Demarcating User-Mediated and Carrier-Mediated Connections

TECHNICAL FIELD

0001This disclosure relates to demarcating user-mediated network and carrier-mediated network connections.

BACKGROUND

0002Mobile devices (e.g., smart phones) and other user devices typically offer a host of different wireless connection technologies (e.g., cellular, Wi-Fi, Bluetooth, etc.). In order to reduce the costs of mobile data, mobile network operators (MNOs) and mobile virtual network operators (MNVOs) are frequently mediating additional lower-cost networks (e.g., Wi-Fi networks) and off-loading customer mobile data off cellular connections (e.g., 4G, 5G, etc.) and onto the lower-cost networks when possible. Modern mobile operating systems do not clearly distinguish between these carrier-mediated network connection and user-mediated network connections and instead offer control over connections to the mobile device on a radio-by-radio basis.

SUMMARY

0003One aspect of the disclosure provides a method of demarcating and connecting carrier-mediated networks and user-mediated networks. The method includes, for a mobile device simultaneously connected to a first wireless network and a second wireless network, determining, by data processing hardware of the mobile device, whether the first wireless network is associated with a same network operator as the second wireless network. When the first wireless network is associated with the same network operator as the second wireless network, the method also includes establishing, by the data processing hardware, a virtual private network (VPN) between the mobile device and a remote server. The VPN includes a first VPN connection and a second VPN connection. The first VPN connection connects the mobile device to the remote server over the first wireless network and the second VPN connection connects the mobile device to the remote server over the second wireless network. The method also includes transmitting, by the data processing hardware, data from the mobile device to the remote server over the VPN via one of the first VPN connection or the second VPN connection. The data, when received by the remote server, causes the remote server to route the data to a destination server.

0004Implementations of the disclosure may include one or more of the following optional features. In some implementations, the first wireless network includes a cellular network and the second wireless network includes a wireless fidelity (Wi-Fi) network. In some examples, when the first wireless network is associated with the same network operator as the second wireless network, the network operator includes a mobile virtual network operator. When the first wireless network is associated with the same network operator as the second wireless network, the network operator may include a mobile network operator.

0005In some implementations, the first VPN connection and the second VPN connection each include carrier-mediated network connections. While the VPN is established between the mobile device and the remote server, the method may include connecting, by the data processing hardware, the mobile device to a third wireless network. The third wireless network is associated with a different network operator than the network operator of the first and second wireless networks. The method may also include prompting, by the data processing hardware, a user of the mobile device to provide consent to permit the VPN to establish a third VPN connection connecting the mobile device to the remote server over the third wireless network. When the user of the mobile device provides the consent to permit the VPN to establish the third VPN connection, the method may include updating, by the data processing hardware, the VPN by establishing the third VPN connection connecting the mobile device to the remote server over the third wireless network.

0006Optionally, prompting the user of the mobile device to provide the consent to permit the VPN to establish the third VPN connection includes displaying a graphical element in a graphical user interface executing on the data processing hardware. The graphical element enables the user to provide the consent to permit the VPN to establish the third VPN connection. In some examples, the third wireless network includes a user-mediated network. Determining whether the first wireless network is associated with the same network operator as the second wireless network, in some implementations, includes querying an application executing on the mobile device to determine whether the first wireless network is associated with the same network operator as the second wireless network.

0007In some examples, the application is verified via a subscriber identification module (SIM) of the mobile device. Transmitting the data from the mobile device to the remote server over the VPN may include transmitting a session token from the mobile device to the remote server over the VPN via the one of the first VPN connection or the second VPN connection. The data and session token when received by the remote server causes the remote server to identify the mobile device using the session token and route the data to the destination server. In some implementations, the remote server may also transmit response data received from the destination server to the mobile device over the VPN via the one of the first VPN connection or the second VPN connection.

0008In some implementations, establishing the VPN causes the remote server to apply a network policy to both the first wireless network and the second wireless network. The network policy may include at least one of zero-rating or throttling. Optionally, when the first wireless network is not associated with the same network operator as the second wireless network, the method includes prompting, by the data processing hardware, a user of the mobile device to provide consent to establish the VPN between the mobile device and the remote server. The method may also include, when the user of the mobile device provides the consent to establish the VPN between the mobile device and the remote server, establishing, by the data processing hardware, the VPN between the mobile device and the remote server.

0009Another aspect of the disclosure provides a system for demarcating and connecting carrier-mediated networks and user-mediated networks. The system includes data processing hardware and memory hardware of a mobile device in communication with the data processing hardware. The memory hardware stores instructions that when executed on the data processing hardware cause the data processing hardware to perform operations. The operations include, for the mobile device simultaneously connected to a first wireless network and a second wireless network, determining whether the first wireless network is associated with a same network operator as the second wireless network. When the first wireless network is associated with the same network operator as the second wireless network, the operations also include establishing a virtual private network (VPN) between the mobile device and a remote server. The VPN includes a first VPN connection and a second VPN connection. The first VPN connection connects the mobile device to the remote server over the first wireless network and the second VPN connection connects the mobile device to the remote server over the second wireless network. The operations also include transmitting data from the mobile device to the remote server over the VPN via one of the first VPN connection or the second VPN connection. The data, when received by the remote server, causes the remote server to route the data to a destination server.

0010This aspect may include one or more of the following optional features. In some implementations, the first wireless network includes a cellular network and the second wireless network includes a wireless fidelity (Wi-Fi) network. In some examples, when the first wireless network is associated with the same network operator as the second wireless network, the network operator includes a mobile virtual network operator. When the first wireless network is associated with the same network operator as the second wireless network, the network operator may include a mobile network operator.

0011In some implementations, the first VPN connection and the second VPN connection each include carrier-mediated network connections. While the VPN is established between the mobile device and the remote server, the operations may include connecting the mobile device to a third wireless network. The third wireless network is associated with a different network operator than the network operator of the first and second wireless networks. The operations may also include prompting a user of the mobile device to provide consent to permit the VPN to establish a third VPN connection connecting the mobile device to the remote server over the third wireless network. When the user of the mobile device provides the consent to permit the VPN to establish the third VPN connection, the operations may include updating the VPN by establishing the third VPN connection connecting the mobile device to the remote server over the third wireless network.

0012Optionally, prompting the user of the mobile device to provide the consent to permit the VPN to establish the third VPN connection includes displaying a graphical element in a graphical user interface executing on the data processing hardware. The graphical element enables the user to provide the consent to permit the VPN to establish the third VPN connection. In some examples, the third wireless network includes a user-mediated network. Determining whether the first wireless network is associated with the same network operator as the second wireless network, in some implementations, includes querying an application executing on the mobile device to determine whether the first wireless network is associated with the same network operator as the second wireless network.

0013In some examples, the application is verified via a subscriber identification module (SIM) of the mobile device. Transmitting the data from the mobile device to the remote server over the VPN may include transmitting a session token from the mobile device to the remote server over the VPN via the one of the first VPN connection or the second VPN connection. The data and session token when received by the remote server causes the remote server to identify the mobile device using the session token and route the data to the destination server. In some implementations, the remote server may also transmit response data received from the destination server to the mobile device over the VPN via the one of the first VPN connection or the second VPN connection.

0014In some implementations, establishing the VPN causes the remote server to apply a network policy to both the first wireless network and the second wireless network. The network policy may include at least one of zero-rating or throttling. Optionally, when the first wireless network is not associated with the same network operator as the second wireless network, the operations include prompting a user of the mobile device to provide consent to establish the VPN between the mobile device and the remote server. The operations may also include, when the user of the mobile device provides the consent to establish the VPN between the mobile device and the remote server, establishing the VPN between the mobile device and the remote server.

0015The details of one or more implementations of the disclosure are set forth in the accompanying drawings and the description below. Other aspects, features, and advantages will be apparent from the description and drawings, and from the claims.

DESCRIPTION OF DRAWINGS

<figref idref="DRAWINGS">FIG. <b>1</b></figref> is a schematic view of an example system for demarcating user-mediated and carrier-mediated connections and providing a multi-network between the different connections.

<figref idref="DRAWINGS">FIGS. <b>2</b>A-<b>2</b>C</figref> are schematic views of exemplary components of a connection aggregator.

<figref idref="DRAWINGS">FIG. <b>2</b>D</figref> is a schematic view of an interactive graphic rendered on a graphical user interface executing on a mobile device.

<figref idref="DRAWINGS">FIG. <b>3</b></figref> is a schematic view of a multi-network connector.

<figref idref="DRAWINGS">FIGS. <b>4</b>A and <b>4</b>B</figref> are schematic views of interactive graphics rendered on a graphical user interface executing on a mobile device.

<figref idref="DRAWINGS">FIG. <b>5</b></figref> is a flowchart of an example arrangement of operations for a method of demarcating and connecting carrier-mediated networks and user-mediated networks.

<figref idref="DRAWINGS">FIG. <b>6</b></figref> is a schematic view of an example computing device that may be used to implement the systems and methods described herein.

0023Like reference symbols in the various drawings indicate like elements.

DETAILED DESCRIPTION

0024Carriers, such as mobile network operators (MNOs) and mobile virtual network operators (MVNOs), are increasingly providing connectivity via multiple heterogeneous network types (e.g., cellular networks and Wi-Fi networks). Current mobile operating systems (OS) do not distinguish clearly between connections that are user-mediated (such as a home Wireless Fidelity (Wi-Fi) network) and carrier-mediated connections, such as a Wi-Fi access point with credentials provided by a carrier or a cellular connection controlled by the carrier (e.g., LTE). User-mediate networks and carrier-mediated networks may have very different properties, and therefore treating the two classes of networks the same often leads to suboptimal user experiences. For example, a carrier may desire to provide session mobility to improve the user experience by tunneling user traffic through a virtual private network (VPN), but cannot do so without clear demarcation between carrier-mediated networks and user-mediated networks. In this case, the carrier may not be able to include user-mediated networks within the VPN (e.g., for privacy concerns).

0025Furthermore, mobile devices typically have user controls for allowing the user to manage radios on the mobile device. For example, the user may enable/disable the Wi-Fi radio or enable/disable the mobile (i.e., cellular) data radio. The mobile devices also provide status indicators on a radio-by-radio basis rather than on a carrier or operator basis. A user of the mobile device may desire to temporarily disable connectivity from their carrier, which may include elements of multiple different wireless connections (e.g., both Wi-Fi and cellular), but the mobile device lacks any convenient way to do so. At best, the user must disable connectivity on a radio-by-radio basis, which disables all connections from that radio. This may have unintended consequences. For example, disabling a Wi-Fi radio to prevent the mobile device from connecting to a Wi-Fi network provided by a carrier will also prevent connections to other Wi-Fi connections (e.g., to the user's home network) that are not managed by that carrier. Moreover, the mobile device provides visual indicators of radio connectivity (e.g., Wi-Fi or cellular connection strength), but not carrier connectivity. For example, there is no way to discern whether Wi-Fi strength graphical status indicator is associated with a user-mediated Wi-Fi network or a carrier-mediated Wi-Fi network.

0026Implementations herein are directed toward a connection aggregator <b>200</b> and a multi-network controller <b>300</b> that both execute on a user device <b>110</b> for demarcating user-mediated networks from carrier-mediated networks and providing a convenient user input and visual indication to control and report multi-network connectivity. As used herein, the user device <b>110</b> may be interchangeably referred to as user equipment (UE) or a mobile device. Referring to <figref idref="DRAWINGS">FIG. <b>1</b></figref>, in some implementations, an example wireless communication environment <b>100</b> includes the mobile device <b>110</b> in communication with an external network <b>40</b> through multiple wireless networks <b>120</b>, <b>120</b><i>a</i>-<i>n</i>. For example, the user device <b>110</b> may communicate with the external network <b>40</b> via a cellular network <b>120</b><i>a </i>and a Wi-Fi network <b>120</b><i>b</i>. These wireless networks <b>120</b> are merely illustrative and the user device <b>110</b> may communicate with the external network <b>40</b> using other types of wireless networks (e.g., Citizens Broadband Radio Service (CBRS), Bluetooth, etc.). The cellular network <b>120</b><i>a </i>may include a General Packet Radio Service (GPRS) network, a Universal Mobile Telecommunications System (UMTS) network, a High Speed Packet Access (HSPA) network, an enhanced-HSPA (H+) network, an Enhanced Data Rates for Global System for Mobile communications (GSM) (EDGE) network, or a Long-Term Evolution (LTE) radio access network (RAN) (e.g., 4G/5G LTE) that supports radio communication of data packets <b>50</b> and/or other services from the external network <b>40</b> to the user device <b>110</b> via, for example, base stations such as macro-cell evolved Node B's (MeNB). The Wi-Fi network <b>120</b><i>b </i>may include any version of Wi-Fi (e.g., 802.11n, 802.11ac, etc.) that also supports radio communication of the data packets <b>50</b>. In some examples, the user device <b>110</b> connects to multiple wireless networks <b>120</b> of the same type simultaneously. For example, the user device <b>110</b> may include capabilities for simultaneously connecting to two separate cellular networks <b>120</b><i>a </i>operated by different carriers <b>70</b>.

0027The cellular network <b>120</b><i>a </i>is associated with a mobile network operator (MNO) or a mobile virtual network operator (MNVO) that provides services of wireless communications to the subscribing user device <b>110</b> via the cellular network <b>120</b><i>a</i>. The MNO or MVNO may also be referred to as a wireless service provider, wireless carrier, cellular company, mobile network operator, or mobile network carrier. The term “carrier” may be used herein to refer to the MNO or MVNO. The term “network operator” may be used herein to refer to an entity that operates or mediates a wireless network <b>120</b>, which may include a carrier (e.g., an MNO or MVNO) that operates/mediates a carrier-mediated wireless network <b>120</b> or a user <b>10</b> that operates/mediates a user-mediated wireless network <b>120</b>.

0028As used herein, a carrier-mediated wireless network <b>120</b> includes any wireless network <b>120</b> managed or mediated or controlled by a single particular carrier <b>70</b> (e.g., an MNO or MVNO) where the user device <b>110</b> subscribes to a service provided by the carrier. That is, the user <b>10</b> does not control or manage the wireless network <b>120</b>. A carrier-mediated network <b>120</b> is a network for which a carrier has provided credentials, such as where either a carrier-provided SIM profile or a carrier-provided application which can be authenticated by the carrier-provided SIM profile, has provided credentials. For example, a SIM profile provided on a UICC allows the user device <b>110</b> to attach and authenticate with a cellular network <b>120</b>. Or, the carrier application is authenticated by the operating system <b>111</b> to access the SIM profile. The carrier application may be cryptographically signed with the carrier's private key and authenticated via the signature of the application contained in the SIM profile. The carrier application is authorized by the operating system <b>111</b> to provide credentials for accessing, for example, Wi-Fi access points. In some examples, the authenticated carrier application may provide a WPA password or a Hotspot2.0 certificate; or, for an open network where credentials are not needed to connect to the access point, the carrier causes the user device <b>110</b> to connect to the access point without need for user intervention, or causes a suggestion to connect to the network to be made to the user, which the user can accept or reject. In the case of carrier-mediated connections to open networks <b>120</b>, an additional step may be needed to bypass a “captive portal” to gain internet access, such as accepting terms and conditions, or supplying a passcode or other login information. For carrier-mediated connections to open-networks <b>120</b> with captive portals, the carrier may accept terms on the user's behalf or provide an email address, passcode or other login information in an automated fashion. An automated fashion may mean providing login information via protocols such as WISPr or via the automated submission of web forms. A single user device <b>110</b> can support multiple carrier-mediated wireless networks <b>120</b> simultaneously.

0029A user-mediated wireless network <b>120</b> includes any wireless network <b>120</b> associated with a network operator <b>70</b> that the user device <b>110</b> does not explicitly subscribe to such that the user-mediated wireless network <b>120</b> is ultimately managed or mediated or controlled by the user <b>10</b>. A user-mediated network is a network for which the user has provided their own credentials, if necessary, to connect e.g., to an access point, e.g., a WPA password or a user-installed certificate, e.g., a Hotspot2.0 certificate; or, for an open network where credentials to connect to the access point are not needed, the user has taken an affirmative action to connect to the network, such as selecting the network from a list, or accepting a suggestion made by the operating system. Any selection may only occur the first time the device is exposed to the network. On user-mediated open networks, additional manual steps may be needed to bypass a “captive portal” to gain internet access, such as accepting terms and conditions, or supplying an email address, a passcode or other login information.

0030A single device, e.g., an access point, can provide access to both a user-mediated network and a carrier-mediated network. The user who owns, rents or controls the AP can enable others to access the Internet using the access point, e.g., the user creates a WEP password that the user provides to others. The access point when accessed in that way provides access to a user-mediated network. The cable service provider or DSL service provider may operate a carrier-mediated network service from the same access point. Devices with a HS2.0 certificate provisioned by the carrier app will automatically connect to the same access point. No user intervention or password is required.

0031In an example where the user has a contract for Internet service provided by a network operator <b>70</b> corresponding to an Internet Service Provider (ISP), and thus may select any one of a multitude of different wireless-enabled user devices <b>110</b> to connect to the Internet service at any given time, the wireless networks <b>120</b> (e.g., Wi-Fi networks <b>120</b><i>b</i>) accessed by the selected user devices <b>110</b> to use the Internet service correspond to user-mediated wireless networks <b>120</b>. Here, the user <b>10</b> may control a modem that connects to the Internet service, as well as a wireless access point (AP) (e.g., wireless router) in communication with the modem to provide a local area network (LAN) that the selected user devices <b>110</b> may establish wireless connections with to use the Internet service. In other examples, a user-mediated wireless network <b>120</b> may simply include a Bluetooth connection (or other wireless connection) between the user device <b>110</b> and another device in proximity to the user device <b>110</b>. On the other hand, when a particular user device <b>110</b> associated with the user <b>10</b> subscribes to services of wireless communications provided by a particular carrier <b>70</b> (e.g., an MNO or MVNO), the wireless networks <b>120</b> (e.g., cellular and/or Wi-Fi networks <b>120</b><i>a</i>, <b>120</b><i>b</i>) accessed by the subscribing user device <b>110</b> to receive the services of wireless communications correspond to carrier-mediated wireless networks <b>120</b>. In some implementations, a subscriber identity module (SIM) installed on the user device <b>110</b> includes a profile defined by a particular carrier <b>70</b> to enable and authenticate the user device <b>110</b> to connect to carrier-mediated wireless networks <b>120</b> associated with the particular carrier <b>70</b>. If, however, the user <b>10</b> would like to connect other user devices <b>110</b> to these carrier-mediated wireless networks <b>120</b> associated with the particular carrier <b>70</b>, each of these other user devices <b>110</b> must individually subscribe to the services of wireless communication provided by the particular carrier <b>70</b>. In these implementations, the user device <b>110</b> may freely connect to user-mediated wireless networks <b>120</b> associated with one or more network operators <b>70</b> other than the particular carrier <b>70</b>. While the user device <b>110</b> is depicted as a mobile device <b>110</b> in the example shown, the user device <b>110</b> can include any device capable of connecting to wireless networks <b>120</b> such as, without limitation, a tablet, laptop, desktop, smart watch, smart speaker, smart display, smart appliance, etc.

0032The user device <b>110</b> includes computing resources <b>112</b> (e.g., data processing hardware) and/or storage resources <b>114</b> (e.g., memory hardware). The data processing hardware <b>112</b> executes a graphical user interface (GUI) <b>115</b> for display on a screen <b>119</b> in communication with the data processing hardware <b>112</b>, the connection aggregator <b>200</b>, and the multi-network controller <b>300</b>. The data processing hardware <b>112</b> further executes an operating system <b>111</b> and one or more applications <b>116</b>. In some implementations, the operating system <b>111</b> executes the functionality of the connection aggregator <b>200</b> and the multi-network controller <b>300</b>.

0033The user device <b>110</b> may use a variety of different operating systems <b>111</b>. In examples where a user device <b>110</b> is a mobile device, the user device <b>110</b> may run an operating system including, but not limited to, ANDROID® developed by Google Inc., IOS® developed by Apple Inc., or WINDOWS PHONE® developed by Microsoft Corporation. Accordingly, the operating system <b>111</b> running on the user device <b>110</b> may include, but is not limited to, one of ANDROID®, IOS®, or WINDOWS PHONE®. In some examples a user device may run an operating system including, but not limited to, MICROSOFT WINDOWS® by Microsoft Corporation, MAC OS® by Apple, Inc., or Linux.

0034The user device <b>110</b> further includes at least one modem <b>165</b> (also referred to as a baseband or baseband processor). The modem <b>165</b> includes one or more antennas that enable the user device to communicate with the operator networks <b>120</b> wirelessly. The modem <b>165</b> may communicate with one or more radios operating on a variety of frequencies simultaneously (e.g., 700 MHz, 900 MHz, 2.4 GHz, 5.0 GHz etc.). The modem <b>165</b> may include various components to provide transmit and receive functions (a processor, memory, etc.). In some implementations, data processing hardware <b>112</b> includes the modem <b>165</b>. That is, tasks executed by the data processing hardware <b>112</b>, in some examples may instead be executed by the modem <b>165</b> and vice versa.

0035The user device <b>110</b> further includes one or more corresponding subscriber identification modules (SIM) <b>350</b> for identifying and connecting the user device <b>110</b> with certain types of carrier-mediated wireless networks <b>120</b>. For instance, the SIM <b>350</b> may include a corresponding SIM profile with the credentials for authorizing the user device <b>110</b> to connect with the cellular network <b>120</b><i>a </i>to access the destination server <b>60</b> over the external network <b>40</b>. Similarly, the SIM <b>350</b> may include one or more additional SIM profiles with corresponding credentials for authorizing the user device <b>110</b> to connect with other carrier-mediated wireless networks <b>120</b> managed by network operators <b>70</b> other than the network operator managing the cellular network <b>120</b><i>a</i>. In some examples, the one or more SIMs <b>350</b> include any combination of one or more embedded SIMS (eSIM) and one or more physical SIMs.

0036The connection aggregator <b>200</b> establishes a virtual private network <b>30</b> (VPN) between the user device <b>110</b> and a remote server <b>130</b>. The VPN <b>30</b> provides a corresponding VPN connection <b>122</b>, <b>122</b><i>a</i>-<i>n </i>for connecting the user device <b>110</b> to each public carrier-mediated wireless network <b>120</b> operated or managed by the same network operator <b>70</b> (i.e., carrier). In some implementations, the VPN <b>30</b> provides connections <b>122</b> for connecting to wireless networks managed by multiple different network operators <b>70</b>. In the example shown, the connection aggregator <b>200</b> establishes the VPN <b>30</b> between the user device <b>110</b> and the remote server <b>130</b> by using a cellular VPN connection <b>122</b><i>a </i>connecting the user device <b>110</b> to the remote server <b>130</b> over the cellular network <b>120</b><i>a </i>(e.g., a first wireless network), and using a Wi-Fi VPN connection <b>122</b><i>b </i>connecting the user device <b>110</b> to the remote server <b>130</b> over the Wi-Fi network <b>120</b><i>b </i>(e.g., a second wireless network).

0037The remote server <b>130</b> executes a VPN back-end service <b>132</b> that receives data packets <b>50</b> from the user device <b>110</b> routed by the connection aggregator <b>200</b> via one of the connected wireless networks <b>120</b> and forwards the data packets <b>50</b> to a destination server <b>60</b> via the external network <b>40</b>. The external network <b>40</b> may include a packet data network (PDN), which may be the Internet. The external network <b>40</b> may be independent from any network related with the user device <b>110</b> or the carrier <b>70</b> that operates the wireless networks <b>120</b>. The destination server <b>60</b> may be any remote server that an application <b>116</b> executing on the user device <b>110</b> sends or receives data packets <b>50</b> to or from. For example, the destination server <b>60</b> may be a web server that hosts web content.

0038A software application (i.e., a software resource) may refer to computer software that causes a computing device to perform a task. In some examples, a software application may be referred to as an “application,” an “app,” or a “program.” Example applications include, but are not limited to, system diagnostic applications, system management applications, system maintenance applications, word processing applications, spreadsheet applications, messaging applications, media streaming applications, social networking applications, and gaming applications.

0039Downstream data packets <b>50</b> sent to the user device <b>110</b> (e.g., from the destination server <b>60</b>) are directed to the remote VPN server <b>130</b> which in turn forwards the data packet <b>50</b> to the connection aggregator <b>200</b> via one of the VPN connections <b>122</b>. The connection aggregator <b>200</b> receives the data packets <b>50</b> and sends the packets to the appropriate application <b>116</b> executing on the user device <b>110</b>.

0040In some implementations, the remote VPN server <b>130</b> maintains the same Internet Protocol (IP) address when sending and receiving data packets <b>50</b> to destination servers <b>60</b> despite receiving and sending data packets <b>50</b> to the user device <b>110</b> through multiple different wireless networks <b>120</b> via multiple different wireless connections <b>122</b>. Thus, from the perspective of the destination server <b>60</b>, the apparent IP address of the user device <b>110</b> (i.e., the IP address of the remote server <b>130</b>) does not change regardless of which wireless connection <b>122</b> is used to route the data packets <b>50</b> between the user device <b>110</b> and the destination server <b>60</b>. Furthermore, as applications <b>116</b> executing on the user device <b>110</b> are agnostic to the specific wireless connection <b>122</b> that is used to send or receive data packets <b>50</b> to or from the destination server <b>60</b>, the connection aggregator <b>200</b> and the remote VPN sever <b>130</b> may abstract multiple wireless connections <b>122</b> into a single connection from the perspective of the destination server <b>60</b> and the applications <b>116</b> executing on the user device <b>110</b>.

0041In some implementations, the connection aggregator <b>200</b> and the remote VPN server <b>130</b> provide session continuity while sending and receiving data packets <b>50</b> across multiple different wireless networks <b>120</b>. Session continuity refers to an uninterrupted connection for the user <b>10</b> when switching between different wireless networks <b>120</b>. To maintain session continuity, the remote VPN server <b>130</b> may, after authenticating the user device <b>110</b> (i.e., the connection aggregator <b>200</b>), send a session token <b>210</b> to the connection aggregator <b>200</b>. The session token <b>210</b> uniquely identifies the user device <b>110</b>. When the connection aggregator <b>200</b> sends a data packet <b>50</b> to the remote VPN server <b>130</b> via a wireless network <b>120</b>, the connection aggregator <b>200</b> may also send the session token <b>210</b> identifying the user device <b>110</b>. The session token <b>210</b>, when received by the remote VPN server <b>130</b>, may allow the remote VPN server <b>130</b> to identify the user device <b>110</b> independent of which wireless connection <b>122</b> the connection aggregator <b>200</b> uses to connect the user device <b>110</b> and the remote VPN server <b>130</b>. For example, when the user device <b>110</b> is connected to the cellular network <b>120</b><i>a </i>and the Wi-Fi network <b>120</b><i>b </i>simultaneously, the user device <b>110</b> may have a first IP address associated with the cellular network connection <b>122</b><i>a </i>and a second IP address different from the first IP address associated with the Wi-Fi connection <b>122</b><i>b</i>. In this example, when the user device <b>110</b> sends an upstream data packet <b>50</b>, the connection aggregator <b>200</b> may route the data packet <b>50</b> over the Wi-Fi network <b>120</b><i>b </i>to the remote VPN server <b>130</b> via the Wi-Fi connection <b>122</b><i>b </i>and present the session token <b>210</b>. The user device <b>110</b> may then move out of range of the Wi-Fi network <b>120</b><i>b </i>and the connection aggregator <b>200</b> may then route a subsequent upstream data packet <b>50</b> over the cellular network <b>120</b><i>a </i>to the remote VPN server <b>130</b> via the cellular connection <b>122</b><i>a </i>and again presents the same session token <b>210</b>. Accordingly, the remote VPN server <b>130</b> can uniquely identify the user device <b>110</b> despite the change in IP addresses from the IP address associated with the Wi-Fi connection <b>122</b><i>b </i>to the subsequent IP address associated with the cellular connection <b>122</b><i>a. </i>

0042In some examples, the remote VPN server <b>130</b> may update its understanding of where to send data packets <b>50</b> based on the received session token <b>210</b>. In some implementations, the remote VPN server <b>130</b> sends downstream data packets <b>50</b> to the user device <b>110</b> using the same wireless network <b>120</b> and corresponding wireless connection <b>122</b> that was used by the connection aggregator <b>200</b> when the last session token <b>210</b> was presented to the remote VPN server <b>130</b>. In case of transmission failure, the remote VPN server <b>130</b> may fall back to a previous wireless connection <b>122</b> in an attempt to reestablish communication with the user device <b>110</b>.

0043With continued reference to <figref idref="DRAWINGS">FIG. <b>1</b></figref>, the data processing hardware <b>112</b> also executes the multi-network controller <b>300</b>. The multi-network controller <b>300</b> renders a status graphic <b>320</b> in the GUI <b>115</b> displayed on the screen <b>119</b> of the user device <b>110</b>. The status graphic <b>320</b> indicates that the user device <b>110</b> is currently connected to at least one carrier-mediated wireless network <b>120</b>. Here, the status graphic <b>320</b> indicates to the user <b>10</b> of the user device <b>110</b> that the user device <b>110</b> is connected to the cellular network <b>120</b><i>a </i>and/or the Wi-Fi network <b>120</b><i>b</i>. In some examples, the multi-network controller <b>300</b> renders a second status graphic <b>320</b> (not shown) to indicate connection to a carrier-mediated wireless network or user-mediated wireless network with an operator <b>70</b> that is different from the operator <b>70</b> associated with the first status graphic <b>320</b>. The multi-network controller <b>300</b> may render any number of status graphics <b>320</b> to reflect any number of operators <b>70</b> of wireless connections <b>122</b> to the mobile device <b>110</b>.

0044The multi-network controller <b>300</b>, in some implementations, renders an interactive graphic <b>330</b> configured to receive user input indications <b>312</b> for disabling wireless connections <b>122</b> between the user device <b>110</b> and any available carrier-mediated wireless networks <b>120</b> associated with the same carrier or network operator <b>70</b>. The interactive graphic <b>330</b> may take many forms, such as a button, switch, slider, or toggle. Other forms of user input may also provide the user input indication <b>312</b>. For example, the user <b>10</b> may optionally provide the user input indication <b>312</b> by speaking a voice command that may be recorded by a microphone of the user device <b>110</b>. In the example shown, the interactive graphic <b>330</b> includes a graphical button <b>330</b> labeled “Carrier Toggle” rendered on the GUI <b>115</b> that provides, when selected by the user <b>10</b>, the user input indication <b>312</b> indicating that the user <b>10</b> desires to disconnect the user device <b>110</b> from all wireless connections <b>122</b> associated with the corresponding carrier/network operator <b>70</b>. When the user device <b>110</b> provides wireless connections <b>122</b> to multiple carrier-mediated wireless networks <b>120</b> associated with more than one different carriers <b>70</b>, the multi-network controller <b>300</b> may render a respective interactive graphic <b>330</b> for each carrier <b>70</b> on the GUI <b>115</b>, allowing the user <b>10</b> control over the carrier-mediated wireless networks <b>120</b> on a carrier-by-carrier basis. Alternatively, the multi-network controller <b>300</b> may render an interactive graphic <b>330</b> for disconnecting all carrier-mediated networks <b>120</b> regardless of the specific carrier <b>70</b> that mediates each network <b>120</b>.

0045In response to receiving the user input indication <b>312</b> indicating selection of the interactive graphic <b>330</b>, the multi-network controller <b>300</b> may disconnect the user device <b>110</b> from each of the one or more carrier-mediated wireless networks <b>120</b> associated with the carrier/network operator <b>70</b> and update the status graphic <b>320</b> to indicate that the mobile device <b>110</b> is not currently connected to any carrier-mediated wireless networks <b>120</b> associated with the corresponding carrier/network operator <b>70</b>. Optionally, in response to receiving the user input indication <b>312</b> indicating selection of the interactive graphic <b>330</b>, the multi-network controller <b>300</b> may connect to one or more networks <b>120</b> associated with another network operator <b>70</b>. For example, after disconnecting from a carrier-mediated Wi-Fi network <b>120</b><i>b</i>, the multi-network controller <b>300</b> may automatically (or prompt the user <b>10</b> to) connect to a user-mediated Wi-Fi network <b>120</b><i>b </i>if one is in range and available. In some implementations, when disconnecting from carrier-mediated wireless networks in response to receiving the user input indication <b>312</b>, the multi-network controller <b>300</b> may maintain any existing wireless network connections <b>122</b> between the user device <b>110</b> and wireless networks <b>120</b> mediated by other operators <b>70</b> (i.e., other carriers or network operators associated with user-mediated networks).

0046In some implementations, the interactive graphic <b>330</b> is also configured to receive user input indications <b>312</b> for enabling connections between the user device <b>110</b> and any available carrier-mediated wireless networks <b>120</b> associated with the respective carrier <b>70</b>. For example, after receiving a first user input indication <b>312</b> indicating selection of the interactive graphic <b>330</b> to disconnect all carrier-mediated wireless networks <b>120</b> connected to the user device <b>110</b> and operated by the associated carrier <b>70</b>, a subsequent second user input indication <b>312</b> indicating selection of the interactive graphic <b>330</b> may cause the user device <b>110</b> to enable or re-connect to the carrier-mediated wireless networks <b>120</b> via the corresponding wireless connection <b>122</b>. While in the example shown, the same interactive graphic <b>330</b> is used to toggle between enabling and disabling the carrier-mediated wireless networks <b>120</b>, it is understood that separate interactive graphics may be used instead, e.g., a first interactive graphic for enabling and a second interactive graphic for disabling. Additionally, the interactive graphic <b>330</b> may update (e.g., textual information) to reflect whether interaction with the interactive graphic <b>330</b> will enable or disable the carrier-mediated networks <b>120</b>.

0047When the multi-network controller <b>300</b> receives the user input indication <b>312</b> indicating selection of the interactive graphic <b>330</b> to disable the carrier-mediated wireless networks <b>120</b> associated with a particular network operator <b>70</b>, the multi-network controller <b>300</b> responds by disconnecting the user device <b>110</b> from each carrier-mediated wireless network <b>120</b> associated with the particular network operator <b>70</b>. The multi-network controller <b>300</b> may also update the status graphic <b>320</b> to indicate that the user device <b>110</b> is not currently connected to any carrier-mediated wireless networks <b>120</b> associated with the network operator <b>70</b>. In some implementations, a single status graphic <b>320</b> indicates connection by the user device <b>110</b> to any number of carrier-mediated wireless networks <b>120</b>, and in other implementations, the multi-network controller <b>300</b> renders multiple status graphics <b>320</b> in the GUI <b>115</b> each representing a respective carrier/network operator <b>70</b> providing one or more carrier-mediated wireless networks <b>120</b> that the user device <b>110</b> is connected to and capable of disconnecting from. In some implementations, the single status graphic <b>320</b> indicates connection by the user device <b>110</b> to all services provided by a single carrier network <b>70</b>. In these implementations, when the status graphic <b>320</b> indicates that the user device <b>110</b> is not connected to services provided by a particular network <b>70</b>, the user device <b>110</b> may still be connected to other carrier-mediated wireless networks <b>120</b> provided by a separate carrier or other user-mediated wireless networks <b>120</b>. Multiple individual graphics may be provided on the user device <b>110</b>, one for each carrier-mediated wireless network <b>120</b> and/or each user-mediated wireless network in these instances.

0048In some examples, the multi-network controller <b>300</b> provides the connection aggregator <b>200</b> an indication <b>340</b> indicating when the carrier-mediated wireless networks <b>120</b> have been enabled or disabled by the user <b>10</b>. The connection aggregator <b>200</b> may use the indication <b>340</b> indicating when the carrier-mediated wireless networks <b>120</b> have been disabled for terminating the appropriate wireless connections <b>122</b> and/or otherwise disconnecting from the VPN <b>30</b>. In some implementations, the user device <b>110</b> maintains an existing connection to the VPN <b>30</b>, but the connection aggregator <b>200</b> will halt transmitting data packets <b>50</b> over the VPN <b>30</b> and halt forwarding data packets <b>50</b> received from the remote VPN server <b>130</b> to applications <b>116</b> executing on the user device <b>110</b>.

0049Referring now to <figref idref="DRAWINGS">FIGS. <b>2</b>A-<b>2</b>D</figref>, in some implementations, the connection aggregator <b>200</b> includes a VPN client <b>230</b>. The VPN client <b>230</b> establishes point-to-point connections <b>122</b> (e.g., with tunneling protocols) over the public wireless networks <b>120</b> to include the user device <b>110</b> and the remote server <b>130</b> within the same private network, e.g., VPN <b>30</b>. The VPN client <b>230</b> may implement a host of security and privacy features to protect the data packets <b>50</b>. For example, the VPN client <b>230</b> may implement authentication and/or encryption. In some examples, the VPN client <b>230</b> authenticates with the VPN back-end service <b>132</b> using any or all of passwords, biometrics, digital certificates, and two-factor authentication.

0050The VPN client <b>230</b>, in some examples, receives VPN parameters <b>240</b>. The VPN parameters <b>240</b> may include network selection criteria <b>240</b><i>a </i>and network connection quality data <b>240</b><i>b</i>. The VPN client <b>230</b> may use the VPN parameters <b>240</b> to determine which connected wireless network connection <b>122</b> to transfer data packets <b>50</b> through when multiple wireless connections <b>122</b> are enabled simultaneously. In some implementations, the selection criteria <b>240</b><i>a </i>identifies a priority among the wireless connections <b>122</b>. For example, the selection criteria <b>240</b><i>a </i>may indicate that the Wi-Fi network connection <b>122</b><i>b </i>has a higher priority than the cellular network connection <b>122</b><i>a</i>, and when both connections <b>122</b> are enabled simultaneously, the VPN client <b>230</b> will use the Wi-Fi network connection <b>122</b><i>b </i>over the cellular network connection <b>122</b><i>a</i>. In other words, when the user device <b>110</b> is simultaneously connected to at least two carrier-mediated wireless networks associated with a same network operator <b>70</b>, the selection criteria <b>240</b><i>a </i>may identify one of the at least two carrier-mediated networks <b>120</b> as a priority carrier-mediated wireless network <b>120</b> associated with the network operator <b>70</b>. Optionally, the multi-network controller <b>300</b> may use the status graphic <b>320</b> to indicate that the mobile device <b>110</b> is currently connected to the priority carrier-mediated wireless network <b>120</b>.

0051In some examples, the VPN client <b>230</b> may determine which connection <b>122</b> to use at least in part based on the connection quality data <b>240</b><i>b</i>. The connection quality data <b>240</b><i>b </i>may quantify a quality of each wireless connection <b>122</b> between the mobile device <b>110</b> and the remote VPN server <b>130</b>. The VPN client <b>230</b> may identify which network connection <b>122</b> has a highest connection quality and transmit data packets <b>50</b> using the identified network connection. In other words, when the user device <b>110</b> is simultaneously connected to at least two carrier-mediated wireless networks associated with a same network operator <b>70</b>, the VPN client <b>230</b> may identify which carrier-mediated wireless network <b>120</b> of the at least two carrier-mediated wireless network <b>120</b> is associated with a highest connection quality based on the connection quality data <b>240</b><i>b</i>. Optionally, the multi-network controller <b>300</b> may use the status graphic <b>320</b> to indicate that the mobile device <b>110</b> is currently connected to the carrier-mediated wireless network <b>120</b> with the highest connection quality. For instance, the status graphic rendered in the GUI <b>115</b> may further indicate a value of the connection quality of the connection <b>122</b> between mobile device <b>110</b> and the identified carrier-mediated wireless network <b>120</b> associated with the highest connection quality.

0052The VPN client <b>230</b> may use quality thresholds <b>240</b><i>c </i>that, when satisfied, cause the VPN client <b>230</b> to switch from using one wireless network <b>120</b> for communicating data packets <b>150</b> over to another wireless network <b>120</b>. For example, while simultaneously connected to the cellular network <b>120</b><i>a </i>via the cellular connection <b>122</b><i>a </i>and Wi-Fi network <b>120</b><i>b </i>via the Wi-Fi network connection <b>122</b><i>b</i>, the user <b>10</b> may move the mobile device <b>110</b> away from an access point of the Wi-Fi network <b>120</b><i>b </i>until the quality of the connection <b>122</b><i>b </i>degrades to a threshold level due to the distance from the access point. At this threshold level, the VPN client <b>230</b> may switch from transmitting data packets <b>50</b> over the Wi-Fi network <b>120</b><i>b </i>to transmitting the data packets <b>50</b> over the cellular network <b>120</b><i>a </i>in order to avoid impacting user experience. The thresholds may be predetermined (e.g., via the user) or may be dynamic based on location, number of connections <b>122</b>, quality of connections <b>240</b><i>b</i>, and priority of the connections.

0053Referring now to <figref idref="DRAWINGS">FIG. <b>2</b>A</figref>, the VPN client <b>230</b> establishes carrier-mediated VPN network connections <b>122</b>C for each wireless connection <b>122</b> mediated by a carrier <b>70</b> to establish the VPN <b>30</b>. For example, the VPN client <b>230</b> may establish the cellular network connection <b>122</b><i>a </i>between the VPN client <b>230</b> and the remote VPN server <b>130</b> and the wireless network connection <b>122</b><i>b </i>(i.e., when the associated Wi-Fi network <b>120</b> is carrier-mediated) between the VPN client <b>230</b> and the remote VPN server <b>130</b>. The VPN client <b>230</b> may receive application traffic (i.e., data packets <b>50</b>) from applications <b>116</b> executing on the user device <b>110</b>. After receiving a data packet <b>50</b>, the VPN client <b>230</b> may determine which active carrier-mediated VPN network connection <b>122</b>C to use to transmit the data packet <b>50</b> based on the VPN parameters <b>240</b>.

0054Referring now to <figref idref="DRAWINGS">FIG. <b>2</b>B</figref>, in some implementations, the user device <b>110</b> connects to both one or more carrier-mediated VPN network connections <b>122</b>C and one or more user-mediated network connections <b>122</b>U simultaneously. For example, the mobile device <b>110</b> may have a cellular wireless connection <b>122</b><i>a </i>to a cellular network <b>120</b><i>a </i>operated by a carrier <b>70</b>, while simultaneously have a Wi-Fi wireless connection <b>122</b><i>b </i>to a Wi-Fi network <b>120</b><i>b </i>operated by the user <b>10</b> (e.g., a home Wi-Fi of the user). Here, the user-mediated network connections <b>122</b>U may bypass the VPN <b>30</b> and instead transmit application traffic (i.e., data packets <b>50</b>) directly to the destination server <b>60</b> through the external network <b>40</b>. In this case, a network selector <b>250</b> may receive the data packets <b>50</b> and determine, based on priority data <b>252</b>, whether to use a user-mediated network connection <b>122</b>U or a carrier-mediated VPN network connection <b>122</b>C. For example, the user-mediated Wi-Fi network connection <b>122</b><i>b </i>may be preferred due to lower costs than the carrier-mediated cellular network connection <b>122</b><i>a</i>. Optionally, the multi-network controller <b>300</b> may indicate with the status graphic <b>320</b> that the mobile device <b>110</b> is currently connected to the priority wireless network <b>120</b> (i.e., either a carrier-mediated network connection <b>122</b>C or a user-mediated network connection <b>122</b>U). In some examples, the status graphic <b>320</b> does not indicate which wireless network <b>120</b> the mobile device <b>110</b> is connected to (i.e., which radios of the mobile device are connected) and instead only indicates whether the mobile device <b>110</b> is connected to a user-mediated network <b>120</b> or to a carrier-mediated network <b>120</b>.

0055Referring now to <figref idref="DRAWINGS">FIG. <b>2</b>C</figref>, in some implementations, the user-mediated network connections <b>122</b>U associated with user-mediated wireless networks <b>120</b> are also established within the VPN <b>30</b>. For example, a carrier-mediated cellular network connection <b>122</b><i>a </i>connecting the mobile device <b>110</b> to the VPN server <b>130</b> over a carrier-mediated cellular network <b>120</b> and a user-mediated Wi-Fi network connection <b>122</b><i>b </i>connecting the mobile device <b>110</b> to the VPN server <b>130</b> over a user-mediated Wi-Fi network <b>120</b><i>b </i>may both be established between the VPN client <b>230</b> and the remote VPN server <b>130</b>. In this case, all application traffic (i.e., data packets <b>50</b>) may be routed to the VPN client <b>230</b> and the VPN client <b>230</b> may determine which connection <b>122</b> to transmit each data packet <b>50</b> on based on VPN parameters <b>240</b> as previously discussed.

0056Prior to including any user-mediated network connections <b>122</b>U within the VPN <b>30</b>, the connection aggregator <b>200</b> may prompt the user <b>10</b> of the mobile device <b>110</b> to provide consent <b>270</b> to permit the VPN client <b>230</b> to establish the VPN user-mediated wireless connection <b>122</b>U connecting the user device <b>110</b> to the remote VPN server <b>130</b> over a user-mediated wireless network <b>120</b>. In some examples, when the connection aggregator <b>200</b> prompts the user <b>10</b> of the mobile device <b>110</b> to provide the consent <b>270</b> to permit the VPN <b>30</b> to establish a connection using a user-mediated wireless network <b>120</b>, the connection aggregator <b>200</b> displays an interactive graphic <b>332</b> (<figref idref="DRAWINGS">FIG. <b>2</b>D</figref>) in the GUI <b>115</b>. The interactive graphic <b>332</b> enables the user <b>10</b> to provide the consent <b>270</b> to permit the VPN <b>30</b> to establish the user-mediated connection <b>122</b>U. For example, as illustrated in <figref idref="DRAWINGS">FIG. <b>2</b>D</figref>, the GUI <b>115</b> may display an interactive graphic <b>332</b> that includes textual information (e.g., “Include User Networks within VPN?”) along with buttons enabling the user <b>10</b> to consent (e.g., by selecting “Yes”) or not consent (e.g., by selecting “No”) to using the VPN <b>30</b> for the connections.

0057Referring back to <figref idref="DRAWINGS">FIG. <b>2</b>C</figref>, in some implementations, the remote VPN server <b>130</b> applies one or more network policies <b>260</b>, <b>260</b><i>a</i>-<i>n </i>to each wireless connection <b>122</b> established through the VPN <b>30</b> with the VPN client <b>230</b>. In some examples, the remote VPN server <b>130</b> applies the one or more network policies <b>260</b> to only connections <b>122</b> to carrier-mediated networks <b>120</b> (i.e., excluding user-mediated networks <b>120</b> from the network policies <b>260</b>) even when the user <b>10</b> has consented to including user-mediated networks within the VPN <b>30</b>. The network policies <b>260</b> may apply a variety of network-side features. For example, the remote VPN server <b>130</b> may apply a throttling policy <b>260</b><i>a </i>to the connections <b>122</b> that throttle data of certain types, at certain times, or at certain thresholds of consumption. The remote VPN server <b>130</b> may additionally or alternatively apply a zero-rating policy <b>260</b><i>b</i>. The zero-rating policy <b>260</b><i>b </i>may provide Internet access with reduced financial cost under certain conditions. For example, costs of access may be reduced based on an increase in advertising or limiting access to certain websites.

0058Referring now to <figref idref="DRAWINGS">FIG. <b>3</b></figref>, when the user device <b>110</b> is simultaneously connected to the first wireless network <b>120</b><i>a </i>(e.g., cellular network) and the second wireless network <b>120</b><i>b </i>(e.g., Wi-Fi network), the multi-network controller <b>300</b> may determine whether the first wireless network <b>120</b><i>a </i>is associated with a same network operator <b>70</b> as the second wireless network <b>120</b><i>b </i>by querying a carrier application <b>116</b>, <b>116</b>C installed/executing on the user device <b>110</b>. The carrier application <b>116</b> may be associated with a particular carrier/network operator, e.g., a MNO or a MVNO. In some examples, the multi-network controller <b>300</b> first verifies that the carrier application <b>116</b>C is associated with the carrier <b>70</b> by determining whether the carrier application <b>116</b>C is digitally signed by the carrier <b>70</b>. For instance, the carrier <b>70</b> may provide the digital signature <b>354</b> using a cryptographic key of <b>352</b> of the carrier <b>70</b>. The key <b>352</b> may be included, for example, within the SIM <b>350</b>, which may include the embedded SIM (eSIM). When the multi-network controller <b>300</b> verifies the carrier application <b>116</b>C via the presence of the digital signature <b>354</b> signed by the key <b>352</b> associated with the carrier <b>70</b>, the multi-network controller <b>300</b> may then retrieve network identifications (IDs) <b>117</b> and/or network credentials <b>118</b> (e.g., a password) for each wireless network <b>120</b> associated with, and mediated by, the carrier <b>70</b>. Accordingly, using the retrieved network IDs <b>117</b> and/or network credentials <b>118</b>, the multi-network controller <b>300</b> may determine whether the first wireless network <b>120</b><i>a </i>and the second wireless network <b>120</b><i>b </i>are associated with (e.g., mediated by) the same carrier <b>70</b>. In some cases, a wireless network <b>120</b> may need credentials <b>118</b> prior to connection (e.g., a Wi-Fi network <b>120</b><i>b</i>) and the multi-network controller <b>300</b> may retrieve these credentials <b>118</b> from the appropriate carrier application <b>116</b>C to access the associated network <b>120</b>. In some examples, the carrier application <b>116</b>C “pushes” or otherwise provisions the multi-network controller <b>300</b> with credentials <b>118</b> for associated carrier-mediated networks <b>120</b>. The carrier application <b>116</b>C may query the multi-network controller <b>300</b> (or otherwise the OS of the user device <b>110</b>) to determine if the user device <b>110</b> is currently connected to one of the carrier's networks <b>120</b>.

0059Referring now to <figref idref="DRAWINGS">FIGS. <b>4</b>A and <b>4</b>B</figref>, in some implementations, the status graphic <b>320</b> rendered in the GUI <b>115</b> of the mobile device <b>110</b> updates to indicate a connection to at least one carrier-mediated wireless network or at least one user-mediated wireless network associated with a select operator <b>70</b>. For example, the status graphic <b>320</b><i>a </i>(<figref idref="DRAWINGS">FIG. <b>4</b>A</figref>) rendered in the GUI <b>115</b> indicates that the mobile device <b>110</b> is currently connected to a carrier-mediated wireless network. While not shown, when the mobile device <b>110</b> is connected to both a carrier-mediated wireless network (e.g., cellular network <b>120</b><i>a</i>) and a user-mediated wireless network (e.g., Wi-Fi network <b>120</b><i>b</i>) simultaneously, two status graphics <b>320</b> may be rendered in the GUI <b>115</b> each indicating a respective one of the connections to the carrier-mediated wireless network or the user-mediated-wireless network. Here, the two status graphics <b>320</b> may be differentiable (e.g., different graphics, orientations, colors, etc.) so that the user <b>10</b> can differentiate which types of wireless networks <b>120</b> the user device <b>110</b> is connected to. <figref idref="DRAWINGS">FIG. <b>4</b>A</figref> also shows a first interactive graphic <b>330</b>, <b>330</b><i>a </i>configured to receive user input indications for selecting between disabling connections <b>122</b> between the mobile device <b>110</b> and any available carrier-mediated wireless networks <b>120</b> associated with the select operator <b>70</b> (i.e., represented by the status graphic <b>320</b><i>a</i>) and enabling connections <b>122</b> between the mobile device <b>110</b> and any available carrier-mediated wireless networks <b>120</b> associated with the select operator <b>70</b>. In response to a first user input indication <b>312</b> indicating selection of the rendered first interactive graphic <b>330</b><i>a </i>(i.e., selecting “Yes” to disable carrier data), the mobile device <b>110</b> disconnects from the carrier-mediated wireless network. In some examples, the mobile device <b>110</b> also connects to a user-mediated wireless network <b>120</b> (e.g., the user's Wi-Fi network). In response to the first input indication <b>312</b>, <figref idref="DRAWINGS">FIG. <b>4</b>B</figref> shows the status graphic <b>320</b><i>a </i>updating by rendering status graphic <b>320</b><i>b </i>in the GUI <b>115</b> to indicate that the mobile device <b>110</b> is not currently connected to any carrier-mediated wireless networks <b>120</b> associated with the operator <b>70</b>. In some examples, the status graphic <b>320</b><i>b </i>may also update to indicate that the mobile device <b>110</b> is now currently connected to the user-mediated wireless network <b>120</b>. Here, the status graphic <b>320</b><i>b </i>of <figref idref="DRAWINGS">FIG. <b>4</b>B</figref> includes an orientation that is rotated relative to the status graphic <b>320</b><i>a </i>of <figref idref="DRAWINGS">FIG. <b>4</b>A</figref>. In other examples, the status graphic <b>320</b><i>b </i>may include an entirely different graphic than the status graphic <b>320</b><i>a</i>, include a different color, and/or include any other distinguishable features to allow the user <b>10</b> to discern between status graphics <b>320</b><i>a </i>indicating connections to carrier-mediated wireless networks <b>120</b> and status graphics <b>320</b><i>b </i>indicating connections to user-mediated wireless networks <b>120</b>. <figref idref="DRAWINGS">FIG. <b>4</b>B</figref> also shows the mobile device <b>110</b> rendering a subsequent second interactive graphic <b>330</b><i>b </i>in the GUI <b>115</b> prompting the user <b>10</b> to enable carrier data. Here, the user may provide a second user input indication <b>312</b> indicating selection of the second interactive graphic <b>330</b><i>b </i>to enable carrier data (i.e., selecting “Yes” to enable carrier data), and the status graphic <b>320</b><i>b </i>may revert back to the status graphic <b>320</b><i>a </i>rendered in the GUI <b>115</b> of <figref idref="DRAWINGS">FIG. <b>4</b>A</figref> appropriately. Both status graphics <b>320</b><i>a</i>, <b>320</b><i>b </i>may visually indicate a quality of the connection (e.g., signal strength) to the currently connected wireless network. Thus, the status graphics <b>320</b><i>a</i>, <b>320</b><i>b </i>provide a convenient and quick way for a user to determine whether or not the mobile device <b>110</b> is connected to a carrier-mediated wireless network or a user-mediated wireless network, as well as optionally providing a quality of the connection.

0060<figref idref="DRAWINGS">FIG. <b>5</b></figref> is a flowchart of an exemplary arrangement of operations for a method <b>500</b> of demarcating carrier-mediated networks and user-mediated networks in a mobile device <b>110</b>. The method <b>500</b> starts at operation <b>502</b> for a mobile device <b>110</b> simultaneously connected to a first wireless network <b>120</b> and a second wireless network <b>120</b>, determining, by data processing hardware <b>112</b> of the mobile device <b>110</b>, whether the first wireless network <b>120</b> is associated with a same network operator <b>70</b> as the second wireless network <b>120</b>. When the first wireless network <b>120</b> is associated with the same network operator <b>70</b> as the second wireless network <b>120</b>, the method <b>500</b> includes, at operation <b>504</b>, establishing, by the data processing hardware <b>112</b>, a virtual private network <b>30</b> (VPN) between the mobile device <b>110</b> and a remote server <b>130</b>. The VPN <b>30</b> includes a first VPN connection <b>122</b> and a second VPN connection <b>122</b>. The first VPN connection <b>122</b> connects the mobile device <b>110</b> to the remote server <b>130</b> over the first wireless network <b>120</b> and the second VPN connection <b>122</b> connects the mobile device <b>110</b> to the remote server <b>130</b> over the second wireless network <b>120</b>.

0061At operation <b>506</b>, the method <b>500</b> includes transmitting, by the data processing hardware <b>112</b>, data <b>50</b> (i.e., data packets <b>50</b>) from the mobile device <b>110</b> to the remote server <b>130</b> over the VPN <b>30</b> via one of the first VPN connection <b>122</b> or the second VPN connection <b>122</b>. The data <b>50</b> when received by the remote server <b>130</b> causes the remote server <b>130</b> to route the data <b>50</b> to a destination server <b>60</b>.

0062<figref idref="DRAWINGS">FIG. <b>6</b></figref> is schematic view of an example computing device <b>600</b> that may be used to implement the systems and methods described in this document. The computing device <b>600</b> is intended to represent various forms of digital computers, such as laptops, desktops, workstations, personal digital assistants, servers, blade servers, mainframes, and other appropriate computers. The components shown here, their connections and relationships, and their functions, are meant to be exemplary only, and are not meant to limit implementations of the inventions described and/or claimed in this document.

0063The computing device <b>600</b> includes a processor <b>610</b>, memory <b>620</b>, a storage device <b>630</b>, a high-speed interface/controller <b>640</b> connecting to the memory <b>620</b> and high-speed expansion ports <b>650</b>, and a low speed interface/controller <b>660</b> connecting to a low speed bus <b>670</b> and a storage device <b>630</b>. Each of the components <b>610</b>, <b>620</b>, <b>630</b>, <b>640</b>, <b>650</b>, and <b>660</b>, are interconnected using various busses, and may be mounted on a common motherboard or in other manners as appropriate. The processor <b>610</b> can process instructions for execution within the computing device <b>600</b>, including instructions stored in the memory <b>620</b> or on the storage device <b>630</b> to display graphical information for a graphical user interface (GUI) on an external input/output device, such as display <b>680</b> coupled to high speed interface <b>640</b>. In other implementations, multiple processors and/or multiple buses may be used, as appropriate, along with multiple memories and types of memory. Also, multiple computing devices <b>600</b> may be connected, with each device providing portions of the necessary operations (e.g., as a server bank, a group of blade servers, or a multi-processor system).

0064The memory <b>620</b> stores information non-transitorily within the computing device <b>600</b>. The memory <b>620</b> may be a computer-readable medium, a volatile memory unit(s), or non-volatile memory unit(s). The non-transitory memory <b>620</b> may be physical devices used to store programs (e.g., sequences of instructions) or data (e.g., program state information) on a temporary or permanent basis for use by the computing device <b>600</b>. Examples of non-volatile memory include, but are not limited to, flash memory and read-only memory (ROM)/programmable read-only memory (PROM)/erasable programmable read-only memory (EPROM)/electronically erasable programmable read-only memory (EEPROM) (e.g., typically used for firmware, such as boot programs). Examples of volatile memory include, but are not limited to, random access memory (RAM), dynamic random access memory (DRAM), static random access memory (SRAM), phase change memory (PCM) as well as disks or tapes.

0065The storage device <b>630</b> is capable of providing mass storage for the computing device <b>600</b>. In some implementations, the storage device <b>630</b> is a computer-readable medium. In various different implementations, the storage device <b>630</b> may be a floppy disk device, a hard disk device, an optical disk device, or a tape device, a flash memory or other similar solid state memory device, or an array of devices, including devices in a storage area network or other configurations. In additional implementations, a computer program product is tangibly embodied in an information carrier. The computer program product contains instructions that, when executed, perform one or more methods, such as those described above. The information carrier is a computer- or machine-readable medium, such as the memory <b>620</b>, the storage device <b>630</b>, or memory on processor <b>610</b>.

0066The high speed controller <b>640</b> manages bandwidth-intensive operations for the computing device <b>600</b>, while the low speed controller <b>660</b> manages lower bandwidth-intensive operations. Such allocation of duties is exemplary only. In some implementations, the high-speed controller <b>640</b> is coupled to the memory <b>620</b>, the display <b>680</b> (e.g., through a graphics processor or accelerator), and to the high-speed expansion ports <b>650</b>, which may accept various expansion cards (not shown). In some implementations, the low-speed controller <b>660</b> is coupled to the storage device <b>630</b> and a low-speed expansion port <b>690</b>. The low-speed expansion port <b>690</b>, which may include various communication ports (e.g., USB, Bluetooth, Ethernet, wireless Ethernet), may be coupled to one or more input/output devices, such as a keyboard, a pointing device, a scanner, or a networking device such as a switch or router, e.g., through a network adapter.

0067The computing device <b>600</b> may be implemented in a number of different forms, as shown in the figure. For example, it may be implemented as a standard server <b>600</b><i>a </i>or multiple times in a group of such servers <b>600</b><i>a</i>, as a laptop computer <b>600</b><i>b</i>, or as part of a rack server system <b>600</b><i>c. </i>

0068Various implementations of the systems and techniques described herein can be realized in digital electronic and/or optical circuitry, integrated circuitry, specially designed ASICs (application specific integrated circuits), computer hardware, firmware, software, and/or combinations thereof. These various implementations can include implementation in one or more computer programs that are executable and/or interpretable on a programmable system including at least one programmable processor, which may be special or general purpose, coupled to receive data and instructions from, and to transmit data and instructions to, a storage system, at least one input device, and at least one output device.

0069These computer programs (also known as programs, software, software applications or code) include machine instructions for a programmable processor, and can be implemented in a high-level procedural and/or object-oriented programming language, and/or in assembly/machine language. As used herein, the terms “machine-readable medium” and “computer-readable medium” refer to any computer program product, non-transitory computer readable medium, apparatus and/or device (e.g., magnetic discs, optical disks, memory, Programmable Logic Devices (PLDs)) used to provide machine instructions and/or data to a programmable processor, including a machine-readable medium that receives machine instructions as a machine-readable signal. The term “machine-readable signal” refers to any signal used to provide machine instructions and/or data to a programmable processor.

0070The processes and logic flows described in this specification can be performed by one or more programmable processors, also referred to as data processing hardware, executing one or more computer programs to perform functions by operating on input data and generating output. The processes and logic flows can also be performed by special purpose logic circuitry, e.g., an FPGA (field programmable gate array) or an ASIC (application specific integrated circuit). Processors suitable for the execution of a computer program include, by way of example, both general and special purpose microprocessors, and any one or more processors of any kind of digital computer. Generally, a processor will receive instructions and data from a read only memory or a random access memory or both. The essential elements of a computer are a processor for performing instructions and one or more memory devices for storing instructions and data. Generally, a computer will also include, or be operatively coupled to receive data from or transfer data to, or both, one or more mass storage devices for storing data, e.g., magnetic, magneto optical disks, or optical disks. However, a computer need not have such devices. Computer readable media suitable for storing computer program instructions and data include all forms of non-volatile memory, media and memory devices, including by way of example semiconductor memory devices, e.g., EPROM, EEPROM, and flash memory devices; magnetic disks, e.g., internal hard disks or removable disks; magneto optical disks; and CD ROM and DVD-ROM disks. The processor and the memory can be supplemented by, or incorporated in, special purpose logic circuitry.

0071To provide for interaction with a user, one or more aspects of the disclosure can be implemented on a computer having a display device, e.g., a CRT (cathode ray tube), LCD (liquid crystal display) monitor, or touch screen for displaying information to the user and optionally a keyboard and a pointing device, e.g., a mouse or a trackball, by which the user can provide input to the computer. Other kinds of devices can be used to provide interaction with a user as well; for example, feedback provided to the user can be any form of sensory feedback, e.g., visual feedback, auditory feedback, or tactile feedback; and input from the user can be received in any form, including acoustic, speech, or tactile input. In addition, a computer can interact with a user by sending documents to and receiving documents from a device that is used by the user; for example, by sending web pages to a web browser on a user's client device in response to requests received from the web browser.

0072A number of implementations have been described. Nevertheless, it will be understood that various modifications may be made without departing from the spirit and scope of the disclosure. Accordingly, other implementations are within the scope of the following claims.