Tethering Detection via IPv4-IPv6 DNS-TCP Correlation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current methods for detecting unauthorized tethering in IPv6 mobile networks are ineffective due to spoofing applications that modify IP headers and User-Agent fields, making it difficult for wireless Internet service providers to identify unauthorized devices accessing their networks.
Innovation Solution
A system and method that communicatively couples a computing device to a mobile device using an IPv4 address and the mobile device to an IPv6 network, utilizing a network module to receive DNS response packets and correlate TCP packets to determine if the computing device is tethered by matching destination addresses and hostnames, regardless of IPv4 or IPv6 protocols.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If spoofing applications modify IP headers and User-Agent fields to hide unauthorized tethering, then the ability to conceal unauthorized devices is improved, but the effectiveness of traditional detection methods deteriorates
Solution Approach 1:
The patent transitions from detecting tethering based on Layer 4 (transport layer) characteristics like TCP/UDP ports and User-Agent fields to detecting based on Layer 3 (network layer) characteristics, specifically the correlation between IPv4 destination addresses in TCP packets and IPv6 destination addresses in DNS response packets. This dimensional shift to the network layer bypasses the modifications made by spoofing applications at higher layers.
Solution Approach 2:
The patent introduces DNS response packets as an intermediary element for detection. By correlating the IPv6 destination address from DNS responses with IPv4 destination addresses from TCP packets, the system creates an indirect detection path that bypasses the spoofed traffic characteristics. The DNS response serves as a trusted reference point that reveals the actual destination of tethered traffic.
2Ease of operation
If detection methods rely on TCP/IP stack signatures and User-Agent fields, then detection simplicity is improved, but adaptability to IPv6 networks and spoofing techniques deteriorates
Solution Approach 1:
The patent creates a detection mechanism that works across both IPv4 and IPv6 protocols by establishing a correlation method between the two address families. The system universally applies the same detection logic (correlating DNS response IPv6 addresses with TCP packet IPv4 addresses) regardless of which protocol is being used for the actual tethered connection, making the detection method adaptable to different protocol versions.
3Difficulty of detecting and measuring
If spoofing applications run proxy servers that modify signatures to match native originated signatures, then the difficulty of detection is improved, but the network control capability deteriorates
Solution Approach 1:
The patent performs detection actions before the spoofed traffic can complete its deceptive transformation. By correlating DNS response packets (which occur early in the connection establishment process) with subsequent TCP packets, the system identifies tethering behavior at the initial stage, before proxy servers can fully modify signatures to match native originated signatures. This preliminary detection prevents spoofed traffic from establishing complete deceptive patterns.
Data Source
AI summary
A system for detecting a computing device tethered to a mobile device is described. The system includes communicatively coupled the computing device to the mobile device with an IPv4 domain protocol. Additionally, the mobile device is communicatively coupled to the mobile data network with an IPv6 domain protocol. A network module, associated with a mobile data network, receives a DNS request packet from the mobile device. An IPv6 hostname and an IPv6 destination address is associated with the DNS response packet, when the DNS response packet is associated with the IPv6 address. Additionally, an IPv4 hostname and an IPv4 destination address is associated with the DNS response packet, when the DNS response packet is associated with the IPv4 address. A communication packet, generated by the mobile device, is also received by the network module. The communication packet includes a destination address and a hostname. The computing device is tethered to the mobile device when the destination address matches the IPv4 destination address and the hostname does not match the IPv6 hostname.