Positioning reference signal spoofing detection and mitigation

Abstract

Techniques for wireless communications are disclosed. In an aspect, a user equipment (UE) can obtain a set of one or more beam profiles, where each beam profile in the set of one or more beam profiles comprises a beam profile of a legitimate positioning reference signal (PRS) beam. The UE can determine a beam profile of a received PRS beam. The UE can determine a legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam to the set of one or more beam profiles from legitimate PRS beams.

Description

[0001] Public background

[0002] 1. Public domain

[0003] The various aspects of this disclosure generally relate to wireless communications.

[0004] 2. Relevant Technical Descriptions

[0005] Wireless communication systems have undergone several generations of development, including first-generation analog radiotelephone service (1G), second-generation (2G) digital radiotelephone service (including transitional 2.5G and 2.75G networks), third-generation (3G) high-speed data radio service with Internet capabilities, and fourth-generation (4G) service (e.g., Long Term Evolution (LTE) or WiMax). Currently, many different types of wireless communication systems are in use, including cellular and Personal Communication Services (PCS) systems. Known examples of cellular systems include cellular analog Advanced Mobile Phone Systems (AMPS), and digital cellular systems based on Code Division Multiple Access (CDMA), Frequency Division Multiple Access (FDMA), Time Division Multiple Access (TDMA), Global System for Mobile Communications (GSM), etc.

[0006] The fifth-generation (5G) wireless standard (known as New Radio (NR)) demands higher data transmission speeds, a greater number of connections, better coverage, and other improvements. According to the Next Generation Mobile Networks Alliance (NGC), the 5G standard is designed to provide tens of megabits per second (Mbps) of data rate to each of tens of thousands of users, and 1 gigabits per second (Gbps) to dozens of employees on an office floor. It should support hundreds of thousands of simultaneous connections to support large-scale sensor deployments. Therefore, 5G mobile communication should have significantly improved spectral efficiency compared to the current 4G standard. Furthermore, signaling efficiency should be improved and latency significantly reduced compared to the current standard.

[0007] Overview

[0008] The following is a simplified overview relating to one or more aspects disclosed herein. Therefore, this overview should not be considered an exhaustive overview relating to all aspects of the conception, nor should it be considered to identify key or decisive elements relating to all aspects of the conception or to depict the scope associated with any particular aspect. Accordingly, the sole purpose of the following overview is to present, in a simplified form, certain concepts relating to one or more aspects of the mechanism disclosed herein before the detailed description given below.

[0009] In one aspect, a wireless communication method includes: obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate Positioning Reference Signal (PRS) beam; determining a beam profile of a received PRS beam; and determining the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with the set of one or more beam profiles from legitimate PRS beams.

[0010] In one aspect, a wireless communication method includes: determining a beam profile of a received Position Reference Signal (PRS) beam; transmitting the beam profile to a network entity; and receiving from the network entity an indication as to whether the PRS beam is legitimate or illegitimate.

[0011] In one aspect, a wireless communication method includes: obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate Positioning Reference Signal (PRS) beam; receiving from a first user equipment (UE) a beam profile of a first PRS beam received by the UE; determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and sending an indication of the legitimacy of the first PRS beam to the UE.

[0012] In one aspect, a wireless communication method includes: obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate Positioning Reference Signal (PRS) beam; receiving from a first user equipment (UE) a measurement of a first PRS beam received by the UE; determining a beam profile of the first PRS beam based on the measurement of the first PRS beam; determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and sending an indication of the legitimacy of the first PRS beam to the UE.

[0013] In one aspect, a user equipment (UE) includes: a memory; at least one transceiver; and at least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: obtain a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate Positioning Reference Signal (PRS) beam; determine a beam profile of a received PRS beam; and determine the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with the set of one or more beam profiles from legitimate PRS beams.

[0014] In one aspect, a user equipment (UE) includes: a memory; at least one transceiver; and at least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: determine a beam profile of a received Position Reference Signal (PRS) beam; cause the at least one transceiver to transmit the beam profile to a network entity; and receive, via the at least one transceiver, an indication from the network entity regarding whether the PRS beam is legitimate or illegitimate.

[0015] In one aspect, a network entity includes: a memory; at least one transceiver; and at least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: obtain a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate Position Reference Signal (PRS) beam; receive, via the at least one transceiver, a beam profile of a first PRS beam received by the UE; determine the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from legitimate PRS beams; and cause the at least one transceiver to send an indication of the legitimacy of the first PRS beam to the UE.

[0016] In one aspect, a network entity includes: a memory; at least one transceiver; and at least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: obtain a set of one or more beam profiles, wherein each of the set of one or more beam profiles includes a beam profile of a legitimate Position Reference Signal (PRS) beam; receive, via the at least one transceiver, a measurement of a first PRS beam received by the UE from a first user equipment (UE); determine a beam profile of the first PRS beam based on the measurement of the first PRS beam; determine the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and cause the at least one transceiver to send an indication of the legitimacy of the first PRS beam to the UE.

[0017] In one aspect, a user equipment (UE) includes: means for obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate positioning reference signal (PRS) beam; means for determining a beam profile of a received PRS beam; and means for determining the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with the set of one or more beam profiles from legitimate PRS beams.

[0018] In one aspect, a user equipment (UE) includes: means for determining a beam profile of a received positioning reference signal (PRS) beam; means for transmitting the beam profile to a network entity; and means for receiving an indication from the network entity as to whether the PRS beam is legitimate or illegitimate.

[0019] In one aspect, a network entity includes: means for obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate Position Reference Signal (PRS) beam; means for receiving from a first user equipment (UE) a beam profile of a first PRS beam received by the UE; means for determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and means for sending an indication of the legitimacy of the first PRS beam to the UE.

[0020] In one aspect, a network entity includes: means for obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate Position Reference Signal (PRS) beam; means for receiving from a first user equipment (UE) a measurement of a first PRS beam received by the UE; means for determining a beam profile of the first PRS beam based on the measurement of the first PRS beam; means for determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and means for sending an indication of the legitimacy of the first PRS beam to the UE.

[0021] In one aspect, a non-transient computer-readable medium storing computer-executable instructions that, when executed by a user equipment (UE), cause the UE to: obtain a set of one or more beam profiles, wherein each of the set of one or more beam profiles includes a beam profile of a legitimate Positioning Reference Signal (PRS) beam; determine a beam profile of a received PRS beam; and determine the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with the set of one or more beam profiles from a legitimate PRS beam.

[0022] In one aspect, a non-transient computer-readable medium storing computer-executable instructions that, when executed by a UE, cause the UE to: determine a beam profile of a received Position Reference Signal (PRS) beam; transmit the beam profile to a network entity; and receive from the network entity an indication as to whether the PRS beam is legitimate or illegitimate.

[0023] In one aspect, a non-transient computer-readable medium storing computer-executable instructions that, when executed by a network entity, cause the network entity to perform: obtaining a set of one or more beam profiles, wherein each of the set of one or more beam profiles includes a beam profile of a legitimate Positioning Reference Signal (PRS) beam; receiving from a first user equipment (UE) a beam profile of a first PRS beam received by the UE; determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and sending an indication of the legitimacy of the first PRS beam to the UE.

[0024] In one aspect, a non-transient computer-readable medium storing computer-executable instructions that, when executed by a network entity, cause the network entity to perform: obtaining a set of one or more beam profiles, wherein each of the set of one or more beam profiles includes a beam profile of a legitimate Positioning Reference Signal (PRS) beam; receiving from a first user equipment (UE) a measurement of a first PRS beam received by the UE; determining a beam profile of the first PRS beam based on the measurement of the first PRS beam; determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and sending an indication of the legitimacy of the first PRS beam to the UE.

[0025] Other objectives and advantages associated with the aspects disclosed herein will be apparent to those skilled in the art based on the accompanying drawings and detailed description. Brief description of the attached diagram

[0027] The accompanying drawings are provided to help describe various aspects of this disclosure, and the drawings are provided for illustrative purposes only and not for limiting the aspects.

[0028] Figure 1 Example wireless communication systems based on various aspects of this disclosure are explained.

[0029] Figure 2A and 2B Example wireless network architectures based on various aspects of this disclosure are explained.

[0030] Figure 3A , 3B The 3C and 3C are simplified block diagrams of several sample aspects of components that can be adopted in user equipment (UE), base stations, and network entities and configured to support communications as taught herein.

[0031] Figures 4A to 4D This is a diagram illustrating example frame structures and channels within these frame structures according to various aspects of this disclosure.

[0032] Figure 5 This is a diagram illustrating the communication between an example base station and an example UE according to various aspects of this disclosure.

[0033] Figure 6 The explanation of Position Reference Signal (PRS) spoofing.

[0034] Figures 7-10 This is a flowchart of an example process associated with PRS spoofing detection and mitigation based on various aspects of this disclosure.

[0035] Detailed description

[0036] Various aspects of this disclosure are provided below in the description and accompanying drawings of various examples provided for illustrative purposes. Alternative aspects may be designed without departing from the scope of this disclosure. Furthermore, elements well-known in this disclosure will not be described in detail or will be omitted so as not to obscure the relevant details of this disclosure.

[0037] The terms “exemplary” and / or “example” are used herein to mean “serving as an example, instance, or illustration.” Any aspect described herein as “exemplary” and / or “example” is not necessarily to be construed as superior to or better than the others. Similarly, the term “aspects of this disclosure” does not require that all aspects of this disclosure include the features, advantages, or modes of operation discussed.

[0038] Those skilled in the art will appreciate that the information and signals described below can be represented using any of a variety of different techniques and arts. For example, the data, instructions, commands, information, signals, bits, symbols, and chips that may be referred to throughout the following description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or optical particles, or any combination thereof, depending in part on the specific application, in part on the desired design, in part on the corresponding technology, etc.

[0039] Furthermore, many aspects are described in the form of sequences of actions performed by elements of, for example, computing devices. It will be appreciated that the various actions described herein can be performed by special-purpose circuitry (e.g., application-specific integrated circuits (ASICs)), by program instructions being executed by one or more processors, or by a combination of both. Additionally, the sequences of actions described herein can be considered to be fully embodied in any form of non-transient computer-readable storage medium storing a corresponding set of computer instructions that, upon execution, will cause an associated processor of the device to perform the functions described herein. Thus, various aspects of this disclosure can be embodied in several different forms, all of which are contemplated to fall within the scope of the claimed subject matter. Furthermore, for each aspect described herein, a corresponding form of any such aspect may be described herein as, for example, "logic configured to perform the described actions."

[0040] As used herein, the terms “User Equipment” (UE) and “Base Station” are not intended to be specific to or otherwise limited to any particular Radio Access Technology (RAT) unless otherwise stated. Generally, a UE can be any wireless communication device used by a user to communicate over a wireless communication network (e.g., mobile phone, router, tablet computer, laptop computer, consumer asset positioning device, wearable device (e.g., smartwatch, glasses, augmented reality (AR) / virtual reality (VR) headset, etc.), vehicle (e.g., car, motorcycle, bicycle, etc.), Internet of Things (IoT) device, etc.). A UE can be mobile or can (e.g., at certain times) be stationary and can communicate with a Radio Access Network (RAN). As used herein, the term “UE” can be interchangeably referred to as “Access Terminal” or “AT”, “Client Equipment”, “Wireless Equipment”, “Subscriber Equipment”, “Subscriber Terminal”, “Subscriber Station”, “User Terminal” or “UT”, “Mobile Equipment”, “Mobile Terminal”, “Mobile Station”, or variations thereof. Generally, a UE can communicate with the core network via the RAN, and through the core network, the UE can connect to external networks (such as the Internet) and other UEs. Of course, other mechanisms for connecting to the core network and / or the Internet are also possible for the UE, such as through a wired access network, a wireless local area network (WLAN) (e.g., based on the IEEE 802.11 standard), and so on.

[0041] A base station may operate according to one of several RATs to communicate with a UE, depending on the network in which it is deployed, and may be alternatively referred to as an Access Point (AP), Network Node, B-Node, Evolved B-Node (eNB), Next Generation eNB (ng-eNB), New Radio (NR) B-Node (also referred to as gNB or gNodeB), etc. A base station may primarily be used to support radio access by the UE, including supporting data, voice, and / or signaling connections with the supported UE. In some systems, the base station may provide purely edge node signaling functions, while in others, it may provide additional control and / or network management functions. The communication link through which the UE can signal to the base station is called an uplink (UL) channel (e.g., reverse traffic channel, reverse control channel, access channel, etc.). The communication link through which the base station can signal to the UE is called a downlink (DL) or forward link channel (e.g., paging channel, control channel, broadcast channel, forward traffic channel, etc.). As used herein, the term traffic channel (TCH) may refer to an uplink / reverse traffic channel or a downlink / forward traffic channel.

[0042] The term "base station" can refer to a single physical transmit / receive point (TRP) or multiple physical TRPs that may or may not be co-located. For example, when the term "base station" refers to a single physical TRP, the physical TRP may be a base station antenna corresponding to a cell (or several cell sectors) of the base station. When the term "base station" refers to multiple co-located physical TRPs, the physical TRP may be an antenna array of the base station (e.g., as in a multiple-input multiple-output (MIMO) system or where the base station employs beamforming). When the term "base station" refers to multiple non-co-located physical TRPs, the physical TRP may be a distributed antenna system (DAS) (a network of spatially separated antennas connected via a transmission medium to a shared source) or a remote radio headend (RRH) (a remote base station connected to a serving base station). Alternatively, non-co-located physical TRPs may be the serving base station from which the UE receives measurement reports and neighboring base stations where the UE is measuring its reference radio frequency (RF) signal. Since a TRP is the point from which a base station transmits and receives wireless signals, as used herein, references to transmissions from or receptions at a base station should be understood as references to the specific TRP of that base station.

[0043] In some implementations that support UE positioning, the base station may not support the UE's radio access (e.g., it may not support data, voice, and / or signaling connections regarding the UE), but may instead transmit reference signals to the UE for measurement, and / or receive and measure signals transmitted by the UE. Such a base station may be referred to as a positioning tower (e.g., in the case of transmitting signals to the UE) and / or as a location measurement unit (e.g., in the case of receiving and measuring signals from the UE).

[0044] "RF signal" refers to electromagnetic waves of a given frequency that transmit information across the space between a transmitter and a receiver. As used herein, a transmitter may transmit a single "RF signal" or multiple "RF signals" to a receiver. However, due to the propagation characteristics of RF signals through multipath channels, a receiver may receive multiple "RF signals" corresponding to each transmitted RF signal. The same RF signal transmitted on different paths between the transmitter and receiver can be referred to as a "multipath" RF signal. As used herein, RF signals may also be referred to as "wireless signals" or simply "signals," where the context clearly indicates that the term "signal" refers to a wireless signal or an RF signal.

[0045] Figure 1An example wireless communication system 100 according to various aspects of this disclosure is described. The wireless communication system 100 (which may also be referred to as a wireless wide area network (WWAN)) may include various base stations 102 (labeled "BS") and various UEs 104. Base station 102 may include macrocell base stations (high-power cellular base stations) and / or small cell base stations (low-power cellular base stations). In one aspect, the macrocell base station may include an eNB and / or an ng-eNB (where the wireless communication system 100 corresponds to an LTE network), or a gNB (where the wireless communication system 100 corresponds to an NR network), or a combination of both, and the small cell base station may include femtocells, picocells, microcells, etc.

[0046] Each base station 102 can collectively form a RAN and interface with the core network 170 (e.g., an evolved packet core (EPC) or a 5G core (5GC)) via a backhaul link 122, and access one or more location servers 172 (e.g., location management function (LMF) or secure user plane positioning (SUPL) location platform (SLP)) via the core network 170. The location servers 172 can be part of the core network 170 or located outside the core network 170. Among other functions, the base station 102 can also perform functions related to one or more of the following: transmitting user data, radio channel cryptography and decoding, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection establishment and release, load balancing, distribution of non-access stratum (NAS) messages, NAS node selection, synchronization, RAN sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment tracking, RAN information management (RIM), paging, location, and delivery of alarm messages. Base stations 102 can communicate with each other directly or indirectly (e.g., via EPC / 5GC) through backhaul link 134 (which can be wired or wireless).

[0047] Base station 102 can wirelessly communicate with UE 104. Each base station 102 can provide communication coverage for a corresponding geographic coverage area 110. In one aspect, one or more cells can be supported by base station 102 in each geographic coverage area 110. A “cell” is a logical communication entity used to communicate with a base station (e.g., on a frequency resource, it is referred to as a carrier frequency, component carrier, carrier, frequency band, etc.) and can be associated with an identifier (e.g., Physical Cell Identifier (PCI), Enhanced Cell Identifier (ECI), Virtual Cell Identifier (VCI), Cell Global Identifier (CGI), etc.) to distinguish cells operating via the same or different carrier frequencies. In some cases, different cells can be configured according to different protocol types that can provide access to different types of UEs (e.g., Machine Type Communication (MTC), Narrowband IoT (NB-IoT), Enhanced Mobile Broadband (eMBB), or others). Since cells are supported by specific base stations, the term “cell” can refer to either or both of the logical communication entity and the base station supporting that logical communication entity, depending on the context. Additionally, since the TRP is typically the physical transmission point of a cell, the terms "cell" and "TRP" are used interchangeably. In some cases, the term "cell" can also refer to the geographical coverage area (e.g., sector) of a base station, in the sense that the carrier frequency can be detected and used for communication within a portion of a geographical coverage area 110.

[0048] While the geographic coverage areas 110 of adjacent macrocell base stations 102 may partially overlap (e.g., in handover areas), some geographic coverage areas 110 may substantially overlap with larger geographic coverage areas 110. For example, a small cell base station 102' ("SC" labeled "small cell") may have geographic coverage areas 110' that substantially overlap with the geographic coverage areas 110 of one or more macrocell base stations 102. A network that includes both small cell and macrocell base stations may be referred to as a heterogeneous network. A heterogeneous network may also include home eNBs (HeNBs) that provide service to a restricted group known as a Closed Subscriber Group (CSG).

[0049] The communication link 120 between base station 102 and UE 104 may include uplink (also known as reverse link) transmission from UE 104 to base station 102 and / or downlink (DL) (also known as forward link) transmission from base station 102 to UE 104. The communication link 120 may use MIMO antenna technologies, including spatial multiplexing, beamforming, and / or transmit diversity. The communication link 120 may use one or more carrier frequencies. Carrier allocation may be asymmetric with respect to the downlink and uplink (e.g., more or fewer carriers may be allocated to the downlink compared to the uplink).

[0050] The wireless communication system 100 may further include a wireless local area network (WLAN) access point (AP) 150 communicating with a WLAN station (STA) 152 via a communication link 154 in unlicensed spectrum (e.g., 5 GHz). When communicating in unlicensed spectrum, the WLAN STA 152 and / or WLAN AP 150 may perform a clear channel assessment (CCA) or listen-before-speak (LBT) procedure to determine channel availability before communication.

[0051] Small cell base station 102' can operate in licensed and / or unlicensed spectrum. When operating in unlicensed spectrum, small cell base station 102' can employ LTE or NR technology and use the same 5 GHz unlicensed spectrum as used by WLAN AP 150. Small cell base station 102' employing LTE / 5G in unlicensed spectrum can enhance access network coverage and / or increase access network capacity. NR in unlicensed spectrum may be referred to as NR-U. LTE in unlicensed spectrum may be referred to as LTE-U, Licensed Assisted Access (LAA), or MulteFire.

[0052] The wireless communication system 100 may further include a millimeter-wave (mmW) base station 180, which can operate in mmW and / or near-mmW frequencies to communicate with the UE 182. Extremely high frequency (EHF) is a portion of the electromagnetic spectrum that contains radio frequency (RF). EHF has a range of 30 GHz to 300 GHz and wavelengths between 1 mm and 10 mm. Radio waves in this band are referred to as millimeter waves. Near-mmW extends down to a 3 GHz frequency with a 100 mm wavelength. Ultra-high frequency (SHF) bands extend between 3 GHz and 30 GHz, and are also referred to as centimeter waves. Communication using mmW / near-mmW RF bands has high path loss and relatively short range. The mmW base station 180 and the UE 182 can utilize beamforming (transmit and / or receive) on the mmW communication link 184 to compensate for the extremely high path loss and short range. Furthermore, it will be appreciated that in alternative configurations, one or more base stations 102 may also use mmW or near-mmW and beamforming for transmission. Accordingly, it will be understood that the foregoing explanations are merely illustrative and should not be construed as limiting the aspects disclosed herein.

[0053] Transmit beamforming is a technique for focusing RF signals in a specific direction. Conventionally, when a network node (e.g., a base station) broadcasts an RF signal, it broadcasts the signal in all directions (omnidirectionally). Using transmit beamforming, the network node determines where a given target device (e.g., a UE) is located (relative to the transmitting network node) and projects a stronger downlink RF signal in that specific direction, thus providing the receiving device with a faster (in terms of data rate) and stronger RF signal. To change the directivity of the RF signal during transmission, the network node can control the phase and relative amplitude of the RF signal at each of one or more transmitters broadcasting the RF signal. For example, the network node can use an antenna array (referred to as a "phased array" or "antenna array") that generates a beam of RF waves, which can be "guided" to different directions without actually moving the antennas. Specifically, RF currents from the transmitters are fed to the individual antennas with the correct phase relationship so that radio waves from the separate antennas add together in the desired direction to increase radiation, while simultaneously canceling each other out in the undesired direction to suppress radiation.

[0054] Transmit beams can be quasi-co-located, meaning they appear to the receiver (e.g., UE) with identical parameters, regardless of whether the network node's transmit antennas are physically co-located. In NR, there are four types of quasi-co-location (QCL) relationships. Specifically, a given type of QCL relationship means that certain parameters of the second reference RF signal on the second beam can be derived from information about the source reference RF signal on the source beam. Thus, if the source reference RF signal is QCL type A, the receiver can use the source reference RF signal to estimate the Doppler shift, Doppler spread, average delay, and delay spread of the second reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type B, the receiver can use the source reference RF signal to estimate the Doppler shift and Doppler spread of the second reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type C, the receiver can use the source reference RF signal to estimate the Doppler shift and average delay of the second reference RF signal transmitted on the same channel. If the source reference RF signal is of type QCL D, the receiver can use the source reference RF signal to estimate the spatial reception parameters of the second reference RF signal transmitted on the same channel.

[0055] In receive beamforming, a receiver uses a receive beam to amplify an RF signal detected on a given channel. For example, a receiver may increase the gain setting of an antenna array and / or adjust the phase setting of the antenna array in a specific direction to amplify the RF signal received from that direction (e.g., increase its gain level). Thus, when a receiver is referred to as beamforming in a certain direction, it means that the beam gain in that direction is higher than the beam gain in other directions, or that the beam gain in that direction is the highest compared to the beam gain of all other receive beams available to the receiver in that direction. This results in a stronger received signal strength (e.g., Reference Signal Received Power (RSRP), Reference Signal Received Quality (RSRQ), Signal-to-Interference-plus-Noise Ratio (SINR), etc.) of the RF signal received from that direction.

[0056] The transmit and receive beams can be spatially correlated. Spatial correlation means that the parameters of the second beam (e.g., the transmit or receive beam) used for the second reference signal can be derived from information about the first beam (e.g., the receive or transmit beam) of the first reference signal. For example, a UE can use a specific receive beam to receive a reference downlink reference signal (e.g., a synchronization signal block (SSB)) from a base station. The UE can then form a transmit beam based on the parameters of the receive beam to transmit an uplink reference signal (e.g., a probe reference signal (SRS)) to that base station.

[0057] Note that, depending on the entity forming the "downlink" beam, the beam can be either a transmit beam or a receive beam. For example, if a base station is forming a downlink beam to transmit a reference signal to a UE, then the downlink beam is a transmit beam. However, if a UE is forming a downlink beam, then the downlink beam is a receive beam for receiving downlink reference signals. Similarly, depending on the entity forming the "uplink" beam, the beam can be either a transmit beam or a receive beam. For example, if a base station is forming an uplink beam, then the uplink beam is an uplink receive beam, while if a UE is forming an uplink beam, then the uplink beam is an uplink transmit beam.

[0058] In 5G, the spectrum in which wireless nodes (e.g., base stations 102 / 180, UEs 104 / 182) operate is divided into several frequency ranges: FR1 (from 450 to 6000 MHz), FR2 (from 24250 to 52600 MHz), FR3 (above 52600 MHz), and FR4 (between FR1 and FR2). The mmW band generally includes the FR2, FR3, and FR4 frequency ranges. Thus, the terms "mmW" and "FR2" or "FR3" or "FR4" are generally used interchangeably.

[0059] In multi-carrier systems (such as 5G), one of the carrier frequencies is referred to as the "primary carrier," "anchor carrier," "primary serving cell," or "PCell," and the remaining carrier frequencies are referred to as "secondary carriers," "secondary serving cells," or "SCell." In carrier aggregation, the anchor carrier is a carrier operating on the primary frequency (e.g., FR1) utilized by UE 104 / 182 and on the cell in which UE 104 / 182 performs an initial radio resource control (RRC) connection establishment procedure or initiates an RRC connection re-establishment procedure. The primary carrier carries all shared control channels as well as control channels that vary from UE to UE, and can be a carrier on a licensed frequency (however, this is not always the case). The secondary carrier is a carrier operating on a second frequency (e.g., FR2), which can be configured once an RRC connection is established between UE 104 and the anchor carrier, and can be used to provide additional radio resources. In some cases, the secondary carrier can be a carrier on an unlicensed frequency. Secondary carriers may contain only necessary signaling information and signals. For example, signaling information and signals that vary from UE to UE may not be present in the secondary carrier, since both the primary uplink and downlink carriers are typically UE-specific. This means that different UEs 104 / 182 within a cell can have different downlink primary carriers. The same applies to the uplink primary carrier. The network can change the primary carrier of any UE 104 / 182 at any time. For example, this is done to balance the load on different carriers. Since a “serving cell” (whether PCell or SCell) corresponds to the carrier frequency / component carrier that a base station is using for communication, the terms “cell,” “serving cell,” “component carrier,” “carrier frequency,” etc., can be used interchangeably.

[0060] For example, still refer to Figure 1 One of the frequencies utilized by the macrocell base station 102 can be an anchor carrier (or "PCell"), and other frequencies utilized by the macrocell base station 102 and / or mmW base station 180 can be secondary carriers ("SCell"). Simultaneous transmission and / or reception on multiple carriers allows the UE 104 / 182 to significantly increase its data transmission and / or reception rates. For example, two 20MHz aggregated carriers in a multi-carrier system would theoretically result in twice the data rate (i.e., 40MHz) compared to the data rate obtained from a single 20MHz carrier.

[0061] The wireless communication system 100 may further include a UE 164, which can communicate with the macrocell base station 102 on the communication link 120 and / or with the mmW base station 180 on the mmW communication link 184. For example, the macrocell base station 102 may support PCell and one or more SCells for the UE 164, and the mmW base station 180 may support one or more SCells for the UE 164.

[0062] exist Figure 1 In the example, one or more Earth-orbiting Satellite Positioning System (SPS) spacecraft (SV) 112 (e.g., satellites) can be used as any of the explained UEs (for simplicity, in...). Figure 1 The location information of a single UE 104 is a separate source. UE 104 may include one or more dedicated SPS receivers specifically designed to receive SPS signal 124 from SV 112 to derive geographic location information. The SPS typically includes a transmitter system (e.g., SV 112) positioned such that receivers (e.g., UE 104) can determine their location on or above the earth based at least in part on signals received from the transmitter (e.g., SPS signal 124). Such transmitters typically transmit signals marked with a set number of repeating pseudo-random noise (PN) codes. While transmitters are typically located in SV 112, they may sometimes be located at a terrestrial control station, base station 102, and / or other UE 104.

[0063] The use of SPS signal 124 can be amplified by various satellite-based augmentation systems (SBAS), which may be associated with or otherwise enabled to be used in conjunction with one or more global and / or regional navigation satellite systems. For example, SBAS may include augmentation systems that provide integrity information, differential correction, etc., such as Wide Area Augmentation System (WAAS), European Geostationary Navigation Coverage Service (EGNOS), Multifunctional Satellite Augmentation System (MSAS), GPS-assisted Geographic Augmentation Navigation or GPS and Geographic Augmentation Navigation System (GAGAN), etc. Thus, as used herein, SPS may include any combination of one or more global and / or regional navigation satellite systems and / or augmentation systems, and SPS signal 124 may include SPS, SPS-like systems, and / or other signals associated with one or more such SPS.

[0064] The wireless communication system 100 may further include one or more UEs (such as UE 190) that are indirectly connected to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links (referred to as “side links”). Figure 1 In the example, UE 190 has a D2D P2P link 192 with a UE 104 connected to a base station 102 (e.g., through which UE 190 indirectly obtains cellular connectivity), and a D2D P2P link 194 with a WLANSTA 152 connected to a WLAN AP 150 (through which UE 190 indirectly obtains WLAN-based Internet connectivity). In one example, D2D P2P links 192 and 194 can use any known D2D RAT (such as LTE Direct (LTE-D), WiFi Direct (WiFi-D)). (etc.) to support.

[0065] Figure 2A Example wireless network architecture 200 is explained. For example, 5GC 210 (also known as Next Generation Core (NGC)) can be functionally considered as control plane (C-plane) functions 214 (e.g., UE registration, authentication, network access, gateway selection, etc.) and user plane (U-plane) functions 212 (e.g., UE gateway functions, access to data networks, IP routing, etc.), which operate collaboratively to form the core network. User plane interface (NG-U) 213 and control plane interface (NG-C) 215 connect gNB 222 to 5GC 210, specifically to user plane function 212 and control plane function 214, respectively. In an additional configuration, ng-eNB 224 can also connect to 5GC 210 via NG-C 215 to control plane function 214 and NG-U 213 to user plane function 212. Furthermore, ng-eNB 224 can communicate directly with gNB 222 via backhaul connection 223. In some configurations, the next-generation RAN (NG-RAN) 220 may have one or more gNBs 222, while other configurations include one or more ng-eNBs 224 and one or more gNBs 222. The gNB 222 or ng-eNB 224 (or both) may communicate with one or more UEs 204 (e.g., any UE described herein).

[0066] Another optional aspect may include location server 230, which can communicate with 5GC 210 to provide location assistance to UE 204. Location server 230 may be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules extending across multiple physical servers, etc.), or alternatively, each may correspond to a single server. Location server 230 may be configured to support one or more location services for UE 204, which UE 204 can connect to via the core network, 5GC 210, and / or via the Internet (not explained). Furthermore, location server 230 may be integrated into a component of the core network, or alternatively, it may be external to the core network (e.g., a third-party server, such as an original equipment manufacturer (OEM) server or a business server).

[0067] Figure 2B Another example wireless network architecture, 250.5GC 260, was explained (which can correspond to...). Figure 2AThe 5GC 210 in the document can be functionally viewed as a control plane function (provided by the Access and Mobility Management Function (AMF) 264) and a user plane function (provided by the User Plane Function (UPF) 262), which operate collaboratively to form the core network (i.e., 5GC 260). The functions of AMF 264 include registration management, connection management, reachability management, mobility management, lawful interception, session management (SM) message transmission between one or more UEs 204 (e.g., any UE described herein) and session management function (SMF) 266, transparent proxy service for routing SM messages, access authentication and access authorization, short message service (SMS) message transmission between UE 204 and short message service function (SMSF) (not shown), and security anchor functionality (SEAF). AMF 264 also interacts with the authentication server function (AUSF) (not shown) and UE 204, and receives an intermediate key established as a result of the UE 204 authentication process. In cases where authentication is based on the UMTS (Universal Mobile Telecommunications System) Subscriber Identity Module (USIM), the AMF 264 retrieves security material from the AMF. The AMF 264 also includes Security Context Management (SCM). The SCM receives a key from the SEAF, which it uses to derive a key that varies depending on the access network. The AMF 264's functionality also includes: location service management for regulatory services, location service message transmission between the UE 204 and the Location Management Function (LMF) 270 (which acts as a location server 230), location service message transmission between the NG-RAN 220 and the LMF 270, EPS bearer identifier allocation for interoperability with the Evolved Packet System (EPS), and UE 204 mobility event notification. Additionally, the AMF 264 supports functionality for non-3GPP (3rd Generation Partnership Project) access networks.

[0068] The functions of UPF 262 include: acting as an anchor point for intra / inter-RAT mobility (where applicable), acting as an external Protocol Data Unit (PDU) session point interconnecting to a data network (not shown), providing packet routing and forwarding, packet inspection, user plane policy rule enforcement (e.g., strobing, redirection, traffic steering), lawful interception (user plane collection), traffic usage reporting, quality of service (QoS) handling for the user plane (e.g., uplink / downlink rate enforcement, reflective QoS marking in the downlink), uplink traffic verification (Service Data Flow (SDF) to QoS flow mapping), transport-level packet marking in the uplink and downlink, downlink packet buffering and downlink data notification triggering, and sending and forwarding one or more "end markers" to the source RAN node. UPF 262 may also support the transmission of location service messages between UE 204 and a location server (such as SLP 272) on the user plane.

[0069] The functions of SMF 266 include session management, UE Internet Protocol (IP) address allocation and management, selection and control of user plane functions, traffic bootstrapping configuration at UPF 262 for routing traffic to the correct destination, partial control of policy enforcement and QoS, and downlink data notification. The interface used by SMF 266 to communicate with AMF 264 is called the N11 interface.

[0070] Another optional aspect may include LMF 270, which can communicate with 5GC 260 to provide location assistance to UE 204. LMF 270 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules extending across multiple physical servers, etc.), or alternatively, each may correspond to a single server. LMF 270 can be configured to support one or more location services for UE 204, which can connect to LMF 270 via the core network, 5GC 260, and / or via the Internet (not explained). SLP 272 supports similar functionality to LMF 270, but while LMF 270 can communicate with AMF 264, NG-RAN 220, and UE 204 on the control plane (e.g., using interfaces and protocols designed to convey signaling messages but not voice or data), SLP 272 can communicate with UE 204 and external clients on the user plane (e.g., using protocols designed to carry voice and / or data, such as Transmission Control Protocol (TCP) and / or IP). Figure 2B (Not shown in the image) Communication.

[0071] User plane interface 263 and control plane interface 265 connect 5GC 260 (and in particular UPF 262 and AMF 264, respectively) to one or more gNB 222 and / or ng-eNB 224 in NG-RAN 220. The interface between gNB 222 and / or ng-eNB 224 and AMF 264 is referred to as the "N2" interface, while the interface between gNB 222 and / or ng-eNB 224 and UPF 262 is referred to as the "N3" interface. The gNB 222 and / or ng-eNB 224 of NG-RAN 220 can communicate directly with each other via backhaul connection 223, which is referred to as the "Xn-C" interface. One or more of gNB 222 and / or ng-eNB 224 can communicate with one or more UEs 204 on a radio interface, which is referred to as the "Uu" interface.

[0072] Figure 3A , 3BThe explanation of 3C includes UE 302 (which may correspond to any UE described herein), base station 304 (which may correspond to any base station described herein), and network entity 306 (which may correspond to or embody any network function described herein, including location server 230 and LMF 270, or alternatively may be independent of UE 302). Figure 2A and 2B Several example components (represented by corresponding boxes) in the NG-RAN 220 and / or 5GC 210 / 260 infrastructure (such as private networks) depicted herein support file transfer operations as taught herein. It will be appreciated that these components may be implemented in different types of devices (e.g., in ASICs, in System-on-Chip (SoCs), etc.) in different implementations. The illustrated components may also be incorporated into other devices in a communication system. For example, other devices in the system may include components similar to those described to provide similar functionality. Furthermore, a given device may include one or more of these components. For example, a device may include multiple transceiver components that enable the device to operate on multiple carriers and / or communicate via different technologies.

[0073] UE 302 and base station 304 each include one or more wireless wide area network (WWAN) transceivers 310 and 350, respectively, to provide means (e.g., means for transmitting, means for receiving, means for measuring, means for tuning, means for suppressing transmission, etc.) for communicating via one or more wireless communication networks (not shown) (such as NR networks, LTE networks, GSM networks, etc.). WWAN transceivers 310 and 350 may each be connected to one or more antennas 316 and 356 for communicating with other network nodes (such as other UEs, access points, base stations (e.g., eNB, gNB)) over a wireless communication medium of interest (e.g., a time / frequency resource set in a specific spectrum) via at least one designated RAT (e.g., NR, LTE, GSM, etc.). WWAN transceivers 310 and 350 can be configured, according to a specified RAT, in various ways to transmit and encode signals 318 and 358 (e.g., messages, indications, information, etc.), and conversely, to receive and decode signals 318 and 358 (e.g., messages, indications, information, pilots, etc.). Specifically, WWAN transceivers 310 and 350 each include one or more transmitters 314 and 354 for transmitting and encoding signals 318 and 358, respectively, and each includes one or more receivers 312 and 352 for receiving and decoding signals 318 and 358, respectively.

[0074] In at least some cases, UE 302 and base station 304 each further include one or more short-range radio transceivers 320 and 360, respectively. The short-range radio transceivers 320 and 360 can be connected to one or more antennas 326 and 366, respectively, and provide access via at least one designated RAT (e.g., WiFi, LTE-D, etc.). Z- A means for communicating with other network nodes (such as other UEs, access points, base stations, etc.) over a wireless communication medium of interest (e.g., means for transmitting, means for receiving, means for measuring, means for tuning, means for suppressing transmission, etc.) using PC5, Dedicated Short Range Communication (DSRC), Wireless Access in Vehicle Environments (WAVE), Near Field Communication (NFC), etc.). Short-range transceivers 320 and 360 can be configured, according to a specified RAT, in various ways to transmit and encode signals 328 and 368 (e.g., messages, indications, information, etc.), and conversely, to receive and decode signals 328 and 368 (e.g., messages, indications, information, pilots, etc.). Specifically, short-range transceivers 320 and 360 each include one or more transmitters 324 and 364 for transmitting and encoding signals 328 and 368, respectively, and one or more receivers 322 and 362 for receiving and decoding signals 328 and 368, respectively. As specific examples, the short-range wireless transceivers 320 and 360 can be WiFi transceivers, transceiver and / or Z- Transceivers, NFC transceivers, or vehicle-to-vehicle (V2V) and / or vehicle-to-everything (V2X) transceivers.

[0075] In at least some cases, UE 302 and base station 304 also include Satellite Positioning System (SPS) receivers 330 and 370. SPS receivers 330 and 370 may be connected to one or more antennas 336 and 376, respectively, and may be provided with means for receiving and / or measuring SPS signals 338 and 378, such as Global Positioning System (GPS) signals, Global Navigation Satellite System (GLONASS) signals, Galileo signals, BeiDou signals, Indian Regional Navigation Satellite System (NAVIC), Quasi-Zenith Satellite System (QZSS), etc. SPS receivers 330 and 370 may each include any suitable hardware and / or software for receiving and processing SPS signals 338 and 378. SPS receivers 330 and 370 request information and operation from other systems as appropriate and perform necessary calculations to determine the positioning of UE 302 and base station 304 using measurements obtained by any suitable SPS algorithm.

[0076] Base station 304 and network entity 306 each include one or more network transceivers 380 and 390, respectively, to provide means (e.g., means for transmitting, means for receiving, etc.) for communicating with other network entities (e.g., other base stations 304, other network entities 306). For example, base station 304 may use one or more network transceivers 380 to communicate with other base stations 304 or network entities 306 on one or more wired or wireless backhaul links. As another example, network entity 306 may use one or more network transceivers 390 to communicate with one or more base stations 304 on one or more wired or wireless backhaul links, or to communicate with other network entities 306 on one or more wired or wireless core network interfaces.

[0077] Transceivers can be configured to communicate over wired or wireless links. A transceiver (whether wired or wireless) includes a transmitter circuitry (e.g., transmitters 314, 324, 354, 364) and a receiver circuitry (e.g., receivers 312, 322, 352, 362). In some implementations, the transceiver may be an integrated device (e.g., implementing the transmitter and receiver circuitry in a single device), in some implementations it may include separate transmitter and receiver circuitry, or in other implementations it may be implemented in a different manner. The transmitter and receiver circuitry of a wired transceiver (e.g., in some implementations, network transceivers 380 and 390) may be coupled to one or more wired network interface ports. Wireless transmitter circuitry (e.g., transmitters 314, 324, 354, 364) may include or be coupled to multiple antennas (e.g., antennas 316, 326, 356, 366), such as antenna arrays, which permit the corresponding device (e.g., UE 302, base station 304) to perform transmit beamforming as described herein. Similarly, wireless receiver circuitry (e.g., receivers 312, 322, 352, 362) may include or be coupled to multiple antennas (e.g., antennas 316, 326, 356, 366), such as antenna arrays, which permit the corresponding device (e.g., UE 302, base station 304) to perform receive beamforming as described herein. In one aspect, the transmitter and receiver circuitry may share the same multiple antennas (e.g., antennas 316, 326, 356, 366) so that the corresponding device can only receive or transmit at a given time, rather than both simultaneously. Wireless transceivers (e.g., WWAN transceivers 310 and 350, short-range wireless transceivers 320 and 360) may also include network listening modules (NLMs) for performing various measurements.

[0078] As used herein, various wireless transceivers (e.g., transceivers 310, 320, 350, and 360, and network transceivers 380 and 390 in some implementations) and wired transceivers (e.g., network transceivers 380 and 390 in some implementations) can generally be characterized as "transceiver," "at least one transceiver," or "one or more transceivers." Thus, whether a particular transceiver is a wired or wireless transceiver can be inferred from the type of communication performed. For example, backhaul communication between network devices or servers generally involves signaling via a wired transceiver, while wireless communication between a UE (e.g., UE 302) and a base station (e.g., base station 304) generally involves signaling via a wireless transceiver.

[0079] UE 302, base station 304, and network entity 306 also include other components that can be used in conjunction with operations as disclosed herein. UE 302, base station 304, and network entity 306 each include one or more processors 332, 384, and 394 for providing functionality related to, for example, wireless communication, and for providing other processing functionality. Processors 332, 384, and 394 can therefore provide means for processing, such as means for determining, means for calculating, means for receiving, means for transmitting, means for indicating, etc. In one aspect, processors 332, 384, and 394 may include, for example, one or more general-purpose processors, multi-core processors, central processing units (CPUs), ASICs, digital signal processors (DSPs), field-programmable gate arrays (FPGAs), other programmable logic devices or processing circuitry systems, or various combinations thereof.

[0080] UE 302, base station 304, and network entity 306 include memory circuitry that respectively implements memories 340, 386, and 396 (e.g., each including a memory device) for maintaining information (e.g., information indicating reserved resources, thresholds, parameters, etc.). Therefore, memories 340, 386, and 396 can provide means for storage, means for retrieval, means for maintenance, etc. In some cases, UE 302, base station 304, and network entity 306 may respectively include beam profile modules 342, 388, and 398. Beam profile modules 342, 388, and 398 may be hardware circuitry as part of or coupled to processors 332, 384, and 394, which, when executed, enable UE 302, base station 304, and network entity 306 to perform the functionality described herein. In other respects, beam profile modules 342, 388, and 398 may be external to processors 332, 384, and 394 (e.g., part of a modem processing system, integrated with another processing system, etc.). Alternatively, beam profile modules 342, 388, and 398 may be memory modules stored in memories 340, 386, and 396, respectively, which, when executed by processors 332, 384, and 394 (or a modem processing system, another processing system, etc.), enable UE 302, base station 304, and network entity 306 to perform the functionality described herein. Figure 3A The possible locations of the beam profile module 342 are described. The beam profile module 342 may be, for example, part of one or more WWAN transceivers 310, memory 340, one or more processors 332, or any combination thereof, or may be a stand-alone component. Figure 3B The possible locations of the beam profile module 388 are described. The beam profile module 388 may be part of, for example, one or more WWAN transceivers 350, memory 386, one or more processors 384, or any combination thereof, or may be a stand-alone component. Figure 3C The possible locations of the beam profile module 398 are explained. The beam profile module 398 may be, for example, part of one or more network transceivers 390, memory 396, one or more processors 394, or any combination thereof, or may be a stand-alone component.

[0081] UE 302 may include one or more sensors 344 coupled to one or more processors 332 to provide means for sensing or detecting motion and / or orientation information independent of motion data derived from signals received by one or more WWAN transceivers 310, one or more short-range wireless transceivers 320, and / or (e.g., SPS receivers) 330. As an example, (e.g.,) sensors 344 may include accelerometers (e.g., microelectromechanical systems (MEMS) devices), gyroscopes, geomagnetic sensors (e.g., compasses), altimeters (e.g., barometric altimeters), and / or any other type of motion detection sensor. Furthermore, sensors 344 may include multiple different types of devices and combine their outputs to provide motion information. For example, (e.g.,) sensors 344 may use a combination of multi-axis accelerometers and orientation sensors to provide the ability to calculate position in two-dimensional (2D) and / or three-dimensional (3D) coordinate systems.

[0082] Additionally, UE 302 includes a user interface 346, which provides means for providing instructions to the user (e.g., audible and / or visual instructions) and / or for receiving user input (e.g., when the user actuates a sensing device (such as a keypad, touchscreen, microphone, etc.)). Although not shown, base station 304 and network entity 306 may also include user interfaces.

[0083] Referring more specifically to one or more processors 384, in the downlink, IP packets from network entity 306 may be provided to processors 384. One or more processors 384 may implement functionality for the RRC layer, Packet Data Convergence Protocol (PDCP) layer, Radio Link Control (RLC) layer, and Media Access Control (MAC) layer. One or more processors 384 may provide RRC layer functionality associated with system information (e.g., Master Information Block (MIB), System Information Block (SIB)) broadcasting, RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-RAT mobility, and measurement configuration for UE measurement reporting; PDCP layer functionality associated with header compression / decompression, security (cryptography, cryptographic decoding, integrity protection, integrity verification), and handover support functions; RLC layer functionality associated with upper-layer PDU delivery, error correction via Automatic Repeat Request (ARQ), concatenation, segmentation and reassembly of RLC Service Data Units (SDUs), resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, scheduling information reporting, error correction, priority handling, and logical channel priority ordering.

[0084] Transmitter 354 and receiver 352 implement Layer 1 (L1) functionality associated with various signal processing functions. Layer-1, including the physical (PHY) layer, may include error detection on the transport channel, forward error correction (FEC) decoding / decoding of the transport channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. Transmitter 354 processes the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-phase shift keying (M-PSK), M-quadrature amplitude modulation (M-QAM)). The decoded and modulated symbols can then be split into parallel streams. Each stream can then be mapped to an orthogonal frequency division multiplexing (OFDM) subcarrier, multiplexed with a reference signal (e.g., a pilot) in the time and / or frequency domains, and subsequently combined using an inverse fast Fourier transform (IFFT) to produce a physical channel carrying a time-domain OFDM symbol stream. The OFDM symbol stream is spatially precoded to generate multiple spatial streams. Channel estimates from the channel estimator can be used to determine the coding and modulation schemes, as well as for spatial processing. The channel estimates can be derived from reference signals transmitted by UE 302 and / or channel condition feedback. Each spatial stream can then be provided to one or more different antennas 356. Transmitter 354 can use the corresponding spatial stream to modulate an RF carrier for transmission.

[0085] At UE 302, receiver 312 receives signals via its respective antennas 316. Receiver 312 recovers the information modulated onto the RF carrier and provides this information to one or more processors 332. Transmitter 314 and receiver 312 implement Layer 1 functionality associated with various signal processing functions. Receiver 312 can perform spatial processing on this information to recover any spatial stream destined for UE 302. If multiple spatial streams are destined for UE 302, they can be combined by receiver 312 into a single OFDM symbol stream. Receiver 312 then uses a Fast Fourier Transform (FFT) to transform the OFDM symbol stream from the time domain to the frequency domain. The frequency domain signal consists of a separate OFDM symbol stream for each subcarrier of the OFDM signal. Symbols on each subcarrier, along with a reference signal, are recovered and demodulated by determining the signal constellation points most likely to be transmitted by base station 304. These soft decisions can be based on a channel estimate calculated by a channel estimator. These soft decisions are then decoded and deinterleaved to recover the original data and control signals transmitted by base station 304 over the physical channel. This data and control signals are then provided to one or more processors 332 that implement Layer 3 (L3) and Layer 2 (L2) functionality.

[0086] In the uplink, one or more processors 332 provide demultiplexing, packet reassembly, cipher decoding, header decompression, and control signal processing between the transport and logical channels to recover IP packets from the core network. One or more processors 332 are also responsible for error detection.

[0087] Similar to the functionality described in conjunction with downlink transmissions performed by base station 304, one or more processors 332 provide RRC layer functionality associated with system information (e.g., MIB, SIB) capture, RRC connectivity, and measurement reporting; PDCP layer functionality associated with header compression / decompression and security (cryptography, cryptographic decoding, integrity protection, integrity verification); RLC layer functionality associated with upper-layer PDU delivery, error correction via ARQ, concatenation, segmentation and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing MAC SDUs onto transport blocks (TBs), demultiplexing MAC SDUs from TBs, scheduling information reporting, error correction via Hybrid Automatic Repeat Request (HARQ), priority handling, and logical channel priority ordering.

[0088] The channel estimate derived by the channel estimator from the reference signal or feedback transmitted by the base station 304 can be used by the transmitter 314 to select an appropriate coding and modulation scheme and to facilitate spatial processing. The spatial stream generated by the transmitter 314 can be provided to different antennas 316. The transmitter 314 can use the corresponding spatial stream to modulate the RF carrier for transmission.

[0089] Uplink transmissions are handled at base station 304 in a manner similar to that described in conjunction with the receiver function at UE 302. Receiver 352 receives signals via its corresponding antenna 356. Receiver 352 recovers the information modulated onto the RF carrier and provides that information to one or more processors 384.

[0090] In the uplink, one or more processors 384 provide demultiplexing, packet reassembly, cipher decoding, header decompression, and control signal processing between the transport and logical channels to recover IP packets from UE 302. IP packets from the one or more processors 384 can be provided to the core network. The one or more processors 384 are also responsible for error detection.

[0091] For convenience, UE 302, base station 304 and / or network entity 306 are in Figure 3A , 3BThe components shown in 3C are various and can be configured according to the various examples described herein. However, it will be understood that the components described may have different functionalities in different designs. Specifically, Figures 3A to 3C The various components are optional in the replacement configuration, and various aspects include configurations that can vary due to design choices, cost, equipment usage, or other considerations. For example, in Figure 3A In such cases, a specific implementation of UE 302 may omit WWAN transceiver 310 (e.g., wearable devices, tablets, PCs, or laptops may have Wi-Fi and / or Bluetooth capabilities but no cellular capabilities), or short-range transceiver 320 (e.g., cellular only), or SPS receiver 330, or sensor 344, etc. In another example, in Figure 3B In such cases, a particular implementation of base station 304 may omit WWAN transceiver 350 (e.g., a Wi-Fi "hotspot" access point without cellular capabilities), or short-range wireless transceiver 360 (e.g., cellular only), or SPS receiver 370, etc. For the sake of brevity, explanations of various alternative configurations are not provided herein, but will be readily understood by those skilled in the art.

[0092] Various components of UE 302, base station 304, and network entity 306 can be communicatively coupled to each other on data buses 334, 382, ​​and 392, respectively. In one aspect, data buses 334, 382, ​​and 392 can form or be part of the communication interfaces of UE 302, base station 304, and network entity 306, respectively. For example, when different logical entities are implemented in the same device (e.g., gNB and location server functionality are incorporated into the same base station 304), data buses 334, 382, ​​and 392 can provide communication between them.

[0093] Figure 3A , 3B The various components of 3C can be implemented in various ways. In some implementations, Figure 3A , 3BThe 3C components can be implemented in one or more circuits (e.g., one or more processors and / or one or more ASICs, which may include one or more processors)). Here, each circuit may use and / or incorporate at least one memory component for storing information or executable code used by that circuit to provide this functionality. For example, some or all of the functionalities represented by blocks 310 to 346 may be implemented by the processor and memory components of UE 302 (e.g., by executing appropriate code and / or by appropriately configuring the processor components). Similarly, some or all of the functionalities represented by blocks 350 to 388 may be implemented by the processor and memory components of base station 304 (e.g., by executing appropriate code and / or by appropriately configuring the processor components). Furthermore, some or all of the functionalities represented by blocks 390 to 398 may be implemented by the processor and memory components of network entity 306 (e.g., by executing appropriate code and / or by appropriately configuring the processor components). For simplicity, various operations, actions, and / or functions are described herein as being performed "by the UE," "by the base station," "by the network entity," etc. However, as will be appreciated, such operations, actions, and / or functions may actually be performed by specific components or combinations of components (such as processors 332, 384, 394, transceivers 310, 320, 350, and 360, memories 340, 386, and 396, beamformer positioning components 342, 388, and 398, etc.) of the UE 302, base station 304, network entity 306, etc.

[0094] In some designs, network entity 306 may be implemented as a core network component. In other designs, network entity 306 may be a network operator or operation different from the cellular network infrastructure (e.g., NG RAN 220 and / or 5GC 210 / 260). For example, network entity 306 may be a component of a private network that may be configured to communicate with UE 302 via base station 304 or independently of base station 304 (e.g., on a non-cellular communication link, such as WiFi).

[0095] The functionality of gNB 222 is divided between gNB Central Unit (gNB-CU) 226 and one or more gNB Distributed Units (gNB-DU) 228. The interface 232 between gNB-CU 226 and one or more gNB-DU 228 is referred to as the "F1" interface. gNB-CU 226 is a logical node that includes base station functions such as transmitting user data, mobility control, radio access network sharing, positioning, and session management, in addition to those functions specifically allocated to gNB-DU(228). More specifically, gNB-CU 226 manages the Radio Resource Control (RRC), Serving Data Adaptation Protocol (SDAP), and Packet Data Convergence Protocol (PDCP) protocols of gNB 222. gNB-DU 228 is a logical node that manages the Radio Link Control (RLC), Media Access Control (MAC), and Physical (PHY) layers of gNB 222. Its operation is controlled by gNB-CU 226. One gNB-DU 228 can support one or more cells, while a cell is supported by only one gNB-DU 228. Therefore, UE 204 communicates with gNB-CU 226 via RRC, SDAP, and PDCP layers, and with gNB-DU 228 via RLC, MAC, and PHY layers.

[0096] Various frame structures can be used to support downlink and uplink transmissions between network nodes (e.g., base stations and UEs).

[0097] Figure 4A Figure 400 illustrates an example of a downlink frame structure according to various aspects of this disclosure. Figure 4B Figure 430 illustrates an example of a channel within a downlink frame structure according to various aspects of this disclosure. Figure 4C Figure 450 is an example illustrating an uplink frame structure according to various aspects of this disclosure. Figure 4D Figure 480 illustrates an example of a channel within an uplink frame structure according to various aspects of this disclosure. Other wireless communication technologies may have different frame structures and / or different channels.

[0098] LTE, and in some cases NR, utilizes OFDM on the downlink and single-carrier frequency division multiplexing (SC-FDM) on the uplink. However, unlike LTE, NR also has the option to use OFDM on the uplink. OFDM and SC-FDM divide the system bandwidth into multiple (K) orthogonal subcarriers, which are often referred to as frequency modulation, frequency slots, etc. Each subcarrier can be modulated with data. Generally, modulation symbols are transmitted in the frequency domain for OFDM and in the time domain for SC-FDM. The spacing between adjacent subcarriers can be fixed, and the total number of subcarriers (K) can depend on the system bandwidth. For example, the subcarrier spacing can be 15 kHz, and the minimum resource allocation (resource block) can be 12 subcarriers (or 180 kHz). Therefore, for system bandwidths of 1.25, 2.5, 5, 10, or 20 MHz, the nominal FFT size can be equal to 128, 256, 512, 1024, or 2048, respectively. The system bandwidth can also be divided into subbands. For example, a subband can cover 1.08MHz (i.e., 6 resource blocks), and for system bandwidths of 1.25, 2.5, 5, 10, or 20MHz, there can be 1, 2, 4, 8, or 16 subbands, respectively.

[0099] LTE supports single-parameter design (subcarrier spacing (SCS), symbol length, etc.). In contrast, NR supports multiple parameter designs (μ), for example, subcarrier spacings of 15kHz (μ=0), 30kHz (μ=1), 60kHz (μ=2), 120kHz (μ=3), and 240kHz (μ=4) or larger can be available. Within each subcarrier spacing, there are 14 symbols per time slot. For a 15kHz SCS (μ=0), there is one time slot per subframe, 10 time slots per frame, a time slot duration of 1 millisecond (ms), a symbol duration of 66.7 microseconds (μs), and a maximum nominal system bandwidth (in MHz) of 4K FFT size is 50. For a 30kHz SCS (μ=1), there are two time slots per subframe, 20 time slots per frame, a time slot duration of 0.5ms, a symbol duration of 33.3μs, and a maximum nominal system bandwidth (in MHz) of 4K FFT size of 100. For a 60kHz SCS (μ=2), there are four time slots per subframe, 40 time slots per frame, a time slot duration of 0.25ms, a symbol duration of 16.7μs, and a maximum nominal system bandwidth (in MHz) of 4K FFT size of 200. For a 120kHz SCS (μ=3), there are eight time slots per subframe, 80 time slots per frame, a time slot duration of 0.125ms, a symbol duration of 8.33μs, and a maximum nominal system bandwidth (in MHz) of 4K FFT size of 400. For a 240kHz SCS (μ=4), there are 16 time slots per subframe and 160 time slots per frame. The time slot duration is 0.0625ms, the symbol duration is 4.17μs, and the maximum nominal system bandwidth (in MHz) with a 4K FFT size is 800.

[0100] exist Figures 4A to 4D In the example, a 15kHz parameter design is used. Therefore, in the time domain, a 10ms frame is divided into 10 equal-sized subframes, each 1ms in size, and each subframe includes one time slot. Figures 4A to 4D In the diagram, time is represented horizontally (on the X-axis), where time increases from left to right, while frequency is represented vertically (on the Y-axis), where frequency increases (or decreases) from bottom to top.

[0101] A resource grid can be used to represent time slots, each time slot comprising one or more concurrent resource blocks (RBs) (also known as physical RBs (PRBs)) in the frequency domain. The resource grid is further divided into multiple resource elements (REs). An RE corresponds to one symbol length in the time domain and one subcarrier in the frequency domain. Figures 4A to 4DIn the parameter design, for a normal cyclic prefix, the RB can contain 12 consecutive subcarriers in the frequency domain and 7 consecutive symbols in the time domain, for a total of 84 REs. For an extended cyclic prefix, the RB can contain 12 consecutive subcarriers in the frequency domain and 6 consecutive symbols in the time domain, for a total of 72 REs. The number of bits carried by each RE depends on the modulation scheme.

[0102] Some REs carry downlink reference (pilot) signals (DL-RS). DL-RS may include positioning reference signals (PRS), tracking reference signals (TRS), phase tracking reference signals (PTRS), cell-specific reference signals (CRS), channel state information reference signals (CSI-RS), demodulation reference signals (DMRS), primary synchronization signals (PSS), secondary synchronization signals (SSS), synchronization signal blocks (SSB), etc. Figure 4A Example locations of REs carrying PRS (labeled "R") are explained.

[0103] The set of resource elements (REs) used for PRS transmission is called a "PRS resource". The resource element set can span multiple PRBs in the frequency domain and 'N' (such as one or more) consecutive symbols within a time slot in the time domain. In a given OFDM symbol in the time domain, the PRS resource occupies a consecutive PRB in the frequency domain.

[0104] The transmission of PRS resources within a given PRB has a specific comb tooth size (also known as "comb tooth density"). The comb tooth size 'N' represents the subcarrier spacing (or frequency / frequency modulation spacing) within each symbol of the PRS resource configuration. Specifically, for a comb tooth size 'N', the PRS is transmitted in every Nth subcarrier of a symbol in the PRB. For example, for comb tooth-4, for each symbol of the PRS resource configuration, the RE corresponding to every fourth subcarrier (such as subcarriers 0, 4, 8) is used to transmit the PRS resource. Currently, comb tooth sizes of comb tooth-2, comb tooth-4, comb tooth-6, and comb tooth-12 are supported by DL-PRS. Figure 4A An example PRS resource configuration for comb tooth 6 (which spans 6 symbols) is explained. That is, the position of the shaded RE (marked as "R") indicates the PRS resource configuration for comb tooth 6.

[0105] Currently, DL-PRS resources can span 2, 4, 6, or 12 consecutive symbols within a single time slot using a full-frequency interleaved mode. DL-PRS resources can be configured in any downlink or flexible (FL) symbol configured by a higher layer within a time slot. For all REs of a given DL-PRS resource, there may be a constant energy per resource element (EPRE). The following are the symbol-by-symbol frequency offsets for comb sizes 2, 4, 6, and 12 symbols. 2-symbol comb-2: {0,1}; 4-symbol comb-2: {0,1,0,1}; 6-symbol comb-2: {0,1,0,1,0,1}; 12-symbol comb-2: {0,1,0,1,0,1,0,1,0,1,0,1}; 4-symbol comb-4: {0,2,1,3}; 12-symbol comb-4: { 0,2,1,3,0,2,1,3,0,2,1,3}; 6-code comb-6: {0,3,1,4,2,5}; 12-code comb-6: {0,3,1,4,2,5,0,3,1,4,2,5}; and 12-code comb-12: {0,6,3,9,1,7,4,10,2,8,5,11}.

[0106] A “PRS resource set” is a PRS resource used for the transmission of PRS signals, where each PRS resource has a PRS resource ID. Furthermore, PRS resources in a PRS resource set are associated with the same TRP. A PRS resource set is identified by a PRS resource set ID and associated with a specific TRP (identified by the TRP ID). Additionally, PRS resources in a PRS resource set share the same periodicity, a shared silent mode configuration, and the same repetition factor (such as “PRS-ResourceRepetitionFactor”) across time slots. Periodicity is the time from the first repetition of the first PRS resource in the first PRS instance to the same first repetition of the same first PRS resource in the next PRS instance. The periodicity can have a length chosen from the following: 2^μ*{4,5,8,10,16,20,32,40,64,80,160,320,640,1280,2560,5120,10240} time slots, where μ=0,1,2,3. The repetition factor can have a length chosen from {1,2,4,6,8,16,32} time slots.

[0107] In a PRS resource set, a PRS resource ID is associated with a single beam (or beam ID) transmitted from a single TRP (where a TRP can transmit one or more beams). That is, each PRS resource in a PRS resource set can be transmitted on a different beam, and thus, a "PRS resource" (or simply a "resource") can also be referred to as a "beam". Note that this does not imply whether the UE is aware of the TRP and beam transmitting the PRS.

[0108] A “PRS instance” or “PRS timing” is an instance of a periodically repeating time window (such as a group of one or more consecutive time slots) in which a PRS is expected to be transmitted. A PRS timing may also be referred to as a “PRS positioning timing,” “PRS positioning instance,” “positioning timing,” “positioning instance,” “positioning repetition,” or simply “timing,” “instance,” or “repetition.”

[0109] A “positioning frequency layer” (also simply “frequency layer”) is a collection of one or more PRS resource sets with identical values ​​for certain parameters across one or more TRPs. Specifically, the collection of PRS resource sets has the same subcarrier spacing and cyclic prefix (CP) type (meaning all parameter designs supported by PDSCH are also supported by PRS), the same point A, the same downlink PRS bandwidth, the same starting PRB (and center frequency), and the same comb size. The point A parameter uses the value of the parameter “ARFCN-ValueNR” (where “ARFCN” stands for “Absolute Radio Channel Number”) and is an identifier / code specifying a pair of physical radio channels used for transmission and reception. The downlink PRS bandwidth can have a granularity of 4 PRBs, with a minimum of 24 PRBs and a maximum of 272 PRBs. Currently, up to four frequency layers have been defined, and up to two PRS resource sets can be configured per frequency layer per TRP.

[0110] The concept of a frequency layer is somewhat similar to that of component carriers and bandwidth portions (BWPs), but the difference is that component carriers and BWPs are used by a single base station (or macrocell base station and small cell base station) to transmit data channels, while a frequency layer is used by several (often three or more) base stations to transmit PRS (Positioning Signals). A UE can indicate the number of frequency layers it can support when sending its positioning capabilities to the network (such as during an LTE Positioning Protocol (LPP) session). For example, a UE can indicate whether it can support one or four positioning frequency layers.

[0111] Figure 4BExamples of various channels within the downlink time slot of a radio frame are explained. In NR, the channel bandwidth, or system bandwidth, is divided into multiple BWPs. A BWP is a set of adjacent PRBs selected from a subset of shared RBs designed for a given carrier with given parameters. Generally, a maximum of four BWPs can be specified in both the downlink and uplink. That is, a UE can be configured to have up to four BWPs in the downlink and up to four BWPs in the uplink. Only one BWP (uplink or downlink) can be active at a given time, meaning that the UE can only receive or transmit on one BWP at a time. In the downlink, the bandwidth of each BWP should be equal to or greater than the bandwidth of the SSB, but it may or may not contain an SSB.

[0112] Reference Figure 4B The Primary Synchronization Signal (PSS) is used by the UE to determine subframe / symbol timing and physical layer identity. The Secondary Synchronization Signal (SSS) is used by the UE to determine the physical layer cell identity group number and radio frame timing. Based on the physical layer identity and physical layer cell identity group number, the UE can determine the PCI. Based on the PCI, the UE can determine the location of the aforementioned DL-RS. The Physical Broadcast Channel (PBCH) carrying the MIB can be logically grouped with the PSS and SSS to form the SSB (also known as SS / PBCH). The MIB provides the number of RBs in the downlink system bandwidth and the System Frame Number (SFN). The Physical Downlink Shared Channel (PDSCH) carries user data, broadcast system information (such as System Information Blocks (SIBs)) not transmitted through the PBCH, and paging messages.

[0113] The Physical Downlink Control Channel (PDCCH) carries downlink control information (DCI) within one or more Control Channel Elements (CCEs). Each CCE includes one or more RE Group (REG) bundles (which can span multiple symbols in the time domain). Each REG bundle includes one or more REGs, and each REG corresponds to 12 resource elements (one resource block) in the frequency domain and one OFDM symbol in the time domain. The physical resource set used to carry the PDCCH / DCI is called the Control Resource Set (CORESET) in NR. In NR, the PDCCH is confined to a single CORESET and transmitted along with its own DMRS. This enables UE-specific beamforming for the PDCCH.

[0114] exist Figure 4BIn the example, each BWP has one CORESET, and this CORESET spans three symbols in the time domain (although it can be only one or two symbols). Unlike the LTE control channel, which occupies the entire system bandwidth, in NR, the PDCCH channel is localized to a specific region in the frequency domain (i.e., the CORESET). Therefore, Figure 4B The frequency components of the PDCCH shown are interpreted in the frequency domain as fewer than a single BWP. Note that although the interpreted CORESETs are contiguous in the frequency domain, they do not need to be contiguous. Additionally, a CORESET can span fewer than three symbols in the time domain.

[0115] The DCI within the PDCCH carries information about uplink resource allocation (persistent and non-persistent) and a description of the downlink data transmitted to the UE (referred to as uplink grant and downlink grant, respectively). More specifically, the DCI indicates the resources scheduled for downlink data channels (e.g., PDSCH) and uplink data channels (e.g., PUSCH). Multiple (e.g., up to eight) DCIs can be configured in the PDCCH, and these DCIs can have one of several formats. For example, different DCI formats exist for uplink scheduling, downlink scheduling, uplink transmit power control (TPC), etc. The PDCCH can be transmitted by 1, 2, 4, 8, or 16 CCEs to accommodate different DCI payload sizes or code rates.

[0116] like Figure 4C As explained, some REs (denoted as "R") carry DMRS for channel estimation at the receiver (e.g., a base station, another UE, etc.). The UE may, for example, additionally transmit SRS in the last symbol of the time slot. The SRS may have a comb structure, and the UE may transmit the SRS on one of the comb teeth. Figure 4C In the example, the SRS described is a comb tooth-2 on a symbol. The SRS can be used by the base station to obtain Channel State Information (CSI) for each UE. CSI describes how the RF signal propagates from the UE to the base station and represents the combined effects of scattering, fading, and power attenuation over distance. The system uses SRS for resource scheduling, link adaptation, massive MIMO, beam management, etc.

[0117] Currently, SRS resources with comb tooth sizes of 2, 4, or 8 can span 1, 2, 4, 8, or 12 consecutive symbols within a time slot. The following are the symbol-by-symbol frequency offsets for the currently supported SRS comb tooth patterns. 1-code element comb-2: {0}; 2-code element comb-2: {0,1}; 4-code element comb-2: {0,1,0,1}; 4-code element comb-4: {0,2,1,3}; 8-code element comb-4: {0,2,1,3,0,2,1,3}; 12-code element comb-4: {0,2,1,3,0,2,1,3,0,2,1,3}; 4-code element comb-8: {0,4,2,6}; 8-code element comb-8: {0,4,2,6,1,5,3,7}; and 12-code element comb-8: {0,4,2,6,1,5,3,7,0,4,2,6}.

[0118] The set of resource elements used for SRS transmission is called an "SRS resource" and is identified by the parameter "SRS-ResourceId (SRS-ResourceId)". The resource element set can span multiple PRBs in the frequency domain and N (e.g., one or more) consecutive symbols within a time slot in the time domain. In a given OFDM symbol, an SRS resource occupies a consecutive PRB. An "SRS resource set" is a group of SRS resources used for SRS signal transmission and is identified by the SRS resource set ID ("SRS-ResourceSetId").

[0119] Generally, a UE transmits a SRS so that the receiving base station (serving base station or neighboring base station) can measure the channel quality between the UE and the base station. However, an SRS can also be specifically configured as an uplink positioning reference signal for uplink-based positioning procedures, such as uplink time difference of arrival (UL-TDOA), round-trip time (RTT), uplink angle of arrival (UL-AoA), etc. As used herein, the term "SRS" can refer to an SRS configured for channel quality measurement or an SRS configured for positioning purposes. When it is necessary to distinguish between the two types of SRS, the former may be referred to herein as "SRS-for-communication" and / or the latter as "SRS-for-positioning".

[0120] Several enhancements to the previously defined SRS have been proposed for “SRS for Positioning” (also known as “UL-PRS”), such as new interleaving patterns within SRS resources (other than single symbol / comb-2), new comb types for SRS, new sequences of SRS, larger sets of SRS resources per component carrier, and larger numbers of SRS resources per component carrier. Additionally, the parameters “SpatialRelationInfo” and “PathLossReference” are configured based on downlink reference signals or SSBs from adjacent TRPs. Furthermore, an SRS resource can be transmitted outside the active BWP, and an SRS resource can span multiple component carriers. Moreover, SRS can be configured in RRC connected states and transmitted only within the active BWP. Furthermore, there may be no frequency hopping, no repetition factor, a single antenna port, and new SRS lengths (e.g., 8 and 12 symbols). Open-loop power control may also exist, but closed-loop power control is not possible, and comb-8 (i.e., SRS transmitted every eighth subcarrier in the same symbol) can be used. Finally, the UE can transmit from multiple SRS resources using the same transmit beam for UL-AoA. All of these are features outside the current SRS framework, which is configured via higher-level RRC signaling (and potentially triggered or activated via MAC control elements (CE) or DCI).

[0121] Figure 4D Examples of various channels within uplink slots of a frame according to various aspects of this disclosure are described. A Random Access Channel (RACH) (also referred to as a Physical Random Access Channel (PRACH)) may be configured based on the PRACH within one or more slots of the frame. A PRACH may include six consecutive RB pairs within a slot. The PRACH allows the UE to perform initial system access and achieve uplink synchronization. A Physical Uplink Control Channel (PUCCH) may be located at the edge of the uplink system bandwidth. The PUCCH carries uplink control information (UCI), such as scheduling requests, CSI reports, channel quality indicators (CQI), precoding matrix indicators (PMI), rank indicators (RI), and HARQ ACK / NACK feedback. A Physical Uplink Shared Channel (PUSCH) carries data and may additionally be used to carry buffer status reports (BSR), power clearance reports (PHR), and / or UCI.

[0122] Note that the terms "location reference signal" and "PRS" generally refer to specific reference signals used for positioning in NR and LTE systems. However, as used herein, the terms "location reference signal" and "PRS" can also refer to any type of reference signal that can be used for positioning, such as, but not limited to, PRS, TRS, PTRS, CRS, CSI-RS, DMRS, PSS, SSS, SSB, SRS, UL-PRS, etc., as defined in LTE and NR. Additionally, the terms "location reference signal" and "PRS" can refer to downlink or uplink positioning reference signals, unless otherwise indicated by the context. If further distinction is needed regarding the type of PRS, downlink positioning reference signals may be referred to as "DL-PRS," while uplink positioning reference signals (e.g., SRS, PTRS used for positioning) may be referred to as "UL-PRS." Furthermore, for signals that can be transmitted in both uplink and downlink (e.g., DMRS, PTRS), these signals may be prefixed with "UL" or "DL" to distinguish direction. For example, "UL-DMRS" can be distinguished from "DL-DMRS."

[0123] Figure 5 This is a diagram 500 illustrating communication between base station (BS) 502 (which may correspond to any base station described herein) and UE 504 (which may correspond to any UE described herein). See Figure 500. Figure 5 Base station 502 may transmit beam-shaped signals to UE 504 on one or more transmit beams 502a, 502b, 502c, 502d, 502e, 502f, 502g, 502h, each of which has a beam identifier that can be used by UE 504 to identify the corresponding beam. When base station 502 uses a single antenna array (e.g., a single TRP / cell) to beamform toward UE 504, base station 502 may perform "beam sweeping" by transmitting a first beam 502a, followed by beam 502b, etc., until finally transmitting beam 502h. Alternatively, base station 502 may transmit beams 502a-502h in a pattern, such as beam 502a, followed by beam 502h, followed by beam 502b, followed by beam 502g, etc. In the case where base station 502 uses multiple antenna arrays (e.g., multiple TRPs / cells) to beamform toward UE 504, each antenna array can perform beam sweeping of a subset of beams 502a-502h. Alternatively, each beam in beams 502a-502h can correspond to a single antenna or antenna array.

[0124] Figure 5Further explanation is provided regarding the paths 512c, 512d, 512e, 512f, and 512g followed by the beamformed signals transmitted on beams 502c, 502d, 502e, 502f, and 502g, respectively. Each path 512c, 512d, 512e, 512f, and 512g may correspond to a single "multipath," or may include multiple "multipaths" (clusters) due to the propagation characteristics of radio frequency (RF) signals through the environment. Note that although only the paths for beams 502c-502g are shown, this is for simplicity, and the signals transmitted on each beam 502a-502h will follow several paths. In the example shown, paths 512c, 512d, 512e, and 512f are straight lines, while path 512g is reflected away from an obstacle 520 (e.g., a building, vehicle, terrain feature, etc.).

[0125] UE 504 can receive beamformed signals from base station 502 on one or more receive beams 504a, 502b, 504c, 504d. Note that, for simplicity... Figure 5 The beams described herein refer to either the transmit beam or the receive beam, depending on which of the base station 502 and the UE 504 is transmitting and which is receiving. Thus, the UE 504 can also transmit beamshaped signals to the base station 502 on one or more beams 504a–504d, and the base station 502 can receive beamshaped signals from the UE 504 on one or more beams 502a–502h.

[0126] On one hand, base station 502 and UE 504 can perform beam training to align their transmit and receive beams. For example, depending on environmental conditions and other factors, base station 502 and UE 504 can determine optimal transmit and receive beams as 502d and 504b, or as 502e and 504c, respectively. The direction of the optimal transmit beam for base station 502 can be the same as or different from the direction of the optimal receive beam, and similarly, the direction of the optimal receive beam for UE 504 can be the same as or different from the direction of the optimal transmit beam. However, it should be noted that aligning the transmit and receive beams is not necessary for performing downlink angle of origin (DL-AoD) or uplink angle of arrival (UL-AoA) positioning procedures.

[0127] To execute the DL-AoD positioning procedure, base station 502 may transmit reference signals (e.g., PRS, CRS, TRS, CSI-RS, PSS, SSS, etc.) to UE 504 on one or more of the beams 502a-502h, where each beam has a different transmission angle. The different transmission angles of the beams will result in different received signal strengths (e.g., RSRP, RSRQ, SINR, etc.) at UE 504. Specifically, the received signal strength will be lower for transmit beams 502a-502h that are farther from the line-of-sight (LOS) path 510 between base station 502 and UE 504 than for transmit beams 502a-502h that are closer to the LOS path 510.

[0128] exist Figure 5 In the example, if base station 502 transmits reference signals to UE 504 on beams 502c, 502d, 502e, 502f, and 502g, then transmit beam 502e is optimally aligned with LOS path 510, while transmit beams 502c, 502d, 502f, and 502g are not optimally aligned with LOS path 510. Thus, beam 502e may have a higher received signal strength at UE 504 than beams 502c, 502d, 502f, and 502g. Note that reference signals transmitted on some beams (e.g., beams 502c and / or 502f) may not reach UE 504, or the energy reaching UE 504 from these beams may be so low that the energy may be undetectable or at least negligible.

[0129] UE 504 can report to base station 502 the received signal strength of each measured transmit beam 502c-502g, and optionally, the associated measurement quality, or alternatively, the identity of the transmit beam with the highest received signal strength (in Figure 5 In the example, beam 502e is used. Alternatively or additionally, where UE 504 is also involved in a round-trip time (RTT) or time difference of arrival (TDOA) positioning session with at least one base station 502 or multiple base stations 502, UE 504 may report received transmission (Rx-Tx) time difference or reference signal time difference (RSTD) measurements (and optionally associated measurement quality) to the serving base station 502 or other positioning entity. In any case, the positioning entity (e.g., base station 502, location server, third-party client, UE 504, etc.) may estimate the angle from base station 502 to UE 504 as the AoD of the transmit beam (here, transmit beam 502e) with the highest received signal strength at UE 504.

[0130] In one aspect of DL-AoD-based positioning, where only one base station 502 is involved, base station 502 and UE 504 can perform round-trip time (RTT) procedures to determine the distance between base station 502 and UE 504. Therefore, the positioning entity can determine both the direction to UE 504 (using DL-AoD positioning) and the distance to UE 504 (using RTT positioning) to estimate the location of UE 504. Note that the AoD with the highest received signal strength is not necessarily positioned along the LOS path 510, as... Figure 5 As shown in the figure. However, for the purposes of DL-AoD-based positioning, this is assumed.

[0131] In another aspect of DL-AoD-based positioning, in the presence of multiple involved base stations 502, each involved base station 502 can report the determined AoD or RSRP measurement from the corresponding base station 502 to the serving base station 502. The serving base station 502 can then report the AoD or RSRP measurements from the other involved base stations 502 to the positioning entity (e.g., the UE 504 for UE-based positioning or a location server for UE-assisted positioning). Using this information and knowledge of the geographic locations of the base stations 502, the positioning entity can estimate the location of the UE 504 as the intersection of the determined AoDs. For a two-dimensional (2D) positioning solution, there should be at least two involved base stations 502, but as will be understood, the more base stations 502 involved in the positioning procedure, the more accurate the estimated location of the UE 504 will be.

[0132] To execute the UL-AoA positioning procedure, UE 504 transmits uplink reference signals (e.g., UL-PRS, SRS, DMRS, etc.) to base station 502 on one or more of the uplink transmit beams 504a-504d. Base station 502 receives the uplink reference signals on one or more of the uplink receive beams 502a-502h. Base station 502 determines the optimal beam angle among the receive beams 502a-502h used to receive one or more reference signals from UE 504 as the AoA from UE 504 to itself. Specifically, each of the receive beams 502a-502h will receive a different received signal strength (e.g., RSRP, RSRQ, SINR, etc.) of one or more reference signals at base station 502. Furthermore, for the received beams 502a-502h that are further away from the actual LOS path between base station 502 and UE 504, the channel impulse response of one or more reference signals will be smaller than that of the received beams 502a-502h that are closer to the LOS path. Similarly, for the received beams 502a-502h that are further away from the LOS path, the received signal strength will be lower than that of the received beams 502a-502h that are closer to the LOS path. Thus, base station 502 identifies the received beam 502a-502h that has the highest received signal strength and optionally the strongest channel impulse response, and estimates the angle from itself to UE 504 as the AoA of the received beam 502a-502h. Note that, as with DL-AoD-based positioning, the AoA of the received beam 502a-502h that has the highest received signal strength (and, in the case of measurement, the strongest channel impulse response) is not necessarily located along LOS path 510. However, in FR2, this can be assumed for positioning purposes based on UL-AoA.

[0133] It should be noted that although UE 504 is described as capable of beamforming, this is not required for DL-AoD and UL-AoA positioning protocols. Instead, UE 504 can receive and transmit on an omnidirectional antenna.

[0134] When UE 504 is estimating its location (i.e., the UE is the location entity), it needs to obtain the geographic location of base station 502. UE 504 can obtain its location from, for example, base station 502 itself or a location server (e.g., location server 230, LMF 270, SLP272). Using the distance to base station 502 (based on RTT or timing advance), the angle between base station 502 and UE 504 (based on the UL-AoA of the optimal receive beams 502a-502h), and the known geographic location of base station 502, UE 504 is able to estimate its location.

[0135] Alternatively, when a positioning entity (such as base station 502 or a location server) is estimating the location of UE 504, base station 502 reports the AoA of the receive beams 502a-502h that result in the highest received signal strength (and optionally the strongest channel impulse response) of the reference signal received from UE 504, or all received signal strengths and channel impulse responses for all receive beams 502a-502h (this allows the positioning entity to determine the optimal receive beams 502a-502h). Base station 502 may additionally report the Rx-Tx time difference to UE 504. The positioning entity may then estimate the location of UE 504 based on the distance from UE 504 to base station 502, the AoA of the identified receive beams 502a-502h, and the known geographic location of base station 502.

[0136] Figure 6 This section explains an example of PRS spoofing in a Network 600 error. For example... Figure 6 As shown, network 600 includes a legitimate PRS source 602, another legitimate PRS source 604 (both sending legitimate DL-PRS signals 606), and an illegitimate PRS source 608 that sends a spoofed DL-PRS signal 610. The victim UE 612 receives both the legitimate DL-PRS signal 606 and the spoofed DL-PRS signal 610, causing the UE 612's apparent location, or spoofed location 614, to differ from its actual location. The illegitimate PRS source 608 can be any device or transmit / receive point (TRP) capable of sending the spoofed PRS signal 610.

[0137] The fact that a victim UE 612 possesses a deceptive location 614 could have serious negative consequences for military vehicles, ambulances, or other emergency vehicles. Therefore, it is necessary to be able to distinguish deceptive location signals from legitimate location signals.

[0138] This document provides techniques for PRS spoofing detection and mitigation. In some aspects, the beam profile of a PRS of uncertain origin is compared with the beam profile of a known legitimate or genuine PRS signal; if a suspicious PRS has a beam profile that does not match the beam profile of one of the known legitimate PRSs, the suspicious PRS is determined to be illegitimate, e.g., a spoofing PRS, and mitigation measures can be taken, such as ignoring the spoofing PRS, or preventing measurements derived from the spoofing PRS from being used for location calculations. The entity that detects the spoofing PRS can also generate a spoofing detection report to notify or warn other entities within the network of its presence. The spoofing detection report may include the PRS ID of the spoofing PRS and may include the detected direction of the attacker (if it can be determined) to allow the location or position of the transmitter of the spoofing PRS to be determined. The spoofing detection report may be sent to a location server or shared with another UE, for example, via a side link or other communication link.

[0139] Figure 7 This is a flowchart of an example process 700 associated with PRS spoofing detection and mitigation. In some implementations, Figure 7 One or more process blocks can be executed by the UE (e.g., UE 104). In some implementations, Figure 7 One or more process frames can be executed by another device or group of devices, either separate from or including the user equipment (UE). Additionally or alternatively, Figure 7 One or more process blocks may be executed by one or more components of UE 302, such as processor 332, memory 340 or other storage components, WWAN transceiver 310, short-range wireless transceiver 320, SPS receiver 330, sensors 344, beam profile module 342, and / or user interface 346, wherein any or all of the components may be means for performing the operation of process 700.

[0140] As in Figure 7As shown, process 700 may include obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a Legal Positioning Reference Signal (PRS) beam (block 710). Means for performing the operations of block 710 may include (a) WWAN transceiver 310, memory 340, and (a) processor 332 of UE 302. For example, the set of beam profiles may be provisioned to UE 302 that is already stored in memory 340, or UE 302 may receive the set of beam profiles via (a) receiver 312. In some aspects, obtaining the set of one or more beam profiles includes receiving the set of one or more beam profiles from a network entity, which may include a base station, location server, LMF, or other network node.

[0141] As in Figure 7 As further illustrated, process 700 may include determining a beam profile of the received PRS beam (block 720). The means for performing the operations of block 720 may include the WWAN transceiver 310, memory 340, and processor 332 of the UE 302. For example, the UE 302 may receive and measure the PRS beam via receiver 312, process the measurement using processor 332 to calculate the beam profile, and store the beam profile in memory 340. In some aspects, the UE 302 may take a measurement of the PRS beam and post-process the measurement using different codebooks to determine the beam pattern (including sidelobes). In some aspects, determining the beam profile includes determining beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, the number and size of beam sidelobes, or combinations thereof.

[0142] As in Figure 7As further illustrated, process 700 may include determining the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with one or more beam profiles from a legitimate PRS beam (block 730). The means for performing the operation of block 730 may include processor(s) 332 and memory 340 of the UE 302. For example, the UE 302 may use processor(s) 332 to determine the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with one or more beam profiles from a legitimate PRS beam, which are stored in memory 340. In some aspects, determining the legitimacy of a received PRS beam includes: if the beam profile of the received PRS beam matches a beam profile from one or more beam profiles in the group, then the received PRS beam is determined to be legitimate; and if the beam profile of the received PRS beam does not match a beam profile from one or more beam profiles in the group, then the received PRS beam is determined to be illegitimate. In some aspects, determining the legitimacy of a first PRS beam based on a comparison of its beam profile with a beam profile from a legitimate PRS beam includes: determining the legitimacy of the first PRS beam based on a comparison of the first PRS beam's beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, and / or the number and size of its sidelobes with those of a legitimate PRS beam.

[0143] As in Figure 7 As further illustrated, process 700 may include using the received PRS beam if it is determined to be valid (box 740), and not using the received PRS beam if it is not determined to be valid (box 750). The means for performing the operations of boxes 740 and 750 may include the WWAN transceiver 310 and processor 332 of UE 302. For example, if the received PRS beam is determined to be valid, processor 332 may use the PRS beam measurement for positioning operations (e.g., to determine its own location) or transmit the PRS beam measurement to a location server via transmitter 314. If the received PRS beam is determined to be invalid, processor 332 may choose not to use the PRS beam measurement for positioning operations or other purposes.

[0144] As in Figure 7As shown, process 700 may include issuing a spoofing detection report (block 760). The means for performing the operations of block 760 may include the WWAN transceiver 310, memory 340, and processor 332 of UE 302. For example, UE 302 may use transmitter 314, for example, using sidelink communication or other communication, to send a spoofing detection report to a location server (e.g., location server 172, LMF 270, SLP 272) or to another UE. In some aspects, the spoofing detection report identifies the spoofing PRS, for example, by its PRS ID. In some aspects, the spoofing detection report may include the detected direction of the attacker (e.g., the direction from which the spoofing PRS beam is transmitted) (if it can be determined), such that if a sufficient number of other UEs also detect the spoofing PRS and issue spoofing detection reports with a direction, the location or orientation of the transmitter of the spoofing PRS can be determined by triangulation or other angle-based positioning calculations.

[0145] Process 700 may include additional implementations, such as any single implementation or any combination of implementations described below and / or in conjunction with one or more other processes described elsewhere herein. Although Figure 7 The example box for process 700 is shown, but in some implementations, process 700 may include... Figure 7 The boxes depicted in the process are compared to additional boxes, fewer boxes, different boxes, or boxes arranged differently. Additionally or alternatively, two or more boxes in process 700 can be executed in parallel.

[0146] Figure 8 This is a flowchart of an example process 800 associated with PRS spoofing detection and mitigation. In some implementations, Figure 8 One or more process blocks can be executed by the UE (e.g., UE 104). In some implementations, Figure 8 One or more process frames can be executed by another device or group of devices, either separate from or including the user equipment (UE). Additionally or alternatively, Figure 8 One or more process blocks may be executed by one or more components of UE 302, such as processor 332, memory 340 or other storage components, WWAN transceiver 310, short-range wireless transceiver 320, SPS receiver 330, sensors 344, beam profile module 342, and / or user interface 346, wherein any or all of the components may be means for performing the operation of process 800.

[0147] As in Figure 8As shown, process 800 may include determining a beam profile (block 810) of the received Positioning Reference Signal (PRS) beam. Means for performing the operations of block 810 may include the UE 302's WWAN transceiver 310, memory 340, and processors 332. For example, the UE 302 may receive and measure the PRS beam via receivers 312, process the measurement using processors 332, and store the measurement results in memory 340. In some aspects, determining the beam profile includes determining beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, the number and size of beam sidelobes, or combinations thereof.

[0148] As in Figure 8 As further illustrated, process 800 may include sending the beam profile to a network entity (block 820). The means for performing the operation of block 820 may include the WWAN transceiver(s) of UE 302. For example, UE 302 may send the beam profile to a network entity via transmitter(s) 314. In some aspects, sending the beam profile to a network entity includes sending the beam profile to a location server or base station.

[0149] As in Figure 8 As further illustrated, process 800 may include receiving an indication from the network entity regarding whether the PRS beam is valid or invalid (block 830). The means for performing the operation of block 830 may include the WWAN transceivers 310 of UE 302. For example, UE 302 may receive the indication regarding whether the PRS beam is valid or invalid via receivers 312.

[0150] As in Figure 8 As further illustrated, process 800 may include using the received PRS beam if it is determined to be legitimate (box 840), and not using the received PRS beam if it is not determined to be legitimate (box 850). The means for performing the operations of boxes 840 and 850 may include the WWAN transceiver(s) 310 and processor(s) 332 of UE 302. For example, if the received PRS beam is determined to be legitimate, processor(s) 332 may use the PRS beam measurement to determine its own location or transmit the PRS beam measurement to a location server via transmitter(s) 314.

[0151] As in Figure 8As shown, process 800 may include issuing a spoofing detection report (block 860). Apparatus for performing the operations of block 860 may include the UE 302's WWAN transceiver 310, memory 340, and processor 332. In some aspects, the spoofing detection report identifies a spoofing PRS, for example, by its PRS ID. In some aspects, the spoofing detection report may include the detected direction of the attacker (e.g., the direction from which the spoofing PRS beam is transmitted) (if it can be determined).

[0152] Process 800 may include additional implementations, such as any single implementation or any combination of implementations described below and / or in conjunction with one or more other processes described elsewhere herein. Although Figure 8 The example box for process 800 is shown, but in some implementations, process 800 may include... Figure 8 The boxes depicted in the diagram may be fewer, different, or arranged differently compared to additional boxes. Alternatively, two or more boxes in process 800 may be executed in parallel.

[0153] Figure 9 This is a flowchart of an example process 900 associated with PRS spoofing detection and mitigation. In some implementations, Figure 9 One or more process frames can be executed by a network entity (e.g., base station 102 or location server 172, etc.). In some implementations, Figure 9 One or more process frames can be executed by another device or a group of devices that are separate from or include the network entity. Additionally or alternatively, Figure 9 One or more process frames may be executed by one or more components of network entity 306, such as processors 394, memory 396, network transceivers 390 and / or beam profile modules 398, or by one or more components of base station 304, such as processors 384, memory 386, WWAN transceivers 350, short-range radio transceivers 360, SPS receivers 370 and / or beam profile modules 388, wherein any or all of them may be means for performing the operations of process 900. In some aspects, the network entity includes a location server or a base station.

[0154] As in Figure 9As shown, process 900 may include obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a valid Position Reference Signal (PRS) beam (block 910). Means for performing the operations of block 910 may include network transceivers 390, memory 396, and processors 394 of network entity 306. For example, a set of beam profiles already stored in memory 396 may be provided to network entity 306, or network entity 306 may receive the set of beam profiles via network transceivers 390. In some aspects, obtaining the set of one or more beam profiles includes receiving one or more beam profiles, each beam profile from one or more TRPs, such as base stations or other network entities.

[0155] As in Figure 9 As further illustrated, process 900 may include receiving a beam profile of a first PRS beam received by a first user equipment (UE) (block 920). The means for performing the operation of block 920 may include network transceivers 390 of network entity 306. For example, network entity 306 may receive the beam profile of the first PRS beam via network transceivers 390 (e.g., from a base station serving the UE).

[0156] As in Figure 9 As further illustrated, process 900 may include determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with one or more beam profiles from the group of legitimate PRS beams (block 930). Means for performing the operations of block 910 may include a memory 396 and processors 394 of network entity 306. For example, processors 394 of network entity 306 may determine the legitimacy of a received PRS beam based on a comparison of the beam profile of the received PRS beam with one or more beam profiles from the group of legitimate PRS beams, as described above. In some aspects, determining the legitimacy of a received PRS beam includes: determining that the received PRS beam is legitimate if the beam profile of the received PRS beam matches a beam profile from the group of one or more beam profiles, and determining that the received PRS beam is illegitimate if the beam profile of the received PRS beam does not match a beam profile from the group of one or more beam profiles. In some respects, determining the legitimacy of a first PRS beam based on a comparison of the beam profile with a beam profile from a legitimate PRS beam includes: determining the legitimacy of the first PRS beam based on a comparison of the beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, and / or the number and size of the beam sidelobes of the first PRS beam and a legitimate PRS beam.

[0157] As in Figure 9 As further illustrated, process 900 may include sending an indication to the UE regarding the validity of the first PRS beam (block 940). The means for performing the operation of block 940 may include network transceivers 390 of network entity 306. For example, network entity 306 may send an indication regarding the validity of the first PRS beam to the UE via network transceivers 390. In some aspects, sending an indication regarding the validity of the first PRS beam includes sending an indication that the first PRS beam is valid. In some aspects, sending an indication regarding the validity of the first PRS beam includes sending an indication that the first PRS beam is invalid.

[0158] As in Figure 9 As shown, process 900 may include issuing a spoofing detection report (block 950). The means for performing the operations of block 950 may include network transceivers 390 of network entity 306. In some aspects, the spoofing detection report identifies a spoofing PRS, for example, by its PRS ID. In some aspects, the spoofing detection report may include the location from which the spoofing PRS was transmitted (if that location has been determined). Knowing the location from which the spoofing PRS was transmitted helps the UE detect the spoofing PRS more easily. The spoofing detection report may be transmitted on demand to one or more UEs, such as to each UE that may be within range of the spoofing PRS.

[0159] Process 900 may include additional implementations, such as any single implementation or any combination of implementations described below and / or in conjunction with one or more other processes described elsewhere herein. Although Figure 9 The example box for process 900 is shown, but in some implementations, process 900 may include... Figure 9 The boxes depicted in the diagram may be fewer, different, or arranged differently compared to additional boxes. Alternatively, two or more boxes in process 900 may be executed in parallel.

[0160] Figure 10 This is a flowchart of an example process 1000 associated with PRS spoofing detection and mitigation. In some implementations, Figure 10 One or more process frames can be executed by a network entity (e.g., base station 102 or location server 172, etc.). In some implementations, Figure 10 One or more process frames can be executed by another device or a group of devices that are separate from or include the network entity. Additionally or alternatively, Figure 10One or more process frames may be executed by one or more components of network entity 306, such as processors 394, memory 396, network transceivers 390 and / or beam profile modules 398, or by one or more components of base station 304, such as processors 384, memory 386, WWAN transceivers 350, short-range radio transceivers 360, SPS receivers 370 and / or beam profile modules 388, wherein any or all of them may be means for performing the operations of process 1000. In some aspects, the network entity includes a location server or a base station.

[0161] As in Figure 10 As shown, process 1000 may include obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a valid Position Reference Signal (PRS) beam (block 1010). Means for performing the operations of block 1010 may include network transceivers 390, memory 396, and processors 394 of network entity 306. For example, a set of beam profiles already stored in memory 396 may be provided to network entity 306, or network entity 306 may receive the set of beam profiles via network transceivers 390. In some aspects, obtaining the set of one or more beam profiles includes receiving one or more beam profiles, each beam profile from one or more TRPs, such as base stations or other network entities.

[0162] As in Figure 10 As further illustrated, process 1000 may include receiving a measurement of a first PRS beam received by a first user equipment (UE) (block 1020). The means for performing the operation of block 1020 may include network transceivers 390 of network entity 306. For example, network entity 306 may receive the measurement of the first PRS beam via network transceivers 390 (e.g., from a base station serving the UE).

[0163] As in Figure 10As further illustrated, process 1000 may include determining a beam profile of the first PRS beam based on measurements of the first PRS beam (block 1030). Means for performing the operations of block 1030 may include a memory 396 and processors 394 of network entity 306. For example, network entity 306 may receive measurements associated with the PRS beam via network transceivers 390, process the measurements using processors 394, and store the beam profile in memory 396. In some aspects, network entity 306 may post-process the measurements of the PRS beam using different codebooks to determine the beam pattern (including sidelobes). In some aspects, determining the beam profile includes determining beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, the number and size of beam sidelobes, or combinations thereof.

[0164] As in Figure 10 As further illustrated, process 1000 may include determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with one or more beam profiles from a legitimate PRS beam (block 1040). The means for performing the operation of block 1040 may include processor(s) 394 and memory 396 of network node 306. For example, network node 306 may use processor(s) 394 to determine the legitimacy of a received PRS beam based on a comparison of the beam profile of the received PRS beam with one or more beam profiles from a legitimate PRS beam, which are stored in memory 396. In some aspects, determining the legitimacy of a received PRS beam includes: if the beam profile of the received PRS beam matches a beam profile from one or more beam profiles in the group, then the received PRS beam is determined to be legitimate; and if the beam profile of the received PRS beam does not match a beam profile from one or more beam profiles in the group, then the received PRS beam is determined to be illegitimate. In some aspects, determining the legitimacy of a first PRS beam based on a comparison of its beam profile with a beam profile from a legitimate PRS beam includes: determining the legitimacy of the first PRS beam based on a comparison of the first PRS beam's beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, and / or the number and size of its sidelobes with those of a legitimate PRS beam.

[0165] As in Figure 10As further illustrated, process 1000 may include sending an indication to the UE regarding the validity of the first PRS beam (block 1050). The means for performing the operation of block 940 may include network transceivers 390 of network entity 306. For example, network entity 306 may send an indication of the validity of the first PRS beam to the UE via network transceivers 390. In some aspects, sending an indication of the validity of the first PRS beam includes sending an indication that the first PRS beam is valid. In some aspects, sending an indication of the validity of the first PRS beam includes sending an indication that the first PRS beam is invalid.

[0166] As in Figure 10 As shown, process 1000 may include issuing a spoofing detection report (block 1060). The means for performing the operation of block 1060 may include network transceivers 390 of network entity 306. In some aspects, the spoofing detection report identifies a spoofing PRS, for example, by its PRS ID. In some aspects, the spoofing detection report may include the location from which the spoofing PRS was transmitted (if that location has been determined).

[0167] Process 1000 may include additional implementations, such as any single implementation or any combination of implementations described below and / or in conjunction with one or more other processes described elsewhere herein. Although Figure 10 An example box of process 1000 is shown, but in some implementations, process 1000 may include... Figure 10 The boxes depicted in the process are compared to additional boxes, fewer boxes, different boxes, or boxes arranged differently. Additionally or alternatively, two or more boxes of process 1000 can be executed in parallel.

[0168] As will be appreciated, the technical advantage of the methods and apparatus disclosed herein is that they can detect deceptive location signals and mitigate or eliminate the potential harm caused by such deceptive location signals.

[0169] As can be seen in the detailed description above, different features are grouped together in the examples. This manner of disclosure should not be construed as an intention to include more features in the example clauses than are expressly mentioned in each clause. Rather, aspects of this disclosure may include fewer features than those in the individual example clauses disclosed. Therefore, the appended clauses should thus be considered as incorporated into this description, where each clause may be a separate example in itself. Although each dependent clause may refer in its respective clause to a specific combination with one of the other clauses, the aspects of that dependent clause are not limited to that specific combination. It will be appreciated that other example clauses may also include combinations of aspects of the dependent clause with the subject matter of any other dependent or independent clause, or any feature combined with other dependent and independent clauses. The aspects disclosed herein expressly include these combinations unless explicitly stated or readily inferred that a particular combination is not intended (e.g., contradictory aspects, such as defining an element as both an insulator and a conductor). Furthermore, it is intended that aspects of a clause may be included in any other independent clause, even if that clause is not directly subordinate to that independent clause.

[0170] Examples of implementations are described in the following numbered clauses:

[0171] Clause 1. A method for performing wireless communication by a user equipment (UE), the method comprising: obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate positioning reference signal (PRS) beam; determining a beam profile of a received PRS beam; and determining the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with the set of one or more beam profiles from a legitimate PRS beam.

[0172] Clause 2. The method of Clause 1 further includes: if it is determined that the received PRS beam is legitimate, then using the received PRS beam, and if it is not determined that the received PRS beam is legitimate, then not using the received PRS beam.

[0173] Clause 3. The method of any of Clauses 1 to 2, wherein obtaining the set of one or more beam profiles comprises: receiving the set of one or more beam profiles from a network entity.

[0174] Clause 4. The method of Clause 3, wherein receiving the group of one or more beam profiles from the network entity includes: receiving the group of one or more beam profiles from a location server or base station.

[0175] Clause 5. The method of any of Clauses 1 to 4, wherein determining the beam profile of the received PRS beam comprises: measuring the received PRS beam to calculate the beam profile of the received PRS beam based on the measurement of the received PRS beam.

[0176] Clause 6. The method of any of Clauses 1 to 5, wherein determining the legality of a received PRS beam comprises: determining that the received PRS beam is legal if the beam profile of the received PRS beam matches a beam profile from one or more beam profiles in the group, and determining that the received PRS beam is illegal if the beam profile of the received PRS beam does not match a beam profile from one or more beam profiles in the group.

[0177] Clause 7. The method of any of Clauses 1 to 6, wherein determining the beam profile includes: determining the beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, number and size of beam sidelobes, or combinations thereof.

[0178] Clause 8. The method of Clause 7, wherein determining the legitimacy of a received PRS beam based on a comparison of the beam profile with a beam profile from a legitimate PRS beam includes: determining the legitimacy of the received PRS beam based on a comparison of the beamwidth, beam angle, beam elevation, beam azimuth, beam power, or the number and size of the beam sidelobes of the received PRS beam with those of a legitimate PRS beam.

[0179] Clause 9. The method of any of Clauses 1 to 8 further includes: issuing a spoofing detection report that identifies the received PRS beam as spoofing and includes the PRS ID of the received PRS beam, the direction from which the received PRS beam was transmitted, or both.

[0180] Clause 10. A method for performing wireless communication by a user equipment (UE), the method comprising: determining a beam profile of a received positioning reference signal (PRS) beam; transmitting the beam profile to a network entity; and receiving from the network entity an indication as to whether the PRS beam is legitimate or illegitimate.

[0181] Clause 11. The method of Clause 10 further includes: using the PRS beam if it is valid, and not using the PRS beam if it is invalid.

[0182] Clause 12. The method of any of Clauses 10 to 11, wherein determining the beam profile includes: determining the beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, number and size of beam sidelobes, or combinations thereof.

[0183] Clause 13. The method of any of Clauses 10 to 12, wherein sending the beam profile to the network entity includes: sending the beam profile to a location server or base station.

[0184] Clause 14. A method for performing wireless communication by a network entity, the method comprising: obtaining a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a legitimate Positioning Reference Signal (PRS) beam; receiving from a first user equipment (UE) a beam profile of a first PRS beam received by the UE; determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and sending an indication of the legitimacy of the first PRS beam to the UE.

[0185] Clause 15. The method of any of Clauses 15 to 14, wherein obtaining the set of one or more beam profiles comprises: obtaining one or more beam profiles from one or more transmit-receive points (TRPs).

[0186] Clause 16. The method of Clause 15, wherein determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam includes: determining the legitimacy of the first PRS beam based on a comparison of beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, the number and size of beam sidelobes, or combinations thereof.

[0187] Clause 17. The method of any of Clauses 15 to 16, wherein sending an indication of the legitimacy of the first PRS beam includes sending an indication that the first PRS beam is legitimate.

[0188] Clause 18. The method of any of Clauses 15 to 17, wherein sending an instruction on the legality of the first PRS beam includes sending an instruction on the illegality of the first PRS beam.

[0189] Clause 19. The method of any of Clauses 15 to 18, wherein the network entity includes a location server or a base station.

[0190] Clause 20. A method for performing wireless communication by a network entity, the method comprising: obtaining a set of one or more beam profiles, wherein each of the set of one or more beam profiles includes a beam profile of a legitimate Position Reference Signal (PRS) beam; receiving from a first user equipment (UE) a measurement of a first PRS beam received by the UE; determining a beam profile of the first PRS beam based on the measurement of the first PRS beam; determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam with the set of one or more beam profiles from a legitimate PRS beam; and sending an indication of the legitimacy of the first PRS beam to the UE.

[0191] Clause 21. The method of any of Clauses 22 to 20, wherein obtaining the set of one or more beam profiles comprises: obtaining one or more beam profiles from one or more transmit-receive points (TRPs).

[0192] Clause 22. The method of any of Clauses 22 to 21, wherein determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam includes: determining the legitimacy of the first PRS beam based on a comparison of beamwidth, beam angle, beam elevation angle, beam azimuth angle, beam power, the number and size of beam sidelobes, or combinations thereof.

[0193] Clause 23. The method of Clause 22, wherein sending an indication of the legitimacy of the first PRS beam includes sending an indication that the first PRS beam is legitimate.

[0194] Clause 24. The method of any of Clauses 22 to 23, wherein sending an instruction on the legality of the first PRS beam includes sending an instruction on the illegality of the first PRS beam.

[0195] Clause 25. The method of any of Clauses 22 to 24, wherein the network entity includes a location server or a base station.

[0196] Clause 26. An apparatus comprising: a memory, at least one transceiver, and at least one processor communicatively coupled to the memory and the at least one transceiver, the memory, the at least one transceiver, and the at least one processor being configured to perform a method as described in any of Clauses 1 to 25.

[0197] Clause 27. An apparatus comprising means for performing the method according to any one of Clauses 1 to 25.

[0198] Clause 28. A non-transitory computer-readable medium storing computer-executable instructions, including at least one instruction for causing a computer or processor to perform a method according to any one of Clauses 1 to 25.

[0199] Those skilled in the art will appreciate that information and signals can be represented using any of a variety of different techniques and skills. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referred to throughout the above description can be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or light particles, or any combination thereof.

[0200] Furthermore, those skilled in the art will appreciate that the various illustrative logic blocks, modules, circuits, and algorithmic steps described in connection with the aspects disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, the various illustrative components, blocks, modules, circuits, and steps are described above in a generalized manner in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in different ways for each specific application, but such implementation decisions should not be construed as departing from the scope of this disclosure.

[0201] The various illustrative logic blocks, modules, and circuits described in conjunction with the aspects disclosed herein can be implemented or executed using a general-purpose processor, digital signal processor (DSP), ASIC, field-programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in alternatives, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors cooperating with a DSP core, or any other such configuration.

[0202] The methods, sequences, and / or algorithms described in conjunction with the aspects disclosed herein may be embodied directly in hardware, in a software module executed by a processor, or in a combination of both. The software module may reside in random access memory (RAM), flash memory, read-only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art. Example storage media are coupled to a processor so that the processor can read and write information from / to the storage medium. In alternatives, the storage medium may be integrated into the processor. The processor and storage medium may reside in an ASIC. The ASIC may reside in a user terminal (e.g., a UE). In alternatives, the processor and storage medium may reside as discrete components in the user terminal.

[0203] In one or more examples, the described functionality may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functionality may be stored or transmitted as one or more instructions or codes on or through a computer-readable medium. A computer-readable medium includes both computer storage media and communication media, including any medium that facilitates the transfer of a computer program from one location to another. A storage medium may be any available medium accessible to a computer. By way of example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disc storage, disk storage or other magnetic storage devices, or any other medium that can be used to carry or store desired program code in the form of instructions or data structures and is accessible to a computer. Similarly, any connection is also legitimately referred to as a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then such coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. As used in this article, disks and discs include compact discs (CDs), laser discs, optical discs, digital multi-purpose discs (DVDs), floppy disks, and Blu-ray discs. Disks typically reproduce data magnetically, while discs reproduce data optically using lasers. Combinations of these should also be included within the scope of computer-readable media.

[0204] While the foregoing disclosure has illustrated illustrative aspects of this disclosure, it should be noted that various changes and modifications may be made therein without departing from the scope of this disclosure as defined by the appended claims. The functions, steps, and / or actions in the method claims according to the aspects of this disclosure described herein need not be performed in any particular order. Furthermore, although elements of this disclosure may be described or claimed in the singular, pluralism is also contemplated unless explicitly stated to be limited to the singular.

Claims

1. A method for performing wireless communication by a user equipment (UE), the method comprising: Determine the beam profile of the received Positioning Reference Signal (PRS) beam, wherein determining the beam profile of the received PRS beam includes determining the beamwidth, beam power, number and size of beam sidelobes, or combinations thereof, of the received PRS beam. as well as The legitimacy of the received PRS beam is determined by comparing the beam profile of the received PRS beam with one or more beam profiles of a legitimate PRS beam, wherein determining the legitimacy of the received PRS beam includes: determining the legitimacy of the received PRS beam by comparing the beamwidth, beam power, number and size of beam sidelobes, or combinations thereof of the received PRS beam with those of the legitimate PRS beam.

2. The method of claim 1, further comprising: If the received PRS beam is determined to be legitimate, then the received PRS beam is used; if the received PRS beam is not determined to be legitimate, then the received PRS beam is not used.

3. The method of claim 1, further comprising: Issue a spoofing detection report, which identifies the received PRS beam as spoofing and includes the PRS ID of the received PRS beam, the direction from which the received PRS beam was transmitted, or both.

4. The method of claim 1, wherein determining the beam profile of the received PRS beam comprises: The received PRS beam is measured, and the beam profile of the received PRS beam is calculated based on the measurement of the received PRS beam.

5. The method of claim 1, wherein determining the beam profile of the received PRS beam further comprises: Determine the beam angle, beam elevation angle, beam azimuth angle, or a combination thereof of the received PRS beam.

6. The method of claim 1, wherein determining the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with one or more sets of beam profiles of a legitimate PRS beam comprises: Obtain the profiles of one or more beams for a valid PRS beam; as well as The beam profile of the received PRS beam is compared with one or more beam profiles of the legitimate PRS beam.

7. The method of claim 6, wherein obtaining the set of one or more beam profiles comprises: Receive the set of one or more beam profiles from the network entity.

8. The method of claim 6, wherein determining the legitimacy of the received PRS beam comprises: If the beam profile of the received PRS beam matches a beam profile from one or more of the set of beam profiles, the received PRS beam is determined to be valid; if the beam profile of the received PRS beam does not match a beam profile from one or more of the set of beam profiles, the received PRS beam is determined to be invalid.

9. The method of claim 8, wherein determining the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with a beam profile from a legitimate PRS beam further comprises: The legitimacy of the received PRS beam is determined by comparing the beam angle, beam elevation angle, beam azimuth angle, or combinations thereof of the received PRS beam with those of the legitimate PRS beam.

10. The method of claim 1, wherein determining the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with one or more sets of beam profiles of a legitimate PRS beam comprises: Send the beam profile to the network entity; as well as The network entity receives an indication as to whether the PRS beam is legitimate or illegitimate, the indication being based on a comparison by the network entity of the beam profile of the received PRS beam with one or more beam profiles of legitimate PRS beams.

11. A method for performing wireless communication by a network entity, the method comprising: Obtain a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a valid positioning reference signal (PRS) beam. Determine the beam profile of a first PRS beam received by the user equipment (UE), wherein determining the beam profile of the first PRS beam includes determining the beamwidth, beam power, number and size of beam sidelobes, or combinations thereof of the first PRS beam. The legitimacy of the first PRS beam is determined by comparing the beam profile of the first PRS beam with one or more beam profiles from a legitimate PRS beam, wherein determining the legitimacy of the first PRS beam includes: determining the legitimacy of the first PRS beam by comparing the beamwidth, beam power, number and size of beam sidelobes, or combinations thereof, of the first PRS beam with those of the legitimate PRS beam; and Send an indication to the UE regarding the legitimacy of the first PRS beam.

12. The method of claim 11, wherein obtaining the set of one or more beam profiles comprises: Obtain one or more beam profiles from one or more transmit / receive points (TRPs).

13. The method of claim 11, wherein determining the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam further comprises: The legitimacy of the first PRS beam is determined by comparing the beam angle, beam elevation angle, beam azimuth angle, or combinations thereof.

14. The method of claim 11, wherein sending the indication of the legitimacy of the first PRS beam comprises: Send an indication that the first PRS beam is valid or send an indication that the first PRS beam is invalid.

15. The method of claim 11, wherein determining the beam profile of the first PRS beam comprises: The UE receives the beam profile of the first PRS beam.

16. The method of claim 11, wherein determining the beam profile of the first PRS beam comprises: The UE receives measurements of the first PRS beam and determines the beam profile of the first PRS beam based on the measurements.

17. The method of claim 11, further comprising: A deception detection report is issued, which identifies the first PRS beam as deceptive and includes the PRS ID of the first PRS beam, the location from which the first PRS beam is transmitted, or both.

18. A user equipment (UE), comprising: Memory; At least one transceiver; as well as At least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: Determine the beam profile of the received Positioning Reference Signal (PRS) beam, wherein determining the beam profile of the received PRS beam includes determining the beamwidth, beam power, number and size of beam sidelobes, or combinations thereof, of the received PRS beam. as well as The legitimacy of the received PRS beam is determined by comparing the beam profile of the received PRS beam with one or more beam profiles from a legitimate PRS beam, wherein determining the legitimacy of the received PRS beam includes: determining the legitimacy of the received PRS beam by comparing the beamwidth, beam power, number and size of beam sidelobes, or combinations thereof of the received PRS beam with those of the legitimate PRS beam.

19. The UE of claim 18, wherein the at least one processor is further configured to: use the received PRS beam if it is determined that the received PRS beam is legitimate, and not use the received PRS beam if it is not determined that the received PRS beam is legitimate.

20. The UE of claim 18, wherein the at least one processor is configured to: issue a spoofing detection report, the spoofing detection report identifying a received PRS beam as spoofing and including the PRS ID of the received PRS beam, the direction from which the received PRS beam is transmitted, or both.

21. The UE of claim 18, wherein the at least one processor is configured to determine the beam profile of the received PRS beam, comprising: The at least one processor is configured to measure the received PRS beam to calculate the beam profile of the received PRS beam based on the measurement of the received PRS beam.

22. The UE of claim 18, wherein the at least one processor is configured to determine the beam profile, further comprising: The at least one processor is configured to determine the beam angle, beam elevation angle, beam azimuth angle, or a combination thereof.

23. The UE of claim 18, wherein the at least one processor is configured to determine the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with one or more beam profiles from a legitimate PRS beam, comprising: The at least one processor is configured to: Obtain the profiles of one or more beams for a valid PRS beam; as well as The beam profile of the received PRS beam is compared with one or more beam profiles of the legitimate PRS beam.

24. The UE of claim 23, wherein the at least one processor is configured to obtain the one or more beam profiles of a valid PRS beam, comprising: The at least one processor is configured to receive the set of one or more beam profiles from the network entity.

25. The UE of claim 18, wherein the at least one processor is configured to determine the legitimacy of the received PRS beam based on a comparison of the beam profile of the received PRS beam with one or more beam profiles from a legitimate PRS beam, comprising: The at least one processor is configured to determine that the received PRS beam is valid if the beam profile of the received PRS beam matches a beam profile from one or more of the set of beam profiles, and to determine that the received PRS beam is invalid if the beam profile of the received PRS beam does not match a beam profile from one or more of the set of beam profiles.

26. The UE of claim 25, wherein the at least one processor is configured to determine the legitimacy of the received PRS beam based on a comparison of the beam profile with a beam profile from a legitimate PRS beam, further comprising: The at least one processor is configured to determine the legitimacy of the received PRS beam based on a comparison of the received PRS beam with the legitimate PRS beam's beam angle, beam elevation angle, beam azimuth angle, or a combination thereof.

27. The UE of claim 18, wherein the at least one processor is configured to determine the legitimacy of the received PRS beam based on a comparison of the beam profile with a beam profile from a legitimate PRS beam, comprising: The at least one processor is configured to: Send the beam profile to the network entity; as well as The network entity receives an indication as to whether the PRS beam is legitimate or illegitimate, the indication being based on a comparison by the network entity of the beam profile of the received PRS beam with one or more beam profiles of legitimate PRS beams.

28. A network entity, comprising: Memory; At least one transceiver; as well as At least one processor communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: Obtain a set of one or more beam profiles, wherein each beam profile in the set of one or more beam profiles includes a beam profile of a valid positioning reference signal (PRS) beam. Determine the beam profile of a first PRS beam received by the user equipment (UE), wherein determining the beam profile of the first PRS beam includes determining the beamwidth, beam power, number and size of beam sidelobes, or combinations thereof of the first PRS beam. The legitimacy of the first PRS beam is determined by comparing the beam profile of the first PRS beam with one or more beam profiles from a legitimate PRS beam, wherein determining the legitimacy of the first PRS beam includes: determining the legitimacy of the first PRS beam by comparing the beamwidth, beam power, number and size of beam sidelobes, or combinations thereof, of the first PRS beam with those of the legitimate PRS beam; and The at least one transceiver sends an indication to the UE regarding the legitimacy of the first PRS beam.

29. The network entity of claim 28, wherein the at least one processor is configured to obtain the set of one or more beam profiles comprising: The at least one processor is configured to obtain one or more beam profiles from one or more transmit / receive points (TRPs).

30. The network entity of claim 28, wherein the at least one processor is configured to determine the legitimacy of the first PRS beam based on a comparison of the beam profile of the first PRS beam, further comprising: The at least one processor is configured to determine the legitimacy of the first PRS beam based on a comparison of beam angle, beam elevation angle, beam azimuth angle, or a combination thereof.

31. The network entity of claim 28, wherein the at least one processor is configured to cause the at least one transceiver to send an indication of the legitimacy of the first PRS beam, comprising: The at least one processor is configured to cause the at least one transceiver to send an indication that the first PRS beam is valid or an indication that the first PRS beam is invalid.

32. The network entity of claim 28, wherein the at least one processor is configured to determine the beam profile of the first PRS beam, comprising: The at least one processor is configured to receive the beam profile of the first PRS beam from the UE.

33. The network entity of claim 28, wherein the at least one processor is configured to determine the beam profile of the first PRS beam, comprising: The at least one processor is configured to receive measurements of the first PRS beam from the UE, and to determine the beam profile of the first PRS beam based on the measurements of the first PRS beam.

34. The network entity as claimed in claim 28, wherein, The at least one processor is further configured to issue a spoofing detection report, which identifies the first PRS beam as spoofing and includes the PRS ID of the first PRS beam, the location from which the first PRS beam is transmitted, or both.

Images