Managing data transfer across a network interface

Described are systems and methods for managing data transfer from a communication device to a communication network over a wireless connection comprising determining that a requesting process on the communication device is authorized to establish a protected connection to the communication network; and, configuring a network interface on the communication device to allow data packets to be transmitted from the requesting process to the communication network over the protected connection, wherein the network interface is associated with the protected connection.

FIELD

The present matter relates to communication devices and in particular to a method and system for managing data transfer across a communication device to a communication network over a wireless connection.

BACKGROUND

Communication devices are commonly used to transmit data across communication networks, including cellular networks. Often cellular networks have protected, zero-rated or data-sensitive connections that can only be used by authorized applications and processes. Data, including audio or other data, can be transmitted across such protected connections from one or more applications or processes on a device.

DETAILED DESCRIPTION

According to an aspect, the present disclosure describes a method implemented on a communication device for managing data transfer from the communication device to a communication network over a wireless connection, the method comprising determining that a requesting process on the communication device is authorized to transfer data to the communication network over a protected connection; and, configuring a network interface on the communication device to allow data packets to be transferred from the requesting process to the communication network over the protected connection, wherein the network interface is associated with the protected connection.

According to another aspect, the present disclosure describes a communication device for managing data transfer from the communication device to a communication network over a wireless connection, the communication device comprising an authorization process module for authorizing a requesting process to transmit data to the communication network over a protected connection; and a cellular data services controller for configuring a network interface on the communication device to allow data packets to be transmitted from the requesting process to the communication network over the protected connection, wherein the network interface is associated with the protected connection.

According to another aspect, the present disclosure describe a communication device for controlling data transfer across a network interface of a communication network, the communication device comprising: a memory; and, computer readable instructions stored on memory and executable by a processor to: determine that a requesting process on the communication device is authorized to transfer data to the communication network across a protected connection; and, configure a network interface on the communication device to allow data packets to be transmitted from the requesting process to the communication network over the protected connection, wherein the network interface is associated with the protected connection.

According to another aspect, the present disclosure describes a computer readable storage medium comprising computer-executable instructions which, when executed, cause a processor to: determine that a requesting process on the communication device is authorized to transfer data to the communication network across a protected connection; and, configure a network interface on the communication device to allow data packets to be transmitted from the requesting process to the communication network over the protected connection, wherein the network interface is associated with the protected connection.

Example Network Infrastructure100

For convenience, like numerals in the description refer to like structures in the drawings. Referring toFIG. 1, a typical telecommunication infrastructure is illustrated generally by numeral100. The telecommunication infrastructure100includes one or more communication devices102, one or more base stations104, a communication network106and a plurality of network servers108.

The communication devices102include wireless computing devices such as a smart phone, a personal digital assistant (PDA), and the like. The communication devices102are in communication with one of the base stations104. The base stations relay data between the communication devices102and the network servers108via the communication network106. Accordingly, the communication network106may include several components such as a wireless network, a relay, a corporate server and/or a mobile data server for relaying data between the base stations104and the network servers108.

The network servers108include servers such as a Web server, an application server108, and an application server with web services. It will be appreciated by a person of ordinary skill in the art that the telecommunication infrastructure100described herein is exemplary and that changes may be made to one or more components to accommodate different network configurations without affecting the scope of the aspects described herein.

Example Communication Device102

Referring toFIG. 2, a typical communication device102is illustrated in greater detail. The communication device102is often a two-way communication device having both voice and data communication capabilities, including the capability to communicate with other computer systems. Depending on the functionality provided by the communication device102, it may be referred to as a data messaging device, a two-way pager, a cellular telephone with data messaging capabilities, a wireless Internet appliance, a smartphone, a table computer, or a data communication device.

The communication device102includes a communication subsystem211, which includes a receiver212, a transmitter214, and associated components, such as one or more embedded or internal antenna elements216and218, local oscillators (LOs)213, and a processing module such as a digital signal processor (DSP)220. As will be apparent to those skilled in field of communications, the particular design of the communication subsystem211depends on the communication network in which the communication device102is intended to operate.

The communication device102includes a processor238, which controls general operation of the communication device102. The processor238can interact with additional device subsystems such as a display222, a flash memory224, a random access memory (RAM)226, a read only memory (ROM)248, auxiliary input/output (I/O) subsystems228(such as a keyboard or trackball, for example), a data port230, a speaker234, a microphone236, a short-range communications subsystem240such as Bluetooth™ for example, and any other device subsystems or peripheral devices generally designated at242.

Operating system software used by the processor238may be stored in a persistent store such as the flash memory224(which may be a ROM), a ROM248or similar storage element (not shown). The operating system, specific device applications, or parts thereof, may be temporarily loaded into a volatile store such as RAM226.

The processor238, in addition to its operating system functions, enables execution of software applications on the communication device102. A predetermined set of applications, which control basic device operations, is installed on the communication device102during its manufacture. These basic operations typically include data and voice communication applications, for example. Additionally, applications may also be loaded onto the communication device102through the network106, an auxiliary I/O subsystem228, serial port230, short-range communications module240, or any other suitable subsystem242, and installed by a user in RAM226, ROM248or flash memory224, for execution by the processor238. Such flexibility in application installation increases the functionality of the communication device102and may provide enhanced on-device features, communication-related features, or both.

The short range communication module240provides for communication between the electronic device102and different systems or devices, which need not necessarily be similar devices. For example, the short range communication module240may include an infrared device and associated circuits and components, or a wireless bus protocol compliant communication mechanism such as a Bluetooth® communication module to provide for communication with similarly-enabled systems and devices.

The display222is used to visually present an application's graphical user interface (GUI) to the user. The user can manipulate application data by modifying information on the GUI using an auxiliary input/output device232, such as a keyboard for example. Depending on the type of communication device102, the user may have access to other types of input devices, such as, for example, a scroll wheel, trackball, light pen or touch sensitive screen.

In some example embodiments, the auxiliary input/output (I/O) subsystems250may include an external communication link or interface, for example, an Ethernet connection. The electronic device201may include other wireless communication interfaces for communicating with other types of wireless networks; for example, a wireless network such as an orthogonal frequency division multiplexed (OFDM) network.

In some example embodiments, the communication device102also includes a removable memory module262(typically including flash memory) and a memory module interface264. Network access may be associated with a subscriber or user of the electronic device102via the memory module262, which may be a Subscriber Identity Module (SIM) card for use in a GSM network or other type of memory module for use in the relevant wireless network type. The memory module262may be inserted in or connected to the memory module interface264of the electronic device102.

In some example embodiments, the electronic device201is provided with a service routing application programming interface (API) which provides an application with the ability to route traffic through a serial data (i.e., USB) or Bluetooth® (Bluetooth® is a registered trademark of Bluetooth SIG, Inc.) connection to the host computer system using standard connectivity protocols. When a user connects their electronic device201to the host computer system via a USB cable or Bluetooth® connection, traffic that was destined for the wireless network101is automatically routed to the electronic device201using the USB cable or Bluetooth® connection. Similarly, any traffic destined for the wireless network101is automatically sent over the USB cable Bluetooth® connection to the host computer for processing.

The communication device102also includes a battery256as a power source, which is typically one or more rechargeable batteries that may be charged, for example, through charging circuitry coupled to a battery interface254such as the serial data port230. The battery256provides electrical power to at least some of the electrical circuitry in the electronic device102, and the battery interface254provides a mechanical and electrical connection for the battery256. The battery interface254is coupled to a regulator (not shown) which provides power V+ to the circuitry of the electronic device102.

Example Persistent Publish and Subscribe Service300

A persistent publish and subscribe (“PPS”) service allows a process (i.e. a publisher) to publish data to a file (e.g. an object file) that can be read by one or more permitted subscribers. The permitted subscribers may be processes or applications operating or running on the same device as the publisher. The publisher may not have to identify the intended recipients or subscribers; instead, the published data can be broadcast to permitted subscribers through the file. The subscribers can be provided with access to the service in accordance with a set of permissions. Permissions can include the ability to receive certain published content or to communicate data to the publisher or to read from and/or write to the file. The PPS service can be associated with specific processes, applications or network connection such that only one PPS service operates for a specific process, application or network connection. It is understood that PPS services can have additional applications not specifically described. A PPS service can be in operation on a communication device102, on a server108or on one or more devices102in communication (e.g. over a network106). A PPS service can be used on a communication device102to allow only permitted processes on the communication device102to communicate with one another.

FIG. 3illustrates an exemplary embodiment of a PPS service300. In the illustrated embodiment, a publisher302is in communication with a PPS object304. Three subscribers306are also in communication with the PPS object304. A PPS module310is associated or coupled with both the PPS object304and an access control list (“ACL”)308. In one or more embodiments, the PPS service300is operating on a communication device102along with the subscribers306and publisher302.

The PPS module310can be an application that is running on the communication device102. For example, a processor238on the device102can be executing a set of instructions stored on a memory in order operate the PPS module310. According to an embodiment, the ACL308is a file stored on the device102(e.g. in memory224) that the PPS module308can read from and/or write to. In alternative embodiments, the ACL308may be stored remotely and accessed over or through a communication network106. The ACL316can be configured to store one or more permissions associated with the subscribers306. For example, the permissions associated with a subscriber306may identify the publisher302and/or PPS object304that the subscriber306is permitted to communicate with. By way of further example, a subscriber306can be considered a permitted subscriber306with respect to a PPS object304or publisher302if that subscriber306is permitted to communicate with the publisher302through the PPS object304.

According to an embodiment, the PPS object304is an object file that is instantiated by the PPS module310on request from a subscriber306. The PPS object304can be stored at the device102or remotely at another location, for example. The publisher302can send or publish data to the PPS object304such that data sent to the PPS object304is broadcast or accessible to one or more permitted subscribers306. Similarly, the publisher302can receive data from the PPS object304sent by specific permitted subscribers306. Such received data can be correspondence from one or more permitted subscriber306, for example. The transmission of data to and from the PPS object304can comprise writing data to and reading data from the PPS object304, respectively.

In the illustrated embodiment, the subscribers306are processes or applications operating on the communication device102on which a PPS service300operates. For example, the PPS object304can be stored or maintained on the same communication device102. Similarly, the publisher302can be a process or application operating on the same communication device102.

The illustrated embodiment shows three subscribers306. It is recognized that more or fewer subscribes306can use or be implemented in the PPS service300. A subscriber306subscribes to data stored at or sent to the PPS object304by the publisher302. For example, a subscriber306can read data from the PPS object304in accordance with permissions provided in the ACL308. Similarly, a subscriber306may be permitted to write data to the PPS object304in order to communicate with the publisher302in accordance with permissions provided in the ACL308. A PPS object304can be associated with a particular process or network connection (e.g. a protected network connection). In accordance with an embodiment there is one ACL308per PPS object304. Alternatively, there can be one ACL308for maintaining permissions with respect to multiple PPS objects304. Generally, the ACL308can be used to define, for any topic (or PPS object304) and subscriber306, the right of that subscriber306to receive publications on that topic or to request persistent delivery of a publication on that topic. The ACL316can also define the level of protection that can apply to each topic such as, for example, the identity of subscribers306permitted to read data from a particular PPS object304.

In an embodiment, correspondence from a subscriber306through the PPS object304comprises a request to establish a connection to a communication network106or to connect to a communication network106over an existing connection. In a further embodiment, there are no other methods for a subscriber306to request to connect to a communication network106over a particular network connection nor are there other methods for a subscriber306to request to establish a particular connection to a communication network106. Additionally, the PPS object304may be associated with a specific network connection or network interface such that all requests to connect communications between processes on the communication device102relating to connecting to a communication network over that specific network connection pass through the PPS object304. Thus, in accordance with such an embodiment, only processes (or applications) that are identified in an ACL308with permission to transmit data to a communication network106over a specific network connection can communicate with the PPS object304.

Example Communication Device Infrastructure400

FIG. 4illustrates the infrastructure of an embodiment of a communication device102. The communication device102comprises various modules, including a process402, a launcher408, an authorization process module404, a PPS module310, a PPS object304, an ACL308, a cellular data services controller (“CDSC”)406, a packet filter module410and a network interface module412. Data may be transferred between two or more of the noted modules. The modules may be applications, processes, files or hardware and/or software components on a communication device102. The functionality of any or all of the identified modules can be combined in one or more module.

In accordance with the illustrated embodiment, the process402is an application or process that is initiated or running or operating on the communication device102. A launcher408is associated with the requesting process402. The launcher408is a process that is used to initiate or launch the process402. For example, the launcher408is a process coupled to the process402that assists with certain functionality of launching the process402. By way of further example, the launcher408comprises an interface through which the process402can be initiated or launched. For example, the launcher408may comprise a user interface on the communication device102through which the process402can be launched or initiated. There may be one or more other processes that are initiated or running or operating on the communication device102along with or instead of the process402and to which the description inFIG. 4applies. For example, another process (not shown) can be associated with the launcher408, PPS module310, the PPS object304and the network interface module412.

According to the illustrated embodiment, a PPS service300is implemented on the communication device102such that the process402comprises a subscriber306and the CDSC406comprises the publisher302. The process402and the CDSC406may each also be in communication with or coupled to the network interface module412and the PPS module310. The PPS module310, PPS object304and one or more ACL308operate as the PPS service300between the CDSC406and the process402. It is understood that there can be more than one process402and that each process402can be a subscriber306to the same PPS object304. In accordance with an embodiment, the PPS service300shown inFIG. 4(i.e. the PPS module310, the PPS object304, the ACL308, the process402and the CDSC406) can be associated with a specific network interface or network connection used to transmit data to and from or communicate with a communications network106. For example, the PPS service300on the communication device102can be associated exclusively with a protected connection such that the PPS object304is the only mechanism that the process402can use to communicate with the CDSC406in respect of the protected connection. It is recognized that in other embodiments, there may be other mechanisms for allowing communication between the CDSC406and process402and/or that there may be multiple PPS objects304associated with the protected connection.

Still with reference to the illustrated embodiment inFIG. 4, the authorization process module404is in communication with the launcher408, ACL308and PPS module310. The authorization process module404can be configured to receive authorization requests from the process402. In accordance with an exemplary embodiment, the authorization process module404is configured to authorize a process402to transmit data to the communication network106over a protected connection. An example authorization request can include the identity of the process402and the identity of the communication network106that the process402is requesting to establish a connection to. A further example authorization request can include the identity of the process402, the identity of a protected connection or network interface that the process402is requesting authorization to connect to. The identity of the process402can include a process ID, for example. It is understood that the process402can be an application running on a communication device102such that the authorization request is transmitted within the communication device102. The identity of the network interface or network connection can include an IP address or a port number for example.

In a further embodiment, the authorization module404is configured to verify the capabilities of the process402. For example, when the process402is initiated (e.g. on the communication device102), the launcher408(i.e. a process running in association with the process402) extracts certain capabilities from the process's402manifest and transmits the capabilities to the authorization process module404. A process's or application's manifest can be data (e.g. metadata) associated with the process or application (e.g. the process402) that contains identifying information and/or permission information and/or session information in respect of the process or application. The authorization process module404verifies the capabilities of the process402. For example, the authorization process module404can maintain a list or descriptions of authorized applications or processes and their capabilities that it can then compare to the capabilities of the process402as extracted by the launcher408. For example, the process402can request to connect to a communication network106over an existing protected connection. If the capabilities are verified then the authorization process module404authorizes the process402to connect to the communication network106through the protected connection. If the capabilities are not verified then the authorization process module404declines to authorize the process402to connect to the network interface or network connection (e.g. the protected connection). In a further example, the process402can request to establish a protected connection to the communication network106. If the capabilities are verified then the authorization process module404authorizes the process402to establish the protected connection. If the capabilities are not verified then the authorization process module404declines to authorize the process402to establish the protected connection. The capabilities may provide information that identifies the specific communication networks or network connection that the process402is authorized or permitted to connect to or to establish. For example, the capabilities can indicate that a certain application or process is authorized to transmit data to a communication network106over a specific protected connection. Similarly, the capabilities may provide information that identifies the specific communication networks or network connection(s) that the process402is not permitted or is not authorized to establish connections over or to connect to. It is recognized that the authorization process module404may authorize the process402to establish connections to one or more communication networks while declining to authorize the process402to establish connections to one or more other communication networks. Similarly, the authorization process module404can authorize the process402to transmit data to a communication network106across a certain protected connection but not to a communication network106across another protected connection. Generally, the role of the authorization process module404is to verify or authorize that a process402is permitted to establish or to access a protected connection and the role of the launcher408is to provide the authorization process module404with identifying information regarding the process402.

In accordance with the embodiment illustrated inFIG. 4, the authorization process module404is in communication with the ACL316. For example, the authorization process module404can transmit data (e.g. write data) to the ACL316and can receive data (e.g. read data) from the ACL316. In accordance with an exemplary embodiment, the ACL316maintains a set of permissions for establishing connections to communication networks106or for transmitting data across existing connections to communication networks106. For example, the ACL316can be a file that stores a list of applications or processes and a list of communication networks and/or existing connections (e.g. protected connections) that each listed application or process is permitted to transmit data to. In an embodiment, the ACL316maintains or stores the identities of the processes or applications that are permitted to request to establish a connection to specific communication networks106and the identities of the processes or applications that are permitted to connect to specific protected connections. For example, the ACL316can maintain or store a “white list” of applications or processes that are permitted to transmit data across a specific protected connection (e.g. the protected connection associated with the PPS object304, for example). In yet another embodiment, the ACL maintains or stores permissions for one or more applications or process indicating which network connections that each application or process is permitted to transmit data across. The authorization process module404can amend, add to or remove one or more permissions maintained at the ACL316. For example, the authorization process module404can edit the data stored on the ACL316such that the process402is noted as having permission to request to connect to the communication network106across the protected connection associated with the PPS object304. For example, the authorization process module404can add the identity (or permission(s)) of a process402to an ACL308after the authorization process module404has verified the capabilities of the process402as provided, for example, by the launcher408. According to an exemplary embodiment, the permissions to connect to a communication network106across a protected connection or network interface that are maintained by the ACL316comprise permissions to read from and/or write to the PPS object304associated with the specific network interface or network connection.

Still with reference to the embodiment illustrated inFIG. 4, the CDSC406is a process or an application running on the communication device102. The CDSC406configures and manages connections to communication network(s)106(e.g. a wireless network) on the communication device102. By way of example, the CDSC406can provide a communication path to a process402through which the process402can request to connect to a specific communication network106across a specific network connection or network interface. Similarly, the CDSC406can provide a communication path to a process402through which the process402can request to establish a connection to a communication network106. According to the illustrated embodiment, the CDSC406is in communication with the PPS object304, the PPS module310, the packet filter module410and the network interface module412. More specifically, the CDSC406can transmit data to or receive data from each of the identified modules. For example, the CDSC406communicates with the process(s)402through the PPS object304using the PPS service300such that the CDSC406is the publisher302in the PPS service300. It is recognized that other methods of communication between processes, applications or modules can be used in alternative embodiments. In another example, the CDSC406can configure the process402to connect to a communication network106through a network connection on the communication device102. For example, the CDSC406can populate a packet data protocol context with information and data from the process402and transmit the packet data protocol context to the network interface module412where the of the connection may be completed or configured. Further, the CDSC406can request or instruct that the packet filter module410apply one or more pre-determined rules to restrict data transfer across a specified network interface or network connection (e.g. the protected connection). Such a request or instruction may be automatically transmitted or communicated to the packet filter module410after the CDSC406receives confirmation that a network connection (e.g. the protected connection) is open, for example.

The network interface module412configures the network interfaces and drivers for the transport technology that is used by a process402(e.g. Wi-Fi network, cellular networks, and wired networks). The network interface module412may also manage communications and data transmission through network connections and/or network interfaces. For example, the network interface module412may receive requests (or calls) from the CDSC406to activate a packet data protocol (“PDP”) context from a specific process402to establish a specific network connection over which data can be transmitted. The network interface module412can then activate the PDP context (in accordance with the general packet radio service (“GPRS”) or other network protocol, for example) thereby opening a data tunnel over which data can be transmitted. In one or more embodiments, one PDP context can be activated for allowing multiple processes or applications to transmit data to a communication network106across a connection. The network interface module412can comprise a radio transmitter on the communication device102.

In an exemplary embodiment, a PDP context is used to facilitate the transmission of data from one or more processes402over a protected connection. It is understood that the PDP context can be used to facilitate the transmission of data from processes402over other network connections. The communication network106may be a GPRS. To be connected to the GPRS, a subscriber306(e.g. a communication device102or an application) must first be allocated an activated PDP context. The PDP context is a data structure, which can be maintained at the network interface module412, and which contains the subscriber's306session information. The PDP context can contain each subscriber's306session information. The session information can include the subscriber's306identification (e.g. International Mobile Subscriber Identity or process ID). In some embodiments, the session information may comprise the access point for the identified network connection and the access point may identify the GPRS network. After a PDP context is activated the network connection (e.g. protected connection) is open and able to receive connections. In an embodiment, the PDP context is populated at or by the CDSC406, however it is understood that the PDP context can be populated at or by the network interface module412.

Still with reference toFIG. 4, the packet filter module410manages the filtering of data packets transmitted to the communication network106through the network interface associated with the protected connection. It is understood that the network interface is associated with the protected connection which in turn is associated with the PPS object304. For example, all data passing from the commination device102over the protected connection passes through the network interface. The packet filter module410may be in communication with the CDSC406for receiving instructions indicating the type, manner and/or magnitude of packet filters to apply to data passing over, through or to the network interface. For example, the packet filter module410may comprise or be configured to apply a set of pre-determined rules, such as packet filter rules to all data transferred over the network interface and/or over a particular network connection. One or more packet filter rules can be applied over the network interface in order to filter packets transmitted to or through the network interface. For example, a blocking rule, such as a “block all” packet filter rule prevents all packets from traveling over the network interface, and an “allow” packet filter rule allows packets from one or more identified sources (e.g., IP addresses, process ID numbers) to pass through the network interface. The “block all” and “allow” packet filter rules can be used together so that data packets coming from all sources except for those identified in the “allow” packet filter rule are blocked or prevented from passing through the network interface to the communication network106. In accordance with an embodiment, the CDSC406instructs the packet filter module410of the identity of the applications or processes to be added to the “allow” packet filter rule so that data transmitted from such identified applications or processes to the network interface is not blocked by the “block all” rule.

In accordance with one or more embodiments, the PPS service300is used to manage communications between process402and the CDSC406. For example, the PPS module308manages all communication between process402and the CDSC406in respect of the protected connection. The PPS module308can instantiate a single PPS object304for a specific network interface or network connection so that all communication between the process and the CDSC406with respect to the specific network interface are communicated through the PPS object304. According to an embodiment, the PPS object304is associated with a protected connection. According to an embodiment, a process402transmits information to the CDSC406by writing to the PPS object304and the CDSC406receives such correspondence by reading from the PPS object304. Similarly, the CDSC406corresponds with a process402by writing to the PPS object304and the process402receives correspondence by reading from the PPS object304. As noted above, the CDSC406may be considered the “publisher” under the PPS service300, so that it need not identify the recipients of correspondence or information or data that it writes to the PPS object304. Similarly, the process may be considered a subscriber306so that it will only receive information, data or communication that it subscribes to. Information, data or communications that a process subscribes to can be limited to a specific network connection or network interface, for example.

According to an embodiment, the ACL308is associated with each PPS object304in order to control, manage and restrict access to the PPS object304to specifically identified applications (or subscribers306). For example, the ACL308may have a list of processes or applications (e.g. identified by IP address or process identification number, etc.) that have permission to write to and/or read from a specific PPS object304associated with a specified network interface or network connection. By way of further example, there may be an ACL308associated with the PPS object304which in turn is associated with a protected connection. The CDSC406and/or the authorization process module404may have the ability to edit the ACL308in order to provide permission for identified applications to read from and write to one or more PPS objects304.

Example Connection Protocol500

With reference toFIG. 5, a sequence of communications500that can be used on a communication device102to connect to a network interface or communication network106will now be described. According to the sequence of communications identified at numeral500there is control over the identity of the applications or processes that can connect to the communication network106, but there may be no control over the data that passes through the network interface from such applications or processes.

At502, the launcher408retrieves the capabilities of the requesting process402from the manifest (e.g. metadata) of the requesting process402. It is understood that the requesting process402is an example or embodiment of the process402described with reference toFIG. 4. At504the launcher408checks the retrieved capabilities with the authorization process module404. For example, the launcher408can transmit the requesting process's402capabilities to the authorization process module404and, in response, the authorization process module404can verify whether the requesting process402has the capabilities that permit it to connect to a network connection (e.g. a protected connection). The authorization process module404may perform this step by using a set of pre-determined rules for verifying selected capabilities from a requesting process402.

At506the authorization process module404updates the ACL308to ensure that the requesting process402is noted or identified as permitted or authorized to correspond with the CDSC406using the PPS service300for certain network connections, which may be determined or identified in the capabilities of the requesting process. For example, the authorization process module404can edit the ACL308to ensure that the requesting process402is noted as permitted to connect a communication network106through one or more network connections. The permitted network connections can be part of the requesting process's402manifest or capabilities for example. Alternatively, the ACL308may only indicate that the requesting process402is permitted to connect to any network connection that it requests a connection to on the communication device102. It is understood that there may be other methods for maintaining a record or storing the identities of applications or processes that are permitted to access certain network connections.

At508, the requesting process402attempts to open communication with the CDSC406. For example, the requesting process402can request from the PPS service300(e.g. the PPS module310) that a PPS object304be opened in respect of a specified network connection (e.g. a protected connection). For example, the request to open the PPS object304could comprise an identification of the requesting process402(e.g. the process ID) and the identification of the network connection or network interface (e.g. port number or IP address). At510, the PPS service300(e.g. the PPS module310) transmits the open PPS object304request to the CDSC406. The CDSC406can then verify with the ACL308whether the requesting process402is permitted or authorized to connect to the identified network connection. Alternatively, verifying or confirming with the ACL308whether the requesting process402can access or connect to a specific network connection is performed by the PPS module310checking the ACL308(rather than by the CDSC406checking with the ACL308).

If permission for the requesting process402to connect to the identified network connection (e.g. a protected connection) is verified (i.e. the requesting process402has permission), the CDSC406instructs the PPS module308to open or instantiate a PPS object304if one is not already open or instantiated and to grant read and/or write access for the PPS object304to the requesting process402(at512). If permission is not verified, then read and write access for the PPS object304is not granted to the requesting process402and the requesting process402will therefore not be permitted to request form the CDSC406that it connect to the network connection. It is understood that the ACL308and/or the PPS module310and/or the CDSC406may indicate whether the requesting process402is authorized or has permission to only read from or only write to the PPS Object304.

At514, the PPS service300(e.g. the PPS module310) can open or instantiate the PPS object304(if one is not already opened or instantiated) and notify the requesting process402of this fact. The requesting process402may then be in a position to request that the CDSC406connect it to the associated network connection (e.g. the network connection associated with the PPS service300).

At516, the requesting process402transmits a connection request (e.g. by making a connection call) to the CDSC406through the PPS service300. For example, the requesting process402can write a message to the PPS object304requesting that the CDSC406open a connection to a specific network connection for the requesting process402to transmit data through. The connection request from the requesting process402can be for connecting to a specific network connection (e.g. a protected connection). It is recognized that other methods or protocols for initiating a connection from a specific application can be performed. Alternatively, for example, the PPS service300is not used and another method of communicating a connection request from the requesting process402to the CDSC406can be performed.

At518, in response to receiving the connection request (e.g. through the PPS service300) the CDSC406requests that the network interface module412activate a PDP context for the identified network connection. For example, the network interface module412may configure the PDP context for the requesting process402and the associated network connection. The request communicated from the CDSC406to the network interface module412can comprise the identity of the requesting process402along with certain other information in respect of the requesting process402in order to allow the network interface module to populate the PDP context with session information for the requesting process402. The network interface module412then activates the PDP context thereby opening the connection over the network connection or network interface. It is recognized that other methods or protocols for opening connections may be used. The network interface module412can comprise a radio transmitter in order to facilitate data transfer from a network connection (e.g. a protected connection) to a communication network106.

At520the network interface module412communicates to the CDSC406that the connection to the requested network connection (e.g. the protected connection) is open (i.e. that the PDP context is activated). At522the CDSC406communicates to the PPS service300(e.g. by writing to the PPS object304) that the connection is open, and at524, the requesting process402receives information from the PPS service300(e.g. by reading from the PPS object304) notifying of the open connection. It is recognized that there are alternative methods of communicating to the requesting process402that a network connection is open at a network interface. The CDSC406may also communicate to the PPS service300other status information in respect of the open network connection including that the blocking rule and allow rule have been applied.

At526, the requesting process402establishes a connection to a socket on the network interface (in association with the network interface module412, for example). It is understood that a bind operation may have been previously performed on the socket by the network interface module412and/or a process operating at or in association with the network interface. It is also understood that other actions to connect the requesting process402to the network interface in order to transmit data from the requesting process402to the network106may be undertaken at this stage.

At528, the requesting process402sends or transmits data across the open connection to the communication network106. It is understood that the requesting process402can also receive data from the communication network106across the network interface.

It is understood that the network connection discussed in respect ofFIG. 5can be a single protected connection and that the network interface discussed in respect ofFIG. 5can be associated with the protected connection.

Example Connection Protocol with Managed Data Transfer600

With reference toFIG. 6, a sequence of communications600that can be used in accordance with an exemplary embodiment will now be described. The sequence of communications identified at numeral600is such that control is maintained over the identity of the applications or processes on a communication device102that can establish a connection (e.g. a protected connection) to a communication network106(e.g. a wireless network) and that control is maintained over the identity of applications or processes that can transmit data across the protected connection or network interfaces associated with the protected connection.

In accordance with the illustrated embodiment, the stages describes at numerals502to520are performed as described in the sequence of communications500illustrated inFIG. 5.

At602, which can be performed after the PDP context is activated (at520inFIG. 5), the CDSC406instructs the packet filter module410apply a “block all” rule to all data passing through an identified network interface. It is understood that an alternative blocking rule could be applied that only prevents all data from being transferred from the requesting process402to the communication network106through the identified network interface and not vice versa. In an embodiment the packet filter module410applies the “block all” rule over the network interface in response to the instructions received from the CDSC406. It is understood that the packet filter module410can be in communication with, in association with or be coupled to the network interface module412in order to configure the “block all” rule.

At604the CDSC406instructs the packet filter module410to apply the “allow” rule to all data passing through the network interface. In an embodiment, the packet filter module410applies the “allow” rule to all data passing across the network interface in response to the instructions received from the CDSC406. The “allow” rule identifies the requesting process402(e.g. by process ID) such that data packets transmitted from the identified requesting process402will be permitted pass through the network interface unobstructed. The combination of the “block all” and “allow” rules results in a network interface through which all transmitted data is blocked except for data that is explicitly allowed to pass through in accordance with the “allow” rule. In accordance with an exemplary embodiment, all data that is transmitted from a requesting process402or other source identified in the “allow” rule will pass through the network interface despite the application of the “block all” rule. The use of the “allow” rule with the “bock all” rule comprises an example of selective restriction or management of the data that can be communicated over a network connection or network interface.

It is understood that before applying the blocking and allow rules (602and604), the packet filter module410may first install packet filter rules at the network interface, with the packet filter rules comprising both a blocking filter (e.g. the “block all” rule) and an allow filter rule (e.g. the “allow” rule).

The stages described at522,524,526and528can be performed as described in the sequence of communications500illustrated inFIG. 5and may be performed after the block all rule and allow rule are applied602,604.

Example Connection Protocol for a Second Process with Managed Data Transfer700

FIG. 7is a flowchart illustrating a method700of managing data transfer from a second process702to the protected connection established following the protocol described with reference toFIG. 6. It is understood that the second process702is an example or embodiment of the process402described with respect ofFIG. 4.

In accordance with the illustrated embodiment, the stages describes at numerals502to516are performed as described in the sequence of communications500illustrated inFIG. 5. It is understood that in one or more embodiments, updating the ACL506may not include amending the ACL506to list to identity of the second process702. Instead, updating the ACL506may only include verifying that the second process702is listed or identified in the ACL. Following the connection call516, the CDSC406instructs the packet filter module410to updated the allow rule704to include the identification of the second process702in the list of processes or applications that are permitted to transmit data across the network interface associated with the protected connection.

After the allow rule is updated704, the stages identified by numerals522,524,526and528as illustrated and described with reference toFIG. 5are performed.

As a result of the continued application of the block all rule and the application of the updated allow rule data from the requesting process402and from the second process702is permitted to be transmitted across the network interface of the protected connection, whereas data from any other application or process will be blocked by the block all rule. This use of the “allow” rule with the “bock all” rule comprises an example of selective restriction or management of the data that can be communicated over a network connection or network interface.

Method of Operation800,900,10000

FIG. 8is a flow chart illustrating a method800of managing data transfer from a communication device102to a communication network106over a wireless connection. The communications network106can be a cellular network for example. The wireless connection can be a network connection and/or a protected connection. By way of further example, the network connection can be to connect to a GPRS compliant network. The network connection can be accessed by an application or a process operating on a communication device102through, for example, a network interface module412, which is also operating on the communication device102. More specifically,FIG. 8illustrates a method800of establishing a protected connection between a requesting application402and a communication network106.

At802a determination is made as to whether the requesting process402on the communication device102is authorized to connect to the communication network106over a protected connection. The authorization may be based on capabilities of the requesting process402, on the type of protected connection or on other pre-determined criteria. In an exemplary embodiment, the connection between the requesting process402and the communication network106through the protected connection is first initiated or established. For example, the capabilities of the requesting process402may first be verified and the requesting process402may then be configured to request to establish the protected connection.

At804a network interface on the communication device102is configured to allow data packets to be transmitted from the requesting process402to the communication network106over the protected connection. The configuration of the network interface on the communication device102can include establishing the protected connection so that the network interface is associated with the protected connection. For example a PDP context may be attached and activated in association with the network interface to establish a protected connection between the requesting process402and the communication network106. In an exemplary embodiment, pre-determined rules or filters are applied at the network interface to restrict the type and/or quantity of the data that is sent across the network interface.

Referring toFIG. 9, numeral900is an illustration of an exemplary embodiment of managing data transfer from a communication device102to a communication network106over a wireless connection.

At902, a verification is made as to whether the requesting process402is permitted to request to establish a protected connection to the communication network106.

In accordance with an exemplary embodiment, verifying that the requesting process402is permitted to request to establish the protected connection comprises verifying the capabilities of the requesting process402. In an example embodiment, the launcher408extracts the capabilities of the requesting process402and sends the capabilities to the authorization process module404, where the requesting process402is authorized (or declined authorization) based on the extracted capabilities.

In accordance with an exemplary embodiment, verifying that the requesting process402is permitted to request to establish the protected connection comprises verifying with an ACL308that the requesting process402is permitted to transfer data across the protected connection to the communication network106. The ACL308can maintain the identification of applications or processes or other sources that are permitted to transfer data across or over a protected connection to the communication network106. In accordance with an embodiment, the identity of the requesting process402can be added to the ACL308. For example, the authorization process module404can also update the ACL308to indicate (in the ACL308) that the requesting process402is permitted to request to establish a protected connection to the communication network106. For example, the authorization process module404can update the ACL308to indicate that the requesting process402is permitted to request to establish the protected connection based on the capabilities of the requesting process402(as extracted by the launcher408, for example).

At904, a PPS object304is provided in response to verifying that the requesting process402is permitted to request to establish the protected connection. The PPS object304is for managing requests to establish protected connections or to connect to existing protected connections. For example the PPS object304manages requests from applications or processes running, executing or operating on the communication device102. In accordance with an embodiment, the requesting process402requests to open the PPS object304from the PPS module310or the CDSC406. The PPS module310or the CDSC406may determine whether the requesting process402is identified in the ACL308and, if so, the PPS object304may be opened for the requesting process402. If the requesting process402is not identified in the ACL308, the PPS object304may not be opened for the requesting process402. If the PPS object304is not opened, the requesting process402may not be able to communicate with the CDSC406and may not be able to open the PPS object304. The ACL308may also contain permissions identifying applications or processes that are permitted to open the PPS object304or identifying applications or processes that are permitted to request to connect to the protected connection.

At906, a request to establish the protected connection is received at the PPS object304from the requesting process402. For example, the requesting process402can write a message to the PPS object304requesting to establish the protected connection. According to an embodiment, the message comprises the identity of the requesting process402(e.g. the process ID) and the identity of communication network106.

At908, the CDSC406is provided with the request to establish the protected connection from the PPS object304. For example, the CDSC406can read the message from the PPS object304written by the requesting process402requesting to establish the protected connection. The CDSC406may be configured to request that a PDP context be activated in order to open or initiate the protected connection in response to receiving or reading the request to establish the protected connection from the requesting process402(through the PPS object304).

It is understood that other types of communication methods could be used (e.g. other object files) to allow or to manage communications between processes on a communication device102. It is recognized that other methods alternative to a PPS service300(stages904,906and908) can be used to configure the requesting process402to request to establish to the protected connection.

At910, in response to initiating the protected connection between the requesting process402and the communication network106, a PDP context is activated to allow data to be transferred or transmitted across the network interface to the communication network106. In an embodiment the PDP context may also be attached. In the illustrated embodiment, the CDSC406requests that the network interface module412activate (and/or attach) the PDP context. In a further example, the PDP context is populated at the CDSC406before the CDSC406requests or instructs the network interface module412to activate the PDP context. The network interface module412may transmit a confirmation message to the CDSC406indicating that the PDP is activated.

At920, a network interface on the communication device102is configured to allow data packets to be transmitted from the requesting process402to the communication network106over the protected connection. For example, the network interface may be the interface between the communication device102and the communication network106. In certain embodiments, such configuration may be such that a set of pre-determined rules is applied onto the network interface in order to selectively restrict or manage the transfer of data across the protected connection. The pre-determined rules can be based on identified applications or identified processes such that only the identified applications or identified processes are permitted to transfer data across the network interface. In a further embodiment, only identified types, formats or structures of data may be permitted to be transferred across the network interface.

An exemplary embodiment of configuring the network interface on the communication device102to allow data packets to be transferred from the requesting process402to the communication network106over the protected connection is illustrated in dashed lines at stages912,914,916and918. Stages912,914,916and918may be performed by the packet filter module410, for example. The packet filter module410can be operating under instructions from the CDSC406.

At912, packet filter rules are installed. For example, the packet filter rules can be installed at the network interface by the packet filter module410. The packet filter rules comprise a blocking filter rule that restricts transfer of data from all applications, processes or other sources across the network interface, and an allow filter rule comprising the identification of applications, processes or other sources to which the blocking filter rule does not apply. It is recognized that such packet filter rules may already be installed and in such a case packet filter rules may not be re-installed. The blocking filter rule can be the “block all” rule, described above. The allow filter rules can be the “allow” filter rule, described above.

At914, the blocking filter rule is applied on the network interface.

At916, the allow filter rule is applied on the network interface. It is recognized that the allow filter rule could be configured to allow data to be transmitted over the network interface based on criteria other than the identification of the application, process or other source from which the data is transmitted from. Example criteria could include the size of the data stream, the type of data, the structure of data, the format of data, etc.

At918, the requesting process402is added to the allow filter rule so that the blocking filter rule does not apply to the requesting process402. In an embodiment, the blocking filter rule blocks all data transferred or transmitted over the network interface except for data transmitted from the applications, process or other sources identified in the allow filter rule (such as the requesting process402).

After the network interface is configured to allow data packets to be transmitted from the requesting process402to the communication network106(e.g. using the packet filter module410described at stages912,914,916and918), a socket can be created at the protected connection, at922. At924the requesting process402can then be bound (e.g. using a bind operation) to the socket to allow the requesting process402to transmit data over or across the network interface (i.e. across the protected connection). It is recognized that the “socket” and “bind” operations can be performed by the network interface module412or another process or module.

FIG. 10illustrates an exemplary embodiment of a method1000of managing data transfer from a process across a protected connection. More specifically, the illustrated method1000is for managing data transmission from a second process702across a protected connection established in accordance with the method900described in reference toFIG. 9.

At1002, a verification is made as to whether the second process702is permitted to request to connect to the communication network106across the protected connection.

In accordance with an exemplary embodiment, verifying that the second process702is permitted to request to connect to the communication network106across the protected connection comprises verifying the capabilities of the second process702. In an example embodiment, the launcher408extracts the capabilities of the second process702and sends the capabilities to the authorization process module404, where the second process702is authorized (or declined authorization) based on the extracted capabilities.

In accordance with an exemplary embodiment, verifying that the second process702is permitted to request to connect to the communication network106across the protected connection comprises verifying with an ACL308that the second process702is permitted to transfer data across the protected connection to the communication network106. In accordance with an embodiment, the identity of the second process702can be added to the ACL308. For example, the authorization process module404can update the ACL308to indicate (in the ACL308) that the second process702is permitted to request to connect to the communication network106across the protected connection. For example, the authorization process module404can update the ACL308to indicate that the second process702is permitted to request to connect to the communication network106across the protected connection based on the capabilities of the second process702(as extracted by the launcher408, for example).

At1004, a PPS object304is provided in response to verifying that the second process702is permitted to request to connect to the communication network106across the protected connection. In accordance with an embodiment, the second process702requests to open the PPS object304from the PPS module310or the CDSC406. The PPS module310or the CDSC406may determine whether the requesting process402is identified in the ACL308and, if so, the PPS object304may be opened for the second process702. If the second process702is not identified in the ACL308, the PPS object304may not be opened for the second process702. If the PPS object304is not opened, the second process702may not be able to communicate with the CDSC406and may not be able to open the PPS object304. The ACL308may also contain permissions identifying applications or processes that are permitted to open the PPS object304or identifying applications or processes that are permitted to request to connect to the communication network106across the protected connection.

At1006, a request to connect to the communication network106across the protected connection is received at the PPS object304from the second process702. For example, the second process702can write a message to the PPS object304requesting to connect to the communication network106across the protected connection. According to an embodiment, the message comprises the identity of the second process702(e.g. the process ID), the identity of communication network106and the identity of the protected connection.

At1008, the CDSC406is provided with the request to connect to the communication network106across the protected connection from the PPS object304. For example, the CDSC406can read the message from the PPS object304written by the second process702requesting to connect to the communication network106across the protected connection. Other methods alternative to a PPS service300(stages1004,1006and1008) can be used to configure the second process702to request to connect to the communication network106across the protected connection.

At1018the second process702is added to the allow filter rule associated with the protected connection so that the block all rule associated with the protected connection is not applied to data transmitted from the second process702across the protected connection. Adding the second process702or the identification of the second process702(e.g. the process ID of the second process702) to the allow filter rule configures the network interface to allow data packets to be transmitted from the second process702to the communication network106across the protected connection.

At1022, a socket is created at the protected connection, at922. At1024the second process702can then be bound (e.g. using a bind operation) to the socket to allow the second process702to transmit data over or across the network interface (i.e. across the protected connection).

One or more embodiments have been described by way of example. It will be apparent to persons skilled in the art that a number of variations and modifications can be made without departing from the scope of what is defined in the claims.