Dynamic migration of session data between firewalls to facilitate low-latency session continuity

A method to facilitate session continuity for latency-sensitive communications in a communication system in which a user-plane function (UPF) serves a plurality of user equipment devices (UEs) and connects with a transport network through a firewall system including a plurality of firewalls, the method comprising:

• for each of the UEs, detecting by the firewall system that the UE engages in signaling to set up a respective transport-layer session via a first firewall of the plurality, and, responsive to the detecting, storing at the first firewall a record of the transport-layer session for access-control use by the first firewall;
• for each UE of a proper subset of the UEs that is a type of device that would engage in latency-sensitive communication, copying by the firewall system, from the first firewall to a centralized data store, the record of the UE's respective transport-layer session;
• and
• thereafter to facilitate switching of firewall service from the first firewall to a second firewall of the plurality, copying by the firewall system, from the centralized data store to the second firewall, the record of the transport-layer session respectively of each UE of the proper subset.

A user-plane function (UPF) comprising:

• at least one network communication interface;
• at least one processor;
• at least one non-transitory data storage;
• and
• program instructions stored in the at least one non-transitory data storage and executable by the at least one processor to carry out operations for facilitating session continuity in a communication system in which the UPF serves a plurality of user equipment devices (UEs) and connects with a transport network through a firewall system including a plurality of firewalls, the UPF being configured by default to communicate with the transport network through a first firewall of the plurality, the operations including:
• for each of the UEs, detecting that the UE engages in signaling to set up a respective transport-layer session via the first firewall, wherein the first firewall stores a record of the transport-layer session for access-control use by the first firewall,
• upon setup of the transport-layer session respectively for each UE of a proper subset of the UEs, determining that the UE is a type of device that would engage in latency-sensitive communication, and, responsive to the determining, causing the first firewall to write the record of the UE's respective transport-layer session to a centralized data store accessible to a second firewall of the plurality, and
• thereafter switching the UPF to communicate with the transport network through the second firewall instead of the first firewall, and causing the second firewall to obtain from the centralized data store the record of the respective transport-layer session of each UE of the proper subset, for access-control use by the second firewall.