Using positioning technology to detect fake base stations

Abstract

Techniques for detecting outlier cells based on positioning of a user equipment (UE) are disclosed. In one aspect, the UE or a location server determines a plurality of cells detectable by the UE, calculates a plurality of position estimates of the UE based on positioning measurements of a corresponding plurality of subsets of the plurality of cells, identifies a subset of cells that provides a best position estimate for the UE, wherein the best position estimate maximizes a set of inlier cells, calculates a final position estimate of the UE based on positioning measurements of the subset of cells and the set of inlier cells, identifies any remaining cells of the plurality of cells other than the subset of cells and the set of inlier cells as at least one outlier cell, and performs mitigation operations based on identifying the at least one outlier cell.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This patent application claims the benefit of U.S. Provisional Application No. 62 / 949,377, filed on December 17, 2019, entitled “USING POSITIONING TECHNIQUES TO DETECT FALSE BASE STATIONS,” and U.S. Non-Provisional Application No. 17 / 084,848, filed on October 30, 2020, entitled “USING POSITIONING TECHNIQUES TO DETECT FALSE BASE STATIONS,” both of which are assigned to the assignee of this application and are expressly incorporated herein by reference in their entirety. Technical Field

[0003] Aspects of the present disclosure generally relate to wireless communications. Background Art

[0004] Wireless communication systems have evolved over several generations, including first generation analog wireless telephone service (1G), second generation (2G) digital wireless telephone service (including transitional 2.5G networks), third generation (3G) high speed data, Internet-enabled wireless services, and fourth generation (4G) services (e.g., LTE or WiMax). There are many different types of wireless communication systems in use today, including cellular and personal communications service (PCS) systems. Examples of known cellular systems include cellular analog Advanced Mobile Phone System (AMPS), digital cellular systems based on code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), and Global System for Mobile Communications (GSM), among others.

[0005] The fifth-generation (5G) wireless standard, known as New Radio (NR), enables higher data speeds, a greater number of connections, and better coverage, among other improvements. According to the Next Generation Mobile Networks Alliance, the 5G standard is designed to provide data rates of tens of megabits per second for each of tens of thousands of users and 1 gigabit per second for dozens of workers on an office floor. To support large wireless sensor deployments, hundreds of thousands of simultaneous connections should be supported. As a result, the spectral efficiency of 5G mobile communications will be significantly improved compared to the current 4G standard. In addition, signaling efficiency should be enhanced and latency should be significantly reduced compared to the current standard. Summary of the invention

[0006] A brief summary of one or more aspects disclosed herein is given below. Therefore, the following summary should not be regarded as an extensive review of all expected aspects, nor should it be regarded as identifying key or important elements related to all expected aspects or delineating the scope related to any particular aspect. Therefore, the sole purpose of the following summary is to present certain concepts related to one or more aspects of the mechanisms disclosed herein in a simplified form before the specific embodiments presented below.

[0007] In one aspect, a method for positioning a user equipment (UE) includes determining a set of multiple cells detectable by the UE, calculating multiple location estimates for the UE based on positioning measurements of corresponding multiple subsets of the multiple cells, identifying a subset of cells in the multiple subsets that provides a best location estimate among the multiple location estimates for the UE, wherein the best location estimate maximizes a set of inlier cells in the multiple cells, and wherein the set of inlier cells includes one or more cells in the multiple cells other than the subset of cells, for the one or more cells, actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells, calculating a final location estimate for the UE based on positioning measurements of the subset of cells and the set of inlier cells, identifying any remaining cells in the multiple cells other than the subset of cells and the set of inlier cells as at least one outlier cell, and performing mitigation operations based on identifying the at least one outlier cell.

[0008] In one aspect, an apparatus for locating a UE includes a memory, a communication unit, and at least one processor communicatively coupled to the memory and the communication unit, the at least one processor being configured to: determine a set of multiple cells detectable by the UE, calculate multiple position estimates of the UE based on positioning measurements of corresponding multiple subsets of the multiple cells, identify a subset of cells in the multiple subsets that provides a best position estimate among the multiple position estimates of the UE, wherein the best position estimate maximizes a set of inlier cells in the multiple cells, and wherein the set of inlier cells includes one or more cells in the multiple cells other than the subset of cells, for one or more cells, actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells, calculate a final position estimate of the UE based on positioning measurements of the subset of cells and the set of inlier cells, identify any remaining cells in the multiple cells other than the subset of cells and the set of inlier cells as at least one outlier cell, and perform mitigation operations based on identifying the at least one outlier cell.

[0009] In one aspect, an apparatus for locating a UE includes: a component for determining a set of multiple cells detectable by the UE, a component for calculating multiple position estimates of the UE based on positioning measurements of corresponding multiple subsets of the multiple cells, a component for identifying a subset of cells in the multiple subsets that provides a best position estimate among the multiple position estimates of the UE, wherein the best position estimate maximizes a set of inlier cells in the multiple cells, and wherein the set of inlier cells includes one or more cells in the multiple cells other than the subset of cells, and for one or more cells, actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells, a component for calculating a final position estimate of the UE based on positioning measurements of the subset of cells and the set of inlier cells, a component for identifying any remaining cells in the multiple cells other than the subset of cells and the set of inlier cells as at least one outlier cell, and a component for performing a mitigation operation based on identifying the at least one outlier cell.

[0010] In one aspect, a non-transitory computer-readable medium storing computer-executable instructions for locating a UE includes computer-executable instructions including at least one instruction for determining a set of multiple cells detectable by the UE, at least one instruction for calculating multiple position estimates for the UE based on positioning measurements of corresponding multiple subsets of the multiple cells, at least one instruction for identifying a subset of cells in the multiple subsets that provides a best position estimate among the multiple position estimates for the UE, wherein the best position estimate maximizes a set of inlier cells in the multiple cells, and wherein the set of inlier cells includes one or more cells in the multiple cells other than the subset of cells, and for the one or more cells, actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells, at least one instruction for calculating a final position estimate for the UE based on positioning measurements of the subset of cells and the set of inlier cells, at least one instruction for identifying any remaining cells in the multiple cells other than the subset of cells and the set of inlier cells as at least one outlier cell, and at least one instruction for performing a mitigation operation based on identifying the at least one outlier cell.

[0011] Other objects and advantages associated with the aspects disclosed herein will be apparent to those skilled in the art based on the drawings and detailed description. BRIEF DESCRIPTION OF THE DRAWINGS

[0012] The drawings are presented to aid in describing various aspects of the disclosure and are provided solely for illustration of these aspects and not limitation thereof.

[0013] Figure 1 An example wireless communication system in accordance with aspects of the present disclosure is shown.

[0014] Figure 2A and Figure 2B Example wireless network structures in accordance with aspects of the present disclosure are shown.

[0015] FIG. 3A to FIG. 3C is a simplified block diagram of several sample aspects of components that may be used in a user equipment (UE), a base station, and a network entity, respectively, and configured to support communications as taught herein.

[0016] Figure 4A and Figure 4B User plane and control plane protocol stacks in accordance with aspects of the present disclosure are shown.

[0017] FIG. 5A to FIG. 5D is a diagram illustrating an example of a frame structure and channels within the frame structure according to aspects of the present disclosure.

[0018] Figure 6 is a diagram illustrating an example technique for determining the location of a mobile device using information obtained from multiple base stations.

[0019] Fig. 7A and Figure 7B is a diagram illustrating an example technique for detecting potential FBSs using information obtained from multiple cells.

[0020] Figure 8 Example methods for positioning a UE according to aspects of the present disclosure are shown. DETAILED DESCRIPTION

[0021] Various aspects of the present disclosure are provided in the following description and related drawings, which are directed to various examples provided for illustrative purposes. Alternative aspects may be designed without departing from the scope of the present disclosure. In addition, known elements of the present disclosure will not be described in detail or will be omitted to avoid confusing the relevant details of the present disclosure.

[0022] The words "exemplary" and / or "example" as used herein mean "serving as an example, instance, or illustration." Any aspect described herein as "exemplary" and / or "example" is not necessarily to be construed as preferred or advantageous over other aspects. Likewise, the term "aspects of the disclosure" does not require that all aspects of the disclosure include the discussed feature, advantage, or mode of operation.

[0023] Those skilled in the art will appreciate that the information and signals described below may be represented using any of a variety of different techniques and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be mentioned in the following description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or optical particles, or any combination thereof, which depends in part on the specific application, in part on the desired design, in part on the corresponding technology, etc.

[0024] In addition, multiple aspects are described in terms of sequences of actions to be performed by, for example, elements of a computing device. It will be appreciated that the various actions described herein may be performed by specific circuits (e.g., application specific integrated circuits (ASICs)), by program instructions executed by one or more processors, or by a combination of the two. In addition, the sequences of actions described herein may be considered to be fully contained in any form of non-transitory computer-readable storage medium, in which a corresponding set of computer instructions is stored, which, when executed, will cause or instruct the associated processor of the device to perform the functions described herein. Therefore, various aspects of the present disclosure may be embodied in a variety of different forms, all of which are considered to be within the scope of the claimed subject matter. In addition, for each aspect described herein, the corresponding form of any such aspect may be described herein as, for example, "logic" that is "configured to" perform the described actions.

[0025] As used herein, the terms "user equipment" (UE) and "base station" are not intended to be specific or limited to any specific radio access technology (RAT), unless otherwise specified. Generally, a UE can be any wireless communication device (e.g., a mobile phone, a router, a tablet computer, a laptop computer, a tracking device, a wearable device (e.g., a smart watch, glasses, augmented reality (AR) / virtual reality (VR) headsets, etc.), a vehicle (e.g., a car, a motorcycle, a bicycle, etc.), an Internet of Things (IoT) device, etc.) that a user uses to communicate over a wireless communication network. A UE can be mobile or can be fixed (e.g., at a certain time) and can communicate with a radio access network (RAN). As used herein, the term "UE" can be interchangeably referred to as an "access terminal" or "AT", "client device", "wireless device", "subscriber device", "subscriber terminal", "subscriber station", "user terminal" or UT, "mobile device", "mobile terminal", "mobile station" or variants thereof. Generally, a UE can communicate with a core network via a RAN, and through the core network, the UE can connect to external networks such as the Internet and other UEs. Of course, other mechanisms for connecting to the core network and / or the Internet are also possible for the UE, such as through a wired access network, a wireless local area network (WLAN) network (eg, based on IEEE 802.11, etc.), and the like.

[0026] Depending on the network in which the base station is deployed, the base station may operate according to one of several RATs for communicating with the UE, and may be alternatively referred to as an access point (AP), a network node, a NodeB, an evolved NodeB (eNB), a next generation eNB (ng-eNB), a new radio (NR) NodeB (also referred to as a gNB or gNodeB), etc. The base station may be primarily used to support wireless access for the UE, including supporting data, voice and / or signaling connections for the supported UE. In some systems, the base station may provide pure edge node signaling functions, while in other systems, the base station may provide additional control and / or network management functions. The communication link through which the UE may send a signal to the base station is referred to as an uplink (UL) channel (e.g., a reverse traffic channel, a reverse control channel, an access channel, etc.). The communication link through which the base station may send a signal to the UE is referred to as a downlink (DL) or forward link channel (e.g., a paging channel, a control channel, a broadcast channel, a forward traffic channel, etc.). The term traffic channel (TCH) used herein may refer to an uplink / reverse or downlink / forward traffic channel.

[0027] The term "base station" may refer to a single physical transmit-receive point (TRP) or to multiple physical TRPs that may or may not be co-located. For example, when the term "base station" refers to a single physical TRP, the physical TRP may be an antenna of the base station corresponding to the cell (or several cell sectors) of the base station. In the case where the term "base station" refers to multiple co-located physical TRPs, the physical TRP may be an antenna array of the base station (for example, in a multiple-input multiple-output (MIMO) system or where the base station employs beamforming). In the case where the term "base station" refers to multiple non-co-located physical TRPs, the physical TRP may be a distributed antenna system (DAS) (a network of spatially separated antennas connected to a common source via a transmission medium) or a remote radio head (RRH) (a remote base station connected to a serving base station). Alternatively, the non-co-located physical TRP may be a serving base station that receives measurement reports from the UE and a neighboring base station whose reference RF signal (or simply "reference signal") the UE is measuring. As used herein, because the TRP is the point at which a base station transmits and receives wireless signals, references to transmissions from or receptions at a base station should be understood to refer to the specific TRP of that base station.

[0028] In some implementations of supporting positioning of a UE, a base station may not support wireless access of the UE (e.g., may not support data, voice, and / or signaling connections of the UE), but may send reference signals to the UE for measurement by the UE, and / or may receive and measure signals sent by the UE. Such a base station may be referred to as a positioning beacon (e.g., when sending a signal to the UE) and / or a position measurement unit (e.g., when receiving and measuring a signal from the UE).

[0029] An "RF signal" includes an electromagnetic wave of a given frequency that transmits information through the space between a transmitter and a receiver. As used herein, a transmitter may transmit a single "RF signal" or multiple "RF signals" to a receiver. However, due to the propagation characteristics of RF signals through multipath channels, a receiver may receive multiple "RF signals" corresponding to each transmitted RF signal. The same transmitted RF signal on different paths between a transmitter and a receiver may be referred to as a "multipath" RF signal. As used herein, an RF signal may also be referred to as a "wireless signal" or simply a "signal", where it is clear from the context that the term "signal" refers to either a wireless signal or an RF signal.

[0030] According to various aspects, Figure 1 An example wireless communication system 100 is shown. The wireless communication system 100 (which may also be referred to as a wireless wide area network (WWAN)) may include various base stations 102 and various UEs 104. The base stations 102 may include macro cell base stations (high power cellular base stations) and / or small cell base stations (low power cellular base stations). In one aspect, the macro cell base stations may include eNBs and / or ng-eNBs where the wireless communication system 100 corresponds to an LTE network, or gNBs where the wireless communication system 100 corresponds to an NR network, or a combination of both, and the small cell base stations may include femto cells, pico cells, micro cells, etc.

[0031] The base stations 102 may collectively form a RAN and interface with a core network 170 (e.g., an evolved packet core (EPC) or a 5G core (5GC)) through a backhaul link 122, and interface with one or more location servers 172 (which may be part of the core network 170 or may be external to the core network 170) through the core network 170. The base stations 102 may perform, among other functions, functions related to one or more of: transmitting user data, radio channel encryption and decryption, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection establishment and release, load balancing, distribution of non-access stratum (NAS) messages, NAS node selection, synchronization, RAN sharing, multimedia broadcast multicast service (MBMS), subscriber and device tracking, RAN information management (RIM), paging, positioning, and delivery of warning messages. The base stations 102 may communicate with each other directly or indirectly (e.g., through the EPC / 5GC) through a backhaul link 134, which may be wired or wireless.

[0032] Base station 102 can communicate wirelessly with UE 104. Each of base stations 102 can provide communication coverage for a corresponding geographic coverage area 110. In one aspect, the base station 102 in each geographic coverage area 110 can support one or more cells. A "cell" is a logical communication entity used to communicate with a base station (e.g., through some frequency resources, referred to as carrier frequency, component carrier, carrier, frequency band, etc.), and can be associated with an identifier (e.g., physical cell identifier (PCI), virtual cell identifier (VCI), cell global identifier (CGI)) to distinguish cells operating via the same or different carrier frequencies. In some cases, different cells can be configured according to different protocol types (e.g., machine type communication (MTC), narrowband Internet of Things (NB-IoT), enhanced mobile broadband (eMBB), etc.) that can provide access to different types of UEs. Because a cell is supported by a specific base station, the term "cell" can refer to one or both of the logical communication entity and the base station that supports it, depending on the context. In addition, because a TRP is usually a physical transmission point of a cell, the terms "cell" and "TRP" can be used interchangeably. In some cases, the term "cell" may also refer to a geographic coverage area (eg, a sector) of a base station, as long as a carrier frequency can be detected and used for communications within some portion of the geographic coverage area 110.

[0033] Although the geographic coverage areas 110 of adjacent macrocell base stations 102 may partially overlap (e.g., in a handoff region), some of the geographic coverage areas 110 may be substantially overlapped by a larger geographic coverage area 110. For example, a small cell base station 102' may have a geographic coverage area 110' that substantially overlaps with the geographic coverage areas 110 of one or more macrocell base stations 102. A network including small cell and macrocell base stations may be referred to as a heterogeneous network. A heterogeneous network may also include a home eNB (HeNB), which may provide services to a restricted group referred to as a closed subscriber group (CSG).

[0034] The communication link 120 between the base station 102 and the UE 104 may include an uplink (also referred to as a reverse link) transmission from the UE 104 to the base station 102 and / or a downlink (also referred to as a forward link) transmission from the base station 102 to the UE 104. The communication link 120 may use MIMO antenna technology, including spatial multiplexing, beamforming, and / or transmit diversity. The communication link 120 may be over one or more carrier frequencies. The allocation of carriers may be asymmetric with respect to the downlink and uplink (e.g., more or fewer carriers may be allocated for the downlink than for the uplink).

[0035] The wireless communication system 100 may also include a wireless local area network (WLAN) access point (AP) 150 that communicates with a WLAN station (STA) 152 in an unlicensed spectrum (e.g., 5 GHz) via a communication link 154. When communicating in the unlicensed spectrum, the WLAN STA 152 and / or the WLAN AP 150 may perform a clear channel assessment (CCA) or a listen before talk (LBT) procedure prior to communication to determine whether a channel is available.

[0036] The small cell base station 102' can operate in a licensed and / or unlicensed spectrum. When operating in an unlicensed spectrum, the small cell base station 102' can adopt LTE or NR technology and use the same 5GHz unlicensed spectrum used by the WLAN AP 150. The small cell base station 102' adopting LTE / 5G in the unlicensed spectrum can expand the coverage of the access network and / or increase the capacity of the access network. NR in the unlicensed spectrum can be referred to as NR-U. LTE in the unlicensed spectrum can be referred to as LTE-U, Licensed Assisted Access (LAA) or MulteFire.

[0037] The wireless communication system 100 may also include a millimeter wave (mmW) base station 180 that communicates with the UE 182, which may operate in mmW frequencies and / or near mmW frequencies. Extremely high frequency (EHF) is a portion of RF in the electromagnetic spectrum. The range of EHF is 30 GHz to 300 GHz, and the wavelength is between 1 mm and 10 mm. The radio waves of this band may be referred to as millimeter waves. Near mmW may extend down to a frequency of 3 GHz, and the wavelength is 100 mm. The super high frequency (SHF) band extends between 3 GHz and 30 GHz, also referred to as centimeter waves. Communications using mmW / near mmW radio frequency bands have high path loss and a relatively short range. The mmW base station 180 and the UE 182 may utilize beamforming (sending and / or receiving) on ​​the mmW communication link 184 to compensate for extremely high path loss and short distance. In addition, it will be appreciated that in an alternative configuration, one or more base stations 102 may also use mmW or near mmW and beamforming for transmission. Therefore, it should be understood that the foregoing description is only exemplary and should not be construed as limiting the various aspects disclosed herein.

[0038] Transmit beamforming is a technique for focusing an RF signal in a specific direction. Traditionally, when a network node (e.g., a base station) broadcasts an RF signal, it broadcasts the signal in all directions (omnidirectionally). With transmit beamforming, the network node determines the location of a given target device (e.g., UE) (relative to the transmitting network node) and projects a stronger downlink RF signal in that specific direction, thereby providing a faster and stronger RF signal (in terms of data rate) to the receiving device. In order to change the directionality of the RF signal when transmitting, the network node can control the phase and relative amplitude of the RF signal at each of the one or more transmitters that are broadcasting the RF signal. For example, the network node can use an antenna array (referred to as a "phased array" or "antenna array") that creates an RF beam that can be "steered" to point in different directions without actually moving the antenna. Specifically, the RF current from the transmitter is fed to each antenna in the correct phase relationship so that the radio waves from the individual antennas are added together to increase the radiation in the desired direction while canceling to suppress the radiation in the undesired direction.

[0039] The transmit beams can be quasi-co-located, which means that they appear to have the same parameters to the receiver (e.g., UE), regardless of whether the transmit antennas of the network nodes themselves are physically co-located. In NR, there are four types of quasi-co-location (QCL) relationships. Specifically, a given type of QCL relationship means that certain parameters about the second reference RF signal on the second beam can be derived from information about the source reference RF signal on the source beam. Therefore, if the source reference RF signal is QCL type A, the receiver can use the source reference RF signal to estimate the Doppler shift, Doppler spread, average delay, and delay spread of the second reference RF signal sent on the same channel. If the source reference RF signal is QCL type B, the receiver can use the source reference RF signal to estimate the Doppler shift and Doppler spread of the second reference RF signal sent on the same channel. If the source reference RF signal is QCL type C, the receiver can use the source reference RF signal to estimate the Doppler shift and average delay of the second reference RF signal sent on the same channel. If the source reference RF signal is QCL type D, the receiver can use the source reference RF signal to estimate the spatial reception parameters of the second reference RF signal sent on the same channel.

[0040] In receive beamforming, a receiver uses a receive beam to amplify an RF signal detected on a given channel. For example, a receiver may increase the gain setting of an antenna array and / or adjust the phase setting of an antenna array in a particular direction to amplify (e.g., increase its gain level) RF signals received from that direction. Thus, when a receiver is referred to as performing beamforming in a certain direction, this means that the beam gain in that direction is high relative to the beam gain along other directions, or that the beam gain in that direction is the highest relative to the beam gain in the directions of all other receive beams available to the receiver. This results in a stronger received signal strength (e.g., reference signal received power (RSRP), reference signal received quality (RSRQ), signal to interference plus noise ratio (SINR), etc.) of the RF signal received from that direction.

[0041] The receive beams may be spatially correlated. The spatial relationship means that the parameters of the transmit beam of the second reference signal may be derived from the information about the receive beam of the first reference signal. For example, the UE may use a specific receive beam to receive one or more reference downlink reference signals (e.g., positioning reference signal (PRS), tracking reference signal (TRS), phase tracking reference signal (PTRS), cell-specific reference signal (CRS), channel state information reference signal (CSI-RS), primary synchronization signal (PSS), secondary synchronization signal (SSS), synchronization signal block (SSB), etc.) from a base station. The UE may then form a transmit beam based on the parameters of the receive beam for sending one or more uplink reference signals (e.g., uplink positioning reference signal (UL-PRS), sounding reference signal (SRS), demodulation reference signal (DMRS), PTRS, etc.) to the base station.

[0042] Note that the terms "positioning reference signal" and "PRS" may sometimes refer to a specific reference signal used for positioning in an LTE system. However, as used herein, unless otherwise indicated, the terms "positioning reference signal" and "PRS" refer to any type of reference signal that can be used for positioning, such as, but not limited to, PRS, TRS, PTRS, CRS, CSI-RS, DMRS, PSS, SSS, SSB, SRS, UL-PRS, etc. in LTE and 5G. In addition, unless otherwise indicated, the terms "positioning reference signal" and "PRS" refer to downlink or uplink positioning reference signals. A downlink positioning reference signal may be referred to as a "DL-PRS", while an uplink positioning reference signal (e.g., SRS, PTRS used for positioning) may be referred to as a "UL-PRS". In addition, for signals (e.g., DMRS, PTRS) that can be transmitted in both the uplink and downlink, "UL" or "DL" may be prefixed to the signal to distinguish the direction. For example, "UL-DMRS" may be distinguished from "DL-DMRS".

[0043] Also note that a "downlink" beam can be either a transmit beam or a receive beam, depending on the entity that forms it. For example, if the base station is forming a downlink beam that transmits a reference signal to the UE, the downlink beam is a transmit beam. However, if the UE is forming a downlink beam, it is a receive beam that receives a downlink reference signal. Similarly, an "uplink" beam can be either a transmit beam or a receive beam, depending on the entity that forms it. For example, if the base station is forming an uplink beam, it is an uplink receive beam, and if the UE is forming an uplink beam, it is an uplink transmit beam.

[0044] In 5G, the spectrum in which wireless nodes (e.g., base stations 102 / 180, UEs 104 / 182) operate is divided into multiple frequency ranges, FR1 (from 450 to 6000 MHz), FR2 (from 24250 to 52600 MHz), FR3 (above 52600 MHz), and FR4 (between FR1 and FR2). In a multi-carrier system (such as 5G), one of the carrier frequencies is called the "primary carrier" or "anchor carrier" or "primary serving cell" or "PCell", and the remaining carrier frequencies are called "secondary carriers" or "secondary serving cells" or "Scells". In carrier aggregation, the anchor carrier is a carrier operating on the primary frequency (e.g., FR1) utilized by the UE 104 / 182 and the cell in which the UE 104 / 182 either performs an initial radio resource control (RRC) connection establishment procedure or initiates an RRC connection reestablishment procedure. The primary carrier carries all common and UE-specific control channels and can be a carrier in a licensed frequency (however, this is not always the case). A secondary carrier is a carrier operating on a secondary frequency (e.g., FR2), which can be configured once an RRC connection is established between UE104 and the anchor carrier, and can be used to provide additional radio resources. In some cases, a secondary carrier may be a carrier in an unlicensed frequency. The secondary carrier may contain only necessary signaling information and signals, for example, those UE-specific information and signals may not be present in the secondary carrier, because both the primary uplink and downlink carriers are typically UE-specific. This means that different UEs 104 / 182 in a cell may have different downlink primary carriers. This is also true for the uplink primary carrier. The network is able to change the primary carrier of any UE 104 / 182 at any time. For example, this is done to balance the load on different carriers. Because a "serving cell" (PCell or SCell) corresponds to a carrier frequency / component carrier on which some base stations are communicating, the terms "cell", "serving cell", "component carrier", "carrier frequency", etc. can be used interchangeably.

[0045] For example, still refer to Figure 1 , one of the frequencies utilized by the macrocell base station 102 may be an anchor carrier (or "PCell"), while the other frequencies utilized by the macrocell base station 102 and / or the mmW base station 180 may be secondary carriers ("SCells"). The simultaneous transmission and / or reception of multiple carriers enables the UE 104 / 182 to significantly increase its data transmission and / or reception rate. For example, two 20 MHz aggregated carriers in a multi-carrier system would theoretically result in a two-fold increase in data rate (i.e., 40 MHz) compared to the data rate obtained with a single 20 MHz carrier.

[0046] The wireless communication system 100 may also include one or more UEs (such as UE 190) indirectly connected to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links. Figure 1 In the example of FIG. 1 , UE 190 has a D2D P2P link 192 with one of UEs 104 connected to one of base stations 102 (e.g., through which UE 190 can indirectly obtain a cellular connection), and a D2D P2P link 194 with a WLAN STA 152 connected to a WLAN AP 150 (through which UE 190 can indirectly obtain a WLAN-based Internet connection). In the example, D2D P2P links 192 and 194 can be provided by any well-known D2D RAT (such as LTE Direct (LTE-D), WiFi Direct (WiFi-D), etc.) to support.

[0047] The wireless communication system 100 may also include a UE 164 that may communicate with the macrocell base station 102 via a communication link 120 and / or communicate with the mmW base station 180 via a mmW communication link 184. For example, for the UE 164, the macrocell base station 102 may support a PCell and one or more Scells, and for the UE 164, the mmW base station 180 may support one or more Scells.

[0048] According to various aspects, Figure 2A An example wireless network architecture 200 is shown. For example, 5GC 210 (also referred to as Next Generation Core (NGC)) can be functionally viewed as control plane functions 214 (e.g., UE registration, authentication, network access, gateway selection, etc.) and user plane functions 212 (e.g., UE gateway functions, data network access, IP routing, etc.), which operate in conjunction to form a core network. User plane interface (NG-U) 213 and control plane interface (NG-C) 215 connect gNB 222 to 5GC 210, and specifically to control plane functions 214 and user plane functions 212. In additional configurations, ng-eNB 224 can also be connected to 5GC 210 via NG-C 215, to control plane functions 214 via NG-C 215, and to user plane functions 212 via NG-U 213. In addition, ng-eNB 224 can communicate directly with gNB 222 via backhaul connection 223. In some configurations, the new RAN 220 may have only one or more gNBs 222, while other configurations include one or more of ng-eNB 224 and gNB 222. The gNB 222 or ng-eNB 224 may communicate with the UE 204 (e.g., Figure 1204). Another optional aspect may include a location server 230 that can communicate with the 5GC 210 to provide location assistance for the UE 204. The location server 230 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules distributed on multiple physical servers, etc.) or alternatively, each location server 230 can correspond to a single server. The location server 230 can be configured to support one or more location services for the UE 204 that can be connected to the location server 230 via the core network 5GC 210 and / or via the Internet (not shown). In addition, the location server 230 can be integrated into a component of the core network or can be external to the core network.

[0049] According to various aspects, Figure 2B Another example wireless network structure 250 is shown. For example, the 5GC 260 can be functionally viewed as a control plane function provided by an access and mobility management function (AMF) 264 and a user plane function provided by a user plane function (UPF) 262, which operate in conjunction to form a core network (i.e., the 5GC 260). The user plane interface 263 and the control plane interface 265 connect the ng-eNB 224 to the 5GC 260, and specifically connect the ng-eNB 224 to the UPF 262 and the AMF 264, respectively. In additional configurations, the gNB 222 can also be connected to the 5GC 260 via a control plane interface 265 to the AMF 264 and a user plane interface 263 to the UPF 262. In addition, the ng-eNB 224 can communicate directly with the gNB 222 via a backhaul connection 223, with or without a gNB direct connection to the 5GC 260. In some configurations, the new RAN 220 may have only one or more gNBs 222, while other configurations include one or more of ng-eNB 224 and gNB 222. The gNB 222 or ng-eNB 224 may communicate with the UE 204 (e.g., Figure 1 The base stations of the new RAN 220 communicate with the AMF 264 via the N2 interface and with the UPF 262 via the N3 interface.

[0050] The functions of AMF 264 include registration management, connection management, reachability management, mobility management, lawful interception, transmission of session management (SM) messages between UE 204 and session management function (SMF) 266, transparent proxy service for routing SM messages, access authentication and access authorization, transmission of short message service (SMS) messages between UE 204 and short message service function (SMSF) (not shown), and security anchor function (SEAF). AMF 264 also interacts with authentication server function (AUSF) (not shown) and UE 204, and receives intermediate keys established as a result of the UE 204 authentication process. In the case of authentication based on UMTS (Universal Mobile Telecommunications System) Subscriber Identity Module (USIM), AMF 264 retrieves security materials from AUSF. The functions of AMF 264 also include security context management (SCM). SCM receives keys from SEAF that it uses to derive access network specific keys. The functions of AMF 264 also include location service management for regulatory services, transmission of location service messages between UE 204 and location management function (LMF) 270 (which acts as location server 230), transmission of location service messages between new RAN 220 and LMF 270, allocation of EPS bearer identifiers for interaction with Evolved Packet System (EPS), and notification of mobility events for UE 204. In addition, AMF 264 also supports the functions of non-3GPP (3rd Generation Partnership Project) access networks.

[0051] The functions of UPF 262 include acting as an anchor point for intra-RAT / inter-RAT mobility (when applicable); acting as an external protocol data unit (PDU) session point for interconnection with a data network (not shown); providing packet routing and forwarding, packet inspection, user plane policy rule enforcement (e.g., gating, redirection, traffic steering), lawful interception (user plane collection), traffic usage reporting, user plane quality of service (QoS) processing (e.g., uplink / downlink rate enforcement, reflective QoS marking in downlink), uplink traffic verification (service data flow (SDF) to QoS flow mapping), transport layer packet marking in uplink and downlink, downlink packet buffering and downlink data notification triggering, and sending and forwarding one or more "end markers" to the source RAN node. UPF 262 can also support the transmission of location service messages through the user plane between UE 204 and a location server (such as a secure user plane location (SUPL) location platform (SLP) 272).

[0052] The functions of SMF 266 include session management, UE Internet Protocol (IP) address allocation and management, selection and control of user plane functions, configuration of traffic steering at UPF 262 to route traffic to the appropriate destination, partial policy enforcement and QoS control, and downlink data notification. The interface through which SMF 266 communicates with AMF 264 is called the N11 interface.

[0053] Another optional aspect may include an LMF 270 that can communicate with the 5GC 260 to provide location assistance for the UE 204. The LMF 270 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules distributed on multiple physical servers, etc.) or alternatively, each LMF 270 can correspond to a single server. The LMF 270 can be configured to support one or more location services for the UE 204, and the UE 204 can be connected to the LMF 270 via the core network 5GC 260 and / or via the Internet (not shown). The SLP 272 can support similar functionality to the LMF 270, but the LMF 270 can communicate with the AMF 264, the new RAN 220, and the UE 204 via the control plane (e.g., using interfaces and protocols intended to transmit signaling messages rather than voice or data), and the SLP 272 can communicate with the UE 204 and external clients (not in the user plane) via the user plane. Figure 2B ) communications (e.g., using protocols intended to carry voice and / or data, such as the Transmission Control Protocol (TCP) and / or IP).

[0054] Figure 3A , Figure 3B and Figure 3C Several example components (represented by corresponding boxes) are shown, which can be incorporated into UE 302 (which can correspond to any UE described herein), base station 304 (which can correspond to any base station described herein), and network entity 306 (which can correspond to or implement any network function described herein, including location server 230, LMF 270 and SLP 272) to support the file transfer operations taught herein. It should be understood that in different implementations, these components can be implemented in different types of devices (e.g., in ASICs, in systems on chips (SoCs), etc.). The components shown can also be incorporated into other devices in the communication system. For example, other devices in the system may include components similar to the components described to provide similar functions. In addition, a given device may include one or more of the components. For example, a device may include multiple transceiver components that enable the device to operate on multiple carriers and / or communicate via different technologies.

[0055] UE 302 and base station 304 each include a wireless wide area network (WWAN) transceiver 310 and 350, respectively, that provides components (e.g., components for transmitting, components for receiving, components for measuring, components for tuning, components for suppressing transmission, etc.) for communicating via one or more wireless communication networks (not shown), such as NR networks, LTE networks, GSM networks, etc. WWAN transceivers 310 and 350 may be connected to one or more antennas 316 and 356, respectively, for communicating with other network nodes (such as other UEs, access points, base stations (e.g., ng-eNBs, gNBs), etc.) via at least one designated RAT (e.g., NR, LTE, GSM, etc.) over a wireless communication medium of interest (e.g., certain sets of time / frequency resources in a particular spectrum). Depending on the specified RAT, the WWAN transceivers 310 and 350 can be configured differently to send and encode signals 318 and 358 (e.g., messages, indications, information, etc.), respectively, and conversely, receive and decode signals 318 and 358 (e.g., messages, indications, information, pilots, etc.), respectively. Specifically, the transceivers 310 and 350 include one or more transmitters 314 and 354 for sending and encoding signals 318 and 358, respectively, and one or more receivers 312 and 352 for receiving and decoding signals 318 and 358, respectively.

[0056] At least in some cases, UE 302 and base station 304 also include wireless local area network (WLAN) transceivers 320 and 360, respectively. WLAN transceivers 320 and 360 can be connected to one or more antennas 326 and 366, respectively, and provide for communicating via at least one designated RAT (e.g., WiFi, LTE-D, The WLAN transceivers 320 and 360 may be configured to transmit and encode signals 328 and 368 (e.g., messages, indications, information, etc.), respectively, and conversely, to receive and decode signals 328 and 368 (e.g., messages, indications, information, pilots, etc.), respectively, according to the specified RAT. Specifically, the transceivers 320 and 360 include one or more transmitters 324 and 364 for transmitting and encoding signals 328 and 368, respectively, and one or more receivers 322 and 362 for receiving and decoding signals 328 and 368, respectively.

[0057] In some implementations, the transceiver circuitry including at least one transmitter and at least one receiver may include an integrated unit or device (e.g., a transmitter circuit and a receiver circuit implemented as a single communication unit or communication device), may include separate transmitter devices and separate receiver devices in some implementations, or may be implemented in other ways in other implementations. In one aspect, the transmitter may include or be coupled to multiple antennas (e.g., antennas 316, 326, 356, 366) (such as an antenna array) that allow the corresponding device to perform transmit "beamforming", as described herein. Similarly, the receiver may include or be coupled to multiple antennas (e.g., antennas 316, 326, 356, 366) (such as an antenna array) that allow the corresponding device to perform receive beamforming, as described herein. In one aspect, the transmitter and receiver may share the same multiple antennas (e.g., antennas 316, 326, 356, 366) so that the corresponding device can only receive or transmit at a given time, but not simultaneously. The wireless communication unit or communication device of the UE 302 and / or the base station 304 (eg, one or both of the transceivers 310 and 320 and / or 350 and 360) may also include a network listening module (NLM) or the like for performing various measurements.

[0058] At least in some cases, UE 302 and base station 304 also include satellite positioning system (SPS) receivers 330 and 370, respectively. SPS receivers 330 and 370 can be connected to one or more antennas 336 and 376, respectively, and can provide components for receiving and / or measuring SPS signals 338 and 378, respectively, such as global positioning system (GPS) signals, global navigation satellite system (GLONASS) signals, Galileo signals, Beidou signals, Indian regional navigation satellite system (NAVIC), Quasi-Zenith Satellite System (QZSS), etc. SPS receivers 330 and 370 can include any suitable hardware and / or software for receiving and processing SPS signals 338 and 378, respectively. SPS receivers 330 and 370 request appropriate information and operations from other systems, and use measurements obtained by any suitable SPS algorithm to perform calculations required to determine the location of UE 302 and base station 304.

[0059] The base station 304 and the network entity 306 each include at least one network interface 380 and 390, respectively, that provide components for communicating with other network entities (e.g., components for sending, components for receiving, etc.). For example, the network interfaces 380 and 390 (e.g., one or more network access ports) can be configured to communicate with one or more network entities via a wired or wireless backhaul connection. In some aspects, the network interfaces 380 and 390 can be implemented as transceivers configured to support wired or wireless signal communication. The communication can involve, for example, sending and receiving messages, parameters, and / or other types of information.

[0060] UE 302, base station 304, and network entity 306 also include other components that can be used in conjunction with the operations disclosed herein. UE 302 includes a processor circuit that implements a processing system 332, which is used to provide functions related to, for example, FBS detection operations and for providing other processing functions. Base station 304 includes a processing system 384 for providing functions related to, for example, FBS detection operations disclosed herein and for providing other processing functions. Network entity 306 includes a processing system 394 for providing functions related to, for example, FBS detection operations disclosed herein and for providing other processing functions. Processing systems 332, 384, and 394 can therefore provide components for processing, such as components for determining, components for calculating, components for receiving, components for sending, components for indicating, etc. In one aspect, processing systems 332, 384, and 394 can include, for example, one or more general-purpose processors, multi-core processors, ASICs, digital signal processors (DSPs), field programmable gate arrays (FPGAs), or other programmable logic devices or processing circuits.

[0061] UE 302, base station 304, and network entity 306, respectively, include memory circuitry implementing memory components 340, 386, and 396 (e.g., each including a memory device) for maintaining information (e.g., information indicating reserved resources, thresholds, parameters, etc.). Thus, memory components 340, 386, and 396 may provide means for storing, means for retrieving, means for maintaining, etc. In some cases, UE 302, base station 304, and network entity 306 may include FBS detection components 342, 388, and 398, respectively. FBS detection components 342, 388, and 398 may be hardware circuitry that is part of or coupled to processing systems 332, 384, and 394, respectively, which, when executed, causes UE 302, base station 304, and network entity 306 to perform the functions described herein. In other aspects, the FBS detection components 342, 388, and 398 can be external to the processing systems 332, 384, and 394 (e.g., part of a modem processing system, integrated with another processing system, etc.). Alternatively, the FBS detection components 342, 388, and 398 can be memory modules (e.g., memory modules) stored in the memory components 340, 386, and 396, respectively. FIG. 3A to FIG. 3C ), which, when executed by the processing systems 332, 384, and 394 (or a modem processing system, another processing system, etc.), causes the UE 302, the base station 304, and the network entity 306 to perform the functions described herein.

[0062] UE 302 may include one or more sensors 344 coupled to processing system 332 that provide components for sensing or detecting movement and / or orientation information that is independent of motion data derived from signals received by WWAN transceiver 310, WLAN transceiver 320, and / or SPS receiver 330. For example, sensor 344 may include an accelerometer (e.g., a micro-electromechanical system (MEMS) device), a gyroscope, a geomagnetic sensor (e.g., a compass), an altimeter (e.g., a barometric altimeter), and / or any other type of motion detection sensor. In addition, sensor 344 may include multiple different types of devices and combine their outputs to provide motion information. For example, sensor 344 may use a combination of a multi-axis accelerometer and an orientation sensor to provide the ability to calculate position in a 2D and / or 3D coordinate system.

[0063] In addition, UE 302 includes a user interface 346 that provides means for providing indications to a user (e.g., audible and / or visual indications) and / or for receiving user input (e.g., when a user activates a sensing device such as a keypad, touch screen, microphone, etc.). Although not shown, base station 304 and network entity 306 may also include a user interface.

[0064] Referring to the processing system 384 in more detail, in the downlink, IP packets from the network entity 306 may be provided to the processing system 384. The processing system 384 may implement the functions of the RRC layer, the Packet Data Convergence Protocol (PDCP) layer, the Radio Link Control (RLC) layer, and the Medium Access Control (MAC) layer. The processing system 384 may provide RRC layer functions associated with broadcasting of system information (e.g., master information block (MIB), system information block (SIB)), RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-RAT mobility, and measurement configuration for UE measurement reporting; PDCP layer functions related to header compression / decompression, security (ciphering, deciphering, integrity protection, integrity verification), and handover support functions; RLC layer functions associated with transmission of upper layer packet data units (PDUs), error correction through automatic repeat request (ARQ), concatenation, segmentation and reassembly of RLC service data units (SDUs), re-segmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functions associated with mapping between logical channels and transport channels, scheduling information reporting, error correction, priority handling, and logical channel prioritization.

[0065] The transmitter 354 and the receiver 352 can implement layer 1 functions associated with various signal processing functions. Layer 1, including the physical (PHY) layer, can include error detection on the transmission channel, forward error correction (FEC) encoding / decoding of the transmission channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. The transmitter 354 processes the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-phase shift keying (M-PSK), M-quadrature amplitude modulation (M-QAM)). The coded and modulated symbols can then be divided into parallel streams. Each stream can then be mapped to an orthogonal frequency division multiplexing (OFDM) subcarrier, multiplexed with a reference signal (e.g., pilot) in the time domain and / or frequency domain, and then combined together using an inverse fast Fourier transform (IFFT) to produce a physical channel carrying a time domain OFDM symbol stream. The OFDM symbol stream is spatially precoded to produce multiple spatial streams. The channel estimate from the channel estimator may be used to determine the coding and modulation schemes, as well as for spatial processing. The channel estimate may be derived from channel condition feedback and / or a reference signal sent by the UE 302. Each spatial stream may then be provided to one or more different antennas 356. The transmitter 354 may modulate an RF carrier with a corresponding spatial stream for transmission.

[0066] At UE 302, receiver 312 receives the signal through its corresponding antenna 316. Receiver 312 recovers the information modulated onto the RF carrier and provides the information to processing system 332. Transmitter 314 and receiver 312 implement layer 1 functions associated with various signal processing functions. Receiver 312 can perform spatial processing on the information to recover any spatial stream destined for UE 302. If the destination of multiple spatial streams is UE 302, receiver 312 can combine them into a single OFDM symbol stream. Receiver 312 then converts the OFDM symbol stream from the time domain to the frequency domain using a fast Fourier transform (FFT). The frequency domain signal includes a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols and reference signals on each subcarrier are recovered and demodulated by determining the most likely signal constellation point sent by base station 304. These soft decisions can be based on channel estimates calculated by a channel estimator. The soft decisions are then decoded and deinterleaved to recover the data and control signals originally sent by base station 304 on the physical channel. The data and control signals are then provided to a processing system 332 that implements layer 3 and layer 2 functions.

[0067] In the uplink, the processing system 332 provides demultiplexing between transport channels and logical channels, packet reassembly, decryption, header decompression, and control signal processing to recover IP packets from the core network. The processing system 332 is also responsible for error detection.

[0068] Similar to the functions described in conjunction with the downlink transmission of the base station 304, the processing system 332 provides RRC layer functions associated with system information (e.g., MIB, SIB) acquisition, RRC connection, and measurement reporting; PDCP layer functions related to header compression / decompression and security (encryption, decryption, integrity protection, integrity verification); RLC layer functions associated with transmission of upper layer PDUs, error correction through ARQ, concatenation, segmentation and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functions associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs to transport blocks (TBs), demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through hybrid automatic repeat request (HARQ), priority handling, and logical channel prioritization.

[0069] The transmitter 314 may select an appropriate coding and modulation scheme and facilitate spatial processing using channel estimates derived by a channel estimator from feedback or reference signals sent by the base station 304. The spatial streams generated by the transmitter 314 may be provided to different antennas 316. The transmitter 314 may modulate an RF carrier with a corresponding spatial stream for transmission.

[0070] At the base station 304, the uplink transmission is processed in a manner similar to that described in conjunction with the receiver functionality at the UE 302. The receiver 352 receives the signal through its respective antenna 356. The receiver 352 recovers the information modulated onto the RF carrier and provides the information to the processing system 384.

[0071] In the uplink, the processing system 384 provides demultiplexing between transport and logical channels, packet reassembly, decryption, header decompression, control signal processing to recover IP packets from the UE 302. The IP packets from the processing system 384 may be provided to the core network. The processing system 384 is also responsible for error detection.

[0072] For convenience, UE 302, base station 304 and / or network entity 306 may be configured to: FIG. 3A to FIG. 3C The 3D-printed embodiment is shown as including various components that can be configured according to various examples described herein. However, it should be understood that in different designs, the blocks shown may have different functions.

[0073] The various components of UE 302, base station 304, and network entity 306 may communicate with each other via data buses 334, 382, ​​and 392, respectively. FIG. 3A to FIG. 3C The components of can be implemented in various ways. In some implementations, FIG. 3A to FIG. 3C The components may be implemented in one or more circuits, such as one or more processors and / or one or more ASICs (which may include one or more processors). Here, each circuit may use and / or be combined with at least one memory component for storing information or executable code used by the circuit to provide the functionality. For example, some or all of the functions represented by blocks 310 to 346 may be implemented by the processor and memory components of UE 302 (e.g., by executing appropriate code and / or by appropriate configuration of the processor components). Similarly, some or all of the functions represented by blocks 350 to 388 may be implemented by the processor and memory components of base station 304 (e.g., by executing appropriate code and / or by appropriate configuration of the processor components). In addition, some or all of the functions represented by blocks 390 to 398 may be implemented by the processor and memory components of network entity 306 (e.g., by executing appropriate code and / or by appropriate configuration of the processor components). For simplicity, various operations, actions, and / or functions are described herein as being performed by "UE", "base station", "positioning entity", etc. However, it should be understood that these operations, actions and / or functions may actually be performed by specific components or combinations of components of the UE, base station, positioning entity (such as processing systems 332, 384, 394; transceivers 310, 320, 350 and 360; memory components 340, 386 and 396; FBS detection components 342, 388 and 398, etc.).

[0074] Figure 4A FIG. 2 shows a user plane protocol stack according to various aspects of the present disclosure. Figure 4A As shown, UE 404 and base station 402 (which may correspond to any UE and base station described herein, respectively) implement service data adaptation protocol (SDAP) layer 410, PDCP layer 415, RLC layer 420, MAC layer 425 and PHY layer 430 from the highest layer to the lowest layer. Figure 4A As shown by the double-arrow lines in , each layer of the protocol stack implemented by UE 404 communicates with the same layer of base station 402, and vice versa. SDAP layer 410, PDCP layer 415, RLC layer 420, and MAC layer 425 are collectively referred to as "Layer 2" or "L2".

[0075] Figure 4B A control plane protocol stack according to aspects of the present disclosure is shown. In addition to the PDCP layer 415, the RLC layer 420, the MAC layer 425, and the PHY layer 430, the UE 404 and the base station 402 also implement the RRC layer 445. In addition, the UE 404 and the AMF 406 (eg, AMF 264) implement the NAS layer 440.

[0076] The main services and functions of the RLC layer 420 depend on the transmission mode and include delivery of upper layer PDUs, sequence numbering independent of sequence numbering in the PDCP layer 415, error correction through ARQ, segmentation and re-segmentation, reassembly of service data units (SDUs), RLC SDU discard, and RLC re-establishment. The ARQ function provides error correction in AM mode and has the following features: ARQ retransmits RLC PDUs or RLC PDU segments based on RLC status reports, RLC uses polling for RLC status reports when needed, and the RLC receiver can also trigger an RLC status report after detecting a lost RLC PDU or RLC PDU segment.

[0077] The main services and functions of the PDCP layer 415 of the user plane include sequence numbering, header compression and decompression (only for robust header compression (ROHC)), delivery of user data, reordering and duplicate detection (if in-sequence delivery to layers above the PDCP layer 415 is required), PDCP PDU routing (in the case of split bearers), retransmission, ciphering and deciphering of PDCP SDUs, PDCP SDU discard, PDCP re-establishment and data recovery of RLC AM, and duplication of PDCP PDUs. The main services and functions of the PDCP layer 415 of the control plane include ciphering, deciphering and integrity protection, delivery of control plane data, and duplication of PDCP PDUs.

[0078] The SDAP layer 410 is an access stratum (AS) layer whose main services and functions include mapping between QoS flows and data radio bearers and marking QoS flow IDs in both DL and UL packets. A single SDAP protocol entity is configured for each individual PDU session.

[0079] The main services and functions of the RRC layer 445 include broadcasting of system information related to AS and NAS, paging initiated by 5GC (e.g., NGC 210 or 260) or RAN (e.g., new RAN 220), establishment, maintenance and release of RRC connection between UE and RAN, security functions including key management, establishment, configuration, maintenance and release of signaling radio bearers (SRBs) and data radio bearers (DRBs), mobility functions (including handover, UE cell selection and reselection and control of cell selection and reselection, context transfer during handover), QoS management functions, UE measurement reporting and control of reporting, and NAS message transmission from / to UE.

[0080] The NAS layer 440 is the highest layer of the control plane between the UE 404 and the AMF 406 at the radio interface. The main functions of the protocols that are part of the NAS layer 440 are to support the mobility of the UE 404 and to support session management procedures to establish and maintain an IP connection between the UE 404 and the packet data network. The NAS layer 440 performs EPS bearer management, authentication, EPS Connection Management (ECM)-IDLE mobility handling, paging initiation in ECM-IDLE, and security control.

[0081] Figure 5A is a diagram 500 illustrating an example of a downlink frame structure in accordance with aspects of the present disclosure. Figure 5B is a diagram 530 illustrating an example of channels within a downlink frame structure in accordance with aspects of the present disclosure. Figure 5C is a diagram 550 illustrating an example of an uplink frame structure in accordance with aspects of the present disclosure. Figure 5D is a diagram 580 illustrating an example of channels within an uplink frame structure in accordance with aspects of the present disclosure. Other wireless communication technologies may have different frame structures and / or different channels.

[0082] LTE, and in some cases NR, utilizes OFDM on the downlink and single carrier frequency division multiplexing (SC-FDM) on the uplink. However, unlike LTE, NR can also choose to use OFDM on the uplink. OFDM and SC-FDM divide the system bandwidth into multiple (K) orthogonal subcarriers, which are also commonly referred to as tones, bins, etc. Each subcarrier can be modulated with data. In general, modulation symbols are sent in the frequency domain with OFDM, and modulation symbols are sent in the time domain with SC-FDM. The spacing between adjacent subcarriers can be fixed, and the total number of subcarriers (K) can depend on the system bandwidth. For example, the spacing of the subcarriers can be 15kHz, and the minimum resource allocation (resource block) can be 12 subcarriers (or 180kHz). Therefore, for system bandwidths of 1.25, 2.5, 5, 10, or 20 megahertz (MHz), the nominal FFT size can be equal to 128, 256, 512, 1024, or 2048, respectively. The system bandwidth may also be divided into subbands. For example, a subband may cover 1.08 MHz (ie, 6 resource blocks), and there may be 1, 2, 4, 8, or 16 subbands for system bandwidths of 1.25, 2.5, 5, 10, or 20 MHz, respectively.

[0083] LTE supports a single numerology (subcarrier spacing, symbol length, etc.). In contrast, NR can support multiple numerology sets (μ), for example, 15kHz, 30kHz, 60kHz, 120kHz, and 240kHz or larger subcarrier spacing can be used. Table 1 provided below lists some of the different parameters of different NR numerology sets.

[0084]

[0085] Table 1

[0086] exist FIG. 5A to FIG. 5D In the example of , a 15kHz digital parameter set is used. Therefore, in the time domain, a frame (e.g., 10 milliseconds (ms)) is divided into 10 equally sized subframes, each subframe is 1 ms, and each subframe includes one time slot. FIG. 5A to FIG. 5D , the horizontal direction (eg, on the X-axis) represents time, which increases from left to right, and the vertical direction (eg, on the Y-axis) represents frequency, which increases (or decreases) from bottom to top.

[0087] A resource grid may be used to represent a time slot, each of which includes one or more time-concurrent resource blocks (RBs) (also referred to as physical RBs (PRBs)) in the frequency domain. A resource grid is further divided into a plurality of resource elements (REs). An RE may correspond to one symbol length in the time domain and one subcarrier in the frequency domain. FIG. 5A to FIG. 5D In the digital parameter set, for a normal cyclic prefix, an RB can contain 12 consecutive subcarriers in the frequency domain, 7 consecutive symbols in the time domain, and a total of 84 REs. For an extended cyclic prefix, an RB can contain 12 consecutive subcarriers in the frequency domain, 6 consecutive symbols in the time domain, and a total of 72 REs.

[0088] Some of the REs may carry downlink reference (pilot) signals (DL-RS). DL-RS may include PR, TRS, PTRS, CRS, CSI-RS, DMRS, PSS, SSS, SSB, etc. in LTE and 5G. Figure 5A Example locations of REs carrying DL-RS (labeled “R”), such as DL-PRS with a comb-6 PRS resource configuration, are shown.

[0089] Figure 5B An example of various channels within a downlink timeslot of a radio frame is shown. In NR, the channel bandwidth or system bandwidth is divided into multiple bandwidth parts (BWPs). A BWP is a contiguous set of PRBs selected from a contiguous subset of common RBs for a given set of digital parameters on a given carrier. Generally, up to four BWPs can be specified in the downlink and uplink. That is, a UE can be configured with up to four BWPs on the downlink and up to four BWPs on the uplink. At a given time, only one BWP (uplink or downlink) can be active, which means that the UE can only receive or transmit on one BWP at a time. On the downlink, the bandwidth of each BWP should be equal to or greater than the bandwidth of the SSB, but it may or may not contain the SSB.

[0090] refer to Figure 5B, the UE uses the primary synchronization signal (PSS) to determine the subframe / symbol timing and physical layer identification. The UE uses the secondary synchronization signal (SSS) to determine the physical layer cell identification group number and the radio frame timing. Based on the physical layer identification and the physical layer cell identification group number, the UE can determine the PCI. Based on the PCI, the UE can determine the location of the aforementioned DL-RS. The physical broadcast channel (PBCH) carrying the MIB can be logically grouped with the PSS and SSS to form an SSB (also referred to as an SS / PBCH block). The MIB provides the number of RBs in the downlink system bandwidth and the system frame number (SFN). The physical downlink shared channel (PDSCH) carries user data, broadcast system information that is not sent through the PBCH, such as system information blocks (SIBs) and paging messages.

[0091] The physical downlink control channel (PDCCH) carries downlink control information (DCI) in one or more control channel elements (CCEs), each CCE includes one or more RE group (REG) bundles (which can span multiple symbols in the time domain), each REG bundle includes one or more REGs, each REG corresponds to 12 resource elements (one resource block) in the frequency domain and one OFDM symbol in the time domain. The set of physical resources used to carry PDCCH / DCI is called a control resource set (CORESET) in NR. In NR, PDCCH is confined to a single CORESET and is transmitted using its own DMRS. This enables UE-specific beamforming for PDCCH.

[0092] exist Figure 5B In the example of , there is one CORESET per BWP and the CORESET spans three symbols in the time domain. Unlike the LTE control channel which occupies the entire system bandwidth, in NR, the PDCCH channel is confined to a specific region (i.e., CORESET) in the frequency domain. Therefore, Figure 5B The frequency components of the PDCCH shown in are shown as being smaller than a single BWP in the frequency domain. Note that although the CORESETs shown are contiguous in the frequency domain, this is not a requirement. Furthermore, a CORESET may span less than three symbols in the time domain.

[0093] The DCI within the PDCCH carries information about uplink resource allocations (persistent and non-persistent) and a description of downlink data sent to the UE, referred to as uplink and downlink grants, respectively. More specifically, the DCI indicates resources scheduled for downlink data channels (e.g., PDSCH) and uplink data channels (e.g., PUSCH). Multiple (e.g., up to eight) DCIs can be configured in the PDCCH, and these DCIs can have one of a variety of formats. For example, there are different DCI formats for uplink scheduling, downlink scheduling, uplink transmit power control (TPC), etc. The PDCCH can be transmitted by 1, 2, 4, 8, or 16 CCEs to accommodate different DCI payload sizes or coding rates.

[0094] like Figure 5C As shown, some of the REs carry a demodulation reference signal (DMRS) used for channel estimation at the base station. The UE may also send a sounding reference signal (SRS), for example in the last symbol of a subframe. The SRS may have a comb structure, and the UE may send the SRS on one of the comb structures. The comb structure (also referred to as the "comb size") indicates the number of subcarriers that carry a reference signal (here, the SRS) in each symbol period. For example, a comb size of comb-4 means that every fourth subcarrier of a given symbol carries a reference signal, while a comb size of comb-2 means that every second subcarrier of a given symbol carries a reference signal. Figure 5C In the example shown, the SRS shown are all comb-2. The base station can use SRS to obtain channel state information (CSI) for each UE. CSI describes how the RF signal propagates from the UE to the base station and represents the combined effects of scattering, fading, and power attenuation with distance. The system uses SRS for resource scheduling, link adaptation, massive MIMO, beam management, etc.

[0095] Figure 5DExamples of various channels within an uplink subframe of a frame according to various aspects of the present disclosure are shown. Based on the physical random access channel (PRACH) configuration, a random access channel (RACH) (also referred to as PRACH) can be within one or more subframes within a frame. The PRACH can include six consecutive RB pairs within a subframe. The PRACH allows the UE to perform initial system access and achieve uplink synchronization. The physical uplink control channel (PUCCH) can be located at the edge of the uplink system bandwidth. The PUCCH carries uplink control information (UCI), such as scheduling requests, CSI reports, channel quality indicators (CQI), precoding matrix indicators (PMI), rank indicators (RI), and HARQ ACK / NACK feedback. The physical uplink shared channel (PUSCH) carries data and can be used to carry buffer status reports (BSRs), power headroom reports (PHRs), and / or UCI in addition.

[0096] NR supports a variety of cellular network-based positioning technologies, including downlink-based, uplink-based, and downlink- and uplink-based positioning methods. Downlink-based positioning methods include observed time difference of arrival (OTDOA) in LTE, downlink time difference of arrival (DL-TDOA) in NR, and downlink angle of departure (DL-AoD) in NR. In the OTDOA or DL-TDOA positioning process, the UE measures the difference between the arrival time (ToA) of the reference signals (e.g., PRS, TRS, CSI-RS, SSB, etc.) received from the base station (referred to as reference signal time difference (RSTD) or arrival time difference (TDOA) measurement) and reports them to the positioning entity. More specifically, the UE receives identifiers of a reference base station (e.g., a serving base station) and multiple non-reference base stations in the positioning assistance data. The UE then measures the RSTD between each of the reference base station and the non-reference base station. Based on the known positions of the base stations involved and the RSTD measurements, the positioning entity can estimate the position of the UE. For DL-AoD positioning, a base station measures the angle of a downlink transmit beam used to communicate with a UE and other channel properties (eg, signal strength) to estimate the position of the UE.

[0097] In a UL-TDOA session, the UE sends an uplink reference signal (e.g., SRS) received by a reference base station and one or more non-reference base stations. The base station reports the time of arrival (ToA) of the uplink reference signal to the positioning entity (e.g., UE, serving base station, location server 230, LMF 270, SLP 272), and the positioning entity calculates the RSTD of the uplink reference signal between the reference base station and each non-reference base station. Based on the known positions of the base stations involved and the RSTD measurements, the positioning entity can estimate the position of the UE.

[0098] Downlink and uplink-based positioning methods include enhanced cell ID (E-CID) positioning and multi-round trip time (RTT) positioning (also referred to as "multi-cell RTT"). In the RTT process, the initiator (base station or UE) sends an RTT measurement signal (e.g., PRS or SRS) to the responder (UE or base station), and the responder sends an RTT response signal (e.g., SRS or PRS) back to the initiator. The RTT response signal includes the difference between the ToA of the RTT measurement signal and the transmission time of the RTT response signal, which is called the receive-transmit (Rx-Tx) measurement. The initiator calculates the difference between the transmission time of the RTT measurement signal and the ToA of the RTT response signal, which is called the "Tx-Rx" measurement. The propagation time (also referred to as "flight time") between the initiator and the responder can be calculated by Tx-Rx and Rx-Tx measurements. Based on the propagation time and the known speed of light, the distance between the initiator and the responder can be determined. For multi-RTT positioning, the UE performs an RTT process with multiple base stations to enable triangulation of its position based on the known positions of the base stations. RTT and multi-RTT methods can be combined with other positioning techniques (such as UL-AoA and DL-AoD) to improve positioning accuracy.

[0099] The E-CID positioning method is based on radio resource management (RRM) measurements. In E-CID, the UE reports the serving cell ID, timing advance (TA), and the identifiers of detected neighboring base stations, estimated timing and signal strength. The UE's position is then estimated based on this information and the known locations of the base stations.

[0100] To assist the positioning operation, the location server (e.g., location server 230, LMF 270, SLP 272) may provide positioning assistance data (also referred to as location assistance information, positioning assistance information, assistance information, assistance data, etc.) to the UE. For example, the assistance data may include an identifier of the base station (or cell / TRP of the base station) from which the reference signal is measured, reference signal configuration parameters (e.g., the number of consecutive positioning time slots, the period of the positioning time slots, the muting sequence, the frequency hopping sequence, the reference signal identifier (ID), the reference signal bandwidth, the time slot offset, etc.), and / or other parameters applicable to a particular positioning method. Alternatively, the assistance data may originate directly from the base station itself (e.g., in a periodically broadcast overhead message, etc.). In some cases, the UE may be able to detect neighboring network nodes on its own without using assistance data.

[0101] In a DL-TDOA positioning session, for example, based on the PCI of the current serving cell reported by the UE, the assistance information may indicate the PCI of the reference cell and the neighboring cells, so that the UE can perform the required measurements in an efficient manner. In this case, the UE will typically perform DL-TDOA measurements only on reference signals from cells whose PCIs are listed in the assistance information. The location server typically provides this assistance information to the UE in a secure message that is integrity protected and encrypted (i.e., ciphered), as further described below. It can be safely assumed that an adversary (such as an FBS) has no ability to manipulate such assistance information. However, it should be noted that the UE may not always be able to obtain or need assistance information. For example, the UE may choose not to request assistance information and decide to perform the necessary positioning measurements for all cells that it can detect. In addition, for certain positioning techniques that rely on measurements at the base station or measurements of the E-CID technology at the UE, positioning assistance information may not be applicable.

[0102] Additional (or side) information is used together with the positioning measurements to calculate the position of the UE. For 5G NR positioning techniques, this side information may include, among other things, the geographical location of the base stations supporting the cells involved in the positioning measurements. For measurements at the UE, the side information will include the location of the base station from which the UE is measuring the reference signal. For measurements at the base station, the side information will include the location of the physical site of the base station.

[0103] Note that the calculation of the UE position can occur at the UE or at a location server in the network. In either case, the computing entity needs access to both positioning measurements and the necessary side information to perform the position calculation. Like the positioning assistance information, it can be assumed that the side information is provided to the computing entity in a secure manner and therefore may not be affected by an adversary such as the FBS. For example, the side information may be transmitted by an encrypted higher layer and not by an unencrypted lower layer, as discussed further below.

[0104] The position estimate may be referred to by other names such as a location estimate, location, position, position fix, fix, etc. The position estimate may be geodetic and include coordinates (e.g., latitude, longitude (possibly), and altitude) or may be civic and include a street address, postal address, or some other verbal description of the location. The position estimate may also be defined relative to some other known location, or in absolute terms (e.g., using latitude, longitude (possibly), and altitude). The position estimate may include an expected error or uncertainty (e.g., by including an area or volume within which the position is expected to be included with some specified or default confidence level).

[0105] Figure 6Detailed description of the present disclosure shows a DL-TDOA positioning process in an example wireless communication system 600 according to aspects of the present disclosure. Figure 6 In an example, a UE 604 (e.g., any UE described herein) attempts to compute an estimate of its location or assist another entity (e.g., a base station or core network component, another UE, a location server, a third-party application, etc.) in computing an estimate of its location. The UE 604 may wirelessly communicate with a plurality of base stations 602-1, 602-2, and 602-3 (collectively referred to as base stations 602) using RF signals and standardized protocols for RF signal modulation and information packet exchange, which may correspond to any combination of base stations described herein. By extracting different types of information from the exchanged RF signals and utilizing the layout of the wireless communication system 600 (e.g., the location, geometry, etc. of the base stations 602), the UE 604 may determine its location in a predefined reference coordinate system or assist in determining its location. In one aspect, the UE 604 may specify its location using a two-dimensional (2D) coordinate system; however, the aspects disclosed herein are not limited thereto and may also be applicable to determining a location using a three-dimensional (3D) coordinate system if additional dimensions are required. In addition, although Figure 6 One UE 604 and four base stations 602 are shown, but it should be understood that there may be more UEs 604 and more or fewer base stations 602.

[0106] To support position estimation, the base station 602 may be configured to broadcast positioning reference signals (e.g., PRS, TRS, CRS, CSI-RS, etc.) to UEs 604 in its coverage area to enable the UEs 604 to measure the characteristics of these reference signals. For example, as described above, the DL-TDOA positioning method is a multilateration method in which the UE 604 measures the time difference (referred to as RSTD) between specific downlink reference signals (e.g., PRS, TRS, CRS, CSI-RS, etc.) sent by different pairs of base stations 602, and either reports these RSTD measurements to a location server (e.g., location server 230, LMF 270, SLP 272) or calculates a position estimate value based on these RSTD measurements.

[0107] Generally, in a reference cell (e.g. Figure 6 ) and one or more neighboring cells (e.g., in Figure 6RSTD is measured between cells supported by base stations 602-2 and 602-3 in the example of DL-TDOA. The reference cell remains the same for all RSTDs measured by UE 604 for any single positioning use of DL-TDOA, and will typically correspond to the serving cell of UE 604 or another nearby cell with good signal strength at UE 604. In one aspect, a neighboring cell is typically a cell supported by a different base station than the base station of the reference cell, and may have good or poor signal strength at UE 604. The position calculation can be based on the measured time difference (e.g., RSTD) and knowledge of the locations and relative transmission timing of the base stations 602 involved (e.g., whether the base stations 602 are accurately synchronized or whether each base station 602 transmits at some known time difference relative to the other base stations 602).

[0108] To assist the positioning operation, the location server (e.g., location server 230, LMF 270, LSP 272) may provide DL-TDOA assistance data of a reference cell and neighboring cells relative to the reference cell to UE 604. For example, the assistance data may include an identifier (e.g., PCI, VCI, CGI, etc.) of each cell in a set of cells that UE 604 expects to measure (here, cells supported by base station 602). The assistance data may also provide a center channel frequency of each cell, various reference signal configuration parameters (e.g., the number of consecutive positioning subframes, the period of positioning subframes, a muting sequence, a frequency hopping sequence, a reference signal identifier, a reference signal bandwidth), and / or other cell-related parameters applicable to DL-TDOA. The DL-TDOA assistance data may indicate the serving cell of UE 604 as a reference cell.

[0109] In some cases, the DL-TDOA assistance data may also include an "expected RSTD" parameter that provides the UE 604 with information about the RSTD value that the UE 604 expects to measure between the reference cell and each neighboring cell at its current location, as well as the uncertainty of the expected RSTD parameter. The expected RSTD along with the associated uncertainty may define a search window for the UE 604 within which the UE 604 expects to measure RSTD values. The DL-TDOA assistance information may also include reference signal configuration information parameters that allow the UE 604 to determine when reference signal positioning opportunities occur relative to the reference signal positioning opportunities of the reference cell on signals received from various neighboring cells, and to determine reference signal sequences sent from various cells in order to measure reference signal ToA or RSTD.

[0110] In one aspect, although a location server (e.g., location server 230, LMF 270, SLP 272) can send assistance data to UE 604, alternatively, the assistance data can originate directly from base station 602 itself (e.g., in a periodically broadcast overhead message, etc.). Alternatively, UE 604 can detect neighboring base stations on its own without using assistance data.

[0111] UE 604 (e.g., based in part on assistance data, if provided) can measure and (optionally) report RSTD between reference signals received from base stations 602. Using RSTD measurements, known absolute or relative transmission timing of each base station 602, and known locations of reference and neighboring base stations 602, a network (e.g., location server 230 / LMF 270 / SLP272, base station 602) or UE 604 can estimate the location of UE 604. More specifically, the RSTD of neighbor cell "k" relative to reference cell "Ref" can be given as (ToA k –ToA Ref ), where the ToA value can be measured modulo one subframe duration (1ms) to remove the effect of measuring different subframes at different times. Figure 6 In the example of , the measured time differences between the reference cell of base station 602-1 and the cells of neighboring base stations 602-2 and 602-3 are represented as τ2–τ1 and τ3–τ1, where τ1, τ2, and τ3 represent the ToA of the reference signals from the transmit antennas of base stations 602-1, 602-2, and 602-3, respectively. The UE 604 can then convert the ToA measurements for different network nodes into RSTD measurements and (optionally) send them to the location server. Using (i) RSTD measurements, (ii) known absolute or relative transmission timing of each base station 602, (iii) known locations of the physical TRPs of the reference and neighboring base stations 602, and / or (iv) directional reference signal characteristics (such as transmission direction), the location of the UE 604 can be determined (by the UE 604 or the location server).

[0112] Still reference Figure 6, when UE 604 obtains a position estimate using the time differences measured by DL-TDOA, the location server may provide the necessary additional data (e.g., the location and relative transmission timing of base station 602) to UE 604. In some implementations, a position estimate for UE 604 may be obtained (e.g., by UE 604 itself or by a location server) from the time differences measured by DL-TDOA and from other measurements made by UE 604 (e.g., signal timing measurements from GPS or other global navigation satellite system (GNSS) satellites). In these implementations, referred to as hybrid positioning, DL-TDOA measurements may help obtain a position estimate for UE 604, but may not fully determine the position estimate.

[0113] As mentioned above, 5G NR positioning technology relies on measurements of reference signals to determine the position of the UE (also referred to as the target). As in the case of DL-TDOA, measurements can be performed at the UE based on downlink reference signals (e.g., SSB, CSI-RS, PRS, TRS, etc.) sent by multiple cells, or as in the case of UL-AoA, measurements can be performed at the base station based on uplink reference signals (e.g., RACH preamble, DMRS, SRS, etc.) sent by the UE. In contrast, measurements based on satellite (e.g., GNSS), WLAN, Other positioning technologies such as GNSS rely on measurements based on reference signals sent / received using the corresponding technology. Note that even for positioning technologies based on other technologies, positioning measurements and / or calculated UE positions can be transmitted to a location server via the 5G NR system. In addition, such as in the case of Assisted GNSS (A-GNSS), assistance information used to facilitate positioning measurements based on other technologies can be provided to the entity performing the measurement via 5G NR.

[0114] In cellular RATs such as LTE and 5G NR, security of the air interface is achieved at the PDCP layer (e.g., PDCP layer 415) through encryption and integrity protection of data and signaling packets. Any signaling originating below the PDCP layer (e.g., at the RLC layer 420, MAC layer 425, or PHY layer 430) is insecure. Specifically, PHY layer (e.g., PHY layer 430) channels and signals (such as SSB, PDCCH, PUCCH, RACH, CSI-RS, and SRS) are not protected by any security primitives. This means that in open standards such as 5G NR, adversaries can construct these PHY layer channels and signals and launch various attacks on the system. Such attacks can include selective interference and FBS attacks against specific PHY channels.

[0115] FBS poses a security threat to wireless communication systems. FBS can send synchronization signals (e.g., SSB) to synchronize UE with FBS. Once UE camps on / connects to FBS, FBS may be able to launch different types of attacks against UE.

[0116] As a first example attack, an FBS attacker can broadcast SSBs to nearby UEs. Since UEs always measure the signal strength of nearby cells for mobility purposes, UEs in RRC_CONNECTED state near an FBS will measure and report the signal strength and PCI obtained from the broadcasted SSBs to their serving cells. If there is a legitimate cell with the same PCI connected to the serving base station (i.e., a base station that supports the serving cell), the serving base station can initiate a handover (HO) to the reported cell (i.e., a legitimate cell with the same PCI broadcast by the FBS in the SSB). However, since the UE is measuring the SSB of the FBS instead of the legitimate cell, the handover to the legitimate cell will likely fail because the UE is not actually communicating with the legitimate cell to perform the handover. In this way, an FBS attacker can cause dropped calls (or HO failures).

[0117] As a second example attack, an FBS attacker can listen to and record the system information (SI) sent by legitimate cells, including MIB, remaining minimum system information (RMSI), and other system information (OSI). The FBS then broadcasts PDCCH / PDSCH and SSB (possibly with different PCI) carrying the same SI. A UE in RRC_IDLE or RRC_INACTIVE state near the FBS can measure the good SSB signal strength from the FBS and camp on the FBS after reading the SI. The UE will then not receive mobile terminated (MT) or emergency calls and remain unaware of the presence of the FBS until the UE initiates signaling on the uplink and does not receive a (integrity protected) response. In this way, the FBS can successfully launch a denial of service (DOS) attack and remain undetected for a considerable period of time.

[0118] As a third example attack, a man-in-the-middle (MITM) FBS can be located between the UE and the legitimate base station in the form of a malicious repeater. The FBS acts as a legitimate cell to the UE and a UE to the legitimate base station. Specifically, the FBS can receive transmissions from the legitimate base station and selectively discard some CSI-RS transmissions. Any UE connected to the legitimate base station through the FBS will then occasionally measure and report poor CSI for that base station, which can result in lower downlink throughput and, in extreme cases, application layer data outages.

[0119] Therefore, as will be appreciated, FBSs can pose a significant threat to a UE's connectivity, and it would be beneficial for a UE to be able to detect FBSs to avoid connecting to them or switching away from them.Thus, the present disclosure provides techniques for detecting FBSs using positioning information.

[0120] For the following discussion, it should be noted that in cellular systems such as 5G NR, a cell is uniquely identified by its CGI. A cell may also be identified by its PCI, although the PCI may only be unique within a specific geographic area, rather than globally unique. As described above, the UE can infer the PCI of a cell when decoding the SSB sent by the cell.

[0121] The present disclosure provides techniques for using positioning as a means of detecting the presence of an FBS. Various methods are described below by which positioning techniques, such as those described above (e.g., DL-TDOA, RTT, E-CID, etc.), can be used to detect an FBS. The means of detecting an FBS depends on the action of the FBS, whether the positioning measurements are performed at the UE or at the base station, and the content of the positioning assistance information and side information. The present disclosure also provides mitigation steps that can be followed once an FBS is detected, thereby limiting the impact of the threat posed by an FBS attack.

[0122] The first technique described herein can be used for a scenario where a UE performs at least some of the positioning measurements (e.g., as in DL-TDOA, E-CID, RTT), the FBS transmits an SSB, and the PCI broadcast by the FBS is not listed in the auxiliary information. In order for the UE to synchronize with the FBS, the FBS typically broadcasts a synchronization signal, such as an SSB. If the FBS broadcasts an SSB, then when the UE performs a periodic cell search, a UE near the FBS can actually measure and decode (i.e., detect) the SSB sent by the FBS. However, if the PCI inferred from the SSB of the FBS is not listed in the auxiliary information provided to the UE for DL-TDOA, it may indicate that the detected cell is an FBS.

[0123] Additional metrics, such as high signal strength measured from cells not listed in the positioning assistance information, may be used to strengthen the FBS assumption. This is because the signal strength of the SSB from the FBS may be high at the UE, but the PCI derived from the SSB may not be included in the assistance information. Since the assistance information may include all or at least most of the nearby cells because their signal strength is higher and therefore easier to detect, a cell with strong signal strength that is not in the assistance information may indicate that the cell is a FBS.

[0124] However, in some cases, the location server (e.g., location server 230, LMF 270, SLP 272) may omit the cell from the assistance information based on a priori knowledge or bias to use legitimate cells for positioning purposes. Nevertheless, upon observing such a cell (i.e., a cell with good signal strength but not included in the assistance information), the UE may report its observation to the location server and rely on the location server to take further action. If the location server receives such reports from multiple UEs pointing to the same cell as a potential FBS, this can be used to strengthen the FBS hypothesis associated with a particular cell.

[0125] As mentioned above, in some cases, the PCI may not be a unique identifier for a cell. Thus, an FBS and a legitimate cell may share the same PCI. In this case, the UE may also read the SI broadcast by the detected cell to obtain their respective CGIs to determine whether any CGI is listed in the assistance information. If the CGI is not listed, the detected cell may be a potential FBS.

[0126] The second technique described herein can be used for scenarios where the UE performs at least some of the positioning measurements (e.g., as in DL-TDOA, E-CID, RTT) and the PCI broadcast by the FBS is listed in the positioning assistance information. Assuming that the FBS shares the same PCI as the legal cells near the UE, the PCI of the FBS will be included in the assistance information provided to the UE (unless the location server excludes the PCI of the legal cells from the assistance information for some reason). However, if the UE is synchronized with the FBS, the UE will perform positioning measurements on the reference signals (e.g., SSB, CSI-RS, PRS, etc.) sent by the FBS. Assuming that the FBS is located at a different physical location than the legal cells sharing the same PCI (a possible scenario), when the measurements of the FBS are combined with the side information about the location of the legal cells, the calculated UE position will be incorrect.

[0127] To detect this situation, the calculated UE position can be compared with the position of the UE using, for example, GNSS, The UE position calculation may be performed at the UE or at a location server (e.g., location server 230, LMF 270, SLP 272) based on measurements made and / or reported by the UE. In addition, the UE position calculated based on 5G NR technology (e.g., DL-TDOA, RTT, E-CID, etc.) and non-5G NR technology (e.g., GNSS, The comparison of the UE position calculated by a WLAN, etc.) can be performed at the UE or at a location server.

[0128] Note that UE synchronization to the SSB of the FBS is not a prerequisite for this detection technique. On the contrary, if the UE performs positioning measurements on any reference signal sent by the FBS (whether SSB, CSI-RS, PRS, etc.), there may be a difference between the UE position calculated by 5G NR technology and non-5G NR technology (which can be used as a detection mechanism for the FBS).

[0129] Typically, measurements from four or more cells are required to determine the position of a UE based on DL-TDOA techniques, as described above with reference to Figure 6 Although the techniques presented herein can be used to detect the possible presence of an FBS, it cannot be simply inferred which measured cell is responsible for the incorrect position calculation and may therefore be marked as a potential FBS. However, if measurement and position comparison results of multiple UEs are available to the location server, the location server may be able to determine a single cell that is common among the different measurement and position comparison results and declare this cell as an FBS with sufficient confidence.

[0130] The third technique described herein can be used in a scenario where the UE performs at least some of the positioning measurements (e.g., in DL-TDOA, E-CID, RTT) and does not receive positioning assistance information. If no assistance information is provided to the UE, the UE can perform positioning measurements on all cells that it can detect. Such measurements may include measurements of reference signals sent by the FBS. Once the UE's positioning measurements are provided to a location calculation entity (e.g., a location server or a UE), the side information at the location calculation entity may or may not include the location of the physical cell site (i.e., the location of the base station) corresponding to the identification (PCI and / or CGI) of the FBS.

[0131] If the side information includes the location of the base station corresponding to the PCI of the FBS, then the location will indicate the location of the legal cell. In this case, the situation is the same as described above with reference to the second technique described herein, and the same FBS detection scheme comparing the UE locations calculated using 5G NR technology and non-5G NR technology can be used to detect the presence of the FBS.

[0132] If the side information does not include the location of the base station corresponding to the reported cell identity (PCI and / or CGI), the situation is the same as described above with reference to the first technique described herein. In this case, the presence of positioning measurements corresponding to unknown cell identities can be used as an indication of the presence of an undesired cell (such as an FBS near the UE). As described above, additional information (such as a high signal strength measured from a cell that does not have associated side information) can be used to strengthen the FBS detection hypothesis.

[0133] The fourth technique described herein can be used in scenarios where positioning measurements are performed in a 5G NR cell, such as in the case of uplink-based or downlink and uplink-based positioning techniques (e.g., E-CID, UL-TDOA, RTT, UL-AoA, DL-AoD, etc.). This technique can be used to detect a MITM FBS in the form of a malicious repeater located between a UE and a legitimate base station. Specifically, the FBS acts as a legitimate base station to the UE and a UE to a legitimate base station. However, the FBS may modify, inject, or discard transmissions in either direction, resulting in a disruption of the communication link between the UE and the legitimate base station.

[0134] If a MITM FBS injects or modifies transmissions on the uplink to a legitimate base station, the positioning measurements at the base station will be based on uplink transmissions (e.g., RACH, SRS, DMRS, etc.) from the FBS instead of the UE. Therefore, the calculated position will be that of the FBS instead of the UE. Assuming that the FBS is in a different physical location than the UE (a possible scenario), the UE's position calculated by uplink positioning techniques can be compared to that calculated using different techniques (such as GNSS, The UE's position is compared with the position calculated by 5G NR (e.g., UL-TDOA, RTT, UL-AoA, etc.) and other technologies. A sufficiently large difference between the positions calculated using 5G NR techniques (e.g., E-CID, UL-TDOA, RTT, UL-AoA, etc.) and other techniques can be used to detect the presence of an FBS. As an added benefit, the calculated position based on 5G NR measurements (i.e., the position of the UE, which is actually the position of the FBS) can be used to pinpoint the position of the FBS.

[0135] The fifth technique disclosed herein for detecting the presence of an FBS uses outlier detection. The premise behind outlier detection is to derive a position estimate for the UE from a subset of positioning measurements and then check the consistency between the position estimate based on that subset and the position estimates based on other subsets of positioning measurements. If the subset correctly rejects outliers, this will result in a position estimate that is very consistent with other measurements outside the subset.

[0136] ToA measurement outliers may occur for a variety of reasons, including (1) poor signal-to-noise ratio (SNR) (which may result in large errors in ToA), (2) non-line-of-sight (NLOS) links (which may result in overestimation of ToA), and (3) cells with large synchronization errors. The FBS may also appear as an outlier if the measurements are performed based on reference signals sent by the FBS, but the side information includes the geographic location of legitimate cells that share the same cell identifier (e.g., PCI and / or CGI) as the FBS. That is, although the ToAs of the reference signals sent by the FBS may be accurate, they will not be the expected ToAs of the reference signals sent by the legitimate cells that the FBS is emulating.

[0137] Fig. 7A and Figure 7B A random sampling and consistency method (referred to as a "RANSAC" method) for positioning outlier detection according to aspects of the present disclosure is shown. The RANSAC method can be performed as follows. First, a location calculation entity (e.g., a location server or a UE) identifies an initial set "U" of cells whose reference signals can be detected at the UE (e.g., based on link quality) for positioning measurements. Fig. 7A and Figure 7B In the example of , "U" is a set of cells corresponding to base stations 702-1 to 702-7.

[0138] Second, from the set of cells "U", the location calculation entity randomly selects a subset "C" of "K" cells. Fig. 7A In the example of , "C" is a set of cells corresponding to base stations 702-1, 702-3, 702-5, and 702-7, and Figure 7B In the example of , "C" is the set of cells corresponding to base stations 702-1, 702-2, 702-3, and 702-4. In both cases, "K" is 4. Using observed ToA measurements of reference signals transmitted from a subset of cells "C", the location calculation entity estimates the location of the UE. In one aspect, Fig. 7A and Figure 7B A UE in (not shown, but its real position is shown by a circle) can conduct an RTT positioning session with each cell in the set "U" of cells, or a DL-TDOA positioning session with a pair of cells in the set "U" of cells.

[0139] Using the calculated position estimates, the position calculation entity calculates the expected ToA measurements for the remaining cells in the set "U" of cells (i.e., the cells in "U" excluding the subset "C" of cells). Fig. 7A In the example of FIG. 5 , the remaining cells are cells corresponding to base stations 702-2, 702-4, and 702-6, while Figure 7BIn the example of , these remaining cells are the cells corresponding to base stations 702-3, 702-5, and 702-7. The computation entity then determines a set "L" of inliers in the set "U" of cells. Inliers are cells for which the observed ToA measurement (within a particular tolerance threshold "T") matches the expected ToA of the cell. That is, since the UE has measured (and reported, if it is not the location computation entity) the ToA of the reference signal from each cell in the set "U" of cells, the location computation entity can estimate what the ToA of the cell should be based on the position estimate that the UE just calculated and the known position of the cell (i.e., the base station corresponding to the cell). It can then compare the expected ToA with the measured ToA, and if the difference is less than the tolerance threshold "T", the location computation entity can determine that the cell is an inlier.

[0140] refer to Fig. 7A , the location calculation entity has estimated the location of the UE using the cells corresponding to base stations 702-1, 702-3, 702-5, and 702-7. It then uses the calculated location of the UE and the known locations of base stations 702-2, 702-4, and 702-6 to determine the expected ToA of the cells corresponding to base stations 702-2, 702-4, and 702-6. Fig. 7A In the example of , there is an FBS 710 that mimics base station 702-2 (e.g., as a MITM or at least by having the same PCI and / or CGI). As such, the measured ToA of the reference signal from FBS 710 will likely not be within the tolerance threshold "T" of the expected ToA of the reference signal from base station 702-2. However, the measured ToA of the reference signals from base stations 702-4 and 702-6 will likely be within the tolerance threshold "T" of the expected ToA of these base stations. As such, base stations 702-4 and 702-6 will likely be placed in the set "L" of interior points.

[0141] refer to Figure 7B , the location calculation entity estimates the location of the UE using the cells corresponding to base stations 702-1, 702-2, 702-4, and 702-6. It then uses the calculated location of the UE and the known locations of base stations 702-3, 702-5, and 702-7 to determine the expected ToA of the cells corresponding to base stations 702-3, 702-5, and 702-7. Figure 7BIn the example of , because the position of the UE is estimated using the ToA of the reference signal received from FBS 710, the estimated position of the UE is likely to be inaccurate (as shown by the shaded circle). Thus, due to the inaccurate position estimate of the UE, the measured ToA of the reference signal from one or more base stations 702-3, 702-5, and 702-7 will likely not be within the tolerance threshold "T" of the expected ToA of the reference signal from these base stations. Therefore, it is possible that none of base stations 702-3, 702-5, and 702-7 are placed in the set "L" of interior points.

[0142] Third, the location computation entity iterates over "M" different random selections of "C" and picks the subset "C" that maximizes the set "L" of inliers (ie, produces the largest set "L" or the most inliers). Fig. 7A and Figure 7B Two iterations are shown, where "M" is 2. However, it will be appreciated that there may be more (or less) than two iterations. As discussed above, because Fig. 7A The set of interior points "L" in the example may include base stations 702-4 and 702-6, but Figure 7B The set of interior points "L" in the example may not include any base stations, so the location calculation entity will probably choose Fig. 7A The subset "C" of cells (ie, the cells corresponding to base stations 702-1, 702-3, 702-5, and 702-7) is shown as the subset "C" of cells that maximizes the set "L" of inliers.

[0143] Fourth, the location calculation entity calculates the final location estimate of the UE using the best subset "C" (i.e., the subset "C" that maximizes "L") and any inlier cells of the remaining cells in the set "U" of cells (i.e., any inlier cells in the set "U" of cells other than the subset "C" of cells). The location calculation entity then declares non-inlier cells that are not "C" cells as outliers. Therefore, in Fig. 7A and Figure 7B In the example, the location calculation entity will use Fig. 7A The location of the UE is calculated based on the subset "C" of cells shown in (i.e., cells corresponding to base stations 702-1, 702-3, 702-5, and 702-7) and the cells in the set "L" of corresponding interior points (i.e., cells corresponding to base stations 702-4 and 702-6). The location calculation entity then declares base station 702-2 as an exterior point.

[0144] As described above, outliers may occur for a variety of reasons, not just because of the presence of an FBS. However, by comparing the determined outliers for multiple UEs, a location server (e.g., location server 230, LMF 270, SLP 272) may be able to identify a single cell that is common in the reports from multiple UEs and declare that cell to be an FBS with sufficient confidence.

[0145] In addition, for DL-TDOA, the UE may report the quality of the ToA measurement (e.g., based on the observed SNR). Although the quality metric may not always indicate whether the ToA measurement is reliable, high-quality signals from a common outlier point for multiple UEs can be used to strengthen the FBS detection hypothesis.

[0146] Note that outpoint detection may be performed at the UE and the results reported to the location server, or may be performed at the location server based on measurements reported by the UE. Thus, the location calculation entity may be the UE or the location server.

[0147] In one aspect, various techniques for detecting potential FBSs may be triggered for various reasons. For example, if the UE or the network (e.g., based on reports from other nearby UEs) suspects that there may be an FBS near the UE, the UE or the network may trigger appropriate FBS detection techniques and corresponding positioning sessions (e.g., DL-TDOA sessions, RTT sessions, E-CID sessions, etc.). As another example, the UE or the network may trigger a positioning session for the UE, and the UE or the network may seize the opportunity to perform appropriate FBS detection techniques during the positioning session. As another example, the FBS technique may be triggered periodically as a precautionary measure.

[0148] Upon detecting a possible FBS (using one or more of the above techniques), the UE may perform one or more mitigation operations. In some cases, mitigation operations may include reporting a suspicious cell to a server (e.g., a security server) (and optionally, causing the UE to suspect measurements of the cell), de-prioritizing the suspicious cell for cell selection / reselection, and / or (if currently communicating with a suspicious cell) using a different cell, frequency, frequency band, or system to access the communication network. Note that the server (e.g., a security server) may be in the same communication network as the UE, FBS, and / or location server (i.e., belonging to the same network operator) or it may be a crowdsourcing server that is not associated with the communication network, meaning that it may be operated by different network operators or service providers. In some cases, the server may be the same as or located at the location server.

[0149] The network side may also perform one or more mitigation actions when a possible FBS is detected, either through its own detection measures or based on UE reports. In some cases, mitigation actions may include handing over the UE to a different cell, or updating one or more communication parameters for cell selection / reselection at the UE to de-prioritize the suspicious cell. The network may also report the suspicious cell to a server (e.g., a security server) within or outside the same communication network.

[0150] Figure 8 An example method 800 for positioning a UE in accordance with aspects of the present disclosure is shown. The method 800 may be performed by a UE (eg, any UE described herein) or a location server (eg, location server 230, LMF 270).

[0151] At 810, the UE or location server determines a set ("U") of multiple cells detectable by the UE. In one aspect, where the UE performs method 800, operation 810 may be performed by WWAN transceiver 310, processing system 332, memory component 340, and / or FBS detection module 342, any or all of which may be considered as means for performing the operation. In one aspect, where the location server performs operation 810, the operation may be performed by network interface 390, processing system 394, memory component 396, and / or FBS detection module 398, any or all of which may be considered as means for performing the operation.

[0152] At 820, the UE or the location server computes multiple location estimates for the UE based on positioning measurements of corresponding multiple subsets ("C") of the multiple cells. In one aspect, where the UE performs method 800, operation 820 may be performed by WWAN transceiver 310, processing system 332, memory component 340, and / or FBS detection module 342, any or all of which may be considered as means for performing the operation. In one aspect, where the location server performs operation 820, the operation may be performed by network interface 390, processing system 394, memory component 396, and / or FBS detection module 398, any or all of which may be considered as means for performing the operation.

[0153] At 830, the UE or location server identifies a subset of cells from a plurality of subsets that provide the best position estimate from a plurality of position estimates for the UE. In one aspect, the best position estimate maximizes a set of inlier cells ("L") from a plurality of cells, wherein the set of inlier cells includes one or more cells from the plurality of cells other than the subset of cells, for which actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells. In one aspect, in the case of the UE performing method 800, operation 830 may be performed by the WWAN transceiver 310, the processing system 332, the memory component 340, and / or the FBS detection module 342, any or all of which may be considered as components for performing the operation. In one aspect, in the case of the location server performing operation 830, the operation may be performed by the network interface 390, the processing system 394, the memory component 396, and / or the FBS detection module 398, any or all of which may be considered as components for performing the operation.

[0154] At 840, the UE or location server calculates a final location estimate of the UE based on the positioning measurements of the subset of cells and the set of interior point cells. In one aspect, in the case where the UE performs method 800, operation 840 can be performed by WWAN transceiver 310, processing system 332, memory component 340 and / or FBS detection module 342, any one or all of which can be considered as a component for performing the operation. In one aspect, in the case where the location server performs operation 840, the operation can be performed by network interface 390, processing system 394, memory component 396 and / or FBS detection module 398, any one or all of which can be considered as a component for performing the operation.

[0155] At 850, the UE or the location server identifies any remaining cells in the plurality of cells other than the subset of cells and the set of interior points as at least one exterior point cell. In one aspect, in the case where the UE performs method 800, operation 850 may be performed by WWAN transceiver 310, processing system 332, memory component 340, and / or FBS detection module 342, any one or all of which may be considered as a component for performing the operation. In one aspect, in the case where the location server performs operation 850, the operation may be performed by network interface 390, processing system 394, memory component 396, and / or FBS detection module 398, any one or all of which may be considered as a component for performing the operation.

[0156] At 860, the UE or the location server performs a mitigation operation based on identifying at least one outlying cell. In one aspect, in the case where the UE performs method 800, operation 860 can be performed by WWAN transceiver 310, processing system 332, memory component 340 and / or FBS detection module 342, any one or all of which can be considered as a component for performing the operation. In one aspect, in the case where the location server performs operation 860, the operation can be performed by network interface 390, processing system 394, memory component 396 and / or FBS detection module 398, any one or all of which can be considered as a component for performing the operation.

[0157] Examples of implementations are described in the following numbered clauses:

[0158] Clause 1. A method for detecting outlier cells based on positioning of a user equipment (UE), comprising: determining a set of multiple cells detectable by the UE; calculating multiple position estimates of the UE based on positioning measurements of corresponding multiple subsets of the multiple cells; identifying a subset of cells in the multiple subsets that provides the best position estimate among the multiple position estimates of the UE, wherein the best position estimate maximizes a set of inlier cells in the multiple cells, and wherein the set of inlier cells includes one or more cells in the multiple cells other than the subset of cells, and for one or more cells, actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells; calculating a final position estimate of the UE based on positioning measurements of the subset of cells and the set of inlier cells; identifying any remaining cells in the multiple cells other than the subset of cells and the set of inlier cells as at least one outlier cell; and performing mitigation operations based on identifying at least one outlier cell.

[0159] Clause 2. The method of clause 1, wherein the mitigation operation comprises sending a report identifying at least one outpoint cell to a server.

[0160] Clause 3. A method according to any one of clauses 1 and 2, wherein the mitigation operation comprises: updating one or more communication parameters for cell selection and / or reselection to cause the UE to de-prioritize at least one outpoint cell.

[0161] Clause 4. A method according to any one of clauses 1-3, wherein the mitigation operation comprises: updating one or more communication parameters based on the UE currently being connected to at least one out-point cell so that the UE uses a different cell, frequency, frequency band or system to access the cellular communication network.

[0162] Clause 5. A method as described in any of clauses 1-4, wherein each of the plurality of subsets comprises the same number of cells.

[0163] Clause 6. A method as described in any of clauses 1-4, wherein at least one of the plurality of subsets comprises a different number of cells as the remaining subsets of the plurality of subsets.

[0164] Clause 7. The method of any of clauses 1-6, wherein each of the plurality of subsets comprises a random selection of the plurality of cells.

[0165] Clause 8. A method as described in any of clauses 1-7, wherein the positioning measurements include time of arrival (ToA) measurements.

[0166] Clause 9. A method according to any of clauses 1-8, wherein the positioning measurements are for multiple downlink time difference of arrival (DL-TDOA) procedures with multiple cell pairs or multiple round trip time (RTT) procedures with multiple cells.

[0167] Clause 10. A method as described in any of clauses 1-9, wherein the method is performed by a UE.

[0168] Clause 11. The method of any of clauses 1-9, wherein the method is performed by a location server.

[0169] Clause 12. The method of clause 11, further comprising: receiving a plurality of reports from a corresponding plurality of UEs including the UE, each report identifying one or more out-point cells; and identifying at least one out-point cell common to the plurality of reports.

[0170] Clause 13. The method of clause 12, further comprising: identifying at least one outpoint cell as a potential fake base station (FBS).

[0171] Those skilled in the art will appreciate that any of a variety of different techniques and methods may be used to represent information and signals. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be mentioned throughout the above description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or optical particles, or any combination thereof.

[0172] In addition, it will be appreciated by those skilled in the art that the various illustrative logic blocks, modules, circuits, and algorithmic steps described in conjunction with the aspects disclosed herein can be implemented as electronic hardware, computer software, or a combination of the two. In order to clearly illustrate this interchangeability of hardware and software, a general description has been given above of the functions of various illustrative components, frames, modules, circuits, and steps. Whether such functional implementation is hardware or software depends on the specific application and the design constraints on the entire system. A skilled person can implement the described functions in different ways for each specific application, but such implementation decisions should not be interpreted as resulting in a departure from the scope of the present disclosure.

[0173] The various illustrative logical blocks, modules, and circuits described in conjunction with the various aspects disclosed herein may be implemented or executed with a general purpose processor, a DSP, an ASIC, an FPGA, or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but alternatively, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, a combination of one or more microprocessors with a DSP core, or any other such configuration.

[0174] The methods, sequences and / or algorithms described in conjunction with the aspects disclosed herein may be directly embodied in hardware, software modules executed by a processor, or a combination of the two. The software module may reside in a random access memory (RAM), flash memory, read-only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art. An example storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. Alternatively, the storage medium may be integrated into a processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal (e.g., UE). Alternatively, the processor and the storage medium may reside in a user terminal as discrete components.

[0175] In one or more example aspects, the functions described can be implemented with hardware, software, firmware, or any combination thereof. If implemented with software, these functions can be stored or transmitted as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media and communication media, including any medium that facilitates the transfer of a computer program from one place to another. The storage medium can be any available medium accessible to a computer. As an example and not a limitation, such a computer-readable medium may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, disk storage or other magnetic storage device or any other medium that can be used to carry or store the desired program code in the form of an instruction or data structure and can be accessed by a computer. In addition, any connection is properly referred to as a computer-readable medium. For example, if a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwaves are used to transmit software from a website, server, or other remote source, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwaves are included in the definition of the medium. Disk and disc, as used herein, include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer-readable media.

[0176] Although the foregoing disclosure shows the illustrative aspects of the present disclosure, it should be noted that various changes and modifications may be made herein without departing from the scope of the present disclosure as defined by the appended claims. The functions, steps and / or actions of the method claims according to the aspects of the disclosure described herein do not need to be performed in any particular order. In addition, although the elements of the present disclosure may be described or claimed in the singular, the plural form is also contemplated unless it is explicitly stated to be limited to the singular.

Claims

1. A method for detecting an outlying cell based on positioning of a user equipment (UE), comprising: Determining a set of multiple cells detectable by the UE; computing a plurality of position estimates for the UE based on positioning measurements for corresponding plurality of subsets of the plurality of cells; identifying a subset of cells in the plurality of subsets that provide a best position estimate in a plurality of position estimates for the UE, wherein the best position estimate maximizes a set of inlier cells in the plurality of cells, and wherein the set of inlier cells includes one or more cells in the plurality of cells other than the subset of cells, for which actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells; Calculating a final position estimate of the UE based on positioning measurements of the subset of cells and the set of interior cells; identifying any remaining cells of the plurality of cells other than the subset of cells and the set of in-point cells as at least one out-point cell; and A mitigation operation is performed based on identifying the at least one out-point cell.

2. The method according to claim 1, wherein: The mitigation actions include: A report identifying the at least one outpoint cell is sent to a server.

3. The method according to claim 1, wherein: The mitigation actions include: For cell selection and / or reselection, one or more communication parameters are updated to cause the UE to de-prioritize the at least one outpoint cell.

4. The method according to claim 1, wherein: The mitigation actions include: Based on the UE currently being connected to the at least one outpoint cell, one or more communication parameters are updated to enable the UE to access the cellular communication network using a different cell, frequency, frequency band or system.

5. The method according to claim 1, wherein: Each of the plurality of subsets includes the same number of cells.

6. The method according to claim 1, wherein: At least one of the plurality of subsets includes a different number of cells as the remaining subsets of the plurality of subsets.

7. The method according to claim 1, wherein: Each of the plurality of subsets comprises a random selection of the plurality of cells.

8. The method according to claim 1, wherein: The positioning measurements include time of arrival (ToA) measurements.

9. The method according to claim 1, wherein: The positioning measurements are for multiple downlink time difference of arrival (DL-TDOA) procedures with multiple cell pairs or multiple round trip time (RTT) procedures with the multiple cells.

10. The method according to claim 1, wherein: The method is executed by UE.

11. The method according to claim 1, wherein: The method is performed by a location server.

12. The method according to claim 11, further comprising: receiving a plurality of reports from a corresponding plurality of UEs including the UE, each report identifying one or more outpoint cells; as well as At least one outpoint cell that is common to the plurality of reports is identified.

13. The method according to claim 12, further comprising: The at least one outlying cell is identified as a potential fake base station (FBS).

14. An apparatus for detecting an out-point cell based on positioning of a user equipment (UE), comprising: Memory; Communication unit; as well as at least one processor, communicatively coupled to the memory and the communication unit, the at least one processor being configured to: Determining a set of multiple cells detectable by the UE; computing a plurality of position estimates for the UE based on positioning measurements for corresponding plurality of subsets of the plurality of cells; identifying a subset of cells in the plurality of subsets that provide a best position estimate in a plurality of position estimates for the UE, wherein the best position estimate maximizes a set of inlier cells in the plurality of cells, and wherein the set of inlier cells includes one or more cells in the plurality of cells other than the subset of cells, for which actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells; Calculating a final position estimate of the UE based on positioning measurements of the subset of cells and the set of interior cells; identifying any remaining cells of the plurality of cells other than the subset of cells and the set of in-point cells as at least one out-point cell; and A mitigation operation is performed based on identifying the at least one out-point cell.

15. The device according to claim 14, wherein: The at least one processor being configured to perform mitigation operations includes the at least one processor being configured to: The communication unit is caused to send a report identifying the at least one out-point cell to a server.

16. The device according to claim 14, wherein: The at least one processor being configured to perform mitigation operations includes the at least one processor being configured to: For cell selection and / or reselection, one or more communication parameters are updated to cause the UE to de-prioritize the at least one outpoint cell.

17. The device according to claim 14, wherein: The at least one processor being configured to perform mitigation operations includes the at least one processor being configured to: Based on the UE currently being connected to the at least one outpoint cell, one or more communication parameters are updated to enable the UE to access the cellular communication network using a different cell, frequency, frequency band or system.

18. The device according to claim 14, wherein: Each of the plurality of subsets includes the same number of cells.

19. The device according to claim 14, wherein: At least one of the plurality of subsets includes a different number of cells as the remaining subsets of the plurality of subsets.

20. The device according to claim 14, wherein: Each of the plurality of subsets comprises a random selection of the plurality of cells.

21. The device according to claim 14, wherein: The positioning measurements include time of arrival (ToA) measurements.

22. The device according to claim 14, wherein: The positioning measurements are for multiple downlink time difference of arrival (DL-TDOA) procedures with multiple cell pairs or multiple round trip time (RTT) procedures with the multiple cells.

23. The apparatus of claim 14, wherein: The device is a UE, and The communication unit includes at least one transceiver of the UE.

24. The apparatus of claim 14, wherein: The device is a location server, and The communication unit comprises at least one network interface of the location server.

25. The device according to claim 24, wherein: The at least one processor is further configured to: receiving, via the communication unit, a plurality of reports from a corresponding plurality of UEs including the UE, each report identifying one or more outpoint cells; and At least one outpoint cell that is common to the plurality of reports is identified.

26. The device according to claim 25, wherein The at least one processor is further configured to: The at least one outlying cell is identified as a potential fake base station (FBS).

27. An apparatus for detecting an out-point cell based on positioning of a user equipment (UE), comprising: means for determining a set of a plurality of cells detectable by the UE; means for computing a plurality of position estimates for the UE based on positioning measurements for corresponding plurality of subsets of the plurality of cells; means for identifying a subset of cells in the plurality of subsets that provides a best position estimate in a plurality of position estimates for the UE, wherein the best position estimate maximizes a set of inlier cells in the plurality of cells, and wherein the set of inlier cells includes one or more cells in the plurality of cells other than the subset of cells, for which actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells; means for calculating a final position estimate of the UE based on positioning measurements of the subset of cells and the set of inlier cells; means for identifying any remaining cells of the plurality of cells other than the subset of cells and the set of in-point cells as at least one out-point cell; and Means for performing a mitigation operation based on identifying the at least one out-point cell.

28. The device according to claim 27, wherein The device is a location server.

29. The apparatus according to claim 28, further comprising: means for receiving a plurality of reports from a corresponding plurality of UEs including the UE, each report identifying one or more outpoint cells; as well as Means for identifying at least one outpoint cell common to said plurality of reports.

30. The apparatus of claim 29, further comprising: Means for identifying the at least one outsite cell as a potential fake base station (FBS).

31. A non-transitory computer-readable medium storing computer-executable instructions for locating a user equipment (UE), the computer-executable instructions comprising: at least one instruction for determining a set of a plurality of cells detectable by the UE; at least one instruction for computing a plurality of position estimates for the UE based on positioning measurements for corresponding plurality of subsets of the plurality of cells; at least one instruction for identifying a subset of cells in the plurality of subsets that provides a best position estimate in a plurality of position estimates for the UE, wherein the best position estimate maximizes a set of inlier cells in the plurality of cells, and wherein the set of inlier cells includes one or more cells in the plurality of cells other than the subset of cells, for which actual positioning measurements of the one or more cells are within a threshold of expected positioning measurements of the one or more cells; at least one instruction for computing a final position estimate of the UE based on positioning measurements of the subset of cells and the set of inlier cells; at least one instruction for identifying any remaining cells of the plurality of cells other than the subset of cells and the set of in-point cells as at least one out-point cell; and At least one instruction for performing a mitigation operation based on identifying the at least one out-point cell.

Images