Over at the LinkedIn Mobilists group I’ve started a discussion related to Apple’s Push Notifications.
How do Push Notifications actually work in the network? What did Apple do?
Here is a blond guess: They use the existing SMS infrastructure. Intercept a special “type” of SMS on iPhone OS level (based on sender & message body) and hide it from the user. Effectively the user does not recognize that this special SMS has been received.
They then dispatch a request on the data network to poll the details from their own infrastructure. From that point onwards they entirely bypass the carrier infrastructure. Advantages: International routing of “push notification SMS” :-) is solved. Store and forward is done.
Any other guesses? Or maybe anybody around knowing?

This push notification method is what we have done with previous JavaME projects. We would register the application to listen on a specific port and send the SMS to this port – worked fine for us but if the iPhone is considered to be ‘always on’ then it would own its own IP; therefore you could just use the internet layer to communicate with it as you do with any other server.