How do paid content providers get a phone number on their sites via 3g,4g?

Question

mobile connection

Hello. How does the scheme technically work with connecting a client from the mobile Internet to paid content when he does not enter his phone number on the content provider's website? (the first method from the page https://habrahabr.ru/company/beeline/blog/228623/ ).
Is it possible to prohibit such an opportunity without the participation of a mobile operator?

Answer 1

Of the technical problems here, only "how do you know who to tell what phone number the one who came to this page has."
The problem is solved simply, stupidly and in the forehead.
The owner of the page concludes an agreement with the telecom operator, they say, I want to see the phone numbers of people who come to me, I read the laws, I give a tooth - I won’t spoil.
After that, the operator DPI starts working.
As a rule, DPI implements a set of Application Level Gateways (ALG) for the most popular protocols: HTTP, FTP, DNS. If in Russian, then ALG is a transparent proxy.
What phone number the subscriber has, DPI knows: if DPI is built into GGSP / PGW (this is like BRAS, but with mobile specifics), then it knows from the beginning, and if it is a separate box, then it receives a bunch of ip-address -> phone number, for example, by the same RADIUS. Or, if DPI is included in the gap between SGSN and GGSN / SGW and PGW (this happens), it peeps the subscriber number from the GTP-C fields.
In general, the DPI subscriber's phone number somehow found out.
And then he simply adds it as a separate HTTP header to HTTP requests to the landing page.
Yes, as a protection against the Evil Hacker somewhere in the middle, sometimes the phone number is encrypted so that no one but the owner of the page can parse it.
You can close this opportunity in one way: make subscriber traffic unreadable for the telecom operator.
These are:
- rejecting HTTP and switching to HTTPS, or
- working exclusively through VPN