Application Identification in the

Age of Encryption

Authored by: Jonathon Gordon, Directing Analyst, Expert Market Insight

November 2016

info@expertmi.com +1-917-259-1020 http://www.expertmi.com/research/

The Ever-Evolving Internet

The Internet by its very nature is a truly dynamic phenomenon. It is continuously

growing and transforming, as new devices, applications, content and ideas push the
very boundaries of what we believe possible. A few numbers should help set the
scene:

 In 2015, the mobile Internet had more than 7.5 billion connections1 (4.5 billion
unique subscribers). The GSMA predicts that this number will increase to 5.6
billion by the end of the decade; covering 70% of the world's population.
 The Apple Store alone currently has over 2 million apps available for
download, while apps have been downloaded from the site 130 billion times2.
Google Play has slightly more apps available.
 Vint Cerf, a "father of the Internet", recently stated that while there are
approximately 10-15 billion devices connected to the Internet today (3-4 per
person), the number is expected to reach 1 trillion devices within 20 years
(100 devices per person)3.
 Global mobile data traffic reached 3.7 exabytes per month at the end of 2015,
and is expected to reach 30.6 exabytes per month by 20204.

While the Internet evolves as a global phenomenon, each county, and indeed each
operator, must deal with multifarious ramifications. With dreams of smart cities,
autonomous cars and virtual reality already coming to fruition, the mounting
challenge for operators is how to stay ahead of, or at least keep pace with, the
changing requirements.

Gaining granular visibility into what and how their own networks are being used is
key to staying ahead of this extremely demanding curve. Identifying patterns and
emerging trends in behavior, usage and quality of experience will be central to the
operators' ability to keep up with demand and continue to innovate and stay
competitive, as the wider environment continues to transform. This granular visibility
becomes even more critical as the industry advances well into the Age of Encryption.

1 http://www.gsma.com/mobileeconomy/
2 https://techcrunch.com/2016/06/13/apples-app-store-hits-2m-apps-130b-downloads-50b-paid-to-
developers/
3 Vint Cerf: Internet Is Evolving—A Glimpse at 2016-2036

http://www.smithsonianmag.com/videos/category/future-is-here/vint-cerf-internet-is-evolvinga-
glimpse-at/?no-ist
4http://www.cisco.com/c/en/us/solutions/collateral/service-provider/visual-networking-index-
vni/mobile-white-paper-c11-520862.html

2
Enter the Age of Encryption

While encrypting data on the Internet is hardly a new concept, the pace of adoption
continues to rise. There is much public concern about privacy on the Internet, and
there is no denying the need to protect subscribers in an ever-connected world.

The immense challenge for operators today is to

support the consumers' legitimate concerns for The Internet Society Policy Brief
privacy, while at the same time promoting the on Encryption, June 2016.
best possible experience. "Encryption technologies enable
Internet users to protect the
Currently, all top 10 web sites encrypt, either by confidentiality of their data and
default or upon user log-in, as do 42 of the top communications from unwanted
50 sites. Based on analysis of one source of observation and intrusion.
Internet backbone data, the HTTPS portion of Encryption is also a technical
total traffic has already risen from 13 percent to foundation for trust on the
Internet. It promotes freedom of
49 percent since April 20145. An estimated 70-80
expression, commerce, privacy,
percent of traffic will be encrypted by the end of
user trust, and helps protect data
2016. from bad actors."
Taking Google's services as a yardstick, the uptake of encryption becomes clear. As
of October 16, 2016, 85% of requests to Google's servers used encrypted
connections.

Figure 1 - Increase in Encrypted Google Traffic over time

These numbers include data from both mobile and fixed devices, and include
applications, such as Gmail, Google Drive, Google Maps and YouTube. Netflix, by
contrast, has only recently added TLS encryption, but expects "the majority of
streaming sessions to be using TLS encryption by the end of 20166". Turning a blind
eye to encryption is just not an option for operators.

5
http://www.iisp.gatech.edu/sites/default/files/images/online_privacy_and_isps.pdf
6
https://people.freebsd.org/~rrs/asiabsd_tls_improved.pdf

3
The Darkening Internet (The Business Challenges of Encryption)

Telecom decision makers need to pay close attention to verify that their ability to
accurately identify encrypted traffic is not significantly reduced. This is not just an
obscure engineering issue, but an issue capable of degrading an operator's ability to
effectively manage their own network assets, analyze their subscribers' behavior and
may significantly erode their ability to innovate and remain competitive in the future!

Consider the scenario of trying to direct people through a pitch-black room, while
someone else is continuously rearranging the furniture, the walls and the doors. Now
imagine that the room is Internet-sized. As encryption becomes pervasive, if not
taken into consideration, the operators’ view of the Internet and indeed their own
network will rapidly disappear. This fading view will directly affect an operator's ability
to deploy business critical use cases and threatens both current and future business
models.

Without accurate application identification of encrypted traffic, CSPs will lose their
ability to:

 Manage and optimize their own network assets

 Understand and analyze how customers use the services they provide and
how these services can be made better
 Better compete and innovate to enhance future positioning

Business Areas Impacted: Where are operators feeling the pain?

Operators are dealing with an enormously complex puzzle while the ground is
constantly shifting beneath their feet. There is a demand for them to deliver more
and more application traffic with an increasing focus on personalization - while strict
regulatory standards often hold them in place, and yet they are still expected to
remain competitive and innovative.

Operators cannot be expected to meet these challenges unless they acquire access to
a comprehensive, actionable picture of what is transpiring across their networks, and
how their customers are using their service/s. There are some significant operational
areas and tasks within the operator’s business that will be severely impacted as the
picture begins to fade.

4
Network Operations/Engineering – Responsibilities and tasks impacted:

 Service availability and performance

 Day-to-day network monitoring
 Analysis and reporting, network troubleshooting
 Network capacity planning

Marketing and Product Owners – Responsibilities and tasks impacted:

 Developing and launching new core and value-added services

 Ensuring consistency of the delivered service with the customer needs
 Providing key customer insights on how current services are used and the
impact on network resources
 Determining optimal segmentation for marketing purposes

C-level/Senior Management and Board– Responsibilities and tasks impacted:

 Determining a profitable and workable business model

 Establishing sustainable competitive advantage
 Creating value for shareholders

Current and Future Use Cases at Risk

Use Case #1 - Network Management

Operations and engineering teams often face a relentless battle to keep the network
running optimally, while dealing with the ever-increasing traffic demands and
complexity. Network management is a key process by which these teams identify
potential issues and respond to them, preventing or minimizing any impact on
customers. The ability to accurately identify application traffic and the capability to
distinguish between traffic types, for example, voice, video or text within WhatsApp,
play a critical role in network and traffic management.

Congestion Management
In a mobile network, there are often points of congestion at peak times of the day or
week, or even permanently, if network expansion is delayed or not possible due to
radio frequency limitations or other reasons. Congestion causes bottlenecks that
often result in unpredictable downtime, failures and outages to applications, which
occur without consideration for the sensitivity of the applications to interruptions.

The ability to identify the impacted cell ID for the traffic, and separate sensitive and
valuable application traffic from background traffic (e.g., Web surfing vs. Dropbox
sync) is critical to manage the impact of congestion.

5
Real-Time Troubleshooting
Network operators need to have application traffic control to perform real-time
troubleshooting, which is based on both network issues and customer complaints.
Network engineers must be able to literally drill down to individual customers'
applications and sometimes even down to individual sessions. This drill down makes
it possible to monitor applications such as Gmail or Netflix, and pinpoint and solve
many issues.

Figure 2 - Real-time troubleshooting and congestion management - per application, per device and per cell

Network Planning
Capacity planning and decisions relating to network expansion require detailed and
comprehensive information on subscribers, applications, usage patterns, and the like.
Literally, the more information planning engineers have access to, the more informed
decisions they can make. Application usage patterns of high value subscribers may
just be the critical factor in deciding where and when to invest in a network build out.

Network management is critical for all network operators, regardless of the access
network type. The ability to intelligently manage traffic across the network is a basic
function of every operator, everywhere. With the tools for granular identification in
place, comprehensive network management is still very feasible - even with
encrypted traffic.

Use Case #2 - Network Analytics and Business-Critical Insights

Most operators ceaselessly and meticulously collect and analyze granular network
data, which they can slice and dice, or indeed compile into a strategic picture of how

6
their own network is performing and evolving. Operators will use this trend analysis
to support strategic decisions regarding how they can tweak the performance of an
application, such as video or VoIP, how they might enhance the quality of experience
for a specific subscriber segment, or what new services they might plan to roll out. In
this case, any parameters measured can not only be improved, but can also provide
the catalyst for new customer offerings.

Subscriber Experience and Churn Propensity

Due to the evolving nature of the Internet (devices, applications, content), it is no
longer enough to measure the quality of service or basic network performance. An
individual customer is at this very point in time employing a unique device,
interacting with a specific app or accessing their choice of content. These choices
and other factors will have a direct impact on the customer’s own individual
experience. This level of operator immersion is critical to understand each customer's
experience. If an operator can identify subscribers with a below acceptable level of
experience, these may be classified as high churn risk customers, and tangible steps
may be taken to rectify the situation, and retain them.

Application Experience
Subscribers tend to judge their broadband experience by how well (or how badly) the
network delivers high value content - as defined by them of course. Streaming video
from providers such as Netflix or YouTube would undoubtedly fall into the category
of high value content for many subscribers (The figure below shows relative brand
popularity and traffic volume). The subscriber experience is determined by the
customer viewing the video at a particular time and place, on their chosen device.
Any buffering or stalls will quickly cause them to give up viewing their chosen
content. If the problem recurs, they are likely to approach customer support, and if
the problem persists, they may also churn from the operator.

Figure 3 - Streaming video application breakdown from a leading European operator (source: Procera)

7
Engagement
A granular picture of customer segments and individual subscribers provides
operators with a unique opportunity to engage and interact with their subscribers.
This opportunity enables the operators to continuously adapt their offerings and
services to match the changing needs and desires of their customers. Operators can
improve customer loyalty, provide self-assistance to subscribers and increase
upselling through targeted promotions.

Applications, content and subscriber demands will continue to evolve at a

breathtaking pace. The only option for operators to possibly match this tempo is to
conscientiously collect, analyze and act on the granular data they manage to collect.
Ignoring the impact of encryption will severely devalue any amount of data the
operator may collect, and so dramatically reduce its usefulness. Operators simply
cannot deliver a quality experience until they understand what is traversing their
networks.

Use Case #3 - Innovation and Competitive Positioning

Some operators have taken bold steps over the last few years to literally claw back
ground in terms of innovation. Some have chosen to take on the Over the Top (OTT)
providers at their own game, providing their own OTT messaging or video apps for
example. Other operators have been hugely successful leveraging and partnering
with OTT players, content providers and application developers.

Zero Rating "Killer Content"

In November 2015, T-Mobile USA launched Binge On, a revolutionary zero-rated
video service. The practice of exempting specific application traffic from data
allowances was already not new by this time. T-Mobile had been offering free music
streaming (Music Freedom) since mid-2014. T-Mobile took a good hard look at its
own network, and it was easy to see what content customers wanted to access -
video. The industry-shaking leap came with the realization that for the clear majority
of subscribers, the resolution or definition of the video had little impact on the
experience itself. Subscribers are more than happy to watch standard definition
video, when the streaming is consistent and the video free7.

7
https://newsroom.t-mobile.com/news-and-blogs/binge-on-100-providers.htm

8
Seeing and Seizing the next opportunity
Pokémon GO was an Internet sensation. A free-to-play, location-based augmented
reality game developed by Niantic, it took the mobile Internet by storm when it
initially launched in mid-2016. The graphs below show the impact on a mobile
operator in Brazil, where the local game launch was timed to coincide with the Rio
Olympics. The impact on operator networks was phenomenal. Figure 1 below shows
the traffic generated by the application downloads from the iTunes Store and Figure
2 shows the resulting impact of the game on the network traffic.

Figure 4 - iTunes App Store Pokémon Go downloads (source: Procera)

9
 Figure 5 - Network impact of subscribers playing Pokémon Go (source: Procera)

Many operators were quick to identify and seize on this unfolding opportunity to
ingratiate themselves with existing subscribers and attract new ones8. The likes of T-
Mobile and Sprint were quick to entice gamers with offers of zero-rated Pokémon
data and discounts on battery packs. Reuters reported9 that subscribers in parts of
Asia were switching operators, seeking out the prime operator to fulfill their
Pokémon GO needs.

Operators must continue to innovate and take advantage of every opportunity that is
presented to them. Operators should be on the lookout for the obvious or
sometimes less-obvious application trends. Resolute observation and astute analysis
of the application traffic on their own networks will enable them to offer unique and
innovative services that increase their value to customers and shareholders alike.

Conclusion

Fixed and mobile telecom providers operate in an environment that is in a state of

constant flux and evolution. While operations and engineering teams face a
relentless battle to keep the network running optimally, marketers work on tweaking
existing offerings and launching new ones.

8
http://www.mobileworldlive.com/apps/news-apps/operators-jump-on-pokemon-go-
bandwagon/
9
http://www.reuters.com/article/us-nintendo-pokemon-asia-idUSKCN10U0L4

10
Decision-makers within telecom operators need to be aware that "you can't manage
what you can't see". What can't be seen may have a significant impact on their ability
to innovate and remain competitive in the future!

Retaining the ability to accurately identify applications in the Age of Encryption, will
be a crucial factor for future success.

About Expert Market Insight - Research

We believe real expert analysis is
about experience, insight and in-
depth knowledge. That is what
we share.

11