# US 12,225,379 B2 · User plane security in split RAN architectures > Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt - Number: US 12,225,379 B2 - Document ID: US12225379B2 - Status: Granted - Kind: B2 - Application number: 17/607,312 - Filed: 2020-05-04 - Published: 2022-06-30 - Granted: 2025-02-11 - Earliest claimed: 2019-05-03 - Assignees: Telefonaktiebolaget LM Ericsson (publ) - Applicants: Telefonaktiebolaget LM Ericsson (publ) - Inventors: Angelo Centonza; Maximilian Popescu; Ioanna Pappa; Thomas Walldeen; Martin Israelsson; Alexander Vesely - Web page: https://patentgrep.com/patent/US12225379B2 ## CPC - H04L 63/166: {at the transport layer} - H04W 12/088: using filters or firewalls - H04L 12/4633: {Interconnection of networks using encapsulation techniques, e.g. tunneling} - H04L 63/0236: {Filtering by address, protocol, port number or service, e.g. IP-address or URL} - H04L 63/164: {at the network layer} - H04W 12/033: of the user plane, e.g. user's traffic - H04W 76/12: Setup of transport tunnels - H04W 76/15: Setup of multiple wireless link connections - H04W 92/20: between access points - H04W 92/24: between backbone network devices - H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M) - H04W: WIRELESS COMMUNICATION NETWORKS (broadcast communication H04H; communication systems using wireless links for non-selective communication, e.g. wireless extensions H04M1/72) ## Abstract A network node (700) of a radio access network (RAN) of a wireless communication network (10) provides user plane security by establishing a secure tunnel between first and second tunnel endpoints (160, 180, 370, 195, 220, 230) that will handle respective protocol layers of a same protocol stack for a Data Radio Bearer (DRB) (330, 340, 350, 360) that is dedicated to user plane traffic and has yet to be established. Establishing the secure tunnel comprises exchanging an inner Internet Protocol (IP) address and an outer IP address of each of the endpoints (160, 180, 370, 195, 220, 230) between the endpoints (160, 180, 370, 195, 220, 230). ## Claims ### Claim 1 A method of providing user plane security, performed by a network node of a radio access network (RAN) of a wireless communication network, the method comprising: establishing a secure tunnel between first and second tunnel endpoints that will handle respective protocol layers of a same protocol stack for a Data Radio Bearer (DRB) that is dedicated to user plane traffic and has yet to be established; wherein establishing the secure tunnel comprises exchanging an inner Internet Protocol (IP) address and an outer IP address of each of the endpoints between the endpoints. ### Claim 2 (depends on 1) The method of claim 1, further comprising: hosting the first tunnel endpoint, wherein the second tunnel endpoint is hosted by a further network node; and supporting, along with the further network node, a dual connectivity configuration of a User Equipment (UE) in which one of the network nodes is a master node and the other of the network nodes is a secondary node. ### Claim 3 (depends on 1) The method of claim 1, further comprising hosting the first tunnel endpoint and the second tunnel endpoint. ### Claim 4 (depends on 1) The method of claim 1, wherein exchanging the inner IP address and the outer IP address of each of the endpoints between the endpoints comprises exchanging the inner and outer IP addresses via a Central Unit Control Plane (CU-CP). ### Claim 5 (depends on 1) The method of claim 1, wherein one of the endpoints is a Central Unit User Plane (CU-UP). ### Claim 6 (depends on 1) The method of claim 1, wherein one of the endpoints is a Distributed Unit (DU). ### Claim 7 (depends on 1) The method of claim 1, further comprising using the secure tunnel to establish the DRB for the user plane traffic. ### Claim 8 (depends on 1) The method of claim 1, further comprising establishing, over the secure tunnel, a further tunnel from the network node to a core network supporting the RAN. ### Claim 9 (depends on 1) The method of claim 1, wherein one of the endpoints will handle a Packet Data Convergence Protocol (PDCP) layer for the DRB and the other of the endpoints will handle a Radio Link Control (RLC) layer for the DRB. ### Claim 10 (depends on 1) The method of claim 1, wherein exchanging the inner IP address and the outer IP address of each of the endpoints between the endpoints comprises exchanging the inner and outer IP address of at least one of the endpoints during setup of an E1 interface. ### Claim 11 (depends on 1) The method of claim 1, wherein exchanging the inner IP address and the outer IP address of each of the endpoints between the endpoints comprises exchanging the inner and outer IP address of at least one of the endpoints during setup of an X2 interface or during setup of an Xn interface. ### Claim 12 (depends on 1) The method of claim 1, wherein exchanging the inner IP address and the outer IP address of each of the endpoints between the endpoints comprises exchanging the inner and outer IP address of one of the endpoints during setup of an F1 interface. ### Claim 13 A network node of a radio access network (RAN) of a wireless communication network, the network node comprising: processing circuitry and a memory, the memory containing instructions executable by the processing circuitry, whereby the network node is configured to establish a secure tunnel between first and second tunnel endpoints that will handle respective protocol layers of a same protocol stack for a Data Radio Bearer (DRB) that is dedicated to user plane traffic and has yet to be established; wherein to establish the secure tunnel, the network node is configured to exchange an inner Internet Protocol (IP) address and an outer IP address of each of the endpoints between the endpoints. ### Claim 14 (depends on 13) The network node of claim 13, wherein the network node is further configured to: host the first tunnel endpoint, wherein the second tunnel endpoint is hosted by a further network node; and support, along with the further network node, a dual connectivity configuration of a User Equipment (UE) in which one of the network nodes is a master node and the other of the network nodes is a secondary node. ### Claim 15 (depends on 13) The network node of claim 13, wherein the network node is further configured to host the first tunnel endpoint and the second tunnel endpoint. ### Claim 16 (depends on 13) The network node of claim 13, wherein to exchange the inner IP address and the outer IP address of each of the endpoints between the endpoints, the network node is configured to exchange the inner and outer IP addresses via a Central Unit Control Plane (CU-CP). ### Claim 17 (depends on 13) The network node of claim 13, wherein one of the endpoints is a Central Unit User Plane (CU-UP). ### Claim 18 (depends on 13) The network node of claim 13, wherein one of the endpoints is a Distributed Unit (DU). ### Claim 19 (depends on 13) The network node of claim 13, wherein the network node is further configured to use the secure tunnel to establish the DRB for the user plane traffic. ### Claim 20 (depends on 13) The network node of claim 13, wherein the network node is further configured to establish, over the secure tunnel, a further tunnel from the network node to a core network supporting the RAN. ### Claim 21 (depends on 13) The network node of claim 13, wherein one of the endpoints will handle a Packet Data Convergence Protocol (PDCP) layer for the DRB and the other of the endpoints will handle a Radio Link Control (RLC) layer for the DRB. ### Claim 22 (depends on 13) The network node of claim 13, wherein to exchange the inner IP address and the outer IP address of each of the endpoints between the endpoints the network node is configured to exchange the inner and outer IP address of at least one of the endpoints during setup of an E1 interface. ### Claim 23 (depends on 13) The network node of claim 13, wherein to exchange the inner IP address and the outer IP address of each of the endpoints between the endpoints the network node is configured to exchange the inner and outer IP address of at least one of the endpoints during setup of an X2 interface or during setup of an Xn interface. ### Claim 24 (depends on 13) The network node of claim 13, wherein to exchange the inner IP address and the outer IP address of each of the endpoints between the endpoints the network node is configured to exchange the inner and outer IP address of one of the endpoints during setup of an F1 interface. ### Claim 25 A non-transitory computer readable medium storing a computer program product for controlling a programmable network node, the computer program product comprising software instructions that, when run on the programmable network node, cause the programmable network node to: establish a secure tunnel between first and second tunnel endpoints that will handle respective protocol layers of a same protocol stack for a Data Radio Bearer (DRB) that is dedicated to user plane traffic and has yet to be established; wherein to establish the secure tunnel, the network node is configured to exchange an inner Internet Protocol (IP) address and an outer IP address of each of the endpoints between the endpoints.