Sharing positioning measurement-based secret keys between network entities

Abstract

Aspects presented herein provide an improved secret key sharing scheme based on positioning measurements in which network device pairs may extract SKs from channels associated with positioning and use the SKs to secure some unsecure channels and further improve the security of other channels such as PDSCH and PUSCH from the PHY security perspective. In an aspect, a UE performs one or more positioning measurements based on a set of signals from at least one network node, where the one or more positioning measurements are associated with at least one of a location of the UE or a location of the at least one network node. The UE selects a secret key for communication with the at least one network node based on the one or more positioning measurements. The UE communicates with the at least one network node based on the secret key.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Greek application serial number 20220100428, filed on May 23, 2022, entitled “POSITIONING MEASUREMENT BASED SECRET KEY SHARING BETWEEN NETWORKENTITIES”, the entire text of which is expressly incorporated herein by reference. Technical Field

[0003] The present disclosure relates generally to communication systems, and more particularly to communication systems with regard to communication security. Background Art

[0004] Wireless communication systems are widely deployed to provide a variety of telecommunication services, such as telephony, video, data, messaging, and broadcast. Typical wireless communication systems may employ multiple access technologies capable of supporting communication with multiple users by sharing available system resources. Examples of such multiple access technologies include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single carrier frequency division multiple access (SC-FDMA) systems, and time division synchronous code division multiple access (TD-SCDMA) systems.

[0005] These multiple access technologies have been adopted in various telecommunication standards to provide a common protocol that enables different wireless devices to communicate at a city, country, region, or even global level. An example telecommunication standard is 5G New Radio (NR). 5G NR is part of the continued mobile broadband evolution promulgated by the Third Generation Partnership Project (3GPP) to meet new requirements associated with latency, reliability, security, scalability (e.g., with the Internet of Things (IoT)) and other requirements. 5G NR includes services associated with enhanced mobile broadband (eMBB), massive machine type communications (mMTC), and ultra-reliable low latency communications (URLLC). Certain aspects of 5G NR may be based on the 4G Long Term Evolution (LTE) standard. Further improvements to 5G NR technology are needed. In addition, these improvements may also be applicable to other multiple access technologies and telecommunication standards that employ these technologies. Summary of the invention

[0006] A simplified summary of one or more aspects is presented below to provide a basic understanding of these aspects. This summary is not an extensive review of all contemplated aspects. This summary is neither intended to identify key or important elements of all aspects, nor to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to a more detailed description presented later.

[0007] In one aspect of the present disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus receives one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of a location of a user equipment (UE) or a location of the at least one network node. The apparatus selects a secret key for communication with the at least one network node based on the one or more positioning measurements. The apparatus communicates with the at least one network node based on the secret key.

[0008] In one aspect of the present disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus receives one or more positioning measurements based on a signal set from at least one network node, wherein the one or more positioning measurements are associated with at least one of a location of the UE or a location of the at least one network node. The apparatus selects a secret key for communication of the at least one network node based on the one or more positioning measurements. The apparatus sends an indication of the secret key to the at least one network node.

[0009] In one aspect of the present disclosure, a method, a computer readable medium, and an apparatus are provided. The apparatus is configured to send at least one parameter of a signal set. The apparatus selects a secret key for communication with a second network node based on the at least one parameter. The apparatus sends the signal set to the second network node based on the at least one parameter and the secret key.

[0010] To achieve the aforementioned and related purposes, one or more aspects include the features fully described below and particularly pointed out in the claims. The following description and the accompanying drawings set forth in detail some exemplary features of one or more aspects. However, these features are only indicative of only some of the various ways in which the principles of the various aspects can be employed. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a diagram illustrating an example of a wireless communication system and an access network.

[0012] Figure 2A is a diagram illustrating an example of a first frame according to various aspects of the present disclosure.

[0013] Figure 2Bis a diagram illustrating an example of downlink (DL) channels within a subframe according to aspects of the present disclosure.

[0014] Figure 2C is a diagram illustrating an example of a second frame according to various aspects of the present disclosure.

[0015] Figure 2D is a diagram illustrating an example of uplink (UL) channels within a subframe according to aspects of the present disclosure.

[0016] Figure 3 is a diagram illustrating an example of a base station and a user equipment (UE) in an access network.

[0017] Figure 4 is a diagram illustrating an example of UE positioning based on reference signal measurement.

[0018] Figure 5A is a diagram illustrating example downlink-positioning reference signal (DL-PRS) resource patterns in accordance with various aspects of the present disclosure.

[0019] Figure 5B is a diagram illustrating example DL-PRS resource patterns according to various aspects of the present disclosure.

[0020] Figure 5C is a diagram illustrating example DL-PRS resource patterns according to various aspects of the present disclosure.

[0021] Figure 5D is a diagram illustrating example DL-PRS resource patterns according to various aspects of the present disclosure.

[0022] Figure 5E is a diagram illustrating example DL-PRS resource patterns according to various aspects of the present disclosure.

[0023] Fig. 5F is a diagram illustrating example DL-PRS resource patterns according to various aspects of the present disclosure.

[0024] Figure 5G is a diagram illustrating example DL-PRS resource patterns according to various aspects of the present disclosure.

[0025] Figure 5H is a diagram illustrating example DL-PRS resource patterns according to various aspects of the present disclosure.

[0026] Figure 6 is a diagram illustrating an example scenario in which communications between a base station and a UE may be tampered with by another UE according to various aspects of the present disclosure.

[0027] Figure 7is a communication flow illustrating an example secret key extraction according to channel randomness in accordance with various aspects of the present disclosure.

[0028] Figure 8 is a communication flow illustrating an example secret key extraction based on positioning measurements according to various aspects of the present disclosure.

[0029] Fig. 9 is a diagram illustrating an example scenario in which a potential eavesdropper / attacker in the vicinity of a UE generates the same secret key (SK) as the UE in accordance with various aspects of the present disclosure.

[0030] Fig.10 is a diagram illustrating an example of a base station modifying a positioning measurement or uncertainty associated with a positioning measurement based on a quality metric provided by a UE according to various aspects of the present disclosure.

[0031] Fig.11 is a flow chart of a method of wireless communication.

[0032] Fig.12 is a flow chart of a method of wireless communication.

[0033] Fig.13 are diagrams illustrating examples of hardware implementations for example apparatuses and / or network entities.

[0034] Fig.14 is a flow chart of a method of wireless communication.

[0035] Fig.15 is a flow chart of a method of wireless communication.

[0036] Fig.16 are diagrams illustrating examples of hardware implementations for example apparatuses and / or network entities.

[0037] Fig.17 is a flow chart of a method of wireless communication.

[0038] Fig.18 are diagrams illustrating examples of hardware implementations for example apparatuses and / or network entities.

[0039] Fig.19 are diagrams illustrating examples of hardware implementations for example apparatuses and / or network entities. DETAILED DESCRIPTION

[0040] Aspects presented herein can improve the security and integrity of wireless communications. Aspects presented herein provide a new type of secret key (SK) sharing scheme based on positioning measurements, wherein a network device / entity pair can be configured to extract the SK from a channel associated with positioning and use the SK to secure some unsecure channels (e.g., PUCCH, DCI, etc.) and / or further improve the security of other channels such as PDSCH and PUSCH from a PHY security perspective.

[0041] The detailed description set forth below in conjunction with the accompanying drawings is a description of various configurations and does not represent the only configurations with which the concepts described herein can be practiced. In order to provide a thorough understanding of the various concepts, the specific embodiments include specific details. However, these concepts can be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form to avoid blurring these concepts.

[0042] Several aspects of the telecommunication system are also presented with reference to various apparatuses and methods. These apparatuses and methods are described in the following detailed description and illustrated in the accompanying drawings by various blocks, components, circuits, processes, algorithms, etc. (collectively referred to as "elements"). These elements can be implemented using electronic hardware, computer software, or any combination thereof. Whether these elements are implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system.

[0043] As an example, an element, or any part of an element, or any combination of elements can be implemented as a "processing system" including one or more processors. Examples of processors include microprocessors, microcontrollers, graphics processing units (GPUs), central processing units (CPUs), application processors, digital signal processors (DSPs), reduced instruction set computing (RISC) processors, systems on chip (SoCs), baseband processors, field programmable gate arrays (FPGAs), programmable logic devices (PLDs), state machines, gate logic, discrete hardware circuits, and other suitable hardware configured to perform various functionalities described throughout the present disclosure. One or more processors in a processing system can execute software. Whether referred to as software, firmware, middleware, microcode, hardware description language, or other terms, software should be broadly interpreted as meaning instructions, instruction sets, codes, code segments, program codes, programs, subroutines, software components, applications, software applications, software packages, routines, subroutines, objects, executables, threads of execution, processes, functions, or any combination thereof.

[0044] Thus, in one or more example aspects, specific implementations and / or use cases, the described functionality may be implemented in hardware, software, or any combination thereof. If implemented in software, the functionality may be stored or encoded as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media. Storage media may be any available media that can be accessed by a computer. For example, such computer-readable media may include random access memory (RAM), read-only memory (ROM), electrically erasable programmable ROM (EEPROM), optical disk storage, magnetic disk storage, other magnetic storage devices, combinations of these types of computer-readable media, or any other medium that can be used to store computer-executable code in the form of instructions or data structures that can be accessed by a computer.

[0045] Although various aspects, specific implementations and / or use cases are described in this application by the illustration of some examples, additional or different aspects, specific implementations and use cases may be generated in many different arrangements and scenarios. The various aspects, specific implementations and / or use cases described herein can be implemented across many different platform types, devices, systems, shapes, sizes and packaging arrangements. For example, various aspects, specific implementations and / or use cases can be generated via integrated chip specific implementations and other devices based on non-module components (e.g., end-user devices, vehicles, communication equipment, computing equipment, industrial equipment, retail / purchase equipment, medical equipment, devices that enable artificial intelligence (AI), etc.). Although some examples may or may not be specifically for use cases or applications, the described examples may have a wide range of applicability. Various aspects, specific implementations and / or use cases can be in the range from chip-level or modular components to non-modular, non-chip-level specific implementations, and further to the range of aggregated, distributed or original equipment manufacturer (OEM) equipment or systems in conjunction with one or more technologies herein. In some practical environments, the equipment in conjunction with the various aspects and features described may also include additional components and features for implementing and practicing the claimed and described aspects. For example, the transmission and reception of wireless signals necessarily include multiple components for analog and digital purposes (e.g., hardware components including antennas, RF chains, power amplifiers, modulators, buffers, processors, interleavers, adders / summers, etc.) The various techniques described herein can be practiced in a wide variety of devices, chip-level components, systems, distributed arrangements, aggregated or disaggregated components, end-user devices, etc., of various sizes, shapes, and configurations.

[0046] The deployment of a communication system (such as a 5G NR system) can be arranged with various components or components in a variety of ways. In a 5G NR system or network, a network node, a network entity, a mobility element of a network, a radio access network (RAN) node, a core network node, a network element or network equipment such as a base station (BS), or one or more units (or one or more components) performing base station functionality can be implemented in an aggregated or decomposed architecture. For example, a BS (such as a Node B (NB), an evolved NB (eNB), an NR BS, a 5G NB, an access point (AP), a transmit receive point (TRP) or a cell, etc.) can be implemented as an aggregated base station (also referred to as an independent BS or a monolithic BS) or a decomposed base station.

[0047] A converged base station may be configured to utilize a radio protocol stack physically or logically integrated within a single RAN node. A decomposed base station may be configured to utilize a protocol stack physically or logically distributed between two or more units, such as one or more central or centralized units (CUs), one or more distributed units (DUs), or one or more radio units (RUs). In some aspects, a CU may be implemented within a RAN node, and one or more DUs may be co-located with the CU, or alternatively, may be geographically or virtually distributed in one or more other RAN nodes. A DU may be implemented to communicate with one or more RUs. Each of a CU, a DU, and a RU may be implemented as a virtual unit, i.e., a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit.

[0048] Base station operation or network design may take into account the aggregated nature of base station functionality. For example, a disaggregated base station may be utilized in an integrated access backhaul (IAB) network, an open radio access network (O-RAN (network configuration such as that initiated by the O-RAN Alliance)), or a virtualized radio access network (vRAN, also known as a cloud radio access network (C-RAN)). Decomposition may include distributing functionality across two or more units at various physical locations, as well as virtually distributing functionality of at least one unit, which may enable flexibility in network design. Individual units of a disaggregated base station or disaggregated RAN architecture may be configured for wired or wireless communication with at least one other unit.

[0049] Figure 11 is a diagram 100 illustrating an example of a wireless communication system and an access network. The illustrated wireless communication system includes a disaggregated base station architecture. The disaggregated base station architecture may include one or more CUs 110 that may communicate directly with a core network 120 via a backhaul link, or indirectly with the core network 120 through one or more disaggregated base station units, such as a near real-time (near RT) RAN intelligent controller (RIC) 125 via an E2 link, or a non-real-time (non-RT) RIC 115 associated with a service management and orchestration (SMO) framework 105, or both. The CU 110 may communicate with one or more DUs 130 via corresponding midhaul links, such as an F1 interface. The DU 130 may communicate with one or more RUs 140 via corresponding fronthaul links. The RU 140 may communicate with corresponding UEs 104 via one or more radio frequency (RF) access links. In some implementations, a UE 104 may be served simultaneously by multiple RUs 140.

[0050] Each of the units (i.e., CU 110, DU 130, RU 140, and near-RT RIC 125, non-RT RIC 115, and SMO framework 105) may include or be coupled to one or more interfaces configured to receive or send signals, data, or information (collectively, signals) via a wired or wireless transmission medium. Each of the units or an associated processor or controller that provides instructions to the communication interfaces of these units may be configured to communicate with one or more of the other units via a transmission medium. For example, these units may include a wired interface configured to receive signals on a wired transmission medium or send signals to one or more of the other units. Additionally, these units may include a wireless interface that may include a receiver, transmitter, or transceiver (such as an RF transceiver) configured to receive signals on a wireless transmission medium or send signals to one or more of the other units, or both.

[0051] In some aspects, CU 110 may host one or more higher layer control functions. Such control functions may include radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP), etc. Each control function may be implemented with an interface configured to communicate signals with other control functions hosted by CU 110. CU 110 may be configured to handle user plane functionality (i.e., central unit-user plane (CU-UP)), control plane functionality (i.e., central unit-control plane (CU-CP)), or a combination thereof. In some specific implementations, CU 110 may be logically split into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RA configuration, the CU-UP unit may communicate bidirectionally with the CU-CP unit via an interface (such as an E1 interface). As needed, CU 110 may be implemented to communicate with DU 130 for network control and signaling.

[0052] DU 130 may correspond to a logical unit that includes one or more base station functions for controlling the operation of one or more RUs 140. In some aspects, DU 130 may host one or more of a radio link control (RLC) layer, a medium access control (MAC) layer, and one or more high physical (PHY) layers (such as modules for forward error correction (FEC) encoding and decoding, scrambling, modulation and demodulation, etc.) depending at least in part on a functional split such as that defined by 3GPP. In some aspects, DU 130 may also host one or more low PHY layers. Each layer (or module) may be implemented with an interface that is configured to communicate signals with other layers (and modules) hosted by DU 130 or with control functions hosted by CU 110.

[0053] The lower layer functionality may be implemented by one or more RUs 140. In some deployments, the RUs 140 controlled by the DUs 130 may correspond to logical nodes that host RF processing functions or low PHY layer functions (such as performing fast Fourier transforms (FFTs), inverse FFTs (iFFTs), digital beamforming, physical random access channel (PRACH) extraction and filtering, etc.), or both, based at least in part on functional splits (such as lower layer functional splits). In such an architecture, the RUs 140 may be implemented to handle over-the-air (OTA) communications with one or more UEs 104. In some implementations, real-time and non-real-time aspects of control plane and user plane communications with the RUs 140 may be controlled by the corresponding DUs 130. In some scenarios, such a configuration may enable the DUs 130 and CUs 110 to be implemented in a cloud-based RAN architecture (such as a vRAN architecture).

[0054] The SMO framework 105 may be configured to support RAN deployment and configuration of non-virtualized network elements and virtualized network elements. For non-virtualized network elements, the SMO framework 105 may be configured to support the deployment of dedicated physical resources for RAN coverage requirements, which may be managed via an operation and maintenance interface (such as an O1 interface). For virtualized network elements, the SMO framework 105 may be configured to interact with a cloud computing platform (such as an open cloud (O-Cloud) 190) to perform network element lifecycle management (such as instantiating virtualized network elements) via a cloud computing platform interface (such as an O2 interface). Such virtualized network elements may include, but are not limited to, CU 110, DU 130, RU 140, and near-RT RIC 125. In some specific implementations, the SMO framework 105 may communicate with hardware aspects of the 4G RAN (such as an open eNB (O-eNB) 111) via the O1 interface. Additionally, in some specific implementations, the SMO framework 105 may communicate directly with one or more RUs 140 via the O1 interface. The SMO framework 105 may also include a non-RT RIC 115 configured to support the functionality of the SMO framework 105 .

[0055] The non-RT RIC 115 may be configured to include logic functions that enable non-real-time control and optimization of RAN elements and resources, artificial intelligence (AI) / machine learning (ML) (AI / ML) workflows including model training and updating, or policy-based guidance of applications / features in the near-RT RIC 125. The non-RT RIC 115 may be coupled to or in communication with the near-RT RIC 125 (such as via an A1 interface). The near-RT RIC 125 may be configured to include logic functions that enable near-real-time control and optimization of RAN elements and resources via data collection and actions through an interface (such as via an E2 interface) that connects one or more CUs 110, one or more DUs 130, or both, and the O-eNB with the near-RT RIC 125.

[0056] In some implementations, in order to generate an AI / ML model to be deployed in the near-RT RIC 125, the non-RT RIC 115 may receive parameters or external enrichment information from an external server. Such information may be utilized by the near-RT RIC 125 and may be received from a non-network data source or from a network function at the SMO framework 105 or the non-RT RIC 115. In some examples, the non-RT RIC 115 or the near-RT RIC 125 may be configured to tune RAN behavior or performance. For example, the non-RT RIC 115 may monitor long-term trends and patterns in performance and employ AI / ML models to perform corrective actions through the SMO framework 105 (such as via reconfiguration of O1) or via the creation of RAN management policies (such as A1 policies).

[0057] At least one of the CU 110, the DU 130, and the RU 140 may be referred to as a base station 102. Therefore, the base station 102 may include one or more of the CU 110, the DU 130, and the RU 140 (each component is indicated by a dotted line to indicate that each component may be included in the base station 102 or may not be included in the base station). The base station 102 provides an access point to the core network 120 for the UE 104. The base station 102 may include a macro cell (a high-power cellular base station) and / or a small cell (a low-power cellular base station). Small cells include femto cells, pico cells, and micro cells. A network including both small cells and macro cells may be referred to as a heterogeneous network. A heterogeneous network may also include a home evolved Node B (eNB) (HeNB), which may provide services to a restricted group referred to as a closed subscriber group (CSG). The communication link between RU 140 and UE 104 may include uplink (UL) (also known as reverse link) transmission from UE 104 to RU 140 and / or downlink (DL) (also known as forward link) transmission from RU 140 to UE 104. The communication link may use multiple-input multiple-output (MIMO) antenna technology, including spatial multiplexing, beamforming and / or transmission diversity. The communication link may be through one or more carriers. For each carrier allocated in a carrier aggregation of up to Yx MHz (x component carriers) for transmission in each direction, the base station 102 / UE 104 may use a spectrum of up to Y MHz (e.g., 5MHz, 10MHz, 15MHz, 20MHz, 100MHz, 400MHz, etc.) bandwidth. The carriers may or may not be adjacent to each other. The allocation of carriers may be asymmetric with respect to DL and UL (e.g., more or fewer carriers may be allocated to DL compared to UL). The component carrier may include a primary component carrier and one or more secondary component carriers. The primary component carrier may be referred to as a primary cell (PCell) and the secondary component carrier may be referred to as a secondary cell (SCell).

[0058] Some UEs 104 may communicate with each other using a device-to-device (D2D) communication link 158. The D2D communication link 158 may use DL / UL wireless wide area network (WWAN) spectrum. The D2D communication link 158 may use one or more side link channels, such as a physical side link broadcast channel (PSBCH), a physical side link discovery channel (PSDCH), a physical side link shared channel (PSSCH), and a physical side link control channel (PSCCH). The D2D communication may be through a variety of wireless D2D communication systems, such as, for example, Bluetooth, Wi-Fi based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard, LTE, or NR.

[0059] The wireless communication system may also include a Wi-Fi AP 150 that communicates with a UE 104 (also referred to as a Wi-Fi station (STA)) via a communication link 154, for example, in a 5 GHz unlicensed spectrum, etc. When communicating in an unlicensed spectrum, the UE 104 / AP 150 may perform a clear channel assessment (CCA) to determine whether a channel is available prior to communication.

[0060] The electromagnetic spectrum is typically subdivided into various categories, bands, channels, etc. based on frequency / wavelength. In 5GNR, two initial operating bands have been identified as frequency range designations FR1 (410 MHz-7.125 GHz) and FR2 (24.25 GHz-52.6 GHz). Although a portion of FR1 is greater than 6 GHz, FR1 is often referred to (interchangeably) as the "below 6 GHz" band in various documents and articles. A similar naming problem sometimes occurs with respect to FR2, which is often (interchangeably) referred to as the "millimeter wave" band in documents and articles, although it is different from the extremely high frequency (EHF) band (30 GHz-300 GHz) identified as the "millimeter wave" band by the International Telecommunication Union (ITU).

[0061] The frequencies between FR1 and FR2 are generally referred to as mid-band frequencies. Recent 5G NR research has identified the operating bands for these mid-band frequencies as frequency range designation FR3 (7.125GHz-24.25GHz). The frequency bands falling within FR3 can inherit FR1 characteristics and / or FR2 characteristics, and therefore the features of FR1 and / or FR2 can be effectively extended to mid-band frequencies. In addition, currently exploring higher frequency bands to extend 5G NR operation to more than 52.6GHz. For example, three higher operating bands have been identified as frequency range designation FR2-2 (52.6GHz-71GHz), FR4 (71GHz-114.25GHz) and FR5 (114.25GHz-300GHz). Each of these higher frequency bands falls within the EHF band.

[0062] In view of the above, unless otherwise specifically stated, if the term "below 6 GHz" or the like is used in this document, it may broadly refer to frequencies that may be less than 6 GHz, may be within FR1, or may include mid-band frequencies. In addition, unless otherwise specifically stated, if the term "millimeter wave" or the like is used in this document, it may broadly refer to frequencies that may include mid-band frequencies, may be within FR2, FR4, FR2-2, and / or FR5, or may be within the EHF band.

[0063] The base station 102 and the UE 104 may each include multiple antennas (such as antenna elements, antenna panels, and / or antenna arrays) to facilitate beamforming. The base station 102 may send a beamformed signal 182 to the UE 104 in one or more transmit directions. The UE 104 may receive the beamformed signal from the base station 102 in one or more receive directions. The UE 104 may also send a beamformed signal 184 to the base station 102 in one or more transmit directions. The base station 102 may receive the beamformed signal from the UE 104 in one or more receive directions. The base station 102 / UE 104 may perform beam training to determine the best receive direction and transmit direction for each of the base station 102 / UE 104. The transmit direction and receive direction for the base station 102 may or may not be the same. The transmit direction and receive direction of the UE 104 may or may not be the same.

[0064] The base station 102 may include and / or be referred to as a gNB, a Node B, an eNB, an access point, a base transceiver station, a radio base station, a radio transceiver, a transceiver function, a basic service set (BSS), an extended service set (ESS), a transmit receive point (TRP), a network node, a network entity, a network equipment, or some other suitable term. The base station 102 may be implemented as an integrated access and backhaul (IAB) node, a relay node, a sidelink node, an aggregated (monolithic) base station with a baseband unit (BBU) (including a CU and a DU) and a RU, or as a decomposed base station including one or more of a CU, a DU, and / or a RU. A set of base stations that may include decomposed base stations and / or aggregated base stations may be referred to as a next generation (NG) RAN (NG-RAN).

[0065] The core network 120 may include an access and mobility management function (AMF) 161, a session management function (SMF) 162, a user plane function (UPF) 163, a unified data management (UDM) 164, one or more location servers 168, and other functional entities. AMF 161 is a control node that handles signaling between UE 104 and the core network 120. AMF 161 supports registration management, connection management, mobility management, and other functions. SMF 162 supports session management and other functions. UPF 163 supports packet routing, packet forwarding, and other functions. UDM 164 supports the generation of authentication and key agreement (AKA) credentials, user identity handling, access authorization, and subscription management. One or more location servers 168 are illustrated as including a gateway mobile location center (GMLC) 165 and a location management function (LMF) 166. However, in general, the one or more location servers 168 may include one or more location / positioning servers, which may include one or more of the GMLC 165, the LMF 166, the position determination entity (PDE), the serving mobile location center (SMLC), the mobile positioning center (MPC), etc. The GMLC 165 and the LMF 166 support UE location services. The GMLC 165 provides an interface for clients / applications (e.g., emergency services) to access UE positioning information. The LMF 166 receives measurement results and assistance information from the NG-RAN and the UE 104 via the AMF 161 to calculate the location of the UE 104. The NG-RAN may determine the location of the UE 104 using one or more positioning methods. Positioning the UE 104 may involve signal measurements, position estimation, and optional speed calculations based on these measurements. Signal measurements may be performed by the UE 104 and / or the serving base station 102. The measured signals may be based on a satellite positioning system (SPS) 170 (e.g., one or more of a global navigation satellite system (GNSS), a global positioning system (GPS), a non-terrestrial network (NTN), or other satellite positioning / positioning systems), LTE signals, wireless local area network (WLAN) signals, Bluetooth signals, a terrestrial beacon system (TBS), sensor-based information (e.g., an atmospheric pressure sensor, a motion sensor), an NR enhanced cell ID (NR E-CID) method, NR signals (e.g., multi-round trip time (multi-RTT), DL angle of departure (DL-AoD), DL time difference of arrival (DL-TDOA), UL time difference of arrival (UL-TDOA), and UL angle of arrival (UL-AoA) positioning), and / or one or more of other systems / signals / sensors.

[0066] Examples of UE 104 include cellular phones, smart phones, session initiation protocol (SIP) phones, laptops, personal digital assistants (PDAs), satellite broadcasts, global positioning systems, multimedia devices, video devices, digital audio players (e.g., MP3 players), cameras, game consoles, tablet devices, smart devices, wearable devices, vehicles, electric meters, gas pumps, large or small kitchen appliances, healthcare equipment, implants, sensors / actuators, displays, or any other similarly functional devices. Some of the UEs in UE 104 may be referred to as IoT devices (e.g., parking meters, gas pumps, toasters, vehicles, heart monitors, etc.). UE 104 may also be referred to as stations, mobile stations, user stations, mobile units, user units, wireless units, remote units, mobile devices, wireless devices, wireless communication devices, remote devices, mobile user stations, access terminals, mobile terminals, wireless terminals, remote terminals, handsets, user agents, mobile clients, clients, or some other suitable terms. In some scenarios, the term UE may also be applied to one or more supporting devices, such as in a device constellation arrangement. One or more of these devices may access the network collectively and / or individually.

[0067] Reference again Figure 1 In certain aspects, the UE 104 may be configured to perform one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of the location of the UE or the location of the at least one network node; select a secret key for communication with the at least one network node based on the one or more positioning measurements; and communicate with the at least one network node based on the secret key via the SK generation and application component 198. In certain aspects, the one or more location servers 168 may be configured to receive one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of the location of the UE or the location of the at least one network node; select a secret key for communication with the at least one network node based on the one or more positioning measurements; and send an indication of the secret key to the at least one network node via the SK generation and application component 199. In certain aspects, the UE 104 and / or the base station 102 may be configured to configure at least one parameter for sending a set of signals, select a secret key for communication with a second network node based on the at least one parameter, and send a set of signals to the second network node based on the at least one parameter and the secret key via the SK generation and application component 198 / 199.

[0068] Figure 2A FIG200 is a diagram illustrating an example of a first subframe within a 5G NR frame structure. Figure 2Bis a diagram 230 illustrating an example of DL channels within a 5G NR subframe. Figure 2C 250 is a diagram illustrating an example of a second subframe within a 5G NR frame structure. Figure 2D FIG280 is a diagram illustrating an example of UL channels within a 5G NR subframe. The 5G NR frame structure may be frequency division duplex (FDD) (wherein for a particular set of subcarriers (carrier system bandwidth), subframes within that subcarrier set are dedicated to either DL or UL), or may be time division duplex (TDD) (wherein for a particular set of subcarriers (carrier system bandwidth), subframes within that subcarrier set are dedicated to both DL and UL). Figure 2A , Figure 2C In the example provided, the 5G NR frame structure is assumed to be TDD, where subframe 4 is configured with slot format 28 (most of which are DL), where D is DL, U is UL, and F is flexible between DL / UL, and subframe 3 is configured with slot format 1 (all of which are UL). Although subframes 3 and 4 are shown as having slot formats 1 and 28, respectively, any particular subframe can be configured to have any of the various available slot formats 0 to 61. Slot formats 0 and 1 are DL and UL, respectively. Other slot formats 2 to 61 include a mix of DL, UL and flexible symbols. The UE is configured with the slot format through the received slot format indicator (SFI) (dynamically configured through DL control information (DCI) or semi-statically / statically configured through radio resource control (RRC) signaling). Note that the following description also applies to the 5G NR frame structure as TDD.

[0069] FIG. 2A to FIG. 2DThe frame structure is illustrated, and various aspects of the present disclosure are applicable to other wireless communication technologies that may have different frame structures and / or different channels. A frame (10ms) can be divided into 10 subframes of the same size (1ms). Each subframe may include one or more time slots. A subframe may also include a microslot, which may include 7, 4 or 2 symbols. Each time slot may include 14 or 12 symbols, depending on whether the cyclic prefix (CP) is conventional or extended. For conventional CP, each time slot may include 14 symbols, and for extended CP, each time slot may include 12 symbols. The symbol on the DL may be a CP orthogonal frequency division multiplexing (OFDM) (CP-OFDM) symbol. The symbol on the UL may be a CP-OFDM symbol (for high throughput scenarios) or a discrete Fourier transform (DFT) extended OFDM (DFT-s-OFDM) symbol (also known as a single carrier frequency division multiple access (SC-FDMA) symbol) (for power-limited scenarios; limited to single-stream transmission). The number of time slots within a subframe is based on the CP and parameter set. The parameter set defines the subcarrier spacing (SCS) and effectively defines the symbol length / duration, which is equal to 1 / SCS.

[0070]

[0071] For normal CP (14 symbols / slot), different parameter sets μ0 to 4 allow 1, 2, 4, 8, and 16 slots per subframe, respectively. For extended CP, parameter set 2 allows 4 slots per subframe. Accordingly, for normal CP and parameter set μ, there are 14 symbols / slot and 2μ slots / subframe. The subcarrier spacing can be equal to 2 μ *15kHz, where μ is parameter set 0 to 4. Therefore, the subcarrier spacing for parameter set μ=0 is 15kHz, and the subcarrier spacing for parameter set μ=4 is 240kHz. The symbol length / duration is inversely related to the subcarrier spacing. FIG. 2A to FIG. 2D An example of a parameter set μ=2 with a normal CP of 14 symbols per slot and 4 slots per subframe is provided. The slot duration is 0.25 ms, the subcarrier spacing is 60 kHz, and the symbol duration is about 16.67 μs. Within a frame set, there may be one or more different bandwidth parts (BWPs) that are frequency-division multiplexed (see Figure 2B ). Each BWP can have a specific parameter set and CP (normal or extended).

[0072] A resource grid may be used to represent a frame structure. Each slot includes a resource block (RB) (also referred to as a physical RB (PRB)) extending over 12 consecutive subcarriers. The resource grid is divided into a plurality of resource elements (REs). The number of bits carried by each RE depends on the modulation scheme.

[0073] like Figure 2A As illustrated, some of the REs carry reference (pilot) signals (RS) for the UE. The RS may include a demodulation RS (DM-RS) (indicated as R for a particular configuration, but other DM-RS configurations are possible) and a channel state information reference signal (CSI-RS) for channel estimation at the UE. The RS may also include a beam measurement RS (BRS), a beam refinement RS (BRRS), and a phase tracking RS (PT-RS).

[0074] Figure 2B Examples of various DL channels within a subframe of a frame are illustrated. A physical downlink control channel (PDCCH) carries DCI within one or more control channel elements (CCEs) (e.g., 1, 2, 4, 8, or 16 CCEs), each CCE including six RE groups (REGs), each REG including 12 consecutive REs in an OFDM symbol of an RB. A PDCCH within a BWP may be referred to as a control resource set (CORESET). The UE is configured to monitor PDCCH candidates in a PDCCH search space (e.g., a common search space, a UE-specific search space) during a PDCCH monitoring opportunity on a CORESET, wherein the PDCCH candidates have different DCI formats and different aggregation levels. Additional BWPs may be located at higher and / or lower frequencies on the channel bandwidth. A primary synchronization signal (PSS) may be within symbol 2 of a particular subframe of a frame. The PSS is used by UE 104 to determine subframe / symbol timing and physical layer identity. A secondary synchronization signal (SSS) may be within symbol 4 of a particular subframe of a frame. The SSS is used by the UE to determine the physical layer cell identity group number and the radio frame timing. Based on the physical layer identity and the physical layer cell identity group number, the UE can determine the physical cell identifier (PCI). Based on the PCI, the UE can determine the location of the DM-RS. The physical broadcast channel (PBCH) carrying the master information block (MIB) can be logically grouped with the PSS and SSS to form a synchronization signal (SS) / PBCH block (also referred to as an SS block (SSB)). The MIB provides the number of RBs in the system bandwidth and the system frame number (SFN). The physical downlink shared channel (PDSCH) carries user data, broadcast system information not sent via the PBCH (such as a system information block (SIB)), and paging messages.

[0075] like Figure 2CAs illustrated, some of the REs carry DM-RS (indicated as R for a particular configuration, but other DM-RS configurations are possible) for channel estimation at the base station. The UE may send a DM-RS for a physical uplink control channel (PUCCH) and a DM-RS for a physical uplink shared channel (PUSCH). The PUSCH DM-RS may be sent in the first or first two symbols of the PUSCH. Depending on whether a short PUCCH or a long PUCCH is sent and depending on the specific PUCCH format used, the PUCCH DM-RS may be sent in different configurations. The UE may send a sounding reference signal (SRS). The SRS may be sent in the last symbol of a subframe. The SRS may have a comb structure, and the UE may send the SRS on one of the teeth of the comb. The SRS may be used by the base station for channel quality estimation to achieve frequency-dependent scheduling of the UL.

[0076] Figure 2D Examples of various UL channels within a subframe of a frame are illustrated. The PUCCH may be located at a position as indicated in one configuration. The PUCCH carries uplink control information (UCI), such as scheduling requests, channel quality indicators (CQI), precoding matrix indicators (PMI), rank indicators (RI), and hybrid automatic repeat request (HARQ) acknowledgement (ACK) (HARQ-ACK) feedback (i.e., one or more HARQ ACK bits indicating one or more ACKs and / or negative ACKs (NACKs)). The PUSCH carries data and may additionally be used to carry buffer status reports (BSRs), power headroom reports (PHRs), and / or UCI.

[0077] Figure 3370 is a block diagram of a base station 310 in an access network communicating with a UE 350. In the DL, Internet Protocol (IP) packets may be provided to a controller / processor 375. The controller / processor 375 implements layer 3 and layer 2 functionality. Layer 3 includes a radio resource control (RRC) layer, and layer 2 includes a service data adaptation protocol (SDAP) layer, a packet data convergence protocol (PDCP) layer, a radio link control (RLC) layer, and a medium access control (MAC) layer. The controller / processor 375 provides RRC layer functionality associated with broadcasting of system information (e.g., MIB, SIB), RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-radio access technology (RAT) mobility, and measurement configuration for UE measurement reporting; PDCP layer functionality associated with header compression / decompression, security (encryption, decryption, integrity protection, integrity verification), and handover support functions; RLC layer functionality associated with delivery of upper layer packet data units (PDUs), error correction through ARQ, concatenation, segmentation and reassembly of RLC service data units (SDUs), re-segmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto transport blocks (TBs), demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority handling, and logical channel prioritization.

[0078] The transmit (TX) processor 316 and receive (RX) processor 370 implement layer 1 functionality associated with various signal processing functions. Layer 1 (which includes the physical (PHY) layer) may include error detection on the transmission channel, forward error correction (FEC) decoding / decoding of the transmission channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. The TX processor 316 processes the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-order phase shift keying (M-PSK), M-order quadrature amplitude modulation (M-QAM)). The decoded and modulated symbols can then be split into parallel streams. Subsequently, each stream can be mapped to an OFDM subcarrier, multiplexed with a reference signal (e.g., a pilot) in the time domain and / or frequency domain, and then combined using an inverse fast Fourier transform (IFFT) to generate a physical channel carrying a time domain OFDM symbol stream. The OFDM stream is spatially pre-coded to generate multiple spatial streams. Channel estimates from a channel estimator 374 may be used to determine the coding and modulation schemes, as well as for spatial processing. Channel estimates may be derived based on reference signals and / or channel condition feedback sent by the UE 350. Each spatial stream may then be provided to a different antenna 320 via a separate transmitter 318Tx. Each transmitter 318Tx may modulate a radio frequency (RF) carrier with a corresponding spatial stream for transmission.

[0079] At the UE 350, each receiver 354Rx receives a signal through its corresponding antenna 352. Each receiver 354Rx recovers the information modulated onto the RF carrier and provides the information to a receive (RX) processor 356. The TX processor 368 and the RX processor 356 implement layer 1 functionality associated with various signal processing functions. The RX processor 356 can perform spatial processing on the information to recover any spatial stream destined for the UE 350. If multiple spatial streams are destined for the UE 350, they can be combined into a single OFDM symbol stream by the RX processor 356. The RX processor 356 then converts the OFDM symbol stream from the time domain to the frequency domain using a fast Fourier transform (FFT). The frequency domain signal includes a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols on each subcarrier and the reference signal are recovered and demodulated by determining the signal constellation point most likely to be sent by the base station 310. These soft decisions can be based on channel estimates calculated by the channel estimator 358. The soft decisions are then decoded and deinterleaved to recover the data and control signals originally sent on the physical channel by the base station 310. The data and control signals are then provided to the controller / processor 359, which implements layer 3 and layer 2 functionality.

[0080] The controller / processor 359 may be associated with a memory 360 that stores program codes and data. The memory 360 may be referred to as a computer readable medium. In the UL, the controller / processor 359 provides demultiplexing between transport channels and logical channels, packet reassembly, decryption, header decompression, and control signal processing to recover IP packets. The controller / processor 359 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operations.

[0081] Similar to the functionality described in conjunction with DL transmissions performed by the base station 310, the controller / processor 359 provides RRC layer functionality associated with system information (e.g., MIB, SIB) acquisition, RRC connection, and measurement reporting; PDCP layer functionality associated with header compression / decompression and security (encryption, decryption, integrity protection, integrity verification); RLC layer functionality associated with delivery of upper layer PDUs, error correction through ARQ, concatenation, segmentation and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto TBs, demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority handling, and logical channel prioritization.

[0082] The TX processor 368 may use channel estimates derived by the channel estimator 358 from a reference signal or feedback sent by the base station 310 to select appropriate coding and modulation schemes and to facilitate spatial processing. The spatial streams generated by the TX processor 368 may be provided to different antennas 352 via corresponding transmitters 354Tx. Each transmitter 354Tx may modulate an RF carrier with a corresponding spatial stream for transmission.

[0083] UL transmissions are processed at the base station 310 in a manner similar to that described in conjunction with the receiver functionality at the UE 350. Each receiver 318Rx receives a signal through its corresponding antenna 320. Each receiver 318Rx recovers information modulated onto an RF carrier and provides the information to the RX processor 370.

[0084] The controller / processor 375 may be associated with a memory 376 that stores program codes and data. The memory 376 may be referred to as a computer readable medium. In the UL, the controller / processor 375 provides demultiplexing between transport channels and logical channels, packet reassembly, decryption, header decompression, control signal processing to recover IP packets. The controller / processor 375 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operations.

[0085] At least one of the TX processor 368, the RX processor 356, and the controller / processor 359 may be configured to combine Figure 1 The sensing signal instructs component 198 to perform various aspects.

[0086] At least one of the TX processor 316, the RX processor 370, and the controller / processor 375 may be configured to perform operations related to Figure 1 All aspects related to SK generation and application component 199.

[0087] Figure 4 4 is a diagram illustrating an example of UE positioning based on reference signal measurements (which may also be referred to as “network-based positioning”) according to various aspects of the present disclosure. UE 404 may be at time T SRS TX UL-SRS 412 is sent and at time T PRS_RX A DL positioning reference signal (PRS) (DL-PRS) 410 is received. TRP 406 may be at time T SRS_RX Receive UL-SRS 412 and at time T PRS_TX 410. UE 404 may receive DL-PRS 410 before transmitting UL-SRS 412, or may transmit UL-SRS 412 before receiving DL-PRS 410. In both cases, a positioning server (e.g., location server 168) or UE 404 may determine the UL-SRS 412 based on ||T SRS_RX -T PRS_TX |-|T SRS_TX -T PRS_RX || determines RTT 414. Thus, multi-RTT positioning may utilize UE Rx-Tx time difference measurements (i.e., |T SRS_TX -T PRS_RX |) and DL-PRS reference signal received power (RSRP) (DL-PRS-RSRP), and the measured TRP Rx-Tx time difference measurement (ie, |T SRS_RX -T PRS_TX|) and UL-SRS-RSRP. The UE 404 measures the UE Rx-Tx time difference measurement (and / or the DL-PRS-RSRP of the received signal) using the assistance data received from the positioning server, and the TRP 402, 406 measures the gNB Rx-Tx time difference measurement (and / or the UL-SRS-RSRP of the received signal) using the assistance data received from the positioning server. These measurements may be used at the positioning server or the UE 404 to determine the RTT, which is used to estimate the position of the UE 404. Other methods for determining the RTT are possible, such as, for example, using DL-TDOA and / or UL-TDOA measurements.

[0088] PRS may be defined for network-based positioning (e.g., NR positioning) to enable UEs to detect and measure more neighbor transmit and receive points (TRPs), with multiple configurations supported to enable various deployments (e.g., indoor, outdoor, below 6, mmW, etc.). To support PRS beam operation, beam scanning may also be configured for PRS. The UL positioning reference signal may be based on a sounding reference signal (SRS) with enhancements / adjustments for positioning purposes. In some examples, the UL-PRS may be referred to as "SRS for positioning," and a new information element (IE) may be configured for SRS for positioning in RRC signaling.

[0089] DL PRS-RSRP may be defined as the linear average of the power contributions (in [W]) of the resource elements of the antenna ports carrying the DL PRS reference signal configured for RSRP measurement within the considered measurement frequency bandwidth. In some examples, for FR1, the reference point for DL ​​PRS-RSRP may be the antenna connector of the UE. For FR2, DL PRS-RSRP may be measured based on the combined signals from the antenna elements corresponding to a given receiver branch. For FR1 and FR2, if the UE uses receiver diversity, the reported DL PRS-RSRP value may not be lower than the corresponding DL PRS-RSRP of any individual receiver branch in the individual receiver branches. Similarly, UL SRS-RSRP may be defined as the linear average of the power contributions (in [W]) of the resource elements carrying the sounding reference signal (SRS). UL SRS-RSRP may be measured over the configured resource elements in the considered measurement frequency bandwidth, in the configured measurement occasions. In some examples, for FR1, the reference point for UL SRS-RSRP may be the antenna connector of the base station (gNB). For FR2, the UL SRS-RSRP may be measured based on the combined signals from the antenna elements corresponding to a given receiver branch. For FR1 and FR2, if the base station uses receiver diversity, the reported UL SRS-RSRP value may not be lower than the corresponding UL SRS-RSRP of any of the individual receiver branches.

[0090] The PRS-path RSRP (PRS-RSRPP) may be defined as the power of the linear average of the channel response at the i-th path delay of the resource element carrying the DL PRS signal configured for measurement, where the DL PRS-RSRPP for the 1st path delay is the power contribution corresponding to the first detected path in time. In some examples, the PRS path phase measurement may refer to the phase associated with the i-th path of the channel derived using the PRS resource.

[0091] DL-AoD positioning may utilize the measured DL-PRS-RSRP of downlink signals received from multiple TRPs 402, 406 at the UE 404. The UE 404 measures the DL-PRS-RSRP of the received signals using assistance data received from a positioning server, and the resulting measurements, along with the departure azimuth angle (A-AoD), departure zenith angle (Z-AoD), and other configuration information, are used to position the UE 404 relative to neighboring TRPs 402, 406.

[0092] DL-TDOA positioning may utilize DL reference signal time difference (RSTD) (and / or DL-PRS-RSRP) of downlink signals received from multiple TRPs 402, 406 at the UE 404. The UE 404 measures the DL RSTD (and / or DL-PRS-RSRP) of the received signals using assistance data received from a positioning server, and the resulting measurements are used along with other configuration information to position the UE 404 relative to neighboring TRPs 402, 406.

[0093] UL-TDOA positioning may utilize the UL relative time of arrival (RTOA) (and / or UL-SRS-RSRP) at multiple TRPs 402, 406 of uplink signals sent from the UE 404. The TRPs 402, 406 measure the UL-RTOA (and / or UL-SRS-RSRP) of the received signals using assistance data received from a positioning server, and the resulting measurements are used along with other configuration information to estimate the position of the UE 404.

[0094] UL-AoA positioning may utilize the measured azimuth angle of arrival (A-AoA) and zenith angle of arrival (Z-AoA) of uplink signals sent from the UE 404 at multiple TRPs 402, 406. The TRPs 402, 406 measure the A-AoA and Z-AoA of the received signals using assistance data received from a positioning server, and the resulting measurements, along with other configuration information, are used to estimate the position of the UE 404. For purposes of this disclosure, positioning operations in which a UE provides measurements to a base station / positioning entity / server for use in calculating the UE's position may be described as "UE-assisted," "UE-assisted positioning," and / or "UE-assisted position calculation," while positioning operations in which a UE measures and calculates its own position may be described as "UE-based," "UE-based positioning," and / or "UE-based position calculation."

[0095] Additional positioning methods may be used to estimate the position of the UE 404, such as, for example, UE-side UL-AoD and / or DL-AoA. Note that data / measurements from various techniques may be combined in various ways to increase accuracy, determine and / or enhance certainty, supplement / complete measurements, and / or replace / provide missing information.

[0096] It should be noted that the terms "positioning reference signal" and "PRS" generally refer to specific reference signals used for positioning in NR and LTE systems. However, as used herein, the terms "positioning reference signal" and "PRS" may also refer to any type of reference signal that can be used for positioning, such as but not limited to: PRS, TRS, PTRS, CRS, CSI-RS, DMRS, PSS, SSS, SSB, SRS, UL-PRS, etc. as defined in LTE and NR. In addition, the terms "positioning reference signal" and "PRS" may refer to downlink or uplink positioning reference signals, unless otherwise indicated by the context. If it is necessary to further distinguish the type of PRS, the downlink positioning reference signal may be referred to as "DL-PRS", and the uplink positioning reference signal (e.g., SRS, PTRS used for positioning) may be referred to as "UL-PRS". In addition, for signals that can be sent in both uplink and downlink (e.g., DMRS, PTRS), these signals may be prepended with "UL" or "DL" to distinguish the direction. For example, "UL-DMRS" can be distinguished from "DL-DMRS".

[0097] FIG. 5A to FIG. 5H 500A to 500H are diagrams illustrating example patterns of DL-PRS resources within a slot according to various aspects of the present disclosure, respectively. DL-PRS resources may span 2, 4, 6, or 12 consecutive symbols with a full frequency domain staggered pattern within a slot. DL-PRS resources may be configured in a high-layer configured DL or FL symbol of a slot. In addition, all REs of a given DL-PRS resource may have a constant per-resource element energy (EPRE).

[0098] The patterns illustrated by diagrams 500A to 500H may be referred to as “interleaving patterns” or “frequency domain interleaving patterns”, in which resource elements on which DL-PRS is transmitted in the frequency domain of a given bandwidth may be interleaved so that these resource elements are not adjacent to each other in two consecutive resource elements on the given bandwidth. In addition, although the resource elements on which DL-PRS is transmitted may be interleaved over multiple symbols, if the resource elements are deinterleaved, the resource elements may occupy the entire bandwidth. For example, Figure 5A500A of exemplifies an example DL-PRS resource based on a comb-2 pattern with 2 symbols, where for two occupied symbols, there is one PRS resource element for every two subcarriers in the frequency domain, such as shown at 502. In addition, a set of frequency offsets may be applied to the PRS resource elements of each occupied symbol in the occupied symbols. For example, a frequency offset of {0,1} may be applied to a comb-2 pattern with 2 symbols, where the PRS resource elements on the first occupied symbol may be transmitted with an offset of zero (0) and the PRS resource elements on the second occupied symbol may be transmitted with an offset of one (1). Therefore, the PRS resource elements may also not be adjacent to each other in the time domain. As shown at 504, although the PRS resource elements may be interleaved in a given bandwidth (and also in a given time domain), after the UE receives these PRS resource elements, the UE is still able to receive the full bandwidth of the PRS, which may be referred to as de-interleaving the interleaving pattern or converting the interleaving pattern to a non-interleaving pattern.

[0099] Similarly, Figure 5B Diagram 500B illustrates an example DL-PRS resource based on a comb-4 pattern with 4 symbols, where for four occupied symbols there is one PRS resource element for every four subcarriers in the frequency domain, and the pattern may include frequency offsets of {0, 2, 1, 3}. Figure 5C Diagram 500C illustrates an example DL-PRS resource based on a comb-2 pattern with 12 symbols, where there is one PRS resource element for every two subcarriers in the frequency domain for twelve occupied symbols, and the pattern may include frequency offsets of {0,1,0,1,0,1,0,1,0,1,0,1}. Figure 5D Diagram 500D illustrates an example DL-PRS resource based on a comb-4 pattern with 12 symbols, where there is one PRS resource element for every four subcarriers in the frequency domain for twelve occupied symbols, and the pattern may include frequency offsets of {0,2,1,3,0,2,1,3,0,2,1,3}. Figure 5E Diagram 500E illustrates an example DL-PRS resource based on a comb-6 pattern with 6 symbols, where for six occupied symbols there is one PRS resource element for every six subcarriers in the frequency domain, and the pattern may include frequency offsets of {0,3,1,4,2,5}. Fig. 5F Diagram 500F illustrates an example DL-PRS resource based on a comb-12 pattern with 12 symbols, where there is one PRS resource element for every twelve subcarriers in the frequency domain for twelve occupied symbols, and the pattern may include frequency offsets of {0,6,3,9,1,7,4,10,2,8,5,11}. Figure 5GDiagram 500G illustrates an example DL-PRS resource based on a comb-2 pattern with 6 symbols, where for six occupied symbols there is one PRS resource element for every two subcarriers in the frequency domain, and the pattern may include frequency offsets of {0, 1, 0, 1, 0, 1}. Figure 5H Diagram 500H illustrates an example DL-PRS resource based on a comb-6 pattern with 12 symbols, where for twelve occupied symbols there is one PRS resource element for every six subcarriers in the frequency domain, and the pattern may include frequency offsets of {0,3,1,4,2,5,0,3,1,4,2,5}.

[0100] In some scenarios, the azimuth angle of arrival AoA (φ) and the zenith angle of arrival (ZoA (θ)) may be used to define an estimated angle of the UE relative to a reference direction, which is determined at the TRP antenna for the UL channel corresponding to this UE. The reference direction may be defined based on a global coordinate system (GCS) and / or a local coordinate system (LCS). The estimated angles may also be referred to as angle measurements, which may be reported by the UE and / or base station based on a defined granularity. For example, the reporting granularity of base station angle measurements (e.g., AoA, ZoA) may be defined as 0.1 degrees. Similarly, the reporting granularity of a set of angles α (azimuth), β (downtilt), and γ (tilt) for the transition from GCS to LCS may also be defined as 0.1 degrees.

[0101] Figure 6 600 is a diagram illustrating an example scenario in which communications between a base station and a UE may be tampered with by another UE according to various aspects of the present disclosure. A base station 602 may communicate with a first UE 604, and the communications therebetween may be eavesdropped on by a second UE 606, which may be a malicious device capable of generating attacks on the communications between the base station 602 and the first UE 604. For example, the second UE 606 may generate the same pseudo signals as the base station 602 and send these pseudo signals to the first UE 604 to interfere with the communications and / or positioning of the first UE 604, which may be referred to as a pseudo base station attack hereinafter.

[0102] As shown by the table at 608, when the first UE 604 is in idle / inactive mode or is transitioning to connected mode, the fake base station attack may cause the first UE 604 to be out of service. If the first UE 604 is in connected mode, the fake base station attack may cause the throughput at the first UE 604 to be degraded. Thus, making communications secure may be very important and critical for wireless communication systems, such as for wireless communications including many devices connected to each other (e.g., IoT). Given the power levels of such devices, it is likely to be beneficial to enhance security (e.g., physical layer (PHY) security) with additional security bits obtained from channels and sounding signals between legitimate nodes (e.g., legitimate network entities, such as base stations 602 and first UE 604).

[0103] Aspects presented herein can improve the security and integrity of wireless communications. Aspects presented herein provide a new type of secret key (SK) sharing scheme based on positioning measurements, wherein a network device / entity pair can be configured to extract the SK from a channel associated with positioning and use the SK to secure some unsecure channels (e.g., PUCCH, DCI, etc.) and / or further improve the security of other channels such as PDSCH and PUSCH from a PHY security perspective.

[0104] Figure 7 is a communication flow 700 illustrating an example secret key extraction based on channel randomness in accordance with various aspects of the present disclosure. The numbers associated with the communication flow 700 do not specify a particular time order and are merely used as a reference for the communication flow 700. Aspects presented herein may enable two network nodes (such as a base station, a base station component, a UE, a sidelink device, or a combination thereof) to derive a SK based on a channel estimate and communicate with each other based on the derived SK.

[0105] At 706, a first device 702 (e.g., a first base station, a component of a first base station, a first UE, or a first side link device, etc.) and a second device 704 (e.g., a second base station, a component of a second base station, a second UE, or a second side link device, etc.) may exchange reference signals with each other.

[0106] At 708, the first device 702 and the second device 704 may each perform channel estimation based on reference signals received from each other. For example, the second device 704 may send a reference signal set to the first device 702, and the first device 702 may estimate the channel by measuring the reference signal set.

[0107] At 710, the first device 702 and the second device 704 may obtain at least one metric based on the channel estimation. For example, the at least one metric may include channel power, RSRP of the channel, signal to interference plus noise ratio (SINR) of the channel, and / or phase of the channel, etc.

[0108] At 712, the first device 702 and the second device 704 may quantize the at least one metric (or one or more mapped values) or use the at least one metric as an input to a secret key derivation function (e.g., HMAC-SHA-256 (e.g., secret key, [other parameters]). For purposes of this disclosure, a secret key may refer to a block of information or parameters that can be used to encrypt and decrypt messages with symmetric or secret key encryption.

[0109] At 714, the first device 702 and the second device 704 can both obtain a SK. In some examples, if the SNR of the channel is above a threshold (e.g., at a high SNR), the obtained SK can be quite secure. However, if the SNR of the channel is not above a threshold (e.g., at a low SNR), some repetition of the pilot signal and / or key refinement process can be implemented by the first device 702 and the second device 704.

[0110] At 716, the first device 702 and the second device 704 may use SK to secure transmission between the first device 702 and the second device 704. For example, the first device 702 and the second device 704 may use SK to secure (e.g., encode / decode or encrypt / decrypt) some fields within the PHY channel, such as some information in a control channel, a shared channel, and / or a sidelink channel (e.g., some information in a PDCCH, a PUCCH, a PDSCH, and / or a PUSCH). If the communication cannot be decoded / decrypted based on the SK, the first device 702 or the second device 704 may be configured to discard the communication. Thus, the communication between the first device 702 and the second device 704 may be secured based on the SK to prevent malicious attacks from another device.

[0111] Figure 8 800 is a communication flow 800 illustrating an example secret key extraction based on positioning measurements according to various aspects of the present disclosure. The numbers associated with the communication flow 800 do not specify a particular time order and are only used as a reference for the communication flow 800. The aspects presented herein may enable a UE and a base station or a component of the base station (e.g., a TRP) to derive a SK based on parameters associated with positioning measurements during a UE positioning session, so that the UE and the base station may perform a UE positioning session with the derived SK to improve the security and integrity of the UE positioning session. Although the aspects illustrated herein are based on a positioning session between a UE and a base station, the aspects presented herein may also be applied to sidelink positioning such as between two sidelink devices (e.g., two UEs, a UE and an RSU, etc.).

[0112] At 806, UE 802 and base station 804 (or components of base station 804) may establish a UE positioning session, such as in conjunction with Figure 4 802 and the base station 804 may then exchange reference signals with each other. For example, the base station 804 may send one or more PRSs to the UE 802 (e.g., via one or more antenna panels or TRPs), and the UE 802 may send one or more SRSs to the base station 804. In other examples, the reference signals may include a synchronization signal block (SSB), a channel state information-reference signal (CSI-RS), a demodulation reference signal (DMRS), a sidelink reference signal, or a combination thereof.

[0113] At 808, the UE 802 and the base station 804 may each measure parameters associated with the UE positioning session (hereinafter referred to as "positioning measurements") based on the received reference signal. For example, the UE 802 and 804 may measure RSRP, path RSRP (PRSRP), RSTD, phase path, relative time of arrival (RtoA), AoA, ZoA, SINR, one or more quality metrics, Doppler shift and / or receive-transmit (Rx-Tx) time difference of the received reference signal, such as in combination with Figure 4 A quality metric may refer to a performance associated with a positioning measurement. For example, a quality metric may include uncertainty, accuracy / precision, coverage, latency, and / or error associated with a positioning measurement.

[0114] At 810, the UE 802 and the base station 804 may obtain at least one metric based on the positioning measurement. For example, the at least one metric may include RSRP, PRSRP, RSTD, phase path, RtoA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0115] At 812, UE 802 and base station 804 may quantize at least one metric (or one or more mapped values) and / or use at least one metric as an input to a secret key derivation function (e.g., HMAC-SHA-256 (e.g., key, [other parameters])). For example, UE 802 may derive SK using multiple arrival times (ToAs) obtained from PRSs sent from base station 804, e.g., UE 802 measures ToAs across several base stations (e.g., including base station 804) or TRPs of base stations, and UE 802 derives an RSTD vector (e.g., RSTD with multiple base stations / TRPs) based on the measured ToAs. The derived RSTD vector is likely to be a unique fingerprint of UE 802 suitable for generating SK. Thus, the UE 802 may derive SK using the RSTD vector as an input and / or as an initialization of a secure random number generator (e.g., a cryptographically secure PRNG) (e.g., as an input to a secret key derivation function (such as HMAC-SHA-256 (e.g., key, [other parameters])). Similarly, the base station 804 may derive SK using multiple ToAs obtained from the SRS sent from the UE 802, for example, the base station 804 measures the ToAs of the SRS received from the UE 802 and derives the RSTD vector (which may be referred to as the RtoA vector for the UL). Thus, the base station 804 may derive SK using the RToA vector as an input and / or as an initialization of a secure random number generator (e.g., a cryptographically secure PRNG) (e.g., as an input to a secret key derivation function (such as HMAC-SHA-256 (e.g., key, [other parameters])).

[0116] At 814, the UE 802 and the base station 804 may both generate SK based on at least one metric and a secret key derivation function. Since the at least one metric obtained by the UE 802 and the base station 804 may be based on a one-to-one mapping associated with the physical location of the UE 802, the RSTD vector derived by the UE 802 and the RtoA vector derived by the base station 804 may both produce the same SK.

[0117] In some examples, if the SNR of the channel is above a threshold (e.g., at a high SNR), the obtained SK may be quite secure. However, if the SNR of the channel is not above a threshold (e.g., at a low SNR), some repetition of the pilot signal and / or key refinement process may be implemented by the UE 802 and the base station 804.

[0118] At 816, the UE 802 and the base station 804 may perform a UE positioning session based on the generated SK to secure transmission between the UE 802 and the base station 804. For example, the UE 802 may use the SK to encode / encrypt the SRS to be sent to the base station 804, and to decode / decrypt the PRS received from the base station 804. Similarly, the base station 804 may use the SK to encode / encrypt the PRS to be sent to the UE 802, and to decode / decrypt the SRS received from the UE 802. In another example, the UE 802 and / or the base station 804 may also use the SK to secure some fields within the PHY channel, such as some information in the control channel, shared channel, and / or sidelink channel (e.g., some information in the PDCCH, PUCCH, PDSCH, and / or PUSCH). In other words, the SK derived by the UE 802 and the base station 804 may also be used for communication purposes. If the UE 802 or the base station 804 cannot decode / decrypt the received positioning reference signal (e.g., PRS and SRS) or communication, the UE 802 or the base station 804 may exclude the positioning measurement associated with the positioning reference signal or communication. Thus, the positioning and / or communication between the UE 802 and the base station 804 may be secured based on the SK to prevent malicious attacks from another device.

[0119] In some examples, the SK generation process for UE 802 and / or base station 804 may be configured or performed by a server (e.g., a location server, a location management function (LMF), etc.). For example, as shown at 822, server 820 may send a request to base station 804 (and other base stations / side link devices) to perform positioning measurements for UE 802 (e.g., for a UE positioning session). At 824, server 820 may receive positioning measurements from base station 804 (and other base stations). At 826, server 820 may generate a SK based on the positioning measurements received from the base station (e.g., by pushing the positioning measurements through a key generator). At 828, server 820 may send the generated SK to base station 804 (and other base stations). Base station 804 may then perform UE positioning or communication with UE 802 based on the SK, such as described in conjunction with 816.

[0120] In some scenarios, while generating a SK based on positioning measurements may improve the security and integrity of positioning and / or communication between a UE and one or more base stations / TRPs, there is a chance that a potential eavesdropper / attacker (e.g., a second UE 606) may also be able to generate the same SK if the potential eavesdropper / attacker is near the UE and is aware of the SK generation process / algorithm used by the UE and one or more base stations / TRPs.

[0121] Fig. 9900 is a diagram illustrating an example scenario in which a potential eavesdropper / attacker in the vicinity of a UE generates the same SK as the UE according to various aspects of the present disclosure. As shown at 908, a first UE 904 can communicate with a base station 902 and / or perform UE positioning, and the UE 904 can generate a SK for communication and / or UE positioning based on an RSTD vector (e.g., obtained by measuring an SRS sent from the base station 902), as combined with Figure 8 Since the RSTD vector may be a unique fingerprint between the first UE 904 and the base station 902, the SK generated based on the RSTD vector may be used to secure communication and / or UE positioning between the first UE 904 and the base station 902.

[0122] However, as shown at 910, the RSTD measured by the first UE 904 may be the same or similar within a region (such as within X meters of the first UE 904). Thus, if a second UE 906, which may be a potential eavesdropper / attacker, is near the first UE 904 (e.g., within X meters of the first UE 904), the RSTD measured by the second UE 906 (e.g., also obtained by measuring the SRS sent from the base station 902) may be the same or similar to the RSTD measured by the first UE 904. As shown at 912, if the second UE 906 is aware of the algorithm used by the first UE 904 and the base station 902 to generate the SK (e.g., based on the RSTD vector), the second UE 906 may be able to generate the same SK as the first UE 904 and tamper with the communication and / or UE positioning between the first UE 904 and the base station 902 (e.g., generate a fake base station attack).

[0123] Thus, in another aspect of the present disclosure, the UE / base station may be configured to generate SK based on a combination of different positioning measurements to further enhance the security / integrity level, rather than generating SK based on one type of positioning measurement. In other words, the first UE 904 and the base station 902 may be configured to generate SK based on a combination of different positioning measurements (e.g., based on RSTD vector, UE Rx-Tx time difference and RSRP vector), rather than generating SK based on one type of positioning measurement. Thus, compared to a configuration in which only one positioning measurement is used to derive SK, the chance that the second UE 906 obtains the same measurement result as the first UE 604 for different types of positioning measurements (and thereby derives the same SK) may become much smaller. For example, although the second UE 906 may obtain an RSTD measurement similar to the first UE 904 when the second UE 906 is near the first UE 904, the chance that the second UE 906 also obtains the same measurement for the UE Rx-Tx time difference and / or RSRP is greatly reduced. Therefore, when a combination of positioning measurements is used to generate SK, the second UE 906 is unlikely to generate the same SK as the first UE 904.

[0124] In one example, the first UE 904 may be configured by a serving base station (e.g., base station 902), a location server (e.g., LMF), or an external application regarding which positioning measurements (e.g., RSTD, UE Rx-Tx time difference, RSRP, etc.), which PRS resources, which TRPs, which PRS resource sets, which PFLs, and / or which bands are to be used by the UE 904 to derive one or more SKs. In addition, there may be a configuration of a positioning frequency layer (PFL) that is configured only for the purpose of SK extraction. A PFL (which may also be referred to as a "frequency layer") may refer to a collection of one or more PRS resource sets that have the same values ​​for certain parameters across one or more TRPs.

[0125] In another example, the first UE 904 may report to a serving base station (e.g., base station 902), a location server (e.g., LMF), or an external application a quality metric (e.g., RSTD, RSRP, UE Rx-Tx time difference, etc.) about the positioning measurement, which may be used (e.g., by the base station or location server) to determine how secure the derived / extracted SK is. For example, if the first UE 904 determines that the positioning measurement has an uncertainty of plus and minus (+ / -) X meters, the extracted SK may be secure as long as the second UE 906 (e.g., an attacker) is not within plus and minus X meters of the first UE 904. Therefore, the first UE 904 may send a quality metric indicating the used positioning measurement and the corresponding uncertainty to the base station 902. Based on the quality metric or how secure the derived / extracted SK is, the serving base station or location server may determine whether to include or exclude additional positioning measurements to derive / extract the SK. In some examples, the quality metric provided by the UE may also be used by the serving base station or location server to modify the positioning measurement or the uncertainty associated with the positioning measurement used to derive the SK.

[0126] Fig.10 1000 is a diagram illustrating an example of a base station modifying a positioning measurement or uncertainty associated with a positioning measurement based on a quality metric provided by a UE according to various aspects of the present disclosure. The first UE 904 and the base station 902 may each be specified to independently derive SK, such as in conjunction with Figure 7 and Figure 8 For example, the first UE 904 may derive the SK based on the AoA of the PRS received from the base station 902, and the base station 902 may also derive the SK based on the AoA of the SRS received from the first UE 904.

[0127] In some scenarios, if the positioning measurements performed by the first UE 904 have an uncertainty that exceeds a threshold (e.g., the uncertainty range is high, such as X=+ / -20 meters), different SKs may be derived at the first UE 904 and the base station 902. For example, as shown at 1002, the AoA measured by the first UE 904 may include an uncertainty circle (e.g., + / -20 meters within the first UE 904), so that the AoA measurements performed by the first UE 904 may be the same or similar within the uncertainty circle. For example, the AoA measured by the first UE 904 at 1004 and 1006 may be the same, so that the SK derived by the first UE 904 at 1004 and 1006 may also be the same (e.g., assuming it is the first SK (SK1)). On the other hand, the positioning measurements performed by the base station 902 may have lower uncertainty than the positioning measurements performed by the UE 904 because the base station 902 may be using hardware components with higher accuracy and / or processing power. Therefore, when the first UE 904 is at 1004 or 1006, the AoA measured by the base station 902 may be different, resulting in the base station 902 generating different SKs when the first UE 904 is at 1004 or 1006. For example, as shown at 1008, the base station 902 may generate a third SK (SK 3) when the first UE 904 is at 1004 and a fourth SK (SK 4) when the first UE 904 is at 1004, and the third SK and the fourth SK may be different from the SK (e.g., SK 1) generated by the first UE 904.

[0128] Thus, after the first UE 904 reports a quality metric associated with the positioning measurement (which may include uncertainty associated with the positioning measurement), as shown at 1010, the base station 902 may adjust its positioning measurement and / or measurement parameters based on the quality metric provided by the first UE 904, so that the SK derived by the base station 902 may be the same regardless of where the first UE 904 is within the uncertainty circle of the first UE 904. For example, as shown at 1012, the base station 902 may be configured to generate a first SK when the first UE 904 is within a certain area (e.g., + / - 20 meters of the location of the first UE 904) or when the measured AoA is within a certain range (e.g., 30 degrees to 35 degrees).

[0129] In another aspect of the present disclosure, one or more base stations associated with a UE positioning session may select a set of positioning parameters (e.g., parameters for sending a reference signal) for the UE positioning session, wherein the set of positioning parameters may be used by the one or more base stations and the UEs participating in the UE positioning session to extract a SK for communicating with each other. Therefore, one or more base stations may skip performing positioning measurements. For example, a set of base stations may select a DL-AOD list / range (e.g., 30 degrees plus minus 2 degrees) for sending PRS to a UE participating in a UE positioning session, wherein the DL-AOD list / range may be used by one or more base stations to generate a SK. The UE may then measure the PRS from one or more base stations based on the DL-AOD list / range and use the measurements to extract the same SK on the UE side. In some examples, the UE may send a request to the network (e.g., one or more base stations or a location server) that specifies such SK extraction based on positioning measurements. For example, an external client associated with the UE or UE positioning session may send a request to the LMF that specifies such SK extraction based on positioning measurements. In response, the LMF may coordinate the transition of one or more base stations so that they send PRS with the selected DL-AOD.

[0130] A similar mechanism may also be applied at a UE participating in a UE positioning session. For example, the UE may select a UL-AOD list / range for sending SRS to one or more base stations, where the UL-AOD list / range may be used by the UE to generate the SK. One or more base stations may then measure the SRS from the UE based on the UL-AOD list / range and use these measurements to extract the same SK on the network / base station side. Similarly, an application client at the UE may send a request to the LMF for the LMF to configure one or more base stations to measure and report UL-AoD measurements so that the SK may be extracted on the network side.

[0131] Fig.11 1100 is a flow chart of a method of wireless communication. The method may be performed by a UE (e.g., UE 104, 404, 604, 802, 904; device 1304). The method may enable the UE to derive a SK based on positioning measurements and use the SK to perform UE positioning to enhance the security and integrity of UE positioning.

[0132] At 1102, the UE may receive a configuration from a serving base station, a location server, or a LMF, wherein the configuration may indicate one or more resources for a signal set to be dedicated to selecting a secret key, such as in conjunction with Figure 8 For example, UE 802 may receive a configuration from base station 804, server 820, or LMF indicating resources to be dedicated to selecting a secret key for a positioning reference signal set. Receipt of the configuration may be performed by, for example Fig.13The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0133] At 1104, the UE may receive a signal set from at least one network node, wherein one or more positioning measurements may be performed after receiving the signal set, such as in conjunction with Figure 8 For example, at 806, UE 802 may receive PRS from base station 804, wherein one or more positioning measurements may be performed by UE 802 after receiving the PRS. Receipt of the signal set from at least one network node may be performed by, for example, Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0134] At 1106, the UE may perform one or more positioning measurements based on the set of signals from the at least one network node, wherein the one or more positioning measurements may be associated with at least one of the location of the UE or the location of the at least one network node, such as in conjunction with Figure 8 For example, at 808, UE 802 may measure parameters associated with positioning based on positioning reference signals received from base station 804. Positioning measurements may be made by, for example, Fig.13 The SK generation and application component 198 of the device 1304 is executed.

[0135] In one example, at least one network node includes at least one TRP, a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

[0136] In another example, the signal set includes PRS, SSB, CSI-RS, DMRS, sidelink reference signal, or a combination thereof.

[0137] In another example, the one or more positioning measurements include: RSRP, path RSRP, RSTD, phase path measurement, RTOA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0138] In another example, the one or more positioning measurements are also associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

[0139] At 1108, the UE may select a secret key for communication with at least one network node based on one or more positioning measurements, such as in conjunction with Figure 8 For example, at 810, 812, and 814, UE 802 may select a secret key for communication with base station 804 based on the positioning measurements. The selection of the secret key may be performed by, for example, Fig.13 The SK generation and application component 198 of the device 1304 is executed.

[0140] In one example, as shown at 1116, upon selecting a secret key for communication with at least one network node based on the one or more positioning measurements, the UE may generate a secret key based on a key generation function.

[0141] In another example, the selection of the secret key is independent of at least one network node.

[0142] At 1110, the UE may communicate with at least one network node based on a secret key, such as in conjunction with Figure 8 For example, at 816, UE 802 may communicate with base station 804 based on the secret key. The communication with at least one network node based on the secret key may be performed by, for example Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0143] In one example, when communicating with at least one network node based on a secret key, the UE may encrypt one or more channels based on the secret key before communicating with the at least one network node, and send the one or more channels to the at least one network node after encrypting the one or more channels, as shown at 1118. In this example, the one or more channels may be used to extract the secret key.

[0144] At 1112, the UE may receive a signal set from at least one network node based on a secret key and decrypt the signal set after receiving the signal set, such as in conjunction with Figure 8 The reception of the signal set from at least one network node based on the secret key may be performed by, for example Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0145] At 1114, the UE may exclude one or more positioning measurements based on the signal set if the signal set cannot be decrypted, such as in conjunction with Figure 8 The exclusion of one or more positioning measurements may be accomplished by, for example, Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0146] Fig.121200 is a flow chart of a method of wireless communication. The method may be performed by a UE (e.g., UE 104, 404, 604, 802, 904; device 1304). The method may enable the UE to derive a SK based on positioning measurements and use the SK to perform UE positioning to enhance the security and integrity of UE positioning.

[0147] At 1206, the UE may perform one or more positioning measurements based on the set of signals from the at least one network node, wherein the one or more positioning measurements may be associated with at least one of the location of the UE or the location of the at least one network node, such as in conjunction with Figure 8 For example, at 808, UE 802 may measure parameters associated with positioning based on positioning reference signals received from base station 804. Positioning measurements may be made by, for example, Fig.13 The SK generation and application component 198 of the device 1304 is executed.

[0148] In one example, at least one network node includes at least one TRP, a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

[0149] In another example, the signal set includes PRS, SSB, CSI-RS, DMRS, sidelink reference signal, or a combination thereof.

[0150] In another example, the one or more positioning measurements include: RSRP, path RSRP, RSTD, phase path measurement, RTOA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0151] In another example, the one or more positioning measurements are also associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

[0152] At 1208, the UE may select a secret key for communication with at least one network node based on one or more positioning measurements, such as in conjunction with Figure 8 For example, at 810, 812, and 814, UE 802 may select a secret key for communication with base station 804 based on the positioning measurements. The selection of the secret key may be performed by, for example, Fig.13 The SK generation and application component 198 of the device 1304 is executed.

[0153] In one example, when selecting a secret key for communication with at least one network node based on the one or more positioning measurements, the UE may generate the secret key based on a key generation function.

[0154] In another example, the selection of the secret key is independent of at least one network node.

[0155] At 1210, the UE may communicate with at least one network node based on a secret key, such as in conjunction with Figure 8 For example, at 816, UE 802 may communicate with base station 804 based on the secret key. The communication with at least one network node based on the secret key may be performed by, for example Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0156] In one example, when communicating with at least one network node based on a secret key, the UE may encrypt one or more channels based on the secret key before communicating with the at least one network node, and send the one or more channels to the at least one network node after encrypting the one or more channels. In this example, the one or more channels may be used to extract the secret key.

[0157] In another example, the UE may receive a configuration from a serving base station, a location server, or a LMF, where the configuration may indicate one or more resources for a signal set to be dedicated to selecting a secret key, such as in conjunction with Figure 8 For example, UE 802 may receive a configuration from base station 804, server 820, or LMF indicating resources to be dedicated to selecting a secret key for a positioning reference signal set. Receipt of the configuration may be performed by, for example Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0158] In another example, the UE may receive a signal set from at least one network node, wherein one or more positioning measurements may be performed after receiving the signal set, such as in conjunction with Figure 8 For example, at 806, UE 802 may receive PRS from base station 804, wherein one or more positioning measurements may be performed by UE 802 after receiving the PRS. Receipt of the signal set from at least one network node may be performed by, for example, Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0159] In another example, the UE may receive a signal set from at least one network node based on a secret key, and decrypt the signal set after receiving the signal set, such as in conjunction with Figure 8 The reception of the signal set from at least one network node based on the secret key may be performed by, for example Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0160] In another example, the UE may exclude one or more positioning measurements based on the signal set if the signal set cannot be decrypted, such as in conjunction with Figure 8 The exclusion of one or more positioning measurements may be accomplished by, for example, Fig.13 The SK generation and application component 198 and / or the transceiver 1322 of the device 1304 are executed.

[0161] Fig.131300 is an example of a hardware implementation of an example device 1304. The device 1304 may be a UE, a component of a UE, or may implement UE functionality. In some aspects, the device 1304 may include a cellular baseband processor 1324 (also referred to as a modem) coupled to one or more transceivers 1322 (e.g., a cellular RF transceiver). The cellular baseband processor 1324 may include on-chip memory 1324'. In some aspects, the device 1304 may also include one or more subscriber identity module (SIM) cards 1320 and an application processor 1306 coupled to a secure digital (SD) card 1308 and a screen 1310. The application processor 1306 may include on-chip memory 1306'. In some aspects, the device 1304 may also include a Bluetooth module 1312, a WLAN module 1314, an SPS module 1316 (e.g., a GNSS module), one or more sensor modules 1318 (e.g., an atmospheric pressure sensor / altimeter; a motion sensor such as an inertial management unit (IMU), a gyroscope, and / or an accelerometer; light detection and ranging (LIDAR), radio-aided detection and ranging (RADAR), sound navigation and ranging (SONAR), a magnetometer, audio, and / or other technologies for positioning), an additional memory module 1326, a power source 1330, and / or a camera 1332. The Bluetooth module 1312, the WLAN module 1314, and the SPS module 1316 may include an on-chip transceiver (TRX) (or in some cases, only a receiver (RX)). The Bluetooth module 1312, the WLAN module 1314, and the SPS module 1316 may include their own dedicated antennas and / or communicate using antennas 1380. The cellular baseband processor 1324 communicates with the UE 104 and / or with the RU associated with the network entity 1302 through the transceiver 1322 via one or more antennas 1380. The cellular baseband processor 1324 and the application processor 1306 may each include a computer-readable medium / memory 1324', 1306', respectively. The additional memory module 1326 may also be considered a computer-readable medium / memory. Each computer-readable medium / memory 1324', 1306', 1326 may be non-transitory. The cellular baseband processor 1324 and the application processor 1306 are each responsible for general processing, including executing software stored on a computer-readable medium / memory. The software, when executed by the cellular baseband processor 1324 / application processor 1306, enables the cellular baseband processor 1324 / application processor 1306 to perform the various functions described above. The computer-readable medium / memory can also be used to store data manipulated by the cellular baseband processor 1324 / application processor 1306 when executing the software.The cellular baseband processor 1324 / application processor 1306 may be a component of the UE 350 and may include the memory 360 and / or at least one of the TX processor 368, the RX processor 356, and the controller / processor 359. In one configuration, the device 1304 may be a processor chip (modem and / or application) and include only the cellular baseband processor 1324 and / or the application processor 1306, while in another configuration, the device 1304 may be the entire UE (e.g., see. Figure 3 350) and includes additional modules of device 1304.

[0162] As discussed above, component 198 is configured to perform one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of the location of the UE or the location of at least one network node; select a secret key for communication with at least one network node based on the one or more positioning measurements; and communicate with at least one network node based on the secret key. Component 198 may be within the cellular baseband processor 1324, the application processor 1306, or within both the cellular baseband processor 1324 and the application processor 1306. Component 198 may be one or more hardware components specifically configured to perform the process / algorithm, implemented by one or more processors configured to perform the process / algorithm, stored in a computer-readable medium for implementation by one or more processors, or some combination thereof. As shown, device 1304 may include a variety of components configured for various functions. In one configuration, device 1304 and in particular cellular baseband processor 1324 and / or application processor 1306 include a component for performing one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of the location of the UE or the location of at least one network node. The apparatus 1304 may also include means for selecting a secret key for communicating with the at least one network node based on the one or more positioning measurements. The apparatus 1304 may also include means for communicating with the at least one network node based on the secret key.

[0163] In one configuration, at least one network node includes at least one TRP, a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

[0164] In another configuration, the signal set includes PRS, SSB, CSI-RS, DMRS, sidelink reference signal, or a combination thereof.

[0165] In another configuration, the one or more positioning measurements include: RSRP, path RSRP, RSTD, phase path measurement, RTOA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0166] In another configuration, the one or more positioning measurements are also associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

[0167] In another configuration, the apparatus 1304 includes means for selecting a secret key for communication with at least one network node based on one or more positioning measurements. In this configuration, the means for selecting a secret key for communication with at least one network node based on one or more positioning measurements may include configuring the apparatus 1304 to generate the secret key based on a key generation function.

[0168] In another configuration, the selection of the secret key is independent of at least one network node.

[0169] In another configuration, the apparatus 1304 includes means for communicating with at least one network node based on a secret key. In this configuration, the means for communicating with at least one network node based on the secret key may include configuring the apparatus 1304 to encrypt one or more channels based on the secret key before communicating with the at least one network node, and to send the one or more channels to the at least one network node after encrypting the one or more channels. In this configuration, the one or more channels may be used to extract the secret key.

[0170] In another configuration, the apparatus 1304 includes means for receiving a configuration from a serving base station, a location server, or a LMF, wherein the configuration may indicate one or more resources for a signal set to be dedicated to selecting a secret key.

[0171] In another configuration, the apparatus 1304 includes means for receiving a set of signals from at least one network node.

[0172] In another configuration, the apparatus 1304 includes means for receiving a set of signals from at least one network node based on a secret key and means for decrypting the set of signals after receiving the set of signals.

[0173] In another configuration, the apparatus 1304 includes means for excluding one or more positioning measurements based on the signal set if the signal set cannot be decrypted.

[0174] A means may be a component 198 of the apparatus 1304 configured to perform the functions recited by the means. As described above, the apparatus 1304 may include a TX processor 368, an RX processor 356, and a controller / processor 359. Thus, in one configuration, the means may be a TX processor 368, an RX processor 356, and / or a controller / processor 359 configured to perform the functions recited by the means.

[0175] Fig.14 1400 is a flow chart of a method of wireless communication. The method may be performed by a location server (e.g., server 820; network entity 1602). At 1402, the location server may send a request for one or more positioning measurements to at least one network node, such as in conjunction with Figure 8 For example, at 822, server 820 may request base station 804 to perform positioning measurements. The request may be sent by, for example Fig.16 The SK generation and application component 199 and / or the transceiver 1646 of the network entity 1602 is executed.

[0176] At 1404, the location server may send a configuration to the UE, where the configuration may indicate one or more resources for a signal set to be dedicated to selection of a secret key by the UE, such as in conjunction with Figure 8 For example, server 820 may send a configuration to UE 802 indicating one or more resources for a signal set to be dedicated to selection of a secret key by UE 802. The sending of the configuration may be performed by, for example Fig.16 The SK generation and application component 199 and / or the transceiver 1646 of the network entity 1602 is executed.

[0177] At 1406, the location server may receive one or more positioning measurements based on the set of signals from the at least one network node, wherein the one or more positioning measurements are associated with at least one of the location of the UE or the location of the at least one network node, such as in conjunction with Figure 8 For example, at 824, server 820 may receive positioning measurements based on positioning reference signals from base station 804, where these positioning measurements may be associated with the location of UE 802 or the location of base station 804. Receipt of one or more positioning measurements may be performed by, for example Fig.16 The SK generation and application component 199 and / or the transceiver 1646 of the network entity 1602 is executed.

[0178] In one example, the location server corresponds to the LMF, and at least one network node includes at least one TRP, a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

[0179] In another example, the signal set is an SRS.

[0180] In another example, the one or more positioning measurements include: RSRP, path RSRP, RSTD, phase path measurement, RTOA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0181] In another example, the one or more positioning measurements are also associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

[0182] At 1408, the location server may select a secret key for communication with at least one network node based on one or more positioning measurements, such as in conjunction with Figure 8 For example, at 826, server 820 may select a secret key for communication with base station 804 based on the positioning measurements. The selection of the secret key may be performed by, for example Fig.16 The SK generation and application component 199 of the network entity 1602 in the example is performed. In this example, the location server can generate a secret key based on a key generation function.

[0183] In one example, the selection of the secret key is independent of the UE.

[0184] At 1410, the location server may send an indication of the secret key to at least one network node, such as in conjunction with Figure 8 For example, at 828, server 820 may send the generated secret key to base station 804. The sending of the indication of the secret key may be performed by, for example Fig.16 The SK generation and application component 199 and / or the transceiver 1646 of the network entity 1602 is executed.

[0185] Fig.15 1500 is a flow chart of a method of wireless communication. The method may be performed by a location server (eg, server 820; network entity 1602).

[0186] At 1506, the location server may receive one or more positioning measurements based on the set of signals from the at least one network node, wherein the one or more positioning measurements are associated with at least one of the location of the UE or the location of the at least one network node, such as in conjunction with Figure 8 For example, at 824, server 820 may receive positioning measurements based on positioning reference signals from base station 804, where these positioning measurements may be associated with the location of UE 802 or the location of base station 804. Receipt of one or more positioning measurements may be performed by, for example Fig.16The SK generation and application component 199 and / or the transceiver 1646 of the network entity 1602 is executed.

[0187] In one example, the location server corresponds to the LMF, and at least one network node includes at least one TRP, a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

[0188] In another example, the signal set is an SRS.

[0189] In another example, the one or more positioning measurements include: RSRP, path RSRP, RSTD, phase path measurement, RTOA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0190] In another example, the one or more positioning measurements are also associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

[0191] In another example, the location server may send a request for one or more positioning measurements to at least one network node, such as in conjunction with Figure 8 For example, at 822, server 820 may request base station 804 to perform positioning measurements. The request may be sent by, for example Fig.16 The SK generation and application component 199 and / or the transceiver 1646 of the network entity 1602 is executed.

[0192] In another example, the location server may send a configuration to the UE, where the configuration may indicate one or more resources for a signal set to be dedicated to selecting a secret key by the UE, such as in conjunction with Figure 8 For example, server 820 may send a configuration to UE 802 indicating one or more resources for a signal set to be dedicated to selection of a secret key by UE 802. The sending of the configuration may be performed by, for example Fig.16 The SK generation and application component 199 and / or the transceiver 1646 of the network entity 1602 is executed.

[0193] At 1508, the location server may select a secret key for communication with at least one network node based on one or more positioning measurements, such as in conjunction with Figure 8 For example, at 826, server 820 may select a secret key for communication with base station 804 based on the positioning measurements. The selection of the secret key may be performed by, for example Fig.16 The SK generation and application component 199 of the network entity 1602 in the example is performed. In this example, the location server can generate a secret key based on a key generation function.

[0194] In one example, the selection of the secret key is independent of the UE.

[0195] At 1510, the location server may send an indication of the secret key to at least one network node, such as in conjunction with Figure 8 For example, at 828, server 820 may send the generated secret key to base station 804. The sending of the indication of the secret key may be performed by, for example Fig.16 The SK generation and application component 199 and / or the transceiver 1646 of the network entity 1602 is executed.

[0196] Fig.161600 is a diagram illustrating an example of a hardware implementation of a network entity 1602. The network entity 1602 may be a location server, a component of a location server, or may implement location server functionality. The network entity 1602 may include at least one of a CU 1610, a DU 1630, or a RU 1640. For example, depending on the layer functionality handled by the component 199, the network entity 1602 may include a CU 1610; both a CU 1610 and a DU 1630; each of the CU 1610, the DU 1630, and the RU 1640; the DU 1630; both a DU 1630 and a RU 1640; or the RU 1640. The CU 1610 may include a CU processor 1612. The CU processor 1612 may include an on-chip memory 1612'. In some aspects, the CU 1610 may also include an additional memory module 1614 and a communication interface 1618. CU 1610 communicates with DU 1630 via a midhaul link such as an F1 interface. DU 1630 may include a DU processor 1632. DU processor 1632 may include on-chip memory 1632'. In some aspects, DU 1630 may also include an additional memory module 1634 and a communication interface 1638. DU 1630 communicates with RU 1640 via a fronthaul link. RU 1640 may include a RU processor 1642. RU processor 1642 may include on-chip memory 1642'. In some aspects, RU 1640 may also include an additional memory module 1644, one or more transceivers 1646, an antenna 1680, and a communication interface 1648. RU 1640 communicates with UE 104. On-chip memory 1612', 1632', 1642' and additional memory modules 1614, 1634, 1644 may each be considered a computer-readable medium / memory. Each computer readable medium / memory may be non-transitory. Each of processors 1612, 1632, 1642 is responsible for general processing, including executing software stored on the computer readable medium / memory. The software, when executed by the corresponding processor, causes the processor to perform the various functions described above. The computer readable medium / memory may also be used to store data manipulated by the processor when executing the software.

[0197] As discussed above, component 199 is configured to receive one or more positioning measurements based on a signal set from at least one network node, wherein the one or more positioning measurements are associated with at least one of the location of the UE or the location of at least one network node; select a secret key for communication of at least one network node based on the one or more positioning measurements; and send an indication of the secret key to at least one network node. Component 199 may be within one or more processors of one or more of CU 1610, DU 1630, and RU 1640. Component 199 may be one or more hardware components specifically configured to perform the process / algorithm, implemented by one or more processors configured to perform the process / algorithm, stored in a computer-readable medium for implementation by one or more processors, or some combination thereof. Network entity 1602 may include a variety of components configured for various functions. In one configuration, network entity 1602 includes a component for receiving one or more positioning measurements based on a signal set from at least one network node, wherein the one or more positioning measurements are associated with at least one of the location of the UE or the location of at least one network node. The network entity 1602 may further include means for selecting a secret key for communications of the at least one network node based on the one or more positioning measurements. The network entity 1602 may further include means for sending an indication of the secret key to the at least one network node.

[0198] In one configuration, the network entity 1602 corresponds to a location server or LMF, and at least one network node includes at least one TRP, a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

[0199] In another configuration, the signal set is an SRS.

[0200] In another configuration, the one or more positioning measurements include: RSRP, path RSRP, RSTD, phase path measurement, RTOA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0201] In another configuration, the one or more positioning measurements are also associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

[0202] In another configuration, the network entity 1602 includes means for sending a request for one or more positioning measurements to at least one network node.

[0203] In another configuration, the network entity 1602 includes means for sending a configuration to the UE, wherein the configuration may indicate one or more resources for the signaling set to be dedicated to selection of a secret key by the UE.

[0204] In another configuration, means for selecting a secret key for communication of at least one network node based on the one or more positioning measurements includes configuring the network entity 1602 to generate the secret key based on a key generation function.

[0205] In another configuration, the selection of the secret key is independent of the UE.

[0206] The means may be a component 199 of the network entity 1602 configured to perform the functions recited by the means. As described above, the network entity 1602 may include the TX processor 316, the RX processor 370, and the controller / processor 375. Thus, in one configuration, the means may be the TX processor 316, the RX processor 370, and / or the controller / processor 375 configured to perform the functions recited by the means.

[0207] Fig.17 1700 is a flow chart of a method of wireless communication. The method may be performed by a first network node (e.g., UE 104, 802, 904; base station 102, 804, 902; device 1804; network entity 1902). At 1702, the first network node may configure at least one parameter for sending a signal set, such as in conjunction with Figure 8 The configuration of at least one parameter for transmitting a signal set may be performed by, for example Fig.18 SK generation and application component 198 of device 1804 and / or Fig.19 The SK generation and application component 199 of the network entity 1902 is executed.

[0208] In one example, the signal set includes PRS, SSB, CSI-RS, DMRS, sidelink reference signal, or a combination thereof.

[0209] In another example, the at least one parameter includes an AoD for each of the signal sets.

[0210] At 1704, the first network node may select a secret key to use for communication with the second network node based on at least one parameter, such as in conjunction with Figure 8 The choice of key can be determined by, for example Fig.18 SK generation and application component 198 of device 1804 and / or Fig.19 The SK generation and application component 199 of the network entity 1902 is executed.

[0211] In one example, the first network node corresponds to a UE and the second network node corresponds to at least one base station. In this example, the first network node may send a request to a location server or LMF, wherein the request specifies a secret key extraction based on positioning measurements.

[0212] In another example, the first network node corresponds to at least one base station and the second network node corresponds to a UE. In this example, the first network node may receive at least one parameter from a location server or a LMF. In another example, the first network node may perform one or more positioning measurements for a second signal set from the second network node, report the one or more positioning measurements to the location server or the LMF, and receive an indication of a secret key from the location server or the LMF.

[0213] At 1706, the first network node may send a signal set to the second network node based on at least one parameter and a secret key, such as in conjunction with Figure 8 The sending of the signal set based on at least one parameter and a secret key may be performed by, for example Fig.18 SK generation and application component 198 of device 1804 and / or Fig.19 The SK generation and application component 199 of the network entity 1902 is executed.

[0214] Fig.181800 is an example of a hardware implementation of an example device 1804. The device 1804 may be a UE, a component of a UE, or may implement UE functionality. In some aspects, the device 1804 may include a cellular baseband processor 1824 (also referred to as a modem) coupled to one or more transceivers 1822 (e.g., a cellular RF transceiver). The cellular baseband processor 1824 may include on-chip memory 1824'. In some aspects, the device 1804 may also include one or more subscriber identity module (SIM) cards 1820 and an application processor 1806 coupled to a secure digital (SD) card 1808 and a screen 1810. The application processor 1806 may include on-chip memory 1806'. In some aspects, the device 1804 may also include a Bluetooth module 1812, a WLAN module 1814, an SPS module 1816 (e.g., a GNSS module), one or more sensor modules 1818 (e.g., an atmospheric pressure sensor / altimeter; a motion sensor such as an inertial management unit (IMU), a gyroscope, and / or an accelerometer; light detection and ranging (LIDAR), radio-aided detection and ranging (RADAR), sound navigation and ranging (SONAR), a magnetometer, audio, and / or other technologies for positioning), an additional memory module 1826, a power source 1830, and / or a camera 1832. The Bluetooth module 1812, the WLAN module 1814, and the SPS module 1816 may include an on-chip transceiver (TRX) (or in some cases, only a receiver (RX)). The Bluetooth module 1812, the WLAN module 1814, and the SPS module 1816 may include their own dedicated antennas and / or communicate using an antenna 1880. The cellular baseband processor 1824 communicates with the UE 104 and / or with the RU associated with the network entity 1802 through the transceiver 1822 via one or more antennas 1880. The cellular baseband processor 1824 and the application processor 1806 may each include a computer-readable medium / memory 1824', 1806', respectively. The additional memory module 1826 may also be considered as a computer-readable medium / memory. Each computer-readable medium / memory 1824', 1806', 1826 may be non-transitory. The cellular baseband processor 1824 and the application processor 1806 are each responsible for general processing, including executing software stored on a computer-readable medium / memory. The software enables the cellular baseband processor 1824 / application processor 1806 to perform the various functions described above when executed by the cellular baseband processor 1824 / application processor 1806. The computer-readable medium / memory can also be used to store data manipulated by the cellular baseband processor 1824 / application processor 1806 when executing the software.The cellular baseband processor 1824 / application processor 1806 may be a component of the UE 350 and may include the memory 360 and / or at least one of the TX processor 368, the RX processor 356, and the controller / processor 359. In one configuration, the device 1804 may be a processor chip (modem and / or application) and include only the cellular baseband processor 1824 and / or the application processor 1806, while in another configuration, the device 1804 may be the entire UE (e.g., see. Figure 3 350) and includes additional modules of device 1804.

[0215] As discussed above, component 198 is configured to: configure at least one parameter for sending a signal set; select a secret key for communication with a second network node based on the at least one parameter; and send a signal set to the second network node based on the at least one parameter and the secret key. Component 198 may be within the cellular baseband processor 1824, the application processor 1806, or both the cellular baseband processor 1824 and the application processor 1806. Component 198 may be one or more hardware components specifically configured to perform the process / algorithm, implemented by one or more processors configured to perform the process / algorithm, stored in a computer-readable medium for implementation by one or more processors, or some combination thereof. As shown, device 1804 may include a variety of components configured for various functions. In one configuration, device 1804, and in particular cellular baseband processor 1824 and / or application processor 1806, includes a component for configuring at least one parameter for sending a signal set. Device 1804 may also include a component for selecting a secret key for communication with a second network node based on at least one parameter. The apparatus 1804 may also include means for sending the set of signals to the second network node based on the at least one parameter and the secret key.

[0216] In one configuration, the signal set includes PRS, SSB, CSI-RS, DMRS, sidelink reference signal, or a combination thereof.

[0217] In another configuration, the at least one parameter includes an AoD for each of the signal sets.

[0218] In another configuration, the first network node corresponds to a UE and the second network node corresponds to at least one base station. In this configuration, the apparatus 1804 includes means for sending a request to a location server or LMF, wherein the request specifies a secret key extraction based on positioning measurements.

[0219] In another configuration, the first network node corresponds to at least one base station and the second network node corresponds to a UE. In this configuration, the apparatus 1804 includes means for receiving at least one parameter from a location server or LMF. In another configuration, the apparatus 1804 includes means for performing one or more positioning measurements for a second set of signals from the second network node, means for reporting the one or more positioning measurements to the location server or LMF, and means for receiving an indication of a secret key from the location server or LMF.

[0220] A means may be a component 198 of the apparatus 1804 configured to perform the functions recited by the means. As described above, the apparatus 1804 may include a TX processor 368, an RX processor 356, and a controller / processor 359. Thus, in one configuration, the means may be a TX processor 368, an RX processor 356, and / or a controller / processor 359 configured to perform the functions recited by the means.

[0221] Fig.191900 is an example of a hardware implementation of a network entity 1902. The network entity 1902 may be a BS, a component of a BS, or may implement BS functionality. The network entity 1902 may include at least one of a CU 1910, a DU 1930, or a RU 1940. For example, depending on the layer functionality handled by the component 199, the network entity 1902 may include a CU 1910; both a CU 1910 and a DU 1930; each of the CU 1910, the DU 1930, and the RU 1940; the DU 1930; both a DU 1930 and a RU 1940; or the RU 1940. The CU 1910 may include a CU processor 1912. The CU processor 1912 may include an on-chip memory 1912'. In some aspects, the CU 1910 may also include an additional memory module 1914 and a communication interface 1918. CU 1910 communicates with DU 1930 via a midhaul link such as an F1 interface. DU 1930 may include a DU processor 1932. DU processor 1932 may include on-chip memory 1932'. In some aspects, DU 1930 may also include an additional memory module 1934 and a communication interface 1938. DU 1930 communicates with RU 1940 via a fronthaul link. RU 1940 may include a RU processor 1942. RU processor 1942 may include on-chip memory 1942'. In some aspects, RU 1940 may also include an additional memory module 1944, one or more transceivers 1946, an antenna 1980, and a communication interface 1948. RU 1940 communicates with UE 104. On-chip memory 1912', 1932', 1942' and additional memory modules 1914, 1934, 1944 may each be considered a computer-readable medium / memory. Each computer readable medium / memory may be non-transitory. Each of the processors 1912, 1932, 1942 is responsible for general processing, including executing software stored on the computer readable medium / memory. The software, when executed by the corresponding processor, causes the processor to perform the various functions described above. The computer readable medium / memory can also be used to store data manipulated by the processor when executing the software.

[0222] As discussed above, component 199 is configured to: configure at least one parameter for sending a signal set; select a secret key for communication with a second network node based on the at least one parameter; and send a signal set to the second network node based on the at least one parameter and the secret key. Component 199 may be within one or more processors of one or more of CU 1910, DU 1930, and RU 1940. Component 199 may be one or more hardware components specifically configured to perform the process / algorithm, implemented by one or more processors configured to perform the process / algorithm, stored in a computer-readable medium for implementation by one or more processors, or some combination thereof. Network entity 1902 may include a variety of components configured for various functions. In one configuration, network entity 1902 includes a component for configuring at least one parameter for sending a signal set. Network entity 1902 may also include a component for selecting a secret key for communication with a second network node based on at least one parameter. Network entity 1902 may also include a component for sending a signal set to a second network node based on at least one parameter and the secret key.

[0223] In one configuration, the signal set includes PRS, SSB, CSI-RS, DMRS, sidelink reference signal, or a combination thereof.

[0224] In another configuration, the at least one parameter includes an AoD for each of the signal sets.

[0225] In another configuration, the first network node corresponds to a UE and the second network node corresponds to at least one base station. In this configuration, the apparatus 1804 includes means for sending a request to a location server or LMF, wherein the request specifies a secret key extraction based on positioning measurements.

[0226] In another configuration, the first network node corresponds to at least one base station and the second network node corresponds to a UE. In this configuration, the apparatus 1804 includes means for receiving at least one parameter from a location server or LMF. In another configuration, the apparatus 1804 includes means for performing one or more positioning measurements for a second set of signals from the second network node, means for reporting the one or more positioning measurements to the location server or LMF, and means for receiving an indication of a secret key from the location server or LMF.

[0227] The means may be a component 199 of the network entity 1902 configured to perform the functions recited by the means. As described above, the network entity 1902 may include the TX processor 316, the RX processor 370, and the controller / processor 375. Thus, in one configuration, the means may be the TX processor 316, the RX processor 370, and / or the controller / processor 375 configured to perform the functions recited by the means.

[0228] It should be understood that the specific order or hierarchy of the blocks in the disclosed process / flowchart is only an illustration of the exemplary method. It should be understood that the specific order or hierarchy of the blocks in the process / flowchart can be rearranged based on design preferences. Further, some blocks can be combined or omitted. The attached method claims provide the elements of each block in a sample order, but are not limited to the specific order or hierarchy provided.

[0229] The foregoing description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects. Therefore, the claims are not limited to the various aspects described herein, but should be given the full scope consistent with the language claims. Unless otherwise specified, reference to an element in the singular form does not mean "one and only one", but "one or more". Terms such as "if", "when ..." and "while" do not mean a direct temporal relationship or reaction. That is, these phrases, such as "when ...", do not mean an immediate action in response to the occurrence of an action or during the occurrence of an action, but simply imply that if the conditions are met, the action will occur, but no specific or immediate time limit is required for the occurrence of the action. The word "exemplary" is used herein to mean "used as an example, instance, or illustration". Any aspect described as "exemplary" herein is not necessarily interpreted as being preferred or having advantages over other aspects. Unless otherwise specified, the term "some" refers to one or more. Combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" include any combination of A, B, and / or C, and may include multiple A, multiple B, or multiple C. Specifically, combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B, and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" may be only A, only B, only C, A and B, A and C, B and C, or A and B and C, wherein any such combination may contain one or more members of A, B, or C. A set should be interpreted as a set of elements, wherein the number of elements is one or more. Thus, for a set of X, X will include one or more elements. If the first device receives data from the second device or sends data to the second device, data can be directly received / sent between the first device and the second device, or data can be indirectly received / sent between the first device and the second device by a collection of devices. All structural and functional equivalents that are known or will be known later to those of ordinary skill in the art throughout the elements of the various aspects described in this disclosure are expressly incorporated herein by reference, and are covered by the claims. In addition, anything disclosed herein is not intended to be dedicated to the public, regardless of whether such disclosures are explicitly stated in the claims. "Module", "mechanism", "element", "equipment" and other words cannot replace the word "component". Therefore, no claim element will be interpreted as a functional component unless the element is explicitly recorded using the phrase "component for...".

[0230] As used herein, the phrase "based on" should not be interpreted as referring to a closed set of information, one or more conditions, one or more factors, etc. In other words, the phrase "based on A" (where "A" can be information, a condition, a factor, etc.) should be interpreted as "based at least on A" unless specifically stated differently.

[0231] The following aspects are merely illustrative and may be combined with other aspects or teachings described herein without limitation.

[0232] Aspect 1 is a method for wireless communication at a UE, comprising: performing one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of a position of the UE or a position of the at least one network node; selecting a secret key for communication with the at least one network node based on the one or more positioning measurements; and communicating with the at least one network node based on the secret key.

[0233] Aspect 2 is a method according to Aspect 1, wherein the at least one network node includes at least one TRP, a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

[0234] Aspect 3 is a method according to aspect 2, wherein the signal set includes PRS, SSB, CSI-RS, DMRS, side link reference signal or a combination thereof.

[0235] Aspect 4 is a method according to any one of aspects 1 to 3, further comprising receiving the signal set from the at least one network node, wherein the one or more positioning measurements are performed after receiving the signal set.

[0236] Aspect 5 is a method according to any one of aspects 1 to 4, further comprising receiving a configuration from a serving base station, a location server or a LMF, wherein the configuration indicates one or more resources for the signal set to be dedicated to selecting the secret key.

[0237] Aspect 6 is a method according to any one of Aspects 1 to 5, wherein the one or more positioning measurements include: RSRP, path RSRP, RSTD, phase path measurement, RTOA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0238] Aspect 7 is a method according to any one of aspects 1 to 6, wherein selecting the secret key for use in the communication with the at least one network node comprises generating the secret key based on a key generation function.

[0239] Aspect 8 is a method according to any one of Aspects 1 to 7, wherein communicating with the at least one network node based on the secret key includes: encrypting one or more channels based on the secret key before communicating with the at least one network node; and sending the one or more channels to the at least one network node after encrypting the one or more channels.

[0240] Aspect 9 is the method according to aspect 8, wherein the one or more channels are used to extract the secret key.

[0241] Aspect 10 is a method according to any one of Aspects 1 to 9, wherein communicating with the at least one network node based on the secret key includes: receiving the signal set from the at least one network node based on the secret key; and decrypting the signal set after receiving the signal set.

[0242] Aspect 11 is a method according to any one of aspects 1 to 10, wherein the one or more positioning measurements are further associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

[0243] Aspect 12 is a method according to any one of aspects 1 to 11, further comprising: excluding the one or more positioning measurements based on the signal set if the signal set cannot be decrypted.

[0244] Aspect 13 is a method according to any one of aspects 1 to 12, wherein the selection of the secret key is independent of the at least one network node.

[0245] Aspect 14 is an apparatus for performing wireless communication to implement any one of aspects 1 to 13.

[0246] Aspect 15 is an apparatus for wireless communication, comprising means for implementing any one of aspects 1 to 13.

[0247] Aspect 16 is a computer-readable medium storing computer-executable code, wherein the code, when executed by a processor, causes the processor to implement any one of aspects 1 to 13.

[0248] Aspect 17 is a method for performing wireless communications at a network entity, comprising: receiving one or more positioning measurements based on a signal set from at least one network node, wherein the one or more positioning measurements are associated with at least one of a position of a UE or a position of the at least one network node; selecting a secret key for communication with the at least one network node based on the one or more positioning measurements; and sending an indication of the secret key to the at least one network node.

[0249] Aspect 18 is a method according to Aspect 17, wherein the network entity corresponds to a location server or an LMF, and the at least one network node includes at least one TRP, a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

[0250] Aspect 19 is a method according to any one of aspects 17 or 18, wherein the signal set is an SRS.

[0251] Aspect 20 is a method according to any one of aspects 17 to 19, further comprising sending a request for the one or more positioning measurements to the at least one network node.

[0252] Aspect 21 is a method according to any one of aspects 17 to 20, further comprising sending a configuration to the UE, wherein the configuration indicates one or more resources for the signal set to be dedicated to selection of the secret key by the UE.

[0253] Aspect 22 is a method according to any one of Aspects 17 to 21, wherein the one or more positioning measurements include: RSRP, path RSRP, RSTD, phase path measurement, RTOA, AoA, ZoA, SINR, one or more quality metrics, Doppler shift, Rx-Tx time difference, or a combination thereof.

[0254] Aspect 23 is a method according to any one of aspects 17 to 22, wherein selecting the secret key for use in the communication of the at least one network node comprises generating the secret key based on a key generation function.

[0255] Aspect 24 is a method according to any one of aspects 17 to 23, wherein the one or more positioning measurements are further associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

[0256] Aspect 25 is a method according to any one of aspects 17 to 24, wherein the selection of the secret key is independent of the at least one UE.

[0257] Aspect 26 is an apparatus for wireless communication to implement any one of aspects 17 to 25.

[0258] Aspect 27 is an apparatus for wireless communication, comprising means for implementing any one of aspects 17 to 25.

[0259] Aspect 28 is a computer readable medium storing computer executable code, wherein the code, when executed by a processor, causes the processor to implement any one of aspects 17 to 25.

[0260] Aspect 29 is a method for performing wireless communications at a first network node, comprising: configuring at least one parameter for sending a signal set; selecting a secret key for communication with a second network node based on the at least one parameter; and sending the signal set to the second network node based on the at least one parameter and the secret key.

[0261] Aspect 30 is a method according to aspect 29, wherein the first network node corresponds to a UE and the second network node corresponds to at least one base station.

[0262] Aspect 31 is a method according to aspect 30, further comprising sending a request to a location server or LMF, wherein the request specifies a secret key extraction based on positioning measurements.

[0263] Aspect 32 is a method according to any one of aspects 29 to 31, wherein the first network node corresponds to at least one base station and the second network node corresponds to a UE.

[0264] Aspect 33 is a method according to aspect 32, further comprising receiving the at least one parameter from a location server or a LMF.

[0265] Aspect 34 is a method according to aspect 32, further comprising: performing one or more positioning measurements for a second set of signals from the second network node; reporting the one or more positioning measurements to a location server or LMF; and receiving an indication of the secret key from the location server or the LMF.

[0266] Aspect 35 is a method according to any one of aspects 29 to 34, wherein the signal set includes a PRS, an SSB, a CSI-RS, a DMRS, a sidelink reference signal, or a combination thereof.

[0267] Aspect 36 is a method according to any one of aspects 29 to 35, wherein the at least one parameter comprises an AoD for each of the signal sets.

[0268] Aspect 37 is an apparatus for wireless communication to implement any one of aspects 29 to 36.

[0269] Aspect 38 is an apparatus for wireless communication, comprising means for implementing any one of aspects 29 to 36.

[0270] Aspect 39 is a computer readable medium storing computer executable code, wherein the code, when executed by a processor, causes the processor to implement any one of aspects 29 to 36.

Claims

1. An apparatus for wireless communication at a user equipment (UE), comprising: Memory; at least one transceiver; and at least one processor, the at least one processor being communicatively connected to the memory and the at least one transceiver, the at least one processor being configured to: performing one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of a location of the UE or a location of the at least one network node; selecting a secret key for communicating with the at least one network node based on the one or more positioning measurements; as well as Communicating with the at least one network node is performed based on the secret key.

2. The apparatus according to claim 1, wherein the at least one network node comprises at least one transmit receive point (TRP), a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

3. The apparatus according to claim 1, wherein the signal set comprises a positioning reference signal (PRS), a synchronization signal block (SSB), a channel state information-reference signal (CSI-RS), a demodulation reference signal (DMRS), a sidelink reference signal, or a combination thereof.

4. The apparatus of claim 1 , wherein the at least one processor is further configured to: The set of signals is received from the at least one network node, wherein the one or more positioning measurements are performed after receiving the set of signals.

5. The apparatus of claim 1 , wherein the at least one processor is further configured to: A configuration is received from a serving base station, a location server, or a location management function (LMF), wherein the configuration indicates one or more resources for the signal set to be dedicated to selecting the secret key.

6. The apparatus of claim 1 , wherein the one or more positioning measurements comprise: Reference signal received power (RSRP), Path RSRP, Reference Signal Time Difference (RSTD), Phase path measurement, Relative time of arrival (RTOA), Azimuth angle of arrival (AoA), Zenith angle of arrival (ZoA), Signal to Interference and Noise Ratio (SINR), one or more quality metrics, Doppler shift, Receive-transmit (Rx-Tx) time difference, or A combination of them.

7. The apparatus of claim 1 , wherein to select the secret key for use in the communication with the at least one network node, the at least one processor is further configured to: The secret key is generated based on a key generation function.

8. The apparatus of claim 1, wherein to communicate with the at least one network node based on the secret key, the at least one processor is further configured to: encrypting one or more channels based on the secret key prior to communicating with the at least one network node; and The one or more channels are sent to the at least one network node after encrypting the one or more channels.

9. The apparatus of claim 8, wherein the one or more channels are used to extract the secret key.

10. The apparatus of claim 1, wherein to communicate with the at least one network node based on the secret key, the at least one processor is further configured to: receiving the set of signals from the at least one network node based on the secret key; and The signal set is decrypted after receiving the signal set.

11. The apparatus of claim 1, wherein the one or more positioning measurements are further associated with an uncertainty margin, such that any secret key selected within the uncertainty margin is the same secret key.

12. The apparatus of claim 1, wherein the at least one processor is further configured to: The one or more positioning measurements are excluded based on the set of signals if the set of signals cannot be decrypted.

13. The apparatus of claim 1, wherein the selection of the secret key is independent of the at least one network node.

14. A method of wireless communication at a user equipment (UE), comprising: performing one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of a location of the UE or a location of the at least one network node; selecting a secret key for communicating with the at least one network node based on the one or more positioning measurements; as well as Communicating with the at least one network node is performed based on the secret key.

15. An apparatus for wireless communication at a network entity, comprising: Memory; at least one transceiver; and at least one processor, the at least one processor being communicatively connected to the memory and the at least one transceiver, the at least one processor being configured to: receiving one or more positioning measurements based on a set of signals from at least one network node, wherein the one or more positioning measurements are associated with at least one of a location of a user equipment (UE) or a location of the at least one network node; selecting a secret key for communications of the at least one network node based on the one or more positioning measurements; as well as An indication of the secret key is sent to the at least one network node.

16. An apparatus according to claim 15, wherein the network entity corresponds to a location server or a location management function (LMF), and the at least one network node includes at least one transmit receive point (TRP), a base station or a component of the base station, at least one side link device, at least one second UE, or a combination thereof.

17. The apparatus of claim 15, wherein the set of signals is a sounding reference signal (SRS).

18. The apparatus of claim 15, wherein the at least one processor is further configured to: A request for the one or more positioning measurements is sent to the at least one network node.

19. The apparatus of claim 15, wherein the at least one processor is further configured to: A configuration is sent to the UE, wherein the configuration indicates one or more resources for the signal set to be dedicated to selection of the secret key by the UE.

20. The apparatus of claim 15, wherein the one or more positioning measurements comprise: Reference signal received power (RSRP), Path RSRP, Reference Signal Time Difference (RSTD), Phase path measurement, Relative time of arrival (RTOA), Azimuth angle of arrival (AoA), Zenith angle of arrival (ZoA), Signal to Interference and Noise Ratio (SINR), one or more quality metrics, Doppler shift, Receive-transmit (Rx-Tx) time difference, or A combination of them.

21. The apparatus of claim 15, wherein to select the secret key for use in the communication of the at least one network node, the at least one processor is further configured to: The secret key is generated based on a key generation function.

22. The apparatus of claim 15, wherein the one or more positioning measurements are further associated with an uncertainty margin such that any secret key selected within the uncertainty margin is the same secret key.

23. The apparatus of claim 15, wherein the selection of the secret key is independent of the UE.

24. An apparatus for wireless communication at a first network node, comprising: Memory; at least one transceiver; and at least one processor, the at least one processor being communicatively connected to the memory and the at least one transceiver, the at least one processor being configured to: configuring at least one parameter for sending a signal set; selecting a secret key for communication with the second network node based on the at least one parameter; as well as The set of signals is sent to the second network node based on the at least one parameter and the secret key.

25. The apparatus of claim 24, wherein the first network node corresponds to a user equipment (UE) and the second network node corresponds to at least one base station.

26. The apparatus of claim 25, wherein the at least one processor is further configured to: A request is sent to a location server or location management function (LMF), wherein the request specifies a secret key extraction based on positioning measurements.

27. The apparatus of claim 24, wherein the first network node corresponds to at least one base station and the second network node corresponds to a user equipment (UE).

28. The apparatus of claim 27, wherein the at least one processor is further configured to: The at least one parameter is received from a location server or a location management function (LMF).

29. The apparatus of claim 27, wherein the at least one processor is further configured to: performing one or more positioning measurements on a second set of signals from the second network node; reporting the one or more positioning measurements to a location server or a location management function (LMF); and An indication of the secret key is received from the location server or the LMF.

30. The apparatus of claim 24, wherein the signal set comprises a sounding reference signal (SRS), a positioning reference signal (PRS), a synchronization signal block (SSB), a channel state information-reference signal (CSI-RS), a demodulation reference signal (DMRS), a sidelink reference signal, or a combination thereof, and wherein the at least one parameter comprises an angle of departure (AoD) for each signal set in the signal set.

Images