Headwater Research LLC

Headwater Partners I LLC

The Prudential Insurance Company of America

Disney Enterprises, Inc.

Box Limited

James Francis Lavine

Gregory G Raleigh

Alireza Raissinia

Jeffrey Green

Justin James

Venkatesh Sarvottamrao Apsingekar

Sahil Vinod Motadoo

Christopher John Schille

Russell Bertrand Carter, Iii

Jose Tellado

Vien-Phuong Nguyen

Michael John Sabin

Laurent An Minh Nguyen

Ali Raissinia

Phuong Nguyen

David MacKenzie

Shilpa Varma

Prachi Snehal

Irina Issayeva

Swati Garg

Vien-Phuong D Nguyen

Russell Bertrand Carter

Laurent An Nguyen

Network service provisioning is described. Network service provisioning to a device includes a mechanism for ensuring that network services are available based upon one or more of appropriate traffic control, billing, and notification policies. Ensuring that the policies are properly enforced on a device is a focus of this paper. The enforcement policies can be on the device or in the network.

End user device that secures an association of application to service policy with an application certificate check

Disclosed herein are various embodiments for publishing a service offer set to a device agent on an end-user device and for on-device selection of a service. In some embodiments, a network system publishes a service offer set to an end-user device over a wireless access network, receives an offer set user selection from the end-user device, and provisions one or more network functions based on the offer set user selection.

Service selection set publishing to device agent with on-device service selection

A system allows a user to store his personally identifiable information (PII) on a personal device. When a third party wants to access the user's PII (e.g., to update the PII or to retrieve the PII), a notification will be presented to the user on the personal device seeking consent to the access. The notification may inform the user as to what information is being requested and which entity is requesting the access. The requested access will be denied unless the user consents to the access. In this manner, the user is given control over the dissemination of his PII. Additionally, the system alters or adjusts the PII that is stored in third-party servers so that even if these servers are breached, the user's actual PII is not exposed.

System for improving data security

Secure device data records (DDRs) are provided. In some embodiments, a system for secure DDRs includes a processor of a wireless communication device for wireless communication with a wireless network, in which the processor is configured with a secure execution environment, and in which the secure execution environment is configured to: monitor service usage of the wireless communication device with the wireless network; and generate a plurality of device data records of the monitored service usage of the wireless communication device with the wireless network, in which each device data record is associated with a unique sequence order identifier; and a memory coupled to the processor and configured to provide the processor with instructions. In some embodiments, the secure execution environment is located in an application processor, in a modem processor, and/or in a subscriber identity module (SIM).

Communications device with secure data path processing agents

Wireless offloading provides tools to a service provider to encourage or direct a subscriber to offload from a first network, e.g., a cellular network, to a second network, e.g., a Wi-Fi network. The cellular service provider can use network data to determine wireless offloading priorities for cellular subscribers on an individual or group basis. The cellular service provider may use wireless network data it has and/or wireless network data it learns about networks from the wireless devices (which may obtain Wi-Fi network data from beacon frames of Wi-Fi networks or active scanning and which may report to the cellular service provider). Each wireless device can be given scanning assignments to ensure that the reporting task is shared among subscribers or adjusted to fill in gaps in data. With the network data, the cellular service provider is capable of generating useful prioritized network lists for wireless devices, either individually or as a group. Preferences can be encouraged in the form of incentive offers to subscribers to, e.g., offload from the cellular network to a Wi-Fi network. Incentive offers can include offers to lower service costs or provide additional or improved services.

System and method for wireless network offloading

A system protects personally identifiable information (PII) by implementing an unconventional key management scheme. In this scheme, the system uses a set of keys rather than an individual key for encrypting PII. Different portions of the PII are encrypted using different keys from the set of keys. In this manner, even if a malicious user were to access a key, that key would not give the malicious user the ability to decrypt all of the PII. Additionally, the system generates a new set of keys periodically (e.g., once a month). The system also deletes sets of keys that are too old (e.g., six months old). As a result, even if a malicious user were to access a key, the usefulness of that key would be time limited.

System for improving data security through key management

When personally identifiable information (PII) is to be stored or updated, a system first seeks consent from the user for the PII store or update. If the user grants consent, then the system stores the PII in the user's personal device or updates the PII stored in the user's personal device. The system then retrieves that PII and generates a token representing that PII. Even if the token were taken by a malicious user, it would not be possible for the malicious user to determine the user's actual PII from the token. In this manner, the security of the PII is improved over conventional systems.

System for improving data security when redeeming data

Methods, systems, and computer program products for a content management system. Embodiments operate within or in conjunction with such a content management system. The content management system stores content objects for access by various collaborators, including extra-system collaborators. A user of the content management system configures extra-enterprise shared link URLs that permit the extra-system collaborators to access shared content objects over an Internet connection. A shared link event graph data structure is formed based on access requests over the extra-enterprise shared link URLs. An interactive user interface module is generated by processing a shared link report query over the shared link event graph data structure to select a subject set of the extra-enterprise shared link URLs, and to generate a data set of the interactive user interface module based at least in part on results from the query. A user interacts with the interactive user interface module to generate insights.

Calculating and reporting collaboration system risks

A technique involves modular storage of network service plan components and provisioning of same. A subset of the capabilities of a service design system can be granted to a sandbox system to enable customization of service plan offerings or other controls.

Network service plan design

Device Assisted Services (DAS) for protecting network capacity is provided. In some embodiments, DAS for protecting network capacity includes monitoring a network service usage activity of the communications device in network communication; classifying the network service usage activity for differential network access control for protecting network capacity; and associating the network service usage activity with a network service usage control policy based on a classification of the network service usage activity to facilitate differential network access control for protecting network capacity.

Device-assisted services for protecting network capacity

There is provided a wireless end-user device configured to assign one of classifications to each of end-user applications to allow for a differential network access control of the end-user applications. The classifications include a background classification and a foreground classification. The differential network access control includes a service usage control policies applicable when a network service is available via a wireless modem, the service usage control policies including a first policy that allows data associated with a first end-user application of the end-user applications to be communicated via the wireless modem, and a second policy that defers the data associated with the first end-user application to be communicated via the wireless modem until a state change occurs. The wireless end-user device is configured to dynamically select from the service usage control policies based on whether the background classification or the foreground classification is assigned to the first end-user application.

Disclosed herein are methods, systems, and apparatuses to enable subscribers of mobile wireless communication devices to view, research, select and customize service plans; to create and manage device groups, share and set permission controls for service plans among devices in device groups; to manage communication services through graphical user interfaces; to sponsor and promote service plans; and to design, manage, and control communication services through application programming interfaces.

Service plan design, user interfaces, application programming interfaces, and device management

Secure architectures and methods for improving the security of mobile devices are disclosed. Also disclosed are apparatuses and methods to detect and mitigate fraud in device-assisted services implementations.

Security, fraud detection, and fraud mitigation in device-assisted services systems

Devices, systems, and non-transitory computer-readable storage media for updating wireless device credentials, the wireless device comprising: a user interface, memory configured to store one or more credentials for enabling the wireless device to obtain one or more services over a wireless access network, and one or more processors configured to execute one or more machine-executable instructions that, when executed by the one or more processors, cause the one or more processors to obtain an indication of a user request to replace a particular credential with a target credential, detect a network-provisioning state change, determine that the particular credential does not match the target credential, initiate a programming session with a network element over a wireless access network, obtain an updated credential from the network element, and assist in storing the updated credential in memory.

Growing community of inventors

Corte Madera, CA, United States of America

James Francis Lavine