ShieldShare: Building a VPN-backed Android Hotspot for Secure Internet Sharing with Per-User Traffic Accounting

• URL: http://arxiv.org/abs/2605.01569v1
• Date: Sat, 02 May 2026 18:40:37 GMT
• Title: ShieldShare: Building a VPN-backed Android Hotspot for Secure Internet Sharing with Per-User Traffic Accounting
• Abstract summary: ShieldShare is a proxy-based Android application that enables secure VPN-backed hotspot sharing with per-user traffic accounting.<n>This enables affordable, community-controlled secure access in censored or high-surveillance environments.
• Score: 1.3318960669670048
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Virtual Private Networks (VPNs) have become essential privacy tools for mobile users, yet current implementations face significant limitations in shared environments. Mainstream VPN providers impose device limits, while Android's native hotspot functionality lacks support for routing shared traffic through VPN connections. Existing solutions either require root access or lack comprehensive monitoring capabilities. This paper presents ShieldShare, a proxy-based Android application that enables secure VPN-backed hotspot sharing with per-user traffic accounting without requiring root access. Our system employs a modular architecture comprising VPN detection, hotspot management, proxy-based traffic forwarding supporting HTTP, HTTPS, and SOCKS5, and comprehensive traffic metering with quota management. Our evaluation shows that ShieldShare reliably routes client traffic through VPN tunnels while maintaining accurate per-client bandwidth allocation and accounting. This enables affordable, community-controlled secure access in censored or high-surveillance environments, benefiting activists, investigative journalists, and shared household networks. We release ShieldShare as open-source software to support further research and real-world deployment.

Related papers

• Ghost Traffic: ICMP Tunneling-Based Billing Bypass in LTE Networks [0.0]
  Some cellular ISPs treat ICMP echo traffic as control traffic rather than user data and exclude it from billing.<n>Android allows ordinary applications to create ICMP echo sockets without root privileges because of an unsafe default configuration.<n>This paper proposes Ghost Traffic, an end-to-end system that uses Android's VpnService to encapsulate all application traffic into ICMP echo payloads without root privileges.
  arXiv  Detail & Related papers  (2026-07-06T08:12:53Z)
• PriSrv: Privacy-Enhanced and Highly Usable Service Discovery in Wireless Communications [43.30406587083713]
  Existing protocols provide limited privacy protection, leaking sensitive device information and opening routes to network attacks.<n>This paper proposes a private service discovery protocol, called PriSrv, which enables both service providers and clients to specify fine-grained authentication policies.
  arXiv  Detail & Related papers  (2026-06-04T08:00:31Z)
• Invisible Adversaries: A Systematic Study of Session Manipulation Attacks on VPNs [29.461096043276104]
  We present three session manipulation attacks targeting TCP and UDP traffic tunneled through VPNs.<n>The attacker who only connects to the same VPN server can launch denial-of-service attacks, hijack TCP connections of other clients, or inject forged DNS responses into their queries.<n>We evaluate these attacks against five popular connection tracking frameworks across different OSes and nine major commercial VPN providers.
  arXiv  Detail & Related papers  (2026-04-05T12:43:08Z)
• ChamaleoNet: Programmable Passive Probe for Enhanced Visibility on Erroneous Traffic [48.87214752144106]
  ChamaleoNet transforms any production network into a transparent monitor to let administrators collect unsolicited and erroneous traffic directed to hosts.<n>ChamaleoNet is programmed to ignore well-formed traffic and collect only erroneous packets.<n>Simple analytics unveil internal and infected hosts, identify temporary failures, and enhance visibility on external radiation produced by attackers looking for vulnerable services.
  arXiv  Detail & Related papers  (2025-08-17T20:54:41Z)
• PWC-MoE: Privacy-Aware Wireless Collaborative Mixture of Experts [59.5243730853157]
  Large language models (LLMs) hosted on cloud servers alleviate the computational and storage burdens on local devices but raise privacy concerns.<n>Small language models (SLMs) running locally enhance privacy but suffer from limited performance on complex tasks.<n>We propose a privacy-aware wireless collaborative mixture of experts (PWC-MoE) framework to balance computational cost, performance, and privacy protection under bandwidth constraints.
  arXiv  Detail & Related papers  (2025-05-13T16:27:07Z)
• Intelligent Detection of Non-Essential IoT Traffic on the Home Gateway [45.70482328441101]
  This work presents ML-IoTrim, a system for detecting and mitigating non-essential IoT traffic by analyzing network behavior at the edge.<n>We test our framework in a consumer smart home setup with IoT devices from five categories, demonstrating that the model can accurately identify and block non-essential traffic.<n>This research advances privacy-aware traffic control in smart homes, paving the way for future developments in IoT device privacy.
  arXiv  Detail & Related papers  (2025-04-22T09:40:05Z)
• Balancing Confidentiality and Transparency for Blockchain-based Process-Aware Information Systems [43.253676241213626]
  We propose an architecture for blockchain-based PAISs to preserve confidentiality and transparency.<n>Smart contracts enact, enforce and store public interactions, while attribute-based encryption techniques are adopted to specify access grants to confidential information.<n>We assess the security of our solution through a systematic threat model analysis and evaluate its practical feasibility.
  arXiv  Detail & Related papers  (2024-12-07T20:18:36Z)
• Bad Neighbors: On Understanding VPN Provider Networks [18.382471188948283]
  We conduct a large-scale analysis of VPN providers and their thousands of VPN endpoints. Our results indicate a widespread lack of traffic filtering towards internally routable networks on the majority of tested VPN service providers. We have disclosed our findings to the affected providers and other stakeholders, and offered guidance to improve the situation.
  arXiv  Detail & Related papers  (2024-10-11T11:51:20Z)
• Never Gonna Give You Up: Exploring Deprecated NULL Ciphers in Commercial VoWiFi Deployments [0.0]
  Many operators use Voice over Wi-Fi (VoWiFi) allowing customers to dial into their core network over the public Internet. To protect against malicious actors on the WiFi or Internet domain, the traffic is sent over a series of IPsec tunnels. We want to analyze security configurations within commercial VoWiFi deployments, both on the client and server side.
  arXiv  Detail & Related papers  (2024-06-18T07:32:38Z)
• OpenVPN is Open to VPN Fingerprinting [10.58132231462485]
  VPN adoption has seen steady growth over the past decade due to increased public awareness of privacy and surveillance threats. Certain governments are attempting to restrict VPN access by identifying connections using "dual use" technology. We develop mechanisms for accurately fingerprinting connections using DPI, the most popular protocol for commercial VPN services.
  arXiv  Detail & Related papers  (2024-03-06T19:15:02Z)
• "I just hated it and I want my money back": Data-driven Understanding of Mobile VPN Service Switching Preferences in The Wild [5.998704044356281]
  We analyzed over 1.3 million reviews from 20 leading VPN apps, identifying 1,305 explicit mentions and intents to switch. Our NLP-based analysis unveiled distinct clusters of factors motivating users to switch. An examination of 376 blogs from six popular VPN recommendation sites revealed biases in the content.
  arXiv  Detail & Related papers  (2024-03-04T00:02:46Z)
• HasTEE+ : Confidential Cloud Computing and Analytics with Haskell [50.994023665559496]
  Confidential computing enables the protection of confidential code and data in a co-tenanted cloud deployment using specialized hardware isolation units called Trusted Execution Environments (TEEs) TEEs offer low-level C/C++-based toolchains that are susceptible to inherent memory safety vulnerabilities and lack language constructs to monitor explicit and implicit information-flow leaks. We address the above with HasTEE+, a domain-specific language (cla) embedded in Haskell that enables programming TEEs in a high-level language with strong type-safety.
  arXiv  Detail & Related papers  (2024-01-17T00:56:23Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.