Wireless end-user device with secure network-provided differential traffic control policy list

A wireless end-user device, comprising:

• a wireless wide area network (WWAN) modem to communicate data for Internet service activities between the device and at least one WWAN, when configured for and connected to the WWAN;
• a wireless local area network (WLAN) modem to communicate data for Internet service activities between the device and at least one WLAN, when configured for and connected to the WLAN;
• and
• one or more processors configured to
• securely receive, from a first network element, at least a portion of a differential traffic control policy list, the differential traffic control policy list distinguishing between a first one or more applications resident on the device and a second one or more applications resident on the device,
• receive Internet service access requests associated with applications resident on the device, including a plurality of applications distinguished by the differential traffic control policy list,
• classify, as a first classification, a wireless network to which the device currently connects in order to communicate data for Internet service activities as at least one of a plurality of network types that the device can connect with,
• classify, as a second classification, whether a particular application associated with a
• given received Internet service access request, and capable of both interacting with a user in a user interface foreground of the device, and
• at least some Internet service activities when not interacting with a user in the device user interface foreground,
• is interacting with the user in the device user interface foreground, and
• apply a differential traffic control policy to the given received Internet service access request, based on
• (i) the first and second classifications performed by the one or more processors, and
• (ii) the differential traffic control policy list,
• such that, when the particular application is one of the first one or more applications, the one or more processors are operable to
• block the given received Internet service access request in a first state of the first and second classifications, wherein the classified wireless network is a first one of the network types, and the particular application is classified as not interacting with a user in the device user interface foreground, and
• allow the given received Internet service access request under at least one different state of the first and second classifications.