Encrypted Traffic Detection via NW-ETDF Authentication

Solution Overview

Problem

End-to-end encryption in wireless communication systems hinders mobile network operators' ability to accurately detect traffic types, making it difficult to apply service-specific policies, such as differentiated charging for video streaming traffic, and deep packet inspection methods have proven unreliable, especially with advanced security protocols like TLS 1.3.

Innovation Solution

The method involves authenticating user equipment (UE) with a network-encrypted traffic detection function (NW-ETDF), modifying data packets to include detection information, and using application keys to identify encrypted data flows, allowing network functions to apply appropriate traffic rules based on the identified applications.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If end-to-end encryption is implemented to protect communication privacy, then security and privacy are improved, but traffic type detection accuracy deteriorates

Engineering Contradiction:

Improvecommunication privacy protectionVSAvoidtraffic type detection accuracy

Core Design Contradiction:

ReliabilityVSMeasurement precision

Solution Approach 1:

The patent introduces an intermediary detection mechanism that operates between the encrypted communication channels and the network policy enforcement point. This intermediary uses machine learning models trained on encrypted traffic patterns to identify application types without decrypting the actual content, thus maintaining privacy while enabling detection.

Inventive Principle:

Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent replaces traditional deep packet inspection (DPI) mechanical analysis methods with machine learning-based pattern recognition. Instead of examining encrypted payload content directly, the system uses ML models to analyze statistical properties, packet timing, and flow characteristics of encrypted traffic to infer application types.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

2Difficulty of detecting and measuring

If deep packet inspection is deployed to detect encrypted traffic types, then traffic detection capability is improved, but reliability and accuracy deteriorate due to encryption protocols like TLS 1.3

Engineering Contradiction:

Improveencrypted traffic detection capabilityVSAvoiddetection accuracy

Core Design Contradiction:

Difficulty of detecting and measuringVSReliability

Solution Approach 1:

The patent replaces traditional deep packet inspection (DPI) mechanical analysis methods with machine learning-based pattern recognition. Instead of examining encrypted payload content directly, the system uses ML models to analyze statistical properties, packet timing, and flow characteristics of encrypted traffic to infer application types.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Solution Approach 2:

The patent shifts the detection parameters from content-based analysis (which fails with strong encryption) to metadata-based analysis including packet inter-arrival times, packet size distributions, flow duration, and connection patterns. These parameters remain observable even when payload encryption is strong.

Inventive Principle:

Principle #35Parameter changes

3Adaptability or versatility

If traditional deep packet inspection methods are used to identify applications, then detection coverage is improved for unencrypted traffic, but detection effectiveness deteriorates with advanced encryption protocols

Engineering Contradiction:

Improvedetection coverageVSAvoiddetection effectiveness

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The patent creates a universal detection framework that handles both encrypted and unencrypted traffic through a single machine learning-based system. The same infrastructure processes all traffic types, automatically adapting its analysis methods based on whether the traffic is encrypted or not, thereby providing consistent detection effectiveness across different protocols.

Inventive Principle:

Principle #6Universality (Multi-functionality)

Solution Approach 2:

The patent replaces traditional deep packet inspection (DPI) mechanical analysis methods with machine learning-based pattern recognition. Instead of examining encrypted payload content directly, the system uses ML models to analyze statistical properties, packet timing, and flow characteristics of encrypted traffic to infer application types.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

Data Source

PatentUS12101633B2Encrypted traffic detection

Publication Date: 2024.09.24 LENOVO (SINGAPORE) PTE LTD

AI summary

Apparatuses, methods, and systems are disclosed for associating the start of an encrypted data flow with an application. One apparatus includes a memory storing instructions executable by a processor to cause the apparatus to authenticate an encrypted traffic detection function (“ETDF”) of the remote unit and to provide the remote unit with a list of application identifiers for which encrypted traffic detection information is to be provided, in response to successfully authenticating the ETDF of the remote unit. The instructions are executable by the processor to cause the apparatus to generate detection information for each application in the list of application identifiers and to send the list of application identifiers and the detection information for each application in the list of application identifiers to a network function in the mobile communication network.