Encrypted Traffic Monitoring via WAN-LAN Device Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing audience measurement entities (AMEs) face challenges in accurately monitoring network traffic data on modern WiFi networks due to advanced encryption protocols like WPA3 and mesh networking, which prevent decryption of network traffic, making it difficult to determine demographics and media consumption patterns.
Innovation Solution
The method involves correlating unencrypted wide area network (WAN) traffic with local area network (LAN) traffic to analyze media consumption, using control packets to identify client devices, and generating scores for device identifiers, without the need for decrypting encrypted LAN traffic.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If advanced encryption protocols (WPA3) and mesh networking are implemented in modern WiFi networks, then network security and reliability are improved, but the ability to decrypt and monitor network traffic deteriorates
Solution Approach 1:
The patent introduces an intermediary device (streaming meter) positioned between the WiFi network and the monitoring system. This device captures unencrypted WAN traffic packets and correlates them with encrypted LAN traffic patterns without attempting to decrypt the encrypted traffic. The intermediary enables monitoring by working around the encryption barrier rather than breaking it.
Solution Approach 2:
The patent creates a copy of the monitoring approach by analyzing unencrypted WAN traffic as a substitute for directly analyzing encrypted LAN traffic. By copying the correlation methodology to work with available unencrypted traffic data, the system achieves monitoring capabilities without requiring decryption of protected traffic.
2Measurement precision
If packet injection techniques are used to monitor encrypted traffic, then measurement precision is improved, but device complexity and requirements deteriorate
Solution Approach 1:
The patent extracts the monitoring function from the encrypted traffic domain and relocates it to the unencrypted WAN traffic domain. By taking out the monitoring operation from the encrypted LAN environment and performing it on unencrypted WAN traffic instead, the system eliminates the need for complex packet injection capabilities and up-to-date WiFi cards.
Solution Approach 2:
The patent replaces expensive, complex packet injection hardware with simpler, more accessible monitoring equipment. By using readily available devices that can capture unencrypted WAN traffic, the system achieves monitoring functionality without requiring specialized high-end WiFi cards or complex injection hardware.
3Adaptability or versatility
If correlation of WAN and LAN traffic is implemented, then adaptability to encrypted networks is improved, but data processing complexity increases
Solution Approach 1:
The patent segments the monitoring task into distinct components: capturing unencrypted WAN traffic packets, capturing encrypted LAN traffic patterns, and correlating these two data streams through timing and device identifier matching. By dividing the complex correlation task into manageable segments, the system achieves adaptability to encrypted networks while keeping processing complexity manageable.
Data Source
AI summary
In one aspect, a method is described. The method includes detecting a first data packet transmitted through a wide area network (WAN), the first packet representing media presented at a client device of a plurality of client devices at a media exposure measurement location, each client device having a respective device identifier; detecting, within a monitoring interval, one or more second data packets transmitted through a local area network (LAN), each of the one or more second packets specifying a candidate device identifier, where the monitoring interval comprises a time window from the detection of the first packet; generating a score for each candidate device identifier based on a number of the second packets detected within the monitoring interval; based on the score, selecting, from the candidate device identifiers, a target device identifier; and storing data correlating the first packet with the target device identifier.