Spoofing protection for mobile device location

Abstract

The present disclosure relates particularly to a network entity including components for: obtaining or determining a position estimate for a mobile device for verification; transmitting or causing transmission of a positioning reference signal to a location indicated by the position estimate for verification; and attempting to verify the position estimate for verification based at least on a potential response received from the mobile device in response to the positioning reference signal.

Description

Technical Field

[0001] The present disclosure relates to communication networks, such as radio networks comprising base stations and mobile devices, such as user equipment, communicating with each other. More particularly, the present disclosure relates to position estimation of such mobile devices in such communication networks. Background Art

[0002] The present disclosure relates to, but is not limited to, communication networks defined by 3GPP standards, such as the 5G standard, also known as New Radio (NR).

[0003] In 3GPP, New Radio (NR) positioning is provided using so-called Positioning Reference Signals (PRS), which can be downlink (DL) or uplink (UL) positioning reference numbers (DL-PRS or UL-PRS) with further positioning enhancements (particularly focused on IoT technologies and applications). The key goal is to support enhancements and solutions necessary for high accuracy (horizontal and vertical), low latency, network efficiency (scalability, overhead, etc.), and device efficiency (power consumption, complexity, etc.) requirements. In addition to system performance, integrity is a key metric for positioning technology.

[0004] Mobile Networks (MNs) may require positioning of the User Equipment (UE) in order to provide specific services or applications (location-based services / applications). In order to determine the location of the UE, 3GPP defines a number of methods. Mainly, the network estimates the UE location, i.e. via network-based methods requiring cooperation from the UE (UE-assisted), or the location estimation is performed by the UE itself, i.e. the UE estimates its own location (UE-based). Furthermore, methods based on downlink and uplink signals are usually distinguished. In 5G, the so-called Positioning Management Function (LMF) is responsible for calculating location coordinates in the cellular network system.

[0005] For example, in the case of a UE-assisted downlink signal-based method, the LMF may configure the UE to perform measurements on the DL-PRS. The UE may then report the measurements to the LMF. The LMF determines the UE's location based on these measurements.

[0006] PRS can be further improved to a so-called on-demand PRS. On-demand PRS is configured by the LMF in a UE-specific manner for a specific user's need for location services. The LMF configures the base station (BS) to send on-demand PRS to a specific UE location, and configures the UE to measure and report on-demand PRS. On-demand PRS is intended to improve efficiency, especially in rural areas, because PRS transmissions can be reduced to the times when they are requested by the LMF (in contrast to the case where PRS is continuously transmitted).

[0007] Now, there is a problem here, that the UE may attempt to spoof its location. This may help circumvent geo-fencing or other location-based restrictions. To do this, the UE may modify the hardware and software to perform this spoofing attempt. With the modified software, the measurements sent to the LMF may be tampered with. With tampered hardware (e.g., modified antennas), signals on different beams may be received after successful spoofing. In general, spoofing may be an intentional act by the UE owner, or it may be an unintentional act due to a compromised UE.

[0008] As mentioned above, the positioning method relies on signals or measurements from and / or to the UE for determining its position. Examples of signals measured by the UE are 5G NR Positioning Reference Signals (PRS) (particularly PRS designed for positioning purposes and already mentioned above), but can also be signals such as Sounding Reference Signals (SRS), Downlink Reference Signals for Measuring Received Power (DL-RSRP), Downlink Reference Signals for Measuring Time Difference (DL-RSTD) or Rx-Tx Time Difference. It is assumed that there is an inherent trust relationship between the UE and the LMF. In other words, the LMF will trust the measurements reported by the UE. The UE can exploit this trust by sending tampered signals or measurements (e.g. DL UE measurements of the LTE Positioning Protocol (LPP) information type "Provide Location Information"). For example, a MN may try to locate a UE to provide access to a sensitive application. The tampered UE receives a request for DL ​​RSRP measurements. Then, instead of sending the actual measurements to achieve true positioning, the tampered UE sends tampered measurements so that the LMF will calculate an incorrect position. By tampering with the measurements, the UE can pretend to be in a specific location to access applications restricted to that specific location.

[0009] Therefore, as a result of a successful attack, the LMF will calculate an erroneous (spoofed) location based on the tampered signals or measurements provided by the UE. The UE may access services or applications that should not be accessible from the actual / true (relative to the spoofed) UE location.

[0010] Therefore, there is a need to improve the integrity and security of positioning for UEs in communication networks. Summary of the invention

[0011] Certain embodiments may have the effect of improving the integrity or security of UE positioning in a communications network. Certain embodiments may have the effect of preventing or hindering location spoofing of a mobile device in a communications network.

[0012] According to a first exemplary aspect, a network entity is disclosed, inter alia, comprising means for:

[0013] obtaining or determining a location estimate of the mobile device for verification;

[0014] transmitting or causing transmission of a positioning reference signal to a position indicated by the gauge position estimate used for verification;

[0015] Validation of the position estimate for validation is attempted based at least on a potential response received from the mobile device in response to the positioning reference signal.

[0016] According to a first exemplary aspect, there is also disclosed a method performed at least by a network entity, the method comprising:

[0017] obtaining or determining a location estimate of the mobile device for verification;

[0018] based on the position estimate for verification, transmitting or causing transmission of a positioning reference signal to a location indicated by the position estimate for verification;

[0019] Validation of the position estimate for validation is attempted based at least on a potential response received from the mobile device in response to the positioning reference signal.

[0020] According to a second exemplary aspect, a network entity is disclosed, inter alia, comprising means for:

[0021] Receive a random number from the network;

[0022] receiving a positioning reference signal from a network;

[0023] transmitting a response to the received positioning reference signal to the network for verification of the position estimate of the mobile device; and

[0024] The received random number is used for at least one of: receiving a positioning reference signal from a network; and transmitting a response to the received positioning reference signal to the network.

[0025] According to a second exemplary aspect, there is also disclosed a method performed at least by a network entity, the method comprising:

[0026] Receive a random number from the network;

[0027] receiving a positioning reference signal from a network;

[0028] transmitting a response to the received positioning reference signal to the network for verification of the position estimate of the mobile device; and

[0029] The received random number is used for at least one of: receiving a positioning reference signal from a network; and transmitting a response to the received positioning reference signal to the network.

[0030] The network entity of the first exemplary aspect may be an electronic device, such as an entity of a radio access network or a core network of a communication system. For example, the network entity may be or include a base station or communicate with a base station. Generally speaking, a network entity may be hardware or software that implements a certain function. In one example, the network entity may be understood as a location management function (LMF) defined by the 3GPP 5G standard or one or more devices that implement this function. Accordingly, although the network entity may be understood as being implemented in a single device or module or being a single device or module, the network entity may also be implemented across multiple devices or modules or include multiple devices or modules. Thus, in particular, the network entity may be implemented in a fixed device or may be a fixed device. The multiple network entities of the first exemplary aspect may in particular establish a communication system or network, in particular, the communication system or network may be a new radio (NR) or 5G system or any other mobile communication system defined by a past or future standard (in particular, a subsequent standard of the current 3GPP standard). The network entity of the first exemplary aspect may communicate directly or indirectly with the mobile device of the second exemplary aspect.

[0031] The mobile device of the second exemplary aspect may be an electronic device, such as a user device or a mobile station. The mobile device may in particular be a device such as a smart phone, a tablet, a wearable device, a smart watch or the like. A user device or a mobile station may be understood as any device that communicates directly with a network by an end user. The mobile device of the second exemplary aspect may communicate directly or indirectly with a network entity of the first exemplary aspect.

[0032] The components of any disclosed apparatus may be implemented in hardware and / or software. They may include, for example, at least one processor for executing a computer program code for performing the desired function, at least one memory for storing the program code, or both. Alternatively, they may include, for example, circuits designed to perform the desired function, such as implemented in a chipset or chip (such as an integrated circuit). Typically, a component may include, for example, one or more processing components or processors.

[0033] Therefore, according to various exemplary aspects of the present disclosure, a corresponding device (i.e., a network entity and a mobile device) including at least one processor and at least one memory including computer program code is also disclosed, and the at least one memory and the computer program code are configured to utilize at least one processor to enable the device to at least execute and / or control the method according to the various exemplary aspects of the present disclosure.

[0034] Any of the above disclosed apparatuses may be a module or component for a device (eg, a chip). The disclosed apparatus may include the disclosed components, such as a part, a processor, a memory, or may further include one or more additional components.

[0035] The methods of the corresponding aspects may be, for example, respectively performed and / or controlled by an apparatus (i.e., a network entity or a mobile device) according to the corresponding aspects. However, generally speaking, the corresponding methods may also be performed and / or controlled by more than one apparatus, such as by a user equipment and a network working together.

[0036] According to the first and second exemplary aspects of the present disclosure, there is also disclosed in each case a computer program which, when executed by a processor of an apparatus, causes the apparatus to perform a method according to the first and second aspects, respectively.

[0037] The computer program may be stored in a computer-readable storage medium, in particular a tangible and / or non-transitory medium. The computer-readable storage medium may be, for example, a disk or a memory or the like. The computer program may be stored in a computer-readable storage medium in the form of instructions encoding the computer-readable storage medium. The computer-readable storage medium may be used to participate in the operation of a device such as an internal or external memory of a computer, such as a read-only memory (ROM) or a computer hard disk, or for program distribution, such as an optical disk.

[0038] A system is also disclosed, comprising the network entity of the first aspect and the mobile device of the second aspect, which work together for performing aspects of the present disclosure.

[0039] In the following, further exemplary features and exemplary embodiments of different aspects of the present disclosure will be described in more detail.

[0040] The location estimate of a mobile device for verification may be understood as a securely obtained previous or to-be-verified location estimate for the mobile device. The estimated location may be required by the mobile device or the network to allow access to sensitive applications or their functions. For example, a location estimate of the mobile device may be required at a service point, for example to obtain services or perform functions such as authorized access information, authorized payment, door opening, etc. at the service point. The (previous) location estimate for verification may be obtained according to any known positioning method, such as positioning technology based on a cellular or non-cellular communication network (in particular, the communication network to which the network entity of the first exemplary aspect belongs) or a global navigation satellite system (GNSS), as described in the background technology section. Moreover, the location estimate for verification may have been determined by the mobile device and / or the network.

[0041] The positioning reference signal may be a dedicated signal specifically designed for positioning purposes, such as a positioning reference signal PRS (such as DL-PRS) of the 3GPP 5G standard. The positioning reference signal may be understood as requiring or triggering a response from a receiving mobile device. Generally, a positioning reference signal may also be a signal designed for a different purpose but may also be used for positioning purposes, and it may specifically trigger a response from a mobile device receiving the signal, such as a reference signal (e.g., a sounding reference signal, DL RSRP, DL RSTD, or Rx-Tx time difference).

[0042] Since the position estimate used for verification indicates the (real or claimed) position (ie, geographic location) of the mobile device, a positioning reference signal may be transmitted (or caused to be transmitted) at least to this location, as will be described in further detail below.

[0043] As an example of a network entity of the first aspect, the transmission may in particular be performed by a base station of the communication network. Alternatively, the network entity may communicate with the base station and cause the transmission of the positioning reference signal, for example by requesting or scheduling a corresponding transmission.

[0044] The act of attempting to verify a location estimate for verification may in particular be understood to mean that a verification process is performed such that the (previous and to be verified) location estimate is verified or not verified as a result thereof. In other words, it is determined whether there is a risk that the location estimate is spoofed. This verification is based (at least) on a potential response from the mobile device.

[0045] For example, verification may depend specifically on which response is received or whether a response is received, such as within a predetermined time window, which will also be discussed in detail below. For example, if the mobile device is an authentic mobile device and the location estimate is a legitimate location estimate, such as the authentic mobile device is actually located at the location indicated by the location estimate to be verified, then the (authentic) mobile device will be able to receive positioning reference signals transmitted to the location indicated by the location estimate, and will be able to respond appropriately. For example, if the mobile device is a spoofing mobile device and the location estimate is a spoofed location estimate, such as the spoofing mobile device is not actually located at the location indicated by the location estimate to be verified, then the (spoofed) mobile device will not be able to receive positioning reference signals transmitted to the location indicated by the location estimate, and will not be able to respond appropriately.

[0046] The response of a mobile device in response to a positioning reference signal may depend on the type of positioning reference signal and the reaction specified therefor. Typically, a mobile device will make measurements of the positioning reference signal or measurements of specific characteristics of the positioning reference signal (such as measurements of received power or timing measurements) depending on the type of reference signal, and then report the measurements back to the network. For example, a mobile device may use a positioning reference signal to measure positioning measurements, and then report the measurements back to the corresponding network as a response to the positioning reference signal. In one example, a mobile device may perform a position estimate based on the positioning reference signal and report back the position estimate. In another example, a mobile device may make measurements and report the measurements back to the network, and the network may then determine a position estimate based on the measurements.

[0047] Typically, the measurement of the positioning reference signal may be a timing measurement, an angle measurement, a signal received power measurement, a downlink time difference of arrival (DL-TDOA) measurement, an uplink time difference of arrival (UL-TDOA) measurement, an angle of transmission (AoD) measurement, and / or an angle of arrival (AoA) measurement. Thus, a response to a received positioning reference signal may be based on or include a measurement of the received positioning reference signal, wherein the measurement may be any one of the above or any combination thereof.

[0048] Transmitting a positioning reference signal to a location indicated by a position estimate for verification is understood to mean that a positioning reference signal may be sent at least to a location or place indicated by a position estimate for verification. Thus, the position estimate may also be sent to other locations or places around the location indicated by the position estimate for verification. The area in which the positioning reference signal may be received depends, among other things, on the capabilities of the network in terms of directional transmission, as will be explained below.

[0049] In an example, at least one positioning reference signal is transmitted to a location indicated by a location estimate for verification using a transmission so that the positioning reference signal is receivable only at the location indicated by the location estimate for verification and at a limited area around the location estimate for verification. For example, the positioning reference signal may be receivable only within a coverage area of ​​one or more base stations or one or more cells or one or more beams that covers the location indicated by the location estimate for verification.

[0050] For example, at least one base station, multiple base stations, or precisely only one base station may be used to transmit at least one positioning reference signal to the location indicated by the position estimate for verification.

[0051] The term base station is to be understood broadly and may in particular cover base stations of 3G, 4G, 5G or any next generation cellular communication standard. Thus, a base station may in particular be a Node B (NB), an evolved Node B (eNB) or a next generation Node B (gNB).

[0052] In an example, at least one positioning reference signal is transmitted to a location indicated by a location estimate for verification using directional transmission. Directional transmission can be implemented in particular via beamforming. This allows the positioning reference signal to be transmitted to a very limited area (e.g., a portion of a cell) around the location estimate to be verified. For example, a positioning reference signal can be transmitted to a location indicated by a location estimate for verification using at least one or precisely one beam covering the location estimate for verification. In the case of multiple beams, at least one beam can cover the location estimate for verification. As explained above, a (spoofed) mobile device outside the coverage area of ​​the corresponding beam will not be able to respond to the positioning reference signal, while a mobile device within the coverage area of ​​the corresponding beam will basically be able to receive and respond to the positioning reference signal.

[0053] In an example, the network entity includes components for providing configuration data related to transmission of positioning reference signals from one or more base stations to a specific mobile device for (position) verification purposes to one or more base stations. For example, the configuration data may include information for the base station related to time and / or frequency resources for transmitting the positioning reference signal (to the specific mobile device). The respective base stations may then transmit the positioning reference signal according to the configuration data.

[0054] Likewise, in an exemplary embodiment, the network entity includes means for providing configuration data related to the transmission of positioning reference signals from one or more base stations to the specific mobile device requiring (position) integrity verification. For example, the configuration data may include information that enables the mobile device to know when and how to listen to the positioning reference signals (transmitted by one or more base stations). For example, the configuration data may include information about time and / or frequency resources for receiving the positioning reference signals at the mobile device.

[0055] Alternatively, the configuration data may also be related to the transmission of a positioning reference signal to be transmitted from the mobile device to one or more base stations (UL-PRS).

[0056] Configuration data may be sent so that only genuine mobile devices (not spoofed mobile devices) can receive or decode the configuration data. For example, the configuration data may be sent as a mobile device-specific transmission. For example, the configuration data may be sent to the mobile device via a data or control channel. For example, if the position estimate is an actual position estimate of a genuine mobile device, the mobile device will receive the configuration data and may measure positioning reference signals. If the position estimate is a spoofed position estimate of a spoofed mobile device, the device will not receive the configuration data, or will not be able to decode the configuration data, or will not be able to receive positioning reference signals. In other words, depending on the circumstances, the mobile device whose position estimate is to be verified may or may not be the same mobile device as the one that receives the configuration data.

[0057] The transmission of configuration data allows for ad-hoc configuration capabilities of the network and mobile devices. The configuration data may be sent only directly before the actual positioning reference signal and / or may be sent separately for each positioning reference signal. This may further improve security, as it will be more difficult for a spoofing mobile device to find out the configuration in order to receive positioning reference data.

[0058] In an example, the network entity comprises means for checking whether a response is received from the mobile device in response to the positioning reference signal in an attempt to validate the position estimate for validation. Receipt of a response to the positioning reference signal may be considered sufficient for validating the position estimate.

[0059] As explained above, if the mobile device is able to respond to the positioning reference signal, it can be assumed that the mobile device is in a certain position and in a certain state, i.e., has sufficient information (e.g., configuration data and / or security information, as will be explained below) to receive the positioning reference signal. Therefore, if a response from the mobile device is received in response to the positioning reference signal, the position estimate used for verification can be verified.

[0060] Conversely, if the mobile device fails to respond to the positioning reference signal, it may be assumed that the mobile device is not in a position and / or state to receive the positioning reference signal. Thus, if a response from the mobile device is not received in response to the positioning reference signal, the position estimate used for verification may not be verified. For example, after a predetermined time without a response, it may be assumed that the mobile device did not provide a response to the positioning reference signal.

[0061] In an example, a network entity device includes a component for determining an additional location estimate of a mobile device based on a potential response of the mobile device to a positioning reference signal. It may be the case that a spoofed mobile device is able to respond to a positioning reference signal because it may be close to a spoofed location and able to receive a positioning reference signal. However, the additional location estimate may indicate that the responding mobile device (which may typically be a spoofed mobile device or a real mobile device) may reside in a different location. To this end, the location estimate for verification and the additional location estimate may be compared to attempt to verify the location estimate for verification. If the location estimate for verification and the additional location estimate indicate the same location, the location estimate for verification may be verified, and if the location estimate for verification and the additional location estimate indicate different locations, the location estimate for verification may not be verified.

[0062] In an example, a network entity includes a component that does not verify a location estimate for verification if multiple responses are received from a mobile device in response to a positioning reference signal. This can allow identification of a spoofed location estimate, such as in a scenario where a spoofed mobile device pretends to be located at a location of a authentic mobile device that is close to the authentic mobile device, such that the spoofed mobile device and the authentic mobile device are located at the same location. Therefore, they can both receive the positioning reference signal and can both be in a state to provide a corresponding response. Therefore, multiple responses to the positioning reference signal can be considered an indicator of a spoofed location estimate.

[0063] In the example, the network entity includes a component for transmitting or causing a random number to be transmitted to a mobile device. The random number can be used, for example, to scramble or encode a positioning reference signal. Then, the mobile device can use the random number to descramble or decode the scrambled or encoded random number. Therefore, the random number can be considered as a security random number or a cryptographic random number. However, more generally, other encrypted information can also be used. It is usually only important to ensure that such information used for scrambling / descrambling or encoding / decoding positioning reference signals is only available at a real mobile device located at a location to be verified. The process of descrambling / scrambling or decoding / encoding can be particularly applied to the digital domain. For example, the random number can be transmitted to the mobile device via a data channel or a control channel (such as DCH or CCH). For example, the transmission of the random number to the mobile device can be a secure transmission, thereby ensuring that only a real mobile device can receive the random number. For example, the random number can be transmitted via a security service application. A random number is generally understood to be any arbitrary information (such as a number or a word) that is used only once for the purpose of protecting communication. For example, the random number can be a random number or a pseudo-random number, which can be published in an authentication protocol. This may ensure that a previous communication session (ie the data exchanged therein) cannot be reused in a reoccurrence attack.

[0064] The random number can be configured or transmitted in particular via a high layer (e.g., a high service layer). For example, a security service application and / or a security service application layer can be used to configure or transmit the random number. This can ensure that only a real mobile device (not a spoofed mobile device) can receive the random number. For example, the high layer can be understood as any layer above the physical layer or any layer above layer 1 of the OSI model. In one example, the high layer can be a data link layer or a network layer. For example, the high layer can be layer 2 or layer 3 (or even above) of the OSI model. For example, the high layer can be a media access control MAC layer (as a sublayer of the data link layer). For example, the random number can be configured or transmitted via a radio resource control RRC protocol (as part of the network layer). For example, the high layer can be a layer (e.g., an application layer) of the application level, layer 7 of the OSI model. If the random number is transmitted via a security service application, it can be understood to mean that the random number is transmitted above the RAN layer (e.g., above layer 3). The security service application can have or provide its own security operation (e.g., based on a key or password) so that the communication can be encrypted at the application level. The mobile device application may then pass the random number down to the physical layer (layer 1) for receiving / transmitting positioning reference signals. In contrast, positioning reference signal transmission may (eg, exclusively) operate at the physical layer.

[0065] Note that, depending on the situation, the mobile device may or may not be the device whose location estimate is to be verified. That is, if the location estimate of an authentic device is to be verified, then this authentic mobile device will also receive the correct random number. However, if the location estimate of a spoofed device is to be verified, then the spoofed mobile device will not be able to receive the (correct) random number.

[0066] In an example, the random number may be transmitted to the mobile device as part of the configuration data before the positioning reference signal is transmitted. As explained above, the configuration data may only be received by a genuine mobile device and not by a spoofed mobile device (e.g., because it is sent via a secure channel or a secure service application). Therefore, only the genuine mobile device can receive the configuration data and the random number.

[0067] As explained above, only mobile devices that are actually residing at or close to the location indicated by the location estimate (e.g., within the coverage area of ​​the corresponding base station, cell, or beam) and are correctly configured can receive the positioning reference signal, and in particular can measure positioning measurements based on the PRS scrambled by the random number. A genuine UE that decodes the PRS based on the random number can respond to the positioning reference signal. A spoofed mobile device cannot receive or decode the PRS scrambled by the dedicated random number.

[0068] In an example, before transmitting the positioning reference signal, the random number may be transmitted or caused to be transmitted to the base station, for example as part of a configuration signal. The base station may then, for example, transmit the random number together with the positioning reference signal, or scramble or encode the positioning reference signal together with the random number. Accordingly, in an example, the network entity comprises means for transmitting or causing the positioning reference signal to be transmitted based on the random number, and in particular for scrambling the positioning reference signal based on the random number for transmission to the location indicated by the location estimate for verification.

[0069] In an example, the network entity comprises means for checking whether an obtained response from a mobile device in response to a positioning reference signal comprises a random number.

[0070] As already explained, verification of the position estimate may be performed by checking at the network whether a response is received (because the positioning reference signal may be descrambled or decoded) and / or whether a correct random number is returned to the network.

[0071] From the perspective of the mobile device, the random number is received from the network (eg, from a base station as described above). The mobile device may then use the random number to receive and / or respond to a positioning reference signal.

[0072] In one example, a mobile device receives a positioning reference signal from a network, and it uses the received random number for receiving the positioning reference signal from the network. For example, as described above, the received random number is used to receive the positioning reference signal from the network by descrambling or decoding the positioning reference signal based on at least the random number. The mobile device can then transmit a response to the received positioning reference signal to the network for verification of the location estimate of the mobile device.

[0073] In another example, the mobile device receives a positioning reference signal from the network. It transmits a response to the received positioning reference signal to the network for verifying the position estimate of the mobile device, and can use the received random number for transmitting the response to the received positioning reference signal to the network. For example, the received random number can be used to transmit the response to the received positioning reference signal to the network by transmitting the random number itself to the network in response to the positioning reference signal.

[0074] As described above, the mobile device may obtain configuration data related to reception of positioning reference signals, which may indicate time and / or frequency resources for receiving positioning reference signals. In addition, the mobile device may receive a random number as part of the configuration data.

[0075] In an example, the positioning reference signal is a downlink positioning reference signal. Preferably, the positioning reference signal is an aperiodic positioning reference signal. In contrast to a periodic positioning reference signal, an aperiodic positioning reference signal is not transmitted periodically or repeatedly. For example, an aperiodic reference signal is only transmitted once. This can further reduce the risk that a spoofing device can receive the positioning reference signal and can spoof the location.

[0076] In an example, the positioning reference signal is an on-demand positioning reference signal. An on-demand reference signal is transmitted only when it is requested or desired. For example, a network entity may request transmission of an on-demand reference in order to perform the described verification process.

[0077] Aperiodic or on-demand positioning reference signals are particularly useful for use in verification of position estimates. Positioning reference signals can be specifically triggered when needed for verification purposes and otherwise do not occupy resources. In addition, since the process of transmitting positioning reference signals and responses can be specifically designed for the purpose of verifying position estimates, for example, scrambling the positioning reference signal with a random number, where the random number is transmitted via the application that needs to verify the position estimate.

[0078] In an example, multiple base stations and / or multiple beams (of one or more base stations) are used to transmit multiple positioning reference signals, wherein some or all base stations and / or beams use different random numbers to transmit corresponding positioning reference signals. As already explained above, the random number can be used to transmit the positioning reference signal by, for example, scrambling the positioning reference signal based on the random number.

[0079] The mobile device will only be able to receive the (correct) random number transmitted by the base station or beam covering the actual location of the mobile device, for example using a secure service application. The random number transmitted by the base station or beam covering the spoofed location will not be received by the mobile device. Alternatively, the random number configured at the secure service application layer cannot be received by other mobile devices.

[0080] In an example, the network entity includes a component for notifying a user of a mobile device of potential spoofing if the location estimate for verification is not verified. For example, the user of the mobile device may receive a push message. Note that the user is typically the user of the real mobile device, so the mobile device may not necessarily be the mobile device whose location estimate is to be verified.

[0081] Additionally or alternatively, the network entity includes means for notifying an operator of the network of the presence of potential spoofing if the location estimate for verification is not verified. Additionally or alternatively, the network entity includes means for notifying another network function or another network entity of the presence of potential spoofing if the location estimate for verification is not verified. For example, the presence of spoofing may be logged by the network, the corresponding network function, or the corresponding network entity. For example, this information may be used for any immediate measurements, or it may be logged for future analysis.

[0082] Additionally or alternatively, access to services requesting the location of the mobile device or requesting a location estimate, such as access to information, authorizing a payment, opening a door, etc., may be denied. Alternatively, in an example, the verification process or a portion thereof may be repeated and verification of the location estimate used for verification may be attempted again.

[0083] In an example, the network entity includes components for determining, by a higher layer in the network entity, a random number for positioning integrity. For example, the network entity may then determine a random seed associated with sequence generation of a positioning reference signal (e.g., based on the random number). The positioning reference signal is then transmitted from the network to the mobile device.

[0084] Additionally or alternatively, in an example, the network entity may include a component for obtaining a random number from a service application. In this case, the network entity may not need to determine the random number by itself, but may obtain the random number from a different entity. For example, the service application may also determine a random seed associated with the sequence generation of the positioning reference signal. The network entity and the corresponding mobile device may then be provided with a random number or a random seed, for example, at the service application layer.

[0085] Accordingly, the mobile device comprises means for receiving a random number from the network or from a service application via a service application layer.

[0086] In an example, the network entity is or includes a base station. In an example, the network entity is or includes implementing a location management function. In an example, the network entity is or includes a network entity in communication with at least one base station.

[0087] The described embodiments may have the advantage that the network has the ability to detect a mobile device spoofing its location and, if necessary, to improve the integrity level (confidence, accuracy) of previous location measurements.

[0088] The described method can be applied to, and combined with, substantially any positioning method. This is particularly advantageous for any location-based service and / or application that may require positioning with a certain level of integrity / confidence relative to location, such as services / applications that use or rely on geo-fencing.

[0089] It should be understood that the embodiments disclosed herein are presented by way of example only and not limitation.

[0090] Here, the disclosure of a method step should also be considered as the disclosure of a component for performing the corresponding method step. Likewise, the disclosure of a component for performing a method step should also be considered as the disclosure of the method step itself.

[0091] Other features of the present disclosure will become apparent from the following detailed description considered in conjunction with the accompanying drawings. However, it should be understood that the drawings are designed for illustrative purposes only and not as a definition of the limits of the present disclosure, which should be referred to the appended claims. It should also be understood that the drawings are not drawn to scale and that they are intended only to conceptually illustrate the structures and processes herein. BRIEF DESCRIPTION OF THE DRAWINGS

[0092] Figure 1 is a schematic diagram illustrating an example radio environment in which exemplary embodiments of the present disclosure may be performed;

[0093] Figure 2 is a flow chart of an exemplary embodiment of the present disclosure;

[0094] Figure 3a is a schematic diagram illustrating an exemplary embodiment of the present disclosure;

[0095] Figure 3b is a flow chart of an exemplary embodiment of the present disclosure;

[0096] Figure 4a is a schematic diagram illustrating an exemplary embodiment of the present disclosure.

[0097] Figure 4b is a flow chart of an exemplary embodiment of the present disclosure;

[0098] Figure 5a is an exemplary signaling diagram of an exemplary embodiment of the present disclosure;

[0099] Figure 5b is a flow chart of an exemplary embodiment of the present disclosure;

[0100] Figure 6 is a block diagram of an exemplary embodiment of an apparatus according to the present disclosure;

[0101] Figure 7is a block diagram of an exemplary embodiment of a base station; and

[0102] Figure 8 is a schematic diagram of an example of a tangible and non-transitory computer-readable storage medium. DETAILED DESCRIPTION

[0103] The following description is for deepening the understanding of the present disclosure, and should be understood as supplementing the description of the exemplary embodiments of the present disclosure provided in the above summary of this specification and read together with the above description.

[0104] While the specific radio system in the following examples is 5G, this is to be considered as a non-limiting example only.

[0105] Figure 1 An example environment is shown in which the present disclosure may be applied. Figure 1 A 5G communication network is shown, which introduces new radio technologies, and the architecture of the different sub-layers of the RAN can be split into two logical entities in the communication network control element (such as a BS or gNB), which can be referred to as a distributed unit (DU) and a central unit (CU). For example, a CU is a logical node that controls the operation of one or more DUs on a front-haul interface (referred to as an F1 interface). A DU is a logical node that includes a subset of gNB functions depending on the functional split option.

[0106] like Figure 1 As shown, as an example of a mobile device of the second exemplary aspect, a mobile device such as a user equipment (UE) 10 is connected to cell 1 via a communication beam of cell 1 of a base station gNB 20. Figure 1 In the example shown, the gNB 20 has a CU 23 and two DUs 21 and 22 connected to the CU 23 via an F1 interface. Figure 1 As shown in the example of , there are multiple additional cells (in Figure 1 In the figure, two cells, namely cell 2 and cell 3, are shown for illustration purposes. Similar to cell 1, cells 2 and 3 are controlled by gNBs 25 and 26, respectively, and each provides multiple beams 1 to 3. Different beams of the 5G network can be used for beam diversity or beam hopping.

[0107] like Figure 1 As shown, each base station or gNB of the cell is connected to the core network, such as 5GC, via a corresponding interface denoted as NG interface. In addition, each gNB of the cell is connected to each other through a specific interface, which is called, for example, Xn-C interface.

[0108] Any network entity (such as gNB, gNB-DU, gNB-CU and / or 5GC) may, alone or together, be an example of a network entity according to the first aspect of the present disclosure.

[0109] In the following examples, the positioning reference signal may be an on-demand downlink positioning reference signal (DL PRS). On-demand DL PRS transmission can be dynamically indicated and allocated via UE-specific downlink control information (DCI) as a response to a positioning service request. Depending on the corresponding service, the request can be triggered by the UE or the network. In addition, specific DL PRS transmission resources and scheduling can be provided to the UE, which can be constructed based on previous reports or data service resource information.

[0110] An example of the proposed verification process using the use case and configuration of the on-demand PRS is referenced below. Figure 2 Overview.

[0111] Typically, (regular) positioning services are provided to users. To this end, the cell configures DL PRS and UL SRS, and the network and UE perform normal measurements and reporting (action 201).

[0112] Since positioning is an important factor for communication integrity and security, for specific service purposes of location-based services (for example, services regarding shopping in a market or opening of an entrance door, etc.), the network or the user can request security verification (action 202) from the location management function LMF (or generally, from the network).

[0113] Based on the conventional positioning estimate, the LMF initiates a verification procedure on the estimated UE position (action 203). As explained, this may be required or requested for sensitive / security-related applications. In addition, this procedure may be triggered for irregularities detected in the UE behavior.

[0114] The LMF then requests the serving base station and / or a plurality of neighboring base stations (which may be none or at most those neighboring base stations within the PRS detection range of the UE) to transmit an on-demand PRS to the target UE location (action 204). The on-demand PRS sent to the target UE may optionally be encrypted by a cryptographic random number that allows the LMF to verify whether the UE location is legitimate or spoofed.

[0115] To this end, the UE can be requested to measure the on-demand PRS and report the results back to the LMF for security verification purposes. In on-demand PRS scheduling, the following two examples of the verification process for this scenario are shown.

[0116] In one embodiment, the spoofed UE pretends to be present at a service point (e.g., a bank ATM, a vending machine, etc.) at a distance. For verification, it can be checked whether the target UE is actually located at the service location measured by conventional positioning estimation. To this end, the LMF schedules an on-demand PRS at the service location using beamforming and requests the UE to measure the on-demand PRS (action 205a). If the UE is not present at the service point, measurements cannot be performed and reports cannot be received, so it can be assumed that a spoofed UE exists. Therefore, if the LMF does not receive any measurement reports (e.g., within a limited time window), the LMF can issue a security notification to the security layer of the service application that it has detected a spoofing attempt.

[0117] In another embodiment, the spoofed UE is considered to be present at the service point together with the real UE or near co-located with the real UE. For verification, it can be checked whether the target UE is really located at the service location and whether the service is under a secure service. In this case as well, the LMF schedules the on-demand PRS at the service location using beamforming. However, in this embodiment, the PRS is scheduled together with a secure random number. The secure random number can be sent by the data channel (DCH or CCH) through the secure service application (action 205b). The on-demand PRS sequence is scrambled with the random number by the seed combination, so the on-demand PRS cannot be read if the random number is not known. If the UE is not present at the service point or cannot receive the on-demand PRS, the measurement cannot be performed and a spoofing attempt can be assumed. Therefore, the presence of the UE and the integrity of the position estimate can be checked.

[0118] The LMF may then attempt to verify the reported UE measurements of the on-demand PRS. Possible verification assessments depend on the UE measurements in response to the on-demand PRS (action 206). If the on-demand PRS measurements are successfully verified (action 207b), the security of the location-based service is authenticated (action 208b). If the on-demand PRS measurements are not verified, it is assumed that the target UE is unknown and the location may be spoofed (action 207a). As a result, as subsequent actions, the measurements may be repeated, the (location-based) service may be denied, or an alert may be issued to the operator (action 208a).

[0119] The above-described use of on-demand PRS for location verification / spoofing detection, and in particular, the use of beamforming and self-organizing configuration capabilities of on-demand PRS for location verification / spoofing detection, allows for improved integrity or security of positioning of UEs in a communication network.

[0120] Will use Figure 3a , 3b , Figure 4a , 4b as well as Figure 5a , 5b The above method is further described with reference to the example illustrated in FIG.

[0121] First turn Figure 3a , 3b , describes an example of a security verification process implemented in a network and a UE using an on-demand PRS, wherein the beamforming and self-organizing configuration capabilities of an on-demand DL-PRS signal are used to verify the UE location. In other words, the described location verification process allows the UE location to be verified using the beamformed on-demand PRS configuration and transmission.

[0122] A location estimate of a mobile device is obtained for use in authentication (act 301).

[0123] The network entity then transmits or causes transmission of a positioning reference signal, PRS, to the location indicated by the location estimate for verification (action 302). That is, the network attempts aperiodic or on-demand DL-PRS scheduling for UE verification purposes so that the PRS is transmitted to a serving location known from previous measurements. In this case, Figure 3a As shown, the PRS is transmitted to location A via beams BS1a, BS2a of base stations BS1 and BS2.

[0124] A genuine UE at location A is expected to measure and report one or more corresponding positioning measurements based on the on-demand PRS so that location A can be verified. A spoofed UE residing at location A but pretending to be at a geographically different location B (i.e., in particular in the coverage area of ​​a different beam and / or base station) will not be able to measure the on-demand PRS, since in this case the PRS will be sent to the spoofed UE location B via beams BS1b, BS2b of base stations BS1 and BS2.

[0125] Accordingly, it can be checked whether a response is received from the mobile device in response to the positioning reference signal to attempt to validate the position estimate for verification (act 303).

[0126] In the event that a response is received from the mobile device in response to the positioning reference signal, the position estimate used for verification is verified (act 304a). In the event that no response is received from the mobile device in response to the positioning reference signal, the position estimate used for verification is not verified (act 304b).

[0127] In the case where a spoofed UE is likely to be co-located with a genuine UE, and if it is also able to act like a genuine UE, the base station or LMF can collect multiple reports in response to the on-demand PRS. In the case where the serving base station should somehow collect such multiple measurements in response to a one-time on-demand PRS, the LMF can conclude that one of the responses is spoofed. This means that the LMF is at least able to detect the presence of a spoofed UE, and the service can notify the user that there may be spoofing.

[0128] Now turn to Figure 4a , 4b , describes an example of a secure authentication process using on-demand PRS, which not only utilizes beamforming and on-demand DL-PRS signals, but also utilizes cryptographic random numbers to enhance location authentication.

[0129] First, something like Figure 3a , 3b In the example of FIG. 4 , a location estimate of a mobile device is obtained for authentication (act 401 ).

[0130] The network entity then transmits or causes transmission of a Positioning Reference Signal (PRS) to the location indicated by the position estimate for verification (action 402). That is, the network attempts aperiodic or on-demand DL-PRS scheduling for UE verification purposes such that the PRS is transmitted to a serving location known from previous measurements.

[0131] and Figure 3a , 3b In contrast to the example of Figure 4a As shown, the PRS is transmitted to various locations, especially locations A and B, via different beams of base stations BS1 and BS2. However, each beam transmission utilizes a different random number (in Figure 4a The PRS is scrambled by the base station (referred to as "random number 1" to "random number 6") in the figure. Therefore, multiple base stations, cells and / or beams can cooperate to verify the test UE through separate transmissions from each entity. The LMF can coordinate the corresponding transmissions.

[0132] As described above, for example, a genuine UE at location A can measure and report one or more corresponding positioning measurements based on the on-demand PRS, so that location A can be verified. For verification purposes at location A, only the corresponding random number 1 and random number 6 for descrambling the two PRSs will be obtained. A spoofed UE residing at location A but disguised at a geographically different location B (i.e., in particular, in the coverage area of ​​a different beam) will not be able to measure the two on-demand PRSs scrambled with random numbers 3 and 4, respectively, and the UE is not physically in the corresponding coverage area of ​​the beams transmitting the two PRSs scrambled with random numbers 3 and 4, respectively. Accordingly, even if the UE at location A receives the PRS at location A, it will not be able to spoof the location at B because it will not be able to respond with the correct random number because it does not know random number 3 and random number 4.

[0133] Accordingly, it can be checked whether a response is received from the mobile device in response to the positioning reference signal to attempt to validate the position estimate for verification (action 403).

[0134] In the case where a response is received from the mobile device in response to the positioning reference signal, the location estimate used for verification is verified, and in the case where no response is received from the mobile device in response to the positioning reference signal or a response with an incorrect random number is received, the location estimate used for verification is not verified.

[0135] Now go to Figure 5a , 5b , describes another example of a security verification process using on-demand PRS, which also utilizes beamforming, on-demand DL-PRS, and cryptographic random numbers to enhance location verification.

[0136] The LMF obtains a location estimate of the mobile device for authentication (act 501).

[0137] The LMF configures the (real) UE (in the case of a UE) for receiving the on-demand PRS by transmitting configuration data (e.g., time and frequency resources). Figure 5a The UE is configured to receive not only the on-demand PRS configuration, but also the random number ( Figure 5a Action 1a and Figure 5b 502 in FIG. 50). Accordingly, the UE receives a random number from the network (action 503). However, a UE that spoofs its location will not receive the configuration signal (e.g. Figure 5a ).

[0138] The LMF also configures the serving BS for the on-demand PRS (in Figure 5a ) and optional neighboring BSs (indicated as "BS1" in Figure 5aThe configuration may be set by the NR Positioning Protocol A (NRPPa). The base stations involved (i.e., the serving base station and no neighboring base station, one neighboring base station, or multiple neighboring base stations) are additionally configured with a random number (a random number used only once). For example, before transmitting the positioning reference signal, the LMF sends the random number as part of the configuration data to each base station ( Figure 5a Action 1b and Figure 5b Action 504 in ).

[0139] Then, any base station involved will send the PRS scrambled with a random number to the location configured by the LMF (which is known from any previous positioning) ( Figure 5a Action 2 and Figure 5b Action 505 in ).

[0140] For example, a secure random number may be sent via a data channel (such as DCH or CCH) by a secure service application. A real UE is able to receive the scheduled DL-PRS at a real location and decode the trigger signal transmitted in the security layer or RAN protocol of RRC, MAC-CE and / or DCI. To this end, signaling for a secure random number may exist in the on-demand PRS configuration support. It includes an on-demand PRS TX / RX processing behavior that scrambles the PRS sequence using a scrambling seed combined with a random number.

[0141] Any (real) UE will correctly receive the PRS and perform measurements on the PRS scrambled with a random number. Specifically, in the case where the PRS is scrambled based on a random number, the real UE has the random number and will be able to descramble the PRS. Therefore, the real UE is correctly configured to measure the PRS scrambled with a random number and receive the PRS at its location so that the UE can perform measurements as expected ( Figure 5a Action 3b and Figure 5b Action 506 in ).

[0142] In contrast, a spoofed UE cannot correctly measure the PRS because i) it is not configured to measure it and therefore does not know the correct parameters for the measurement, and ii) even if it guessed the parameters correctly, the PRS cannot be received at the actual location of the spoofed UE because the PRS is sent to the spoofed location (not the actual location). Therefore, any UE that spoofs its location will not be able to receive the PRS (action 3a and by Figure 5a ).

[0143] UEs will report their PRS measurements ( Figure 5a Action 4 and Figure 5bIn contrast, due to the reasons given above, the spoofed UE cannot report the correct PRS and random number measurements (again due to Figure 5a denoted by the dotted line in ).

[0144] The LMF attempts to verify the potentially received PRS measurements (if any) ( Figure 5a Action 5 and Figure 5b The LMF will detect incorrect measurements and random numbers originating from a spoofed UE. However, if the verification process in action 5 / action 508 is successful, the LMF can verify the UE location ( Figure 5a Action 6).

[0145] The above examples provide the LMF with the ability to detect location spoofing. If necessary, the LMF is able to improve the integrity level (trustworthiness, accuracy) of the previous location measurement. Any positioning method (meaning initial location estimate) can be used in combination with the described method. The described method is particularly advantageous for location-based services / applications, which may require the location to be located with a certain level of integrity / trustworthiness, such as geo-fencing services / applications.

[0146] Now go to Figure 6 , a block diagram of an exemplary embodiment of a mobile device according to the present disclosure is shown, the mobile device being in the form of a mobile device 600 representing a UE, e.g. Figure 1 UE 10. For example, the mobile device 600 may be one of a smart phone, a tablet computer, a laptop computer, a smart watch, a smart bracelet, and an IoT device.

[0147] The mobile device 600 includes a processor 601. The processor 601 may represent a single processor or two or more processors, which are at least partially coupled, for example, via a bus. The processor 601 executes program code stored in a program memory 602 (for example, when executed on the processor 601, the program code that enables the mobile device 600 to optionally perform one or more embodiments of the method according to the present disclosure or a part thereof together with the network entity 700) and is connected to a main memory 603. The program memory 602 may also include an operating system for the processor 601. Some or all of the memories 602 and 603 may also be included in the processor 601.

[0148] One or both of the processor's main memory and program memory (eg program memory 602 and main memory 603) may be fixedly connected to the processor (eg processor 601) or may be at least partially removable from the processor, eg in the form of a memory card or stick.

[0149] The program memory (e.g., program memory 602) may be, for example, a non-volatile memory. For example, it may be any one of a flash memory (FLASH) memory (or a portion thereof), a ROM, a PROM, an EPROM, an MRAM or a FeRAM (or a portion thereof), or a hard disk (or a portion thereof), to name a few examples. For example, the program memory may, for example, include a first memory portion that is fixedly installed, and a second memory portion that may be removed, for example, in the form of a removable SD memory card.

[0150] The main memory (e.g., main memory 603) may be, for example, a volatile memory. By way of non-limiting example, it may be, for example, a DRAM memory. For example, it may be used as a working memory for the processor 601 when executing an operating system, an application, a program, etc.

[0151] The processor 601 also controls a communication interface 604 (e.g., a radio interface) configured to receive and / or transmit data and / or information. For example, the communication interface 604 may be configured to transmit and / or receive radio signals from a radio node such as a base station. It should be understood that any computer program code-based processing required to receive and / or evaluate radio signals may be stored in the communication interface 604's own memory and executed by the communication interface 604's own processor, or it may be stored, for example, in the memory 603 and executed, for example, by the processor 601.

[0152] The communication interface 604 may be configured to communicate in accordance with a cellular communication system such as 2G / 3G / 4G / 5G or a next generation cellular communication system. The mobile device 600 may use the radio interface 604 to communicate with a base station (e.g. Figure 1 Communicates with the base station 20) shown.

[0153] For example, the communication interface 604 may also include a BLE and / or a Bluetooth radio interface including a BLE transmitter, a receiver, or a transceiver. For example, the radio interface 604 may additionally or alternatively include a WLAN radio interface including at least a WLAN transmitter, a receiver, or a transceiver.

[0154] The components 602 to 604 of the mobile device 600 may be connected to the processor 601 , for example, via one or more serial and / or parallel buses.

[0155] It should be understood that the mobile device 600 may include various other components. For example, the mobile device 600 may optionally include a user interface (eg, a touch-sensitive display, a keyboard, a touchpad, a display, etc.).

[0156] Figure 7 Such as Figure 1 2 and / or a core network 30 (or a portion thereof). For example, the network entity 700 may be configured to schedule and / or transmit positioning reference signals to mobile devices, as described above.

[0157] The device 700 includes a processor 701. The processor 701 may represent a single processor or two or more processors, which are at least partially coupled, for example, via a bus. The processor 701 executes program codes stored in a program memory 702 (e.g., a program code that enables the device 700 to execute alone or together with the mobile device 600 according to an embodiment of the present disclosure or a portion thereof), and is connected to a main memory 703.

[0158] Program memory 702 may also include an operating system for processor 701. Some or all of memories 702 and 703 may also be included in processor 701.

[0159] Furthermore, the processor 701 controls a communication interface 704, which is configured, for example, to communicate according to a cellular communication system such as 2G / 3G / 4G / 5G. The communication interface 704 of the apparatus 700 may be implemented, for example, by the radio head 30 and may be provided for Figure 1 Communication between the base station 20 and the UE 10 in the system.

[0160] The components 702 to 704 of the apparatus 700 may be connected to the processor 701 , for example, via one or more serial and / or parallel buses.

[0161] The mobile device 600 together with the communication interface 604 may be specifically configured for receiving positioning reference signals from the network entity 700 according to the method solutions described herein.

[0162] It should be understood that the apparatus 600, 700 may include various other components.

[0163] Figure 8 According to the present disclosure, it can be used to implement, for example Figure 6 Memory 602 or Figure 7 702 of the memory 702 is a schematic diagram of an example of a tangible and non-transitory computer-readable storage medium. To this end, Figure 8 Shown are, for example, a flash memory 800 that can be soldered or bonded to a printed circuit board, a solid-state drive 801 including multiple memory chips (e.g., flash memory chips), a magnetic hard disk drive 802, a secure digital (SD) card 803, a universal serial bus (USB) memory stick 804, an optical storage medium 805 (e.g., a CD-ROM or DVD), and a magnetic storage medium 806.

[0164] The following embodiments are also disclosed:

[0165] 1. A network entity comprising components for the following operations:

[0166] obtaining or determining a location estimate of the mobile device for verification;

[0167] transmitting or causing transmission of a positioning reference signal to the location indicated by the position estimate for verification; and

[0168] Validation of the position estimate is attempted based at least on a potential response received from the mobile device in response to the positioning reference signal for validation.

[0169] 2. The network entity of embodiment 1, wherein the positioning reference signal is transmitted to the location indicated by the position estimate for verification using one or more of the following:

[0170] at least one base station;

[0171] One base station precisely;

[0172] Multiple base stations;

[0173] Directional transmission;

[0174] Beamforming;

[0175] transmitting so that the positioning reference signal is receivable only at the position estimate used for verification and in a limited area around the position estimate used for verification;

[0176] covering at least one beam for verifying the position estimate;

[0177] Covering exactly one beam for the position estimate to be verified; and / or

[0178] A plurality of beams, at least one beam covering a position estimate for verification.

[0179] 3. The network entity of embodiment 1 or 2, wherein the network entity includes components for one or more of the following:

[0180] providing, to one or more base stations, configuration data relating to transmission of positioning reference signals from the one or more base stations to a particular mobile device for verification purposes;

[0181] Configuration data related to transmission of positioning reference signals from one or more base stations to a particular mobile device requiring integrity verification is provided to the particular mobile device.

[0182] 4. The network entity of any one of embodiments 1 to 3, wherein the network entity comprises components for one or more of the following:

[0183] checking whether a response is received from the mobile device in response to the positioning reference signal to attempt to validate the position estimate for verification;

[0184] Upon receiving a response from the mobile device in response to the positioning reference signal, verifying the position estimate for verification; and / or

[0185] In the event that no response is received from the mobile device in response to the positioning reference signal, the position estimate used for verification is not verified.

[0186] 5. The network entity of any one of embodiments 1 to 4, wherein the network entity device comprises means for one or more of the following:

[0187] determining an additional position estimate of the mobile device based on a potential response of the mobile device to the positioning reference signal;

[0188] comparing the validated position estimate with another position estimate to attempt to validate the validated position estimate;

[0189] verifying the position estimate used for verification, where the position estimate used for verification and the further position estimate indicate the same position; and / or

[0190] In case the position estimate used for verification and the further position estimate indicate different positions, the position estimate used for verification is not verified.

[0191] 6. The network entity of any one of embodiments 1 to 5, wherein the network entity comprises components for the following operations:

[0192] In the event that multiple responses are received from the mobile device in response to the positioning reference signal, the position estimate used for verification is not verified.

[0193] 7. The network entity of any one of embodiments 1 to 6, wherein the network entity comprises components for one or more of the following:

[0194] transmit or cause to be transmitted a random number to a mobile device;

[0195] transmitting or causing to be transmitted a random number to a mobile device via a data channel or a control channel;

[0196] transmitting or causing to be transmitted a random number to the mobile device as part of the configuration data prior to transmission of the positioning reference signal; and / or

[0197] Prior to transmission of the positioning reference signal, the random number is transmitted or caused to be transmitted to the base station as part of the configuration data.

[0198] 8. The network entity of embodiment 7, wherein the network entity includes components for one or more of the following:

[0199] transmitting or causing to be transmitted a positioning reference signal based on the random number;

[0200] scrambling a positioning reference signal based on a random number for transmission to a location indicated by a position estimate for verification; and / or

[0201] Checking whether a response obtained from the mobile device in response to the positioning reference signal includes a random number.

[0202] 9. The network entity of any one of embodiments 1 to 8, wherein the positioning reference signal is one or more of the following:

[0203] Aperiodic positioning reference signal;

[0204] Positioning reference signals as needed; and / or

[0205] Downlink Positioning Reference Signal.

[0206] 10. A network entity of any one of embodiments 1 to 9, wherein multiple base stations and / or multiple beams are used to transmit multiple positioning reference signals, wherein some or all of the base stations and / or beams use different random numbers for transmitting corresponding positioning reference signals.

[0207] 11. The network entity of any one of embodiments 1 to 10, wherein the network entity comprises components for one or more of the following:

[0208] In the event that the location estimate used for verification is not verified, notifying the user of the mobile device of potential fraud; and / or

[0209] In the event that the position estimate used for verification is not verified, notifying the network operator of potential fraud; and / or

[0210] In the event that the position estimate used for verification is not verified, another network function or another network entity is notified that potential spoofing exists.

[0211] 12. The network entity of any one of embodiments 1 to 11, wherein the network entity comprises components for one or more of the following:

[0212] Determining, by a higher layer in a network entity, a random number for location integrity; and

[0213] Get a random number from the service application.

[0214] 13. The network entity of any one of embodiments 1 to 12, wherein the network entity is or includes at least one of the following:

[0215] Base station;

[0216] A network entity that implements location management functions;

[0217] A network entity in communication with at least one base station.

[0218] 14. A method performed at least by a network entity, the method comprising:

[0219] obtaining or determining a location estimate of the mobile device for verification;

[0220] Based on the position estimate for verification, transmitting or causing transmission of a positioning reference signal to the location indicated by the position estimate for verification; and

[0221] Validation of the position estimate for validation is attempted based at least on a potential response received from the mobile device in response to the positioning reference signal.

[0222] 15. A mobile device comprising components for:

[0223] Receive a random number from the network;

[0224] receiving a positioning reference signal from a network;

[0225] transmitting a response to the received positioning reference signal to a network for use in validating a position estimate of the mobile device; and

[0226] The received random number is used for at least one of: receiving a positioning reference signal from a network; and transmitting a response to the received positioning reference signal to the network.

[0227] 16. The mobile device of embodiment 15, wherein the response to the received positioning reference signal is based on a measurement of the received positioning reference signal, the measurement comprising one or more of the following:

[0228] Time measurement;

[0229] Angle measurement;

[0230] Signal receiving power measurement;

[0231] Downlink time difference of arrival DL-TDOA measurement;

[0232] Uplink time difference of arrival UL-TDOA measurement;

[0233] Downlink transmit angle AoD measurement; and

[0234] Angle of arrival AoA measurement.

[0235] 17. The mobile device of embodiment 15 or 16, wherein the received random number is used to receive a positioning reference signal from a network by descrambling the positioning reference signal based at least on the random number.

[0236] 18. The mobile device of any one of embodiments 15 to 17, the mobile device comprising components for the following operations:

[0237] Configuration data related to reception of a positioning reference signal is obtained.

[0238] 19. The mobile device of any one of embodiments 15 to 18, the mobile device comprising components for the following operations:

[0239] A random number is received from the network via the service application layer.

[0240] 20. A method performed at least by a mobile device, the method comprising:

[0241] Receive a random number from the network;

[0242] receiving a positioning reference signal from a network;

[0243] transmitting a response to the received positioning reference signal to a network for use in validating a position estimate of the mobile device; and

[0244] The received random number is used for at least one of: receiving a positioning reference signal from a network; and transmitting a response to the received positioning reference signal to the network.

[0245] 21. Computer program code which, when executed by a processor of an apparatus, causes the apparatus to perform the method according to any one of embodiments 14 or 20.

[0246] 22. A computer readable storage medium comprising the computer program code according to embodiment 21.

[0247] Any connections presented in the described embodiments should be understood in a manner that the components involved are operatively coupled. Thus, the connection may be direct or indirect, with any number or combination of intervening elements, and there may only be a functional relationship between the components.

[0248] Furthermore, as used in this application, the term "circuitry" may refer to any of the following:

[0249] (a) a pure hardware circuit implementation (such as an implementation using only analog and / or digital circuitry), and

[0250] (b) a combination of circuitry and software (and / or firmware), such as: (i) a combination of a processor or (ii) a processor / software (including portions of a digital signal processor, software and memory that work together to enable a device such as a mobile phone to perform various functions) and

[0251] (c) Circuitry that requires software or firmware to operate even if the software or firmware is not physically present, such as a microprocessor or portion of a microprocessor.

[0252] This definition of "circuitry" applies to all uses of this term in this application, including in any claims. As another example, as used in this application, the term "circuitry" also covers an implementation of merely a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its accompanying software and / or firmware. The term circuitry also covers, for example, a baseband integrated circuit or an application processor integrated circuit for a mobile phone.

[0253] Any processor referred to herein may be any suitable type of processor, in particular but not limited to Figure 6 and 7 Processors 601 and 701. Any processor may include, but is not limited to, one or more microprocessors, one or more processors with an accompanying digital signal processor, one or more processors without an accompanying digital signal processor, one or more special purpose computer chips, one or more field programmable gate arrays (FPGAs), one or more controllers, one or more application specific integrated circuits (ASICs), or one or more computers. The relevant structure / hardware has been programmed in a manner to perform the described functions.

[0254] In addition, any of the actions or steps described or illustrated herein may be implemented using executable instructions in a general or special purpose processor and stored on a computer readable storage medium (e.g., disk, memory, or the like) for execution by the processor. References to "computer readable storage medium" should be understood to include special purpose circuits such as FPGAs, ASICs, signal processing devices, and other devices.

[0255] In addition, any of the actions described or illustrated herein may be implemented using executable instructions in a general or special purpose processor and stored on a computer readable storage medium (e.g., disk, memory, etc.) for execution by the processor. References to "computer readable storage medium" should be understood to include special purpose circuits such as FPGAs, ASICs, signal processing devices, and other devices.

[0256] The phrase "A, or B, or C, or a combination thereof" or "at least one of A, B, and C" may be understood as being non-exhaustive and including at least the following: (i) A, or (ii) B, or (iii) C, or (iv) A and B, or (v) A and C, or (vi) B and C, or (vii) A, B, and C.

[0257] It should be understood that the embodiments disclosed herein are exemplary only, and any feature presented for a specific exemplary embodiment may be used alone or in combination with any feature presented for the same or another specific exemplary embodiment and / or in combination with any other features not mentioned with any aspect of the present invention. It will also be understood that any feature presented for an exemplary embodiment in a particular category may also be used in an exemplary embodiment of any other category in a corresponding manner.

[0258] List of abbreviations:

[0259] 3GPP Third Generation Partnership Project

[0260] 5GS 5G System

[0261] 5GC 5G Core

[0262] DCI Downlink Control Information

[0263] NR New Radio

[0264] UE User Equipment

[0265] PRS Positioning Reference Signal

[0266] Rel version

[0267] BS Base Station

[0268] DL-TDOAD Downlink-Time Difference of Arrival

[0269] DL-AoA Downlink Angle of Arrival

[0270] LMF Location Management Function

[0271] MN Mobile Network

[0272] SRS Sounding Reference Signal

[0273] DL RSRP Downlink reference signal received power

[0274] DL RSTD Downlink Reference Signal Time Difference

[0275] RX

[0276] Tx Transmit

[0277] Multi-RTT Multi-cell round trip time

Claims

1. A network entity comprising components for the following operations: obtaining or determining a location estimate of the mobile device for verification; transmitting or causing transmission of a positioning reference signal to a location indicated by the position estimate for verification; as well as attempting to validate the position estimate for validation based at least on a potential response received from the mobile device in response to the positioning reference signal, The network entity further includes components for one or more of the following: transmit or cause to be transmitted a random number to a mobile device; transmitting or causing to be transmitted a random number to a mobile device via a data channel or a control channel; transmitting or causing to be transmitted a random number to the mobile device as part of configuration data prior to transmission of said positioning reference signal; and / or Prior to transmission of the positioning reference signal, transmitting or causing to be transmitted a random number to the base station as part of configuration data, Multiple base stations and / or multiple beams are used to transmit multiple positioning reference signals, wherein some or all of the base stations and / or beams use different random numbers to transmit corresponding positioning reference signals.

2. The network entity of claim 1 , wherein the positioning reference signal is transmitted to the location indicated by the location estimate for verification using one or more of: at least one base station; One base station precisely; Multiple base stations; Directional transmission; Beamforming; transmitting so that the positioning reference signal is receivable only at the position estimate used for verification and at a limited area around the position estimate used for verification; covering at least one beam of the position estimate for verification; covering exactly one beam of the position estimate used for verification; and / or A plurality of beams, at least one beam covering the position estimate for verification.

3. The network entity according to claim 1 or 2, wherein the network entity comprises means for one or more of: providing, to one or more base stations, configuration data related to transmission of the positioning reference signal from the one or more base stations to a particular mobile device for verification purposes; Configuration data related to transmission of the positioning reference signal from one or more base stations to a specific mobile device requiring integrity verification is provided to the specific mobile device.

4. The network entity according to claim 1 or 2, wherein the network entity comprises means for one or more of: checking whether a response is received from the mobile device in response to the positioning reference signal to attempt to validate the position estimate for verification; validating the position estimate for validation in an event that a response is received from the mobile device in response to the positioning reference signal; and / or In the event that a response from the mobile device in response to the positioning reference signal is not received, the position estimate used for verification is not verified.

5. The network entity according to claim 1 or 2, wherein the network entity device comprises means for one or more of the following: determining an additional position estimate of the mobile device based on a potential response of the mobile device to the positioning reference signal; comparing the position estimate for verification with the further position estimate to attempt to verify the position estimate for verification; verifying the position estimate used for verification in case the position estimate used for verification and the further position estimate indicate the same position; and / or In case the position estimate used for verification and the further position estimate indicate different positions, the position estimate used for verification is not verified.

6. The network entity according to claim 1 or 2, wherein the network entity comprises means for: In the event that multiple responses are received from a mobile device in response to the positioning reference signal, the position estimate used for verification is not verified.

7. The network entity according to claim 1 or 2, wherein the network entity comprises means for one or more of: Based on the random number, transmitting or causing transmission of the positioning reference signal; scrambling the positioning reference signal based on the random number for transmission to the location indicated by the position estimate for verification; and / or A check is performed to determine whether a response obtained from the mobile device in response to the positioning reference signal includes the random number.

8. The network entity according to claim 1 or 2, wherein the positioning reference signal is one or more of the following: Aperiodic positioning reference signal; Positioning reference signals as needed; and / or Downlink Positioning Reference Signal.

9. The network entity according to claim 1 or 2, wherein the network entity comprises means for one or more of: In the event that the position estimate used for verification is not verified, notifying a user of the mobile device of potential fraud; and / or In the event that the position estimate used for verification is not verified, notifying the network operator of potential fraud; and / or In the event that the position estimate used for verification is not verified, another network function or another network entity is notified of the potential spoofing.

10. The network entity according to claim 1 or 2, wherein the network entity comprises means for one or more of: Determining, by a higher layer in the network entity, a random number for positioning integrity; and Get a random number from the service application.

11. The network entity according to claim 1 or 2, wherein the network entity is or includes at least one of the following: Base station; A network entity that implements location management functions; A network entity in communication with at least one base station.

12. A mobile device comprising components for: Receive a random number from the network; receiving a positioning reference signal from the network; transmitting a response to the received positioning reference signal to the network for use in verifying the position estimate of the mobile device; and using the received random number for at least one of: receiving the positioning reference signal from the network; and transmitting a response to the received positioning reference signal to the network, The received random number is used for the positioning reference signal received from the network by descrambling the positioning reference signal based at least on the random number.

13. The mobile device of claim 12, wherein the response to the received positioning reference signal is based on a measurement of the received positioning reference signal, the measurement comprising one or more of: Timing measurement; Angle measurement; Signal receiving power measurement; Downlink time difference of arrival DL-TDOA measurement; Uplink time difference of arrival UL-TDOA measurement; Downlink transmit angle AoD measurement; and Angle of arrival AoA measurement.

14. A mobile device according to claim 12 or 13, comprising means for: Configuration data related to reception of the positioning reference signal is obtained.

15. The mobile device according to claim 12 or 13, comprising means for: The random number is received from the network via a service application layer.

Images