# US 10,771,980 B2 · Communications device with secure data path processing agents > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 10,771,980 B2 - Document ID: US10771980B2 - Status: Granted - Kind: B2 - Application number: 15/977,731 - Filed: 2018-05-11 - Published: 2019-05-02 - Granted: 2020-09-08 - Earliest claimed: 2009-01-28 - Assignees: Headwater Research LLC - Applicants: Headwater Research LLC - Inventors: Gregory G. Raleigh; James Lavine; Alireza Raissinia; Michael J. Sabin - Web page: https://patentgrep.com/patent/US10771980B2 ## CPC - H04L 63/1425: {Traffic logging, e.g. anomaly detection} - H04L 41/046: comprising network management agents or mobile agents therefor - H04W 12/12: Detection or prevention of fraud - H04W 12/128: Anti-malware arrangements, e.g. protection against SMS fraud or mobile malware - G06F 21/575: {Secure boot} - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N) ## Abstract Secure device data records (DDRs) are provided. In some embodiments, a system for secure DDRs includes a processor of a wireless communication device for wireless communication with a wireless network, in which the processor is configured with a secure execution environment, and in which the secure execution environment is configured to: monitor service usage of the wireless communication device with the wireless network; and generate a plurality of device data records of the monitored service usage of the wireless communication device with the wireless network, in which each device data record is associated with a unique sequence order identifier; and a memory coupled to the processor and configured to provide the processor with instructions. In some embodiments, the secure execution environment is located in an application processor, in a modem processor, and/or in a subscriber identity module (SIM). ## Claims ### Claim 1 A wireless communications device comprising: an application execution environment and network stack to provide wireless network access for user application software executing in the application execution environment; a policy enforcement client to implement a device communication activity policy applicable to wireless network access provided for the user application software; a wireless modem chipset in network data path communication with the network stack, the wireless modem chipset including a secure execution environment configured to be inaccessible to the user application software, the secure execution environment including signal processing elements and one or more secure data path processing agents configured to: execute in the secure execution environment, monitor a device data communications activity that utilizes the wireless modem chipset to receive and transmit data passing between the network stack and a wireless network, generate a device data record comprising information about the monitored device data communications activity, the information configured to assist a network element in determining whether the wireless communications device is operating or has operated in accordance with the device communication activity policy, and send the device data record to the network element over a trusted communication link between the one or more data path processing agents and the network element; and a trusted data path between the one or more secure data path processing agents and the signal processing elements wide area network port. ### Claim 2 (depends on 1) The wireless communications device of claim 1, wherein the secure data path processing agents further comprise a device data record mailbox, the device data record mailbox relaying the device data records to an agent outside of the secure execution environment for transmission to the network element. ### Claim 3 (depends on 1) The wireless communications device of claim 1, further comprising a subscriber identity module (SIM), wherein at least a portion of the SIM is within the secure execution environment. ### Claim 4 (depends on 3) The wireless communications device of claim 3, wherein the agent configured to generate the device data record resides on the SIM. ### Claim 5 (depends on 4) The wireless communications device of claim 4, wherein the network data path between the network stack and the wireless modem chipset passes through the SIM, and the secure data path processing agents further comprise a data path security verifier in the wireless modem chipset. ### Claim 6 (depends on 5) The wireless communications device of claim 5, wherein the data path security verifier restricts network access to allow only monitored device data communications activity. ### Claim 7 (depends on 1) The wireless communications device of claim 1, further comprising an applications processor unit section that is within the secure execution environment. ### Claim 8 (depends on 7) The wireless communications device of claim 7, wherein the agent configured to generate the device data record resides within the applications processor unit section. ### Claim 9 (depends on 8) The wireless communications device of claim 8, wherein the network data path between the network stack and the wireless modem chipset passes through the applications processor unit section, and the secure data path processing agents further comprise a data path security verifier in the wireless modem chipset. ### Claim 10 (depends on 9) The wireless communications device of claim 9, wherein the data path security verifier restricts network access to allow only monitored device data communications activity.