Method for detecting fake base stations by UE during handover

Abstract

Systems, devices, and techniques for handover and false base station detection in a wireless communication network are described. The techniques performed by a user equipment (UE) include receiving a handover command from a source base station of a wireless network to indicate a handover to a target base station for communicating in the wireless network; receiving information from the target base station; determining whether the target base station is a legitimate base station of the wireless network based on the information from the target base station and the handover information included in the handover command; and performing the handover based on the handover command and the determination that the target base station is a legitimate base station.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This disclosure claims the benefit of priority to U.S. Provisional Patent Application No. 62 / 862,521, entitled “METHODS OF DETECTING FAKE BASESTATION BY UE DURING HANDOVER,” filed on June 17, 2019. The entirety of the above-described patent application is incorporated herein by reference. Technical Field

[0003] The present disclosure relates generally to wireless communication systems. Background Art

[0004] Base stations, such as nodes of a radio access network (RAN), can communicate wirelessly with wireless devices, such as user equipment (UE). Downlink (DL) transmissions refer to communications from a base station to a wireless device. Uplink (UL) transmissions refer to communications from a wireless device to another device, such as a base station. A base station can transmit control signaling in order to control wireless devices operating within its network. Summary of the invention

[0005] Systems, devices, and techniques for handover and false base station detection in a wireless communication network are described. The techniques performed by a user equipment (UE) include receiving a handover command from a source base station of a wireless network to indicate a handover to a target base station for communicating in the wireless network; receiving information from the target base station; determining whether the target base station is a legitimate base station of the wireless network based on the information from the target base station and the handover information included in the handover command; and performing the handover based on the handover command and the determination that the target base station is a legitimate base station. Other specific implementations include corresponding systems, apparatus, communication processors, and computer programs for performing the actions of the method defined by instructions encoded on a computer-readable storage device.

[0006] These and other implementations may include one or more of the following features. The handover information may include a radio network temporary identifier (RNTI). In some implementations, the RNTI is a temporary cell RNTI. Receiving the information from the target base station may include receiving a message via a physical downlink control channel (PDCCH). In some implementations, the message schedules the reception of a system information block (such as a system information block of type x (SIBx) from the target base station), and determining whether the target base station is a legitimate base station may include determining whether at least a portion of the message received via the PDCCH is scrambled based on the RNTI. Receiving the message via the PDCCH may include receiving a PDCCH scheduled by a legitimate base station in a common search space using the RNTI. Receiving the message via the PDCCH may include receiving a PDCCH scheduled by a legitimate base station in a UE-specific search space using the RNTI.

[0007] Specific implementations may include: transmitting a first message of a random access procedure; and receiving a second message of the random access procedure from the target base station. Determining that the target base station is a legitimate base station may include determining whether the RNTI included in the second message matches the RNTI provided in the handover command. Specific implementations may include: receiving a random access response (RAR) message; and ignoring the RAR message based on determining that the RNTI included in the RAR message does not match the RNTI provided in the handover command.

[0008] In some implementations, the handover information specifies a range of radio network temporary identity values. Implementations may include transmitting a first message of a random access procedure; and receiving a second message of the random access procedure from the target base station. Determining that the target base station is a legitimate base station may include determining whether the RNTI included in the second message is within the range of radio network temporary identity values.

[0009] In some implementations, receiving information from the target base station may include receiving a system information block from the target base station, and determining whether the target base station is a legitimate base station may include determining whether the system information block includes a value that matches a value provided by the handover command. In some implementations, determining whether the target base station is a legitimate base station may include receiving a system information block from the target base station at a location provided by the handover command. In some implementations, the handover information includes scheduling information for receiving a physical downlink shared channel (PDSCH) from the target base station.

[0010] The UE may include one or more processors, a transceiver, and a memory storing instructions that, when executed by the one or more processors, cause the one or more processors to perform the operations described herein. In some implementations, one or more communication processors in the UE may include a circuit, such as a transceiver or an interface to a transceiver, configured to communicate with one or more base stations; and one or more processors coupled to the circuit. The one or more processors may be configured to perform a switching process. Further, the base station may include a transceiver; and one or more processors coupled to the transceiver. The one or more processors may be configured to perform a switching and a false base station detection process.

[0011] In some specific implementations, a processor for a UE may include a circuit configured to communicate with a base station of a wireless network; and a circuit configured to perform operations. These operations may include receiving a handover command from a source base station of the wireless network to indicate a handover to a target base station communicating in the wireless network; receiving information from the target base station; determining whether the target base station is a legitimate base station of the wireless network based on the information from the target base station and the handover information included in the handover command; and performing the handover based on the handover command and determining that the target base station is a legitimate base station.

[0012] The details of one or more implementations are set forth in the following drawings and detailed description. Other features and advantages will be apparent from the detailed description and drawings, and from the claims. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 An example of a wireless communication system is illustrated.

[0014] Figure 2 An example of a handover procedure involving authentication of a target base station is shown.

[0015] Figure 3 Another example of a handover procedure involving authentication of a target base station is shown.

[0016] Figure 4 An example of infrastructure equipment is shown.

[0017] Figure 5 Examples of platforms or devices are shown.

[0018] Figure 6 Exemplary components of baseband circuitry and radio front-end circuitry are illustrated.

[0019] Figure 7 Exemplary components of a cellular communications circuit are shown.

[0020] Figure 8 Example protocol functions that may be implemented in a wireless communication system are shown.

[0021] Fig. 9 Another example of a handover and fake base station detection process is shown.

[0022] Like reference symbols in the various drawings indicate like elements. DETAILED DESCRIPTION

[0023] Figure 1 An example of a wireless communication system 100 is illustrated. For convenience and not limitation, the exemplary system 100 is described in the context of LTE and 5G NR communication standards defined by the 3rd Generation Partnership Project (3GPP) technical specifications. However, other types of communication standards are possible.

[0024] System 100 includes UE 101a and UE 101b (collectively referred to as "UE 101"). In this example, UE 101 is shown as a smart phone (e.g., a handheld touch screen mobile computing device that can connect to one or more cellular networks). In other examples, any of UE 101 may include other mobile or non-mobile computing devices, such as consumer electronic devices, cellular phones, smart phones, feature phones, tablet computers, wearable computer devices, personal digital assistants (PDAs), pagers, wireless handheld devices, desktop computers, laptop computers, in-vehicle infotainment (IVI), in-car entertainment (ICE) devices, head-up display (HUD) devices, on-board diagnostic (OBD) devices, in-vehicle mobile equipment (DME), mobile data terminals (MDTs), electronic engine management systems (EEMS), electronic / engine control units (ECUs), electronic / engine control modules (ECMs), embedded systems, microcontrollers, control modules, engine management systems (EMS), networked or "smart" appliances, machine type communication (MTC) devices, machine-to-machine (M2M) devices, Internet of Things (IoT) devices, or combinations thereof, etc.

[0025] In some implementations, any of the UEs 101 may be an IoT UE, which may include a network access layer designed for low-power IoT applications that utilize short-term UE connections. The IoT UE may utilize technologies such as M2M or MTC to exchange data with an MTC server or device using, for example, a public land mobile network (PLMN), a short-range service (ProSe), a device-to-device (D2D) communication, a sensor network, an IoT network, or a combination thereof. The M2M or MTC data exchange may be a machine-initiated data exchange. The IoT network describes interconnected IoT UEs, which may include uniquely identifiable embedded computing devices (within the Internet infrastructure) with short-lived connections. The IoT UE may execute background applications (e.g., keep-alive messages or status updates) to facilitate connectivity to the IoT network.

[0026] The UE 101 may be configured to be connected (e.g., communicatively coupled) to the RAN 110. The RAN 110 includes one or more RAN nodes 111a and 111b (collectively referred to as “RAN nodes 111”). In some implementations, the RAN 110 may be a next generation RAN (NGRAN), an evolved UMTS terrestrial radio access network (E-UTRAN), or a legacy RAN, such as a UMTS terrestrial radio access network (UTRAN) or a GSM EDGE radio access network (GERAN). As used herein, the term “NG RAN” may refer to the RAN 110 operating in a 5G NR system 100, while the term “E-UTRAN” may refer to the RAN 110 operating in an LTE or 4G system 100.

[0027] In order to connect to the RAN 110, multiple UEs 101 utilize connections (or channels) 103 and 104, respectively, each of which may include a physical communication interface or layer, as described below. In this example, connections 103 and 104 are shown as air interfaces to achieve communication coupling, and may be consistent with cellular communication protocols, such as global system for mobile communications (GSM) protocols, code division multiple access (CDMA) network protocols, push-to-talk (PTT) protocols, cellular PTT (POC) protocols, universal mobile telecommunications system (UMTS) protocols, 3GPP LTE protocols, 5G NR protocols, or combinations thereof, as well as other communication protocols.

[0028] The RAN 110 may include one or more RAN nodes 111a and 111b (collectively referred to as "RAN nodes 111") that enable connections 103 and 104. As used herein, the terms "access node", "access point", etc. may describe equipment that provides radio baseband functions for data or voice connections, or both, between a network and one or more users. These nodes 111 may be referred to as base stations (BS), gNodeBs, gNBs, eNodeBs, eNBs, NodeBs, RAN nodes, road side units (RSUs), etc., and may include ground stations (e.g., terrestrial access points) or satellite stations that provide coverage within a geographic area (e.g., a cell), etc. As used herein, the term "NG RAN node" may refer to a RAN node 111 (e.g., a gNB) operating in a 5G NR system 100, while the term "E-UTRAN node" may refer to a RAN node 111 (e.g., an eNB) operating in an LTE or 4G system 100. In some implementations, the RAN node 111 may be implemented as one or more of a dedicated physical device such as a macrocell base station, or a low power (LP) base station for providing a femtocell, picocell, or other similar cell with a smaller coverage area, smaller user capacity, or higher bandwidth than a macrocell.

[0029] The RAN node 111 and the UE 101 may be configured for multiple-input and multiple-output (MIMO) communications, including single beam or multi-beam communications. For example, the UE 101 may receive transmissions from one RAN node 111 at a time, or simultaneously from multiple RAN nodes 111. The RAN node 111 and the UE 101 may use beamforming for UL, DL, or both. For example, one or more RAN nodes 111 may transmit (Tx) beams to the UE 101, and the UE 101 may simultaneously receive data via one or more receive (Rx) beams. In some implementations, each of the RAN nodes 111 may be configured as a transmission and reception point (TRP). The RAN 110 may provide signaling for configuring beamforming, such as by providing transmission configuration indicator (TCI) state configuration information.

[0030] Any of the RAN nodes 111 may serve as a termination point for the air interface protocol and may be the first point of contact for the UE 101. In some implementations, any of the RAN nodes 111 may perform various logical functions of the RAN 110, including but not limited to functions of a radio network controller (RNC), such as radio bearer management, uplink and downlink dynamic radio resource management and data packet scheduling, and mobility management.

[0031] In some implementations, multiple UEs 101 may be configured to communicate with each other or any of RAN nodes 111 over a multi-carrier communication channel using orthogonal frequency division multiplexing (OFDM) communication signals according to various communication techniques, such as, but not limited to, OFDMA communication techniques (e.g., for downlink communications) or SC-FDMA communication techniques (e.g., for uplink communications), although the scope of the techniques described herein is not limited in this respect. The OFDM signal may include multiple orthogonal subcarriers.

[0032] In some specific implementations, a downlink resource grid may be used for downlink transmissions from any of the RAN nodes 111 to the UE 101, while uplink transmissions may utilize similar techniques. The grid may be a frequency grid or a time-frequency grid, which is a physical resource in the downlink in each time slot. For OFDM systems, such a time-frequency plane representation is a common practice, which makes wireless resource allocation intuitive. Each column and each row of the resource grid corresponds to an OFDM symbol and an OFDM subcarrier, respectively. The duration of the resource grid in the time domain corresponds to a time slot in a radio frame. The smallest time-frequency unit in the resource grid may be represented as a resource element. Each resource grid may include multiple resource blocks, which describe the mapping of certain physical channels to resource elements. A resource block (RB) may include a collection of resource elements; in the frequency domain, this may represent the minimum amount of resources that can currently be allocated. Such resource blocks may be used to transmit physical downlink channels and uplink channels. In some cases, an RB may be referred to as a physical resource block (PRB).

[0033] The RAN node 111 may transmit to the UE 101 via one or more DL channels. Various examples of DL communication channels include a physical broadcast channel (PBCH), a physical downlink control channel (PDCCH), and a physical downlink shared channel (PDSCH). The PDSCH may carry user data and higher layer signaling to multiple UEs 101. Other types of downlink channels are possible. The UE 101 may transmit to the RAN node 111 via one or more UL channels. Various examples of UL communication channels include a physical uplink shared channel (PUSCH), a physical uplink control channel (PUCCH), and a physical random access channel (PRACH). Other types of uplink channels are possible. Devices such as the RAN node 111 and the UE 101 may transmit reference signals. Examples of reference signals include synchronization signal blocks (SSBs), sounding reference signals (SRSs), channel state information reference signals (CSI-RSs), demodulation reference signals (DMRSs or DM-RSs), and phase tracking reference signals (PTRSs). Other types of reference signals are possible. In some implementations, UE 101 may monitor SI transmitted by RAN node 111 via one or more system information (SI) blocks (SIBs).

[0034] A channel such as a PDCCH may convey different types of scheduling information for one or more downlink channels and uplink channels. Scheduling information may include downlink resource scheduling, uplink power control instructions, uplink resource grants, and indications for paging or system information. The RAN node 111 may transmit one or more downlink control information (DCI) messages on the PDCCH to provide scheduling information, such as the allocation of one or more PRBs. In some implementations, the DCI message transmits control information, such as a request for aperiodic CQI reporting, a UL power control command for a channel, and a notification of a slot format for a group of UEs 101. Downlink scheduling (e.g., allocating control and shared channel resource blocks to UE 101b within a cell) may be performed at any of the RAN nodes 111 based on channel quality information fed back from any of the UEs 101. Downlink resource allocation information may be sent on a PDCCH for (e.g., allocated to) a UE 101 or each UE in a group of UEs. In some implementations, the PDCCH carries information about transport formats and resource allocations related to a PDSCH channel, among other information. The PDCCH may also inform the UE 101 about transport format, resource allocation, and hybrid automatic repeat request (HARQ) information for providing HARQ feedback on uplink channels based on PDSCH reception.

[0035] Downlink and uplink transmissions may occur in one or more component carriers (CCs). One or more bandwidth part (BWP) configurations may be configured for each component carrier. In some implementations, the DL BWP includes at least one control resource set (CORESET). In some implementations, a CORESET includes one or more PRBs in the frequency domain and one or more OFDM symbols in the time domain. In some implementations, a channel such as a PDCCH may be transmitted via one or more CORESETs, where each CORESET corresponds to a set of time-frequency resources. CORESET information may be provided to the UE 101, and the UE 101 may monitor the time-frequency resources associated with one or more CORESETs to receive PDCCH transmissions.

[0036] In some implementations, the PDSCH carries user data and higher layer signaling to the UE 101. Typically, DL scheduling (allocation of control and shared channel resource blocks to the UE 101 within the cell) may be performed at any of the RAN nodes 111 based on channel quality information fed back from any of the UEs 101. Downlink resource allocation information may be sent on a PDCCH for (e.g., allocated to) each of the UEs 101. The PDCCH may use control channel elements (CCEs) to transmit control information (e.g., DCI), and a group of CCEs may be referred to as a "control region." A control channel is formed by an aggregation of one or more CCEs, where different coding rates for the control channel are achieved by aggregating different numbers of CCEs. The CCEs are numbered from 0 to N. CCE,K -1, where N CCE,K -1 is the number of CCEs in the control region of subframe k. Before being mapped to REs, the PDCCH complex symbols may first be organized into quadruplets, which may then be arranged using a subblock interleaver for rate matching. Each PDCCH may be transmitted using one or more of these CCEs, where each CCE may correspond to nine groups of four physical REs referred to as resource element groups (REGs). Depending on the size of the DCI and channel conditions, one or more CCEs may be used to transmit the PDCCH. There may be four or more different PDCCH formats defined with different numbers of CCEs (e.g., aggregation levels, L=1, 2, 4, or 8 in LTE, L=1, 2, 4, 8, or 16 in NR). UE 101 monitors a set of PDCCH candidates on one or more activated serving cells configured according to higher layer signaling for control information (e.g., DCI), where monitoring means attempting to decode each PDCCH (or PDCCH candidate) in the set according to all monitored DCI formats. UE 101 monitors (or attempts to decode) the corresponding PDCCH candidate set in one or more configured monitoring occasions according to the corresponding search space configuration.

[0037] In a NR specific implementation, the UE 101 monitors (or attempts to decode) the corresponding PDCCH candidate set in one or more configured monitoring opportunities in one or more configured CORESETs according to the corresponding search space configuration. A CORESET may include a PRB set with a duration of 1 to 3 OFDM symbols. A CORESET may additionally or alternatively include a PRB in the frequency domain. RBs and time domain symbols. A CORESET may include six REGs numbered in ascending order in a time-first manner, where a REG is equal to one RB during one OFDM symbol. UE 101 may be configured with multiple CORESETs, where each CORESET is associated with a CCE-to-REG mapping. Interleaved and non-interleaved CCE-to-REG mappings are supported in a CORESET. Each REG that carries a PDCCH carries its own DMRS.

[0038] The RAN nodes 111 are configured to communicate with each other using an interface 112. In an example, such as when the system 100 is an LTE system (e.g., when the core network 120 is an evolved packet core (EPC) network), the interface 112 may be an X2 interface 112. The X2 interface may be defined between two or more RAN nodes 111 (e.g., two or more eNBs, etc.) connected to the EPC 120, or between two eNBs connected to the EPC 120, or both. In some implementations, the X2 interface may include an X2 user plane interface (X2-U) and an X2 control plane interface (X2-C). The X2-U may provide a flow control mechanism for user packets transmitted over the X2 interface, and may be used to transmit information about the delivery of user data between eNBs. For example, X2-U may provide specific sequence number information about user data transmitted from the primary eNB to the secondary eNB; information about successful in-sequence delivery of PDCP protocol data units (PDUs) from the secondary eNB to the UE 101 for user data; information about PDCP PDUs that were not delivered to the UE 101; information about the current minimum expected buffer size at the secondary eNB for transmitting user data to the UE; etc. X2-C may provide intra-LTE access mobility functions, including context transfer from a source eNB to a target eNB, or user plane transmission control; load management functions; inter-cell interference coordination functions; etc.

[0039] In some implementations, such as when the system 100 is a 5G NR system (e.g., when the core network 120 is a 5G core network), the interface 112 may be an Xn interface 112. The Xn interface may be defined between two or more RAN nodes 111 (e.g., two or more gNBs, etc.) connected to the 5G core network 120, between a RAN node 111 (e.g., a gNB) and an eNB connected to the 5G core network 120, or between two eNBs connected to the 5G core network 120, or a combination of the above. In some implementations, the Xn interface may include an Xn user plane (Xn-U) interface and an Xn control plane (Xn-C) interface. The Xn-U may provide non-guaranteed delivery of user plane PDUs and support / provide data forwarding and flow control functions. The Xn-C may provide management and error handling functions for managing functions of the Xn-C interface; mobility support for UE 101 in a connected mode (e.g., CM-CONNECTED), including functions for managing UE mobility in a connected mode between one or more RAN nodes 111; and the like. Mobility support may include context transfer from the old (source) serving RAN node 111 to the new (target) serving RAN node 111, and control of the user plane tunnel between the old (source) serving RAN node 111 and the new (target) serving RAN node 111. The protocol stack of Xn-U may include a transport network layer built on an Internet Protocol (IP) transport layer, and a GPRS Tunneling Protocol (GTP-U) layer for carrying user plane PDUs on top of a user datagram protocol (UDP) or IP layer or both. The Xn-C protocol stack may include an application layer signaling protocol (referred to as the Xn Application Protocol (Xn-AP or XnAP)) and a transport network layer built on a stream control transmission protocol (SCTP). SCTP may be on top of the IP layer and may provide guaranteed delivery of application layer messages. In the transport IP layer, point-to-point transport is used to deliver signaling PDUs. In other specific implementations, the Xn-U protocol stack or the Xn-C protocol stack or both may be the same or similar to the user plane and / or control plane protocol stacks shown and described herein.

[0040] RAN 110 is shown as being communicatively coupled to a core network 120 (referred to as "CN 120"). CN 120 includes one or more network elements 122 configured to provide various data and telecommunication services to customers / subscribers (e.g., users of UE 101) connected to CN 120 using RAN 110. Components of CN 120 may be implemented in one physical node or separate physical nodes and may include components for reading and executing instructions from a machine-readable or computer-readable medium (e.g., a non-transitory machine-readable storage medium). In some specific implementations, network function virtualization (NFV) may be used to virtualize some or all of the network node functions described herein using executable instructions stored in one or more computer-readable storage media, as will be described in further detail below. A logical instance of CN 120 may be referred to as a network slice, and a logical instance of a portion of CN 120 may be referred to as a network sub-slice. NFV architecture and infrastructure may be used to virtualize one or more network functions onto physical resources comprising a combination of industry-standard server hardware, storage hardware, or switches (alternatively performed by proprietary hardware). In other words, a NFV system may be used to perform virtual or reconfigurable implementations, or both, of one or more network components or functions.

[0041] The application server 130 may be an element that provides applications that use IP bearer resources with the core network (e.g., UMTS packet service (PS) domain, LTE PS data services, etc.). The application server 130 may also be configured to support one or more communication services for the UE 101 using the CN 120 (e.g., VoIP sessions, PTT sessions, group communication sessions, social network services, etc.). The application server 130 may use the IP communication interface 125 to communicate with one or more network elements 122.

[0042] In some specific implementations, CN 120 may be a 5G core network (referred to as “5GC 120” or “5G core network 120”), and RAN 110 may be connected to CN 120 using a next generation interface 113. In some specific implementations, the next generation interface 113 may be divided into two parts: a next generation user plane (NG-U) interface 114, which carries traffic data between the RAN node 111 and the UPF (user plane function); and an S1 control plane (NG-C) interface 115, which is a signaling interface between the RAN node 111 and the access and mobility management function (AMF).

[0043] In some implementations, the CN 120 may be an EPC (referred to as “EPC 120” or the like), and the RAN 110 may be connected to the CN 120 using an S1 interface 113. In some implementations, the S1 interface 113 may be divided into two parts: an S1 user plane (S1-U) interface 114, which carries traffic data between the RAN node 111 and a serving gateway (S-GW); and an S1-MME interface 115, which is a signaling interface between the RAN node 111 and a mobility management entity (MME).

[0044] In some implementations, some or all of the RAN nodes 111 may be implemented as one or more software entities running on a server computer as part of a virtual network that may be referred to as a cloud RAN (CRAN) and / or a virtual baseband unit pool (vBBUP). The CRAN or vBBUP may implement a RAN functional split, such as a packet data convergence protocol (PDCP) split, where the radio resource control (RRC) and PDCP layers are operated by the CRAN / vBBUP, and other layer 2 (e.g., data link layer) protocol entities are operated by individual RAN nodes 111; a medium access control (MAC) / physical layer (PHY) split, where the RRC, PDCP, MAC, and radio link control (RLC) layers are operated by the CRAN / vBBUP, and the PHY layer is operated by individual RAN nodes 111; or a "lower PHY" split, where the RRC, PDCP, RLC, and MAC layers and the upper portion of the PHY layer are operated by the CRAN / vBBUP, and the lower portion of the PHY layer is operated by individual RAN nodes 111. The virtualization framework allows idle processor cores of the RAN node 111 to execute, for example, other virtualized applications. In some implementations, a single RAN node 111 may represent a single virtualized application using each F1 interface ( Figure 1 ) are connected to the gNB Central Unit (CU). In some implementations, the gNB-DU may include one or more remote radio heads or RFEMs (see, e.g., Figure 4 ), and the gNB-CU may be operated by a server (not shown) located in the RAN 110 or by a server pool in a manner similar to the CRAN / vBBUP. In addition or alternatively, one or more of the RAN nodes 111 may be a next generation eNB (ng-eNB), including a RAN node that provides E-UTRA user plane and control plane protocol terminals to the UE 101 and is connected to a 5G core network (e.g., the core network 120) using a next generation interface.

[0045] In a vehicle-to-everything (V2X) scenario, one or more of the RAN nodes 111 may be or act as an RSU. The term "roadside unit" or "RSU" refers to any traffic infrastructure entity used for V2X communication. The RSU may be implemented in or by a suitable RAN node or a stationary (or relatively stationary) UE, wherein an RSU implemented in or by a UE may be referred to as a "UE-type RSU", an RSU implemented in or by an eNB may be referred to as an "eNB-type RSU", an RSU implemented in or by a gNB may be referred to as a "gNB-type RSU", and so on. In some specific implementations, the RSU is a computing device coupled to a radio frequency circuit located on the road side that provides connectivity support to a passing vehicle UE 101 (vUE 101). The RSU may also include internal data storage circuitry for storing intersection map geometry, traffic statistics, media, and applications or other software for sensing and controlling ongoing vehicle and pedestrian traffic. The RSU may operate on the 5.9 GHz Direct Short Range Communications (DSRC) band to provide extremely low latency communications required for high-speed events, such as collision avoidance, traffic warnings, and the like. In addition or alternatively, the RSU may operate on the cellular V2X band to provide the aforementioned low latency communications as well as other cellular communications services. In addition or alternatively, the RSU may operate as a Wi-Fi hotspot (2.4 GHz band) or provide connectivity to one or more cellular networks to provide uplink and downlink communications, or both. Some or all of the computing device and the RSU's RF circuitry may be packaged in a weather-resistant enclosure suitable for outdoor installation, and may include a network interface controller to provide a wired connection (e.g., Ethernet) to a traffic signal controller or a backhaul network, or both.

[0046] The wireless communication network may provide one or more random access procedures, such as two-step and four-step procedures for UE 101 to initiate communication with a base station (e.g., a gNB or eNB) or for handover to another base station. The random access procedure may be triggered when a PRACH transmission is requested by a higher layer, a PDCCH command, or by a handover command. The random access procedure may use a random access channel (RACH). In some implementations, the four-step random access procedure may include transmission of a random access preamble (Msg1) in the PRACH, a random access response (RAR) message with a PDCCH / PDSCH (Msg2), and, when applicable, a PUSCH transmission of Msg3 scheduled by the RAR UL grant and a PDSCH transmission of Msg4 for contention resolution. In some implementations, the random access preamble for Msg1 may be selected according to 3GPP TS 38.213, clause 8.1. In some implementations, the two-step random access procedure may include a first message referred to as MsgA and a second message referred to as MsgB. In some implementations, MsgA is based on a combined version of Msg1 and Msg3, and MsgB is based on a combined version of Msg2 and Msg4.

[0047] A source base station such as a source gNB may send a handover (HO) command to a UE to cause the UE to perform a handover to a target base station (such as a target gNB). An imposter may attempt to disrupt a network or spoof a real base station of the network. A fake base station may also be referred to as a counterfeit base station or an illegal base station. A real base station may also be referred to as a true base station or a legitimate base station. The UE may be configured to determine whether it is connected to a real or counterfeit base station after receiving a HO command from a source base station, the HO command containing credential information about the real target base station. The handover techniques disclosed herein may be used in various networks, such as networks based on LTE, 5G NR, or both. They may also be applied to eMTC and NB-IoT. Some handover techniques and examples may refer to gNBs, but they may also be applied to eNBs as well as other types of base stations.

[0048] The fake base station can simulate the system information and reference signals of the real base station of the network and monitor the messages sent to or from the UE. The UE can send the measurement result report of the fake base station to the source base station, however, the UE can receive the real switching command for the real base station. In addition, the UE can send a preamble or a contention-free preamble to the real base station, where the preamble is associated with a random access process message such as Msg1. The fake base station can monitor the preamble and can send a fake random access response message, such as Msg2, in response to the preamble. The fake Msg2 may arrive earlier than the real Msg2, which may cause HO failure and / or more power consumption of the UE if it is not ignored when it is determined to be from the fake base station.

[0049] The UE may perform verification techniques to determine whether the target base station is a real base station of the network. When the UE receives the HO command, the UE may perform additional steps to detect the existence of a real base station before synchronization, for example, sending a random access preamble, whether or not it is contention-free, or sending Msg3 for RACH-free switching. If the UE cannot detect the existence of a real target base station within the specified time, there may not be a real target base station. The UE may declare a handover failure, or indicate a handover failure to the source base station. In some specific implementations, the UE may exclude the cell from the measurement result report. In some specific implementations, the UE considers the cell to be prohibited. When the source base station detects the problem, the base station may cancel the HO command and, if possible, request another handover to the next best target base station.

[0050] In some implementations, the UE may monitor system information such as an "other SI" block, referred to as a SIB, of a real base station at a predefined location that is securely provided to the intended UE via a handover command. The x of this SIB is greater than 1. SIBx may be broadcast periodically on a downlink shared channel (DL-SCH), broadcast on demand on DL-SCH, or sent to one or more UEs in a dedicated manner. In some implementations, SIBx may contain a value field that may be provided in a handover command. It is assumed that the fake base station does not have or cannot know the location of the SIBx or value field. If the UE finds SIBx, the UE may determine that it has detected a real base station. In addition, the UE may match the field values ​​in SIBx with the field values ​​provided in the HO command for verification.

[0051] In some implementations, a new target base station specific RNTI (which may be similar to the SI-RNTI) may be provided in the handover command. The UE may monitor for this new RNTI to detect SIBx. The DCI message carried by the PDCCH, which schedules SIBx, may be scrambled with the new RNTI. In some implementations, the PDCCH is scheduled in a common search space by the real target base station using the RNTI securely provided to the UE in the handover command. In some implementations, the PDCCH is scheduled by the real target base station in the UE-specific search space of the real target base station using the RNTI, which is securely provided to the UE in the handover command. In some implementations, the UE-specific search space for locating the PDCCH may be indicated in the handover command. In some implementations, the PDSCH is directly scheduled by the real target base station, and information for receiving the PDSCH is provided in the HO command.

[0052] Figure 2An example of a handover procedure involving verification of a target base station is shown. In this example, the UE may be configured to detect the presence of a real target base station. At 205, the UE employs measurements of a target gNB, which in this example is a fake gNB. At 210, the UE sends a measurement report of the fake gNB to the source gNB. The measurement report may include a physical cell identifier (PCI) of the target gNB and strength measurements. At 215, the source gNB sends a handover request to the real target gNB. The real target gNB may correspond to the PCI indicated by the report, note that the fake gNB may simulate the real target gNB by using its PCI. At 220, the real target gNB sends a response, such as a handover command to the source gNB. The handover command may include a temporary C-RNTI and scheduling information from the SIBx of the real target gNB with a field value of z. At 225, the source gNB forwards the handover command to the UE. At 230, the UE reads the SIBx received from the gNB in ​​a given location and attempts to match the value z contained in the SIBx with the value z contained in the handover command. If the UE finds SIBx, the UE continues to transmit Msg1 including the preamble of the random access procedure. Otherwise, the UE notifies the source gNB of the handover failure.

[0053] At 235, the UE transmits Msg1 for the random access procedure. The Msg1 may be received by both the fake gNB and the real gNB. At 240, the fake gNB sends a Msg2 response to Msg1. In this example, the fake gNB responds to Msg1 before the real gNB. At 245, the UE determines whether the temporary C-RNTI in Msg2 matches the temporary C-RNTI received in the handover command. If the temporary C-RNTI in Msg2 does not match the temporary C-RNTI provided in the HO command, the UE may ignore Msg2. The UE may continue to monitor Msg2. At 250, the real target gNB sends Msg2 to the UE. If the temporary C-RNTI in the Msg2 matches the temporary C-RNTI provided in the HO command, then at 255, the UE may continue with the handover, which may be based on a conventional handover because the actual target gNB has been verified and determined to be legitimate.

[0054] In some implementations, the UE may initiate synchronization with the target base station after receiving the handover command. The UE may send a preamble to start the RACH process. If a contention-free preamble is configured, the UE sends the contention-free preamble provided in the HO command. The fake base station may monitor the preamble and may send a fake Msg2 before the real base station sends the real Msg2. The handover may fail because the UE may not receive the real Msg2 from the real base station.

[0055] In some specific implementations, a contention preamble to be used for the real base station is provided in the handover command, and a temporary C-RNTI to be provided in the real Msg2 is also provided in the HO command. When the UE receives Msg2, the UE determines whether the temporary C-RNTI provided in Msg2 matches the temporary C-RNTI provided in the HO command. If there is a match, the UE has received the real Msg2, i.e., the Msg2 from the real base station. If it does not match, the UE can ignore Msg2 and can monitor another Msg2 message using traditional procedures. In some specific implementations, the target base station allocates a temporary C-RNTI to the UE, prepares a handover command for the temporary C-RNTI, and sends a preamble to the UE.

[0056] In some implementations, when no contention preamble is configured, the real base station can determine whether Msg1 is sent by the intended UE performing the handover or another UE initiating random access. Therefore, the target gNB can provide a range of temporary C-RNTI values ​​that are scheduled to be allocated over time. This range can be refreshed as a sliding window based on a handover failure timer such as T304 (see, for example, 3GPP TS 38.331).

[0057] The temporary C-RNTI, offset value, multiplier value of the offset, and the total number of RNTIs allocated during the time window defined by the new timer or T304 timer may be provided in the handover command. The RNTI range provided in the handover command may be large enough so that during the time window, the RNTI range may be sufficient to allocate a unique temporary C-RNTI to any UE that sends a preamble. The intended UE performing the handover may determine whether the temporary C-RNTI received in Msg2 matches, for example, falls within the range of temporary C-RNTI values ​​received in the handover command. Other UEs that do not perform the handover may follow conventional procedures.

[0058] In some implementations, the real target base station provides some information about the UL grant to be provided in Msg2. For example, a frequency hopping flag (1 bit), an MCS index (4 bits), a CSI request (1 bit) may be provided in the handover command, and the same information may be provided in the UL grant field of the actual Msg2.

[0059] In some implementations, the real target base station provides an encrypted preamble identifier in the subheader of the RAR in Msg2. The legacy UE matches the preamble identifier in Msg2, regardless of whether the Msg2 is intended for the UE. In order to identify the Msg2 from the real base station, the preamble identifier can be encrypted using the target base station key. The UE can use the preamble it sent and the target base station key as input parameters to produce a result. The result can be compared with the preamble identifier of Msg2. If there is a match, the Msg2 is from the real target base station.

[0060] Figure 3 Another example of a handover procedure involving verification of a target base station is shown. In this example, the UE may be configured to detect the presence of a real target base station based on the reception of Msg2. At 305, the UE employs measurements of a target gNB, which in this example is a fake gNB. At 310, the UE sends a measurement report of the fake gNB to the source gNB. The measurement report may include the PCI of the target gNB and the strength measurement results. At 315, the source gNB sends a handover request to the real target gNB. The real target gNB may correspond to the PCI indicated by the measurement report, note that the fake gNB may simulate the real target gNB by using its PCI. At 320, the real target gNB sends a response, such as a handover command to the source gNB. The handover command may include one or more of the following: a temporary C-RNTI (TC-RNTI), a range of TC-RNTI values, scheduling information, and / or other information. At 325, the source gNB forwards the handover command to the UE.

[0061] At 335, the UE transmits Msg1 for the random access procedure. The Msg1 may be received by both the fake gNB and the real gNB. At 340, the fake gNB sends a Msg2 response to Msg1. In this example, the fake gNB responds to Msg1 before the real gNB. At 345, the UE determines whether the temporary C-RNTI in Msg2 matches the range of temporary C-RNTI or TC-RNTI values ​​received in the handover command. If the temporary C-RNTI in Msg2 does match, the UE may ignore Msg2. The UE may continue to monitor Msg2. At 350, the real target gNB transmits Msg2 to the UE. If the temporary C-RNTI in the Msg2 matches the temporary C-RNTI provided in the HO command, then at 355, the UE may continue with the handover, which may be based on a conventional handover because the actual target gNB has been verified and determined to be legitimate.

[0062] Figure 4An example of infrastructure equipment 400 is shown. Infrastructure equipment 400 (or "system 400") can be implemented as a base station, a radio head, a RAN node (such as the RAN node 111 shown and described previously), an application server 130, or any other component or device discussed herein. In other examples, system 400 can be implemented in or by a UE.

[0063] System 400 includes: application circuit 405, baseband circuit 410, one or more radio front end modules (RFEM) 415, memory circuit 420, power management integrated circuit (PMIC) 425, power tee circuit 430, network controller circuit 435, network interface connector 440, satellite positioning circuit 445 and user interface circuit 450. In some implementations, system 400 may include additional elements such as, for example, memory, storage, display, camera, one or more sensors or input / output (I / O) interfaces or combinations thereof. In other examples, the components described with reference to system 400 may be included in more than one device. For example, various circuits may be separately included in more than one device for CRAN, vBBU or other implementations.

[0064] The application circuit 405 may include circuits such as, but not limited to, one or more processors (or processor cores), cache memory, one or more of the following: a low dropout regulator (LDO), an interrupt controller, a serial interface such as SPI, I2C or a general programmable serial interface module, a real-time clock (RTC), a timer-counter including an interval timer and a watchdog timer, a general input / output (I / O or IO), a memory card controller such as a secure digital (SD) multimedia card (MMC), a universal serial bus (USB) interface, a mobile industry processor interface (MIPI) interface, and a joint test access group (JTAG) test access port. The processor (or core) of the application circuit 405 may be coupled to or may include a memory or storage element, and may be configured to execute instructions stored in the memory or storage element to enable various applications or operating systems to run on the system 400. In some implementations, the memory or storage element may include on-chip memory circuitry that may include any suitable volatile or nonvolatile memory, such as DRAM, SRAM, EPROM, EEPROM, flash memory, solid-state memory, or combinations thereof as well as other types of memory.

[0065] The processor of the application circuit 405 may include, for example, one or more processor cores (CPUs), one or more application processors, one or more graphics processing units (GPUs), one or more reduced instruction set computing (RISC) processors, one or more complex instruction set computing (CISC) processors, one or more digital signal processors (DSPs), one or more FPGAs, one or more PLDs, one or more application specific integrated circuits (ASICs), one or more microprocessors or controllers, or a combination thereof, etc. In some specific implementations, the application circuit 405 may include or may be a dedicated processor or controller configured to perform the various techniques described herein. In some specific implementations, the system 400 may not utilize the application circuit 405, and may instead include a dedicated processor or controller to process, for example, IP data received from the EPC or 5GC.

[0066] In some implementations, the application circuit 405 may include one or more hardware accelerators, which may be microprocessors, programmable processing devices, etc. The one or more hardware accelerators may include, for example, computer vision (CV) or deep learning (DL) accelerators or both. In some implementations, the programmable processing device may be: one or more field programmable devices (FPDs), such as field programmable gate arrays (FPGAs), etc.; programmable logic devices (PLDs), such as complex PLDs (CPLDs) or high capacity PLDs (HCPLDs); ASICs, such as structured ASICs; programmable SoCs (PSoCs), or combinations thereof, etc. In such implementations, the circuits of the application circuit 405 may include logic blocks or logic architectures, as well as other interconnected resources that can be programmed to perform various functions such as the processes, methods, functions described herein. In some implementations, the circuitry of application circuit 405 may include a memory unit (e.g., an erasable programmable read-only memory (EPROM), an electrically erasable programmable read-only memory (EEPROM), a flash memory, a static memory (e.g., a static random access memory (SRAM) or an antifuse)) for storing logic blocks, logic structures, data, or other data in a lookup table (LUT) or the like.

[0067] The user interface circuit 450 may include one or more user interfaces designed to enable a user to interact with the system 400 or a peripheral component interface designed to enable a peripheral component to interact with the system 400. The user interface may include, but is not limited to, one or more physical or virtual buttons (e.g., a reset button), one or more indicators (e.g., light emitting diodes (LEDs)), a physical keyboard or keypad, a mouse, a touch pad, a touch screen, a speaker or other audio transmitting device, a microphone, a printer, a scanner, a headset, a display screen or display device, or a combination thereof, etc. The peripheral component interface may include, but is not limited to, a non-volatile memory port, a universal serial bus (USB) port, an audio jack, a power interface, etc.

[0068] The radio front end module (RFEM) 415 may include a millimeter wave (mmWave) RFEM and one or more sub-mmWave radio frequency integrated circuits (RFICs). In some implementations, the one or more sub-mmWave RFICs may be physically separated from the mmWave RFEM. The RFIC may include connections to one or more antennas or antenna arrays (see, e.g., Figure 6 The baseband circuit 410 may be implemented, for example, as a solder-in substrate including one or more integrated circuits, a single packaged integrated circuit soldered to a main circuit board, or a multi-chip module containing two or more integrated circuits.

[0069] The memory circuit 420 may include one or more of the following: a volatile memory, such as a dynamic random access memory (DRAM) or a synchronous dynamic random access memory (SDRAM); and a non-volatile memory (NVM), such as a high-speed electrically erasable memory (commonly referred to as flash memory), a phase change random access memory (PRAM), or a magnetoresistive random access memory (MRAM), or a combination thereof, etc. For example, the memory circuit 420 may be implemented as one or more of the following: a solder-in packaged integrated circuit, a socketed memory module, and a plug-in memory card.

[0070] The PMIC 425 may include a voltage regulator, a surge protector, a power alarm detection circuit, and one or more backup power sources, such as a battery or capacitor. The power alarm detection circuit may detect one or more of a brownout (undervoltage) and a surge (overvoltage) condition. The power tee circuit 430 may provide power extracted from the network cable to provide both power and data connections for the infrastructure equipment 400 using a single cable.

[0071] The network controller circuit 435 may provide connectivity to the network using a standard network interface protocol such as Ethernet, Ethernet based on a GRE tunnel, Ethernet based on Multi-Protocol Label Switching (MPLS), or some other suitable protocol. Network connectivity may be provided to and from the infrastructure equipment 400 using a network interface connector 440 using a physical connection, which may be an electrical connection (commonly referred to as a "copper interconnect"), an optical connection, or a wireless connection. The network controller circuit 435 may include one or more dedicated processors or FPGAs, or both, for communicating using one or more of the aforementioned protocols. In some implementations, the network controller circuit 435 may include multiple controllers for providing connectivity to other networks using the same or different protocols.

[0072] The positioning circuit 445 includes circuits for receiving and decoding signals transmitted or broadcast by a positioning network of a global navigation satellite system (GNSS). Examples of GNSS include the United States' Global Positioning System (GPS), Russia's Global Navigation System (GLONASS), the European Union's Galileo system, China's Beidou Navigation Satellite System, regional navigation systems or GNSS augmentation systems (e.g., using the Indian constellation (NAVIC), Japan's Quasi-Zenith Satellite System (QZSS), France's Doppler Orbit Chart and Satellite Integrated Radio Positioning (DORIS) for navigation), etc. The positioning circuit 445 may include various hardware elements (e.g., including hardware devices such as switches, filters, amplifiers, antenna elements, etc. for facilitating OTA communications) to communicate with components of the positioning network such as navigation satellite constellation nodes. In some specific implementations, the positioning circuit 445 may include a micro technology (micro PNT) IC for positioning, navigation, and timing that uses a master timing clock to perform position tracking and estimation without GNSS assistance. The positioning circuit 445 may also be part of or interact with the baseband circuit 410 or the RFEM 415 or both to communicate with nodes and components of the positioning network. The positioning circuit 445 may also provide data (e.g., location data, time data) to the application circuit 405, which may use the data to synchronize operations with various infrastructures (e.g., RAN node 111, etc.).

[0073] Figure 5 An example of a platform 500 (or "device 500") is shown. In some implementations, the computer platform 500 may be suitable for use as a UE 101 application server 130, or any other component or device discussed herein. The platform 500 may include any combination of components shown in the example. The components (or portions thereof) of the platform 500 may be implemented as integrated circuits (ICs), discrete electronic devices, or other modules, logic, hardware, software, firmware, or combinations thereof adapted in the computer platform 500, or as components otherwise incorporated within the chassis of a larger system. Figure 5 The block diagram is intended to show a high-level view of the components of platform 500. However, in some implementations, platform 500 may include fewer, additional, or alternative components, or Figure 5 Different arrangements of components are shown.

[0074] The application circuit 505 includes circuits such as, but not limited to, one or more processors (or processor cores), cache memory, and one or more LDOs, interrupt controllers, serial interfaces (such as SPI), I2C or general programmable serial interface modules, RTCs, timers-counters (including interval timers and watchdog timers), general I / Os, memory card controllers (such as SD MMC or similar controllers), USB interfaces, MIPI interfaces, and JTAG test access ports. The processor (or core) of the application circuit 505 may be coupled to or may include a memory / storage element, and may be configured to execute instructions stored in the memory or storage device to enable various applications or operating systems to run on the system 500. In some specific implementations, the memory or storage element may be an on-chip memory circuit, which may include any suitable volatile memory or non-volatile memory, such as DRAM, SRAM, EPROM, EEPROM, flash memory, solid-state memory, or combinations thereof, as well as other types of memory.

[0075] The processor of the application circuit 505 may include, for example, one or more processor cores, one or more application processors, one or more GPUs, one or more RISC processors, one or more ARM processors, one or more CISC processors, one or more DSPs, one or more FPGAs, one or more PLDs, one or more ASICs, one or more microprocessors or controllers, multi-threaded processors, ultra-low voltage processors, embedded processors, some other known processing elements, or any suitable combination thereof. In some specific implementations, the application circuit 405 may include or may be a dedicated processor / controller for performing the techniques described herein. In some specific implementations, the application circuit 505 may be part of a system on a chip (SoC), in which the application circuit 505 and other components are formed as a single integrated circuit or a single package.

[0076] In some implementations, the application circuit 505 may include: circuits, such as but not limited to one or more field programmable devices (FPDs) such as FPGAs; PLDs such as CPLDs, HCPLDs; ASICs such as structured ASICs; PSoCs, or combinations thereof, etc. In some implementations, the application circuit 505 may include logic blocks or logic structures, and other interconnected resources that can be programmed to perform various functions such as the processes, methods, functions described herein. In some implementations, the application circuit 505 may include memory cells, such as EPROMs, EEPROMs, flash memory, static memory (such as SRAM or anti-fuse) for storing logic blocks, logic structures, data, or other data in LUTs, etc.

[0077] Baseband circuit 510 may be implemented, for example, as a solder-in substrate including one or more integrated circuits, a single packaged integrated circuit soldered to a main circuit board, or a multi-chip module containing two or more integrated circuits. Figure 6 The various hardware electronic components of baseband circuit 510 are discussed.

[0078] The RFEM 515 may include a millimeter wave (mmWave) RFEM and one or more sub-millimeter wave RFICs. In some implementations, the one or more sub-millimeter wave RFICs may be physically separated from the mmWave RFEM. The RFIC may include connections to one or more antennas or antenna arrays (see, e.g., Figure 6 The antenna array 611 of the platform 500 may be connected to a plurality of antennas. In some implementations, both millimeter wave and sub-millimeter wave radio functions may be implemented in the same physical RFEM 515 that combines both millimeter wave antennas and sub-millimeter wave. In some implementations, the RFEM 515, the baseband circuit 510, or both are included in a transceiver of the platform 500.

[0079] The memory circuit 520 may include any number and type of memory devices for providing a quantitative system memory. For example, the memory circuit 520 may include one or more of volatile memory (such as RAM, DRAM, or SDRAM) and NVM (such as high-speed electrically erasable memory (commonly referred to as flash memory), PRAM, or MRAM), or a combination thereof, etc. In a low-power implementation, the memory circuit 520 may be an on-chip memory or register associated with the application circuit 505. In order to provide persistent storage of information such as data, applications, operating systems, etc., the memory circuit 520 may include one or more mass storage devices, which may include, for example, a solid-state drive (SSD), a hard disk drive (HDD), a micro HDD, a resistive change memory, a phase change memory, a holographic memory, or a chemical memory, etc.

[0080] The removable memory circuit 523 may include a device, circuit, housing, case, port or socket, etc. for coupling a portable data storage device to the platform 500. These portable data storage devices may be used for mass storage and may include, for example, a flash memory card (e.g., a secure digital (SD) card, a micro SD card, an xD picture card), as well as a USB flash drive, an optical disk, or an external HDD or a combination thereof, etc. The platform 500 may also include an interface circuit (not shown) for connecting an external device to the platform 500. External devices connected to the platform 500 using the interface circuit include a sensor circuit 521 and an electromechanical component (EMC) 522, as well as a removable memory device coupled to the removable memory circuit 523.

[0081] Sensor circuit 521 includes a device, module, or subsystem that is intended to detect events or changes in its environment and send information about the detected events (e.g., sensor data) to one or more other devices, modules, or subsystems. Examples of such sensors include: an inertial measurement unit (IMU), such as an accelerometer, gyroscope, or magnetometer; a microelectromechanical system (MEMS) or nanoelectromechanical system (NEMS) including a three-axis accelerometer, a three-axis gyroscope, or a magnetometer; a liquid level sensor; a flow sensor; a temperature sensor (e.g., a thermistor); a pressure sensor; a barometric pressure sensor; a gravity meter; an altimeter; an image capture device (e.g., a camera or a lensless aperture); a light detection and ranging (LiDAR) sensor; a proximity sensor (e.g., an infrared radiation detector, etc.), a depth sensor, an ambient light sensor, an ultrasonic transceiver; a microphone or other audio capture device, or a combination thereof, etc.

[0082] The EMC 522 includes devices, modules or subsystems that are intended to enable the platform 500 to change its state, position, or orientation or to move or control a mechanism, system or subsystem. In addition, the EMC 522 may be configured to generate messages or signaling and send messages or signaling to other components of the platform 500 to indicate the current state of the EMC 522. Examples of EMC 522 include one or more power switches, relays (such as electromechanical relays (EMRs) or solid-state relays (SSRs)), actuators (e.g., valve actuators), audible sound generators, visual warning devices, motors (e.g., DC motors or stepper motors), wheels, thrusters, propellers, claws, clamps, hooks, or combinations thereof, in addition to other electromechanical components. In some specific implementations, the platform 500 is configured to operate one or more EMCs 522 based on one or more capture events, instructions or control signals received from a service provider or a client or both.

[0083] In some specific implementations, the interface circuit can connect the platform 500 with the positioning circuit 545. The positioning circuit 545 includes a circuit for receiving and decoding signals transmitted or broadcast by the positioning network of the GNSS. The positioning circuit 545 includes various hardware elements (e.g., including hardware devices such as switches, filters, amplifiers, antenna elements, etc. for facilitating OTA communication) to communicate with components of the positioning network such as navigation satellite constellation nodes. In some specific implementations, the positioning circuit 545 may include a micro PNT IC that uses a master timing clock to perform position tracking or estimation without GNSS assistance. The positioning circuit 545 can also be a part of the baseband circuit 510 or RFEM515 or both or interact with it to communicate with nodes and components of the positioning network. The positioning circuit 545 can also provide data (e.g., position data, time data) to the application circuit 505, which can use the data to synchronize operations with various infrastructures (e.g., radio base stations) for turn-by-turn navigation applications, etc.

[0084] In some implementations, the interface circuit may connect the platform 500 with a near field communication (NFC) circuit 540. The NFC circuit 540 is configured to provide contactless short-range communication based on the radio frequency identification (RFID) standard, wherein magnetic field induction is used to enable communication between the NFC circuit 540 and an NFC-enabled device (e.g., an "NFC touch point") external to the platform 500. The NFC circuit 540 includes an NFC controller coupled to an antenna element and a processor coupled to the NFC controller. The NFC controller may be a chip or IC that provides NFC functionality to the NFC circuit 540 by executing an NFC controller firmware and an NFC stack. The NFC stack may be executed by the processor to control the NFC controller, and the NFC controller firmware may be executed by the NFC controller to control the antenna element to transmit a short-range RF signal. The RF signal may power a passive NFC tag (e.g., a microchip embedded in a sticker or wristband) to transfer stored data to the NFC circuit 540, or initiate data transfer between the NFC circuit 540 and another active NFC device (e.g., a smart phone or an NFC-enabled POS terminal) close to the platform 500.

[0085] The driver circuit 546 may include software and hardware elements for controlling specific devices embedded in, attached to, or otherwise communicatively coupled to the platform 500. The driver circuit 546 may include various drivers to allow other components of the platform 500 to interact with or control various input / output (I / O) devices that may be present in or connected to the platform 500. For example, the driver circuit 546 may include: a display driver for controlling and allowing access to a display device, a touch screen driver for controlling and allowing access to a touch screen interface of the platform 500, a sensor driver for obtaining sensor readings of the sensor circuit 521 and controlling and allowing access to the sensor circuit 521, an EMC driver for obtaining an actuator position of the EMC 522 or controlling and allowing access to the EMC 522, a camera driver for controlling and allowing access to an embedded image capture device, and an audio driver for controlling and allowing access to one or more audio devices.

[0086] A power management integrated circuit (PMIC) 525 (also referred to as “power management circuit 525”) may manage power provided to various components of platform 500. Specifically, PMIC 525 may control power selection, voltage scaling, battery charging, or DC-DC conversion with respect to baseband circuit 510. PMIC 525 may be included, for example, when the device is included in a UE such as UE 101.

[0087] In some implementations, the PMIC 525 may control or otherwise be part of various power saving mechanisms of the platform 500. For example, if the platform 500 is in the RRC_CONNECTED state, in which the platform is still connected to the RAN node because it expects to receive traffic soon, then after a period of inactivity, the platform may enter a state known as discontinuous reception mode (DRX). During this state, the platform 500 may be powered off for short time intervals, thereby saving power. If there is no data traffic activity for a longer period of time, the platform 500 may transition to the RRC_IDLE state, in which it is disconnected from the network and does not perform operations such as channel quality feedback or handover. This may allow the platform 500 to enter a very low power state in which it periodically wakes up to listen to the network and then powers off again. In some implementations, the platform 500 may not receive data in the RRC_IDLE state, but must transition back to the RRC_CONNECTED state to receive data. Additional power saving modes may prevent the device from using the network for longer than the paging interval (ranging from a few seconds to a few hours). During this time, the device may not be able to connect to the network and may lose power completely. Any data sent during this time may be significantly delayed, and it is assumed that the delay is acceptable.

[0088] The battery 530 can power the platform 500, but in some implementations, the platform 500 can be deployed in a fixed location and can have a power source coupled to a power grid. The battery 530 can be a lithium-ion battery, a metal-air battery such as a zinc-air battery, an aluminum-air battery, or a lithium-air battery, etc. In some implementations, such as in V2X applications, the battery 530 can be a typical lead-acid car battery.

[0089] The user interface circuit 550 includes various input / output (I / O) devices present in or connected to the platform 500, and includes one or more user interfaces designed to implement user interaction with the platform 500 or peripheral component interfaces designed to implement interaction with peripheral components of the platform 500. The user interface circuit 550 includes input device circuits and output device circuits. The input device circuit includes any physical or virtual means for accepting input, including one or more physical or virtual buttons (e.g., a reset button), a physical keyboard, a keypad, a mouse, a touchpad, a touch screen, a microphone, a scanner, or a headset, or a combination thereof, etc. The output device circuit includes any physical or virtual means for displaying information or otherwise conveying information (such as sensor readings, actuator positions, or other information). The output device circuitry may include any number or combination of audio or visual displays, including one or more simple visual outputs or indicators (e.g., binary state indicators (e.g., light emitting diodes (LEDs)), multi-character visual outputs, or more complex outputs, such as a display device or touch screen (e.g., a liquid crystal display (LCD), an LED display, a quantum dot display, or a projector), where the output of characters, graphics, or multimedia objects is generated or produced by the operation of the platform 500. The output device circuitry may also include a speaker or other audio emitting device, or a printer. In some implementations, the sensor circuitry 521 may be used as an input device circuitry (e.g., an image capture device, or a motion capture device) and one or more EMCs may be used as an output device circuitry (e.g., an actuator for providing tactile feedback). In another example, an NFC circuit may be included to read an electronic tag or connect to another NFC-enabled device, the NFC circuitry including an NFC controller and a processing device coupled to an antenna element. The peripheral component interface may include, but is not limited to, a non-volatile memory port, a USB port, an audio jack, or a power interface.

[0090] Figure 6 6 and 615. The baseband circuit 610 may correspond to Figure 4 The baseband circuit 410 and Figure 5 The baseband circuit 510 of FIG. RFEM 615 may correspond to Figure 4 RFEM415 and Figure 5RFEM 515. As shown, RFEM 615 may include radio frequency (RF) circuit 606, front end module (FEM) circuit 608, and antenna array 611 coupled together. In some implementations, RFEM 615, baseband circuit 610, or both are included in a transceiver.

[0091] The baseband circuitry 610 includes circuitry configured to execute various radio or network protocols and control functions that enable communication with one or more radio networks using the RF circuitry 606. The radio control functions may include, but are not limited to, signal modulation and demodulation, encoding and decoding, and radio frequency shifting. In some implementations, the modulation and demodulation circuitry of the baseband circuitry 610 may include fast Fourier transform (FFT), precoding, or constellation mapping and demapping functions. In some implementations, the encoding and decoding circuitry of the baseband circuitry 610 may include convolution, tail-biting convolution, turbo, Viterbi, or low-density parity check (LDPC) encoder and decoder functions. The modulation and demodulation and encoder and decoder functions are not limited to these examples and may include other suitable functions in other examples. The baseband circuitry 610 is configured to process baseband signals received from the receive signal path of the RF circuitry 606 and to generate baseband signals for the transmit signal path of the RF circuitry 606. The baseband circuitry 610 is configured to communicate with application circuitry (e.g., Figure 4 and Figure 5 4 and 505) to generate and process baseband signals and control the operation of RF circuitry 606. Baseband circuitry 610 may handle various radio control functions.

[0092] The aforementioned circuits and control logic components of the baseband circuit 610 may include one or more single-core or multi-core processors. For example, the one or more processors may include a 3G baseband processor 604A, a 4G or LTE baseband processor 604B, a 5G or NR baseband processor 604C, or some other baseband processor 604D for other existing generations, generations under development, or generations to be developed in the future (e.g., the sixth generation (6G)). In some specific implementations, some or all of the functions of the baseband processors 604A-D may be included in a module stored in the memory 604G and executed using one or more processors such as a central processing unit (CPU) 604E. In some specific implementations, some or all of the functions of the baseband processors 604A-D may be provided as a hardware accelerator (e.g., FPGA or ASIC) loaded with appropriate bitstreams or logic blocks stored in corresponding memory units. In some implementations, the memory 604G may store program code of a real-time OS (RTOS), which, when executed by the CPU 604E (or other processor), is used to enable the CPU 604E (or other processor) to manage resources, schedule tasks, or perform other operations of the baseband circuit 610. In some implementations, the baseband circuit 610 includes one or more audio digital signal processors (DSPs) 604F. The audio DSP 604F may include elements for compression and decompression and echo cancellation, and may include other suitable processing elements in some implementations.

[0093] In some implementations, each of the processors 604A-604E includes a corresponding memory interface to send data to and receive data from the memory 604G. The baseband circuit 610 may also include one or more interfaces for communicatively coupling to other circuits or devices, such as an interface for sending data to and receiving data from a memory external to the baseband circuit 610; an interface for sending data to and receiving data from a memory external to the baseband circuit; Figure 4 and Figure 5 The application circuit interface for sending data to the application circuit 405, 505 and receiving data from the application circuit; Figure 6 RF circuit 606 to send data and receive data from the RF circuit; an RF circuit interface for receiving data from one or more wireless hardware elements (e.g., near field communication (NFC) components, A wireless hardware connection interface for sending data to and receiving data from wireless hardware elements (such as low-power components, Wi-Fi components, etc.); and a power management interface for sending power or control signals to and receiving power or control signals from the PMIC 525.

[0094] In some specific implementations (which may be combined with the above examples), the baseband circuit 610 includes one or more digital baseband systems, which are coupled to each other and to the CPU subsystem, the audio subsystem, and the interface subsystem using an interconnection subsystem. The digital baseband subsystem may also be coupled to the digital baseband interface and the mixed signal baseband subsystem using another interconnection subsystem. Each of the interconnection subsystems may include a bus system, a point-to-point connection, a network on chip (NOC) structure, or some other suitable bus or interconnection technology, such as those discussed herein. The audio subsystem may include a DSP circuit, a buffer memory, a program memory, a voice processing accelerator circuit, a data converter circuit such as an analog-to-digital converter circuit and a digital-to-analog converter circuit, an analog circuit including one or more of an amplifier and a filter, etc. In some specific implementations, the baseband circuit 610 may include a protocol processing circuit having one or more control circuit instances (not shown) to provide control functions to the digital baseband circuit or the radio frequency circuit (e.g., the radio front end module 615).

[0095] In some implementations, the baseband circuit 610 includes various processing devices (e.g., a "multi-protocol baseband processor" or "protocol processing circuit") for operating one or more wireless communication protocols and various processing devices for implementing PHY layer functions. In some implementations, the PHY layer functions include the aforementioned radio control functions. In some implementations, the protocol processing circuit operates or implements various protocol layers or entities of one or more wireless communication protocols. For example, when the baseband circuit 610 or the RF circuit 606 or both are part of a millimeter wave communication circuit or some other suitable cellular communication circuit, the protocol processing circuit may operate an LTE protocol entity or a 5G NR protocol entity or both. In this example, the protocol processing circuit may operate MAC, RLC, PDCP, SDAP, RRC, and NAS functions. In some implementations, when the baseband circuit 610 or the RF circuit 606 or both are part of a Wi-Fi communication system, the protocol processing circuit may operate one or more IEEE-based protocols. In this example, the protocol processing circuit may operate Wi-Fi MAC and logical link control (LLC) functions. The protocol processing circuitry may include one or more memory structures (e.g., 604G) for storing program code and data for operating protocol functions, and one or more processing cores for executing program code and performing various operations using data. The baseband circuitry 610 may also support radio communications for more than one wireless protocol.

[0096] The various hardware elements of the baseband circuit 610 discussed herein may be implemented as, for example, a solder-in substrate including one or more integrated circuits (ICs), a single packaged integrated circuit soldered to a main circuit board, or a multi-chip module containing two or more ICs. In some implementations, the components of the baseband circuit 610 may be appropriately combined in a single chip or a single chipset, or disposed on the same circuit board. In some implementations, some or all of the components of the baseband circuit 610 and the RF circuit 606 may be implemented together, such as, for example, a system on a chip (SoC) or a system-in-package (SiP). In some implementations, some or all of the components of the baseband circuit 610 may be implemented as a separate SoC communicatively coupled to the RF circuit 606 (or multiple instances of the RF circuit 606). In some implementations, some or all of the components of the baseband circuit 610 and the application circuits 405, 505 may be implemented together as a separate SoC mounted to the same circuit board (e.g., a "multi-chip package").

[0097] In some implementations, the baseband circuit 610 may provide communications compatible with one or more radio technologies. The RF circuit 606 may use modulated electromagnetic radiation to achieve communication with a wireless network through a non-solid medium. In some implementations, the RF circuit 606 may include switches, filters, or amplifiers and other components to facilitate communication with a wireless network. The RF circuit 606 may include a receive signal path, which may include circuits for down-converting RF signals received from the FEM circuit 608 and providing baseband signals to the baseband circuit 610. The RF circuit 606 may also include a transmit signal path, which may include circuits for up-converting baseband signals provided by the baseband circuit 610 and providing RF output signals for transmission to the FEM circuit 608.

[0098] The receiving signal path of the RF circuit 606 includes a mixer circuit 606a, an amplifier circuit 606b, and a filter circuit 606c. In some specific implementations, the transmitting signal path of the RF circuit 606 may include a filter circuit 606c and a mixer circuit 606a. The RF circuit 606 also includes a synthesizer circuit 606d for synthesizing the frequency used by the mixer circuit 606a for the receiving signal path and the transmitting signal path. In some specific implementations, the mixer circuit 606a of the receiving signal path can be configured to down-convert the RF signal received from the FEM circuit 608 based on the synthesized frequency provided by the synthesizer circuit 606d. The amplifier circuit 606b can be configured to amplify the down-converted signal, and the filter circuit 606c can be a low-pass filter (LPF) or a band-pass filter (BPF) configured to remove unwanted signals from the down-converted signal to generate an output baseband signal. The output baseband signal can be provided to the baseband circuit 610 for further processing. In some implementations, the output baseband signal can be a zero-frequency baseband signal, but this is not required.In some implementations, the mixer circuit 606a of the receive signal path can include a passive mixer.

[0099] In some implementations, the mixer circuit 606a of the transmit signal path can be configured to up-convert an input baseband signal based on a synthesized frequency provided by the synthesizer circuit 606d to generate an RF output signal for the FEM circuit 608. The baseband signal can be provided by the baseband circuit 610 and can be filtered by the filter circuit 606c.

[0100] In some implementations, the mixer circuit 606a of the receive signal path and the mixer circuit 606a of the transmit signal path may include two or more mixers and may be arranged for quadrature down-conversion and up-conversion, respectively. In some implementations, the mixer circuit 606a of the receive signal path and the mixer circuit 606a of the transmit signal path may include two or more mixers and may be arranged for image suppression (e.g., Hartley image suppression). In some implementations, the mixer circuit 606a of the receive signal path and the mixer circuit 606a of the transmit signal path may be arranged for direct down-conversion and direct up-conversion, respectively. In some implementations, the mixer circuit 606a of the receive signal path and the mixer circuit 606a of the transmit signal path may be configured for superheterodyne operation.

[0101] In some implementations, the output baseband signal and the input baseband signal may be analog baseband signals. In some implementations, the output baseband signal and the input baseband signal may be digital baseband signals, and the RF circuit 606 may include analog-to-digital converter (ADC) and digital-to-analog converter (DAC) circuits, and the baseband circuit 610 may include a digital baseband interface to communicate with the RF circuit 606. In some dual-mode examples, separate radio IC circuits may be provided to process signals for each spectrum, but the techniques described herein are not limited in this regard.

[0102] In some implementations, synthesizer circuit 606d may be a fractional-N synthesizer or a fractional N / N+1 synthesizer, although other types of frequency synthesizers may also be used. For example, synthesizer circuit 606d may be a delta-sigma synthesizer, a frequency multiplier, or a synthesizer including a phase-locked loop with a frequency divider. Synthesizer circuit 606d may be configured to synthesize an output frequency based on a frequency input and a frequency divider control input for use by mixer circuit 606a of RF circuit 606. In some implementations, synthesizer circuit 606d may be a fractional-N / N+1 synthesizer.

[0103] In some implementations, the frequency input may be provided by a voltage controlled oscillator (VCO), although this is not required. The divider control input may be provided by the baseband circuit 610 or the application circuit 405 / 505 according to the desired output frequency. In some implementations, the divider control input (e.g., N) may be determined from a lookup table based on the channel indicated by the application circuit 405, 505.

[0104] The synthesizer circuit 606d of the RF circuit 606 may include a frequency divider, a delay locked loop (DLL), a multiplexer, and a phase accumulator. In some implementations, the frequency divider may be a dual-mode frequency divider (DMD), and the phase accumulator may be a digital phase accumulator (DPA). In some implementations, the DMD may be configured to divide the input signal by N or N+1 (e.g., based on a carry output) to provide a fractional frequency division ratio. In some implementations, the DLL may include a cascaded, tunable, delay element, a phase detector, a charge pump, and a set of D-type flip-flops. The delay element may be configured to divide the VCO cycle into Nd equal phase groups, where Nd is the number of delay elements in the delay line. In this way, the DLL provides negative feedback to help ensure that the total delay through the delay line is one VCO cycle.

[0105] In some implementations, the synthesizer circuit 606d can be configured to generate a carrier frequency as an output frequency, while in other examples, the output frequency can be a multiple of the carrier frequency (e.g., twice the carrier frequency, four times the carrier frequency) and can be used with a quadrature generator and divider circuit to generate multiple signals with multiple different phases relative to each other at the carrier frequency. In some implementations, the output frequency can be an LO frequency (fLO). In some implementations, the RF circuit 606 can include an IQ or polarity converter.

[0106] FEM circuitry 608 may include a receive signal path that may include circuitry configured to operate on RF signals received from antenna array 611, amplify the received signals, and provide an amplified version of the received signals to RF circuitry 606 for further processing. FEM circuitry 608 may also include a transmit signal path that may include circuitry configured to amplify transmit signals provided by RF circuitry 606 for transmission by one or more antenna elements in antenna array 611. Amplification by either the transmit signal path or the receive signal path may be accomplished only in RF circuitry 606, only in FEM circuitry 608, or in both RF circuitry 606 and FEM circuitry 608.

[0107] In some implementations, the FEM circuit 608 may include a TX / RX switch to switch between transmit mode and receive mode operation. The FEM circuit 608 may include a receive signal path and a transmit signal path. The receive signal path of the FEM circuit 608 may include an LNA to amplify a received RF signal and provide the amplified received RF signal as an output (e.g., to the RF circuit 606). The transmit signal path of the FEM circuit 608 may include a power amplifier (PA) for amplifying an input RF signal (e.g., provided by the RF circuit 606), and one or more filters for generating an RF signal for subsequent transmission by one or more antenna elements of the antenna array 611.

[0108] The antenna array 611 includes one or more antenna elements, each of which is configured to convert an electrical signal into a radio wave to travel through the air and convert the received radio wave into an electrical signal. For example, a digital baseband signal provided by the baseband circuit 610 is converted into an analog RF signal (e.g., a modulated waveform), which is amplified and transmitted using the antenna elements of the antenna array 611 including one or more antenna elements (not shown). The antenna elements may be omnidirectional, directional, or a combination thereof. The antenna elements may be formed into a variety of arrangements as known and / or discussed herein. The antenna array 611 may include a microstrip antenna or a printed antenna fabricated on the surface of one or more printed circuit boards. The antenna array 611 may be formed as a patch of metal foil (e.g., a patch antenna) of various shapes and may be coupled to the RF circuit 606 and / or the FEM circuit 608 using a metal transmission line or the like.

[0109] The processor of the application circuit 405 / 505 and the processor of the baseband circuit 610 can be used to execute elements of one or more instances of the protocol stack. For example, the processor of the baseband circuit 610 can perform layer 3, layer 2 or layer 1 functions individually or in combination, and the processor of the application circuit 405, 505 can utilize the data received from these layers (e.g., packet data) and further perform layer 4 functions (e.g., TCP and UDP layers). As mentioned herein, layer 3 may include an RRC layer, which will be described in further detail below. As mentioned herein, layer 2 may include a MAC layer, an RLC layer, and a PDCP layer, which will be described in further detail below. As mentioned herein, layer 1 may include a PHY layer of a UE / RAN node, which will be described in further detail below.

[0110] Figure 7 2 shows exemplary components of the communication circuit 700. In some implementations, the communication circuit 700 may be implemented as Figure 4 and Figure 5 The communication circuit 700 may be communicatively coupled (e.g., directly or indirectly) to one or more antennas, such as antennas 711a, 711b, 711c, and 711d. In some implementations, the communication circuit 700 includes or is communicatively coupled to dedicated receive chains, processors, or radio components, or a combination thereof, for multiple RATs (e.g., a first receive chain for LTE and a second receive chain for 5G NR). For example, Figure 7 As shown, the communication circuit 700 includes a modem 710 and another modem 720, which may correspond to or be Figure 4 and Figure 5The baseband circuit 410 and a portion of the baseband circuit 510 are shown. The modem 710 can be configured to communicate according to a first RAT (such as LTE or LTE-A), and the modem 720 can be configured to communicate according to a second RAT (such as 5GNR). In some specific implementations, the processor 705, such as an application processor, can interact with the modems 710 and 720.

[0111] The modem 710 includes one or more processors 712 and a memory 716 in communication with the processor 712. The modem 710 is in communication with a radio frequency (RF) front end 730, which may correspond to Figure 4 and Figure 5 RFEM 415 and 515 are shown or are part of them. RF front end 730 may include circuits for transmitting and receiving radio signals. For example, RF front end 730 includes RX circuit 732 and TX circuit 734. In some specific implementations, receiving circuit 732 communicates with DL front end 752, which may include circuits for receiving radio signals from one or more antennas 711a. Transmitting circuit 734 communicates with UL front end 754, which is coupled to one or more antennas 711b.

[0112] Similarly, the modem 720 includes one or more processors 722 and a memory 726 in communication with the one or more processors 722. The modem 720 is in communication with the RF front end 740, which may correspond to Figure 4 and Figure 5 RFEM 415 and 515 shown or part thereof. RF front end 740 may include circuits for transmitting and receiving radio signals. For example, RF front end 740 includes receiving circuit 742 and transmitting circuit 744. In some specific implementations, receiving circuit 742 may communicate with DL front end 760, and the DL front end may include circuits for receiving radio signals from one or more antennas 711c. Transmitting circuit 744 communicates with UL front end 765, and the UL front end is coupled to one or more antennas 711d. In some specific implementations, one or more front ends may be combined. For example, an RF switch may selectively couple modems 710, 720 to a single UL front end 772 for transmitting radio signals using one or more antennas.

[0113] The modem 710 may include hardware and software components for time division multiplexing UL data (e.g., for NSA NR operation) and various other technologies described herein. The processor 712 may include one or more processing elements configured to implement the various features described herein, such as by executing program instructions stored on a memory 716 (e.g., a non-transitory computer-readable memory medium). In some specific implementations, the processor 712 may be configured as a programmable hardware element, such as an FPGA or an ASIC. In some specific implementations, the processor 712 may include one or more ICs configured to perform the functions of the processor 712. For example, each IC may include a circuit configured to perform the functions of the processor 712.

[0114] The modem 720 may include hardware and software components for time division multiplexing UL data (e.g., for NSA NR operation) and various other techniques described herein. The processor 722 may include one or more processing elements configured to implement the various features described herein, such as by executing instructions stored on a memory 726 (e.g., a non-transitory computer readable memory medium). In some implementations, the processor 722 may be configured as a programmable hardware element, such as an FPGA or ASIC. In some implementations, the processor 722 may include one or more ICs configured to perform the functions of the processor 722.

[0115] Figure 8 Various protocol functions that can be implemented in a wireless communication device are shown. Specifically, Figure 8 An arrangement 800 is included to illustrate the interconnection between various protocol layers / entities. Various protocol layers and entities operating in conjunction with the 5G NR system standard and the LTE system standard are provided. Figure 8 The following description, but Figure 8 Some or all aspects of the invention may also be applicable to other wireless communication network systems.

[0116] In addition to other higher layer functions not shown, the protocol layers of arrangement 800 may also include one or more of PHY 810, MAC 820, RLC 830, PDCP 840, SDAP 847, RRC 855, and NAS layer 857. These protocol layers may include one or more service access points (e.g., Figure 8 Items 859, 856, 850, 849, 845, 835, 825 and 815).

[0117] PHY 810 can transmit and receive physical layer signals 805, which can be received from or transmitted to one or more other communication devices. Physical layer signals 805 may include one or more physical channels, such as those discussed herein. PHY 810 may also perform link adaptation or adaptive modulation and coding (AMC), power control, cell search (e.g., for initial synchronization and switching purposes) and other measurement items used by higher layers (e.g., RRC 855). PHY 810 may also further perform error detection on transmission channels, forward error correction (FEC) encoding and decoding of transmission channels, modulation and demodulation of physical channels, interleaving, rate matching, mapping to physical channels, and MIMO antenna processing. In some specific implementations, an instance of PHY 810 may utilize one or more PHY-SAP 815 to process requests from an instance of MAC 820 and provide instructions thereto. According to some specific implementations, requests and instructions transmitted using PHY-SAP 815 may include one or more transmission channels.

[0118] An instance of MAC 820 may process requests from and provide indications to an instance of RLC 830 using one or more MAC-SAPs 825. These requests and indications transmitted using MAC-SAPs 825 may include one or more logical channels. MAC 820 may perform mapping between logical channels and transport channels, multiplexing MAC SDUs from one or more logical channels onto transport blocks (TBs) to be delivered to PHY 810 using transport channels, demultiplexing MAC SDUs from TBs delivered from PHY 810 using transport channels to one or more logical channels, multiplexing MAC SDUs onto TBs, scheduling information reporting, error correction through HARQ, and logical channel prioritization.

[0119] An instance of RLC 830 may utilize one or more radio link control service access points (RLC-SAPs) 835 to process requests from an instance of PDCP 840 and provide indications thereto. These requests and indications transmitted using RLC-SAPs 835 may include one or more logical channels. RLC 830 may operate in a variety of operating modes, including: transparent mode (TM), unacknowledged mode (UM), and acknowledged mode (AM). RLC 830 may perform transmission of upper layer protocol data units (PDUs), error correction through automatic repeat request (ARQ) for AM data transmission, and concatenation, segmentation, and reassembly of RLC SDUs for UM and AM data transmission. RLC 830 may also perform resegmentation of RLC data PDUs for AM data transmission, reorder RLC data PDUs for UM and AM data transmission, detect duplicate data for UM and AM data transmission, discard RLC SDUs for UM and AM data transmission, detect protocol errors for AM data transmission, and perform RLC re-establishment.

[0120] An instance of PDCP 840 may utilize one or more Packet Data Convergence Protocol Service Access Points (PDCP-SAP) 845 to process requests from an instance of RRC 855 or an instance of SDAP 847, or both, and provide indications thereto. These requests and indications transmitted using PDCP-SAP 845 may include one or more radio bearers. PDCP 840 may perform header compression and decompression of IP data, maintain PDCP sequence numbers (SNs), perform in-order delivery of higher layer PDUs when lower layers are reestablished, eliminate duplication of lower layer SDUs when lower layers are reestablished for radio bearers mapped on RLC AM, encrypt and decrypt control plane data, perform integrity protection and integrity verification on control plane data, control timer-based data discard, and perform security operations (e.g., encryption, decryption, integrity protection, or integrity verification).

[0121] An instance of SDAP 847 may utilize one or more SDAP-SAPs 849 to process requests from one or more higher layer protocol entities and provide instructions thereto. These requests and instructions transmitted using SDAP-SAPs 849 may include one or more QoS flows. SDAP 847 may map QoS flows to data radio bearers (DRBs) and vice versa, and may also mark QoS flow identifiers (QFIs) in DL and UL packets. A single SDAP entity 847 may be configured for a separate PDU session. In the UL direction, NG-RAN 110 may control the mapping of QoS flows to DRBs in two different ways (reflective mapping or explicit mapping). For reflective mapping, SDAP 847 of UE 101 may monitor the QFI of the DL packets of each DRB, and may apply the same mapping to packets flowing in the UL direction. For DRBs, SDAP 847 of UE 101 may map UL packets belonging to a QoS flow corresponding to the QoS flow ID and PDU session observed in the DL packets of the DRB. To implement the reflective mapping, the NG-RAN 310 may mark the DL packets with the QoS flow ID over the Uu interface. The explicit mapping may involve the RRC 855 configuring the SDAP 847 with explicit mapping rules of QoS flows to DRBs, which may be stored and followed by the SDAP 847. In some implementations, the SDAP 847 may only be used in NR implementations and may not be used in LTE implementations.

[0122] The RRC 855 may configure aspects of one or more protocol layers using one or more management service access points (M-SAPs), which may include one or more instances of PHY 810, MAC 820, RLC 830, PDCP 840, and SDAP 847. In some implementations, instances of the RRC 855 may utilize one or more RRC-SAPs 856 to process requests from one or more NAS entities 857 and provide instructions thereto. The main services and functions of the RRC 855 may include broadcasting of system information (e.g., included in a master information block (MIB) or system information block (SIB) related to NAS), broadcasting of system information related to the access stratum (AS), paging, establishment, maintenance, and release of the RRC connection between the UE 101 and the RAN 110 (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), establishment, configuration, maintenance, and release of point-to-point radio bearers, security functions including key management, inter-RAT mobility, and measurement configuration for UE measurement reporting. These MIBs and SIBs may include one or more information elements (IEs), each of which may include a separate data field or data structure. NAS 857 may form the highest layer of the control plane between UE 101 and AMF. NAS 857 may support the mobility and session management procedures of UE 101 to establish and maintain an IP connection between UE 101 and P-GW in the LTE system.

[0123] In some implementations, one or more protocol entities of arrangement 800 may be implemented in UE 101, RAN node 111, AMF in NR implementation or MME in LTE implementation, UPF in NR implementation or S-GW and P-GW in LTE implementation, etc., for control plane or user plane communication protocol stacks between the aforementioned devices. In some implementations, one or more protocol entities that may be implemented in one or more of UE 101, gNB 111, AMF, etc. may communicate with corresponding peer protocol entities that may be implemented in or on another device (using services of corresponding lower layer protocol entities to perform such communication). In some implementations, the gNB-CU of gNB 111 may host the RRC 855, SDAP 847, and PDCP 840 of the gNB that control the operation of one or more gNB-DUs, and the gNB-DUs of gNB 111 may each host the RLC 830, MAC 820, and PHY 810 of gNB 111.

[0124] In some implementations, the control plane protocol stack may include, in order from the highest layer to the lowest layer, NAS 857, RRC 855, PDCP 840, RLC 830, MAC 820, and PHY 810. In this example, upper layers 860 may be built on top of NAS 857, which includes an IP layer 861, SCTP 862, and an application layer signaling protocol (AP) 863.

[0125] In some implementations, such as NR implementations, the AP 863 may be an NG application protocol layer (NGAP or NG-AP) 863 for the NG interface 113 defined between the NG-RAN node 111 and the AMF, or the AP 863 may be an Xn application protocol layer (XnAP or Xn-AP) 863 for the Xn interface 112 defined between two or more RAN nodes 111. The NG-AP 863 may support the functionality of the NG interface 113 and may include an elementary procedure (EP). The NG-AP EP may be an interaction unit between the NG-RAN point 111 and the AMF. The NG-AP 863 services may include two groups: UE-associated services (e.g., services related to the UE 101) and non-UE-associated services (e.g., services related to the entire NG interface instance between the NG-RAN node 111 and the AMF). These services may include functions such as, but not limited to: a paging function for sending a paging request to the NG-RAN node 111 involved in a specific paging area; a UE context management function for allowing the AMF to establish, modify or release the UE context in the AMF and the NG-RAN node 111; a mobility function for the UE 101 in ECM-CONNECTED mode, for intra-system HO to support mobility within the NG-RAN, and for inter-system HO to support mobility from / to the EPS system; a NAS signaling transmission function for transmitting or rerouting NAS messages between the UE 101 and the AMF; a NAS node selection function for determining the association between the AMF and the UE 101; an NG interface management function for setting up the NG interface and monitoring errors through the NG interface; a warning message transmission function for providing a means for transmitting a warning message using the NG interface or cancelling an ongoing warning message broadcast; a configuration transmission function for requesting and transmitting RAN configuration information (e.g., SON information, or performance measurement (PM) data) between two RAN nodes 111 using the CN 120; or a combination thereof, etc.

[0126] The XnAP 863 may support the functions of the Xn interface 112 and may include XnAP basic mobility procedures and XnAP global procedures. The XnAP basic mobility procedures may include procedures for handling UE mobility within the NG RAN 111 (or E-UTRAN 210), such as handover preparation and cancellation procedures, SN state transfer procedures, UE context retrieval and UE context release procedures, RAN paging procedures, or procedures related to dual connectivity, etc. The XnAP global procedures may include procedures not related to a specific UE 101, such as Xn interface setup and reset procedures, NG-RAN update procedures, or cell activation procedures, etc.

[0127] In an LTE specific implementation, AP 863 can be an S1 application protocol layer (S1-AP) 863 for the S1 interface 113 defined between the E-UTRAN node 111 and the MME, or AP 863 can be an X2 application protocol layer (X2AP or X2-AP) 863 for the X2 interface 112 defined between two or more E-UTRAN nodes 111.

[0128] The S1 application protocol layer (S1-AP) 863 may support the functionality of the S1 interface, and similar to the NG-AP discussed previously, the S1-AP may include an S1-AP EP. The S1-AP EP may be an interaction unit between the E-UTRAN node 111 and the MME within the LTE CN 120. The S1-AP 863 services may include two groups: UE-associated services and non-UE-associated services. The functions performed by these services include, but are not limited to: E-UTRAN Radio Access Bearer (E-RAB) management, UE capability indication, mobility, NAS signaling transmission, RAN Information Management (RIM), and configuration transmission.

[0129] The X2AP 863 may support the functions of the X2 interface 112 and may include an X2AP basic mobility procedure and an X2AP global procedure. The X2AP basic mobility procedure may include a procedure for handling UE mobility within the E-UTRAN 120, such as a handover preparation and cancellation procedure, an SN state transfer procedure, a UE context retrieval and a UE context release procedure, a RAN paging procedure, or a procedure related to dual connectivity, etc. The X2AP global procedure may include a procedure not related to a specific UE 101, such as an X2 interface setup and reset procedure, a load indication procedure, an error indication procedure, or a cell activation procedure, etc.

[0130] The SCTP layer (alternatively referred to as the SCTP / IP layer) 862 may provide guaranteed delivery of application layer messages (e.g., NGAP or XnAP messages in NR implementations, or S1-AP or X2AP messages in LTE implementations). The SCTP 862 may ensure reliable delivery of signaling messages between the RAN node 111 and the AMF / MME based in part on the IP protocol supported by the IP 861. The Internet Protocol layer (IP) 861 may be used to perform packet addressing and routing functions. In some implementations, the IP layer 861 may deliver and transmit PDUs using point-to-point transport. In this regard, the RAN node 111 may include L2 and L1 layer communication links (e.g., wired or wireless) with the MME / AMF to exchange information.

[0131] In some implementations, the user plane protocol stack may include SDAP 847, PDCP 840, RLC 830, MAC 820, and PHY 810 in order from the highest layer to the lowest layer. The user plane protocol stack may be used for communication between UE 101, RAN node 111, and UPF in NR implementations, or between S-GW and P-GW in LTE implementations. In this example, the upper layer 851 may be built on top of SDAP 847 and may include a user datagram protocol (UDP) and IP security layer (UDP / IP) 852, a general packet radio service (GPRS) tunneling protocol layer (GTP-U) 853 for the user plane, and a user plane PDU layer (UP PDU) 863.

[0132] The transport network layer 854 (also referred to as the "transport layer") may be built on top of the IP transport, and the GTP-U 853 may be used on top of the UDP / IP layer 852 (including the UDP layer and the IP layer) to carry the user plane PDU (UP-PDU). The IP layer (also referred to as the "Internet layer") may be used to perform packet addressing and routing functions. The IP layer may assign IP addresses to user data packets, for example, in any of the IPv4, IPv6, or PPP formats.

[0133] GTP-U 853 may be used to carry user data within the GPRS core network and between the radio access network and the core network. For example, the transmitted user data may be packets in any of the IPv4, IPv6 or PPP formats. UDP / IP 852 may provide a checksum for data integrity, a port number for addressing different functions at the source and destination, and encryption and authentication of selected data flows. The RAN node 111 and the S-GW may utilize the S1-U interface to exchange user plane data using a protocol stack including an L1 layer (e.g., PHY 810), an L2 layer (e.g., MAC 820, RLC 830, PDCP 840 and / or SDAP 847), a UDP / IP layer 852, and a GTP-U 853. The S-GW and the P-GW may utilize an S5 / S8a interface to exchange user plane data using a protocol stack including an L1 layer, an L2 layer, a UDP / IP layer 852, and a GTP-U 853. As previously discussed, the NAS protocol may support the mobility of UE 101 and session management procedures to establish and maintain an IP connection between UE 101 and the P-GW.

[0134] In addition, despite Figure 8 Not shown, but an application layer may exist above the AP 863 and / or transport network layer 854. The application layer may be a layer where a user of the UE 101, RAN node 111, or other network element interacts with a software application, for example, executed by the application circuitry 405 or the application circuitry 505, respectively. The application layer may also provide one or more interfaces for the software application to interact with the communication system (such as the baseband circuitry 610) of the UE 101 or RAN node 111. In some implementations, the IP layer or the application layer or both may provide functionality the same or similar to layers 5 to 7 of the Open Systems Interconnection (OSI) model, or portions thereof (e.g., OSI layer 7—application layer, OSI layer 6—presentation layer, and OSI layer 5—session layer).

[0135] Fig. 9 Another example of a handover and fake base station detection process is shown. At 905, the UE receives a handover command from a source base station of a wireless network to indicate a handover to a target base station for communication in the wireless network. The command may include handover information, such as a radio network temporary identifier (RNTI), such as a temporary C-RNTI or a range of temporary C-RNTI values. In some implementations, the handover information includes information for receiving system information such as SIBx from a legitimate base station.

[0136] At 910, the UE receives information from the target base station. Receiving information from the target base station may include receiving a DCI message via a PDCCH. Receiving information from the target base station may include a message as part of a random access procedure, such as Msg2. In some implementations, receiving information from the target base station may include system information from the target base station, such as SIBx.

[0137] At 915, the UE determines whether the target base station is a legitimate base station of the wireless network based on the information from the target base station and the handover information included in the handover command. Determining that the target base station is a legitimate base station may include determining whether at least a portion of the DCI message received via the PDCCH is scrambled based on the temporary C-RNTI included in the handover command. In some specific implementations, determining whether the target base station is a legitimate base station may use the information included in the handover command to verify the system information received from the target base station. In some specific implementations, the determination may include sending Msg1 from the base station, and receiving Msg2 from the base station in response to Msg1, and checking whether Msg2 contains information included in the handover command, such as RNTI. If the determination indicates that the target base station is illegal, the UE may ignore communications from the base station, such as ignoring Msg2.

[0138] At 920, the UE performs a handover based on the handover command and the determination that the target base station is a legitimate base station. Performing the handover at 920 may include continuing a handover procedure triggered by receiving the HO command.

[0139] Below are some non-limiting embodiments. The following examples relate to additional implementations, and the details in these examples can be used anywhere in one or more implementations previously discussed. Any of the following examples can be combined with any other example or any implementation discussed herein.

[0140] In a first example, a method for detecting a fake base station and performing a handover may include monitoring, by a UE, system information such as SIBx of a real base station at a predefined location that is securely provided to the intended UE only via a handover command. This example and other examples may include one or more of the following features. The SIBx may contain a value field that may be provided in the handover command. Upon receiving the HO command, the UE may match the field value provided in the HO command for verification. A new target base station specific RNTI (which may be similar to the SI-RNTI) may be provided in the handover command. The UE may be configured to monitor the RNTI to detect SIBx. The PDCCH that schedules the SIBx is scrambled with the new RNTI.

[0141] In the first example, the PDCCH may be scheduled in the common search space by the real target base station using an RNTI that is securely provided to the UE in the handover command. The target base station may pre-allocate a temporary C-RNTI to the UE for preparing the handover command and sending the preamble. The target gNB may provide a range of temporary C-RNTIs that it plans to allocate over time. The range may be refreshed as a sliding window based on a handover failure timer such as T304. In some implementations, a temporary C-RNTI, an offset value and / or a multiplier value to the offset and the total number of RNTIs allocated during the time window defined by the new timer or the existing timer T304 may be provided in the handover command. In some implementations, a frequency hopping flag (1 bit), an MCS index (4 bits), and a CSI request (1 bit) are provided in the handover command, and the same information is provided in the UL grant field of the actual Msg2. In some implementations, the real target base station provides an encrypted preamble identifier in the header of the RAR in Msg2. In some implementations, a legacy UE may match the preamble identifier in Msg2, regardless of whether the Msg2 is intended for the UE. In some implementations, the preamble identifier in Msg2 may be encrypted using a target base station key to identify that Msg2 is from a real target base station.

[0142] In a second example, a method for detecting a counterfeit base station and performing a handover may include receiving a handover command to indicate a handover to a target base station for communication in a wireless cellular network; determining that the target base station is a legitimate base station; and performing the handover based on the handover command and the determination. This example and other examples may include one or more of the following features. The target base station may be determined to be a legitimate base station based on handover information included in the handover command. The handover information may include one or more of the SIBx of the target base station; an RNTI specific to the target base station; or information for receiving a PDSCH from the target base station.

[0143] In a second example, the handover information may include an RNTI specific to the target base station, and determining that the target base station is a legitimate base station includes receiving a PDCCH to schedule SIBx from the target base station, wherein the PDCCH is scrambled using the RNTI. In some specific implementations, the handover information includes an RNTI specific to the target base station, and determining that the target base station is a legitimate base station includes receiving a PDCCH scheduled by the target base station in a common search space based on the RNTI. In some specific implementations, the handover information includes an RNTI specific to the target base station, and determining that the target base station is a legitimate base station includes receiving a PDCCH in a UE-specific search space of the target base station based on the RNTI. In some specific implementations, the target base station is determined to be a legitimate base station based on Msg2 received from the target base station.

[0144] The third example includes a UE configured to perform the UE aspects of the first example and / or the second example. The fourth example includes one or more base stations, such as gNBs, eNBs, or both, which are configured to perform one or more of the base station aspects of the first example and / or the second example.

[0145] The techniques described herein may be performed by an apparatus implemented or employed in one or more types of network components, user equipment, or both. In some implementations, one or more non-transitory computer-readable media include instructions for causing an electronic device to perform one or more of the techniques described herein when the instructions are executed by one or more processors of an electronic device. An apparatus may include one or more processors and one or more computer-readable media, the computer-readable media including instructions that, when executed by the one or more processors, cause the one or more processors to perform one or more of the techniques described herein.

[0146] In different specific implementations, the methods described herein can be implemented in software, hardware, or a combination thereof. In addition, the order of the blocks of the method can be changed, and various elements can be added, reordered, combined, omitted, modified, etc. Various modifications and changes can be made, which will be apparent to those skilled in the art who benefit from this disclosure. The various specific implementations described herein are intended to be illustrative and not restrictive. Many variations, modifications, additions, and improvements are possible. Therefore, multiple examples can be provided for the components described herein as a single example. The boundaries between various components, operations, and data repositories are arbitrary to a certain extent, and specific operations are shown in the context of a specific exemplary configuration. Other allocations of functions are contemplated, and they may fall within the scope of the appended claims. Finally, the structure and function presented as discrete components in the exemplary configuration may be implemented as a combined structure or component.

[0147] The methods described herein may be implemented in a circuit, such as one or more of an integrated circuit, a logic circuit, a processor (shared, dedicated, or group) and / or a memory (shared, dedicated, or group), an ASIC, a field programmable device (FPD) (e.g., a field programmable gate array (FPGA), a programmable logic device (PLD), a complex PLD (CPLD), a high capacity PLD (HCPLD), a structured ASIC, or a programmable SoC), a digital signal processor (DSP), or some combination thereof. Examples of processors may include Apple A series processors, Architecture Core TMProcessors, such as Intel processors, ARM processors, AMD processors, and Qualcomm processors. Other types of processors are possible. In some specific implementations, the circuit can execute one or more software or firmware programs to provide at least some of the functions. The term "circuit" can also refer to a combination of one or more hardware elements and a program code for executing the functions of the program code (or a combination of circuits used in an electrical or electronic system). In these embodiments, the combination of hardware elements and program codes can be referred to as a specific type of circuit. The circuit can also include a radio circuit, such as a transmitter, a receiver, or a transceiver.

[0148] As described above, some aspects of the subject matter of this specification include the collection and use of data from various sources to improve the services that mobile devices can provide to users. This disclosure contemplates that, in some cases, the collected data may identify a specific location or address based on device usage. Such personal information data may include location-based data, addresses, subscriber account identifiers, or other identifying information.

[0149] The disclosure also contemplates that entities responsible for the collection, analysis, disclosure, transmission, storage or other purposes of such personal information data will comply with established privacy policies and / or privacy practices. Specifically, such entities should implement and adhere to the use of privacy policies and practices that are recognized as meeting or exceeding the industry or government requirements for maintaining the privacy and security of personal information data. For example, personal information from users should be collected for the legal and reasonable purposes of the entity, and not shared or sold outside these legal purposes. In addition, such collection should only be carried out after the user's informed consent. In addition, such entities should take any necessary steps to safeguard and protect access to such personal information data, and ensure that others who can access personal information data comply with their privacy policies and procedures. In addition, such entities can subject themselves to third-party assessments to prove that they comply with widely accepted privacy policies and practices.

[0150] In the case of an advertisement delivery service, the present disclosure also contemplates implementations in which users selectively block the use or access of personal information data. That is, the present disclosure contemplates providing hardware elements and / or software elements to prevent or block access to such personal information data. For example, in the case of an advertisement delivery service, the technology of the present invention may be configured to allow a user to choose to "opt in" or "opt out" of participating in the collection of personal information data during registration for the service.

[0151] Thus, while the present disclosure broadly covers the use of personal information data to implement one or more of the various disclosed embodiments, the present disclosure also contemplates that various embodiments may also be implemented without access to such personal information data. That is, various embodiments of the present technology will not fail to function properly due to the lack of all or a portion of such personal information data. For example, content may be selected and delivered to a user by inferring preferences based on non-personal information data or an absolute minimum amount of personal information, such as content requested by a device associated with the user, other non-personal information available to a content delivery service, or publicly available information.

[0152] A plurality of specific implementations have been described. However, it should be understood that various modifications may be made. Elements in one or more specific implementations may be combined, deleted, modified or supplemented to form other specific implementations. As another example, the logic flow shown in the accompanying drawings does not require the specific order or sequential order shown to achieve the desired result. In addition, other steps may be provided or steps may be eliminated from the process, and other components may be added to the system or removed from the system. Therefore, other specific embodiments are within the scope of the following claims.

Claims

1. A method for communication, the method comprising: receiving a handover command from a source base station of a wireless network, the handover command indicating a handover to a target base station for communicating in the wireless network, and the handover command identifying a location for a system information block from the target base station; receiving information from the target base station, the information comprising a system information block; Determining whether the target base station is a legitimate base station includes: determining that the target base station is a legitimate base station of the wireless network based at least on the received system information block from the target base station being located at the location identified by the handover command; as well as A handover is performed based at least on the handover command and a determination that the target base station is a legitimate base station. 2 . The method according to claim 1 , wherein the handover command comprises a Radio Network Temporary Identifier (RNTI) for the target base station. 3 . The method of claim 2 , wherein receiving the information from the target base station comprises receiving a message from the target base station via a physical downlink control channel (PDCCH).

4. The method of claim 3, wherein determining whether the target base station is a legitimate base station further comprises determining whether at least a portion of the message received from the target base station via the PDCCH is encrypted based at least on the RNTI for the target base station indicating that the target base station is a legitimate base station.

5. The method according to claim 3, wherein: Receiving the message via the PDCCH includes receiving a PDCCH scheduled by the legitimate base station in a common search space using the RNTI, or receiving a PDCCH scheduled by the legitimate base station in a UE-specific search space using the RNTI; and Determining whether the target base station is a legal base station also includes determining whether the target base station is a legal base station of the wireless network based at least on receiving the PDCCH scheduled by the legal base station in the common search space using the RNTI, or receiving the PDCCH scheduled by the legal base station in the UE-specific search space using the RNTI.

6. The method according to claim 2, comprising: Transmitting a first message of a random access procedure; as well as A second message of the random access procedure is received from the target base station, wherein determining whether the target base station is a legitimate base station further comprises determining whether an RNTI included in the second message matches the RNTI provided in the handover command.

7. The method according to claim 2, comprising: receiving a random access response message; as well as The random access response message is ignored based at least on a determination that the RNTI included in the random access response message does not match the RNTI provided in the handover command. The method of claim 2 , wherein the RNTI is a temporary cell RNTI.

9. The method of claim 1, wherein the handover command specifies a range of Radio Network Temporary Identity values.

10. The method according to claim 9, comprising: Transmitting a first message of a random access procedure; as well as receiving a second message of the random access procedure from the target base station, the second message including a radio network temporary identifier RNTI, The determining whether the target base station is a legitimate base station further comprises determining whether the RNTI included in the second message is within a range of the radio network temporary identity values ​​indicating that the target base station is a legitimate base station. 11 . The method of claim 1 , wherein receiving the handover command comprises receiving, from the source base station, the handover command including scheduling information for receiving a physical downlink shared channel (PDSCH) from the target base station.

12. The method of claim 1, wherein: Receiving the switching command includes receiving the switching command including a reference value; and Determining whether the target base station is a legitimate base station further includes determining whether the system information block includes a value matching the reference value included in the handover command.

13. An apparatus for communication, the apparatus comprising: circuitry configured to communicate with a base station of a wireless network; as well as A circuit configured to perform operations comprising: receiving a handover command from a source base station of the wireless network, the handover command indicating a handover to a target base station for communications in the wireless network, and the handover command identifying a location for a system information block from the target base station; receiving information from the target base station, the information comprising a system information block; Determining whether the target base station is a legitimate base station includes: determining that the target base station is a legitimate base station of the wireless network based at least on the received system information block from the target base station being located at the location identified by the handover command; and A handover is performed based at least on the handover command and a determination that the target base station is a legitimate base station.

14. The apparatus of claim 13, wherein the handover command comprises a Radio Network Temporary Identifier (RNTI) for the target base station.

15. The apparatus of claim 14, wherein receiving the information from the target base station comprises receiving a message from the target base station via a physical downlink control channel (PDCCH).

16. The apparatus of claim 15, wherein determining whether the target base station is a legitimate base station further comprises determining whether at least a portion of the message received from the target base station via the PDCCH is scrambled based at least on the RNTI for the target base station indicating that the target base station is a legitimate base station.

17. The device according to claim 15, wherein: Receiving the message via the PDCCH includes receiving a PDCCH scheduled by the legitimate base station in a common search space using the RNTI, or receiving a PDCCH scheduled by the legitimate base station in a UE-specific search space using the RNTI; and Determining whether the target base station is a legal base station also includes determining whether the target base station is a legal base station of the wireless network based at least on receiving the PDCCH scheduled by the legal base station in the common search space using the RNTI, or receiving the PDCCH scheduled by the legal base station in the UE-specific search space using the RNTI.

18. The apparatus of claim 14, wherein the operations comprise: Transmitting a first message of a random access procedure; as well as A second message of the random access procedure is received from the target base station, wherein determining whether the target base station is a legitimate base station further comprises determining whether an RNTI included in the second message matches the RNTI provided in the handover command.

19. The apparatus of claim 14, wherein the operations comprise: receiving a random access response message; as well as The random access response message is ignored based at least on a determination that the RNTI included in the random access response message does not match the RNTI provided in the handover command.

20. The apparatus of claim 14, wherein the RNTI is a temporary cell RNTI.

21. The apparatus of claim 14, wherein the handover command specifies a range of Radio Network Temporary Identity values.

22. The apparatus of claim 21, wherein the operations comprise: Transmitting a first message of a random access procedure; as well as receiving a second message of the random access procedure from the target base station, the second message including a radio network temporary identifier RNTI, The determining whether the target base station is a legitimate base station further comprises determining whether the RNTI included in the second message is within a range of the radio network temporary identity values ​​indicating that the target base station is a legitimate base station.

23. The apparatus of claim 13, wherein receiving the handover command comprises receiving, from the source base station, the handover command including scheduling information for receiving a physical downlink shared channel (PDSCH) from the target base station.

24. The apparatus of claim 13, wherein: Receiving the switching command includes receiving the switching command including a reference value; and Determining whether the target base station is a legitimate base station further includes determining whether the system information block includes a value matching the reference value included in the handover command.

25. An apparatus for communication, comprising a transceiver, the transceiver being configured to: communicating with a base station of a wireless network; as well as Perform actions including the following: receiving a handover command from a source base station of the wireless network, the handover command indicating a handover to a target base station for communications in the wireless network, and the handover command identifying a location for a system information block from the target base station; receiving information from the target base station, the information comprising a system information block; Determining whether the target base station is a legitimate base station includes: determining that the target base station is a legitimate base station of the wireless network based at least on the received system information block from the target base station being located at the location identified by the handover command; as well as A handover is performed based at least on the handover command and a determination that the target base station is a legitimate base station.

26. The apparatus of claim 25, wherein the handover command comprises a Radio Network Temporary Identifier (RNTI) for the target base station.

27. The apparatus of claim 26, wherein receiving the information from the target base station comprises receiving a message from the target base station via a physical downlink control channel (PDCCH).

28. An apparatus according to claim 27, wherein determining whether the target base station is a legitimate base station also includes determining whether at least a portion of the message received from the target base station via the PDCCH is encrypted based at least on the RNTI for the target base station indicating that the target base station is a legitimate base station.

29. The apparatus of claim 27, wherein: Receiving the message via the PDCCH includes receiving a PDCCH scheduled by the legitimate base station in a common search space using the RNTI, or receiving a PDCCH scheduled by the legitimate base station in a UE-specific search space using the RNTI; and Determining whether the target base station is a legal base station also includes determining whether the target base station is a legal base station of the wireless network based at least on receiving the PDCCH scheduled by the legal base station in the common search space using the RNTI, or receiving the PDCCH scheduled by the legal base station in the UE-specific search space using the RNTI.

30. The device according to claim 26, wherein: The operations include: transmitting a first message of a random access procedure; and A second message of the random access procedure is received from the target base station, wherein determining whether the target base station is a legitimate base station further comprises determining whether an RNTI included in the second message matches the RNTI provided in the handover command.

31. The apparatus of claim 26, wherein: The operations include: receiving a random access response message; and The random access response message is ignored based at least on a determination that the RNTI included in the random access response message does not match the RNTI provided in the handover command.

32. The apparatus of claim 26, wherein the RNTI is a temporary cell RNTI.

33. The apparatus of claim 26, wherein the handover command specifies a range of Radio Network Temporary Identity values.

34. The device according to claim 33, wherein The operations include: transmitting a first message of a random access procedure; and receiving a second message of the random access procedure from the target base station, the second message including a radio network temporary identifier RNTI, The determining whether the target base station is a legitimate base station further comprises determining whether the RNTI included in the second message is within a range of the radio network temporary identity values ​​indicating that the target base station is a legitimate base station.

35. The apparatus of claim 25, wherein receiving the handover command comprises accepting, from the source base station, the handover command including scheduling information for receiving a physical downlink shared channel (PDSCH) from the target base station.

36. The apparatus of claim 25, wherein: Receiving the switching command includes receiving the switching command including a reference value; and Determining whether the target base station is a legitimate base station further includes determining whether the system information block includes a value matching the reference value included in the handover command.

Images