Encrypted Network Traffic Monitoring via WAN–LAN Device Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing audience measurement entities (AMEs) face challenges in accurately monitoring network traffic data on modern WiFi networks due to advanced encryption protocols like WPA3 and mesh networking, which prevent decryption of network traffic, making it difficult to determine demographics and usage patterns of media presentation devices.
Innovation Solution
The method involves correlating unencrypted wide area network (WAN) traffic with local area network (LAN) traffic to analyze media consumption patterns, using control packets to identify client devices, and generating scores for device identifiers, without requiring the latest WiFi cards or packet injection techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If advanced encryption protocols (WPA3) and mesh networking are implemented to secure network traffic, then network security is improved, but the ability to monitor and analyze network traffic data deteriorates
Solution Approach 1:
The patent uses an intermediary approach by monitoring unencrypted control packets (intermediary signals) that traverse the encrypted network, rather than attempting to decrypt the main data traffic. These control packets serve as mediators that reveal device identifiers and traffic patterns without compromising the encrypted communication channels.
Solution Approach 2:
The patent extracts only the necessary monitoring information (device identifiers from control packets) from the encrypted network traffic, leaving the main encrypted data flow intact. This extraction approach allows monitoring functionality while preserving network security and encryption integrity.
2Measurement precision
If packet injection techniques and latest WiFi cards are used to monitor encrypted traffic, then traffic analysis capability is improved, but device complexity and cost increase
Solution Approach 1:
The patent employs inexpensive, widely compatible WiFi capture cards rather than requiring cutting-edge WiFi 6/7 cards with packet injection capabilities. The approach uses readily available hardware that can capture control packets without needing advanced features, thereby reducing cost and complexity while maintaining monitoring effectiveness.
Solution Approach 2:
The patent replaces the mechanical approach of packet injection (requiring special hardware capabilities) with a passive capture approach using standard WiFi monitoring modes. This substitution eliminates the need for complex packet injection mechanisms and latest-generation WiFi cards.
3Measurement precision
If decryption methods are used to analyze media consumption patterns, then demographic analysis accuracy is improved, but network security and privacy are compromised
Solution Approach 1:
The patent extracts only device identifier information from control packets rather than attempting to decrypt or access the actual media content. This extraction of minimal necessary information enables demographic analysis through device identification while avoiding privacy intrusion into the encrypted communication content.
Solution Approach 2:
The patent uses control packets as intermediaries that indirectly reveal device information without directly accessing or decrypting private communication content. This intermediary method provides the necessary monitoring data while maintaining the privacy and security of the actual media traffic.
Data Source
AI summary
In one aspect, a method is described. The method includes detecting a first data packet transmitted through a wide area network (WAN), the first packet representing media presented at a client device of a plurality of client devices at a media exposure measurement location, each client device having a respective device identifier; detecting, within a monitoring interval, one or more second data packets transmitted through a local area network (LAN), each of the one or more second packets specifying a candidate device identifier, where the monitoring interval comprises a time window from the detection of the first packet; generating a score for each candidate device identifier based on a number of the second packets detected within the monitoring interval; based on the score, selecting, from the candidate device identifiers, a target device identifier; and storing data correlating the first packet with the target device identifier.