access network, receives an offer set user selection from the end-user device, and provisions one or more network functions based on the offer set user selection.

Abstract: Secure architectures and methods for improving the security of mobile devices are disclosed. Also disclosed are apparatuses and methods to detect and mitigate fraud in device-assisted services implementations.

Abstract: Secure device data records (DDRs) are provided. In some embodiments, a system for secure DDRs includes a processor of a wireless communication device for wireless communication with a wireless network, in which the processor is configured with a secure execution environment, and in which the secure execution environment is configured to: monitor service usage of the wireless communication device with the wireless network; and generate a plurality of device data records of the monitored service usage of the wireless communication device with the wireless network, in which each device data record is associated with a unique sequence order identifier; and a memory coupled to the processor and configured to provide the processor with instructions. In some embodiments, the secure execution environment is located in an application processor, in a modem processor, and/or in a subscriber identity module (SIM).

Abstract: Methods and apparatuses to manage service user discovery and service launch object placement on a device. A method comprising: obtaining information to assist in identifying a portion of a user interface of a wireless device, the wireless device communicatively coupled to a network system over a wireless access network; determining a differentiating attribute of the identified portion of the user interface; obtaining one or more service launch objects for placement in the identified portion of the user interface; and sending configuration information to the wireless device over the wireless access network to assist the wireless device in placing the one or more service launch objects in the identified portion of the user interface.

Abstract: A technique involves modular storage of network service plan components and provisioning of same. A subset of the capabilities of a service design system can be granted to a sandbox system to enable customization of service plan offerings or other controls.