Monitoring wireless data consumption

Patent metadata

Field	Value
Publication number	US-9807058-B2
Application number	US-201514859765-A
Country	US
Kind code	B2
Filing date	Sep 21, 2015
Priority date	Jul 2, 2015
Publication date	Oct 31, 2017
Grant date	Oct 31, 2017

Abstract

Techniques and devices for circumventing wireless data monitoring in communications between a communication device and a proxy server, as well as systems and techniques for detecting and resolving vulnerabilities in wireless data monitoring systems are described herein. The techniques for circumventing wireless data monitoring may include manipulating a routing table of a communication device, encapsulating data in an unmonitored protocol, and transmitting the encapsulated data in a “bearer,” or communications channel, to a proxy server that fulfills requests included in the encapsulated data. Furthermore, the techniques for detecting and resolving network vulnerabilities may include restricting protocols by bearers in an Access Control List, limiting a bandwidth of a bearer, or protecting a routing table in a secure location of the communication device.

First claim

What is claimed is:

1. A system comprising:
a communication device including a first memory coupled to a first processor, the first memory including one or more modules that are executable by the first processor to perform first operations comprising:
gaining root access to the communication device;
updating a routing table stored in the first memory of the communication device, the routing table identifying at least a first destination and a first communication bearer;
encapsulating a hypertext transfer protocol (HTTP) request from an application stored in the first memory as an Internet Control Message Protocol (ICMP) packet; and
transmitting the ICMP packet to a proxy server via the first communication bearer based at least in part on the routing table; and

the proxy server including a second memory coupled to a second processor, the second memory including one or more modules that are executable by the second processor to perform second operations comprising:
receiving the ICMP packet transmitted by the communication device;
fetching content based at least in part on the HTTP request;
encapsulating the content as an ICMP reply packet; and
transmitting the ICMP reply packet to the communication device,

wherein the updating the routing table stored in the first memory of the communication device includes adding the first destination to the routing table, the first destination indicating an address of the proxy server, and wherein the first communication bearer is a Voice over Long Term Evolution (VoLTE) voice channel having an associated Quality of Service (QoS) class identifier (QCI).

2. The system of claim 1 , wherein the first operations of the communication device further comprise:
receiving the ICMP reply packet; and
providing an indication to a service provider of a network vulnerability.

3. The system of claim 2 , further comprising a data server associated with the service provider, the data server comprising a third memory coupled to a third processor, the third memory including one or more modules that are executable by the third processor to perform third operations comprising:
receiving the indication of the network vulnerability; and
updating an access control list to block the ICMP packet from being delivered to the proxy server.

4. The system of claim 2 , further comprising a data server associated with the service provider, the data server comprising a third memory coupled to a third processor, the third memory including one or more modules that are executable by the third processor to perform third operations comprising:
receiving the indication of the network vulnerability; and
restricting a bandwidth of the first communication bearer.

5. A computer-implemented method comprising:
gaining root access to a communication device associated with a service provider;
updating a routing table of the communication device to identify at least a first destination and a first communication bearer, wherein the first destination is a destination unauthorized by the service provider;
encapsulating data as an encapsulated data packet;
transmitting the encapsulated data packet to a proxy server via the first communication bearer based at least in part on the routing table; and
receiving an encapsulated reply data packet from the proxy server at the communication device, the encapsulated reply data packet including at least web content fetched by the proxy server,
wherein the first communication bearer is a dedicated bearer providing Voice over Long Term Evolution (VoLTE) voice communications.

6. The method of claim 5 , further comprising providing an indication to the service provider of a network vulnerability.

7. The method of claim 5 , further comprising updating an access control list to block the encapsulated data packet from being delivered to the proxy server.

8. The method of claim 5 , wherein the proxy server is not controlled by the service provider.

9. The method of claim 5 , further comprising restricting a bandwidth of the first communication bearer.

10. The method of claim 5 , wherein the encapsulating the data as the encapsulated data packet comprises encapsulating a hypertext transfer protocol (HTTP) request as an Internet Control Message Protocol (ICMP) packet.

11. The method of claim 5 , further comprising:
providing an indication to the service provider of a network vulnerability; and
in response, storing the routing table in a trusted execution environment of the communication device.

12. The method of claim 5 , further comprising:
receiving the encapsulated data packet at the proxy server;
fetching content based at least in part on the encapsulated data packet;
encapsulating the content as an encapsulated reply packet; and
transmitting the encapsulated reply packet to the communication device.

13. The method of claim 5 , wherein the transmitting the encapsulated data packet is not logged in a data volume associated with a data monitoring module.

14. The method of claim 5 , wherein the receiving the encapsulated reply data packet includes receiving the web content in an Internet Control Message Protocol (ICMP) reply packet from the proxy server.

15. A communication device operating on a network associated with a service provider, the communication device comprising:
a processor, and
a memory including one or more modules that are executable by the processor to perform operations comprising:
updating a routing table stored in the memory to identify at least a first destination and a first communication bearer, wherein the first destination is a proxy server unauthorized by the service provider;
encapsulating data as an encapsulated data packet;
transmitting the encapsulated data packet to the proxy server via the first communication bearer based at least in part on the routing table;
receiving an encapsulated reply data packet, the encapsulated reply data packet including at least web content fetched by the proxy server;
providing an indication to the service provider of a network vulnerability; and
in response, storing the routing table in a trusted execution environment of the communication device.

16. The communication device of claim 15 , wherein the operations further comprise providing the indication to the service provider of the network vulnerability based at least in part on the receiving the encapsulated reply data packet.

17. The communication device of claim 15 , wherein the encapsulating the data as the encapsulated data packet comprises encapsulating a hypertext transfer protocol (HTTP) request as an Internet Control Message Protocol (ICMP) packet.

Assignees

• T Mobile Usa Inc

Inventors

• Jia Yunhan
• Yoon Jong Sung
• Hui Jie
• Kwong Samson Kim-Sun
• Lau Kevin
• Mendoza Salvador
• Mao Zhuoqing Morley

Classifications

• H04L67/02

  based on web technology, e.g. hypertext transfer protocol [HTTP] · CPC title

• H04L63/0281 Primary

  Proxies · CPC title

• H04L12/4633

  Interconnection of networks using encapsulation techniques, e.g. tunneling · CPC title

• H04L63/1441

  Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002) · CPC title

• H04W28/0263

  involving mapping traffic to individual bearers or channels, e.g. traffic flow template [TFT] · CPC title