Device, method and medium for detecting PRACH storm attack

Abstract

A method for PRACH attack detection may include: detecting, by a base station, multiple preamble codes sent by a device via a physical random access channel (PRACH); initiating, by the base station, a random access (RA) process for at least one device for which a preamble code has been detected; decoding, by the base station, at least one radio resource control (RRC) connection request received in the context of the initiated RA process; determining, by the base station, a first metric and a second metric, wherein the first metric is the number of RRC connection requests successfully decoded within a period of time, wherein the second metric is the number of preamble codes detected within the same period of time in which the RA process has been initiated; and determining, based on a comparison result of the first metric and the second metric, whether there is a suspicion of a storm attack on the PRACH.

Description

Technical Field

[0001] Various example embodiments are generally directed to apparatus, methods, and computer programs for detecting a physical random access channel (PRACH) storm attack. Background Art

[0002] From 2G to 5G, radio access network communications have been subject to various attacks in different mobile networks. Although the security between user equipment (UE) and base stations has been strengthened in new mobile generations (4G / 5G), radio-based attacks remain a problem for all operators and UE manufacturers.

[0003] One of the big emerging markets for 5G is the Industrial Internet of Things (IIOT). Dedicated base stations (BTS; in 5G networks: gNB) will be deployed / configured to cover industrial parks using dedicated telecom networks or via network slicing. Attackers who want to target specific industries may seek such dedicated radio access networks.

[0004] Among the various types of attacks, distributed denial of service (DDoS) attacks in general and physical random access channel (PRACH) storm attacks in particular can be particularly stealthy, preventing legitimate devices from attaching to a cell. This attack is a real problem for the industrial world, as it can deny service to an entire industrial park, leading to severe economic losses.

[0005] PRACH storm attacks are difficult to detect because the attacker sends preambles that comply with applicable standards for the random access procedure, making these preambles indistinguishable from preambles sent by genuine user equipment (UE).

[0006] The consequences of such an attack may be degradation of quality indicators of the cell (e.g., key performance indicators (KPIs)), complete or partial attachment DoS, consumption of base station resources (e.g., central processing unit (CPU)), occupation of cell radio resources for random access procedures, and a global impact on cell performance that may lead to a base station reset.

[0007] KR 101853698 B1 discloses a random access method for reducing access congestion in disaster situations.

[0008] US 2010131751 A1 discloses a method and apparatus for performing physical layer security operations. Summary of the invention

[0009] The independent claims define the scope of protection. Embodiments, examples, and features described in this specification that do not fall within the scope of protection (if any) will be interpreted as helping to understand various embodiments and examples that fall within the scope of protection.

[0010] According to a first aspect, a method is provided, comprising: detecting, by a base station, a plurality of preamble codes sent by a device via a physical random access channel (PRACH); detecting, by the base station, a plurality of preamble codes sent by a device via a physical random access channel (PRACH); initiating, by the base station, a random access (RA) process for at least one device for which a preamble code has been detected; decoding, by the base station, at least one radio resource control (RRC) connection request received in the context of the initiated RA process; determining, by the base station, a first metric and a second metric, wherein the first metric is the number of RRC connection requests successfully decoded within a period of time, wherein the second metric is the number of preamble codes detected within the same period of time in which the RA process has been initiated; and determining, based on a comparison result of the first metric with the second metric, whether there is a suspicion of a storm attack on the PRACH.

[0011] When several beams are deployed for defining the radio cell coverage of the base station, the first metric and the second metric are determined per beam.

[0012] Determining whether there is suspicion of a storm attack includes determining that a value of the first metric decreases compared to a value of the second metric, and that a decrease ratio exceeds a threshold value.

[0013] The threshold is determined based on the values ​​of the first metric and the second metric calculated during a learning phase without a storm attack.

[0014] The method may include sending a message from a physical layer to a higher layer, the message including information related to the first metric and the second metric.

[0015] The method may include: when suspicion of a storm attack is determined, starting a PRACH attack detection process.

[0016] The detection process may be based on an analysis of parameters of the signal carrying the detected preamble, wherein the parameters include at least one of: power of a signal peak, timing delay of a signal peak in a RACH search window, and an angle of arrival of the signal in question.

[0017] The analysis may include a correlation analysis between two or more opportunity windows to detect a correlation between values ​​of at least one signal parameter of preambles sent during the two or more opportunity windows, wherein a storm attack is confirmed if a correlation is detected between a first set of preambles sent in a first opportunity window and a second set of preambles sent in at least one second opportunity window, wherein the at least one signal parameter includes at least one of: a time delay within a preamble search window for a signal peak detected for the relevant preamble and a signal power for the signal peak detected for the relevant preamble.

[0018] The detection process may include clustering the detected preambles into two subsets, a first subset including preambles for which correlations were detected, and a second subset including preambles for which correlations were not detected, wherein if the size of the first subset is above a predefined threshold, a storm attack is confirmed.

[0019] The detection process may include: modifying the value of a configuration parameter applicable to a preamble sent via PRACH so as to reduce the radio cell coverage of the base station; sending at least one synchronization signal by the base station, the at least one synchronization signal including the modified value of the configuration parameter; determining that a device outside the radio cell coverage continues to send preambles via PRACH regardless of the modified value of the configuration parameter; and determining that the device outside the radio cell coverage is an attacking device based on the determination.

[0020] The configuration parameters may include at least one of the following: target beam power and synchronization signal block threshold.

[0021] The radio cell coverage of the base station may correspond to the radio coverage of a set of beams, wherein modified values ​​of the configuration parameters are transmitted only via a subset of at least one beam for which suspicion of a storm attack has been detected, in order to selectively reduce the radio cell coverage in the direction of the at least one beam.

[0022] According to another aspect, a base station is provided, which includes a component for executing a method, the method including: detecting, by the base station, multiple preamble codes sent by a device through a physical random access channel PRACH; initiating, by the base station, a random access RA process for at least one device for which the preamble code has been detected; decoding, by the base station, at least one radio resource control RRC connection request received in the context of the initiated RA process; determining, by the base station, a first metric and a second metric, wherein the first metric is the number of RRC connection requests successfully decoded within a period of time, wherein the second metric is the number of preamble codes detected within the same period of time in which the RA process has been initiated; and determining whether there is a suspicion of a storm attack on the PRACH based on a comparison result of the first metric and the second metric.

[0023] Typically, the base station includes a component for performing one or more or all steps of the method disclosed herein (e.g., the method according to the first aspect). The component may include a circuit configured to perform one or more or all steps of the method. The component may include at least one processor and at least one memory, the at least one memory including computer program code, at least one memory and computer program code configured to, with at least one processor, cause the device to perform one or more or all steps of the method.

[0024] According to another aspect, a non-transitory computer-readable medium is provided, storing computer-executable instructions, which, when executed by at least one processor at a base station, cause the base station to perform a method, the method comprising: detecting, by the base station, a plurality of preambles sent by a device via a physical random access channel (PRACH); initiating, by the base station, a random access (RA) procedure for at least one device for which a preamble has been detected; decoding, by the base station, at least one radio resource control (RRC) connection request received in the context of the initiated RA procedure; determining, by the base station, a first metric and a second metric, wherein the first metric is the number of RRC connection requests successfully decoded within a period of time, wherein the second metric is the number of preambles detected within the same period of time in which the RA procedure has been initiated; and determining, based on a comparison result of the first metric and the second metric, whether there is a suspicion of a storm attack on the PRACH. BRIEF DESCRIPTION OF THE DRAWINGS

[0025] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate example embodiments together with the general description given above and the detailed description given below.

[0026] Figure 1 is a flow chart illustrating a random access procedure according to an example, the random access procedure including a UE synchronization procedure to a RAN device and an attach procedure for the UE device.

[0027] Figure 2 is a schematic diagram illustrating aspects of a PRACH attack according to an example.

[0028] Figure 3 is a flow chart illustrating a method for triggering PRACH attack detection according to an example.

[0029] Figure 4 is a flow chart illustrating a method for PRACH attack detection according to an example.

[0030] Figure 5 is a schematic diagram illustrating aspects of a PRACH attack detection process according to an example.

[0031] Figure 6 is a flow chart illustrating a method for PRACH attack detection according to an example.

[0032] Figure 7 is a flow chart illustrating a method for PRACH attack detection according to an example.

[0033] Figure 8 is a block diagram illustrating an exemplary architecture of a communication system according to an example.

[0034] Fig. 9is a block diagram illustrating an exemplary architecture of an apparatus according to an example.

[0035] It should be noted that these drawings are intended to illustrate various aspects of the apparatus, methods, and structures used in the example embodiments described herein. The use of similar or identical reference numerals in the various drawings is intended to indicate the presence of similar or identical elements or features. DETAILED DESCRIPTION

[0036] Detailed example embodiments are disclosed herein. However, the specific structural and functional details disclosed herein are representative only for the purpose of describing the example embodiments. However, it will be understood by those of ordinary skill in the art that the example embodiments may be practiced without these specific details. The example embodiments may be embodied in many alternative forms and should not be construed as being limited to the embodiments set forth herein. Accordingly, although the example embodiments can have various modifications and alternative forms, these embodiments are shown in the accompanying drawings by way of example and will be described in detail herein. However, it should be understood that the example embodiments are not intended to be limited to the specific forms disclosed.

[0037] The method disclosed herein is applicable to detecting PRACH-based attacks in the Radio Access Network (RAN) of 4G, 5G systems and above. The goal is to allow detection of attackers who perform a large number of RACH connections, which consumes all available RACH occasions and prevents authorized UEs (real UEs) from implementing their legitimate RACH procedures and connecting to the Radio Access Network.

[0038] The triggering of the PRACH attack detection process (also referred to herein as the detection process for short) is based on KPIs and metrics related to the RA process occurring and can be easily calculated per beam and / or cell (with or without beamforming deployment).

[0039] Several embodiments for the PRACH attack detection process allow to confirm if there is an attacker sending a large number of PRACH preambles to request to connect to the radio access network. This type of attack is referred to herein as a "storm attack". The PRACH attack detection process can be easily integrated into a base station, a network entity within the O-RAN / RIC framework, or any other entity of the network. The PRACH attack detection process can be integrated as an AI / ML-based use case within the O-RAN framework.

[0040] The method prevents a complete reset of the base station or a reset of the attacked radio cell / beam through intelligent detection of the presence of a PRACH attacker based on a global analysis of all preambles received within a given period of time.

[0041] Since the attacker is leveraging the traditional attach procedure, it is not easy for the operator to distinguish the case of such an attacker from the case of a large number of authorized UEs trying to connect to the radio access network or any other entity of the network.

[0042] exist Figure 1 A simplified sequence diagram of a random access procedure (RAP) 100B is shown in . Prior to the random access procedure (RAP) 100B, a synchronization phase 100A is implemented, during which the base station transmits a synchronization signal on a common channel. The synchronization signal carries a synchronization signal block (SSB).

[0043] If beamforming is used, several beams are deployed by the base station to define the radio cell coverage of the base station. The base station performs beam scanning, selects the beam and the corresponding synchronization signal block (SSB) based on the beam power measurement during the cell search (based on the reference signal received power (RSRP)). After the UE selects the beam, the UE decodes the information of the corresponding SSB and determines the RACH configuration (e.g., "RACH-ConfigCommon" defined in 3GPP specification TS 38.331) based on the corresponding SSB and SIB1 signal.

[0044] The synchronization signal block (SSB) includes a synchronization information master information block (MIB) carried by the physical channel PBCH. The system information block 1 (SIB1) is carried by the PDSCH physical channel and includes cell information about the resources available for performing the random access procedure in the time domain (PRACH format, number of subframes to be used for RAP, number of slots in a subframe, PRACH time instance index, etc.) and frequency domain (frequency instance index of OFDM symbols available for RAP, etc.). The synchronization signal also includes a parameter rsrp-ThresholdSSB, which indicates the minimum power level (of the reference signal received power) to be used by the UE under the radio cell coverage of the base station.

[0045] After the UE obtains the PRACH configuration in the synchronization phase 100A, the UE starts to perform a random access procedure RAP, 100B. For example, in Section 5.1, the random access procedure 100B is defined in the 3GPP specification "Medium Access Control (MAC) Protocol Specification", 3GPP Technical Specification TS 38.321 v16.8.0, March 2022. See, for example, Section 9.2.6 Fig. 9 .2.6-1, various aspects of the random access preamble and the random access procedure are also disclosed in 3GPP technical specification TS 38.300, V17.0.0.

[0046] If beamforming is used for radio cell coverage, the RAP 100B is performed using the selected beam.Since the PRACH resources are accessible to all UEs and two UEs may select the same preamble, the RAP is configured to detect collisions in case of contention.

[0047] The physical random access channel (PRACH) is used to carry a random access preamble for initiating a random access procedure. The random access procedure 100B is a sequence of messages between a user equipment (UE) 110 and a base station 120 (e.g., a gNB in ​​a 5G network) to acquire uplink synchronization and obtain a specific ID for establishing radio communication.

[0048] PRACH signal generation (PRACH preamble) is disclosed in the 3GPP specification "Physical Channels and Modulation", 3GPP Technical Specification TS 38.211 v16.9.0, March 2022, for example in sections 6.3.3 and 5.3.2. The preamble is an orthogonal frequency division multiplexing (OFDM) baseband signal.

[0049] In order to obtain dedicated resources for radio access, the UE first contacts the base station (in the case of 5G communication networks, the base station is designated as a gNB entity, but the process is similar to other mobile radio accesses) using radio resources common to all terminals (including PRACH) and notifies the base station of its access request.

[0050] At step 101, the UE randomly selects one of the 64 available RACH preambles and transmits the selected preamble via PRACH: The first message Msg1 corresponds to the preamble transmitted by the UE 100 to the base station 120. The UE also needs to provide its identity to the base station so that the base station can address the UE in the next steps. The identity that the UE will use is the Random Access Radio Network Temporary Identifier (RA-RNTI), which is determined by the number of time slots in which the preamble is transmitted and other parameters. If the UE does not receive any response from the base station, the UE increases the power by a fixed step size and will transmit another PRACH signal with the same preamble index. The message Msg1 is transmitted during a specific subframe of the frame, which is identified by the PRACH configuration index obtained from the SIB1 information transmitted by the base station during the synchronization phase 100A. Once the preamble is transmitted, the UE terminal listens for a response from the base station during a given time window (e.g., defined by the parameter ra-ResponseWindow in 3PPG TS 38.321).

[0051] At step 102, a message Msg2 is sent by the base station to the UE. The message Msg2 is addressed to the UE identified by the RA-RNTI calculated by the base station according to the number of time slots in which the preamble is sent, and is sent on the physical downlink control channel (PDCCH). The message Msg2 includes a random access response (RAR) transmitted on the physical downlink shared channel (PDSCH). The message Msg2 includes the following information:

[0052] - a temporary identifier for another communication (Cell Radio Network Temporary Identifier (C-RNTI));

[0053] - a timing advance value based on which the base station requests the UE to change its timing to compensate for the round trip delay caused by the distance between the UE and the base station for the next uplink message; and

[0054] - Uplink grant resources (UL grant), in which the base station allocates initial resources to the UE so that the UE can use the physical uplink shared channel (PUSCH) for the next message Msg3.

[0055] At step 103 , the UE sends an “RRC connection establishment request” (Radio Resource Control (RRC)) message Msg3 to the base station using resources allocated on PUSCH, where the UE is identified by a temporary identifier (Temporary C-RNTI (TC-RNTI)) allocated by the base station in the previous step 102 .

[0056] In step 104, the base station responds to Msg3 with message Msg4, which is a contention resolution message sent to the UE whose message Msg3 was received and successfully decoded in step 103. The message Msg4 is sent to the UE identified by the TMSI value or random number, but includes a new C-RNTI, which will be used to identify the UE for another communication. The message Msg4 includes an RRC connection establishment message.

[0057] If the UE does not receive the message before the timer expires or a collision occurs when transmitting Msg3, the random access procedure is considered to have failed. When the UE fails in the random access procedure, the UE reselects the SSB according to the RSRP indication included in the SSB or uses the same SSB to transmit the preamble code after waiting during the backoff window.

[0058] A sequence diagram of a random access procedure 100B for contention-based access has been described. For contention-free access, messages Msg1, Msg2 and Msg3 are also used. Embodiments of the method for triggering PRACH attack detection disclosed herein are applicable to both cases.

[0059] In a PRACH storm attack, the attacker (also referred to as the attacking device in this article) mainly uses the first step of the RACH process ( Figure 1 The attacker can first listen to the PRACH and can use a sufficiently high power level for Msg1 to ensure that its transmit power is higher than the transmit power of all UEs used for RAP.

[0060] The attacker can also monitor the downlink (DL) grant for Msg2 and the uplink (UL) grant for Msg3 to verify whether the base station detects a "fake" preamble. In this way, the attacker can adjust the attack in various ways. The attacker can use different time advance values ​​to simulate various delays, just as if the attacker represents different UEs with different physical locations within the cell. The attacker can select different time and / or frequency occasion indices for each preamble transmission, just as if the attacker represents different UEs.

[0061] In the context of this document, a "fake" preamble may be understood as a preamble that complies with applicable standards but is sent by a malicious device that does not have authorized access and / or a device that wants to interfere with access to the radio network by sending a large number of preambles, for example, with the purpose of generating DDoS, spoofing, etc. As will be described herein, a "fake" preamble may include or rely on erroneous information: a timing delay of a PRACH signal corresponding to an erroneous timing advance, an erroneous UE configuration, etc.

[0062] Figure 2 A simplified example of an attack with 4 possible preambles for a given beam and SSB configuration is shown. At each RACH opportunity window, the attacker 215 transmits all possible false preambles (i.e., 4 preambles P1, P2, P3, and P4 in this example), each with a specific power and timing delay (in order to simulate the presence of different UEs). Another UE 210 (herein referred to as the victim UE) sends preamble P5. The 4 false preambles and the real preamble are detected by the BTS in a predefined preamble search window. For each preamble, the base station 220 selects the highest signal peak of the signal carrying the preamble. Since the power of the preamble P5 sent by the real UE 210 is lower than the power of the false preambles P1, P2, P3, and P4 of the attacker 215, and since there are only 4 possible preambles in the RACH opportunity window, the preamble P5 of the victim UE 210 is not selected by the base station 220, and the base station 220 will not respond to the victim UE 210.

[0063] The attacker's actions can be as follows:

[0064] - During phase 100A, the attacker listens to the synchronization signal (MIB / SIB1 / SI-m signal) of the synchronization phase A to obtain the RACH process configuration parameters (i.e. time and frequency occasion, etc.) for the victim cell;

[0065] - The attacker transmits a fake preamble at each PRACH opportunity window during phase 100B; for example, with beamforming, a limited set of preambles is defined per SSB / beam, and all preambles can be used by the attacker to prevent the real UE from sending preambles;

[0066] The transmission of each preamble may be performed by the aggressor increasing the power (eg, +3 dB) at each opportunity until the maximum transmission power defined in 3GPP Technical Specification TS 38.321 (see Section 5.1.3) is reached.

[0067] Each preamble may be sent with a specific timing delay and different transmission power to simulate the presence of physically different UEs. The goal of the attacker is to get the base station to detect a different UE requesting to attach to the radio access network.

[0068] Note that because PRACH attacks are not easily detected, the attacker can perform this PRACH-based attack instead of blocking. Unlike blocking, interference is not generated, but a preamble that complies with the standard is sent, making it impossible to detect that the preamble was sent by the attacker by analyzing a single preamble.

[0069] In order to be able to detect an attack, an analysis of all preambles and / or all RA procedures received by the base station within a given period of time is performed. The analysis relies on metrics calculated per radio cell or per beam that show the overall RACH performance of the radio cell in question or of the beam in question. The analysis consists of two phases:

[0070] - Phase A: Determine if there is a suspicion of a storm attack on PRACH; and

[0071] - Phase B: If the suspicion of a storm attack has been detected in Phase A, PRACH attack detection is initiated.

[0072] Phase B is performed because after Phase A alone it may not be possible to conclude a storm attack, since various system errors, other possible failures, or the presence of a large number of UEs cannot be excluded.

[0073] Figure 33 is a flow chart of a method 300 for triggering PRACH attack detection. The method corresponds to phase A. The method allows determining whether a trigger condition for initiating PRACH attack detection is met. The method allows determining whether there is a suspicion of a storm attack on PRACH. When the trigger condition is met, the PRACH attack detection process (phase B) can be initiated.

[0074] PRACH attack detection is initiated only when a predefined trigger condition is verified. To this end, metrics are determined and the trigger condition is checked based on these metrics. When beamforming is used, the metrics can be calculated per beam. Otherwise, the metrics can be calculated per radio cell.

[0075] In step 310, the base station performs a RA procedure for one or more UEs requesting access to the radio access network during a period of time (referred to herein as a measurement period). The duration of the measurement period is configurable and may correspond to, for example, 100 radio frames. During the measurement period, the base station performs the following sub-steps.

[0076] In sub-step 310-1, the base station detects multiple preamble codes, and the multiple preamble codes are sent by the device through the physical random access channel PRACH. This sub-step 310-1 may correspond to reference Figure 1 Execution of one or more steps 101 (Msg1) disclosed.

[0077] In sub-step 310-2, the base station initiates a random access RA procedure for at least one device for which a preamble has been detected during sub-step 310-1. This sub-step 310-2 may correspond to reference Figure 1 Execution of one or more steps 102 (Msg2) disclosed.

[0078] In sub-step 310-3, the base station decodes at least one radio resource control RRC connection request received in the context of the RA procedure initiated during sub-step 310-2. This sub-step 310-3 may correspond to reference Figure 1 The decoding of one or more messages Msg3 received in step 103 is disclosed.

[0079] Sub-steps 310-1 to 310-3 may be performed in parallel, such that the base station may, for example, in a sequential manner: 1) detect at least one first preamble; 2) initiate at least one first RA process based on at least one first detected preamble; 3) decode at least one first RRC connection request received in the context of at least one first RA process; 4) detect at least one second preamble; 5) initiate at least one second RA process based at least on the second detected preamble; 6) decode at least one second RRC connection request received in the context of at least one second RA process, and the like.

[0080] In step 320, the base station determines a first metric and a second metric. The first metric and the second metric are calculated for RA procedures performed during the same period of time (referred to herein as a measurement period).

[0081] The first metric Rb is the number of RRC connection requests that are successfully decoded during the measurement period. In this case, successful decoding means that the cyclic redundancy code (CRC) of the Msg3 carrying the RRC connection request is correct. The first metric is useful because the attacker may not necessarily perform a complete RA process for all preambles sent by the attacker, and it is likely that no Msg3 messages will be sent to save hardware and computing resources.

[0082] The second metric Ab is the number of preambles detected over the same measurement period for which the RA procedure has been initiated. It should be noted that the base station (e.g., the L2 layer of the base station) does not have to trigger the RA procedure for each preamble detected by the base station (e.g., for each preamble reported by the L1 layer of the base station to the L2 layer of the base station). According to 3GPP technical specification TS38.300, the L1 layer corresponds to the physical layer "sublayer PHY", and L2 corresponds to the "sublayer MAC".

[0083] When beamforming is used (i.e. when multiple beams are deployed to define the radio cell coverage of the base station), the first metric and the second metric may be determined per beam. The reason is that an attacker may be able (due to limitations in terms of hardware resources) to send the preamble only through a reduced number of beams, possibly only through one beam, so that only a reduced number of beams may be attacked by a given attacker. Therefore, attack detection may be performed per beam. When beamforming is not used, the first metric and the second metric are calculated by the base station per radio cell.

[0084] In step 330, it is determined whether a trigger condition is met. The trigger condition allows determining whether there is a suspicion of a storm attack on the PRACH based on a comparison result of the first metric with the second metric.

[0085] Step 330 may include determining that the value of the first metric Rb decreases compared to the value of the second metric Ab, and the decrease ratio exceeds a threshold value Th. The decrease ratio measures the decrease in the value of the first metric relative to the value of the second metric. The threshold value Th may be determined based on the values ​​of the first metric and the second metric calculated during a reference time period or a learning phase without a storm attack.

[0086] In order to be able to compare the changes in the values ​​of the first and second metric, the KPI may be calculated (per beam or per cell) as a ratio:

[0087] KPI1b=Rb / Ab

[0088] The reverse ratio can also be used:

[0089] KPI2b = Ab / Rb

[0090] If this ratio is below the threshold KPI1n, the trigger condition can be satisfied. In normal mode (i.e., without any attack), the RA process activity / configuration is determined: KPI1 is extracted and used as the threshold KPI1n. The threshold KPI1n constitutes a reference point for triggering condition verification in Figure 3 step 330. The threshold KPI1n is used to determine (initial detection) whether there is a suspicion of an attack. For each valid beam, the trigger condition is: KPI1b < KPI1n. If the trigger condition is satisfied, the suspicion of an attack is detected. Otherwise, if the trigger condition is not satisfied, the suspicion is not detected.

[0091] Other KPIs can be used. The purpose is to use a KPI that allows comparison of Rb and Ab and detection of the difference between the change in Rb and the change in Ab, where the difference is below a given threshold (e.g., below 0.9, 0.8, 0.5, 0.2, 0.1, etc.). For example, Rb can increase by Rb = 10%, while Ab increases by Ab = 50%, given an increase ratio equal to = 0.20. For example, Rb can remain unchanged while Ab increases by 400%, given an increase ratio of 0.25.

[0092] The purpose here is to detect that Rb and Ab do not change in the same proportion. In the absence of any attack, the values of Rb and Ab should change in a similar manner (increase or decrease), unless the maximum capacity of the base station is reached (e.g., in terms of the maximum number of UEs for which the base station can initiate the RA process). But in the case of an attack, Ab can increase significantly while Rb may remain near the maximum value or even decrease.

[0093] In step 340, if the trigger condition is satisfied, the PRACH attack detection process is initiated to detect whether a storm attack has occurred and / or is still in progress during the measurement period. When the suspicion of a storm attack has been determined in step 330, the detection process allows confirmation of whether there is a storm attack on the PRACH. When only one beam is involved in the set of valid beams in the cell, the suspicion of an attack can be raised. Due to equipment cost reasons, it is assumed that the attacker can only attack on a single beam or a small set of beams (adjacent beams).

[0094] In step 340, the base station can send one or more messages (e.g., an alert message) from the L1 layer of the receiver to the higher layer of the base station (e.g., the L2 layer) or to an external supervision module.

[0095] The one or more messages may include information related to the first metric and the second metric (e.g., values ​​of the first metric and the second metric calculated over a measurement time period). When beamforming is used, the alert message may identify a specific beam for which the triggering condition is met. The one or more messages may also include a set of at least one signal parameter for a signal carrying a preamble (including a suspect preamble) detected in a specific RACH opportunity window to allow PRACH attack detection, which will be disclosed in detail below.

[0096] Once the triggering conditions for the defined metrics are verified, a detection process is initiated to detect possible PRACH attacks. In the following, several embodiments of the detection process are disclosed.

[0097] PRACH attack detection based on signal analysis

[0098] In the first embodiment #1, the PRACH attack detection process is based on the signal analysis of the detected preamble. Radio samples (e.g., IQ data) of the preamble detected in the preamble search window used by the base station can be captured from the antenna array for analysis by the base station and / or an external supervision module.

[0099] like Figure 4 As shown, the detection process may include a correlation analysis of the detected preambles and / or a clustering algorithm applied to the preambles.

[0100] One or more clustering algorithms may be used to cluster the preambles into clusters (also referred to herein as subsets). Several clustering algorithms may be used in sequence: a second clustering algorithm is used to refine the subset obtained by the first clustering algorithm, and so on. For example, after the first clustering algorithm; a first subset of "possibly false" preambles and a second subset of "real" preambles are obtained. Then a second clustering algorithm is used to detect "false" preambles in the first subset of "possibly false" preambles. Correlation analysis may also be used to refine the results of the clustering algorithm. Finally, the detected preambles are clustered into two subsets, a first subset including preambles for which correlations are detected and a second subset including preambles for which correlations are not detected, wherein if the size of the first subset is above a predefined threshold, the storm attack is confirmed.

[0101] The detection process can generate two subsets as output: a first subset Cg with preambles from real UEs and a second subset Cf for false preambles. If the second subset Cf is not empty (or the size of the second subset is above a predefined threshold, for example, equal to 0), the storm attack is confirmed.

[0102] The correlation analysis can search for the existence of correlations between preambles. In fact, if the attacker's device transmits multiple preambles in the same window, there will be a high similarity between the received preambles, and the correlation for these preambles can be detected. The correlation analysis can be used to identify a subset of "false" preambles for which correlations exist (for example, the correlation level is above a threshold). Alternatively, the correlation analysis can be used to detect whether a subset of preambles detected as "likely false" by the clustering algorithm is false. If the subset of "false" preambles is not empty, the attack can be confirmed. Otherwise, the attack is not confirmed.

[0103] The clustering algorithm can be based on the UE signal configuration. Each UE can send at most one preamble. The several preambles received in the PRACH search window should be based on the received signal metric (e.g., path loss, arrival angle, received power estimation, SNR (signal-to-noise ratio), or any other metric that can be extracted from the received signal). A clustering algorithm based on these signal metrics can be applied to divide the preambles into two subsets: "possibly false" and "real" preambles. Correlation analysis can be used in combination with two subset detection based on UE configuration to confirm whether correlation exists within the subset of "possibly false" preambles and identify the correlated "false" preambles.

[0104] As an example of a signal metric, the angle of arrival can be used for clustering. If the attacker has a fixed location, the angle of arrival of all preambles sent by the attacker will be the same or very similar. Therefore, the angle of arrival can be used to detect a subset of preambles with substantially the same angle of arrival. The distribution of the values ​​of the angle of arrival can be used to detect a subset of preambles. Correlation analysis can be used in combination with the detection of subsets based on the angle of arrival: the correlation analysis can search for correlations within one subset to identify related "false" preambles with substantially the same angle of arrival, while no such correlation exists for other subsets.

[0105] The result of the RA process can be used for clustering. If no signal power is detected on Msg3 (or the signal power is below a threshold), despite several retransmission commands from the base station, the given preamble index may be marked as "possibly false", and eventually the RA process results in failure. Therefore, the preambles can be clustered into two subsets based on the results of the RA process. Correlation analysis can be used in combination with subset detection based on the results of the RA process: the correlation analysis can search for correlations that exist within a subset of preambles, while the RA process results in the inability to identify the relevant "false" preambles.

[0106] The correlation analysis may be based on an analysis of a set of at least one signal parameter of the signal carrying the detected preamble. The analysis may be performed in the time domain and / or the frequency domain. The set of at least one signal parameter may be reported by a PRACH receiver on the L1 layer of the base station to the L2 layer and / or the external supervision module of the base station. The set of at least one signal parameter may include, for each detected preamble, at least one of the following:

[0107] -Preamble signal peak power;

[0108] - The time delay of the signal peak in the preamble search window; the time delay corresponds to the initial value of the time advance reported by the PRACH receiver on the L1 layer of the base station to the L2 layer of the base station;

[0109] -The angle of arrival of the preamble signal.

[0110] The set of at least one signal parameter may also include a time instance and a frequency instance. However, it is assumed that the attacker can change the selection of the time instance and the frequency instance selected for each preamble index for each PRACH opportunity window.

[0111] A correlation analysis may be performed between two or more opportunity windows to detect a correlation between values ​​of at least one signal parameter of preambles sent during the two or more opportunity windows. A storm attack is confirmed if a correlation is detected between a first set of preambles sent in a first opportunity window and a second set of preambles sent in at least one second opportunity window. For example, a correlation is detected if the correlation level exceeds a correlation threshold.

[0112] Different types of correlations can be searched. For example, an attacker can:

[0113] - Always use the same time delay and power level for the preamble sent by the attacker from one opportunity window to the next;

[0114] - always use the same time delay, but increase the power level stepwise from one opportunity window to the next;

[0115] - always using the same power level, but the associated time delay varies from one opportunity window to the next;

[0116] -Change the number of preambles;

[0117] - Performing any combination of the above by varying the time delay and / or power level and / or number of preambles.

[0118] For example, the preamble index may always have the same timing delay and signal power. In the RA procedure, when the real UE does not receive the message Msg2, the real UE typically transmits with the same preamble index but with increasing power from one opportunity window to the next opportunity window.

[0119] The correlation analysis may search for correlations that exist for values ​​of time delay and power level with the goal of detecting two subsets of preambles: a first subset including preambles for which correlations were detected and a second subset including preambles for which correlations were not detected.

[0120] An example of a clustering algorithm combined with correlation analysis will be described in the context of a single attacker device. However, using the same principles, it can be easily adapted to multiple attacker devices.

[0121] The first clustering step is based on a first signal metric: here it is the angle of arrival. The angle of arrival (AoA) is calculated for each preamble detected. Preambles belonging to the same AoA range are placed in the same cluster. It provides the creation of a first set of clusters (assumed to be N clusters) separated in the spatial domain. If an attacker is taking action, its device should be located in one of these clusters. After this first clustering step, a cluster should contain abnormally high preamble values. This cluster is designated C' f , is chosen and assumed to contain a set of false preambles and possible real preambles that are spatially co-located with the attacker device. There may be several clusters C′ f as candidate clusters.

[0122] Alternatively, a combination of different signal metrics (path loss, received power estimation, signal-to-noise ratio (SNR), etc.) can be used to refine the initial cluster C′ f Creation.

[0123] In the second clustering step, a correlation analysis may be performed to identify false preambles in the initial clusters. The correlation analysis may be performed using the Euclidean distance as a correlation measure. The Euclidean distance is used to identify the clusters C′ obtained after the first clustering step. f A set of false preambles in . Assume that these preambles are subject to the same distortion introduced by the wireless channel. The analysis can be based on Zadoff-Chu sequence correlation as follows.

[0124] For the preamble code p, the preamble code p and the conjugate root Zadoff-Chu sequence z for the same preamble code p are p The multiplication results in the vector Y p It can be given by the following equation:

[0125]

[0126] Where: r p is the signal received in the frequency domain (output of the Fast Fourier Transform (FFT)) and corresponds to the preamble p detected in the time domain;

[0127] is the conjugate root Zadoff-Chu sequence z for the preamble p p

[0128] Y p is the conjugate root Zadoff-Chu sequence z for the preamble p p The complex vector multiplication output of (normalized);

[0129] L RA is the length of the vector, for example L RA = 139 or 839, depending on the preamble format configured by the network (see 3GPP Technical Specification 38.211, Section 5.3.2);

[0130] Then the inverse fast Fourier transform (iFFT) is applied to the vector Y p , to obtain the vector X in the time domain p For iFFT, vector Y p can be padded with zeros to form a RA =139 is a 256-byte data or for L RA = 839 is a data of length 1024. IFFT is applied to Y p To obtain the vector X in the time domain p , corresponding to a correlation vector that can be used for correlation analysis. The power of the correlation vector (from different antennas in the case of a receive antenna array) can be averaged to perform peak detection.

[0131] The correlation analysis is performed by calculating the detected two preamble codes p a and p b The vector X obtained Pa and X Pb Start. 2 preamble codes p a and p b can be chosen arbitrarily. The Euclidean distance d Pa，Pb In the two vectors X Pa and X Pb is calculated (see Equation 2) and compared with a threshold.

[0132] d Pa，Pb =||X Pa -X Pb || 2 (2)

[0133] If dPa，Pb If the value is lower than the threshold, the preamble p a and p b Placed by C f Otherwise, the preamble p a and p b are placed in two different clusters: C g and C f Initially, these clusters are empty. After this stage, f The two preamble codes after processing are removed.

[0134] In an iterative manner, the vector X Pc For C′ f Get the next leading code p c is obtained, and the Euclidean distance is used for cluster C f The vector obtained from the preamble in is calculated. If the Euclidean distance value is lower than the threshold, the preamble code p c Placed in cluster C f Otherwise, the leading code p c Placed in C g This iterative process ends at C′ f Processing of the last preamble available in .

[0135] At the end of the algorithm, 2 clusters were formed: C with preambles that had significant correlation f (e.g., relevance level is above a threshold): X a and X b The Euclidean distance d between the two Xa，Xb The value is below the threshold of the preamble and X a and X b There is no significant correlation between the two (ie, the Euclidean distance is above the threshold) of another preamble (C g ). The first cluster is assumed to contain a set of false preambles. The second cluster contains f The remaining real preamble extracted.

[0136] C f May be empty. If it is empty, the algorithm proceeds by choosing C′ f Another candidate to restart.

[0137] Optionally, in the third step, the result of the RAP of each valid preamble can be used to merge the two clusters obtained after the correlation analysis. Each cluster can be refined (removed or added elements) according to the decoding result of Msg3 in the next frame. For example, if it is assumed that the attacker does not send any message Msg3, then the number of clusters present in C g But the signal power is not detected for the preamble of Msg3 transport block is added to Cf Similarly, the existence of C f The preamble whose signal power is detected for the Msg3 transport block is added to C g In addition, RAP can be targeted to C f Each preamble code is stopped in order to save resources of the base station.

[0138] The correlation analysis and / or clustering may be performed by the base station, or by a supervision module that reports a set of parameters of the detected preamble to confirm an attack on the PRACH. The supervision module may be hosted in any network entity, such as in a RIC that interfaces with the O-RAN standard.

[0139] For example, the supervision module at the RIC processes information and / or radio samples received from the base station (e.g., radio samples of baseband signals received by (multiple) antennas (e.g., by multiple antennas). These radio samples may correspond to antenna signals for suspicious preamble detection in the preamble search window.

[0140] The main advantage of the first embodiment #1 is that it relies on the use of existing parameters and does not require reconfiguration of radio cell parameters as in the second embodiment #2 (described below), which may be harmful to real UEs. In addition, for the first embodiment #1, the solution to the attack can be simplified because the base station can simply not trigger any random access procedures for preambles that are classified into the subset of false preambles.

[0141] PRACH attack detection based on radio cell coverage reduction

[0142] In the second embodiment #2, the PRACH attack detection process is based on the radio cell parameter reconfiguration causing the radio cell coverage to be reduced. The second embodiment #2 requires less processing resources than the first embodiment #1 because the second embodiment #2 does not include any radio sample processing. Also for the second embodiment #2, the QoS may be reduced as the radio cell coverage is reduced, and some real UEs in the CONNECTED state may be lost. However, if the attack is not detected, it may result in a complete denial of service (DoS), or require a radio cell lock / unlock or a beam reset or a cell reset, or possibly a reset of the base station.

[0143] In a second embodiment #2, a configuration parameter affecting the preamble sent over the PRACH is changed in order to reduce the radio cell coverage of the base station. The configuration parameter is a radio cell coverage configuration parameter and may be at least one of: a target beam power (a minimum power for sending a preamble) and an SSB threshold (e.g., see parameter rsrp-ThresholdSSB).

[0144] The configuration parameter may be changed all at once or may be changed stepwise. The base station informs the device of the change in the configuration parameter by sending at least one synchronization signal during phase 100A, the synchronization signal comprising the modified value of the configuration parameter to be used for the next transmission of the preamble of the PRACH. For example, by reconfiguring the radio cell via an update of SIB1 information, the change in the value of the configuration parameter is notified to the UE.

[0145] For example, if the configuration parameter is a target beam power, the target beam power may be decreased stepwise.

[0146] For example, if the configuration parameter is an SSB threshold, the SSB threshold (eg, rsrp-ThresholdSSB) may be set to a first value Th5, such as Figure 5 As shown, they are sequentially and gradually increased to Th4, Th3, Th2, and Th1, so that

[0147] Th5 <Th4<Th3<Th2<Th1

[0148] And the radio cell coverage is reduced here also at each step.

[0149] By gradually decreasing the cell coverage, the base station may detect at some step (e.g., based on beam power measurements (e.g., RSRP, Reference Signal Received Power) and / or time delays of PRACH signals sent by the device) that the device falls outside of the radio cell coverage, but continues to send preambles via PRACH in an attempt to connect to the radio cell regardless of the modified value of the parameter.

[0150] Instead, a real UE will try to connect via another beam (if beamforming is used) or another cell (if no beamforming is used) because its SSB power is too low compared to the SSB threshold.

[0151] Furthermore, if the preambles are transmitted by real UEs, a subset of these preambles will not be detected and the amount of detected preambles will decrease. This change can be detected by counting the number of preambles detected within an opportunity window or preamble search window used by the base station to detect the preambles sent in step 101 within the opportunity window.

[0152] If the details of the suspected set of preambles remain the same over a timing delay that should not be identified, the attack is confirmed due to this inconsistency. In other cases, the attacker can consider a change in the configuration parameters. The attacker can then adjust the attack by changing the transmission delay of the false preamble. If the same number of preambles are detected, the attack can also be confirmed.

[0153] The configuration parameter rsrp-ThresholdSSB may be set differently per beam, and using a dedicated value of rsrp-ThresholdSSB for each beam is compatible with future developments of the standard.

[0154] If there is an attacker, the base station can determine that the attacker's device continues to send preambles through PRACH to request access to the radio access network via a radio cell managed by the base station while falling outside the radio cell coverage, regardless of the modified value of the configuration parameter. The real UE usually detects that it is outside the radio cell coverage of the base station and attempts to request a connection through another radio cell or another beam.

[0155] When the configuration parameters are changed (either gradually or all at once), the base station may continue to calculate the values ​​of the first metric and the second metric to determine whether suspicion of an attack is still detected.

[0156] Based on the determination that the attacker's device continues to send preambles via the PRACH, the base station can confirm that the device is the attacker's device. Therefore, the PRACH attack can be confirmed and detected.

[0157] When beamforming is used (so that the radio cell coverage of the base station corresponds to the radio coverage of the beam set), the beam in which the PRACH attack occurs can be identified by the first metric Rb and the second metric and Ab: if the trigger condition for this particular beam is met, then this beam is concerned by the PRACH attack. In this case, the modified value of the directional configuration parameter is transmitted only through the relevant beam and the associated SSB, instead of reducing the radio cell coverage in all directions, where the suspicion of a storm attack has been detected in stage A based on the first metric Rb and the second metric Ab, so as to selectively reduce the radio cell coverage in the direction of the relevant beam.

[0158] Figure 6 1 is a flow chart illustrating the interaction between various entities for triggering a PRACH attack detection process and implementing the PRACH attack detection process according to an example. The PRACH attack detection process is implemented by a supervisory module. The supervisory module may be within the RIC or operations administration and maintenance (OAM), or within another entity within the network.

[0159] In step 610, the base station calculates a first metric Rb and a second metric Ab for a measurement period. During this measurement period, the attacker may send a false preamble, but it is assumed that no Msg3 is sent by the attacker. The metric may be calculated per beam or per cell.

[0160] In step 620, the base station determines whether a trigger condition for initiating a PRACH attack detection process is met based on a comparison of the values ​​of the first metric Rb and the second metric Ab obtained in step 610. If the trigger condition is met, suspicion of an attack is detected, and if the trigger condition is met, step 630 is performed after step 620.

[0161] In step 630, the base station reports a set of measurement data to the supervision module. The set of measurement data may include:

[0162] - the values ​​of the first metric Rb and the second metric Ab for the measurement period obtained in step 610; and / or

[0163] - a set of at least one preamble signal parameter determined by the base station (e.g., power of a signal peak, time delay of a signal peak, angle of arrival); and / or

[0164] - Radio samples (or at least a subset of radio samples) of the preamble detected during the measurement period.

[0165] In step 640, the supervisory module receives the set of measurement data.

[0166] In step 650, the supervision module initiates signal analysis (correlation analysis and / or clustering based on one of the embodiments #1) based on the measurement data set to confirm whether there is a PRACH attack or not.

[0167] In step 660 , if the PRACH attack is confirmed in step 650 , step 670 is performed after step 660 .

[0168] A solution to the attack is implemented in step 670. For example, the solution may include not initiating any RA process for the detected false preamble and / or dispatching a technician to the site to locate and remove the attacking device.

[0169] Figure 7 1 is a flow chart illustrating the interaction between various entities for triggering a PRACH attack detection process and implementing the PRACH attack detection process according to an example. The PRACH attack detection process is implemented by a supervisory module. The supervisory module may be within the RIC or operations administration and maintenance (OAM), or within another entity within the network.

[0170] In step 710, the first metric Rb and the second metric Ab are calculated by the base station for a measurement period. During this measurement period, the attacker may send a false preamble, but it is assumed that the attacker does not send Msg3. The metric may be calculated per beam or per cell.

[0171] In step 720, the base station determines whether a trigger condition for initiating a PRACH attack detection process is met based on a comparison of the values ​​of the first metric Rb and the second metric Ab obtained in step 710. If the trigger condition is met, suspicion of an attack is detected, and if the trigger condition is met, step 730 is performed after step 720.

[0172] In step 730, the base station reports a set of measurement data to the supervision module. The set of measurement data may include:

[0173] - the values ​​of the first metric Rb and the second metric Ab for the measurement period obtained in step 710;

[0174] - a set of at least one preamble signal parameter determined by the base station (e.g., power of signal peak, time delay of signal peak, angle of arrival); and or

[0175] - Radio samples (or at least a subset of the radio samples) of the preamble detected during the measurement period. In step 740, the supervisory module receives the set of measurement data.

[0176] In step 750, the supervisory module sends a request to the base station to request a radio cell parameter reconfiguration resulting in a reduction in radio cell coverage (based on one of embodiment #2). The supervisory module will then wait for new values ​​of the first metric and the second metric to determine whether the suspicion of an attack is confirmed after the reduction in radio cell coverage.

[0177] In step 760 , if the PRACH attack is confirmed in step 750 , step 770 is performed after step 760 .

[0178] In step 770, a solution to the attack is implemented. For example, the solution may include not initiating any RA process for the detected false preamble and / or dispatching a technician to the site to locate and remove the attacking device.

[0179] The existing O-RAN / RIC architecture and its existing interface with base stations (e.g., gNBs) can easily integrate the PRACH attack detection process disclosed herein. This integration can be performed in at least two ways.

[0180] According to the first approach, the PRACH attack detection process is implemented at the gNB level: In this scheme, the gNB is able to use the available information at the gNB to support the proposed PRACH attack detection process. The process will then run in a near real-time manner, but at the cost of additional computational work that should be supported at the gNB.

[0181] According to the second approach, PRACH attack detection is implemented at the O-RAN / RIC level. Another possibility provided by the established O-RAN / RIC framework is to leverage the existing interfaces and capabilities of O-RAN / RAC in order to run the RACH attack detection method as a software tool (e.g., an xAPP that can be used by the RIC to manage network functions). Figure 8 As shown, the necessary data collected from the gNB can be transmitted to the xAPP via interface E2. Figure 8 A detailed view of the network architecture is provided, where our approach runs as an xAPP 810 within a RIC 815.

[0182] Those skilled in the art will appreciate that any functions, engines, block diagrams, flow charts, state transition diagrams, flow charts, and / or data structures described herein represent conceptual views of illustrative circuits that embody the principles of the present invention. Similarly, it will be appreciated that any flow charts, flow charts, state transition diagrams, pseudocodes, etc. represent various processes that can be substantially represented in a computer-readable medium and executed by a computer or device, whether or not such a computer or processor is explicitly shown.

[0183] Although a flowchart may describe operations as a sequential process, many of the operations may be performed in parallel, concurrently, or simultaneously. In addition, some operations may be omitted, combined, or performed in a different order. A process may terminate when its operations are completed, but may also have additional steps not disclosed in the diagram or description. A process may correspond to a method, a function, a procedure, a subroutine, a subprogram, etc. When a process corresponds to a function, its termination may correspond to a return of the function to the calling function or the main function.

[0184] Each described function, engine, block, step described herein may be implemented in hardware, software, firmware, middleware, microcode, or any suitable combination thereof.

[0185] When implemented in software, firmware, middleware, or microcode, instructions for performing the necessary tasks may be stored in a computer-readable medium, which may or may not be included in a host device or host system. Instructions may be transmitted via a computer-readable medium and loaded onto a host device or host system. These instructions are configured to cause the host device / host system to perform one or more functions disclosed herein. For example, as described above, according to one or more examples, at least one memory may include or store instructions, and at least one memory and instructions may be configured to use at least one processor to cause the host device or host system to perform one or more functions. In addition, the processor, memory, and instructions act as a component for providing or enabling the execution of one or more functions disclosed herein by a host device or host system.

[0186] The host device or host system can be a general purpose computer and / or computing system, a special purpose computer and / or computing system, a programmable processing device and / or system, a machine, etc. The host device or host system can be or include or be part of: a user device, a client device, a mobile phone, a laptop computer, a computer, a network element, a data server, a network resource controller, a network device, a router, a gateway, a network node, a computer, a cloud-based server, a web server, an application server, a proxy server, etc.

[0187] Fig. 9 An exemplary embodiment of an apparatus 1000 is shown. The apparatus 1000 may be a host device or a part of a host system as disclosed herein. The apparatus 1000 may be a base station or a network entity (or a part thereof) as disclosed herein.

[0188] The device 1000 may include at least one processor 1010 and at least one memory 1020. The device 1000 may include one or more communication interfaces 1040 (e.g., a network interface for accessing a wired / wireless network, including an Ethernet interface, a WIFI interface, a USB interface, etc.), connected to the processor and configured to communicate via a wired / non-wired communication link. The device 1000 may include other associated hardware, such as a user interface 1030 (e.g., a keyboard, a mouse, a display screen, etc.) connected to the processor. The device 1000 may also include one or more media drives 1050 for reading computer-readable storage media (e.g., a digital storage disk 1060 (CD-ROM, DVD, Blu-ray, etc.), a USB key 1080, etc.). The processor 1010 is connected to each of the other components 1030, 1040, 1050 to control their operation.

[0189] The memory 1020 may include random access memory (RAM), cache memory, non-volatile memory, backup memory (e.g., programmable or flash memory), read-only memory (ROM), hard disk drive (HDD), solid-state drive (SSD), or any combination thereof. The ROM of the memory 1020 may be configured to store, among other things, one or more computer program codes of an operating system and / or one or more software applications of the device 1000. The RAM of the memory 1020 may be used by the processor 1010 for temporary storage of data.

[0190] The processor 1010 can be configured to store, read, load, execute and / or otherwise process instructions 1070 stored in computer-readable storage media 1060, 1080 and / or memory 1020, so that when the instructions are executed by the processor, the device 1000 performs one or more or all steps of the method described herein for the device 1000 involved.

[0191] Instructions can correspond to computer program instructions, computer program codes and can include one or more code segments. Code segments can represent any combination of steps, functions, subroutines, programs, routines, subroutines, modules, software packages, classes or instructions, data structures or program statements. Code segments can be coupled to another code segment or hardware circuit by transmitting and / or receiving information, data, independent variables, parameters or memory contents. Information, independent variables, parameters, data, etc. can be transmitted, forwarded or transmitted via any suitable technology, including memory sharing, message transmission, tag transmission, network transmission, etc.

[0192] When provided by a processor, the functionality may be provided by a single dedicated processor, a single shared processor, or multiple separate processors, some of which may be shared. The term "processor" should not be interpreted as referring only to hardware capable of executing software, and may implicitly include one or more processing circuits. A processor or similar processing circuit may correspond to a digital signal processor (DSP), a network processor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a system on a chip (SoC), a central processing unit (CPU), a quantum processor, an arithmetic logic unit (ALU), a programmable logic unit (PLU), a processing core, programmable logic, a microprocessor, a controller, a microcontroller, a microcomputer, any device capable of responding and / or executing instructions in a defined manner and / or according to defined logic. Other conventional or customized hardware may also be included. A processor or processing circuit may be configured to execute instructions suitable for causing a host device or host system to perform one or more functions of a host device or host system disclosed herein.

[0193] A computer-readable medium or computer-readable storage medium may be any storage medium suitable for storing instructions readable by a computer or processor. More generally, a computer-readable medium may be any storage medium capable of storing and / or containing and / or carrying instructions and / or data. A computer-readable medium may be a portable or fixed storage medium. A computer-readable medium may include one or more storage devices, such as a permanent mass storage device, a magnetic storage medium, an optical storage medium, a digital storage disk (CD-ROM, DVD, Blu-ray, etc.), a USB key or dongle or peripheral device, a memory card, a random access memory (RAM), a read-only memory (ROM), a core memory, a flash memory, or any other non-volatile storage.

[0194] A memory suitable for storing instructions may be, for example, a random access memory (RAM), a read-only memory (ROM), a permanent mass storage device such as a disk drive, a hard disk drive (HDD), a solid-state drive (SSD), a memory card, a random access memory, a read-only memory, a core memory, a flash memory, or any combination thereof.

[0195] In this specification, "a component configured to perform one or more functions" or "a component for performing one or more functions" may correspond to one or more functional blocks, which include circuits suitable for performing or configured to perform the relevant functions. The block may perform the function by itself, or cooperate and / or communicate with other one or more functional blocks to perform the function. "Component" may correspond to or be implemented as "one or more modules", "one or more devices", "one or more units", etc. The component may include at least one processor and at least one memory, the at least one memory including computer program code, wherein the at least one memory and the computer program code are configured to use the at least one processor to enable a host device or a host system to perform the relevant function.

[0196] The term "circuitry" as used in this application may refer to one or more or all of the following:

[0197] (a) hardware circuit implementation only (such as implementation only in analog and / or digital circuits) and

[0198] (b) a combination of hardware circuitry and software, such as (as applicable): (i) a combination of analog and / or digital hardware circuitry and software / firmware, and (ii) any portion of a hardware processor and software (including a digital signal processor), software and memory that work together to enable a device (such as a mobile phone or server) to perform various functions; and

[0199] (c) A hardware circuit and / or processor, such as a microprocessor or portion of a microprocessor, requires software (e.g., firmware) to operate, but where software is not required for operation, the software may be absent.

[0200] This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of only a hardware circuit or processor (or multiple processors) or a portion of a hardware circuit or processor and its (or their) accompanying software and / or firmware. The term circuitry also covers, for example and if applicable to the specifically claimed element, an integrated circuit for a network element or network node or any other computing device or network device.

[0201] The term circuitry may encompass digital signal processor (DSP) hardware, network processors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), etc. A circuit may be or may include, for example, hardware, programmable logic, a programmable processor that executes software or firmware, and / or any combination thereof (e.g., a processor, a control unit / entity, a controller) to execute instructions or software and control the transmission and reception of signals and memory to store data and / or instructions.

[0202] The circuitry may also make decisions or determinations, generate frames, packets, or messages for transmission, decode received frames or messages for further processing, and other tasks or functions described herein. The circuitry may control the transmission of signals or messages over a radio network, and may control the reception of signals or messages, etc., via one or more communication networks.

[0203] Although the terms first, second, etc. may be used to describe various elements in this article, these elements should not be limited by these terms. These terms are only used to distinguish one element from another element. For example, without departing from the scope of the present disclosure, a first element may be referred to as a second element, and similarly, a second element may be referred to as a first element. As used herein, the term "and / or" includes any and all combinations of one or more associated listed items.

[0204] The terms used herein are only used for the purpose of describing specific embodiments and are not intended to be limiting. As used herein, the singular forms "a", "an", and "the" are also intended to include the plural forms unless the context clearly indicates otherwise. It will be further understood that the terms "comprises" and / or "comprising" when used herein specify the presence of the features, integers, steps, operations, elements, and / or components, but do not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0205] Although various aspects of the present disclosure have been specifically shown and described with reference to the above embodiments, it will be understood by those skilled in the art that various additional embodiments may be considered by modifying the disclosed machines, systems and methods without departing from the scope of the disclosure. Such embodiments should be understood to fall within the scope of the present disclosure as determined based on the claims and any equivalents thereof.

[0206] List of main abbreviations

[0207] BTS Base Station

[0208] KPI Key Performance Indicator

[0209] MIB Master Information Block

[0210] OFDM Orthogonal Frequency Division Multiplexing

[0211] O-RAN Open Radio Access Network

[0212] PRACH Physical Random Access Channel

[0213] RIC radio intelligent controller

[0214] SIB system information broadcast

[0215] SSB Synchronous Signal Block

[0216] UE User Equipment

Claims

1. A method of communication, comprising: Detecting, by the base station, a plurality of preamble codes sent by the device via a physical random access channel PRACH; Initiating, by the base station, a random access RA procedure for at least one device for which a preamble has been detected; decoding, by the base station, at least one Radio Resource Control, RRC, Connection Request received in the context of an initiated RA procedure; determining, by the base station, a first metric and a second metric, wherein the first metric is a number of successfully decoded RRC connection requests within a period of time, wherein the second metric is a number of preambles detected within the same period of time in which a RA procedure has been initiated; determining whether there is a suspicion of a storm attack on the PRACH based on a comparison result of the first metric and the second metric; When the suspicion of a storm attack is determined, the PRACH attack detection process is started. 2 . The method according to claim 1 , wherein when several beams are deployed for defining the radio cell coverage of the base station, the first metric and the second metric are determined per beam. 3 . The method according to claim 1 , wherein determining whether there is suspicion of a storm attack comprises determining that a value of the first metric decreases compared to a value of the second metric, and a decrease ratio exceeds a threshold. 4 . The method of claim 3 , wherein the threshold is determined based on values ​​of the first metric and the second metric calculated during a learning phase without a storm attack.

5. The method according to claim 1 or 2, comprising: A message is sent from a physical layer to a higher layer, the message including information related to the first metric and the second metric.

6. A method according to claim 1 or 2, wherein the detection process is based on an analysis of parameters of a signal carrying the detected preamble code, wherein the parameters include at least one of the following: the power of a signal peak, the time delay of a signal peak in a preamble code search window, and the arrival angle of the signal.

7. The method of claim 6, wherein the analysis comprises a correlation analysis between two or more windows of opportunity to detect a correlation between values ​​of at least one signal parameter of the preambles sent during the two or more windows of opportunity, wherein the storm attack is confirmed if a correlation is detected between a first set of preambles sent in a first opportunity window and a second set of preambles sent in at least one second opportunity window, The at least one signal parameter comprises at least one of the following: a time delay of a signal peak in a preamble search window detected for the preamble and a power of a signal peak detected for the preamble.

8. A method according to claim 1 or 2, wherein the detection process includes clustering the detected preambles into two subsets, the first subset includes preambles for which correlations are detected, and the second subset includes preambles for which correlations are not detected, wherein if the size of the first subset is above a predefined threshold, the storm attack is confirmed.

9. The method according to claim 2, wherein implementing the detection process comprises: modifying a value of a configuration parameter applicable to a preamble sent over the PRACH so as to reduce radio cell coverage of the base station; sending, by the base station, at least one synchronization signal, the at least one synchronization signal including the modified value of the configuration parameter; determining that a device outside of coverage of the radio cell continues to transmit preambles over the PRACH regardless of the modified value of the configuration parameter; Based on the determination that the device that is out of coverage of the radio cell continues to send preambles through the PRACH regardless of the modified value of the configuration parameter, it is determined that the device that is out of coverage of the radio cell is an aggressor device.

10. The method according to claim 9, wherein the configuration parameters include at least one of the following: a target beam power and a synchronization signal block threshold.

11. A method according to claim 9 or 10, wherein the radio cell coverage of the base station corresponds to the radio coverage of a beam set, and wherein the modified value of the configuration parameter is transmitted only through a subset of at least one beam for which suspicion of a storm attack has been detected so as to selectively reduce the radio cell coverage in the direction of the at least one beam.

12. A base station, comprising: at least one processor; as well as at least one memory including computer program code, the at least one memory and the computer program code being configured to, with the at least one processor, cause the base station to perform a method, the method comprising: Detecting, by the base station, a plurality of preamble codes sent by the device via a physical random access channel PRACH; Initiating, by the base station, a random access RA procedure for at least one device for which a preamble has been detected; decoding, by the base station, at least one Radio Resource Control, RRC, Connection Request received in the context of an initiated RA procedure; determining, by the base station, a first metric and a second metric, wherein the first metric is a number of successfully decoded RRC connection requests within a period of time, wherein the second metric is a number of preambles detected within the same period of time in which a RA procedure has been initiated; determining whether there is a suspicion of a storm attack on the PRACH based on a comparison result of the first metric and the second metric; and When the suspicion of a storm attack is determined, the PRACH attack detection process is started.

13. A non-transitory computer readable medium storing computer executable instructions which, when executed by at least one processor at a base station, cause the base station to perform a method comprising: Detecting, by the base station, a plurality of preamble codes sent by the device via a physical random access channel PRACH; Initiating, by the base station, a random access RA procedure for at least one device for which a preamble has been detected; decoding, by the base station, at least one Radio Resource Control, RRC, Connection Request received in the context of an initiated RA procedure; determining, by the base station, a first metric and a second metric, wherein the first metric is a number of successfully decoded RRC connection requests within a period of time, wherein the second metric is a number of preambles detected within the same period of time in which a RA procedure has been initiated; determining whether there is a suspicion of a storm attack on the PRACH based on a comparison result of the first metric and the second metric; as well as When the suspicion of a storm attack is determined, the PRACH attack detection process is started.

Images