IP Filter Module for Application Processor Modem Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current wireless communication devices face challenges in protecting modem services from misuse by malware on the application processor, as certain applications are not restricted from accessing modem services, potentially leading to unauthorized access.
Innovation Solution
Implementing an IP filter module in the application processor to identify and discard packets originating from disallowed applications by using application-specific parameters such as destination IP address, operating system access groups, and application identities, ensuring only authorized applications access modem services.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If all applications are allowed to access modem services via IP socket API, then application versatility is improved, but security against malware is worsened
Solution Approach 1:
An IP filter module is introduced as an intermediary component between applications and modem services. This filter module examines outgoing packets from applications and selectively blocks or allows access to modem services based on application identity, thereby mediating between the need for application access and security protection.
Solution Approach 2:
The system performs preliminary identification and classification of applications before they can access modem services. The IP filter module pre-establishes rules and actively identifies application identities, evaluating whether each application is authorized to access modem services before allowing the connection, rather than reacting after unauthorized access occurs.
2Reliability
If IP filtering is implemented to block unauthorized applications, then security is improved, but device complexity is worsened
Solution Approach 1:
The IP filter module leverages existing multi-functional components within the application processor, such as the packet processor and operating system networking stack, to perform filtering functions. By reusing existing infrastructure for multiple purposes (network processing plus security filtering), the system avoids adding significant complexity while achieving security improvements.
3Reliability
If packet filtering is performed at application processor, then unauthorized access is prevented, but processing overhead is increased
Solution Approach 1:
The IP filter module performs partial filtering by focusing only on packets destined for modem services rather than examining all network traffic. This selective approach reduces processing overhead compared to comprehensive packet inspection, as the filter only activates for relevant traffic flows to the modem.
Data Source
Figure 1~2
Figure 3~5
Figure 6~7
AI summary
An application processor circuit comprises an interface circuit configured to communicate with a separate modem device, a user application module configured to execute one or more user-installed applications, and a core application module configured to execute one or more core applications and to access one or more modem services on the modem device, using the interface circuit and an IP socket application protocol interface (API), wherein packets sent to the modem device for accessing the one or more modem services include a destination IP address corresponding to the modem device. The application processor circuit further comprises an IP filter module configured to identify and discard outbound packets that include a destination IP address corresponding to the modem device and that originate from any of one or more disallowed applications in the application processor, without sending the identified packets to the modem device.