Modem processor firewall operation

Abstract

In aspects of modem processor firewall operation, an application processor may provide information related to one or more firewall rules to a modem, the information configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules. A modem processor may: receive, from the application processor, one or more firewall rules used by the application processor to perform firewall operations on received data packets; generating one or more filters executable by the modem processor based on the received one or more firewall rules to apply to data packets received by the modem; and discarding the received data packets conforming to the blocking criteria of the generated one or more filters.

Description

[0001] Related Applications

[0002] This application claims the benefit of priority to U.S. non-provisional application No. 17 / 931,606, filed on September 13, 2022; the entire contents of which are incorporated herein by reference. Background Art

[0003] Long Term Evolution (LTE) technology, fifth generation (5G) new radio (NR) technology, and other communication technologies have improved communication services and data services. Modern communication devices typically use firewalls to protect devices and networks from attacks by malicious data or malicious code. Typically, the application processor of the device executes all firewall rules. Conventionally, a modem processor of the device that communicates with the application processor receives data from a radio frequency (RF) or wired interface (e.g., Ethernet), decodes the received data, and passes the decoded data to the application processor. The application processor is responsible for executing firewall rules to protect the processor and connected devices from attacks. Therefore, the processing burden of executing the firewall is entirely imposed on the application processor, requiring the processor to start to execute firewall rules even if all received data packets are rejected. Summary of the invention

[0004] Various aspects include systems and methods executed by a modem processor of a device to discard received data packets that meet firewall blocking criteria, thereby preventing data packets that would be blocked by firewall rules executed in an application processor from being passed to the application processor. Various aspects include a method executed by a modem processor, the method comprising: receiving from an application processor one or more firewall rules used by the application processor to perform firewall operations on received data packets; generating one or more filters executable by the modem processor based on the received one or more firewall rules; and discarding received data packets that meet the blocking criteria of the generated one or more filters.

[0005] In some aspects, generating one or more filters executable by the modem processor based on the received one or more firewall rules may include generating one or more filters based on the received one or more firewall rules associated with one or more user plane connections maintained by the modem.

[0006] In some aspects, generating one or more filters executable by the modem processor based on one or more received firewall rules may include: parsing each firewall rule to identify firewall parameters and blocking operations applicable to the firewall rule, and generating a corresponding filter executable by the modem processor, the corresponding filter including filtering criteria consistent with the identified firewall parameters.

[0007] In some aspects, receiving one or more firewall rules from an application processor may include receiving, from the application processor, firewall rules that apply only to user plane connections maintained by the modem.

[0008] Additional aspects include a modem including a modem processor configured to perform one or more operations of any of the methods outlined above. Additional aspects include a modem having components for performing the functions of any of the methods outlined above. Additional aspects include a non-transitory processor-readable storage medium having processor-executable instructions stored thereon, the processor-executable instructions configured to cause the modem processor to perform the operations of any of the methods outlined above.

[0009] In further aspects, an application processor may provide information associated with one or more firewall rules to a modem, the information being configured to enable the modem to discard data packets that meet filtering criteria consistent with the one or more firewall rules. Some aspects include a method performed by an application processor, the method comprising: providing information associated with one or more firewall rules to a modem, the information being configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules. In some aspects, providing information associated with one or more firewall rules to a modem may include: transmitting to the modem all firewall rules configured for use by the application processor. In some aspects, providing information associated with one or more firewall rules to a modem may include: transmitting to the modem only firewall rules that apply to one or more user plane connections maintained by the modem.

[0010] In some aspects, providing information related to one or more firewall rules to a modem may include generating one or more filters executable by the modem based on the one or more firewall rules, wherein the information is configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules, the generated one or more filters including filtering criteria consistent with the one or more firewall rules. In some aspects, generating one or more filters executable by the modem based on the one or more firewall rules may include generating the one or more filters having filtering criteria consistent with firewall parameters of the one or more firewall rules.

[0011] Additional aspects include an application processor configured to perform one or more operations of any of the methods outlined above. Additional aspects include an application processor having components for performing the functions of any of the methods outlined above. Additional aspects include a non-transitory processor-readable storage medium having processor-executable instructions stored thereon, the processor-executable instructions configured to cause the application processor to perform the operations of any of the methods outlined above. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] Figure 1A is a system block diagram illustrating an example communication system suitable for implementing any of the various embodiments.

[0013] Figure 1B is a system block diagram illustrating an example decomposed base station architecture suitable for implementing any of the various embodiments.

[0014] Figure 2 is a component block diagram illustrating an example computing and wireless modem system suitable for implementing any of the various embodiments.

[0015] Figure 3 is a component block diagram illustrating a software architecture including a radio protocol stack for user plane and control plane in wireless communications suitable for implementing any of the various embodiments.

[0016] Figure 4 is a component block diagram illustrating elements of a device configured in accordance with various embodiments.

[0017] FIG. 5A to FIG. 5D is a conceptual diagram illustrating operations that may be performed by an application processor and a modem processor according to various embodiments.

[0018] Fig. 6Ais a process flow diagram illustrating a method 600a performed by a modem processor of a modem according to various embodiments.

[0019] Figure 6B is a process flow diagram illustrating operations 600b that may be performed by a modem processor of a modem as part of method 600a according to various embodiments.

[0020] Figure 7 is a process flow diagram illustrating a method 700 performed by an application processor of a device according to various embodiments.

[0021] Figure 8 is a component block diagram of a UE suitable for use with various embodiments.

[0022] Fig. 9 is a component block diagram of a network device suitable for use with various embodiments. DETAILED DESCRIPTION

[0023] Various embodiments will be described in detail with reference to the accompanying drawings. Where possible, the same reference numerals will be used throughout the drawings to refer to the same or similar parts. References to specific examples and implementations are for illustrative purposes and are not intended to limit the scope of the claims.

[0024] Various embodiments enable a modem processor of a device to perform operations to filter out data packets that a connected application processor would block or discard based on firewall rules executed in the application processor. In some embodiments, the modem processor generates a firewall filter based on firewall rules received from the application processor. In some embodiments, the application processor generates a firewall filter based on the firewall rules and passes the generated filter to the modem for execution.

[0025] Various embodiments improve the efficiency of application processor operation by reducing the computational burden required of the application processor to execute firewall rules on data packets that would be blocked by such rules. Various embodiments particularly improve the efficiency of the application processor when the device is operating in a non-sleep or non-low-power mode, such as a radio resource control (RRC) active mode or a connected mode, when the modem is actively receiving data packets and the application processor is on standby to receive data packets for processing. By filtering out data packets that would be discarded by the application processor's firewall rules anyway by the modem, the application processor does not have to expend processing resources to block such data packets.

[0026] The term "user equipment" (UE) is used herein to refer to any or all of the following: wireless communication devices, wireless appliances, cellular phones, smart phones, portable computing devices, personal or mobile multimedia players, laptop computers, tablet computers, smartbooks, ultrabooks, handheld computers, wireless email receivers, Internet-enabled multimedia cellular phones, wireless router devices, medical devices and equipment, biosensors / devices, wearable devices (including smart watches, smart clothing, smart glasses, smart wristbands, smart jewelry (e.g., smart rings and smart bracelets)), entertainment devices (e.g., wireless game controllers, music and video players, satellite radios, etc.), wireless network-enabled Internet of Things (IoT) devices (including smart meters / sensors, industrial manufacturing equipment, large and small machines and appliances for home or business use), wireless communication elements within vehicles, wireless devices attached to or incorporated into various mobile platforms, and similar electronic devices that include memory, wireless communication components and programmable processors.

[0027] The term "system on chip" (SOC) is used herein to refer to a single integrated circuit (IC) chip that includes multiple resources or processors integrated on a single substrate. A single SOC may include circuits for digital, analog, mixed signal, and radio frequency functions. A single SOC may also include any number of general or special processors (digital signal processors, modem processors, video processors, etc.), memory blocks (such as ROM, RAM, flash memory, etc.), and resources (such as timers, voltage regulators, oscillators, etc.). Each SOC may also include software for controlling the integrated resources and processors, as well as for controlling peripheral devices.

[0028] The term "system-in-package" (SIP) may be used herein to refer to a single module or package that contains multiple resources, computing units, cores or processors on two or more IC chips, substrates, or SOCs. For example, a SIP may include a single substrate on which multiple IC chips or semiconductor dies are stacked in a vertical configuration. Similarly, a SIP may include one or more multi-chip modules (MCMs) on which multiple ICs or semiconductor dies are packaged into a unified substrate. A SIP may also include multiple independent SOCs that are coupled together via high-speed communication circuits and packaged together in close proximity (such as on a single motherboard or in a single wireless device). The proximity of the SOCs facilitates high-speed communication and sharing of memory and resources.

[0029] As used herein, the terms "network", "system", "wireless network", "cellular network" and "wireless communication network" may interchangeably refer to a portion or all of a wireless network of a carrier associated with a wireless device and / or a subscription on a wireless device. The techniques described herein may be used in various wireless communication networks, such as code division multiple access (CDMA), time division multiple access (TDMA), FDMA, orthogonal FDMA (OFDMA), single carrier FDMA (SC-FDMA), and other networks. In general, any number of wireless networks may be deployed in a given geographic area. Each wireless network may support at least one radio access technology, which may operate on one or more frequencies or frequency ranges. For example, a CDMA network may implement Universal Terrestrial Radio Access (UTRA) (including Wideband Code Division Multiple Access (WCDMA) standards), CDMA2000 (including IS-2000, IS-95 and / or IS-856 standards), and the like. In another example, a TDMA network may implement Enhanced Data Rates for Global System for Mobile Communications (GSM) Evolution (EDGE). In another example, an OFDMA network may implement Evolved UTRA (E-UTRA) (including the LTE standard), Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Etc. Reference may be made to wireless networks using the LTE standard, and thus the terms "Evolved Universal Terrestrial Radio Access," "E-UTRAN," and "eNodeB" may also be used interchangeably herein to refer to wireless networks. However, such references are provided merely as examples and are not intended to exclude wireless networks using other communication standards. For example, although various third generation (3G) systems, fourth generation (4G) systems, and fifth generation (5G) systems are discussed herein, those systems are cited merely as examples and may be replaced with future generation systems (e.g., sixth generation (6G) or higher generation systems) in various examples.

[0030] Firewalls are an essential feature of modern communication devices such as computing devices, mobile broadband routers, automotive telematics products, and / or numerous other devices. Firewalls are typically executed by the device's application processor to analyze incoming data packets to identify and block malware and other forms of attack. A firewall may include executing firewall rules on data traffic (e.g., protocol data units (PDUs)) received (and / or transmitted) by the device (such as via a modem). Firewall rules may be applied to data traffic to discard malformed data traffic or unwanted data traffic received from a communication network.

[0031] As used herein, the terms "discard" and "discarding data packets" refer to various operations that may be performed on data packets that meet defined blocking criteria and thereby prevent data traffic (one or more packets) from being received for further processing by an application processor and / or use in device operation. Thus, in a modem executing a filter or in an application processor executing a firewall rule, discarding a data packet may include: blocking the packet from further processing, ignoring the packet, rejecting the packet, passing the packet to a sandbox environment (e.g., for analysis), deleting the packet from a memory (e.g., a cache or buffer memory), and / or other operations that will prevent the packet from further processing. In various embodiments, with respect to a modem discarding a data packet, "discarding a data packet" involves not passing the data packet to an application processor (i.e., preventing the application processor from receiving the data packet).

[0032] In some embodiments, a firewall may be employed at the router level of a communication network to protect devices connected to, for example, a broadband network served by such a router. In some routers (e.g., commercial routers), firewall features, functions, and parameters may be configured, modified, deleted, enabled, or disabled through a user interface such as a home application of the router. In some embodiments, the router may provide an application that may call one or more firewall APIs supported by software executed by an application processor that enables configuration of firewall rules (e.g., a telematics software development kit such as TelSDK, a software suite such as Qualcomm Mobile Access Point (QCMAP), and / or another suitable application).

[0033] Firewall rules may be stored in an application processor for execution in the kernel, for example, in the form of iptables in a netfilter framework. Such firewall rules may be applied or executed by an application processor to allow or block data packets received from another device (such as a communication network). If one or more packets meet the blocking criteria of a firewall rule, such packets are discarded according to the firewall rule (e.g., such packets are blocked from further processing, deleted from memory, ignored, etc.).

[0034] In a typical communication device, a device modem may receive and decode data packets and pass the decoded data packets to an application processor. The application processor may route or send the data packets to an embedded client or a direct-connect client. The modem typically does not execute or instantiate any aspect of the firewall rules configured and maintained at the application processor, and the modem typically cannot determine whether a received packet should be blocked based on such firewall rules.

[0035] When executing and applying firewall rules, the application processor must fetch packets from memory and apply firewall rules, resulting in significant power consumption and processing resource burden. Firewall operations performed by the application processor consume bandwidth of the application processor, memory, and communication buses. For some application processors, such processing and bandwidth consumption can degrade the performance and user experience of other applications, especially for more resource-constrained processors or processing chipsets.

[0036] Various embodiments enable a modem processor of a device to effectively perform firewall operations by applying filters based on firewall rules to data packets when the data packets are received by the modem. In some embodiments, the modem processor may receive one or more firewall rules from an application processor for use by the application processor to perform firewall operations on received data packets. In such embodiments, the firewall rules provided to the modem are the same as the firewall rules used by the application processor to determine whether the received data packets should be blocked. In some embodiments, the modem processor may generate one or more filters that can be executed by the modem processor based on the one or more firewall rules received to apply to the data packets received by the modem. Then, using the generated filters, the modem may discard the received data packets that meet the blocking criteria of the one or more generated filters. In some embodiments, the modem processor may discard the received data packets without passing such data packets to the application processor.

[0037] In some embodiments, the modem processor may generate one or more filters based on one or more received firewall rules associated with one or more user plane connections. As used herein, a "user plane connection" refers to a communication link, bearer, or session that provides end-to-end user plane connectivity to a device, such as an Evolved Packet System (EPS) bearer that can be used in conjunction with a 4G communication system, a PDU session that can be used in conjunction with a 5G communication system, and any other suitable communication link, bearer, or session adopted in a current or future (e.g., 6G, 7G, etc.) communication system. For example, a 4G communication system uses an EPS bearer to provide end-to-end user plane connectivity between a UE and an access point name (APN) through a packet gateway (P-GW). There is a one-to-one mapping between an EPS bearer and a QoS profile, i.e., all packets belonging to a specific EPS bearer have the same "quality of service class identifier" (QCI). As another example, a 5G communication system uses a PDU session to provide end-to-end user plane connectivity between a UE and a specific data network (DN) through a user plane function (UPF). A PDU session supports one or more quality of service (QoS) flows. There is a one-to-one mapping between QoS flows and QoS profiles, where all packets belonging to a specific QoS flow have the same 5G Quality of Service Identifier (5QI).

[0038] In some embodiments, the modem processor may generate the one or more filters executable by the modem processor based on the received one or more firewall rules by parsing each firewall rule to identify firewall parameters and a blocking action applicable to the firewall rule, and generating a corresponding filter executable by the modem processor, the corresponding filter including filtering criteria consistent with the identified firewall parameters. In some embodiments, the modem processor may receive firewall rules from the application processor that apply only to user plane connections maintained by the modem.

[0039] In some embodiments, the application processor may provide information related to one or more firewall rules to the modem, which is configured to enable the modem to discard data packets that meet filtering criteria consistent with the one or more firewall rules. In some embodiments, the application processor may transmit to the modem all firewall rules configured for use by the application processor.

[0040] In some embodiments, the application processor may transmit to the modem only firewall rules that are applicable to one or more user plane connections maintained by the modem. For example, the application processor may scan, review, parse, or analyze the firewall rules to identify or determine the firewall rules that are applicable to the user plane connections maintained by the modem. In some embodiments, the application processor may identify a parameter, argument, or item in the firewall rule that indicates that the firewall rule is applicable to such user plane connections maintained by the modem.

[0041] In some embodiments, the application processor may generate one or more filters executable by the connected modem based on the one or more firewall rules, wherein the generated one or more filters include filtering criteria consistent with the one or more firewall rules. In some embodiments, the application processor may generate the one or more filters having filtering criteria consistent with firewall parameters of the one or more firewall rules.

[0042] Various embodiments improve the operation of the application processor and the modem processor by reducing the processing burden of the application processor and increasing the ability of the application processor to execute other processes, thereby improving the overall performance of the application processor. Various embodiments improve the operation of the communication device by reducing power consumption when performing firewall operations. Various embodiments improve the operation of the communication device by reducing the consumption of the device's memory cache and communication bus resources.

[0043] Figure 1A 1 is a system block diagram illustrating an example communication system 100 suitable for implementing any of the various embodiments. The communication system 100 may be a 5G New Radio (NR) network, or any other suitable network such as a Long Term Evolution (LTE) network. Figure 1A A 5G network is illustrated, but later generations of networks may include the same or similar elements. Therefore, references to 5G networks and 5G network elements in the following description are for illustrative purposes and are not intended to be limiting.

[0044] The communication system 100 may include a heterogeneous network architecture including a core network 140 and various UEs (in Figure 1A120a-120e). The communication system 100 may also include a plurality of network devices 110a, 110b, 110c, and 110d and other network entities, such as base stations and network nodes. A network device is an entity that communicates with a UE, and in various implementations, may be referred to as a Node B, an LTE evolved Node B (eNodeB or eNB), an access point (AP), a radio head, a transmit receive point (TRP), a new radio base station (NR BS), a 5G Node B (NB), a next generation Node B (gNodeB or gNB), and the like. In various communication network implementations or architectures, the network device may be implemented as an aggregated base station, a decomposed base station, an integrated access and backhaul (IAB) node, a relay node, a sidelink node, and the like, such as a virtualized radio access network (vRAN) or an open radio access network (O-RAN). In addition, in various communication network implementations or architectures, the network equipment (or network entity) may be implemented in an aggregated or monolithic base station architecture, or alternatively, in a decomposed base station architecture, and may include one or more of a centralized unit (CU), a distributed unit (DU), a radio unit (RU), a near real-time (RT) RAN intelligent controller (RIC), or a non-real-time RIC. Each network device may provide communication coverage for a specific geographic area. In 3GPP, the term "cell" may refer to a coverage area of ​​a network device, a network device subsystem serving the coverage area, or a combination thereof, depending on the context in which the term is used. The core network 140 may be any type of core network, such as an LTE core network (e.g., an evolved packet core (EPC) network), a 5G core network, etc.

[0045] The network devices 110a-110d may provide communication coverage for a macro cell, a pico cell, a femto cell, another type of cell, or a combination thereof. A macro cell may cover a relatively large geographic area (e.g., a radius of several kilometers) and may allow unrestricted access by UEs with service subscriptions. A pico cell may cover a relatively small geographic area and may allow unrestricted access by UEs with service subscriptions. A femto cell may cover a relatively small geographic area (e.g., a residence) and may allow restricted access by UEs associated with the femto cell (e.g., UEs in a closed subscriber group (CSG)). Network equipment for macro cells may be referred to as macro nodes or macro base stations. Network equipment for pico cells may be referred to as pico nodes or pico base stations. Network equipment for femto cells may be referred to as femto nodes, femto base stations, home nodes, or home network devices. In Figure 1AIn the example illustrated in , network device 110a may be a macro node for macro cell 102a, network device 110b may be a pico node for pico cell 102b, and network device 110c may be a femto node for femto cell 102c. Network devices 110a-110d may support one or more (e.g., three) cells. The terms “network device,” “network node,” “eNB,” “base station,” “NR BS,” “gNB,” “TRP,” “AP,” “Node B,” “5G NB,” and “cell” may be used interchangeably herein.

[0046] In some examples, the cell may not be stationary, and the geographic area of ​​the cell may move depending on the location of a network device such as a network node or a mobile network device. In some examples, the network devices 110a-110d may be interconnected to each other and to one or more other network devices (e.g., a base station or a network node (not illustrated)) in the communication system 100 using any suitable transport network via various types of backhaul interfaces (such as direct physical connections, virtual networks, or combinations thereof).

[0047] The network devices 110a-110d may communicate with the core network 140 over a wired or wireless communication link 126. The UEs 120a-120e may communicate with the network nodes 110a-110d over a wireless communication link 122. The wired communication link 126 may use a variety of wired networks (such as Ethernet, TV cable, telephone, fiber optic, and other forms of physical network connections) that may use one or more wired communication protocols, such as Ethernet, point-to-point protocol, high-level data link control (HDLC), advanced data communications control protocol (ADCCP), and transmission control protocol / Internet protocol (TCP / IP).

[0048] The communication system 100 may also include a relay station (such as a relay network device 110d). A relay station is an entity that can receive data transmissions from an upstream station (e.g., a network device or UE) and transmit the data transmissions to a downstream station (e.g., a UE or network device). A relay station may also be a UE that is capable of relaying transmissions for other UEs. Figure 1A In the example illustrated in , a relay station 110d may communicate with a macro network device 110a and a UE 120d to facilitate communication between the network device 110a and the UE 120d. A relay station may also be referred to as a relay network device, a relay base station, a relay, or the like.

[0049] The communication system 100 may be a heterogeneous network including different types of network devices (e.g., macro network devices, pico network devices, femto network devices, relay network devices, etc.). These different types of network devices may have different transmit power levels, different coverage areas, and different effects on interference in the communication system 100. For example, a macro node may have a high transmit power level (e.g., 5 watts to 40 watts), while a pico network device, a femto network device, and a relay network device may have a lower transmit power level (e.g., 0.1 watt to 2 watts).

[0050] The network controller 130 may be coupled to a collection of network devices and may provide coordination and control of these network devices. The network controller 130 may communicate with the network devices via a backhaul. The network devices may also communicate with each other directly or indirectly, for example, via a wireless or wired backhaul.

[0051] UEs 120a, 120b, 120c may be dispersed throughout the communication system 100, and each UE may be stationary or mobile.UE may also be referred to as an access terminal, terminal, mobile station, subscriber unit, station, wireless device, etc.

[0052] The macro network device 110a may communicate with the communication network 140 over a wired or wireless communication link 126. The UEs 120a, 120b, 120c may communicate over a wireless communication link 122 with the network devices 110a-110d.

[0053] The wireless communication links 122 and 124 may include multiple carrier signals, frequencies, or frequency bands, each of which may include multiple logical channels. The wireless communication links 122 and 124 may utilize one or more radio access technologies (RATs). Examples of RATs that may be used in the wireless communication links include: 3GPP LTE, 3G, 4G, 5G (such as NR), GSM, Code Division Multiple Access (CDMA), Wideband Code Division Multiple Access (WCDMA), Worldwide Interoperability for Microwave Access (WiMAX), Time Division Multiple Access (TDMA), and other mobile phone communication technology cellular RATs. Other examples of RATs that may be used in one or more of the various wireless communication links within the communication system 100 include medium-range protocols (such as Wi-Fi, LTE-U, LTE-Direct, LAA, MuLTEfire) and relatively short-range RATs (such as ZigBee, Bluetooth, and Bluetooth Low Energy (LE)).

[0054] Certain wireless networks (e.g., LTE) use orthogonal frequency division multiplexing (OFDM) on the downlink and single carrier frequency division multiplexing (SC-FDM) on the uplink. OFDM and SC-FDM divide the system bandwidth into multiple (K) orthogonal subcarriers, which are also often referred to as tones, frequency bins, etc. Each subcarrier can be modulated with data. In general, modulation symbols are transmitted in the frequency domain using OFDM and in the time domain using SC-FDM. The spacing between adjacent subcarriers can be fixed, and the total number of subcarriers (K) can depend on the system bandwidth. For example, the spacing of the subcarriers can be 15kHz, and the minimum resource allocation (called a "resource block") can be 12 subcarriers (or 180kHz). Therefore, for a system bandwidth of 1.25 megahertz (MHz), 2.5MHz, 5MHz, 10MHz, or 20MHz, the nominal fast file transfer (FFT) size can be equal to 128, 256, 512, 1024, or 2048, respectively. The system bandwidth may be further divided into subbands. For example, a subband may cover 1.08 MHz (ie, 6 resource blocks), and there may be 1, 2, 4, 8, or 16 subbands for system bandwidths of 1.25 MHz, 2.5 MHz, 5 MHz, 10 MHz, or 20 MHz, respectively.

[0055] Although the description of some specific implementations may use terms and examples associated with LTE technology, some specific implementations may be applicable to other wireless communication systems (such as new radio (NR) or 5G networks). NR can utilize OFDM with a cyclic prefix (CP) on the uplink (UL) and downlink (DL), and includes support for half-duplex operation using time division duplex (TDD). A single component carrier bandwidth of 100 MHz can be supported. NR resource blocks can span 12 subcarriers with a subcarrier bandwidth of 75 kHz over a duration of 0.1 milliseconds (ms). Each radio frame may include 50 subframes with a length of 10 ms. Therefore, each subframe may have a length of 0.2 ms. Each subframe may indicate a link direction (i.e., DL or UL) for data transmission, and the link direction of each subframe may be dynamically switched. Each subframe may include DL / UL data and DL / UL control data. Beamforming may be supported and the beam direction may be dynamically configured. Multiple-input multiple-output (MIMO) transmission with precoding may also be supported. MIMO configuration in DL can support up to eight transmit antennas, multi-layer DL transmission with up to eight streams and up to two streams per UE. Multi-layer transmission with up to 2 streams per UE can be supported.

[0056] Up to eight serving cells may be used to support aggregation of multiple cells. Alternatively, NR may support a different air interface other than the OFDM-based air interface.

[0057] Some UEs may be considered as machine type communication (MTC) UEs, or evolved or enhanced machine type communication (eMTC) UEs. MTC and eMTC UEs include, for example, robots, remote devices, sensors, meters, monitors, location tags, etc., which may communicate with a network device, another device (e.g., a remote device), or some other entity. The wireless computing platform may provide connectivity to or to a network (e.g., a wide area network (such as the Internet) or a cellular network), for example, via a wired or wireless communication link. Some UEs may be considered as Internet of Things (IoT) devices, or may be implemented as NB-IoT (narrowband Internet of Things) devices. UE 120a-120e may be included inside a housing that houses components of UE 120a-120e, such as processor components, memory components, similar components, or combinations thereof.

[0058] Generally speaking, any number of communication systems and any number of wireless networks may be deployed in a given geographic area. Each communication system and wireless network may support a specific radio access technology (RAT) and may operate on one or more frequencies. RAT may also be referred to as radio technology, air interface, etc. Frequency may also be referred to as carrier, frequency channel, etc. Each frequency may support a single RAT in a given geographic area to avoid interference between communication systems of different RATs. In some cases, 4G / LTE and / or 5G / NR RAT networks may be deployed. For example, a 5G non-standalone (NSA) network may use 4G / LTE RAT on the 4G / LTE RAN side of a 5G NSA network and simultaneously use 5G / NR RAT on the 5G / NR RAN side of a 5G NSA network. Both 4G / LTE RAN and 5G / NR RAN may be connected to each other and to a 4G / LTE core network (e.g., EPC network) in a 5G NSA network. Other example network configurations may include a 5G standalone (SA) network in which a 5G / NR RAN is connected to a 5G core network.

[0059] In some implementations, two or more UEs 120a-120e (e.g., illustrated as UE 120a and UE 120e) may communicate directly (e.g., without using network nodes 110a-110d as an intermediary to communicate with each other) using one or more side link channels 124. For example, UEs 120a-120e may communicate using peer-to-peer (P2P) communication, device-to-device (D2D) communication, a mesh network or similar network, a vehicle-to-everything (V2X) protocol (which may include a vehicle-to-vehicle (V2V) protocol, a vehicle-to-infrastructure (V2I) protocol, or a similar protocol), or a combination thereof. In this case, UEs 120a-120e may perform scheduling operations, resource selection operations, and other operations described elsewhere herein as being performed by network nodes 110a-110d.

[0060] The deployment of a communication system (such as a 5G NR system) can be arranged with various components or components in a variety of ways. In a 5G NR system or network, a network node, a network entity, a mobility element of a network, a radio access network (RAN) node, a core network node, a network element or a network equipment (such as a base station (BS), or one or more units (or components) that perform base station functionality) can be implemented in an aggregated or decomposed architecture. For example, a base station (such as a node B (NB), an evolved NB (eNB), a NRBS, a 5GNB, an access point (AP), a transmit receive point (TRP) or a cell, etc.) can be implemented as an aggregated base station (also referred to as an independent BS or a monolithic BS) or a decomposed base station.

[0061] A converged base station may be configured to utilize a radio protocol stack physically or logically integrated within a single RAN node. A decomposed base station may be configured to utilize a protocol stack physically or logically distributed between two or more units, such as one or more central or centralized units (CUs), one or more distributed units (DUs), or one or more radio units (RUs). In some aspects, a CU may be implemented within a RAN node, and one or more DUs may be co-located with the CU, or alternatively, may be geographically or virtually distributed in one or more other RAN nodes. A DU may be implemented to communicate with one or more RUs. Each of a CU, a DU, and a RU may also be implemented as a virtual unit (referred to as a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU)).

[0062] Base station type operations or network designs may take into account the aggregated nature of base station functionality. For example, a disaggregated base station may be used in an integrated access backhaul (IAB) network, an open radio access network (O-RAN) (such as a network configuration initiated by the O-RAN Alliance), or a virtualized radio access network (vRAN, also known as a cloud radio access network (C-RAN)). Decomposition may include distributing functionality across two or more units at various physical locations, as well as virtually distributing functionality of at least one unit, which may enable flexibility in network design. Various units of a disaggregated base station or disaggregated RAN architecture may be configured for wired or wireless communication with at least one other unit.

[0063] Figure 1B is a system block diagram illustrating an example decomposed base station 160 architecture suitable for implementing any of the various embodiments. Figure 1A and Figure 1B , the decomposed base station 160 architecture may include one or more central units (CU) 162, which may communicate directly with the core network 180 via a backhaul link, or indirectly with the core network 180 through one or more decomposed base station units (such as a near real-time (near RT) RAN intelligent controller (RIC) 164 via an E2 link, or a non-real-time (non-RT) RIC 168 associated with a service management and orchestration (SMO) framework 166, or both). The CU 162 may communicate with one or more distributed units (DU) 170 via corresponding midhaul links (such as an F1 interface). The DU 170 may communicate with one or more radio units (RU) 172 via corresponding fronthaul links. The RU 172 may communicate with corresponding UEs 120 via one or more radio frequency (RF) access links. In some implementations, a UE 120 may be served by multiple RUs 172 simultaneously.

[0064] Each of the units (i.e., CU 162, DU 170, RU 172), as well as near-RT RIC 164, non-RT RIC 168, and SMO framework 166 may include one or more interfaces, or be coupled to one or more interfaces configured to receive or send signals, data, or information (collectively referred to as signals) via a wired or wireless transmission medium. Each of the units or an associated processor or controller that provides instructions to the communication interface of these units may be configured to communicate with one or more of the other units via a transmission medium. For example, these units may include a wired interface that is configured to receive or send signals to one or more of the other units via a wired transmission medium. Additionally, these units may include a wireless interface that may include a receiver, a transmitter, or a transceiver (such as a radio frequency (RF) transceiver) that is configured to receive or send signals, or both, to one or more of the other units on a wireless transmission medium.

[0065] In some aspects, CU 162 may host one or more higher layer control functions. Such control functions may include radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP), etc. Each control function may be implemented using an interface configured to communicate signals with other control functions hosted by CU 162. CU 162 may be configured to handle user plane functionality (i.e., central unit-user plane (CU-UP)), control plane functionality (i.e., central unit-control plane (CU-CP)), or a combination thereof. In some specific implementations, CU 162 may be logically split into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RAN configuration, the CU-UP unit may communicate bidirectionally with the CU-CP unit via an interface (such as an E1 interface). As needed, CU 162 may be implemented to communicate with DU 170 for network control and signaling.

[0066] DU 170 may correspond to a logical unit that includes one or more base station functions for controlling the operation of one or more RUs 172. In some aspects, DU 170 may host one or more of a radio link control (RLC) layer, a medium access control (MAC) layer, and one or more high physical (PHY) layers (such as modules for forward error correction (FEC) encoding and decoding, scrambling, modulation and demodulation, etc.) at least in part according to a functional split such as defined by the Third Generation Partnership Project (3GPP). In some aspects, DU 170 may further host one or more low PHY layers. Each layer (or module) may be implemented using an interface that is configured to communicate signals with other layers (and modules) hosted by DU 170 or with control functions hosted by CU 162.

[0067] The lower layer functionality may be implemented by one or more RUs 172. In some deployments, the RUs 172 controlled by the DUs 170 may correspond to logical nodes that host RF processing functions or low PHY layer functions (such as performing fast Fourier transforms (FFTs), inverse FFTs (iFFTs), digital beamforming, physical random access channel (PRACH) extraction and filtering, etc.), or both, based at least in part on functional splits (such as lower layer functional splits). In such an architecture, the RUs 172 may be implemented to handle over-the-air (OTA) communications with one or more UEs 120. In some specific implementations, real-time and non-real-time aspects of control plane and user plane communications with the RUs 172 may be controlled by the corresponding DUs 170. In some scenarios, this configuration may enable the DUs 170 and CUs 162 to be implemented in a cloud-based RAN architecture such as a vRAN architecture.

[0068] The SMO framework 166 may be configured to support RAN deployment and provisioning of non-virtualized network elements and virtualized network elements. For non-virtualized network elements, the SMO framework 166 may be configured to support the deployment of dedicated physical resources for RAN coverage requirements, which may be managed via an operation and maintenance interface (such as an O1 interface). For virtualized network elements, the SMO framework 166 may be configured to interact with a cloud computing platform (such as an open cloud (O-Cloud) 176) to perform network element lifecycle management (such as instantiating virtualized network elements) via a cloud computing platform interface (such as an O2 interface). Such virtualized network elements may include, but are not limited to, CU 162, DU 170, RU 172, and near-RT RIC 164. In some specific implementations, the SMO framework 166 may communicate with hardware aspects of the 4G RAN (such as an open eNB (O-eNB) 174) via the O1 interface. Additionally, in some specific implementations, the SMO framework 166 may communicate directly with one or more RUs 172 via the O1 interface. The SMO framework 166 may also include a non-RT RIC 168 configured to support the functionality of the SMO framework 166 .

[0069] The non-RT RIC 168 may be configured to include logic functions that enable non-real-time control and optimization of RAN elements and resources, artificial intelligence / machine learning (AI / ML) workflows including model training and updating, or policy-based guidance of applications / features in the near-RT RIC 164. The non-RT RIC 168 may be coupled to or in communication with the near-RT RIC 164 (such as via an A1 interface). The near-RT RIC 164 may be configured to include logic functions that enable near-real-time control and optimization of RAN elements and resources via data collection and actions through an interface (such as via an E2 interface) that connects one or more CUs 162, one or more DUs 170, or both, and the O-eNB with the near-RT RIC 164.

[0070] In some implementations, in order to generate an AI / ML model to be deployed in the near-RT RIC 164, the non-RT RIC 168 may receive parameters or external enrichment information from an external server. Such information may be utilized by the near-RT RIC 164 and may be received from a non-network data source or from a network function at the SMO framework 166 or the non-RT RIC 168. In some examples, the non-RT RIC 168 or the near-RT RIC 164 may be configured to tune RAN behavior or performance. For example, the non-RT RIC 168 may monitor long-term trends and patterns of performance and employ AI / ML models to perform corrective actions through the SMO framework 166 (such as via reconfiguration of O1) or via the creation of RAN management policies (such as A1 policies).

[0071] Figure 2 is a component block diagram illustrating an example computing and wireless modem system 200 suitable for implementing any of the various embodiments. The various embodiments may be implemented on a number of single-processor and multi-processor computer systems, including system-on-chip (SOC) or system-in-package (SIP).

[0072] refer to Figure 1A to Figure 2 , the illustrated example computing system 200 (which may be a SIP in some embodiments) includes two SOCs 202, 204 coupled to a clock 206, a voltage regulator 208, and a wireless transceiver 266, which is configured to transmit and receive wireless communications to / from a UE (e.g., 120a-120e) or a network device (e.g., 110a-110d) via an antenna (not shown). In some specific implementations, the first SOC 202 may operate as a central processing unit (CPU) of the UE, which executes the instructions of the software application by performing arithmetic, logic, control, and input / output (I / O) operations specified by the instructions of the software application. In some specific implementations, the second SOC 204 may operate as a dedicated processing unit. For example, the second SOC 204 may operate as a dedicated 5G processing unit responsible for managing high-capacity, high-speed (such as 5 Gbps, etc.) and / or ultra-high frequency short wavelength (such as 28 GHz millimeter wave spectrum, etc.) communications.

[0073] The first SOC 202 may include a digital signal processor (DSP) 210, a modem processor 212, a graphics processor 214, an application processor 216, one or more coprocessors 218 (such as a vector coprocessor) connected to one or more of these processors, memory 220, custom circuits 222, system components and resources 224, interconnects / bus modules 226, one or more temperature sensors 230, a thermal management unit 232, and a thermal power envelope (TPE) component 234. The second SOC 204 may include a 5G modem processor 252, a power management unit 254, an interconnect / bus module 264, multiple millimeter wave transceivers 256, memory 258, and various additional processors 260, such as an application processor, a packet processor, etc.

[0074] Each processor 210, 212, 214, 216, 218, 252, 260 may include one or more cores, and each processor / core may perform operations independently of other processors / cores. For example, the first SOC 202 may include a processor that executes a first type of operating system (such as FreeBSD, LINUX, OS X, etc.) and a processor that executes a second type of operating system (such as MICROSOFT WINDOWS10). In addition, any or all of the processors 210, 212, 214, 216, 218, 252, 260 may be included as part of a processor cluster architecture (such as a synchronous processor cluster architecture, an asynchronous or heterogeneous processor cluster architecture, etc.).

[0075] The first SOC 202 and the second SOC 204 may include various system components, resources, and custom circuits for managing sensor data, analog-to-digital conversion, wireless data transmission, and for performing other specialized operations, such as decoding data packets and processing encoded audio and video signals for presentation in a web browser. For example, the system components and resources 224 of the first SOC 202 may include power amplifiers, voltage regulators, oscillators, phase-locked loops, peripheral bridges, data controllers, memory controllers, system controllers, access ports, timers, and other similar components used to support processors and software clients running on UEs. The system components and resources 224 and / or custom circuits 222 may also include circuits for docking with peripheral devices (such as cameras, electronic displays, wireless communication devices, external memory chips, etc.).

[0076] The first SOC 202 and the second SOC 204 may communicate via an interconnect / bus module 250. The various processors 210, 212, 214, 216, 218 may be interconnected to one or more memory elements 220, system components and resources 224, and custom circuits 222, and a thermal management unit 232 via an interconnect / bus module 226. Similarly, the processor 252 may be interconnected to a power management unit 254, a millimeter wave transceiver 256, a memory 258, and various additional processors 260 via an interconnect / bus module 264. The interconnect / bus modules 226, 250, 264 may include an array of reconfigurable logic gates and / or implement a bus architecture (such as CoreConnect, AMBA, etc.). Communications may be provided by an advanced interconnect, such as a high-performance network on chip (NoC).

[0077] The first SOC 202 and / or the second SOC 204 may also include an input / output module (not illustrated) for communicating with resources external to the SOC, such as a clock 206 and a voltage regulator 208. The resources external to the SOC, such as the clock 206 and the voltage regulator 208, may be shared by two or more of the internal SOC processors / cores.

[0078] In addition to the example SIP 200 discussed above, some implementations may be realized in a variety of computing systems that may include a single processor, multiple processors, multi-core processors, or any combination thereof.

[0079] Figure 3 is a component block diagram illustrating a software architecture 300 including a radio protocol stack for a user plane and a control plane in wireless communications suitable for implementing any of the various embodiments. Figures 1A to 3, UE 320 may implement software architecture 300 to facilitate communication between UE 320 (e.g., UE 120a-120e, 200) and network device 350 (e.g., network device 110a-110d) of a communication system (e.g., 100). In various embodiments, the layers in software architecture 300 may form a logical connection with the corresponding layers in the software of network device 350. Software architecture 300 may be distributed between one or more processors (e.g., processors 212, 214, 216, 218, 252, 260). Although illustrated with respect to one radio protocol stack, in a UE with multiple subscriber identity modules (SIMs), software architecture 300 may include multiple protocol stacks, each of which may be associated with a different SIM (e.g., in a dual SIM wireless communication device, two protocol stacks are associated with two SIMs, respectively). Although described below with reference to LTE communication layers, software architecture 300 may support any of a variety of standards and protocols for wireless communication, and / or may include additional protocol stacks that support any of a variety of standards and protocols for wireless communication.

[0080] The software architecture 300 may include a non-access stratum (NAS) 302 and an access stratum (AS) 304. The NAS 302 may include functions and protocols to support packet filtering, security management, mobility control, session management, and services and signaling between a SIM of a UE (such as SIM 204) and its core network 140. The AS 304 may include functions and protocols to support communication between a SIM (such as SIM 204) and entities of a supported access network (such as network devices, network nodes, RUs, base stations, etc.). Specifically, the AS 304 may include at least three layers (layer 1, layer 2, and layer 3), each of which may include various sublayers.

[0081] In the user plane and control plane, layer 1 (L1) of AS 304 may be a physical layer (PHY) 306, which may oversee functions for transmitting and / or receiving over an air interface via a wireless transceiver (e.g., 266). Examples of such physical layer 306 functions may include cyclic redundancy check (CRC) attachment, decoding blocks, scrambling and descrambling, modulation and demodulation, signal measurement, MIMO, etc. The physical layer may include various logical channels, including a physical downlink control channel (PDCCH) and a physical downlink shared channel (PDSCH).

[0082] In the user plane and the control plane, Layer 2 (L2) of AS 304 may be responsible for the link between UE 320 and network node 350 on physical layer 306. In some implementations, Layer 2 may include a medium access control (MAC) sublayer 308, a radio link control (RLC) sublayer 310, a packet data convergence protocol (PDCP) 312 sublayer, and a service data adaptation protocol (SDAP) 317 sublayer, each of which forms a logical connection terminated at network node 350.

[0083] In the control plane, layer 3 (L3) of AS 304 may include a radio resource control (RRC) sublayer 3. Although not shown, the software architecture 300 may include additional layer 3 sublayers, as well as various upper layers above layer 3. In some implementations, the RRC sublayer 313 may provide functionality including broadcasting system information, paging, and establishing and releasing RRC signaling connections between the UE 320 and the network node 350.

[0084] In various embodiments, the SDAP sublayer 317 may provide mapping between quality of service (QoS) flows and data radio bearers (DRBs). In some implementations, the PDCP sublayer 312 may provide uplink functions including multiplexing between different radio bearers and logical channels, sequence number addition, handover data handling, integrity protection, encryption, and header compression. In the downlink, the PDCP sublayer 312 may provide functions including in-sequence delivery of data packets, duplicate data packet detection, integrity verification, decryption, and header decompression.

[0085] In the uplink, the RLC sublayer 310 may provide segmentation and concatenation of upper layer data packets, retransmission of lost data packets, and automatic repeat request (ARQ). In the downlink, the RLC sublayer 310 functions may include reordering of data packets to compensate for out-of-order reception, reassembly of upper layer data packets, and ARQ.

[0086] In the uplink, the MAC sublayer 308 may provide functions including multiplexing between logical and transport channels, random access procedures, logical channel priorities, and hybrid ARQ (HARQ) operations. In the downlink, MAC layer functions may include channel mapping within a cell, demultiplexing, discontinuous reception (DRX), and HARQ operations.

[0087] While the software architecture 300 may provide functionality for sending data over a physical medium, the software architecture 300 may also include at least one host layer 314 to provide data delivery services to various applications in the UE 320. In some implementations, the application-specific functionality provided by the at least one host layer 314 may provide an interface between the software architecture and a general-purpose processor (e.g., 202).

[0088] In other implementations, the software architecture 300 may include one or more higher logical layers (such as transport, session, presentation, application, etc.) that provide host layer functionality. For example, in some implementations, the software architecture 300 may include a network layer (such as an Internet Protocol (IP) layer) where the logical connection terminates at a packet data network (PDN) gateway (PGW). In some implementations, the software architecture 300 may include an application layer where the logical connection terminates at another device (such as an end-user device, a server, etc.). In some implementations, the software architecture 300 may further include a hardware interface 316 between the physical layer 306 and communication hardware (such as one or more radio frequency (RF) transceivers) in the AS 304.

[0089] In various network implementations or architectures, in the network device 350, the different logical layers 308 to 317 may be implemented in a converged or monolithic base station architecture, or alternatively in a disaggregated network device architecture, and the various logical layers may be implemented in one or more of a CU, DU, RU, near-RT RAN intelligent controller (RIC), or non-real-time (non-RT) RIC. In addition, the network device 350 may be implemented as a converged base station, a disaggregated base station, an integrated access and backhaul (IAB) node, a relay node, a sidelink node, etc.

[0090] Figure 4 is a component block diagram illustrating elements of a device 400 configured according to various embodiments. Figures 1A to 4 , the device 400 (eg, 120a - 120e , 320 ) may be configured to communicate with the core network 140 via the base station 110 .

[0091] Device 400 may include one or more modem processors 404, application processors 424, memory 402, wireless transceiver 266, and other components. Device 400 may include multiple hardware, software, and / or firmware components that operate together to provide the functionality attributed herein to modem processor 404 and application processor 424.

[0092] The memory 402 may include non-transitory storage media that electronically stores information. The electronic storage media of the memory 402 may include one or both of a system storage device that is provided integrally (i.e., substantially non-removable) with the vehicle processing system 104 and / or a removable storage device that is removably connected to the device 400 via, for example, a port (e.g., a universal serial bus (USB) port, a firewire port, etc.) or a drive (e.g., a disk drive, etc.). In various embodiments, the memory 402 may include one or more of a charge-based storage medium (e.g., EEPROM, RAM, etc.), a solid-state storage medium (e.g., a flash drive, etc.), an optically readable storage medium (e.g., an optical disk, etc.), a magnetically readable storage medium (e.g., a magnetic tape, a magnetic hard drive, a floppy disk drive, etc.), and / or other electronically readable storage media.

[0093] Memory 402 may include one or more virtual storage resources (e.g., cloud storage, a virtual private network, and / or other virtual storage resources). Memory 402 may store software algorithms, information determined by application processor 424, information received from another device, information received from a network element of core network 140, information received from base station 110, and / or other information that enables device 400 to function as described herein.

[0094] Processors 404 and 424 may include one of a plurality of local processors that may be configured to provide information processing capabilities in device 400. Thus, processors 404 and 424 may include one or more of a digital processor, an analog processor, a digital circuit designed to process information, an analog circuit designed to process information, a state machine, and / or other mechanisms for electronically processing information. Figure 4 404 and 424 may include multiple processing units. These processing units may be physically located in the same device, or 404 and 424 may represent processing functionality of multiple devices distributed in the vehicle and operating in coordination.

[0095] Modem processor 404 may be configured by machine-readable instructions 406 that may include one or more instruction modules. An instruction module may include a computer program module. In various embodiments, the instruction module may include one or more of a firewall rule module 410, a filter module 412, a packet handling module 414, and / or other modules.

[0096] Firewall rules module 410 may be configured to receive from application processor 424 one or more firewall rules used by application processor 424 to perform firewall operations on received data packets. Firewall rules module 410 may be configured to receive from application processor firewall rules that apply only to user plane connections maintained by the modem.

[0097] The filtering module 412 may be configured to generate one or more filters executable by the modem processor based on the received one or more firewall rules to be applied to data packets received by the modem. The filtering module 412 may be configured to generate one or more filters based on the received one or more firewall rules associated with one or more user plane connections. The filtering module 412 may be configured to parse each firewall rule to identify firewall parameters and blocking actions applicable to the firewall rule, and to generate a corresponding filter executable by the modem processor, the corresponding filter including filtering criteria consistent with the identified firewall parameters.

[0098] The packet handling module 338 may be configured to discard received data packets that meet the blocking criteria of the generated one or more filters.

[0099] The application processor 424 may be configured by machine-readable instructions 426 that may include one or more instruction modules. The instruction module may include a computer program module. In various embodiments, the instruction module may include one or more of a firewall rule module 430, a filter module 434, and / or other modules.

[0100] The firewall rules module 430 may be configured to provide information related to one or more firewall rules to the modem, the information being configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules. The firewall rules module 430 may be configured to transmit to the modem all firewall rules configured for use by the application processor. The firewall rules module 430 may be configured to transmit to the modem only firewall rules that are applicable to one or more user plane connections maintained by the modem.

[0101] The filtering module 434 can be configured to generate one or more filters executable by the modem based on the one or more firewall rules, wherein the generated one or more filters include filtering criteria consistent with the one or more firewall rules. The filtering module 434 can be configured to generate the one or more filters having filtering criteria consistent with the firewall parameters of the one or more firewall rules.

[0102] Processors 404 and 424 may be configured to execute modules 434 - 442 and / or other modules via software, hardware, firmware, some combination of software, hardware, and / or firmware and / or other mechanisms for configuring processing capabilities on processors 404 and 424 .

[0103] The description of the functionality provided by the different modules 410-414 and 426-434 is for illustrative purposes and is not intended to be limiting, as any of the modules 410-414 and 426-434 may provide more or less functionality than described. For example, one or more of the modules 410-414 and 426-434 may be removed, and some or all of their functionality may be provided by other modules of the modules 410-414 and 426-434. As another example, the processor 404 may be configured to execute one or more additional modules that may perform some or all of the functionality attributed below to one of the modules 410-414 and 426-434.

[0104] FIG. 5A to FIG. 5D is a conceptual diagram illustrating a non-limiting example of operations 500a through 500d that may be performed by an application processor (AP) and a modem processor according to various embodiments. FIG. 1A to FIG. 5D , operations 500a to 500d may be performed by a processor (such as processors 210, 212, 214, 216, 218, 252, 260, 404, 424) of a UE (such as UEs 120a-120e, 200, 320, 400).

[0105] See also Figure 5A In operation 502, the application processor may configure firewall rules. In some embodiments, the application processor may receive firewall configuration information, such as various firewall parameters, from user input, a configuration file, or another suitable source of firewall configuration information. For example, the application processor may configure firewall rules 520 based on the firewall configuration information.

[0106] The application processor may save these firewall rules in a data structure in operation 504. In some embodiments, the data structure may include IP table 522. In some embodiments, the firewall rules in the data structure may be in a form or format that can be executed by the application processor.

[0107] In operation 506 , the application processor may communicate the firewall rules 522 to the modem processor.

[0108] In operation 508 , the modem processor may receive the firewall rules from the application processor.

[0109] In operation 510, the modem processor may generate filters based on the received firewall rules. In some embodiments, the modem processor may generate the filters in a data structure, such as the data structure of filters 524. In some embodiments, the generated filters are executable by the modem processor.

[0110] In operation 512, the modem processor may use these filters to filter packets. In some embodiments, the modem processor may discard received data packets that meet the blocking criteria of the filters. In some embodiments, the modem processor may pass received data packets that do not meet the blocking criteria of the filters to the application processor.

[0111] See also Figure 5B , the application processor may configure firewall rules in operation 502 and may save the firewall rules in a data structure in operation 504, as described.

[0112] In operation 532, the application processor may communicate to the modem processor firewall rules (indicated by darkened fields) associated with one or more user plane connections maintained by the modem processor.

[0113] In operation 534, the modem processor receives firewall rules (indicated by darkened fields) associated with one or more user plane connections maintained by the modem processor.

[0114] In operation 510, the modem processor may generate filters based on the received firewall rules, and in operation 512, the modem processor may use these filters to screen packets, as described.

[0115] See also Figure 5C , the application processor may configure firewall rules in operation 502 and may save the firewall rules in a data structure in operation 504, as described.

[0116] In operation 542, the application processor may generate filters according to the firewall rules. In some embodiments, the application processor may generate the filters in a data structure, such as the data structure of filter 550. In some embodiments, the generated filters are executable by the modem processor.

[0117] In operation 544, the application processor transmits the filter to the modem processor.

[0118] The modem processor receives the filters in operation 546. In operation 512, the modem processor may use the filters to screen packets, as described.

[0119] See also Figure 5D , the application processor may configure firewall rules in operation 502 and may save the firewall rules in a data structure in operation 504, as described.

[0120] In operation 552, the application processor may generate filters (indicated by darkened fields) based on firewall rules associated with one or more user plane connections maintained by the modem processor.

[0121] In operation 534, the modem processor receives firewall rules (indicated by darkened fields) associated with one or more user plane connections maintained by the modem processor. In some embodiments, the application processor may generate filters in a data structure such as the data structure of filters 560. In some embodiments, the generated filters are executable by the modem processor.

[0122] In operation 554, the application processor transmits the filter to the modem processor.

[0123] The modem processor receives the filters in operation 546 and may use the filters to screen packets in operation 512, as described.

[0124] Fig. 6A is a process flow diagram illustrating a method 600a performed by a modem processor of a modem according to various embodiments. Figures 1A to 6A , the operations of method 600a may be performed by a processor (such as processor 210, 212, 214, 216, 218, 252, 260, 404) of a device (such as UE 120a-120e, 200, 320, 400, 800). The processor may be a modem processor or a processor coupled to a modem or controlling a modem, and is therefore generally referred to as a "modem processor".

[0125] In block 602, the modem processor may receive from the application processor one or more firewall rules (e.g., 522) for use by the application processor to perform firewall operations on received data packets. In some embodiments, the modem processor may receive from the application processor one or more firewall rules that apply only to one or more user plane connections (e.g., EPS bearers, PDU sessions, or another suitable user plane connection) maintained by the modem. In some embodiments, the modem processor may receive from the application processor firewall rules that apply only to user plane connections maintained by the modem. Components for performing the functions of the operations in block 602 may include a modem processor (e.g., 212, 252, 404) executing a firewall rules module 410 and a wireless transceiver (e.g., 266).

[0126] In block 604, the modem processor may generate one or more filters that are executable by the modem processor based on the one or more firewall rules received. In other words, the modem processor may generate one or more filters that, when executed in the modem, will discard (i.e., not transmit to the application processor) the same data packets that the application processor would block or discard when executing the one or more firewall rules, if a data packet is received from the modem. For example, the modem processor may generate filter 524 that is executable by the modem processor. In some embodiments, the modem processor may generate one or more filters based on the one or more firewall rules received that are associated with one or more user plane connections (e.g., EPS bearers, PDU sessions, or another suitable user plane connection). In such embodiments, the firewall rules received from the application processor may be limited to active user plane connections maintained by the modem (i.e., sources or bearers of data packets), and thus the generated filters will be limited to the same user plane connections. The means for performing the functions of the operations in block 604 may include a modem processor (e.g., 212, 252, 404) executing a filtering module 412.

[0127] In block 606, the modem processor may discard received data packets that meet the blocking criteria of the one or more filters generated. In other words, when a data packet is received that meets or meets one or more of the filters generated in block 604, the data packet will not receive further processing and will not be passed to the application processor. In this way, there is no need to initiate an application processor to execute firewall rules on the data packet and then block or discard the data packet. The means for performing the functions of the operations in block 604 may include a modem processor (e.g., 212, 252, 404) executing the packet handling module 414.

[0128] Figure 6B is a process flow diagram illustrating operations 600b that may be performed by a modem processor of a modem as part of method 600a according to various embodiments. Figures 1A to 6B , the operations of method 600a may be performed by a processor (such as processor 210, 212, 214, 216, 218, 252, 260, 404) of a device (such as UE 120a-120e, 200, 320, 400, 800). The processor may be a modem processor or a processor coupled to a modem or controlling a modem, and is therefore generally referred to as a "modem processor".

[0129] In block 602, the modem processor may receive from an application processor one or more firewall rules for use by the application processor to perform firewall operations on received data packets, as described with respect to similarly numbered blocks in method 600a.

[0130] In block 610, the modem processor may parse each firewall rule to identify firewall parameters and blocking actions applicable to the firewall rule. The operations in block 610 may include identifying parameters in the firewall rule information that define data packet criteria for blocking, and any actions that should be performed on data packets that match these parameters. The components for performing the functions of the operations in block 610 may include a modem processor (e.g., 212, 252, 404) executing the filter module 412.

[0131] In block 612, the modem processor may generate a corresponding filter executable by the modem processor that includes filtering criteria consistent with the identified firewall parameters. For example, in block 612, the modem processor may generate a filter based on the firewall rule information parameters identified in block 610 and associate an appropriate filtering action (e.g., drop the packet) based on any actions that should be performed identified in block 610. The means for performing the functions of the operations in block 612 may include a modem processor (e.g., 212, 252, 404) executing the filter module 412.

[0132] In block 606, the modem processor may discard received data packets that meet the blocking criteria of the generated one or more filters, as described with respect to similarly numbered blocks in method 600a.

[0133] Figure 7 is a process flow diagram illustrating a method 700 performed by an application processor of a device according to various embodiments. Figures 1A to 7The operations of method 700 may be performed by a processor (such as processor 210, 214, 216, 218, 260, 424) of a device (such as UE 120a-120e, 200, 320, 400, 800). The processor may be an application processor or another processor configured to perform the operations of an application processor, and is therefore generally referred to as an "application processor".

[0134] In block 702, an application processor may provide information related to one or more firewall rules to a connected modem, and provide the information in a configuration that will enable the modem to drop or block data packets that meet filtering criteria consistent with the one or more firewall rules. In some embodiments, the application processor may transmit to the modem all firewall rules implemented by the application processor. In some embodiments, the application processor may transmit to the modem only those firewall rules that are applicable to data sources handled by the modem, such as one or more user plane connections maintained by the modem (e.g., EPS bearers, PDU sessions, or another suitable user plane connection). The means for performing the functions of the operations in block 702 may include an application processor (e.g., 210, 214, 216, 218, 260, 424) that executes the firewall rules module 430.

[0135] In some embodiments, the application processor may generate one or more filters that can be executed by the modem based on the one or more firewall rules in optional block 704, rather than providing firewall rules to the modem. In optional block 704, the application processor (rather than the modem processor) generates one or more filters including filtering criteria consistent with the one or more firewall rules. In some embodiments, the application processor may generate the one or more filters with filtering criteria consistent with the firewall parameters of the one or more firewall rules. In some embodiments, the application processor may generate one or more filters only for those firewall rules that are applicable to data sources handled by the modem, such as one or more user plane connections maintained by the modem (e.g., EPS bearers, PDU sessions, or another suitable user plane connection). The means for performing the functions of the operations in optional block 704 may include an application processor (e.g., 210, 214, 216, 218, 260, 424) executing the filtering module 434.

[0136] In optional block 706, the application processor may communicate the generated filter to the modem. Means for performing the functions of the operations in optional block 706 may include an application processor (eg, 210, 214, 216, 218, 260, 424) executing the filter module 434.

[0137] Figure 8 is a block diagram of components of a UE 800 suitable for use with various embodiments. Figures 1A to 8 , various embodiments may be implemented on a variety of UEs 800 (e.g., UEs 120a-120e, 200, 320, 402, 404), examples of which are described in Figure 8 800 is illustrated in the form of a smart phone. The UE 800 may include a first SOC 202 (e.g., a SOC-CPU) coupled to a second SOC 204 (e.g., a SOC with 5G capabilities). The first SOC 202 and the second SOC 204 may be coupled to an internal memory 816, a display 812 and may be coupled to a speaker 814. Additionally, the UE 800 may include an antenna 804 for transmitting and receiving electromagnetic radiation, which may be connected to a wireless transceiver 266, which is coupled to one or more processors in the first SOC 202 and / or the second SOC 204. The UE 800 may include a menu selection button or rocker switch 820 for receiving user input. The UE 800 may include a sound coding / decoding (CODEC) circuit 810, which digitizes the sound received from the microphone into data packets suitable for wireless transmission, and decodes the received sound data packets to generate an analog signal provided to the speaker to generate sound. One or more of the processors in the first SOC 202 and the second SOC 204 , the wireless transceiver 266 , and the CODEC 810 may include a digital signal processor (DSP) circuit (not separately shown).

[0138] Fig. 9 is a component block diagram of a network device suitable for use with various embodiments. Such a network device (e.g., network devices 110a-110d, 350) may include at least Fig. 9 Components illustrated in . Figures 1A to 9, the network device 900 may generally include a processor 901 coupled to a volatile memory 902 and a large capacity non-volatile memory (such as a disk drive 908). The network device 900 may also include a peripheral memory access device 906 coupled to the processor 901, such as a floppy disk drive, a compact disc (CD), or a digital video disc (DVD) drive. The network device 900 may also include a network access port 904 (or interface) coupled to the processor 901 for establishing a data connection with a network (such as the Internet or a local area network coupled to other system computers and servers). The network device 900 may include one or more antennas 907 for transmitting and receiving electromagnetic radiation, which may be connected to a wireless communication link. The network device 900 may include additional access ports for coupling to peripheral devices, external memory, or other devices, such as USB, Firewire, Thunderbolt, etc.

[0139] The processors of UE 800 and network device 900 may be any programmable microprocessor, microcomputer, or one or more multi-processor chips that may be configured by software instructions (applications) to perform a variety of functions including some of the specific implementations described below. In some wireless devices, multiple processors may be provided, such as one processor dedicated to wireless communication functions within SOC 204 and one processor dedicated to running other applications within SOC 202. Software applications may be stored in memory 816, 902, which are then accessed and loaded into the processor. The processor may include an internal memory sufficient to store application software instructions.

[0140] The various embodiments illustrated and described are provided merely as examples of various features of the claims. However, the features shown and described with respect to any given embodiment are not necessarily limited to the associated embodiment, and may be used or combined with other embodiments shown and described. In addition, the claims are not intended to be limited to any one example embodiment. For example, one or more of the methods and operations disclosed herein may replace or be combined with one or more of the methods and operations disclosed herein.

[0141] Specific implementations are described in the following paragraphs. Although some of the following specific implementations are described in terms of example methods, other example implementations may include: the example methods discussed in the following paragraphs implemented by a modem processor or application processor, the modem processor or application processor including a modem processor or application processor configured with processor-executable instructions to perform the operations of the methods of the following specific implementations; the example methods discussed in the following paragraphs implemented by a modem processor or application processor including components for performing the functions of the methods of the following specific implementations; and the example methods discussed in the following paragraphs may be implemented on a non-transitory processor-readable storage medium having processor-executable instructions stored thereon, the processor-executable instructions being configured to cause the modem processor or application processor to perform the operations of the methods of the following specific implementations.

[0142] Embodiment 1. A method executed by a modem processor of a modem, the method comprising: receiving one or more firewall rules from an application processor for use by the application processor to perform firewall operations on received data packets; generating one or more filters executable by the modem processor based on the received one or more firewall rules; and discarding received data packets that meet the blocking criteria of the generated one or more filters.

[0143] Embodiment 2. A method according to embodiment 1, wherein generating one or more filters executable by the modem processor based on one or more received firewall rules includes: generating one or more filters based on one or more received firewall rules associated with one or more user plane connections maintained by the modem.

[0144] Embodiment 3. A method according to any one of Embodiment 1 or Embodiment 2, wherein generating one or more filters executable by the modem processor based on the received one or more firewall rules includes: parsing each firewall rule to identify firewall parameters and blocking operations applicable to the firewall rule; and generating corresponding filters executable by the modem processor, the corresponding filters including filtering criteria consistent with the identified firewall parameters.

[0145] Embodiment 4. The method of any one of embodiments 1 to 3, wherein receiving one or more firewall rules from an application processor comprises: receiving firewall rules from the application processor that apply only to user plane connections maintained by the modem.

[0146] Embodiment 5. A method performed by an application processor, the method comprising: providing information related to one or more firewall rules to a modem, the information being configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules.

[0147] Embodiment 6. The method of embodiment 5, wherein providing information related to one or more firewall rules to a modem comprises transmitting to the modem all firewall rules configured for use by the application processor.

[0148] Embodiment 7. The method of Embodiment 5, wherein providing information related to one or more firewall rules to a modem comprises transmitting to the modem only firewall rules applicable to one or more user plane connections maintained by the modem.

[0149] Embodiment 8. A method according to embodiment 5, wherein providing information related to one or more firewall rules to the modem includes: generating one or more filters that can be executed by the modem based on the one or more firewall rules, wherein the information is configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules, and the generated one or more filters include filtering criteria consistent with the one or more firewall rules.

[0150] Embodiment 9. The method of embodiment 8, wherein generating one or more filters executable by the modem based on one or more firewall rules comprises generating the one or more filters having filtering criteria consistent with firewall parameters of the one or more firewall rules.

[0151] As used in this application, the terms "component", "module", "system", etc. are intended to include computer-related entities, such as but not limited to hardware, firmware, a combination of hardware and software, software, or software being executed, which are configured to perform specific operations or functions. For example, a component can be, but is not limited to, a process, a processor, an object, an executable, a thread of execution, a program, or a computer running in a processor. By way of example, both an application running on a wireless device and a wireless device can be referred to as a component. One or more components may reside within a process or a thread of execution, and a component may be localized on a processor or core or distributed between two or more processors or cores. In addition, these components may be executed from various non-transitory computer-readable media having various instructions or data structures stored thereon. Each component may communicate via local or remote processes, function or procedure calls, electronic signals, data packets, memory read / write, and other known network, computer, processor, or process-related communication methodologies.

[0152] Several different cellular and mobile communication services and standards are available and are contemplated in the future, all of which can be implemented and benefit from various implementations. Such services and standards include, for example, the Third Generation Partnership Project (3GPP), Long Term Evolution (LTE) system, third generation wireless mobile communication technology (3G), fourth generation wireless mobile communication technology (4G), fifth generation wireless mobile communication technology (5G) and later generation 3GPP technologies, Global System for Mobile Communications (GSM), Universal Mobile Telecommunications System (UMTS), 3GSM, General Packet Radio Service (GPRS), Code Division Multiple Access (CDMA) systems (e.g., cdmaOne, CDMA1020TM), Enhanced Data Rates for GSM Evolution (EDGE), Advanced Mobile Phone System (AMPS), Digital AMPS (IS-136 / TDMA), Evolution Data Optimized (EV-DO), Digital Enhanced Cordless Telecommunications (DECT), Worldwide Interoperability for Microwave Access (WiMAX), Wireless Local Area Network (WLAN), Wi-Fi Protected Access I and II (WPA, WPA2), and Integrated Digital Enhanced Network (iDEN). Each of these technologies involves, for example, the transmission and reception of voice, data, signaling and / or content messages. It should be understood that any reference to terminology and / or technical details related to individual telecommunication standards or technologies is for illustrative purposes only and is not intended to limit the scope of the claims to a particular communication system or technology unless specifically recited in the claim language.

[0153] The foregoing method descriptions and process flow charts are provided only as illustrative examples and are not intended to require or imply that the operations of the various embodiments must be performed in the order given. As will be appreciated by those skilled in the art, the order of operations in the foregoing embodiments may be performed in any order. Words such as "thereafter," "then," "next," etc. are not intended to limit the order of operations; these words are used to guide the reader through the description of the method. In addition, any reference to a claim element in the singular form (e.g., a reference using the article "one," "an," or "the") should not be interpreted as limiting the element to the singular.

[0154] The various exemplary logic blocks, modules, components, circuits, and algorithmic operations described in conjunction with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or a combination of the two. In order to clearly illustrate this interchangeability of hardware and software, various exemplary components, blocks, modules, circuits, and operations have been generally described above in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the entire system. The technician may implement the described functionality in different ways for each specific application, but such implementation decisions should not be interpreted as causing a departure from the scope of the claims.

[0155] The hardware for implementing the various exemplary logic components, logic blocks, modules, and circuits described in conjunction with the embodiments disclosed herein may be implemented or executed with a general purpose processor, digital signal processor (DSP), application specific integrated circuit (ASIC), field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic components, discrete hardware components, or any combination thereof designed to perform the functions described herein. Although a general purpose processor may be a microprocessor, in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of receiver smart objects, for example, a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration. Alternatively, some operations or methods may be performed by circuits specific to a given function.

[0156] In one or more embodiments, the described functions may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored as one or more instructions or codes on a non-transient computer-readable storage medium or a non-transient processor-readable storage medium. The operation of the method or algorithm disclosed herein may be implemented in a processor-executable software module or a processor-executable instruction, which may reside on a non-transient computer-readable or processor-readable storage medium. A non-transient computer-readable or processor-readable storage medium may be any storage medium accessible by a computer or processor. By way of example and without limitation, such non-transient computer-readable or processor-readable storage media may include RAM, ROM, EEPROM, FLASH memory, CD-ROM or other optical disk storage device, magnetic disk storage device or other magnetic storage smart object, or any other medium that can be used to store the required program code in the form of an instruction or data structure and can be accessed by a computer. Disks and optical disks as used herein include compact discs (CDs), laser discs, optical disks, digital versatile discs (DVDs), floppy disks, and blue discs, wherein disks generally reproduce data magnetically, and optical discs reproduce data optically with lasers. The above combinations are also included within the scope of non-transitory computer-readable and processor-readable media. Additionally, the operations of a method or algorithm may reside as one or any combination or set of codes and / or instructions on a non-transitory processor-readable storage medium and / or computer-readable storage medium, which may be incorporated into a computer program product.

[0157] The above description of the disclosed embodiments is provided to enable any person skilled in the art to make or use the claims. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be applied to other embodiments without departing from the scope of the claims. Thus, the present disclosure is not intended to be limited to the embodiments shown herein, but should be accorded the broadest scope consistent with the following claims and the principles and novel features disclosed herein.

Claims

1. A modem, comprising: A modem processor, the modem processor being configured to: receiving, from an application processor, one or more firewall rules used by the application processor to perform firewall operations on received data packets; generating one or more filters executable by the modem processor based on the received one or more firewall rules; as well as Received data packets that meet blocking criteria of the generated one or more filters are discarded.

2. The modem of claim 1 , wherein generating one or more filters executable by the modem processor based on the received one or more firewall rules comprises: One or more filters are generated based on the received one or more firewall rules associated with one or more user plane connections maintained by the modem.

3. The modem of claim 1 , wherein generating one or more filters executable by the modem processor based on the received one or more firewall rules comprises: parsing each firewall rule to identify firewall parameters and blocking actions applicable to the firewall rule; as well as A corresponding filter executable by the modem processor is generated, the corresponding filter including filtering criteria consistent with the identified firewall parameters.

4. The modem of claim 1 , wherein receiving one or more firewall rules from an application processor comprises: Firewall rules are received from the application processor that apply only to user plane connections maintained by the modem.

5. A method performed by a modem processor of a modem, the method comprising: receiving, from an application processor, one or more firewall rules used by the application processor to perform firewall operations on received data packets; generating one or more filters executable by the modem processor based on the received one or more firewall rules; as well as Received data packets that meet blocking criteria of the generated one or more filters are discarded.

6. The method of claim 5, wherein generating one or more filters executable by the modem processor based on the received one or more firewall rules comprises: One or more filters are generated based on the received one or more firewall rules associated with one or more user plane connections maintained by the modem.

7. The method of claim 5, wherein generating one or more filters executable by the modem processor based on the received one or more firewall rules comprises: parsing each firewall rule to identify firewall parameters and blocking actions applicable to the firewall rule; as well as A corresponding filter executable by the modem processor is generated, the corresponding filter including filtering criteria consistent with the identified firewall parameters.

8. The method of claim 5, wherein receiving one or more firewall rules from an application processor comprises: Firewall rules are received from the application processor that apply only to user plane connections maintained by the modem.

9. An application processor, the application processor being configured to: Information related to one or more firewall rules is provided to a modem, the information being configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules.

10. The application processor of claim 9, wherein providing information related to one or more firewall rules to the modem comprises: All firewall rules configured for use by the application processor are communicated to the modem.

11. The application processor of claim 9, wherein providing information related to one or more firewall rules to the modem comprises: Only firewall rules applicable to one or more user plane connections maintained by the modem are communicated to the modem.

12. The application processor of claim 9, wherein providing information related to one or more firewall rules to the modem comprises: generating one or more filters executable by the modem based on the one or more firewall rules, wherein the information is configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules, and the generated one or more filters include filtering criteria consistent with the one or more firewall rules.

13. The application processor of claim 12, wherein generating one or more filters executable by the modem based on one or more firewall rules comprises: The one or more filters are generated having filtering criteria consistent with the firewall parameters of the one or more firewall rules.

14. A method performed by an application processor, the method comprising: Information related to one or more firewall rules is provided to a modem, the information being configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules.

15. The method of claim 14, wherein providing information related to one or more firewall rules to the modem comprises: All firewall rules configured for use by the application processor are communicated to the modem.

16. The method of claim 14, wherein providing information related to one or more firewall rules to the modem comprises: Only firewall rules applicable to one or more user plane connections maintained by the modem are communicated to the modem.

17. The method of claim 14, wherein providing information related to one or more firewall rules to the modem comprises: generating one or more filters executable by the modem based on the one or more firewall rules, wherein the information is configured to enable the modem to block data packets that meet filtering criteria consistent with the one or more firewall rules, and the generated one or more filters include filtering criteria consistent with the one or more firewall rules.

18. The method of claim 17, wherein generating one or more filters executable by the modem based on one or more firewall rules comprises: The one or more filters are generated having filtering criteria consistent with the firewall parameters of the one or more firewall rules.

Images