Spoofing determination based on reference signal received power measurements

Abstract

In an aspect, a wireless node performs a first RSRP measurement of an RS-P based on a first set of samples within a first time window of RS-P symbols or resources, and determines whether a spoofing attack is associated with the RS-P based on the first RSRP measurement and one or more other RSRP measurements of one or more other sets of samples within one or more earlier time windows of the RS-P symbols or resources. The wireless node transmits an indication of the spoofing attack determination (e.g., in a measurement report) to a communication device (e.g., a position estimation entity). The communication device performs at least one action based at least in part on the indication of the spoofing attack determination.

Description

[0001] Public background

[0002] 1. Public domain

[0003] The various aspects of this disclosure generally relate to wireless communications.

[0004] 2. Relevant Technical Descriptions

[0005] Wireless communication systems have undergone several generations of development, including first-generation analog radiotelephone service (1G), second-generation (2G) digital radiotelephone service (including transitional 2.5G and 2.75G networks), third-generation (3G) high-speed data radio service with Internet capabilities, and fourth-generation (4G) service (e.g., Long Term Evolution (LTE) or WiMax). Currently, many different types of wireless communication systems are in use, including cellular and Personal Communication Services (PCS) systems. Known examples of cellular systems include cellular analog Advanced Mobile Phone Systems (AMPS), and digital cellular systems based on Code Division Multiple Access (CDMA), Frequency Division Multiple Access (FDMA), Time Division Multiple Access (TDMA), Global System for Mobile Communications (GSM), etc.

[0006] The fifth-generation (5G) wireless standard (known as New Radio (NR)) demands higher data transmission speeds, a greater number of connections, better coverage, and other improvements. According to the Next Generation Mobile Networks Alliance (NGC), the 5G standard is designed to provide tens of megabits per second (Mbps) of data rate to each of tens of thousands of users, and 1 gigabits per second (Gbps) to dozens of employees on an office floor. It should support hundreds of thousands of simultaneous connections to support large-scale sensor deployments. Therefore, 5G mobile communication should have significantly improved spectral efficiency compared to the current 4G standard. Furthermore, signaling efficiency should be improved and latency significantly reduced compared to the current standard.

[0007] Overview

[0008] The following is a simplified overview relating to one or more aspects disclosed herein. Therefore, this overview should not be considered an exhaustive overview relating to all aspects of the conception, nor should it be considered to identify key or decisive elements relating to all aspects of the conception or to depict the scope associated with any particular aspect. Accordingly, the sole purpose of the following overview is to present, in a simplified form, certain concepts relating to one or more aspects of the mechanism disclosed herein before the detailed description given below.

[0009] In one aspect, a method of operating a wireless node includes: performing a first reference signal received power (RSRP) measurement of RS-P based on a first sample set within a first time window of a reference signal (RS-P) symbol or resource for positioning; determining whether a spoofing attack is associated with RS-P based on the first RSRP measurement and one or more other RSRP measurements of one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource; and transmitting an indication of the determination of the spoofing attack to a communication device.

[0010] In some respects, the spoofing attack is determined based on the difference between the first RSRP measurement and the one or more other RSRP measurements.

[0011] In some aspects, the method includes performing a second RSRP measurement of the RS-P based on a second sample set within a second time window following a first time window of the RS-P symbol or resource, wherein the spoofing attack determines further based on the second RSRP measurement.

[0012] In some respects, the confidence level associated with the spoofing attack is based on a first difference between a first RSRP measurement and the one or more other RSRP measurements, and a second difference between a second RSRP measurement and the one or more other RSRP measurements.

[0013] In some respects, the one or more other RSRP measurements include a single RSRP measurement, or the one or more other RSRP measurements include an average RSRP measurement based on multiple RSRP measurements.

[0014] In some respects, the instruction further indicates the level of confidence associated with the identification of the spoofing attack.

[0015] In some respects, the instruction further indicates the first RSRP measurement, the one or more other RSRP measurements, or a combination thereof.

[0016] In some aspects, the first RSRP measurement and the one or more other RSRP measurements are associated with a first angle or a first angle range, and the method further includes: performing at least one additional RSRP measurement on the RS-P based on at least one additional set of samples associated with at least one additional angle or at least one additional angle range different from the first angle or the first angle range within a first time window of the RS-P symbol or resource, wherein the spoofing attack determines one or more other additional RSRP measurements on the RS-P based on the at least one additional RSRP measurement and one or more other additional sets of samples within the one or more earlier time windows of the RS-P symbol or resource.

[0017] In some aspects, the method includes receiving from the communication device a request for determining whether to trigger the spoofing attack.

[0018] In some respects, the request specifies the RS-P used for the spoofing attack determination, and for one or more other RS-Ps, the spoofing attack determination is bypassed.

[0019] In some respects, the request is received via downlink control information (DCI), media access control command element (MACCE), long-term evolution positioning protocol (LPP), or new radio positioning protocol A (NRPPa).

[0020] In some respects, the transmission of this instruction is triggered periodically, aperiodically, or semi-persistently.

[0021] In some respects, this instruction is transmitted via uplink control information (UCI), media access control command element (MACCE), radio resource control (RRC), or long-term evolution positioning protocol (LPP).

[0022] In some respects, the indication is included in a measurement report, which includes a timestamp associated with the first RSRP measurement or one or more other RSRP measurements or a combination thereof, an identifier associated with the RS-P, an identifier associated with the user equipment (UE) or transmit receiving point (TRP) that transmitted the RS-P, or a combination thereof.

[0023] In some respects, the identification of spoofing attacks includes the identification of the type of spoofing attack.

[0024] In some respects, this type of spoofing attack is one of the following: cyclic prefix (CP) attack, noise attack, computational attack, or sample-by-sample attack.

[0025] In some respects, the instruction further includes instructions regarding this type of spoofing attack.

[0026] In some respects, the radio node corresponds to the target user equipment (UE) for which its positioning estimation is expected, and the RS-P corresponds to a downlink positioning reference signal (PRS) or a sidelink PRS from a reference UE.

[0027] In some respects, the wireless node corresponds to a base station or reference user equipment (UE), and the RS-P corresponds to an uplink probe reference signal (UL-PRS-P) for positioning.

[0028] In one aspect, a method of operating a communication device includes: receiving from a wireless node an indication of a spoofing attack determined in connection with a reference signal (RS-P) for positioning, the indication being at least in part based on a first reference signal received power (RSRP) measurement of the RS-P on a first sample set within a first time window of the RS-P symbol or resource and one or more other RSRP measurements on one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource; and performing at least one action based at least in part on the indication determined by the spoofing attack.

[0029] In some respects, the spoofing attack is determined based on the difference between the first RSRP measurement and the one or more other RSRP measurements.

[0030] In some respects, the instruction further indicates the level of confidence associated with the identification of the spoofing attack.

[0031] In some respects, the instruction further indicates the first RSRP measurement, the one or more other RSRP measurements, or a combination thereof.

[0032] In some aspects, the first RSRP measurement and the one or more other RSRP measurements are associated with a first angle or a first angle range, wherein the spoofing attack determines further based on (i) at least one additional RSRP measurement of the RS-P, the at least one additional RSRP measurement being based on at least one additional set of samples associated with at least one additional angle or at least one additional angle range different from the first angle or the first angle range within a first time window of the RS-P symbol or resource; and (ii) one or more other additional RSRP measurements of the RS-P with one or more other additional set of samples within one or more earlier time windows of the RS-P symbol or resource.

[0033] In some aspects, the method includes: sending a request to the wireless node to determine whether the spoofing attack has been triggered.

[0034] In some respects, the request is transmitted based on the detection of measurement inconsistencies in one or more measurement reports from the wireless node.

[0035] In some respects, the request specifies the RS-P used for the spoofing attack determination, and for one or more other RS-Ps, the spoofing attack determination is bypassed.

[0036] In some respects, the transmission of this instruction is triggered periodically, aperiodically, or semi-persistently.

[0037] In one aspect, a wireless node includes: a memory; at least one transceiver; and at least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: perform a first reference signal received power (RSRP) measurement of RS-P based on a first sample set within a first time window of a reference signal (RS-P) symbol or resource for location; determine, via the at least one processor, whether a spoofing attack is associated with RS-P based on the first RSRP measurement and one or more other RSRP measurements of one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource; and transmit an indication of the determination of the spoofing attack to a communication device via the at least one processor, the at least one transceiver, or both.

[0038] In one aspect, a communication device includes: a memory; at least one transceiver; and at least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: receive, via the at least one processor, the at least one transceiver, or both, from a wireless node a measurement report including an indication of a spoofing attack determined in connection with a reference signal (RS-P) for positioning, the indication being at least partially based on a first reference signal received power (RSRP) measurement of the RS-P on a first sample set within a first time window of the RS-P symbol or resource, and one or more other RSRP measurements on one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource; and perform at least one action via the at least one processor, the at least one transceiver, or both, at least partially based on the indication determined by the spoofing attack.

[0039] Other objectives and advantages associated with the aspects disclosed herein will be apparent to those skilled in the art based on the accompanying drawings and detailed description. Brief description of the attached diagram

[0041] The accompanying drawings are provided to help describe various aspects of this disclosure, and the drawings are provided for illustrative purposes only and not for limiting the aspects.

[0042] Figure 1 Example wireless communication systems based on various aspects of this disclosure are explained.

[0043] Figure 2A and 2B Example wireless network architectures based on various aspects of this disclosure are explained.

[0044] Figures 3A to 3C It is a simplified block diagram of several sample aspects of components that can be adopted in user equipment (UE), base stations, and network entities and configured to support communications as taught herein.

[0045] Figures 4A to 4D This is a diagram illustrating example frame structures and channels within these frame structures according to various aspects of this disclosure.

[0046] Figure 5 This is a diagram illustrating an example PRS configuration for the transmission of a Position Reference Signal (PRS) for a given base station, according to various aspects of this disclosure.

[0047] Figure 6 This is a diagram illustrating an example set of Positioning Reference Signals (PRS) resources with different time intervals according to various aspects of this disclosure.

[0048] Figures 7A-7B Various DL-PRS comb patterns according to this disclosure are explained.

[0049] Figure 8 The PRS spoofing attack described in this disclosure is explained.

[0050] Figure 9 The disclosure explains another aspect of PRS spoofing attacks.

[0051] Figure 10A The disclosure explains another aspect of PRS spoofing attacks.

[0052] Figure 10B The explanation describes one aspect of the method used for countermeasures according to this disclosure. Figure 10A Example mitigation techniques for PRS spoofing attacks.

[0053] Figure 11 Exemplary wireless communication processes according to various aspects of this disclosure are explained.

[0054] Figure 12 Exemplary wireless communication processes according to various aspects of this disclosure are explained.

[0055] Figure 13 Each aspect of this disclosure has been explained. Figures 11-12 Example implementation of the process.

[0056] Figure 14 Each aspect of this disclosure has been explained. Figures 11-12 Example implementation of the process.

[0057] Detailed description

[0058] Various aspects of this disclosure are provided below in the description and accompanying drawings of various examples provided for illustrative purposes. Alternative aspects may be designed without departing from the scope of this disclosure. Furthermore, elements well-known in this disclosure will not be described in detail or will be omitted so as not to obscure the relevant details of this disclosure.

[0059] The terms “exemplary” and / or “example” are used herein to mean “serving as an example, instance, or illustration.” Any aspect described herein as “exemplary” and / or “example” is not necessarily to be construed as superior to or better than the others. Similarly, the term “aspects of this disclosure” does not require that all aspects of this disclosure include the features, advantages, or modes of operation discussed.

[0060] Those skilled in the art will appreciate that the information and signals described below can be represented using any of a variety of different techniques and arts. For example, the data, instructions, commands, information, signals, bits, symbols, and chips that may be referred to throughout the following description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or optical particles, or any combination thereof, depending in part on the specific application, in part on the desired design, in part on the corresponding technology, etc.

[0061] Furthermore, many aspects are described in the form of sequences of actions performed by elements of, for example, computing devices. It will be appreciated that the various actions described herein can be performed by special-purpose circuitry (e.g., application-specific integrated circuits (ASICs)), by program instructions being executed by one or more processors, or by a combination of both. Additionally, the sequences of actions described herein can be considered to be fully embodied in any form of non-transient computer-readable storage medium storing a corresponding set of computer instructions that, upon execution, will cause an associated processor of the device to perform the functions described herein. Thus, various aspects of this disclosure can be embodied in several different forms, all of which are contemplated to fall within the scope of the claimed subject matter. Furthermore, for each aspect described herein, a corresponding form of any such aspect may be described herein as, for example, "logic configured to perform the described actions."

[0062] As used herein, the terms “User Equipment” (UE) and “Base Station” are not intended to be specific to or otherwise limited to any particular Radio Access Technology (RAT) unless otherwise stated. Generally, a UE can be any wireless communication device used by a user to communicate over a wireless communication network (e.g., mobile phone, router, tablet computer, laptop computer, consumer asset positioning device, wearable device (e.g., smartwatch, glasses, augmented reality (AR) / virtual reality (VR) headset, etc.), vehicle (e.g., car, motorcycle, bicycle, etc.), Internet of Things (IoT) device, etc.). A UE can be mobile or can (e.g., at certain times) be stationary and can communicate with a Radio Access Network (RAN). As used herein, the term “UE” can be interchangeably referred to as “Access Terminal” or “AT”, “Client Equipment”, “Wireless Equipment”, “Subscriber Equipment”, “Subscriber Terminal”, “Subscriber Station”, “User Terminal” or “UT”, “Mobile Equipment”, “Mobile Terminal”, “Mobile Station”, or variations thereof. Generally, a UE can communicate with the core network via the RAN, and through the core network, the UE can connect to external networks (such as the Internet) and other UEs. Of course, other mechanisms for connecting to the core network and / or the Internet are also possible for the UE, such as through a wired access network, a wireless local area network (WLAN) (e.g., based on the IEEE 802.11 standard), and so on.

[0063] A base station may operate according to one of several RATs to communicate with a UE, depending on the network in which it is deployed, and may be alternatively referred to as an Access Point (AP), Network Node, B-Node, Evolved B-Node (eNB), Next Generation eNB (ng-eNB), New Radio (NR) B-Node (also referred to as gNB or gNodeB), etc. A base station may primarily be used to support radio access by the UE, including supporting data, voice, and / or signaling connections with the supported UE. In some systems, the base station may provide purely edge node signaling functions, while in others, it may provide additional control and / or network management functions. The communication link through which the UE can signal to the base station is called an uplink (UL) channel (e.g., reverse traffic channel, reverse control channel, access channel, etc.). The communication link through which the base station can signal to the UE is called a downlink (DL) or forward link channel (e.g., paging channel, control channel, broadcast channel, forward traffic channel, etc.). As used herein, the term traffic channel (TCH) may refer to an uplink / reverse traffic channel or a downlink / forward traffic channel.

[0064] The term "base station" can refer to a single physical transmit / receive point (TRP) or multiple physical TRPs that may or may not be co-located. For example, when the term "base station" refers to a single physical TRP, the physical TRP may be a base station antenna corresponding to a cell (or several cell sectors) of the base station. When the term "base station" refers to multiple co-located physical TRPs, the physical TRP may be an antenna array of the base station (e.g., as in a multiple-input multiple-output (MIMO) system or where the base station employs beamforming). When the term "base station" refers to multiple non-co-located physical TRPs, the physical TRP may be a distributed antenna system (DAS) (a network of spatially separated antennas connected via a transmission medium to a shared source) or a remote radio headend (RRH) (a remote base station connected to a serving base station). Alternatively, non-co-located physical TRPs may be the serving base station from which the UE receives measurement reports and neighboring base stations where the UE is measuring its reference radio frequency (RF) signal. Since a TRP is the point from which a base station transmits and receives wireless signals, as used herein, references to transmissions from or receptions at a base station should be understood as references to the specific TRP of that base station.

[0065] In some implementations that support UE positioning, the base station may not support the UE's radio access (e.g., it may not support data, voice, and / or signaling connections regarding the UE), but may instead transmit reference signals to the UE for measurement, and / or receive and measure signals transmitted by the UE. Such a base station may be referred to as a positioning tower (e.g., in the case of transmitting signals to the UE) and / or as a location measurement unit (e.g., in the case of receiving and measuring signals from the UE).

[0066] An “RF signal” refers to an electromagnetic wave of a given frequency that transmits information across the space between a transmitter and a receiver. As used herein, a transmitter may transmit a single “RF signal” or multiple “RF signals” to a receiver. However, due to the propagation characteristics of individual RF signals through a multipath channel, a receiver may receive multiple “RF signals” corresponding to each transmitted RF signal. The same RF signal transmitted on different paths between the transmitter and receiver can be referred to as a “multipath” RF signal.

[0067] Figure 1An example wireless communication system 100 according to various aspects of this disclosure is described. The wireless communication system 100 (which may also be referred to as a wireless wide area network (WWAN)) may include various base stations 102 (labeled "BS") and various UEs 104. Base station 102 may include macrocell base stations (high-power cellular base stations) and / or small cell base stations (low-power cellular base stations). In one aspect, the macrocell base station may include an eNB and / or an ng-eNB (where the wireless communication system 100 corresponds to an LTE network), or a gNB (where the wireless communication system 100 corresponds to an NR network), or a combination of both, and the small cell base station may include femtocells, picocells, microcells, etc.

[0068] Each base station 102 can collectively form a RAN and interface with the core network 170 (e.g., an evolved packet core (EPC) or a 5G core (5GC)) via a backhaul link 122, and access one or more location servers 172 (e.g., location management function (LMF) or secure user plane positioning (SUPL) location platform (SLP)) via the core network 170. The location servers 172 can be part of the core network 170 or located outside the core network 170. Among other functions, the base station 102 can also perform functions related to one or more of the following: transmitting user data, radio channel cryptography and decoding, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection establishment and release, load balancing, distribution of non-access stratum (NAS) messages, NAS node selection, synchronization, RAN sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment tracking, RAN information management (RIM), paging, location, and delivery of alarm messages. Base stations 102 can communicate with each other directly or indirectly (e.g., via EPC / 5GC) through backhaul link 134 (which can be wired or wireless).

[0069] Base station 102 can wirelessly communicate with UE 104. Each base station 102 can provide communication coverage for its respective geographical coverage area 110. In one aspect, one or more cells can be supported by base station 102 in each geographical coverage area 110. A “cell” is a logical communication entity used to communicate with a base station (e.g., on a frequency resource, referred to as a carrier frequency, component carrier, carrier, frequency band, etc.) and can be associated with an identifier (e.g., Physical Cell Identifier (PCI), Virtual Cell Identifier (VCI), Cell Global Identifier (CGI)) to distinguish cells operating via the same or different carrier frequencies. In some cases, different cells can be configured according to different protocol types that can provide access to different types of UEs (e.g., Machine Type Communication (MTC), Narrowband IoT (NB-IoT), Enhanced Mobile Broadband (eMBB), or others). Since cells are supported by specific base stations, the term “cell” can refer to either or both of the logical communication entity and the base station supporting that logical communication entity, depending on the context. In some contexts, the term "cellular" can also refer to the geographical coverage area (e.g., sector) of a base station, in the sense that the carrier frequency can be detected and used for communication within a portion of the geographic coverage area 110.

[0070] While the geographic coverage areas 110 of adjacent macrocell base stations 102 may partially overlap (e.g., in handover areas), some geographic coverage areas 110 may substantially overlap with larger geographic coverage areas 110. For example, a small cell (SC) base station 102' may have geographic coverage areas 110' that substantially overlap with the geographic coverage areas 110 of one or more macrocell base stations 102. A network that includes both small cell and macrocell base stations may be referred to as a heterogeneous network. A heterogeneous network may also include home eNBs (HeNBs) that can provide service to a restricted group referred to as a Closed Subscriber Group (CSG).

[0071] The communication link 120 between base station 102 and UE 104 may include uplink (also known as reverse link) transmission from UE 104 to base station 102 and / or downlink (also known as forward link) transmission from base station 102 to UE 104. The communication link 120 may use MIMO antenna technologies, including spatial multiplexing, beamforming, and / or transmit diversity. The communication link 120 may use one or more carrier frequencies. Carrier allocation may be asymmetric with respect to the downlink and uplink (e.g., more or fewer carriers may be allocated to the downlink compared to the uplink).

[0072] The wireless communication system 100 may further include a wireless local area network (WLAN) access point (AP) 150 communicating with a WLAN station (STA) 152 via a communication link 154 in unlicensed spectrum (e.g., 5 GHz). When communicating in unlicensed spectrum, the WLAN STA 152 and / or WLAN AP 150 may perform a clear channel assessment (CCA) or listen-before-speak (LBT) procedure to determine channel availability before communication.

[0073] Small cell base station 102' can operate in licensed and / or unlicensed spectrum. When operating in unlicensed spectrum, small cell base station 102' can employ LTE or NR technology and use the same 5 GHz unlicensed spectrum as used by WLAN AP 150. Small cell base station 102' employing LTE / 5G in unlicensed spectrum can enhance access network coverage and / or increase access network capacity. NR in unlicensed spectrum may be referred to as NR-U. LTE in unlicensed spectrum may be referred to as LTE-U, Licensed Assisted Access (LAA), or MulteFire.

[0074] The wireless communication system 100 may further include a millimeter-wave (mmW) base station 180, which can operate in mmW and / or near-mmW frequencies to communicate with the UE 182. Extremely high frequency (EHF) is a portion of the electromagnetic spectrum that contains radio frequency (RF). EHF has a range of 30 GHz to 300 GHz and wavelengths between 1 mm and 10 mm. Radio waves in this band are referred to as millimeter waves. Near-mmW extends down to a 3 GHz frequency with a 100 mm wavelength. Ultra-high frequency (SHF) bands extend between 3 GHz and 30 GHz, and are also referred to as centimeter waves. Communication using mmW / near-mmW RF bands has high path loss and relatively short range. The mmW base station 180 and the UE 182 can utilize beamforming (transmit and / or receive) on the mmW communication link 184 to compensate for the extremely high path loss and short range. Furthermore, it will be appreciated that in alternative configurations, one or more base stations 102 may also use mmW or near-mmW and beamforming for transmission. Accordingly, it will be understood that the foregoing explanations are merely illustrative and should not be construed as limiting the aspects disclosed herein.

[0075] Transmit beamforming is a technique for focusing RF signals in a specific direction. Conventionally, when a network node (e.g., a base station) broadcasts an RF signal, it broadcasts the signal in all directions (omnidirectionally). Using transmit beamforming, the network node determines where a given target device (e.g., a UE) is located (relative to the transmitting network node) and projects a stronger downlink RF signal in that specific direction, thus providing the receiving device with a faster (in terms of data rate) and stronger RF signal. To change the directivity of the RF signal during transmission, the network node can control the phase and relative amplitude of the RF signal at each of one or more transmitters broadcasting the RF signal. For example, the network node can use an antenna array (referred to as a "phased array" or "antenna array") that generates a beam of RF waves, which can be "guided" to different directions without actually moving the antennas. Specifically, RF currents from the transmitters are fed to the individual antennas with the correct phase relationship so that radio waves from the separate antennas add together in the desired direction to increase radiation, while simultaneously canceling each other out in the undesired direction to suppress radiation.

[0076] Transmit beams can be quasi-co-located, meaning they appear to the receiver (e.g., the UE) with identical parameters, regardless of whether the network node's transmit antennas are physically co-located. In NR, there are four types of quasi-co-location (QCL) relationships. Specifically, a given type of QCL relationship means that certain parameters of the target reference RF signal on the target beam can be derived from information about the source reference RF signal on the source beam. If the source reference RF signal is QCL type A, the receiver can use the source reference RF signal to estimate the Doppler shift, Doppler spread, average delay, and delay spread of the target reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type B, the receiver can use the source reference RF signal to estimate the Doppler shift and Doppler spread of the target reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type C, the receiver can use the source reference RF signal to estimate the Doppler shift and average delay of the target reference RF signal transmitted on the same channel. If the source reference RF signal is of type QCL D, the receiver can use the source reference RF signal to estimate the spatial reception parameters of the target reference RF signal transmitted on the same channel.

[0077] In receive beamforming, a receiver uses a receive beam to amplify an RF signal detected on a given channel. For example, a receiver may increase the gain setting of an antenna array and / or adjust the phase setting of the antenna array in a specific direction to amplify the RF signal received from that direction (e.g., increase its gain level). Thus, when a receiver is referred to as beamforming in a certain direction, it means that the beam gain in that direction is higher than the beam gain in other directions, or that the beam gain in that direction is the highest compared to the beam gain of all other receive beams available to the receiver in that direction. This results in a stronger received signal strength (e.g., Reference Signal Received Power (RSRP), Reference Signal Received Quality (RSRQ), Signal-to-Interference-plus-Noise Ratio (SINR), etc.) of the RF signal received from that direction.

[0078] The receive beam can be spatially dependent. Spatial dependency means that the parameters of the transmit beam used for the second reference signal can be derived from information about the receive beam of the first reference signal. For example, the UE can use a specific receive beam to receive one or more reference downlink reference signals (e.g., Position Reference Signal (PRS), Tracking Reference Signal (TRS), Phase Tracking Reference Signal (PTRS), Cell-Specific Reference Signal (CRS), Channel State Information Reference Signal (CSI-RS), Primary Synchronization Signal (PSS), Secondary Synchronization Signal (SSS), Synchronization Block (SSB), etc.) from the base station. The UE can then form a transmit beam based on the parameters of the receive beam to transmit one or more uplink reference signals (e.g., Uplink Position Reference Signal (UL-PRS), Probe Reference Signal (SRS), Demodulation Reference Signal (DMRS), PTRS, etc.) to the base station.

[0079] Note that, depending on the entity forming the "downlink" beam, the beam can be either a transmit beam or a receive beam. For example, if a base station is forming a downlink beam to transmit a reference signal to a UE, then the downlink beam is a transmit beam. However, if a UE is forming a downlink beam, then the downlink beam is a receive beam for receiving downlink reference signals. Similarly, depending on the entity forming the "uplink" beam, the beam can be either a transmit beam or a receive beam. For example, if a base station is forming an uplink beam, then the uplink beam is an uplink receive beam, while if a UE is forming an uplink beam, then the uplink beam is an uplink transmit beam.

[0080] In 5G, the spectrum in which radio nodes (e.g., base stations 102 / 180, UE 104 / 182) operate is divided into multiple frequency ranges: FR1 (from 450 to 6000 MHz), FR2 (from 24250 to 52600 MHz), FR3 (above 52600 MHz), and FR4 (between FR1 and FR2). In multi-carrier systems (such as 5G), one of the carrier frequencies is referred to as the “primary carrier” or “anchor carrier” or “primary serving cell” or “PCell,” and the remaining carrier frequencies are referred to as “secondary carriers” or “secondary serving cells” or “SCell.” In carrier aggregation, the anchor carrier is the carrier operating on the primary frequency (e.g., FR1) utilized by UE 104 / 182 and on the cell in which UE 104 / 182 performs an initial radio resource control (RRC) connection establishment procedure or initiates an RRC connection re-establishment procedure. The primary carrier carries all shared control channels as well as UE-specific control channels, and can be a carrier on a licensed frequency (however, this is not always the case). The secondary carrier is a carrier operating on a second frequency (e.g., FR2), which can be configured once an RRC connection is established between UE 104 and the anchor carrier, and can be used to provide additional radio resources. In some cases, the secondary carrier can be a carrier on an unlicensed frequency. The secondary carrier may contain only the necessary signaling information and signals; for example, UE-specific signaling information and signals may not be present on the secondary carrier, since both the primary uplink and downlink carriers are typically UE-specific. This means that different UEs 104 / 182 in a cell can have different downlink primary carriers. The same applies to the uplink primary carrier. The network can change the primary carrier of any UE 104 / 182 at any time. For example, this is done to balance the load on different carriers. Since a “serving cell” (whether PCell or SCell) corresponds to the carrier frequency / component carrier that a base station is using for communication, the terms “cell,” “serving cell,” “component carrier,” “carrier frequency,” etc., can be used interchangeably.

[0081] For example, still refer to Figure 1 One of the frequencies utilized by the macrocell base station 102 can be an anchor carrier (or "PCell"), and other frequencies utilized by the macrocell base station 102 and / or mmW base station 180 can be secondary carriers ("SCell"). Simultaneous transmission and / or reception on multiple carriers allows the UE 104 / 182 to significantly increase its data transmission and / or reception rates. For example, two 20MHz aggregated carriers in a multi-carrier system would theoretically result in twice the data rate (i.e., 40MHz) compared to the data rate obtained from a single 20MHz carrier.

[0082] The wireless communication system 100 may further include a UE 164, which can communicate with the macrocell base station 102 on the communication link 120 and / or with the mmW base station 180 on the mmW communication link 184. For example, the macrocell base station 102 may support PCell and one or more SCells for the UE 164, and the mmW base station 180 may support one or more SCells for the UE 164.

[0083] exist Figure 1 In the example, one or more Earth-orbiting Satellite Positioning System (SPS) spacecraft (SV) 112 (e.g., satellites) can be used as any of the explained UEs (for simplicity, in...). Figure 1 The location information of a single UE 104 is a separate source. UE 104 may include one or more dedicated SPS receivers specifically designed to receive SPS signal 124 from SV 112 to derive geographic location information. The SPS typically includes a transmitter system (e.g., SV 112) positioned such that receivers (e.g., UE 104) can determine their location on or above the earth based at least in part on signals received from the transmitter (e.g., SPS signal 124). Such transmitters typically transmit signals marked with a set number of repeating pseudo-random noise (PN) codes. While transmitters are typically located in SV 112, they may sometimes be located at a terrestrial control station, base station 102, and / or other UE 104.

[0084] The use of SPS signal 124 can be amplified by various satellite-based augmentation systems (SBAS), which may be associated with or otherwise enabled to be used in conjunction with one or more global and / or regional navigation satellite systems. For example, SBAS may include augmentation systems that provide integrity information, differential correction, etc., such as Wide Area Augmentation System (WAAS), European Geostationary Navigation Coverage Service (EGNOS), Multifunctional Satellite Augmentation System (MSAS), GPS-assisted Geographic Augmentation Navigation or GPS and Geographic Augmentation Navigation System (GAGAN), etc. Thus, as used herein, SPS may include any combination of one or more global and / or regional navigation satellite systems and / or augmentation systems, and SPS signal 124 may include SPS, SPS-like systems, and / or other signals associated with one or more such SPS.

[0085] The wireless communication system 100 may further include one or more UEs (such as UE 190) that are indirectly connected to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links (referred to as “side links”). Figure 1 In the example, UE 190 has a D2D P2P link 192 through which one of UEs 104 is connected to a base station 102 (e.g., UE 190 can indirectly obtain cellular connectivity), and a D2D P2P link 194 through which WLAN STA 152 is connected to WLANAP 150 (UE 190 can indirectly obtain WLAN-based Internet connectivity). In one example, D2D P2P links 192 and 194 can use any known D2D RAT (such as LTE Direct (LTE-D), WiFi Direct (WiFi-D)). (etc.) to support.

[0086] Figure 2A Example wireless network architecture 200 is explained. For example, 5GC 210 (also referred to as Next Generation Core (NGC)) can be functionally considered as control plane functions 214 (e.g., UE registration, authentication, network access, gateway selection, etc.) and user plane functions 212 (e.g., UE gateway functions, access to data networks, IP routing, etc.), which operate collaboratively to form the core network. User plane interface (NG-U) 213 and control plane interface (NG-C) 215 connect gNB 222 to 5GC 210, specifically to control plane functions 214 and user plane functions 212. In an additional configuration, ng-eNB 224 can also connect to 5GC 210 via NG-C 215 to control plane function 214 and NG-U 213 to user plane function 212. Furthermore, ng-eNB 224 can communicate directly with gNB 222 via backhaul connection 223. In some configurations, the next-generation RAN (NG-RAN) 220 may have only one or more gNBs 222, while other configurations include one or more ng-eNBs 224 and one or more gNBs 222. The gNB 222 or ng-eNB 224 can be used with the UE 204 (e.g., Figure 1The UE 204 can communicate with any UE depicted herein. Another optional aspect may include location server 230, which may communicate with 5GC 210 to provide location assistance to UE 204. Location server 230 may be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules extending across multiple physical servers, etc.), or alternatively, each may correspond to a single server. Location server 230 may be configured to support one or more location services for UE 204, which UE 204 can connect to via the core network, 5GC 210, and / or via the Internet (not described). Furthermore, location server 230 may be integrated into a component of the core network, or alternatively, may be external to the core network.

[0087] Figure 2B Another example wireless network architecture, 250.5GC 260, was explained (which can correspond to...). Figure 2A The 5GC 210 can be functionally considered as a control plane function (provided by the Access and Mobility Management Function (AMF) 264) and a user plane function (provided by the User Plane Function (UPF) 262), which operate collaboratively to form the core network (i.e., 5GC 260). User plane interface 263 and control plane interface 265 connect the ng-eNB 224 to the 5GC 260, specifically to the UPF 262 and AMF 264, respectively. In an additional configuration, the gNB 222 can also connect to the 5GC 260 via the control plane interface 265 to the AMF 264 and the user plane interface 263 to the UPF 262. Furthermore, the ng-eNB 224 can communicate directly with the gNB 222 via a backhaul connection 223, with or without direct gNB connectivity to the 5GC 260. In some configurations, the NG-RAN 220 may have only one or more gNB 222s, while other configurations include one or more ng-eNB 224s and one or more gNB 222s. The gNB 222 or ng-eNB 224 can be used with the UE 204 (e.g., Figure 1 The base station of NG-RAN 220 communicates with AMF 264 via the N2 interface and with UPF 262 via the N3 interface.

[0088] The functions of AMF 264 include registration management, connection management, reachability management, mobility management, lawful interception, transmission of Session Management (SM) messages between UE 204 and Session Management Function (SMF) 266, transparent proxy service for routing SM messages, access authentication and access authorization, transmission of Short Message Service (SMS) messages between UE 204 and Short Message Service Function (SMSF) (not shown), and Security Anchor Functionality (SEAF). AMF 264 also interacts with Authentication Server Function (AUSF) (not shown) and UE 204, and receives an intermediate key established as a result of the UE 204 authentication process. In the case of authentication based on the UMTS (Universal Mobile Telecommunications System) Subscriber Identity Module (USIM), AMF 264 retrieves security material from the AUSSF. The functions of AMF 264 also include Security Context Management (SCM). The SCM receives a key from the SEAF, which is used by the SCM to derive a key that varies depending on the access network. The functionality of AMF 264 also includes: location service management for regulatory services, transmission of location service messages between UE 204 and LMF 270 (which acts as location server 230), transmission of location service messages between NG-RAN 220 and LMF 270, allocation of EPS bearer identifiers for interoperability with Evolved Packet Systems (EPS), and UE 204 mobility event notification. Additionally, AMF 264 supports functionality for non-3GPP (3rd Generation Partnership Project) access networks.

[0089] The functions of UPF 262 include: acting as an anchor point for intra / inter-RAT mobility (where applicable), acting as an external Protocol Data Unit (PDU) session point interconnecting to a data network (not shown), providing packet routing and forwarding, packet inspection, user plane policy rule enforcement (e.g., strobing, redirection, traffic steering), lawful interception (user plane collection), traffic usage reporting, quality of service (QoS) handling for the user plane (e.g., uplink / downlink rate enforcement, reflective QoS marking in the downlink), uplink traffic verification (Service Data Flow (SDF) to QoS flow mapping), transport-level packet marking in the uplink and downlink, downlink packet buffering and downlink data notification triggering, and sending and forwarding one or more "end markers" to the source RAN node. UPF 262 may also support the transmission of location service messages between UE 204 and a location server (such as SLP 272) on the user plane.

[0090] The functions of SMF 266 include session management, UE Internet Protocol (IP) address allocation and management, selection and control of user plane functions, traffic bootstrapping configuration at UPF 262 for routing traffic to the correct destination, partial control of policy enforcement and QoS, and downlink data notification. The interface used by SMF 266 to communicate with AMF 264 is called the N11 interface.

[0091] Another optional aspect may include LMF 270, which can communicate with 5GC 260 to provide location assistance to UE 204. LMF 270 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules extending across multiple physical servers, etc.), or alternatively, each may correspond to a single server. LMF 270 can be configured to support one or more location services for UE 204, which can connect to LMF 270 via the core network, 5GC 260, and / or via the Internet (not explained). SLP 272 supports similar functionality to LMF 270, but while LMF 270 can communicate with AMF 264, NG-RAN 220, and UE 204 on the control plane (e.g., using interfaces and protocols designed to convey signaling messages but not voice or data), SLP 272 can communicate with UE 204 and external clients on the user plane (e.g., using protocols designed to carry voice and / or data, such as Transmission Control Protocol (TCP) and / or IP). Figure 2B (Not shown in the image) Communication.

[0092] Figure 3A , 3B The document describes several example components (represented by corresponding boxes) that can be incorporated into UE 302 (which may correspond to any UE described herein), base station 304 (which may correspond to any base station described herein), and network entity 306 (which may correspond to or embody any network function described herein, including location server 230 and LMF 270) to support file transfer operations as taught herein. It will be appreciated that these components can be implemented in different types of devices (e.g., in ASICs, in system-on-chips (SoCs), etc.) in different implementations. The described components can also be incorporated into other devices in a communication system. For example, other devices in the system may include components similar to those described to provide similar functionality. Furthermore, a given device may include one or more of these components. For example, a device may include multiple transceiver components that enable the device to operate on multiple carriers and / or communicate via different technologies.

[0093] UE 302 and base station 304 each include wireless wide area network (WWAN) transceivers 310 and 350, respectively, providing means (e.g., means for transmitting, means for receiving, means for measuring, means for tuning, means for suppressing transmission, etc.) for communication via one or more wireless communication networks (not shown) (such as NR networks, LTE networks, GSM networks, etc.). WWAN transceivers 310 and 350 may be connected to one or more antennas 316 and 356, respectively, for communication with other network nodes (such as other UEs, access points, base stations (e.g., eNB, gNB), etc.) on a wireless communication medium of interest (e.g., a time / frequency resource set in a specific spectrum) via at least one designated RAT (e.g., NR, LTE, GSM, etc.). WWAN transceivers 310 and 350 can be configured, according to a specified RAT, in various ways to transmit and encode signals 318 and 358 (e.g., messages, indications, information, etc.), and conversely, to receive and decode signals 318 and 358 (e.g., messages, indications, information, pilots, etc.). Specifically, WWAN transceivers 310 and 350 each include one or more transmitters 314 and 354 for transmitting and encoding signals 318 and 358, respectively, and each includes one or more receivers 312 and 352 for receiving and decoding signals 318 and 358, respectively.

[0094] In at least some cases, UE 302 and base station 304 also include one or more short-range radio transceivers 320 and 360, respectively. The short-range radio transceivers 320 and 360 may be connected to one or more antennas 326 and 366, respectively, and provide access via at least one designated RAT (e.g., WiFi, LTE-D, etc.). A means for communicating with other network nodes (such as other UEs, access points, base stations, etc.) over a wireless communication medium of interest (e.g., means for transmitting, means for receiving, means for measuring, means for tuning, means for suppressing transmission, etc.) using PC5, Dedicated Short Range Communication (DSRC), Wireless Access in Vehicle Environments (WAVE), Near Field Communication (NFC), etc.). Short-range transceivers 320 and 360 can be configured, according to a specified RAT, in various ways to transmit and encode signals 328 and 368 (e.g., messages, indications, information, etc.), and conversely, to receive and decode signals 328 and 368 (e.g., messages, indications, information, pilots, etc.). Specifically, short-range transceivers 320 and 360 each include one or more transmitters 324 and 364 for transmitting and encoding signals 328 and 368, respectively, and one or more receivers 322 and 362 for receiving and decoding signals 328 and 368, respectively. As specific examples, the short-range wireless transceivers 320 and 360 can be WiFi transceivers, transceiver and / or Transceivers, NFC transceivers, or vehicle-to-vehicle (V2V) and / or vehicle-to-everything (V2X) transceivers.

[0095] A transceiver circuit system including at least one transmitter and at least one receiver may, in some implementations, include integrated devices (e.g., transmitter and receiver circuitry implemented as a single communication device), in some implementations, include separate transmitter and receiver devices, or in other implementations, may be implemented in a different manner. In one aspect, the transmitter may include or be coupled to multiple antennas (e.g., antennas 316, 326, 356, 366), such as an antenna array, which allows the corresponding device to perform transmit "beamforming," as described herein. Similarly, the receiver may include or be coupled to multiple antennas (e.g., antennas 316, 326, 356, 366), such as an antenna array, which allows the corresponding device to perform receive beamforming, as described herein. In another aspect, the transmitter and receiver may share the same multiple antennas (e.g., antennas 316, 326, 356, 366) such that the corresponding device can only receive or transmit at a given time, rather than both simultaneously. The wireless communication equipment of UE 302 and / or base station 304 (e.g., one or both of transceivers 310 and 320 and / or one or both of transceivers 350 and 360) may also include a network eavesdropping module (NLM) for performing various measurements, etc.

[0096] In at least some cases, UE 302 and base station 304 also include Satellite Positioning System (SPS) receivers 330 and 370. SPS receivers 330 and 370 may be connected to one or more antennas 336 and 376, respectively, and may provide means for receiving and / or measuring SPS signals 338 and 378, such as Global Positioning System (GPS) signals, Global Navigation Satellite System (GLONASS) signals, Galileo signals, BeiDou signals, Indian Regional Navigation Satellite System (NAVIC), Quasi-Zenith Satellite System (QZSS), etc. SPS receivers 330 and 370 request information and operations from other systems as appropriate and perform necessary calculations to determine the positioning of UE 302 and base station 304 using measurements obtained by any suitable SPS algorithm.

[0097] Base station 304 and network entity 306 each include at least one network interface 380 and 390, providing means for communicating with other network entities (e.g., means for transmitting, means for receiving, etc.). For example, network interfaces 380 and 390 (e.g., one or more network access ports) may be configured to communicate with one or more network entities via a wired or wireless backhaul connection. In some aspects, network interfaces 380 and 390 may be implemented as transceivers configured to support wired or wireless signal communication. This communication may involve, for example, sending and receiving messages, parameters, and / or other types of information.

[0098] UE 302, base station 304, and network entity 306 also include other components that can be used in conjunction with operations disclosed herein. UE 302 includes a processor circuitry implemented with a processing system 332 for providing, for example, functionality related to wireless positioning, and for providing other processing functionality. Base station 304 includes a processing system 384 for providing, for example, functionality related to wireless positioning as disclosed herein, and for providing other processing functionality. Network entity 306 includes a processing system 394 for providing, for example, functionality related to wireless positioning as disclosed herein, and for providing other processing functionality. Processing systems 332, 384, and 394 can therefore provide means for processing, such as means for determining, means for calculating, means for receiving, means for transmitting, means for indicating, etc. In one aspect, processing systems 332, 384, and 394 may include, for example, one or more processors, such as one or more general-purpose processors, multi-core processors, ASICs, digital signal processors (DSPs), field-programmable gate arrays (FPGAs), other programmable logic devices or processing circuitry, or various combinations thereof.

[0099] UE 302, base station 304, and network entity 306 include memory circuitry that implements memory components 340, 386, and 396 (e.g., each including a memory device) for maintaining information (e.g., information indicating reserved resources, thresholds, parameters, etc.). Memory components 340, 386, and 396 thus provide means for storage, means for retrieval, means for maintenance, etc. In some cases, UE 302, base station 304, and network entity 306 may include spoofing attack modules 342, 388, and 398, respectively. Spoofing attack modules 342, 388, and 398 may be hardware circuitry that is part of or coupled to processing systems 332, 384, and 394, which, when executed, cause UE 302, base station 304, and network entity 306 to perform the functionality described herein. In other respects, spoofing attack modules 342, 388, and 398 may be external to processing systems 332, 384, and 394 (e.g., part of a modem processing system, integrated with another processing system, etc.). Alternatively, spoofing attack modules 342, 388, and 398 may be memory modules stored in memory components 340, 386, and 396, respectively, which, when executed by processing systems 332, 384, and 394 (or a modem processing system, another processing system, etc.), enable UE 302, base station 304, and network entity 306 to perform the functionality described herein. Figure 3A The possible locations of the spoofing attack module 342 are explained. The spoofing attack module 342 may be part of the WWAN transceiver 310, memory component 340, processing system 332, or any combination thereof, or it may be a stand-alone component. Figure 3B The possible locations of the spoofing attack module 388 are explained. The spoofing attack module 388 may be part of a WWAN transceiver 350, a memory component 386, a processing system 384, or any combination thereof, or it may be a stand-alone component. Figure 3C The possible locations of the spoofing attack module 398 are explained. The spoofing attack module 398 may be part of (a) network interface 390, memory component 396, processing system 394, or any combination thereof, or may be a stand-alone component.

[0100] UE 302 may include one or more sensors 344 coupled to processing system 332 to provide means for sensing or detecting motion and / or orientation information independent of motion data derived from signals received by WWAN transceiver 310, short-range wireless transceiver 320, and / or SPS receiver 330. As an example, sensor 344 may include accelerometers (e.g., microelectromechanical systems (MEMS) devices), gyroscopes, geomagnetic sensors (e.g., compasses), altimeters (e.g., barometric altimeters), and / or any other type of motion detection sensor. Furthermore, sensor 344 may include multiple different types of devices and combine their outputs to provide motion information. For example, sensor 344 may use a combination of multi-axis accelerometers and orientation sensors to provide the ability to calculate positioning in 2D and / or 3D coordinate systems.

[0101] Additionally, UE 302 includes a user interface 346, which provides means for providing instructions to the user (e.g., audible and / or visual instructions) and / or for receiving user input (e.g., when the user actuates a sensing device (such as a keypad, touchscreen, microphone, etc.)). Although not shown, base station 304 and network entity 306 may also include user interfaces.

[0102] Referring more specifically to processing system 384, in the downlink, IP packets from network entity 306 can be provided to processing system 384. Processing system 384 can implement functionality for the RRC layer, Packet Data Convergence Protocol (PDCP) layer, Radio Link Control (RLC) layer, and Media Access Control (MAC) layer. The processing system 384 can provide RRC layer functionality associated with system information (e.g., Master Information Block (MIB), System Information Block (SIB)) broadcasting, RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-RAT mobility, and measurement configuration of UE measurement reports; PDCP layer functionality associated with header compression / decompression, security (cryptography, cryptographic decoding, integrity protection, integrity verification), and handover support functions; RLC layer functionality associated with upper-layer PDU delivery, error correction via Automatic Repeat Request (ARQ), concatenation, segmentation and reassembly of RLC Service Data Units (SDUs), resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, scheduling information reporting, error correction, priority handling, and logical channel priority ordering.

[0103] Transmitter 354 and receiver 352 implement Layer 1 (L1) functionality associated with various signal processing functions. Layer-1, including the physical (PHY) layer, may include error detection on the transport channel, forward error correction (FEC) decoding / decoding of the transport channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. Transmitter 354 processes the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-phase shift keying (M-PSK), M-quadrature amplitude modulation (M-QAM)). The decoded and modulated symbols can then be split into parallel streams. Each stream can then be mapped to an orthogonal frequency division multiplexing (OFDM) subcarrier, multiplexed with a reference signal (e.g., a pilot) in the time and / or frequency domains, and subsequently combined using an inverse fast Fourier transform (IFFT) to produce a physical channel carrying a time-domain OFDM symbol stream. The OFDM symbol stream is spatially precoded to generate multiple spatial streams. Channel estimates from the channel estimator can be used to determine the coding and modulation schemes, as well as for spatial processing. The channel estimates can be derived from reference signals transmitted by UE 302 and / or channel condition feedback. Each spatial stream can then be provided to one or more different antennas 356. Transmitter 354 can use the corresponding spatial stream to modulate an RF carrier for transmission.

[0104] At UE 302, receiver 312 receives signals via its corresponding antenna 316. Receiver 312 recovers the information modulated onto the RF carrier and provides this information to processing system 332. Transmitter 314 and receiver 312 implement Layer 1 functionality associated with various signal processing functions. Receiver 312 can perform spatial processing on this information to recover any spatial stream destined for UE 302. If multiple spatial streams are destined for UE 302, they can be combined by receiver 312 into a single OFDM symbol stream. Receiver 312 then uses a Fast Fourier Transform (FFT) to transform the OFDM symbol stream from the time domain to the frequency domain. The frequency domain signal consists of a separate OFDM symbol stream for each subcarrier of the OFDM signal. Symbols on each subcarrier, along with a reference signal, are recovered and demodulated by determining the signal constellation points most likely to be transmitted by base station 304. These soft decisions can be based on a channel estimate calculated by a channel estimator. These soft decisions are then decoded and deinterleaved to recover the original data and control signals transmitted by base station 304 on the physical channel. These data and control signals are then provided to processing system 332, which implements Layer 3 (L3) and Layer 2 (L2) functionality.

[0105] In the uplink, processing system 332 provides demultiplexing, packet reassembly, cipher decoding, header decompression, and control signal processing between the transport and logical channels to recover IP packets from the core network. Processing system 332 is also responsible for error detection.

[0106] Similar to the functionality described in conjunction with downlink transmissions performed by base station 304, processing system 332 provides RRC layer functionality associated with system information (e.g., MIB, SIB) capture, RRC connectivity, and measurement reporting; PDCP layer functionality associated with header compression / decompression and security (cryptography, cryptographic decoding, integrity protection, integrity verification); RLC layer functionality associated with upper-layer PDU delivery, error correction via ARQ, concatenation, segmentation and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing MAC SDUs onto transport blocks (TBs), demultiplexing MAC SDUs from TBs, scheduling information reporting, error correction via Hybrid Automatic Repeat Request (HARQ), priority handling, and logical channel priority ordering.

[0107] The channel estimate derived by the channel estimator from the reference signal or feedback transmitted by the base station 304 can be used by the transmitter 314 to select an appropriate coding and modulation scheme and to facilitate spatial processing. The spatial stream generated by the transmitter 314 can be provided to different antennas 316. The transmitter 314 can use the corresponding spatial stream to modulate the RF carrier for transmission.

[0108] Uplink transmissions are processed at base station 304 in a manner similar to that described in conjunction with the receiver function at UE 302. Receiver 352 receives signals via its corresponding antenna 356. Receiver 352 recovers the information modulated onto the RF carrier and provides this information to processing system 384.

[0109] In the uplink, processing system 384 provides demultiplexing, packet reassembly, cipher decoding, header decompression, and control signal processing between the transport and logical channels to recover IP packets from UE 302. IP packets from processing system 384 can then be provided to the core network. Processing system 384 is also responsible for error detection.

[0110] For convenience, UE 302, base station 304 and / or network entity 306 are in Figures 3A to 3C The box is shown as including various components that can be configured according to the various examples described herein. However, it will be understood that the illustrated box may have different functionalities in different designs.

[0111] Various components of UE 302, base station 304 and network entity 306 can communicate with each other on data buses 334, 382 and 392 respectively. Figures 3A to 3C The components can be implemented in various ways. In some implementations, Figures 3A to 3C The components can be implemented in one or more circuits, such as, for example, one or more processors and / or one or more ASICs (which may include one or more processors). Here, each circuit may use and / or incorporate at least one memory component for storing information or executable code used by that circuit to provide this functionality. For example, some or all of the functionalities represented by blocks 310-346 may be implemented by the processor and memory components of UE 302 (e.g., by executing appropriate code and / or by appropriately configuring the processor components). Similarly, some or all of the functionalities represented by blocks 350-388 may be implemented by the processor and memory components of base station 304 (e.g., by executing appropriate code and / or by appropriately configuring the processor components). Furthermore, some or all of the functionalities represented by blocks 390-398 may be implemented by the processor and memory components of network entity 306 (e.g., by executing appropriate code and / or by appropriately configuring the processor components). For simplicity, various operations, actions, and / or functions are described herein as being performed "by the UE," "by the base station," "by the network entity," etc. However, as will be understood, such operations, actions, and / or functions can actually be performed by specific components or combinations of components of UE 302, base station 304, network entity 306, etc., such as processing systems 332, 384, 394, transceivers 310, 320, 350 and 360, memory components 340, 386 and 396, spoofing attack modules 342, 388 and 398, etc.

[0112] Various frame structures can be used to support downlink and uplink transmissions between network nodes (e.g., base stations and UEs). Figure 4A Figure 400 illustrates an example of a downlink frame structure according to various aspects of this disclosure. Figure 4B Figure 430 illustrates an example of a channel within a downlink frame structure according to various aspects of this disclosure. Figure 4C Figure 450 is an example illustrating an uplink frame structure according to various aspects of this disclosure. Figure 4D Figure 480 illustrates an example of a channel within an uplink frame structure according to various aspects of this disclosure. Other wireless communication technologies may have different frame structures and / or different channels.

[0113] LTE, and in some cases NR, utilizes OFDM on the downlink and single-carrier frequency division multiplexing (SC-FDM) on the uplink. However, unlike LTE, NR also has the option to use OFDM on the uplink. OFDM and SC-FDM divide the system bandwidth into multiple (K) orthogonal subcarriers, which are often referred to as frequency modulation, frequency slots, etc. Each subcarrier can be modulated with data. Generally, modulation symbols are transmitted in the frequency domain for OFDM and in the time domain for SC-FDM. The spacing between adjacent subcarriers can be fixed, and the total number of subcarriers (K) can depend on the system bandwidth. For example, the subcarrier spacing can be 15 kHz, and the minimum resource allocation (resource block) can be 12 subcarriers (or 180 kHz). Therefore, for system bandwidths of 1.25, 2.5, 5, 10, or 20 MHz, the nominal FFT size can be equal to 128, 256, 512, 1024, or 2048, respectively. The system bandwidth can also be divided into subbands. For example, a subband can cover 1.08MHz (i.e., 6 resource blocks), and for system bandwidths of 1.25, 2.5, 5, 10, or 20MHz, there can be 1, 2, 4, 8, or 16 subbands, respectively.

[0114] LTE supports single-parameter design (subcarrier spacing (SCS), symbol length, etc.). In contrast, NR supports multiple parameter designs (μ), for example, subcarrier spacings of 15kHz (μ=0), 30kHz (μ=1), 60kHz (μ=2), 120kHz (μ=3), and 240kHz (μ=4) or larger can be available. Within each subcarrier spacing, there are 14 symbols per time slot. For a 15kHz SCS (μ=0), there is one time slot per subframe, 10 time slots per frame, a time slot duration of 1 millisecond (ms), a symbol duration of 66.7 microseconds (μs), and a maximum nominal system bandwidth (in MHz) of 4K FFT size is 50. For a 30kHz SCS (μ=1), there are two time slots per subframe, 20 time slots per frame, a time slot duration of 0.5ms, a symbol duration of 33.3μs, and a maximum nominal system bandwidth (in MHz) of 4K FFT size of 100. For a 60kHz SCS (μ=2), there are four time slots per subframe, 40 time slots per frame, a time slot duration of 0.25ms, a symbol duration of 16.7μs, and a maximum nominal system bandwidth (in MHz) of 4K FFT size of 200. For a 120kHz SCS (μ=3), there are eight time slots per subframe, 80 time slots per frame, a time slot duration of 0.125ms, a symbol duration of 8.33μs, and a maximum nominal system bandwidth (in MHz) of 4K FFT size of 400. For a 240kHz SCS (μ=4), there are 16 time slots per subframe and 160 time slots per frame. The time slot duration is 0.0625ms, the symbol duration is 4.17μs, and the maximum nominal system bandwidth (in MHz) with a 4K FFT size is 800.

[0115] exist Figures 4A to 4D In the example, a 15kHz parameter design is used. Therefore, in the time domain, a 10ms frame is divided into 10 equal-sized subframes, each 1ms in size, and each subframe includes one time slot. Figures 4A to 4D In the diagram, time is represented horizontally (on the X-axis), where time increases from left to right, while frequency is represented vertically (on the Y-axis), where frequency increases (or decreases) from bottom to top.

[0116] A resource grid can be used to represent time slots, each time slot comprising one or more concurrent resource blocks (RBs) (also known as physical RBs (PRBs)) in the frequency domain. The resource grid is further divided into multiple resource elements (REs). An RE corresponds to one symbol length in the time domain and one subcarrier in the frequency domain. Figures 4A to 4DIn the parameter design, for a normal cyclic prefix, the RB can contain 12 consecutive subcarriers in the frequency domain and 7 consecutive symbols in the time domain, for a total of 84 REs. For an extended cyclic prefix, the RB can contain 12 consecutive subcarriers in the frequency domain and 6 consecutive symbols in the time domain, for a total of 72 REs. The number of bits carried by each RE depends on the modulation scheme.

[0117] Some REs carry downlink reference (pilot) signals (DL-RS). DL-RS may include PRS, TRS, PTRS, CRS, CSI-RS, DMRS, PSS, SSS, SSB, etc. Figure 4A The example location of the RE carrying PRS (labeled "R") is explained.

[0118] The set of resource elements (REs) used for PRS transmission is called a "PRS resource". The resource element set can span multiple PRBs in the frequency domain and 'N' (such as one or more) consecutive symbols within a time slot in the time domain. In a given OFDM symbol in the time domain, the PRS resource occupies a consecutive PRB in the frequency domain.

[0119] The transmission of PRS resources within a given PRB has a specific comb tooth size (also known as "comb tooth density"). The comb tooth size 'N' represents the subcarrier spacing (or frequency / frequency modulation spacing) within each symbol of the PRS resource configuration. Specifically, for a comb tooth size 'N', the PRS is transmitted in every Nth subcarrier of a symbol in the PRB. For example, for comb tooth-4, for each symbol of the PRS resource configuration, the RE corresponding to every fourth subcarrier (such as subcarriers 0, 4, 8) is used to transmit the PRS resource. Currently, comb tooth sizes of comb tooth-2, comb tooth-4, comb tooth-6, and comb tooth-12 are supported by DL-PRS. Figure 4A An example PRS resource configuration for comb tooth 6 (which spans 6 symbols) is explained. That is, the position of the shaded RE (marked as "R") indicates the PRS resource configuration for comb tooth 6.

[0120] Currently, DL-PRS resources can span 2, 4, 6, or 12 consecutive symbols within a single time slot using a full-frequency interleaved mode. DL-PRS resources can be configured in any downlink or flexible (FL) symbol configured by a higher layer within a time slot. For all REs of a given DL-PRS resource, there may be a constant energy per resource element (EPRE). The following are the symbol-by-symbol frequency offsets for comb sizes 2, 4, 6, and 12 symbols. 2-symbol comb-2: {0,1}; 4-symbol comb-2: {0,1,0,1}; 6-symbol comb-2: {0,1,0,1,0,1}; 12-symbol comb-2: {0,1,0,1,0,1,0,1,0,1,0,1}; 4-symbol comb-4: {0,2,1,3}; 12-symbol comb-4: { 0,2,1,3,0,2,1,3,0,2,1,3}; 6-code comb-6: {0,3,1,4,2,5}; 12-code comb-6: {0,3,1,4,2,5,0,3,1,4,2,5}; and 12-code comb-12: {0,6,3,9,1,7,4,10,2,8,5,11}.

[0121] A “PRS resource set” is a group of PRS resources used to transmit PRS signals, where each PRS resource has a PRS resource ID. Furthermore, PRS resources in a PRS resource set are associated with the same TRP. A PRS resource set is identified by a PRS resource set ID and associated with a specific TRP (identified by a TRP ID). Additionally, PRS resources in a PRS resource set share the same periodicity, a shared silent mode configuration, and the same repetition factor (such as “PRS-ResourceRepetitionFactor”) across time slots. Periodicity is the time from the first repetition of the first PRS resource in the first PRS instance to the same first repetition of the same first PRS resource in the next PRS instance. Periodicity can have a length chosen from the following: 2^μ*{4,5,8,10,16,20,32,40,64,80,160,320,640,1280,2560,5120,10240} time slots, where μ = 0, 1, 2, 3. The repetition factor can have a length selected from {1, 2, 4, 6, 8, 16, 32} time slots.

[0122] In a PRS resource set, a PRS resource ID is associated with a single beam (or beam ID) transmitted from a single TRP (where a TRP can transmit one or more beams). That is, each PRS resource in a PRS resource set can be transmitted on a different beam, and thus, a "PRS resource" (or simply a "resource") can also be referred to as a "beam". Note that this does not imply whether the UE is aware of the TRP and beam transmitting the PRS.

[0123] A “PRS instance” or “PRS timing” is an instance of a periodically repeating time window (such as a group of one or more consecutive time slots) in which a PRS is expected to be transmitted. A PRS timing may also be referred to as a “PRS positioning timing,” “PRS positioning instance,” “positioning timing,” “positioning instance,” “positioning repetition,” or simply “timing,” “instance,” or “repetition.”

[0124] A “Frequency Layer” (also simply “Frequency Layer”) is a collection of one or more PRS resource sets with identical values ​​for certain parameters across one or more TRPs. Specifically, the collection of PRS resource sets has the same subcarrier spacing and cyclic prefix (CP) type (meaning all parameter designs supported by PDSCH are also supported by PRS), the same point A, the same downlink PRS bandwidth, the same starting PRB (and center frequency), and the same comb size. The point A parameter uses the value of the parameter “ARFCN-ValueNR” (where “ARFCN” stands for “Absolute Radio Channel Number”) and is an identifier / code specifying a pair of physical radio channels used for transmission and reception. The downlink PRS bandwidth can have a granularity of 4 PRBs, with a minimum of 24 PRBs and a maximum of 272 PRBs. Currently, up to four frequency layers have been defined, and up to two PRS resource sets can be configured per frequency layer per TRP.

[0125] The concept of a frequency layer is somewhat similar to that of component carriers and bandwidth portions (BWPs), but the difference is that component carriers and BWPs are used by a single base station (or macrocell base station and small cell base station) to transmit data channels, while a frequency layer is used by several (often three or more) base stations to transmit PRS (Positioning Signals). A UE can indicate the number of frequency layers it can support when sending its positioning capabilities to the network (such as during an LTE Positioning Protocol (LPP) session). For example, a UE can indicate whether it can support one or four positioning frequency layers.

[0126] Figure 4BExamples of various channels within the downlink time slot of a radio frame are explained. In NR, the channel bandwidth, or system bandwidth, is divided into multiple BWPs. A BWP is a set of adjacent PRBs selected from a subset of shared RBs designed for a given carrier with given parameters. Generally, a maximum of four BWPs can be specified in both the downlink and uplink. That is, a UE can be configured to have up to four BWPs in the downlink and up to four BWPs in the uplink. Only one BWP (uplink or downlink) can be active at a given time, meaning that the UE can only receive or transmit on one BWP at a time. In the downlink, the bandwidth of each BWP should be equal to or greater than the bandwidth of the SSB, but it may or may not contain an SSB.

[0127] Reference Figure 4B The Primary Synchronization Signal (PSS) is used by the UE to determine subframe / symbol timing and physical layer identity. The Secondary Synchronization Signal (SSS) is used by the UE to determine the physical layer cell identity group number and radio frame timing. Based on the physical layer identity and physical layer cell identity group number, the UE can determine the PCI. Based on the PCI, the UE can determine the location of the aforementioned DL-RS. The Physical Broadcast Channel (PBCH) carrying the MIB can be logically grouped with the PSS and SSS to form the SSB (also known as SS / PBCH). The MIB provides the number of RBs in the downlink system bandwidth and the System Frame Number (SFN). The Physical Downlink Shared Channel (PDSCH) carries user data, broadcast system information (such as System Information Blocks (SIBs)) not transmitted through the PBCH, and paging messages.

[0128] The Physical Downlink Control Channel (PDCCH) carries downlink control information (DCI) within one or more Control Channel Elements (CCEs). Each CCE includes one or more RE Group (REG) bundles (which can span multiple symbols in the time domain). Each REG bundle includes one or more REGs, and each REG corresponds to 12 resource elements (one resource block) in the frequency domain and one OFDM symbol in the time domain. The physical resource set used to carry the PDCCH / DCI is called the Control Resource Set (CORESET) in NR. In NR, the PDCCH is confined to a single CORESET and transmitted along with its own DMRS. This enables UE-specific beamforming for the PDCCH.

[0129] exist Figure 4BIn the example, each BWP has one CORESET, and this CORESET spans three symbols in the time domain (although it can be only one or two symbols). Unlike the LTE control channel, which occupies the entire system bandwidth, in NR, the PDCCH channel is localized to a specific region in the frequency domain (i.e., the CORESET). Therefore, Figure 4B The frequency components of the PDCCH shown are interpreted in the frequency domain as fewer than a single BWP. Note that although the interpreted CORESETs are contiguous in the frequency domain, they do not need to be contiguous. Additionally, a CORESET can span fewer than three symbols in the time domain.

[0130] The DCI within the PDCCH carries information about uplink resource allocation (persistent and non-persistent) and a description of the downlink data transmitted to the UE (referred to as uplink grant and downlink grant, respectively). More specifically, the DCI indicates the resources scheduled for downlink data channels (e.g., PDSCH) and uplink data channels (e.g., PUSCH). Multiple (e.g., up to eight) DCIs can be configured in the PDCCH, and these DCIs can have one of several formats. For example, different DCI formats exist for uplink scheduling, downlink scheduling, uplink transmit power control (TPC), etc. The PDCCH can be transmitted by 1, 2, 4, 8, or 16 CCEs to accommodate different DCI payload sizes or code rates.

[0131] like Figure 4C As explained, some REs (denoted as "R") carry DMRS for channel estimation at the receiver (e.g., a base station, another UE, etc.). The UE may, for example, additionally transmit SRS in the last symbol of the time slot. The SRS may have a comb structure, and the UE may transmit the SRS on one of the comb teeth. Figure 4C In the example, the SRS described is a comb tooth-2 on a symbol. The SRS can be used by the base station to obtain Channel State Information (CSI) for each UE. CSI describes how the RF signal propagates from the UE to the base station and represents the combined effects of scattering, fading, and power attenuation over distance. The system uses SRS for resource scheduling, link adaptation, massive MIMO, beam management, etc.

[0132] Currently, SRS resources with comb tooth sizes of 2, 4, or 8 can span 1, 2, 4, 8, or 12 consecutive symbols within a time slot. The following are the symbol-by-symbol frequency offsets for the currently supported SRS comb tooth patterns. 1-code element comb-2: {0}; 2-code element comb-2: {0,1}; 4-code element comb-2: {0,1,0,1}; 4-code element comb-4: {0,2,1,3}; 8-code element comb-4: {0,2,1,3,0,2,1,3}; 12-code element comb-4: {0,2,1,3,0,2,1,3,0,2,1,3}; 4-code element comb-8: {0,4,2,6}; 8-code element comb-8: {0,4,2,6,1,5,3,7}; and 12-code element comb-8: {0,4,2,6,1,5,3,7,0,4,2,6}.

[0133] The set of resource elements used for SRS transmission is called an "SRS resource" and is identified by the parameter "SRS-ResourceId (SRS-ResourceId)". The resource element set can span multiple PRBs in the frequency domain and N (e.g., one or more) consecutive symbols within a time slot in the time domain. In a given OFDM symbol, an SRS resource occupies a consecutive PRB. An "SRS resource set" is a group of SRS resources used for SRS signal transmission and is identified by the SRS resource set ID ("SRS-ResourceSetId").

[0134] Generally, a UE transmits a Signal for Reference Signal (SRS) to enable the receiving base station (serving base station or neighboring base station) to measure the channel quality between the UE and the base station. However, an SRS can also be specifically configured as an uplink positioning reference signal for uplink-based positioning procedures, such as uplink time difference of arrival (UL-TDOA), round-trip time (RTT), uplink angle of arrival (UL-AoA), etc. As used herein, the term "SRS" can refer to an SRS configured for channel quality measurement or an SRS configured for positioning purposes. When it is necessary to distinguish between the two types of SRS, the former may be referred to herein as "SRS for communication" and / or the latter as "SRS for positioning".

[0135] Several enhancements to the previously defined SRS have been proposed for “SRS for Positioning” (also known as “UL-PRS”), such as new interleaving patterns within SRS resources (other than single symbol / comb-2), new comb types for SRS, new sequences of SRS, larger sets of SRS resources per component carrier, and larger numbers of SRS resources per component carrier. Additionally, the parameters “SpatialRelationInfo” and “PathLossReference” are configured based on downlink reference signals or SSBs from adjacent TRPs. Furthermore, an SRS resource can be transmitted outside the active BWP, and an SRS resource can span multiple component carriers. Moreover, SRS can be configured in RRC connected states and transmitted only within the active BWP. Furthermore, there may be no frequency hopping, no repetition factor, a single antenna port, and new SRS lengths (e.g., 8 and 12 symbols). Open-loop power control may also exist, but closed-loop power control is not possible, and comb-8 (i.e., SRS transmitted every eighth subcarrier in the same symbol) can be used. Finally, the UE can transmit from multiple SRS resources using the same transmit beam for UL-AoA. All of these are features outside the current SRS framework, which is configured via higher-level RRC signaling (and potentially triggered or activated via MAC control elements (CE) or DCI).

[0136] Figure 4D Examples of various channels within uplink slots of a frame according to various aspects of this disclosure are described. A Random Access Channel (RACH) (also referred to as a Physical Random Access Channel (PRACH)) may be configured based on the PRACH within one or more slots of the frame. A PRACH may include six consecutive RB pairs within a slot. The PRACH allows the UE to perform initial system access and achieve uplink synchronization. A Physical Uplink Control Channel (PUCCH) may be located at the edge of the uplink system bandwidth. The PUCCH carries uplink control information (UCI), such as scheduling requests, CSI reports, channel quality indicators (CQI), precoding matrix indicators (PMI), rank indicators (RI), and HARQ ACK / NACK feedback. A Physical Uplink Shared Channel (PUSCH) carries data and may additionally be used to carry buffer status reports (BSR), power clearance reports (PHR), and / or UCI.

[0137] Note that the terms "location reference signal" and "PRS" generally refer to specific reference signals used for positioning in NR and LTE systems. However, as used herein, the terms "location reference signal" and "PRS" can also refer to any type of reference signal that can be used for positioning, such as, but not limited to, PRS, TRS, PTRS, CRS, CSI-RS, DMRS, PSS, SSS, SSB, SRS, UL-PRS, etc., as defined in LTE and NR. Additionally, the terms "location reference signal" and "PRS" can refer to downlink or uplink positioning reference signals, unless otherwise indicated by the context. If further distinction is needed regarding the type of PRS, downlink positioning reference signals may be referred to as "DL-PRS," while uplink positioning reference signals (e.g., SRS, PTRS used for positioning) may be referred to as "UL-PRS." Furthermore, for signals that can be transmitted in both uplink and downlink (e.g., DMRS, PTRS), these signals may be prefixed with "UL" or "DL" to distinguish direction. For example, "UL-DMRS" can be distinguished from "DL-DMRS."

[0138] Figure 5 This is a diagram illustrating an example PRS configuration 500 for PRS transmission at a given base station, based on various aspects of this disclosure. Figure 5 In the diagram, time is represented horizontally, increasing from left to right. Each long rectangle represents a time slot, while each short (shaded) rectangle represents an OFDM symbol. Figure 5 In the example, PRS resource set 510 (labeled "PRS resource set 1") includes two PRS resources, a first PRS resource 512 (labeled "PRS resource 1") and a second PRS resource 514 (labeled "PRS resource 2"). The base station transmits PRS on PRS resources 512 and 514 of PRS resource set 510.

[0139] PRS resource set 510 has a timing length of two time slots (N_PRS) and a periodicity of, for example (for a 15 kHz subcarrier spacing), 160 time slots or 160 milliseconds (ms) (T_PRS). Thus, PRS resources 512 and 514 are both two consecutive time slots in length and repeat every T_PRS time slot starting from the time slot in which the first symbol of the corresponding PRS resource appears. Figure 5 In the example, PRS resource 512 has a symbol length of two symbols (N_symb), and PRS resource 514 has a symbol length of four symbols (N_symb). PRS resource 512 and PRS resource 514 can be transmitted on separate beams of the same base station.

[0140] Each instance of PRS resource set 510 (described as instances 520a, 520b, and 520c) includes an event of length '2' (i.e., N_PRS = 2) for each PRS resource 512, 514 in the PRS resource set. PRS resources 512 and 514 repeat every T_PRS slot until the silence sequence is periodically T_REP. Thus, a bitmap of length T_REP is needed to indicate which events of instances 520a, 520b, and 520c of PRS resource set 510 are silenced (i.e., not transmitted).

[0141] On the one hand, there may be additional constraints on PRS configuration 500. For example, for all PRS resources (e.g., PRS resources 512, 514) in a PRS resource set (e.g., PRS resource set 510), the base station can configure the following parameters to be the same: (a) timing length (T_PRS), (b) number of symbols (N_symb), (c) comb type, and / or (d) bandwidth. Additionally, for all PRS resources in all PRS resource sets, the subcarrier spacing and cyclic prefix can be configured to be the same for one base station or for all base stations. Whether it is for one base station or for all base stations depends on the UE's ability to support the first and / or second options.

[0142] Figure 6 This is a diagram illustrating example PRS resource sets with different time intervals according to various aspects of this disclosure. Figure 6 In the example, time is represented horizontally and frequency is represented vertically. Each box represents a time slot in the time domain and a bandwidth in the frequency domain.

[0143] Figure 6 Two DL-PRS resource set configurations, DL-PRS resource set configuration 610 and DL-PRS resource set configuration 650, are explained. Each DL-PRS resource set configuration 610 and 650 includes four PRS resources (labeled "Resource 1", "Resource 2", "Resource 3", and "Resource 4") and has a repetition factor of four. A repetition factor of four means that each of the four PRS resources is repeated four times in the DL-PRS resource set (i.e., transmitted four times). That is, each of the four PRS resources within the DL-PRS resource set is repeated four times.

[0144] The DL-PRS resource set configuration 610 has a time slot of one time slot, meaning that each repetition of a PRS resource (e.g., "Resource 1") begins on the first time slot after a previous repetition of that PRS resource. Therefore, as explained by the DL-PRS resource set configuration 610, four repetitions of each of the four PRS resources are grouped together. Specifically, the four repetitions of PRS resource "Resource 1" occupy the first set of four time slots of the DL-PRS resource set configuration 610 (i.e., time slots n to n+3), the four repetitions of PRS resource "Resource 2" occupy the second set of four time slots (i.e., time slots n+4 to n+7), the four repetitions of PRS resource "Resource 3" occupy the third set of four time slots (i.e., time slots n+8 to n+11), and the four repetitions of PRS resource "Resource 4" occupy the last four time slots (i.e., time slots n+12 to n+15).

[0145] Conversely, the DL-PRS resource set configuration 650 has a four-slot time interval, meaning that each repetition of a PRS resource (e.g., "Resource 2") begins on the fourth time slot after a previous repetition of that PRS resource. Therefore, as explained by the DL-PRS resource set configuration 650, the four repetitions of each of the four PRS resources are scheduled in every fourth time slot. For example, the four repetitions of PRS resource "Resource 1" occupy the first, fifth, ninth, and thirteenth time slots of the DL-PRS resource set configuration 650 (i.e., time slots n, n+4, n+8, and n+12).

[0146] Note that, as Figure 6 As explained, the time span of a DL-PRS resource set containing repeating DL-PRS resources should not exceed the PRS periodicity. Furthermore, the UE receive beam sweep used to receive / measure the DL-PRS resource set is not specified but depends on the UE implementation.

[0147] Figure 7A and 7B This section explains the various comb modes supported by DL-PRS within resource blocks. Figure 7A and 7B In the diagram, time is represented horizontally and frequency is represented vertically. Figure 7A and 7B Each large block represents a resource block, and each small block represents a resource element. As discussed above, a resource element consists of a symbol in the time domain and a subcarrier in the frequency domain. Figure 7A and Figure 7BIn the example, each resource block comprises 14 symbols in the time domain and 12 subcarriers in the frequency domain. The shadow resource element carries DL-PRS or is scheduled to carry DL-PRS. Thus, the shadow resource element in each resource block corresponds to a PRS resource, or a portion of a PRS resource within a resource block (because a PRS resource can span multiple resource blocks in the frequency domain).

[0148] The comb patterns described correspond to the various DL-PRS comb patterns mentioned above. Specifically, Figure 7A The DL-PRS comb pattern 710 with two code teeth -2, the DL-PRS comb pattern 720 with four code teeth -4, the DL-PRS comb pattern 730 with six code teeth -6, and the DL-PRS comb pattern 740 with twelve code teeth -12 are explained. Figure 7B The DL-PRS comb pattern 750 for comb teeth-2 with twelve symbols, the DL-PRS comb pattern 760 for comb teeth-4 with twelve symbols, the DL-PRS comb pattern 770 for comb teeth-2 with six symbols, and the DL-PRS comb pattern 780 for comb teeth-6 with twelve symbols are explained.

[0149] Note that, Figure 7A In the example comb pattern, the resource elements of DL-PRS transmitted on it are interleaved in the frequency domain so that only one such resource element exists per subcarrier across the configured number of symbols. For example, for DL-PRS comb pattern 720, only one resource element exists per subcarrier across four symbols. This is called "frequency domain interleaving".

[0150] Furthermore, there exists a DL-PRS resource symbol offset from the first symbol of the resource block to the first symbol of the DL-PRS resource (given by the parameter "DL-PRS-ResourceSymbolOffset"). In the example of DL-PRS comb mode 710, this offset is three symbols. In the example of DL-PRS comb mode 720, this offset is eight symbols. In the examples of DL-PRS comb modes 730 and 740, this offset is two symbols. In the examples of DL-PRS comb modes 750 to 780, this offset is two symbols.

[0151] As will be understood, compared to measuring DL-PRS comb pattern 720, the UE will need a higher capability to measure DL-PRS comb pattern 710 because, for DL-PRS comb pattern 710, the UE will have to measure resource elements on twice the number of subcarriers per symbol as in DL-PRS comb pattern 720. Furthermore, compared to measuring DL-PRS comb pattern 740, the UE will need a higher capability to measure DL-PRS comb pattern 730 because, for DL-PRS comb pattern 730, the UE will have to measure resource elements on twice the number of subcarriers per symbol as in DL-PRS comb pattern 740. Moreover, compared to measuring DL-PRS comb patterns 730 and 740, the UE will need a higher capability to measure DL-PRS comb patterns 710 and 720 because the resource elements in DL-PRS comb patterns 710 and 720 are more densely packed than those in DL-PRS comb patterns 730 and 740.

[0152] In NR, the scrambling identifier is defined per PRS resource, and the pseudo-random QPSK sequence changes per slot per OFDM symbol. For example, in some NR systems, the pseudo-random sequence generator should be initialized as follows:

[0153]

[0154] in, It is the timeslot number, the downlink PRS sequence ID. It is given by the higher-level parameter dl-PRS-SequenceID-r16 (dl-PRS-SequenceID-r16), and l is the OFDM symbol in the time slot to which the sequence is mapped.

[0155] The parameters mentioned above can be indicated to the UE via NR-DL-PRS-Resource-r16, for example:

[0156] NR-DL-PRS-Resource-r16::=SEQUENCE(sequence){

[0157] NR-DL-PRS-Resource-r16::=SEQUENCE{

[0158] nr-DL-PRS-ResourceID-r16 (nr-DL-PRS-ResourceID-r16)

[0159] NR-DL-PRS-ResourceID-r16,

[0160] dl-PRS-SequenceID-r16 INTEGER (integer) (0..4095),

[0161] dl-PRS-CombSizeN-AndReOffset-r16(dl-PRS-CombSizeN-AndReOffset-r16)

[0162] CHOICE (Selection) {

[0163] n2-r16 INTEGER(0..1),

[0164] n4-r16 INTEGER(0..3),

[0165] n6-r16 INTEGER(0..5),

[0166] n12-r16 INTEGER(0..11), ...

[0168] },

[0169] dl-PRS-ResourceSlotOffset-r16(dl-PRS-resource slot offset-r16)INTEGER(0..nrMaxResourceOffsetValue-1-r16(maximum number of resource offset values-1-r16)),

[0170] dl-PRS-ResourceSymbolOffset-r16 (dl-PRS-ResourceSymbolOffset-r16)

[0171] INTEGER(0..12),

[0172] dl-PRS-QCL-Info-r16 (dl-PRS-QCL-Info-r16)

[0173] DL-PRS-QCL-Info-r16 (DL-PRS-QCL-Info-r16)

[0174] OPTIONAL (Optional) ...

[0176] }

[0177] Ranging is supported in current Wi-Fi systems. If the first path is not too weak (e.g., within 10 dB of the strongest path), channel estimation using a long training field (LTF) can identify the first path, even in multipath environments. IEEE 802.11az is built on top of 802.11ax and is an IEEE project for secure ranging. One goal of IEEE 802.11az is secure LTF design. One of the main problems with secure LTF is preventing LTF spoofing (e.g., making the distance between two stations (STAs) appear smaller than the actual distance).

[0178] Some examples of man-in-the-middle or "spoofing" attacks (e.g., one of the spoofing attacks that can be characterized as a "repetition-based" spoofing attack) are as follows:

[0179]

[0180]

[0181] Table 1: Description of spoofing attacks against IEEE 802.11az and mitigation techniques

[0182] Figure 8 This explanation details one aspect of the PRS spoofing attack based on this disclosure. Figure 8 In this context, a PRS spoofing attack 800 involving PRS symbols or resources (e.g., potentially spanning multiple symbols) includes a listening phase 802, a calculation phase 804, and an attack phase 806. During the listening phase 802, the attacker examines the first portion of the PRS. During the calculation phase 804, the attacker determines which QAM symbols were transmitted and subsequently determines the scrambling ID. This is also known as a frequency domain (FD) attack. For a cross-symbol attacker, the attacker receives the set of PRS symbols at 802, performs blind detection of which scrambling ID was used at 804, and uses a timing advance to transmit the remaining PRS symbols at 806. For an intra-symbol attacker, the attacker is able to receive only a portion of a single OFDM symbol at 802, perform an FD or TD attack (calculation or per-symbol attack) at 804, and use a timing advance to transmit the remaining portion of that single symbol at 806.

[0183] Figure 9 The PRS spoofing attack 900, based on one aspect of this disclosure, is explained. Figure 9In this context, PRS spoofing attack 900 is a sample-by-sample or time-domain (TD) attack and includes a PRS symbol or resource (e.g., potentially spanning multiple symbols) comprising a received signal stage 902, a time advance 904, and a future signal 906. The time advance 904 of the future signal 906 (or the attack signal) can have a duration set to several samples (such as 3, 4, 5, etc.). In PRS spoofing attack 900, the attacker receives the first portion of the signal at 902, determines the correlation (bandwidth-limited signal) at 906, and predicts a small number of future samples. A Wiener filter predicts the future signal 906 by utilizing the correlation between the previously received signal at 902 and the unreceived future signal. This is also known as a time-domain (TD) attack.

[0184] Figure 10A The explanation covers one aspect of the PRS spoofing attack 1000 based on this disclosure. Figure 10A In this PRS symbol (e.g., OFDM symbol), there is a CP 1002, a PRS portion 1004, and a PRS end portion 1006. CP 1002 is equivalent to the PRS end portion 1006. Here, the attack listens to CP 1002 and then transmits a copy of CP 1002 in a later part of the PRS symbol at 1008.

[0185] Figure 10B The explanation describes one aspect of the method used for countermeasures according to this disclosure. Figure 10A Example mitigation technique 1050 for PRS spoofing attack 1000. Figure 10B In PRS symbols (e.g., OFDM symbols), there is a PRS portion 1054 and a PRS end portion 1056. Figure 10B From Figure 10A CP 1002 is simply omitted to prevent the attacker from copying and transmitting it. Mitigation technique 1050 (which may be referred to as zero CP or zero guard interval (GI) technique) adds complexity to channel estimation.

[0186] Security for NR UE positioning is crucial for commercialization and enables a wider range of use cases. However, current 3GPP designs lack PHY layer security technologies for NR UE positioning. Solutions to zero-GI handling CP attacks proposed in IEEE 802.11az may not be easily adopted in 3GPP because the fundamental waveform variations in the NR specification make implementation more challenging. Furthermore, unlike 802.11az, NR PRS contains an inherent repetition, even within a single PRS symbol (e.g., this PRS symbol can be monitored and copied by an attacker, similar to CP). For example, for a comb 2 / 12 symbol PRS resource, the PRS symbol is repeated 6 times. Therefore, an attacker can listen to a portion of the PRS resource and manipulate it (e.g., by using a small time advance) to transmit a copy of the monitored portion of the PRS resource.

[0187] Various aspects of this disclosure relate to spoofing attack detection based on RSRP measurements. For example, adding an attacker's signal on top of a intended reference signal (RS-P) for positioning (e.g., DL-PRS, UL-SRS-P, sidelink PRS, etc.) can increase the RSRP against at least some portion of the RS-P symbols or resources at at least some angles (e.g., the angle of arrival of the radio node). Knowing about potential spoofing attacks can provide various technical advantages (such as deploying one or more mitigation techniques) that can improve UE positioning accuracy.

[0188] Various aspects of this disclosure relate to measurement reports having measurement indications for multiple subbands of a reference signal used for locating resources. Such measurements may include RSRP as mentioned above, but may additionally (or alternatively) include timing measurements. Furthermore, such measurements, as mentioned above, may be related to DL-PRS, but can be applied to other types of reference signals (RS-P) used for locating, such as sidelink PRS, uplink probe reference signals for locating (UL-SRS-P), and so on. These aspects can provide various technical advantages, such as improved locating accuracy (e.g., because beam tilt can be better compensated at the locating entity).

[0189] Figure 11 An exemplary wireless communication process 1100 according to various aspects of this disclosure is explained. In one aspect, process 1100 may be performed by a wireless node, such as a UE 302 (e.g., a target UE expecting its location estimation, an anchor or reference UE having a known location locked according to the most recent location) or a BS 304 (e.g., a serving or non-serving gNB).

[0190] Reference Figure 11In 1110, the wireless node (e.g., receiver 312 or 322 or 352 or 362, processing system 332 or 384, etc.) performs a first RSRP measurement of RS-P based on a first set of samples within a first time window of the RS-P symbol or resource. In some designs, the first time window may correspond to an instance of a time-sliding window spanning one or more RS-P samples of the RS-P symbol or resource.

[0191] Reference Figure 11 At 1120, the wireless node (e.g., spoofing module 342 or 388, processing system 332 or 384, etc.) determines whether a spoofing attack is associated with RS-P based on a first RSRP measurement and one or more other RSRP measurements of one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource. In some designs, the spoofing attack determination at 1110 is based on the difference between the first RSRP measurement and the one or more other RSRP measurements.

[0192] Reference Figure 11 At 1130, the wireless node (e.g., transmitter 314, 324, 354, or 364, network interface 380, data bus 334 or 382, ​​etc.) transmits an indication of the spoofing attack determination (e.g., as part of a measurement report, etc.) to a communication device (e.g., a location estimation entity, a network server, a UE, etc.). In some designs, the wireless node itself may correspond to a location estimation entity (e.g., a UE for UE-based positioning, a gNB in ​​the case of LMF integration in the RAN, etc.). In this case, the transmission from 1130 to that particular component may correspond to internal data transmission between logical components via corresponding data buses, etc., rather than external wireless or backhaul transmission. In some designs, the communication device does not need to be a location estimation entity, but may correspond to another type of network component (e.g., an OEM server, an application server, etc.).

[0193] Figure 12 An exemplary wireless communication process 1200 according to various aspects of this disclosure has been described. In one aspect, process 1200 may be performed by a communication device (such as a location estimation entity) that may correspond to a UE (such as UE 302) (e.g., for UE-based location), a BS or gNB (such as BS 304) (e.g., for LMF integrated in a RAN), or a network entity 306 (e.g., a core network component (such as an LMF)). In other designs, process 1200 may be performed on another UE by another type of network component (e.g., not necessarily a location estimation entity) (such as an OEM server, application server, etc.).

[0194] Reference Figure 12In 1210, the communication device (e.g., receiver 312 or 322 or 352 or 362, network interface 380 or 390, data bus 334 or 382, ​​etc.) receives from the radio node an indication (e.g., as part of a measurement report, etc.) of a determination of an spoofing attack associated with RS-P, which is at least partially based on a first RSRP measurement of the RS-P on a first sample set within a first time window of the RS-P symbols or resources and one or more other RSRP measurements on one or more other sample sets within one or more earlier time windows of the RS-P symbols or resources. In some designs, the first time window may correspond to an instance of a time-sliding window spanning one or more RS-P samples of the RS-P symbols or resources. In some designs, the spoofing attack determination communicated in the measurement report is based on the difference between the first RSRP measurement and the one or more other RSRP measurements. In some designs, the radio node itself may correspond to a location estimation entity (e.g., a UE for UE-based location, a gNB in ​​the case of LMF integration in the RAN, etc.). In this scenario, the reception of 1210 to that particular component may correspond to internal data transmission between logical components via a corresponding data bus, rather than external wireless or backhaul transmission.

[0195] Reference Figure 12At 1220, the communication device (e.g., processing system 332, 384, or 394, etc.) performs at least one action based at least in part on the indication determined by the spoofing attack. For example, the at least one action may include determining a location estimate for the target UE; or crowdsourcing measurement information or spoofing attack determination from one or more wireless nodes, or both (e.g., to increase the confidence level that the spoofing attack actually occurred in a particular area, or to set a baseline or expected RSRP when no spoofing attack occurred for comparison with the spoofing attack, etc.); or transmitting one or more location scheme recommendations based on the type of spoofing attack associated with the spoofing attack determination (e.g., providing a recommendation to use 5G NR positioning, or providing a recommendation to use GNSS positioning, or providing a recommendation to avoid (these) specific location schemes, etc.); or a combination thereof (e.g., location estimates may be collected to identify areas of interest, then crowdsourced to increase confidence, and then recommendations are provided once a threshold confidence level is reached, etc.). In some designs, if the spoofing attack determination at 1210 indicates a possible spoofing attack, the location determination at 1220 can be based on one or more spoofing attack mitigation techniques (e.g., ignoring RS-P measurement data that is highly likely to be spoofed, triggering a new location session, etc.). In the case of crowdsourcing, measurement information (e.g., RSRP) and / or spoofing attack determination can be collected from the target UE itself (e.g., by multiple indications from a specific UE across time) or from different UEs within the area of ​​interest. In some designs, crowdsourcing can be used to confirm the spoofing attack determination by setting a baseline or expected RSRP, where a deviation from the baseline or expected RSRP based on spoofing leads to the spoofing attack determination (or increases the confidence level associated with the spoofing attack). In other designs, crowdsourcing can be used to confirm the spoofing attack determination by increasing the confidence level associated with the spoofing attack determination (e.g., the confidence level is increased when two or more UEs report the spoofing attack compared to when only a single UE reports the spoofing attack). In some designs, crowdsourcing can be further performed in a targeted manner (e.g., UEs associated with the same model or OEM can crowdsource their corresponding measurement information and / or spoofing attacks together, etc.).

[0196] Figure 13 Each aspect of this disclosure has been explained. Figures 11-12 The example implementation of process 1100-1200 is 1300. Figure 13The text describes the RSRP (Relationship to RS-P Symbols) associated with a time window 1…N (with a duration of 1302) of an RS-P symbol or resource (e.g., DL-PRS symbol / resource, UL-SRS-P symbol / resource, sidelink PRS symbol / resource, etc.) as measured at a wireless node. In some designs, an RS-P symbol or resource may comprise a single RS-P (e.g., single-symbol attacker or intra-symbol attacker), although in other designs, an RS-P symbol or resource may span multiple symbols (e.g., cross-symbol attacker). Figure 13 In the example, RSRP is evaluated without considering angles (e.g., RSRP is averaged across AoA). Figure 13 As shown, the RSRP for time window N-1 is higher than the RSRP for previous time windows 1…N-2. This "peak" in RSRP can indicate a potential spoofing attack. Furthermore, a return to a lower RSRP in time window N can further indicate a potential spoofing attack and can be used to increase the confidence level associated with identifying a spoofing attack. Conversely, the lack of such... Figure 13 Any RSRP spikes depicted can be considered as indicating a lower probability of a spoofing attack.

[0197] Reference Figure 13 As an example, a wireless node (e.g., a gNB or UE) uses a certain hourly sliding window to measure the RSRP of RS-P (e.g., PRS or SRS-P). The wireless node (e.g., a gNB or UE) compares the RSRP measurement based on the RS-P time-domain sample captured using the current sliding window with (e.g.,) previously measured RSRP measurements. Previous RSRP measurements can be one-off (e.g., RSRP for a specific time window) or averaged measurements (e.g., the average of RSRP across M previous time windows, etc.). If the RSRP measurement using the current sliding window is X dB larger than (e.g.,) previous RSRP measurements, the wireless node can determine (e.g., with some confidence level) that a repeating attack has been detected. In some designs, to reduce the false alarm rate, the wireless node can continue RSRP measurement even if a potential attack is detected (e.g., as...). Figure 13 As shown in the diagram, this is reflected in the fact that after an abnormal RSRP in time window N-1, the RSRP in time window N returns to normal. If the RSRP falls back to the level of the previously normal RSRP measurement, the detection reliability is higher.

[0198] Figure 14 Each aspect of this disclosure has been explained. Figure 11-12 The example implementation of process 1100-1200 is 1400. Figure 14The text describes the RSRP associated with a time window 1…N of an RS-P symbol or resource (e.g., DL-PRS symbol / resource, UL-SRS-P symbol / resource, sidelink PRS symbol / resource, etc.) as measured at a wireless node. In some designs, an RS-P symbol or resource may comprise a single RS-P (e.g., single-symbol attacker or intra-symbol attacker), although in other designs, an RS-P symbol or resource may span multiple symbols (e.g., cross-symbol attacker). Figure 13 The examples are different, in Figure 14 In this context, RSRP can be associated with a specific angle or angular range (e.g., AoA), which can be referred to as a two-dimensional (2D) RSRP measurement. Specifically, RSRP is depicted relative to angles (or angular ranges) 1402, 1404, and 1406, which is consistent with... Figure 13 Compared to allowing for more accurate detection of spoofing attacks (e.g., at the cost of increased power consumption at the wireless node, which could be problematic for battery-operated wireless nodes such as UEs), the beam of an attack signal from an attacker is unlikely to be perfectly aligned with the beam from a genuine RS-P source. Therefore, RSRP spikes from the attacker may disproportionately affect the measured RSRP at specific angles or angular ranges.

[0199] like Figure 14 As shown, at angles (or angle ranges) 1402 and 1404, the RSRP for time window N-1 is slightly higher than the RSRP for previous time windows 1…N-2. However, this slight spike in RSRP may not be sufficient to trigger spoofing attack detection (e.g., below a certain RSRP spike threshold). At angle (or angle range) 1406, the RSRP for window N-1 is significantly higher than the RSRP for time windows 1…N-2. Here, the inconsistency in RSRP for time window N-1 at angles (or angle ranges) 1404–1406 can indicate a potential spoofing attack. As will be understood, if the RSRP is as… Figure 13 Averaging across all angles, the peak at time window N-1 at 1406 might have been overlooked. However, in Figure 14 In this context, examining RSRP from different angles facilitates more granular detection of spoofing attacks.

[0200] Reference Figure 14In a more detailed example, the wireless node (e.g., gNB or UE) utilizes a temporal sliding window to capture RS-P samples (e.g., DL-PRS or SRS-P samples). The wireless node can then apply one or more DFT codebooks (similar to AoA estimation) to the captured RS-P samples. Here, the wireless node checks not only the consistency of RSRP measurements over time but also their consistency over angle. If RSRP measurements are inconsistent across time and angle, the confidence in spoofing detection may increase compared to evaluating RSRP only relative to time.

[0201] Reference Figures 11-12 In some designs, a wireless node can perform a second RSRP measurement of RS-P based on a second sample set within a second time window following a first time window of RS-P symbols or resources, and a spoofing attack can determine that further measurements can be based on the second RSRP measurement. Regarding Figures 13-14 An example illustrating this situation is where the RSRP(s) at time window N returns to normal relative to the anomalous RSRP(s) at time window N-1. For example, the confidence level associated with determining this spoofing attack could be based on a first difference between a first RSRP measurement and the one or more other RSRP measurements, and a second difference between a second RSRP measurement and the one or more other RSRP measurements. In other words, an RSRP at time window N that is closer to the RSRPs at time windows 1 to N-2 than the RSRPs at time windows 1 to N-1 increases the likelihood of a spoofing attack and also increases the confidence level of the detected spoofing attack.

[0202] Reference Figures 11-12 In some designs, the one or more other RSRP measurements include a single RSRP measurement (e.g., Figures 13-14 In this context, a specific RSRP is used for a specific time window from 1 to N-2 to detect spoofing attacks in time window N-1. In other designs, this one or more other RSRP measurements include an average RSRP measurement based on multiple RSRP measurements (e.g., in...). Figures 13-14 In this process, RSRP averages two or more time windows from time window 1 to N-2 to be used for spoofing attack detection in time window N-1.

[0203] Reference Figures 11-12 In some designs, the measurement report can indicate the confidence level associated with the spoofing attack. In this case, the confidence level can be determined at the wireless node and further shared with communication devices (e.g., a location estimation entity).

[0204] Reference Figures 11-12In some designs, the measurement report may indicate the first RSRP measurement, the one or more other RSRP measurements, or a combination thereof.

[0205] Reference Figures 11-12 In some designs, the first RSRP measurement and the one or more other RSRP measurements are associated with a first angle or a first angle range (e.g., Figure 14 (e.g., 1402, 1404, or 1406 in the original text). In one example, the wireless node may further be associated with at least one additional angle or at least one additional angle range (e.g., different from the first angle or the first angle range) within a first time window based on RS-P symbols or resources. Figure 14 At least one additional RSRP measurement of the RS-P can be performed based on at least one additional sample set associated with 1402, 1404, or 1406 in the RS-P symbol set. In a further example, the spoofing attack determines that it can further perform one or more additional RSRP measurements of the RS-P based on the at least one additional RSRP measurement and one or more other additional sample sets within the one or more earlier time windows of the RS-P symbol or resource. For example, as mentioned above, such as... Figure 14 The inconsistency in the angular granularity of RSRP shown can provide higher accuracy in spoofing attack detection.

[0206] Reference Figures 11-12In some designs, a communication device (e.g., a location estimation entity) can transmit a request to trigger spoofing attack determination. For example, 'normal' spoofing attack determination may be impractical for at least some types of wireless nodes due to high power consumption. Therefore, in some designs, spoofing attack determination can be triggered based on specific triggering criteria. In some designs, the request to trigger spoofing attack determination can further specify the RS-P used for spoofing attack determination, and for one or more other RS-Ps, spoofing attack determination can be bypassed. For example, a wireless node can measure other RS-Ps in a 'normal' manner without acquiring multiple RSRPs across multiple time windows and / or angles. For example, when a communication device (e.g., a location estimation entity) observes some inconsistencies in location measurements or location estimates for a particular wireless node (e.g., a UE), the communication device (e.g., a location estimation entity, such as a location server / gNB) can trigger repeat-based attack detection. The communication device (e.g., a location estimation entity) can also indicate which measurement (e.g., RS-P, etc.) reported by the wireless node (e.g., a UE) is inconsistent. This can help the UE optimize its receiver operation for attack detection. In some designs, requests can be sent from the communication device (e.g., a location estimation entity) to the radio node via downlink control information (DCI), media access control command element (MAC CE), long-term evolution positioning protocol (LPP), or new radio positioning protocol A (NRPPa).

[0207] Reference Figures 11-12 In some designs, this indication is (e.g., as part of a measurement report or separately) transmitted from the radio node to the communication device (e.g., the location estimation entity) entity via uplink control information (UCI), media access control command element (MAC CE), radio resource control (RRC), or long-term evolution positioning protocol (LPP).

[0208] Reference Figures 11-12 In some designs, this indication may be included as part of a measurement report, which may further include a timestamp associated with the first RSRP measurement and / or one or more other RSRP measurements, an identifier associated with the RS-P, an identifier associated with the user equipment (UE) or transmit / receive point (TRP) transmitting the RS-P, or a combination thereof. In some designs, the transmission of the measurement report may be triggered periodically, aperiodically, or semi-persistently. In some designs, attack reports may be given higher priority in uplink transmissions (e.g., in the case where the radio node corresponds to the UE).

[0209] Reference Figure 11-12In some designs, the spoofing attack determination includes identifying the type of spoofing attack. For example, the spoofing attack type may be one of a cyclic prefix (CP) attack, a noise attack, a computational attack, or a sample-by-sample attack. In some designs, if the spoofing attack type is determined, the indication may be further configured to communicate the indication of the spoofing attack type to a communication device (e.g., a location estimation entity).

[0210] Reference Figures 11-12 In some designs, the radio node corresponds to the target UE for which its positioning estimation is desired, and the RS-P corresponds to the PRS or sidelink PRS from a reference UE. In other designs, the radio node corresponds to a base station or a reference UE, and the RS-P corresponds to an uplink probe reference signal (UL-PRS-P) used for positioning.

[0211] In the detailed description above, it can be seen that different features are grouped together in the examples. This manner of disclosure should not be construed as an intention to have more features than those explicitly mentioned in each clause. Rather, aspects of this disclosure may include fewer features than those of the individual example clauses disclosed. Therefore, the appended clauses should thus be considered as incorporated into this description, where each clause may be a separate example. Although each dependent clause may refer in its respective clause to a specific combination with one of the other clauses, the aspects of that dependent clause are not limited to that specific combination. It will be appreciated that other example clauses may also include combinations of aspects of the dependent clause with the subject matter of any other dependent or independent clause, or any feature combined with other dependent and independent clauses. The aspects disclosed herein expressly include these combinations unless explicitly stated or readily inferred that a particular combination is not intended (e.g., contradictory aspects, such as defining an element as both an insulator and a conductor). Furthermore, it is intended that aspects of a clause may be included in any other independent clause, even if that clause is not directly subordinate to that independent clause.

[0212] Examples of implementations are described in the following numbered clauses:

[0213] Clause 1. A method of operating a wireless node, comprising: performing a first reference signal received power (RSRP) measurement of an RS-P based on a first sample set within a first time window of a reference signal (RS-P) symbol or resource for positioning; determining whether a spoofing attack is associated with the RS-P based on the first RSRP measurement and one or more other RSRP measurements of one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource; and transmitting an indication of the determination of the spoofing attack to a communication device.

[0214] Clause 2. The method of Clause 1, wherein the spoofing attack determines the difference between the first RSRP measurement and the one or more other RSRP measurements.

[0215] Clause 3. The method of any of Clauses 1 to 2 further includes: performing a second RSRP measurement of the RS-P based on a second sample set within a second time window following a first time window of the RS-P symbol or resource, wherein the spoofing attack determines to further measure based on the second RSRP measurement.

[0216] Clause 4. The method of any of Clauses 2 to 3, wherein the confidence level associated with the spoofing attack determination is based on a first difference between a first RSRP measurement and the one or more other RSRP measurements and a second difference between a second RSRP measurement and the one or more other RSRP measurements.

[0217] Clause 5. The method of any of Clauses 1 to 4, wherein the one or more other RSRP measurements comprise a single RSRP measurement, or wherein the one or more other RSRP measurements comprise an average RSRP measurement based on a plurality of RSRP measurements.

[0218] Clause 6. The method of any of Clauses 1 to 5, wherein the instruction further indicates the confidence level associated with the determination of the spoofing attack.

[0219] Clause 7. The method of any of Clauses 1 to 6, wherein the instruction further indicates the first RSRP measurement, the one or more other RSRP measurements, or a combination thereof.

[0220] Clause 8. The method of any of Clauses 1 to 7, wherein the first RSRP measurement and the one or more other RSRP measurements are associated with a first angle or a first angle range, the method further comprising: performing at least one additional RSRP measurement of the RS-P based on at least one additional set of samples associated with at least one additional angle or at least one additional angle range different from the first angle or the first angle range within a first time window of the RS-P symbol or resource, wherein the spoofing attack determines one or more other additional RSRP measurements of the RS-P based on the at least one additional RSRP measurement and one or more other additional sets of samples within the one or more earlier time windows of the RS-P symbol or resource.

[0221] Clause 9. The method of any of Clauses 1 to 8 further includes: receiving from the communication device a request for determining the triggering of the spoofing attack.

[0222] Clause 10. The method of Clause 9, wherein the request specifies an RS-P for the spoofing attack determination, and wherein the spoofing attack determination is bypassed for one or more other RS-Ps.

[0223] Clause 11. The method of any of Clauses 9 to 10, wherein the request is received via Downlink Control Message (DCI), Media Access Control Command Element (MAC CE), Long Term Evolution Positioning Protocol (LPP), or New Radio Positioning Protocol A (NRPPa).

[0224] Clause 12. The method of any of Clauses 1 to 11, wherein the transmission of the instruction is triggered periodically, aperiodically, or semi-persistently.

[0225] Clause 13. The method of any of Clauses 1 to 12, wherein the instruction is transmitted via Uplink Control Information (UCI), Media Access Control Command Element (MAC CE), Radio Resource Control (RRC), or Long Term Evolution Positioning Protocol (LPP).

[0226] Clause 14. The method of any of Clauses 1 to 13, wherein the indication is included in a measurement report, the measurement report including a timestamp associated with the first RSRP measurement or the one or more other RSRP measurements or a combination thereof, an identifier associated with the RS-P, an identifier associated with the user equipment (UE) or transmit receiving point (TRP) transmitting the RS-P, or a combination thereof.

[0227] Clause 15. The method of any of Clauses 1 to 14, wherein the spoofing attack determination includes the determination of the type of spoofing attack.

[0228] Clause 16. The method of Clause 15, wherein the spoofing attack type is one of a cyclic prefix (CP) attack, a noise attack, a computational attack, or a sample-by-sample attack.

[0229] Clause 17. The method of any of Clauses 15 to 16, wherein the instruction further includes an instruction on the type of spoofing attack.

[0230] Clause 18. The method of any of Clauses 1 to 17, wherein the radio node corresponds to a target user equipment (UE) for which its positioning estimation is desired, and the RS-P corresponds to a downlink positioning reference signal (PRS) or a sidelink PRS from a reference UE.

[0231] Clause 19. The method of any of Clauses 1 to 18, wherein the radio node corresponds to a base station or reference user equipment (UE), and the RS-P corresponds to an uplink probe reference signal (UL-PRS-P) for positioning.

[0232] Clause 20. A method of operating a communication device, comprising: receiving from a wireless node an indication of a spoofing attack determined in connection with a reference signal (RS-P) for positioning, the indication being at least in part based on a first reference signal received power (RSRP) measurement of the RS-P on a first sample set within a first time window of the RS-P symbol or resource and one or more other RSRP measurements on one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource; and performing at least one action based at least in part on the indication determined by the spoofing attack.

[0233] Clause 21. The method of any of Clauses 21 to 20, wherein the at least one action comprises: determining a location estimate of a target user equipment (UE), or crowdsourcing measurement information from one or more wireless nodes, a spoofing attack determination, or both, or transmitting one or more location scheme recommendations, or a combination thereof, based on the spoofing attack type associated with the spoofing attack determination.

[0234] Clause 22. The method of any of Clauses 20 to 21, wherein the spoofing attack is determined based on the difference between the first RSRP measurement and the one or more other RSRP measurements.

[0235] Clause 23. The method of any of Clauses 20 to 22, wherein the instruction further indicates the confidence level associated with the determination of the spoofing attack.

[0236] Clause 24. The method of any of Clauses 20 to 23, wherein the instruction further indicates the first RSRP measurement, the one or more other RSRP measurements, or a combination thereof.

[0237] Clause 25. The method of any of Clauses 20 to 24, wherein the first RSRP measurement and the one or more other RSRP measurements are associated with a first angle or a first angle range, wherein the spoofing attack determines further based on (i) at least one additional RSRP measurement of the RS-P, the at least one additional RSRP measurement being based on at least one additional set of samples associated with at least one additional angle or at least one additional angle range different from the first angle or the first angle range within a first time window of the RS-P symbol or resource; and (ii) one or more other additional RSRP measurements of the RS-P based on one or more other additional sets of samples within one or more earlier time windows of the RS-P symbol or resource.

[0238] Clause 26. The method of any of Clauses 20 to 25 further includes: transmitting to the wireless node a request for determining whether the spoofing attack has been triggered.

[0239] Clause 27. The method of any of Clauses 25 to 26, wherein the request is transmitted based on the detection of measurement inconsistencies in one or more measurement reports from the wireless node.

[0240] Clause 28. The method of any of Clauses 25 to 27, wherein the request specifies an RS-P for the spoofing attack determination, and wherein the spoofing attack determination is bypassed for one or more other RS-Ps.

[0241] Clause 29. The method of any of Clauses 20 to 28, wherein the transmission of the instruction is triggered periodically, aperiodically, or semi-persistently.

[0242] Clause 30. An apparatus comprising: a memory and at least one processor communicatively coupled to the memory, the memory and the at least one processor being configured to perform a method according to any one of Clauses 1 to 29.

[0243] Clause 31. An apparatus comprising means for performing a method as described in any of Clauses 1 to 29.

[0244] Clause 32. A non-transitory computer-readable medium storing computer-executable instructions, including at least one instruction for causing a computer or processor to perform methods as described in any of Clauses 1 to 29.

[0245] Those skilled in the art will appreciate that information and signals can be represented using any of a variety of different techniques and skills. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referred to throughout the above description can be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or light particles, or any combination thereof.

[0246] Furthermore, those skilled in the art will appreciate that the various illustrative logic blocks, modules, circuits, and algorithmic steps described in connection with the aspects disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps are described above in a generalized manner in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in different ways for each specific application, but such implementation decisions should not be construed as departing from the scope of this disclosure.

[0247] The various illustrative logic blocks, modules, and circuits described in conjunction with the aspects disclosed herein can be implemented or executed using a general-purpose processor, digital signal processor (DSP), ASIC, field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0248] The methods, sequences, and / or algorithms described in conjunction with the aspects disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. The software module may reside in random access memory (RAM), flash memory, read-only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art. Example storage media are coupled to a processor so that the processor can read and write information from / to the storage medium. In alternatives, the storage medium may be integrated into the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal (e.g., a UE). In alternatives, the processor and storage medium may reside as discrete components in the user terminal.

[0249] In one or more examples, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored or transmitted as one or more instructions or codes on or through a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, including any medium that facilitates the transfer of a computer program from one location to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Similarly, any connection is also legitimately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then such coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. As used in this article, disks and discs include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray discs. Disks typically reproduce data magnetically, while discs reproduce data optically using lasers. Combinations of these should also be included within the scope of computer-readable media.

[0250] While the foregoing disclosure has illustrated illustrative aspects of this disclosure, it should be noted that various changes and modifications may be made therein without departing from the scope of this disclosure as defined by the appended claims. The functions, steps, and / or actions in the method claims according to the aspects of this disclosure described herein need not be performed in any particular order. Furthermore, although elements of this disclosure may be described or claimed in the singular, pluralism is also contemplated unless explicitly stated to be limited to the singular.

Claims

1. A method for operating a wireless node, comprising: The first reference signal received power (RSRP) measurement of RS-P is performed based on the first sample set within the first time window of the reference signal RS-P symbol or resource used for positioning. The spoofing attack is determined to be associated with RS-P based on the first RSRP measurement and one or more other RSRP measurements of one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource. as well as The communication device is sent with an indication of the identified spoofing attack.

2. The method of claim 1, wherein the spoofing attack is determined based on the difference between the first RSRP measurement and the one or more other RSRP measurements.

3. The method of claim 1, further comprising: A second RSRP measurement of the RS-P is performed based on a second sample set within a second time window following the first time window of the RS-P symbol or resource. The spoofing attack is further determined based on the second RSRP measurement.

4. The method of claim 2, wherein the confidence level associated with the spoofing attack determination is based on a first difference between the first RSRP measurement and the one or more other RSRP measurements and a second difference between the second RSRP measurement and the one or more other RSRP measurements.

5. The method as described in claim 1, The one or more other RSRP measurements mentioned above include a single RSRP measurement, or The one or more other RSRP measurements mentioned therein include an average RSRP measurement based on multiple RSRP measurements.

6. The method of claim 1, wherein the indication further indicates a confidence level associated with the determination of the spoofing attack.

7. The method of claim 1, wherein the indication further indicates the first RSRP measurement, the one or more other RSRP measurements, or a combination thereof.

8. The method of claim 1, wherein the first RSRP measurement and the one or more other RSRP measurements are associated with a first angle or a first angle range, the method further comprising: At least one additional RSRP measurement of the RS-P is performed based on at least one additional sample set associated with at least one additional angle or at least one additional angle range different from the first angle or the first angle range within the first time window of the RS-P symbol or resource. The spoofing attack is further determined based on the at least one additional RSRP measurement and one or more other additional RSRP measurements of the RS-P within one or more earlier time windows of the RS-P symbol or resource.

9. The method of claim 1, further comprising: Receive a request from the communication device to determine whether to trigger the spoofing attack.

10. The method of claim 9, The request specifies the RS-P used to determine the spoofing attack, and The spoofing attack was determined to be bypassed for one or more other RS-Ps.

11. The method of claim 9, wherein the request is received via downlink control information (DCI), media access control command element (MAC CE), long-term evolution positioning protocol (LPP), or new radio positioning protocol (ANRPPa).

12. The method of claim 1, wherein the transmission of the indication is triggered periodically, aperiodically, or semi-persistently.

13. The method of claim 1, wherein the indication is transmitted via uplink control information (UCI), media access control command element (MAC CE), radio resource control (RRC), or long-term evolution positioning protocol (LPP).

14. The method of claim 1, wherein the indication is included in a measurement report, the measurement report including a timestamp associated with the first RSRP measurement or the one or more other RSRP measurements or a combination thereof, an identifier associated with the RS-P, an identifier associated with the user equipment (UE) or transmit / receive point (TRP) transmitting the RS-P, or a combination thereof.

15. The method of claim 1, wherein the spoofing attack determination includes determining the type of spoofing attack.

16. The method of claim 15, wherein the spoofing attack type is one of a cyclic prefix (CP) attack, a noise attack, a computational attack, or a sample-by-sample attack.

17. The method of claim 15, wherein the indication further includes an indication of the type of spoofing attack.

18. The method of claim 1, wherein the radio node corresponds to a target user equipment (UE) for which its positioning estimation is desired, and the RS-P corresponds to a downlink positioning reference signal (PRS) or a sidelink PRS from a reference UE.

19. The method of claim 1, wherein the wireless node corresponds to a base station or a reference user equipment (UE), and the RS-P corresponds to an uplink probe reference signal UL-PRS-P for positioning.

20. A method of operating a communication device, comprising: Receive from a wireless node an indication of a spoofing attack determined in connection with a reference signal RS-P used for positioning, the indication being at least in part based on a first reference signal received power RSRP measurement of the RS-P on a first sample set within a first time window of the RS-P symbols or resources, and one or more other RSRP measurements on one or more other sample sets within one or more earlier time windows of the RS-P symbols or resources; and At least one action is performed based at least in part on the instructions determined in response to the spoofing attack.

21. The method of claim 20, wherein the at least one action comprises: Determine the location estimation of the target user equipment (UE), or Crowdsourcing measurement information from one or more wireless nodes, identification of spoofing attacks, or both, or Based on the spoofing attack type associated with the spoofing attack, one or more location scheme recommendations are delivered, or Its combination.

22. The method of claim 20, wherein the spoofing attack is determined based on the difference between the first RSRP measurement and the one or more other RSRP measurements.

23. The method of claim 20, wherein the indication further indicates a confidence level associated with the determination of the spoofing attack.

24. The method of claim 20, wherein the indication further indicates the first RSRP measurement, the one or more other RSRP measurements, or a combination thereof.

25. The method of claim 20, The first RSRP measurement and the one or more other RSRP measurements are associated with a first angle or a first angle range. The spoofing attack is further determined based on (i) at least one additional RSRP measurement of the RS-P, the at least one additional RSRP measurement being based on at least one additional sample set associated with at least one additional angle or at least one additional angle range different from the first angle or the first angle range within the first time window of the RS-P symbol or resource; and (ii) one or more other additional RSRP measurements of the RS-P on one or more other additional sample sets within the one or more earlier time windows of the RS-P symbol or resource.

26. The method of claim 20, further comprising: A request to determine whether to trigger the spoofing attack is sent to the wireless node.

27. The method of claim 25, wherein the request is transmitted based on the detection of measurement inconsistencies in one or more measurement reports from the wireless node.

28. The method of claim 20, wherein the transmission of the indication is triggered periodically, aperiodically, or semi-persistently.

29. A wireless node, comprising: Memory; At least one transceiver; as well as At least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: The first reference signal received power RSRP measurement of RS-P is performed by the at least one processor based on a first sample set within a first time window of the reference signal RS-P symbol or resource used for positioning; The at least one processor determines whether a spoofing attack is associated with RS-P based on the first RSRP measurement and one or more other RSRP measurements of one or more other sample sets within one or more earlier time windows of the RS-P symbol or resource. as well as Instructions for identifying the spoofing attack are transmitted to the communication device via the at least one processor, the at least one transceiver, or both.

30. The wireless node of claim 29, wherein the at least one processor is configured to perform the method of any one of claims 2-19.

31. A communication device, comprising: Memory; At least one transceiver; as well as At least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: The at least one processor, the at least one transceiver, or both receive from a wireless node a measurement report including an indication of a spoofing attack associated with a reference signal RS-P used for positioning, the indication being at least in part based on a first reference signal received power (RSRP) measurement of the RS-P on a first sample set within a first time window of the RS-P symbols or resources, and one or more other RSRP measurements on one or more other sample sets within one or more earlier time windows of the RS-P symbols or resources. as well as At least one action is performed via the at least one processor, the at least one transceiver, or both, at least in part based on the instructions determined in response to the spoofing attack.

32. The communication device of claim 31, wherein the at least one processor is configured to perform the method of any one of claims 21-28.

Images