# US 12,120,551 B2 · Security, fraud detection, and fraud mitigation in device-assisted services systems > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,120,551 B2 - Document ID: US12120551B2 - Status: Granted - Kind: B2 - Application number: 18/136,255 - Filed: 2023-04-18 - Published: 2023-08-24 - Granted: 2024-10-15 - Earliest claimed: 2009-02-04 - Assignees: Headwater Research LLC - Applicants: Headwater Research LLC - Inventors: Gregory G. Raleigh; James Lavine; Jeffrey Green - Web page: https://patentgrep.com/patent/US12120551B2 ## CPC - H04W 28/10: Flow control {between communication endpoints} - H04L 12/1407: {Policy-and-charging control [PCC] architecture} - H04L 63/105: {Multiple levels of security} - H04L 63/20: {for managing network security; network security policies in general (filtering policies H04L63/0227)} - H04M 15/00: Arrangements for metering, time-control or time indication {; Metering, charging or billing arrangements for voice wireline or wireless communications, e.g. VoIP} - H04M 15/41: {Billing record details, i.e. parameters, identifiers, structure of call data record [CDR]} - H04M 15/47: {Fraud detection or prevention means} - H04M 15/66: {Policy and charging system} - H04W 4/24: Accounting or billing - H04W 12/08: Access security - H04W 28/02: Traffic management, e.g. flow control or congestion control - H04W 80/04: Network layer protocols, e.g. mobile IP [Internet Protocol] - H04W 84/12: WLAN [Wireless Local Area Networks] - H04W 88/06: adapted for operation in multiple networks {or having at least two operational modes}, e.g. multi-mode terminals - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04M: TELEPHONIC COMMUNICATION (circuits for controlling other apparatus via a telephone cable and not involving telephone switching apparatus G08) ## Abstract Secure architectures and methods for improving the security of mobile devices are disclosed. Also disclosed are apparatuses and methods to detect and mitigate fraud in device-assisted services implementations. ## Claims ### Claim 1 A method for use by a system including one or more processors, the method comprising: receiving, by the one or more processors from a first end-user device of a plurality of end-user devices, a request for a device credential, the request including a device identifier; generating, by the one or more processors and in response to the request, the device credential; storing, by the one or more processors and in response to the request, the device credential in a database; sending, by the one or more processors and in response to the request, the device credential to the first end-user device; receiving, by the one or more processors, a first application credential associated with a first application installed on the first end-user device; generating, by the one or more processors, a signed application credential based on the first application credential and the device credential stored in the database; and sending, by the one or more processors, the signed application credential to the first end-user device. ### Claim 2 (depends on 1) The method of claim 1, wherein the request further includes a subscriber identifier. ### Claim 3 (depends on 1) The method of claim 1, wherein the one or more processors receive the first application credential from a trusted source. ### Claim 4 (depends on 1) The method of claim 1, wherein generating the device credential includes encrypting the device credential with a key. ### Claim 5 (depends on 1) The method of claim 1, wherein the signed application credential is a run-time application credential. ### Claim 6 (depends on 5) The method of claim 5, further comprising: evaluating, by the one or more processors, the run-time application credential. ### Claim 7 (depends on 1) The method of claim 1, further comprising: refreshing, based on an event, the signed application credential to create a different signed application credential unique to the first end-user device; sending the different signed application credential to the first end-user device to supersede the signed application credential. ### Claim 8 (depends on 1) The method of claim 1, wherein the signed application credential is generated based on a combination of the first application credential and the device credential stored in the database. ### Claim 9 (depends on 8) The method of claim 8, wherein the combination includes a hash. ### Claim 10 (depends on 1) The method of claim 1, further comprising: using the device credential to establish a secure communication with the first end-user device. ### Claim 11 A system comprising: one or more processors configured to: receive, from a first end-user device of a plurality of end-user devices, a request for a device credential, the request including a device identifier; generate, in response to the request, the device credential; store, in response to the request, the device credential in a database; send, in response to the request, the device credential to the first end-user device; receive a first application credential associated with a first application installed on the first end-user device; generate a signed application credential based on the first application credential and the device credential stored in the database; and send the signed application credential to the first end-user device. ### Claim 12 (depends on 11) The system of claim 11, wherein the request further includes a subscriber identifier. ### Claim 13 (depends on 11) The system of claim 11, wherein the one or more processors are configured to receive the first application credential from a trusted source. ### Claim 14 (depends on 11) The system of claim 11, wherein generating the device credential includes encrypting the device credential with a key. ### Claim 15 (depends on 11) The system of claim 11, wherein the signed application credential is a run-time application credential. ### Claim 16 (depends on 15) The system of claim 15, wherein the one or more processors are further configured to: evaluate the run-time application credential. ### Claim 17 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to: refresh, based on an event, the signed application credential to create a different signed application credential unique to the first end-user device; send the different signed application credential to the first end-user device to supersede the signed application credential. ### Claim 18 (depends on 11) The system of claim 11, wherein the signed application credential is generated based on a combination of the first application credential and the device credential stored in the database. ### Claim 19 (depends on 18) The system of claim 18, wherein the combination includes a hash. ### Claim 20 (depends on 11) The system of claim 11, wherein the one or more processors are further configured to: use the device credential to establish a secure communication with the first end-user device.