WO2018036613A1

WO2018036613A1 - A method, network node and system for controlling tethering

Info

Publication number: WO2018036613A1
Application number: PCT/EP2016/069888
Authority: WO
Inventors: Maxim TESLENKO; Keven WANG; Qiang Li
Original assignee: Telefonaktiebolaget Lm Ericsson (Publ)
Priority date: 2016-08-23
Filing date: 2016-08-23
Publication date: 2018-03-01

Abstract

A method performed in a network node for controlling tethering being provided by an endpoint device to a tethered device is provided. The network node receives a first IP packet to be forwarded by the endpoint device to the tethered device, obtains a Time to Live, TTL, value in a network layer header of the first IP packet. The network node blocks tethering by: generating a second IP packet by modifying the TTL value of the first IP packet to N when the TTL value of the first IP packet is bigger than N, where a data payload in the second IP packet is the same as a data payload in the first IP packet; and routing the second IP packet instead of the first IP packet towards the endpoint device. The endpoint device is located N hops from the network node. The modified TTL value of the second IP packet enables the endpoint device to discard and not forward the second IP packet to the tethered device.

Description

_Λ

A METHOD, NETWORK NODE AND SYSTEM FOR CONTROLLING TETHERING

TECHNICAL FIELD

Embodiments herein relate to a network node, a method and a system therein. In particular, they relate to controlling tethering.

BACKGROUND

Tethering is connecting a tethered device to another device. In the context of a User Equipment (UE), such as e.g. a mobile phone or a tablet computer, tethering allows sharing the internet connection of the mobile phone or tablet computer with a tethered device such as a laptop. In this case, the UE acts as an access point for the tethered device.

Tethering may be detrimental to a network service provider. For example, tethering may create more network data traffic over the service provider network by tethered devices that are not subscribers of the network service provider. In order to effectively manage data subscriptions, the network service provider needs to know if tethering exists.

There are a plurality of known techniques that can be used to detect whether a UE is tethering. These techniques include: a UE asking the network service provider for approval if tethering is allowed, or a UE notifying the network service provider of tethering, inspecting a MAC address, sniffing a user-agent, or checking a software update. However they are either probabilistic or rely on the UE to report tethering.

SUMMARY An object of embodiments herein is to provide another way to control tethering in a communications network.

According to a first aspect of embodiments herein, the object is achieved by a method performed in a network node for controlling tethering that is provided by an endpoint device to a tethered device. The endpoint device is located N hops from the network node. The network node receives a first Internet Protocol, IP, packet to be forwarded by the endpoint device to the tethered device. The network node obtains a Time to Live, TTL, value in a network layer header of the first IP packet. The network node blocks tethering by: generating a second IP packet by modifying the TTL value of the first IP packet to N when the TTL value of the first IP packet is bigger than N; and routing the second IP packet instead of the first IP packet towards the endpoint device. A data payload in the second IP packet is the same as a data payload in the first IP packet. The modified TTL value of the second IP packet enables the endpoint device to discard and not forward the second IP packet to the tethered device.

According to a second aspect of embodiments herein, the object is achieved by a network node for controlling tethering that is provided by an endpoint device to a tethered device. The endpoint device is located N hops from the network node. The network node is configured to receive a first IP packet to be forwarded by the endpoint device to the tethered device; and to obtain a Time to Live, TTL, value in a network layer header of the first IP packet. The network node is also configured to block tethering by: generating a second IP packet by modifying the TTL value of the first IP packet to N when the TTL value of the first IP packet is bigger than N; and routing the second IP packet instead of the first IP packet towards the endpoint device. A data payload in the second IP packet is the same as a data payload in the first IP packet. The modified TTL value of the second IP packet enables the endpoint device to discard and not forward the second IP packet to the tethered device.

According to a third aspect of embodiments herein, the object is achieved by a system for controlling tethering that is provided by an endpoint device to a tethered device. The system comprises a network node according to the second aspect.

According to a fourth aspect of embodiments herein, the object is achieved by a computer program comprising instructions, which when executed by a network node, cause the network node to perform the method according to the first aspect.

According to a fifth aspect of embodiments herein, the object is achieved by a carrier comprising the computer program according to the fourth aspect. The carrier is one of an electronic signal, an optical signal, an electromagnetic signal, a magnetic signal, an electric signal, a radio signal, a microwave signal, or a computer-readable storage medium.

Thanks to that the TTL value is modified, blocking of tethering is realized by enabling the endpoint device to discard and not forward the IP packet with the modified TTL value to the tethered device.

By modifying the TTL value, the embodiments apply even to the scenario when the configuration of tethered device is changed. Due to the fact that modification of the TTL is performed by the network node, instead of the tethered device, even when the configuration of the tethered device is changed, the embodiments herein still achieve the same result. Additionally, as the embodiments are implemented in the network node, which is transparent to the endpoint device, no change is therefore required on the endpoint device.

BRIEF DESCRIPTION OF THE DRAWINGS

Examples of embodiments herein are described in more detail with reference to attached drawings in which:

Figures 1A-1 B are schematic block diagrams illustrating a communication network according to embodiments of the present invention.

Figures 2A-2Care signaling diagrams depicting embodiments of methods in a network node. Figure 3 is a flowchart depicting embodiments of a method in a network node. Figure 4 is a flowchart depicting embodiments of a method in a network node. Figure 5 is a schematic block diagram illustrating embodiments of a network node.

DETAILED DESCRIPION

As part of developing the embodiments herein, the inventors realized that all of above conventional solutions have a certain limitation or drawback, for example they all introduce too much traffic load in the network, or they cannot block tethering.

Embodiments herein relate to a method to control tethering. Controlling tethering herein includes determining, also referred to as detecting or discovering, if a UE is providing tethering, and, if it is necessary, blocking the traffic transported through tethering by modifying a Time To Live (TTL) value in an Internet Protocol (IP) header of an IP packet towards an endpoint device.

Figure 1 A and Figure 1 B depict examples of a communications network in which embodiments herein may be implemented, where Figure 1 B provides more example details. An endpoint device 115 is located N hops from a network node 113. A hop is a portion of a path between a source node and destination node. Each time a packet is passed to a next device, a hop occurs. One hop is one step from one device, e.g., a router to a next device, e.g. another router. The endpoint device 1 15 accesses the Internet 1 1 1 via the network node 1 13.

The network node 1 13 may communicate with the endpoint device 1 15 using a wireless communication technique, such as an LTE network, a WCDMA network, a GSM network, any 3GPP cellular network, 5G, WiMAX, or any cellular network or system. The network node 1 13 may also use wired communication techniques to communicate with the endpoint device 1 15.

The network node 1 13 supports IP protocol, and may e.g. be a radio base station (RBS), for example an eNB, an eNodeB, or an Home Node B, an Home eNode B or any other network node capable to serve a user equipment or a machine type communication device in a cellular radio network. The network node 1 13 may also e.g. be any network device in virtual or physical form having a routing module or a routing function, e.g., including a router, layer-3 switch, a firewall, a gateway, a Gateway General Packet Radio Service (GPRS) Support Node (GGSN) or having a network function working on layer 3 and above.

Tethering is provided by the endpoint device 1 15 to the tethered deice 1 17 via e.g., one of: a USB connection, a Bluetooth connection, a Wi-Fi access point connection, a Wi- Fi direct connection and an Ethernet connection.

The tethered device 1 17 may also be referred to as a tethering consumer as shown in Figure 1 B. The tethered device 1 17 and the endpoint device 1 15 may e.g. be a UE a mobile terminal or a wireless terminal, a mobile phone, a computer such as e.g. a laptop, a Personal Digital Assistants PDAs or a tablet computer, sometimes referred to as a surf plate, with wireless capability, or any other radio network units capable to communicate over a radio link in a wireless communications network. Please note that the term user equipment used in this document also covers other wireless devices such as Machine to machine (M2M) devices, even though they do not have any user.

The endpoint device 1 15 is a subscriber to an Internet service, such as e.g., a data service. Tethering is provided by an endpoint device 1 15 to a tethered device 1 17, which may not be a subscriber to the Internet service.

The endpoint device 1 15 may provide tethering to multiple tethered devices 1 17 at the same time as shown in Figure 1 B. As an example the tethered devices 1 17 are located one hop from the endpoint device 1 15 according to Figure 1 B, however they may be any number of hops from the endpoint device 1 15. For instance this is the case when there are multiple layers of tethering, i.e. when the tethered device 1 17 located at a first layer further provides tethering to another tethered device located at a further layer, e.g., a second layer. The tethered device in the second layer is located two hops away from the endpoint device 1 15 in this case.

According to embodiments herein, the network node 1 13 blocks and/or detects tethering traffic by modifying a TTL value in the network header of an IP packet addressed to the endpoint device 1 15. This will be described below. Example of embodiments of a method performed by the network node 1 13 for controlling tethering will now be described with reference to Figure 2A and Figure 3. Tethering is provided by the endpoint device 1 15 to the tethered device 1 17. The method may comprise the following actions, which actions may be taken in any suitable order.

In an example scenario, as can be seen only in Figure 2A, the tethered device 1 17 transmits, Action 301 , a request to access the Internet 1 1 1 to the endpoint device 1 15. The request may, e.g. ask for an access to a server in the Internet 1 1 1 . The endpoint device 1 15 then forwards, Action 302, the request to the network node 1 13. The network node 1 13 routes, Action 303, the request to the Internet 1 1 1 . Actions 301 -303 are optional. In another example scenario (not shown), the tethered device 1 17 may also transmit user data to the endpoint device 1 15, in which case the endpoint device 1 15 forwards the user data to the network node 1 13.

Action 310

According to embodiments herein, the network node 1 13 receives a first IP packet to be forwarded by the endpoint device 1 15 to the tethered device 1 17. The first IP packet is received from the Internet 1 1 1. The first IP packet is addressed to the endpoint device

1 15, i.e., a destination of the first IP packet is an IP address of the endpoint device 1 15.

However, because of tethering, the first IP packet will be forwarded by the endpoint device 1 15 to the tethered device 1 17.

The first IP packet may be used for, e.g., transmitting a response for a request to access the Internet 1 1 1 , as shown in Figure 2A, and may also be used for e.g., transmitting user data.

Action 320 In order to block tethering, the network node 1 13 needs to know the TTL value in the received first IP packet, in order to see whether the TTL value of the first IP packet is bigger than N. Since the endpoint device 1 15 is located N hops from the network node 1 13, and if the TTL value is bigger than N, the first IP packet is understood to be for a device tethered to the endpoint device 1 15, e.g. tethered device 1 17. The network node 1 13 therefore inspects the first IP packet. Specifically, the network node 1 13 obtains a TTL value in a network layer header of the first IP packet.

It is known that an IP packet is composed of an IP header and a data payload. A TTL field is part of the IP header, which may also be referred to as network layer header. The purpose of the TTL field the network layer header is loop detection and prevention, i.e. to detect that an IP packet enters into a loop topology and to avoid that it stays in the network forever. In practice, TTL is measured in hops. The TTL field is set by the source node, and reduced at every hop. If the TTL value reaches zero before the IP packet arrives at its destination, then the IP packet is discarded during the transmission.

Action 330

As can be seen in Figure 3, after knowing the first IP packet is for the tethered device 1 17, the network node 1 13 blocks tethering, in order to block traffic to and from the tethered device 1 17, who is not a subscriber.

According to some embodiments, the method may further comprise repeating the Actions 310 - 330 for a time period, thereby continuously blocking IP packets. The length of the time period is a design parameter and the embodiments are not restricted to any value.

Specifically, blocking tethering in Action 330 comprises actions 331 and 332 below. Action 331

Blocking tethering means that an IP packet should be discarded before arriving or at the endpoint node 1 15. It is provided in embodiments herein to set the TTL value to N, because the network node 1 13 is aware that the endpoint device 1 15 is located N hops away. The network node 1 13 generates a second IP packet by modifying the TTL value of the first IP packet to N when the TTL value of the first IP packet is bigger than N. A data payload in the second IP packet is the same as a data payload in the first IP packet. By modifying the TTL value, an IP header of the second IP packet is therefore different from that of the first IP packet. However the data payload of the generated second IP packet is the same as that of the first IP packet. The first IP packet may be stored in a memory for the sake of subsequent actions.

As mentioned above, the endpoint device 1 15 is located N hops from the network node 1 13. As an example, when the network node 1 13 is located 1 hop from the endpoint device 1 15, N is 1 .

When modifying the TTL value of the first IP packet to N, the second IP packet will only be transmitted N hops at most, i.e. only to the endpoint device 1 15 and not all the way to the tethered device 177 which is more than N hops, e.g. N+1 hops, away from the network node 1 13. The endpoint device 1 15 will instead discard the second IP packet since the maximum number of hops has been reached, i.e. the TTL has expired. This will be further described below.

When the TTL value of the first IP packet is equal to or smaller than N, the network node 1 13 just forwards the first IP packet to next hop as usual instead of modifying the TTL value as above. In this case, the first IP packet is likely discarded at the endpoint device 1 15 or before arriving to the endpoint device 1 15, hence the same effect as blocking tethering is achieved. It is unnecessary to modify the TTL value to N. Action 332

The network node 1 13 routes the second IP packet instead of the first IP packet towards the endpoint device 1 15, e.g., via a radio interface which employs any one of the wireless communication techniques as mentioned above. The modified TTL value of the second IP packet enables the endpoint device 1 15 to discard and not forward the second IP packet to the tethered device 1 17.

Since the second IP packet instead of the first IP packet is routed to a next hop, tethering is blocked. Being the next hop the endpoint device 1 15 discards, Action 332a, the second IP packet because its TTL expires.

Thus, by setting the TTL value to N, which is equal to the number of hops from the network node 1 13 to the endpoint device 1 15, the second IP packet is allowed to travel N hops at most . It means that when the second IP packet arrives at the endpoint device 1 15, it will be discarded by the endpoint device 1 15 due to the fact that its TTL expires. Thereby the tethered device 1 17 won't receive any packet from the Internet 1 1 1 , i.e. traffic to it is effectively blocked. Because the concept is based on modifying the TTL value it is easy to implement the embodiments. Additionally, as the embodiments are implemented in the network node 1 13, these are transparent to the endpoint device 1 15, i.e. no change is required on the endpoint device 1 15.

Another advantage is that the same result is achieved even when the configuration of tethered device is changed, e.g. the tethered device 1 17 is hacked, rooted and/or software on tethered device 1 17 is compromised. Hacking or rooting a device herein means gaining a privileged control, e.g. administrative permission or super user access, of a device, in order to change its configuration.

Action 340

The network node 1 13 may not be aware of tethering but in some embodiments the network node 1 13 will find out whether or not the first IP packet relates to tethering. Thus optionally, the network node 1 13 determines tethering. The operation of determining tethering will be discussed in detail below.

The Action 340 may be performed either prior to and/or after the Action 310. For instance, if the aim is to block tethering after detecting it, then the method may further comprise performing the Actions 310 - 330 on a subsequent IP packet after the Action 340.

The determining of tethering in Action 340 above may be performed by the following method depicted in Figure 4 in together with Figures 2B and 2C. The method is illustrated with respect to both Transmission Control Protocol/Internet Protocol (TCP/IP) tethering (Actions 341 -344 in Figure 4 together with Figure 2B), User Datagram

Protocol/Internet Protocol (UDP/IP) tethering (Actions 345-360 in Figure 4 together with Figure 2C). The method may comprise the following actions, which actions may be taken in any suitable order.

Determining TCP/IP tethering, Actions 341 -344, Figure 4 together with Figure 2B In case of TCP/IP tethering, the first IP packet is a TCP/IP packet. The endpoint device 1 15 is running TCP/IP. The method of determining the TCP/IP tethering may comprise the following actions, which actions may be taken in any suitable order.

Action 341 When an IP packet arrives at the destination, the destination here being the tethered device 1 17, it will send an Acknowledgement (Ack), message to notify the source node of the receipt, otherwise the destination node does not send an Ack message. If the tethered device 1 17 sends the Ack message, the network node 1 13 will receive it through the 5 endpoint device 1 15. Therefore, the network node 1 13 can determine whether or not an Ack message is received with respect to a sent IP packet. The network node 1 13 determines that no Ack, message in response to the routed second IP packet has been received within a time period, owing to the second IP packet did not arrive at the tethered device 1 17 in this case. An advantage is that a simple way of determining tethering by

10 making use of the Ack message is provided.

According to some embodiments, the network node 1 13 looks for the Ack message for a time period. The length of the time period is a design parameter and the embodiments are not restricted to any value. The network node 1 13 waits the time period because it takes time to deliver the second IP packet to the endpoint device 1 15 or tethered device

15 1 17 and get Ack back in response. The network node 1 13 waits long enough to let the round trip plus some normal network delay and processing delay. On the other hand, the network node 1 13 will not look for it a too long time period since during this time period the tethered device 1 17 receives no traffic and in case the objective is only to detect tethering the tethered device 1 17 should not be out of service for too long time.

20

Action 342

In order to determine whether tethering exists, the network node 1 13 generates a third IP packet with a TTL value not smaller than, i.e., either equal to or bigger than, N+1 . A data payload of the generated third IP packet is the same as that of the first IP packet. 25 Being equal to or bigger than N+1 means that the third IP packet will reach the tethered device 1 17 if sent to the endpoint device 1 15.

According to some embodiments, the network node 1 13 generates the third IP packet by:

• modifying the TTL value of the first IP packet to M when the TTL value of the first 30 IP packet is smaller than N+1 , wherein M≥N+1 ; or

• using the first IP packet as the third IP packet when the TTL value of the first IP packet is not smaller than N+1.

Action 343 The network node 1 13 routes the third IP packet towards the endpoint device 1 15. The TTL value of the third IP packet, which is not smaller than N+1 , enables the endpoint device 1 15 to forward the third IP packet to the tethered device 1 17.

The endpoint device 1 15 receives the third IP packet, and forwards, Action 343a, the third IP packet to the tethered device 1 17 since the TTL value is bigger than or equal to N+1 . After that, an Ack message with respect to the third IP packet is sent by the tethered device 1 17, and received, Action 343b, at the endpoint device 1 15. The endpoint device 1 15 forwards, Action 343c, the Ack message with respect to the third IP packet to the network node 1 13.

Action 344

The network node 1 13 receives the Ack message with respect to the third IP packet. The difference between the second and third IP packets is the one hop difference of TTL value. Comparing to the Action 341 , where there is no Ack message in response to the second IP packet, and the Action 343c where the Ack message in response to the third IP is received, it's therefore determined that the tethered device 1 17 exists in one hop further from the endpoint device 1 15, tethering based on TCP/IP is confirmed. The network node 1 13 determines that tethering related to a Transmission Control Protocol exists, when the Ack message in response to the routed third IP packet has been received.

In case there are multiple layers of tethering, the embodiment is enabled to determine the first layer tethering only. In practice, as long as the first layer is detected, it is enough to confirm TCP/IP tethering exists.

According to some embodiments, the method may further comprise forwarding the first IP packet towards the endpoint device 1 15, thereby the first IP packet may arrive to the tethered device 1 17 via the endpoint device 1 15, detecting without blocking tethering is thereby achieved.

Determining UDP/IP tethering, Actions 345-360, Figure 4 together with Figure 2C

It is realized that applying the same Actions 341 -344 to determine UDP/IP tethering as for TCP/IP tethering is not feasible due to the fact that UDP socket in tethering consumer may potentially be absolutely silent to the network. ICMP message is therefore used here for determining a UDP tethering.

In case of a UDP/IP tethering, the IP packet is a UDP/IP packet. The endpoint device 1 15 is running UDP/IP. As can only be seen in Figure 2C, the network node 1 13 receives, Action 345a, an ICMP message notifying a source node 1 1 1 of the first IP packet that the modified TTL value has exceeded. Based on this ICMP message, the method of determining the UDP/IP tethering may comprise the following actions, which actions may be taken in any suitable order. Action 345

The network node 1 13 determines that tethering related to a UDP exists, when an ICMP message has been received, which ICMP message notifies a source node 1 1 1 of the first IP packet that the modified TTL value has exceeded. Regarding an IP packet, also referred to as a datagram, if the TTL value is zero then receiver not only discards such a datagram but also sends an ICMP "Time to Live exceeded in transit" message to a source of the datagram.

An advantage of making use of the ICMP message to determine the UPD/IP tethering is that the tethered device 1 17 is left shorter time without internet service compared to the method of determining TCP/IP tethering described above, owing to that we do not wait for an absence of Ack for the time period according to the Action 341.

Referring to the UDP/IP packet tethering, the method of controlling tethering may further comprise the following Actions 350 and 360 to clean up the consequence incurred by the above actions for blocking tethering. Action 350

With respect to the received ICMP message, the network node 1 13 discards and not forwards the ICMP message to the source node 1 1 1.

Since the ICMP message is actually in response to the second IP packet with TTL value = N, instead of the first IP packet, it is not necessary to notify the source node 1 1 1 of the expiration of the second IP packet. By discarding and not forwarding the ICMP message an advantage is that the traffic load in the Internet 1 1 1 is reduced. Another advantage is that a usual way of handling the first IP packet is maintained, since no ICMP message has been generated with respect to the first IP packet according to the usual way.

Action 360

To not block the tethering traffic, the network node 1 13 routes the first IP packet towards the endpoint device 1 15. Thereby the tethered device 1 17 may receive, Action 370, the first IP packet, if the TTL value of the first IP packet does not expire. By forwarding the first IP packet, determining without blocking tethering is achieved. The tethering traffic is forwarded as usual towards the endpoint device 1 15, and may finally reach the tethered device 1 17 if the TTL value of the first IP packet does not expire. To perform the method actions for controlling tethering that is provided by an endpoint device 1 15 to a tethered device 1 17, the network node 1 13 may comprise the following arrangement depicted in Figure 5.

The network node 1 13 is configured, e.g. by means of a transceiver 510, to receive a first IP packet to be forwarded by the endpoint device 1 15 to the tethered device 1 17. The network node 1 13 is also configured, e.g. by means of an obtaining module 520, to obtain a Time To Live, TTL, value in a network layer header of the first IP packet. The network node 1 13 is also configured, e.g. by means of a blocking module 530, to block tethering by: generating a second IP packet by modifying the TTL value of the first IP packet to N when the TTL value of the first IP packet is bigger than N; and routing the second IP packet instead of the first IP packet towards the endpoint device 1 15. The data payload in the second IP packet is the same as a data payload in the first IP packet. The endpoint device 1 15 is located N hops from the network node 1 13. The modified TTL value of the second IP packet enables the endpoint device 1 15 to discard and not forward the second IP packet to the tethered device 1 17.

The network node 1 13 may be further configured, e.g. by means of a determining module 540, to determine tethering by: determining that no Acknowledgement, Ack, message in response to the routed second IP packet has been received within a time period; generating a third IP packet with a TTL value not smaller than N+1 and with the same data payload as in the first IP packet; routing the third IP packet towards the endpoint device 1 15, wherein the TTL value of the third IP packet which is not smaller than N+1 enables the endpoint device 1 15 to forward the third IP packet to the tethered device 1 17; and determining that tethering related to a Transmission Control Protocol exists, when an Ack message in response to the routed third IP packet has been received.

The network node 1 13 may be further configured, e.g. by means of the determining module 540, to generate the third IP packet by:

modifying the TTL value of the first IP packet to M when the TTL value of the first IP packet is smaller than N+1 , wherein M≥N+1 ; or using the first IP packet as the third IP packet when the TTL value of the first IP packet is not smaller than N+1 .

The network node 1 13 may be further configured, e.g. by means of the determining module 540, to determine tethering by: determining that tethering related to a User Datagram Protocol exists, when an Internet Control Message Protocol, ICMP, message has been received, which ICMP message notifies a source node 1 1 1 of the first IP packet that the modified TTL value has exceeded. The network node 1 13 may be further configured, e.g. by means of a discarding module 550, to discard and not forward the ICMP message to the source node 1 1 1 . The network node 1 13 may be further configured, e.g. by means of a routing module 560, to route the first IP packet towards the endpoint device 1 15. The network node 1 13 is may further comprise a memory 570 configured to store, e.g. IP packets, such as the first IP packet, data, configurations, and applications to perform the methods herein when being executed in the network node 1 13.

According to another embodiment, the above modules 520-560 are also referred to as a Traffic Interceptor (Tl) 590.

According to some embodiments, a system for controlling tethering that is provided by an endpoint device 1 15 to a tethered device 1 17 is provided. The system comprises the above network node 1 13. The system may further comprise the endpoint device 1 15 and/or the tethered device 1 17.

In some embodiments, a computer program comprises instructions, which when executed by the at least one processor, such as a processor 595 comprised in the network node 1 13, cause the at least one processor to perform actions according to any of the Actions 320-360, 331 -332 and 341 -345.

In some embodiments, a carrier comprises the computer program, wherein the carrier is one of an electronic signal, an optical signal, an electromagnetic signal, a magnetic signal, an electric signal, a radio signal, a microwave signal, or a computer-readable storage medium. In some embodiments, the process of controlling tethering that is provided by the endpoint device 1 15 to the tethered device 1 17, may be implemented through one or more processors such as the processor 595 comprised in the network node 1 13, together with computer program code for performing the functions and actions of the embodiments herein. The program code mentioned above may also be provided as a computer program product, for instance in the form of a data carrier carrying computer program code for performing the embodiments herein when being loaded into the network node 1 13. One such carrier may be in the form of a CD ROM disc. It is however feasible with other data carriers such as a memory stick. The computer program code may furthermore be provided as pure program code on a server and downloaded to network node 1 13. The network node 1 13 may further comprise a memory such as e.g. the memory 570 comprising one or more memory units. The memory comprises instructions executable by the respective processor 595. The memory 570 is arranged to store e.g. IP packets, data, configurations, and applications to perform the methods herein when being executed in the network node 1 13.

Those skilled in the art will also appreciate that the modules in network node 1 13, described above may refer to a combination of analog and digital circuits, and/or one or more processors configured with software and/or firmware, e.g. stored in the respective memory, that when executed by the one or more processors as described above. One or more of these processors, as well as the other digital hardware, may be included in a single Application-Specific Integrated Circuitry ASIC, or several processors and various digital hardware may be distributed among several separate components, whether individually packaged or assembled into a system-on-a-chip SoC.

When using the word "comprise" or "comprising" it shall be interpreted as non- limiting, i.e. meaning "consist at least of". The embodiments herein are not limited to the above described preferred

embodiments. Various alternatives, modifications and equivalents may be used.

Therefore, the above embodiments should not be taken as limiting the scope of the invention, which is defined by the appending claims.

Claims

A method performed in a network node (1 13) for controlling tethering that is provided by an endpoint device (1 15) to a tethered device (1 17), the method comprising:

-receiving (310) a first Internet Protocol, IP, packet to be forwarded by the endpoint device (1 15) to the tethered device (1 17);

-obtaining (320) a Time To Live, TTL, value in a network layer header of the first IP packet; and

-blocking (330) tethering by:

generating (331 ) a second IP packet by modifying the TTL value of the first IP packet to N when the TTL value of the first IP packet is bigger than N, where a data payload in the second IP packet is the same as a data payload in the first IP packet, wherein the endpoint device (1 15) is located N hops from the network node (1 13); and

routing (332) the second IP packet instead of the first IP packet towards the endpoint device (1 15), wherein the modified TTL value of the second IP packet enables the endpoint device (1 15) to discard and not forward the second IP packet to the tethered device (1 17).

The method according to claim 1 , wherein the method further comprises

determining (340) tethering by:

-determining (341 ) that no Acknowledgement, Ack, message in response to the routed second IP packet has been received within a time period;

-generating (342) a third IP packet with a TTL value not smaller than N+1 , and with the same data payload as in the first IP packet;

-routing (343) the third IP packet towards the endpoint device (1 15), wherein the TTL value of the third IP packet which is not smaller than N+1 enables the endpoint device (1 15) to forward the third IP packet to the tethered device (1 17); and

-determining (344) that tethering related to a Transmission Control Protocol exists, when an Ack message in response to the routed third IP packet has been received.

The method according to claim 2, wherein generating (342) the third IP packet by any one out of:

-modifying the TTL value of the first IP packet to M when the TTL value of the first

IP packet is smaller than N+1 , wherein M≥N+1 ; and

-using the first IP packet as the third IP packet when the TTL value of the first IP packet is not smaller than N+1.

The method according to claim 1 , wherein the method further comprises

determining (340) tethering by:

-determining (345) that tethering related to a User Datagram Protocol exists, when an Internet Control Message Protocol, ICMP, message has been received, which ICMP message notifies a source node (1 1 1 ) of the first IP packet that the modified TTL value has exceeded. 5. The method according to claim 4, wherein the method further comprises:

-discarding and not forwarding (350) the ICMP message to the source node (1 1 1 ); and

-routing (360) the first IP packet towards the endpoint device (1 15). 6. The method according to any one of the preceding claims, wherein N is 1.

A network node (1 13) for controlling tethering that is provided by an endpoint device (1 15) to a tethered device (1 17), the network node (1 13) being configured to: -receive a first IP packet to be forwarded by the endpoint device (1 15) to the

tethered device (1 17);

-obtain a Time To Live, TTL, value in a network layer header of the first IP packet; and

-block tethering by:

generating a second IP packet by modifying the TTL value of the first IP packet to N when the TTL value of the first IP packet is bigger than N, where a data payload in the second IP packet is the same as a data payload in the first IP packet, wherein the endpoint device (1 15) is located N hops from the network node (1 13); and

routing the second IP packet instead of the first IP packet towards the endpoint device (1 15), wherein the modified TTL value of the second IP packet enables the endpoint device (1 15) to discard and not forward the second IP packet to the tethered device (1 17).

The network node (1 13) according to claim 7, wherein the network node (1 13) is further configured to determine tethering by:

-determining that no Acknowledgement, Ack, message in response to the routed second IP packet has been received within a time period;

-generating a third IP packet with a TTL value not smaller than N+1 , and with the same data payload as in the first IP packet;

-routing the third IP packet towards the endpoint device (1 15), wherein the TTL value of the third IP packet which is not smaller than N+1 enables the endpoint device (1 15) to forward the third IP packet to the tethered device (1 17); and -determining that tethering related to a Transmission Control Protocol exists, when an Ack message in response to the routed third IP packet has been received.

The network node (1 13) according to claim 8, wherein the network node (1 13) is further configured to generate the third IP packet by any one out of:

IP packet is smaller than N+1 , wherein M≥N+1 ; and

10. The network node (1 13) according to claim 7, wherein the network node (1 13) is further configured to determine tethering by:

-determining that tethering related to a User Datagram Protocol exists, when an Internet Control Message Protocol, ICMP, message has been received, which ICMP message notifies a source node (1 1 1 ) of the first IP packet that the modified TTL value has exceeded.

1 1 . The network node (1 13) according to claim 10, wherein the network node (1 13) further configured to:

-discard and not forward the ICMP message to the source node (1 1 1 ); and -route the first IP packet towards the endpoint device (1 15).

12. The network node (1 13) according to any one of claims 7-1 1 , wherein N is 1.

13. A system for controlling tethering being provided by an endpoint device (1 15) to a tethered device (1 17), comprising a network node (1 13) according to any one of claims 7-12.

14. A computer program comprising instructions, which when executed by a network node (1 13), cause the network node (1 13) to perform the method according to any of the claims 1 -6.

15. A carrier comprising the computer program of claim 14, wherein the carrier is one of an electronic signal, an optical signal, an electromagnetic signal, a magnetic signal, an electric signal, a radio signal, a microwave signal, or a computer- readable storage medium.