Secure ranging sequence generation

Abstract

A ranging method includes receiving, at a first UE, encrypted input information from a first entity; communicating, by the first UE, with a second entity as a second UE to establish a ranging session with the second UE; generating an encrypted ranging signal using the encrypted input information; and using the encrypted ranging signal in the ranging session for ranging between the first UE and the second UE.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Greek Patent Application No. 20220100264, filed on March 28, 2022, entitled “SECURE RANGING SEQUENCE GENERATION,” which application is assigned to the assignee of the present invention, and the entire contents of which are hereby incorporated herein by reference for all purposes. Background Art

[0003] Wireless communication systems have evolved over several generations, including first generation analog wireless telephone service (1G), second generation (2G) digital wireless telephone service (including transitional 2.5G and 2.75G networks), third generation (3G) high-speed data wireless service with Internet capabilities, fourth generation (4G) service (e.g., Long Term Evolution (LTE) or WiMax), fifth generation (5G) service, and the like. There are many different types of wireless communication systems in use today, including cellular and personal communications service (PCS) systems. Examples of known cellular systems include the cellular analog Advanced Mobile Phone System (AMPS), and digital cellular systems based on code division multiple access (CDMA), frequency division multiple access (FDMA), orthogonal frequency division multiple access (OFDMA), time division multiple access (TDMA), global system for mobile access (GSM) TDMA variants, and the like.

[0004] The fifth generation (5G) mobile standard requires higher data transfer speeds, a greater number of connections and better coverage, among other improvements. According to the Next Generation Mobile Network Alliance, the 5G standard is designed to provide data rates of tens of megabits per second to each of tens of thousands of users, with a data rate of 1 gigabit per second provided to dozens of workers on an office floor. In order to support large sensor deployments, hundreds of thousands of simultaneous connections should be supported. Therefore, the spectrum efficiency of 5G mobile communications should be significantly improved compared to the current 4G standard. In addition, signaling efficiency should be improved and latency should be significantly reduced compared to the current standard. Summary of the invention

[0005] An example first UE (user equipment) includes: a transceiver configured to send and receive wireless signals; a memory; and a processor communicatively coupled to the memory and the transceiver, the processor being configured to: receive encrypted input information from a first entity via the transceiver; communicate with a second entity, which is a second UE, via the transceiver to establish a ranging session with the second UE; generate an encrypted ranging signal using the encrypted input information; and use the encrypted ranging signal in the ranging session for ranging between the first UE and the second UE.

[0006] An example ranging method includes: receiving encrypted input information from a first entity at a first UE; communicating, by the first UE, with a second entity as a second UE to establish a ranging session with the second UE; using the encrypted input information to generate an encrypted ranging signal; and using the encrypted ranging signal in the ranging session for ranging between the first UE and the second UE.

[0007] Another example first UE includes: a component for receiving encrypted input information from a first entity; a component for communicating with a second entity as a second UE to establish a ranging session with the second UE; a component for using the encrypted input information to generate an encrypted ranging signal; and a component for using the encrypted ranging signal in the ranging session for ranging between the first UE and the second UE.

[0008] An example non-transitory processor-readable storage medium includes processor-readable instructions for causing a processor of a first UE to perform the following operations: receive encrypted input information from a first entity; communicate with a second entity as a second UE to establish a ranging session with the second UE; use the encrypted input information to generate an encrypted ranging signal; and use the encrypted ranging signal in the ranging session for ranging between the first UE and the second UE.

[0009] An example apparatus includes: a transceiver configured to send and receive wireless signals; a memory; and a processor communicatively coupled to the memory and the transceiver, the processor configured to send an encrypted message and a ranging indication to at least a first UE and a second UE via the transceiver, the encrypted message including encrypted input information, the ranging indication indicating that the encrypted input information is used to generate an encrypted ranging signal for ranging.

[0010] An example ranging information distribution method includes: sending an encrypted message including encrypted input information from a device to at least a first UE and a second UE; and sending a ranging indication from the device to at least the first UE and the second UE, the ranging indication indicating that the encrypted input information is used to generate an encrypted ranging signal for ranging.

[0011] Another example apparatus includes: means for sending an encrypted message including encrypted input information to at least a first UE and a second UE; and means for sending a ranging indication to at least the first UE and the second UE, the ranging indication indicating that the encrypted input information is used to generate an encrypted ranging signal for ranging.

[0012] Another example non-transitory processor-readable storage medium includes processor-readable instructions for causing a processor of a device to perform the following operations: sending an encrypted message including encrypted input information to at least a first UE and a second UE; and sending a ranging indication to at least the first UE and the second UE, the ranging indication indicating that the encrypted input information is used to generate an encrypted ranging signal for ranging. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] 1 is a simplified diagram of an example wireless communication system.

[0014] 2 is a block diagram of components of the example user equipment shown in FIG. 1 .

[0015] 3 is a block diagram of components of an example transmit / receive point.

[0016] FIG. 4 is a block diagram of components of an example server, various embodiments of which are shown in FIG. 1 .

[0017] 5 is a block diagram of example user equipment.

[0018] 6 is a block diagram of an example transmit / receive point.

[0019] 7 is a block diagram of an example environment for network-assisted positioning.

[0020] FIG8 is a block diagram of a method of generating ciphertext for positioning.

[0021] 9 is a block diagram of an example environment for out-of-network coverage positioning.

[0022] 10 is a block diagram of example plaintext and encryption keys for use in a method of generating ciphertext for positioning.

[0023] 11 is a timing diagram of signaling and process flow for reduced discovery overhead and secure ranging.

[0024] FIG12 is a flow chart of a distance measurement method.

[0025] FIG13 is a flowchart of a ranging information distribution method. DETAILED DESCRIPTION

[0026] Discussed herein are techniques for generating secure ranging sequences for secure ranging (e.g., determining one or more ranges that can be used to determine a location estimate for a device and / or one or more location estimates for one or more devices). For example, a source of assistance data (e.g., a transmit / receive point or user equipment (UE)) may transmit assistance data to multiple user UEs. The assistance data may include some plaintext and encryption keys and / or information from which the encryption keys are determined. The UEs receiving the assistance data may communicate with each other to determine additional information, and may use the assistance data and the additional information to complete a plaintext / encryption key combination and use the combination as an input to an encryption process to produce ciphertext. The UE may use the ciphertext to send, receive, and measure one or more ranging signals (which include the ciphertext). However, other specific implementations other than these examples may be used.

[0027] The items and / or techniques described herein may provide one or more of the following capabilities and other capabilities not mentioned. Compared to the old method for secure ranging, the overhead signaling for secure ranging can be reduced by utilizing common data provided to multiple UEs to derive one or more secure ranging signals transmitted and measured between UEs. The techniques discussed herein are scalable to a large number of devices and facilitate low-overhead collaborative communications. Secure ranging can be performed by non-attacker devices in a collaborative environment where one or more attackers are present without being affected by the attackers. Other capabilities may be provided, and not every specific implementation according to the present disclosure must provide any of the capabilities discussed, let alone all of the capabilities.

[0028] Obtaining the location of a mobile device accessing a wireless network can be used for many applications, including, for example, emergency calls, personal navigation, consumer asset tracking, locating friends or family members, etc. Existing positioning methods include methods based on measuring radio signals transmitted from various devices or entities, including satellite vehicles (SVs) and terrestrial radio sources such as base stations and access points in wireless networks. It is expected that standardization for 5G wireless networks will include support for various positioning methods, which can utilize reference signals transmitted by base stations for positioning determination in a manner similar to how LTE wireless networks currently utilize positioning reference signals (PRS) and / or cell-specific reference signals (CRS).

[0029] This specification may quote a sequence of actions to be performed by, for example, an element of a computing device. Each action described herein can be performed by a dedicated circuit (e.g., an application specific integrated circuit (ASIC)), by program instructions being executed by one or more processors, or by a combination of the two. The sequence of actions described herein may be implemented in a non-transient computer-readable medium having a corresponding computer instruction set stored thereon, which, when executed, causes an associated processor to perform the functionality described herein. Therefore, the various aspects described herein may be implemented in a number of different forms, all of which fall within the scope of the present disclosure, including the claimed subject matter.

[0030] As used herein, the terms "user equipment" (UE) and "base station" are not dedicated to or otherwise limited to any particular radio access technology (RAT), unless otherwise specified. In general, such UE can be any wireless communication device (e.g., mobile phone, router, tablet computer, laptop computer, consumer asset tracking device, Internet of Things (IoT) device, etc.) used by a user to communicate on a wireless communication network. The UE can be mobile or can be stationary (e.g., at certain times) and can communicate with a radio access network (RAN). As used herein, the term "UE" can be interchangeably referred to as an "access terminal" or "AT", "client device", "wireless device", "subscriber equipment", "subscriber terminal", "subscriber station", "user terminal" or UT, "mobile terminal", "mobile station", "mobile device" or their variants. In general, the UE can communicate with the core network via the RAN, and through the core network, the UE can connect to external networks such as the Internet and other UEs. Of course, other mechanisms for connecting to the core network and / or the Internet are also possible for the UE, such as through a wired access network, a WiFi network (eg, based on IEEE (Institute of Electrical and Electronics Engineers) 802.11, etc.), and the like.

[0031] Depending on the network in which the base station is deployed, the base station may operate according to one of several RATs when communicating with the UE. Examples of base stations include access points (APs), network nodes, NodeBs, evolved NodeBs (eNBs), or general NodeBs (gNodeBs, gNBs). In addition, in some systems, the base station may only provide edge node signaling functions, while in other systems, the base station may provide additional control functions and / or network management functions.

[0032] The UE may be implemented by any of several types of devices, including but not limited to a printed circuit (PC) card, a compact flash device, an external or internal modem, a wireless or wired phone, a smart phone, a tablet device, a consumer asset tracking device, an asset tag, etc. The communication link through which the UE can transmit signals to the RAN is called an uplink channel (e.g., a reverse traffic channel, a reverse control channel, an access channel, etc.). The communication link through which the RAN can transmit signals to the UE is called a downlink or forward link channel (e.g., a paging channel, a control channel, a broadcast channel, a forward traffic channel, etc.). As used herein, the term "traffic channel (TCH)" may refer to an uplink / reverse traffic channel or a downlink / forward traffic channel.

[0033] As used herein, depending on the context, the term "cell" or "sector" may correspond to one of multiple cells of a base station or to the base station itself. The term "cell" may refer to a logical communication entity used to communicate with a base station (e.g., on a carrier) and may be associated with an identifier to distinguish adjacent cells operating via the same or different carriers (e.g., physical cell identifier (PCID), virtual cell identifier (VCID)). In some examples, a carrier may support multiple cells, and different cells may be configured according to different protocol types that may provide access to different types of devices (e.g., machine type communication (MTC), narrowband Internet of Things (NB-IoT), enhanced mobile broadband (eMBB), or other protocol types). In some examples, the term "cell" may refer to a portion of a geographic coverage area (e.g., a sector) on which the logical entity operates.

[0034] 1 , an example of a communication system 100 includes a UE 105, a UE 106, a radio access network (RAN) (here, a fifth generation (5G) next generation (NG) RAN (NG-RAN) 135), a 5G core network (5GC) 140, and a server 150. The UE 105 and / or the UE 106 may be, for example, an IoT device, a location tracker device, a cellular phone, a vehicle (e.g., a car, a truck, a bus, a ship, etc.), or other devices. A 5G network may also be referred to as a new radio (NR) network; the NG-RAN 135 may be referred to as a 5G RAN or a NR RAN; and the 5GC 140 may be referred to as an NG core network (NGC). Standardization of the NG-RAN and the 5GC is being conducted in the 3rd Generation Partnership Project (3GPP). Accordingly, the NG-RAN 135 and the 5GC 140 may comply with current or future standards for 5G support from the 3GPP. NG-RAN 135 may be another type of RAN, such as a 3G RAN, a 4G Long Term Evolution (LTE) RAN, etc. UE 106 may be similarly configured and coupled to UE 105 to transmit and / or receive signals to and / or from similar other entities in system 100, but such signaling is not indicated in FIG. 1 for simplicity of the drawing. Similarly, for simplicity, the discussion focuses on UE 105. Communication system 100 may utilize information from a constellation 185 of satellite vehicles (SVs) 190, 191, 192, 193 of a satellite positioning system (SPS) (e.g., a global navigation satellite system (GNSS)) such as the Global Positioning System (GPS), the Global Navigation Satellite System (GLONASS), Galileo, or BeiDou or some other local or regional SPS such as the Indian Regional Navigation Satellite System (IRNSS), the European Geostationary Navigation Overlay Service (EGNOS), or the Wide Area Augmentation System (WAAS). Additional components of communication system 100 are described below. Communications system 100 may include additional or alternative components.

[0035] As shown in FIG. 1 , the NG-RAN 135 includes NR nodeBs (gNBs) 110a, 110b and next generation eNodeBs (ng-eNBs) 114, and the 5GC 140 includes an access and mobility management function (AMF) 115, a session management function (SMF) 117, a location management function (LMF) 120, and a gateway mobile location center (GMLC) 125. The gNBs 110a, 110b, and ng-eNBs 114 are communicatively coupled to each other, each configured to perform bidirectional wireless communication with the UE 105, and each communicatively coupled to the AMF 115 and configured to perform bidirectional communication with the AMF. The gNBs 110a, 110b, and ng-eNBs 114 may be referred to as base stations (BSs). The AMF 115, the SMF 117, the LMF 120, and the GMLC 125 are communicatively coupled to each other, and the GMLC is communicatively coupled to the external client 130. The SMF 117 may serve as an initial contact point for a service control function (SCF) (not shown) to create, control, and delete media sessions. A base station (such as gNB 110a, 110b, and / or ng-eNB 114) may be a macro cell (e.g., a high-power cellular base station), or a small cell (e.g., a low-power cellular base station), or an access point (e.g., a short-range base station configured to communicate with a short-range technology (such as WiFi, WiFi Direct (WiFi-D), Low Energy (BLE), Zigbee, etc.) for communication). One or more base stations (e.g., one or more of gNB 110a, 110b, and / or ng-eNB 114) may be configured to communicate with UE 105 via multiple carriers. Each of gNB 110a, 110b, and / or ng-eNB 114 may provide communication coverage for a corresponding geographic area (e.g., a cell). Each cell may be divided into multiple sectors according to the base station antenna.

[0036] FIG. 1 provides a generalized illustration of various components, any or all of which may be utilized as appropriate, and each component may be repeated or omitted as desired. Specifically, although one UE 105 is illustrated, many UEs (e.g., hundreds, thousands, millions, etc.) may be utilized in the communication system 100. Similarly, the communication system 100 may include a greater (or smaller) number of SVs (i.e., more or less than the four SVs 190-193 shown), gNBs 110a, gNBs 110b, ng-eNBs 114, AMFs 115, external clients 130, and / or other components. The illustrated connections connecting the various components in the communication system 100 include data and signaling connections, which may include additional (intermediate) components, direct or indirect physical and / or wireless connections, and / or additional networks. In addition, the components may be rearranged, combined, separated, replaced, and / or omitted depending on the desired functionality.

[0037] Although FIG. 1 illustrates a 5G-based network, similar network implementations and configurations may be used for other communication technologies, such as 3G, Long Term Evolution (LTE), etc. The implementations described herein (which are used for 5G technology and / or for one or more other communication technologies and / or protocols) may be used to send (or broadcast) directional synchronization signals, receive and measure directional signals at a UE (e.g., UE 105), and / or provide location assistance to UE 105 (via GMLC 125 or other location servers), and / or calculate the position of UE 105 at a device with positioning capabilities such as UE 105, gNB 110a, gNB 110b, or LMF 120 based on measurement parameters received at UE 105 for such directional transmitted signals. The gateway mobile location center (GMLC) 125, location management function (LMF) 120, access and mobility management function (AMF) 115, SMF 117, ng-eNB (eNodeB) 114 and gNB (gNodeB) 110a, 110b are examples and may be replaced by or include various other location server functionalities and / or base station functionalities, respectively, in various embodiments.

[0038] The system 100 is capable of wireless communication because the components of the system 100 can communicate with each other (at least sometimes using wireless connections), directly or indirectly, for example, via gNB 110a, 110b, ng-eNB 114 and / or 5GC 140 (and / or one or more other devices not shown, such as one or more other transceiver base stations). For indirect communication, the communication can be modified during transmission from one entity to another, for example, to change header information of a data packet, change the format, etc. The UE 105 may include multiple UEs and may be a mobile wireless communication device, but may communicate wirelessly as well as via a wired connection. The UE 105 may be any of a variety of devices, such as a smart phone, a tablet computer, a vehicle-based device, etc., but these are merely examples, as the UE 105 need not be any of these configurations, and other configurations of the UE may be used. Other UEs may include wearable devices (e.g., smart watches, smart jewelry, smart glasses, or head-mounted devices, etc.). Other UEs may also be used, whether currently existing or developed in the future. In addition, other wireless devices (whether mobile or not) may be implemented within the system 100 and may communicate with each other and / or with the UE 105, the gNBs 110a, 110b, the ng-eNBs 114, the 5GC 140, and / or the external clients 130. For example, such other devices may include Internet of Things (IoT) devices, medical devices, home entertainment and / or automation devices, etc. The 5GC 140 may communicate with the external client 130 (e.g., a computer system), for example, to allow the external client 130 (e.g., via the GMLC 125) to request and / or receive location information about the UE 105.

[0039] UE 105 or other devices may be configured to communicate in various networks and / or for various purposes and / or using various technologies (e.g., 5G, Wi-Fi communication, multi-frequency Wi-Fi communication, satellite positioning, one or more types of communication (e.g., GSM (Global System for Mobile), CDMA (Code Division Multiple Access), LTE (Long Term Evolution), V2X (Vehicle to Vehicle, e.g., V2P (vehicle to pedestrian), V2I (vehicle to infrastructure), V2V (vehicle to vehicle), etc.), IEEE802.11p, etc.). V2X communication may be cellular The system 100 may support operations on multiple carriers (waveform signals of different frequencies). A multi-carrier transmitter may send modulated signals on multiple carriers simultaneously. Each modulated signal may be a code division multiple access (CDMA) signal, a time division multiple access (TDMA) signal, an orthogonal frequency division multiple access (OFDMA) signal, a single carrier frequency division multiple access (SC-FDMA) signal, or the like. Each modulated signal may be transmitted on a different carrier and may carry pilots, overhead information, data, or the like. UEs 105, 106 may communicate with each other through UE-to-UE SL communication by transmitting on one or more sidelink (SL) channels such as a physical sidelink synchronization channel (PSSCH), a physical sidelink broadcast channel (PSBCH), or a physical sidelink control channel (PSCCH).

[0040] UE 105 may include and / or may be referred to as a device, a mobile device, a wireless device, a mobile terminal, a terminal, a mobile station (MS), a terminal (SET) enabled with secure user plane location (SUPL), or some other name. In addition, UE 105 may correspond to a cellular phone, a smart phone, a laptop computer, a tablet device, a PDA, a consumer asset tracking device, a navigation device, an Internet of Things (IoT) device, a health monitor, a security system, a smart city sensor, a smart meter, a wearable tracker, or some other portable or mobile device. Typically, although not necessarily, UE 105 may use one or more radio access technologies (RATs) to support wireless communications, such as Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), Wideband CDMA (WCDMA), LTE, High Rate Packet Data (HRPD), IEEE 802.11 WiFi (also known as Wi-Fi), (BT), Worldwide Interoperability for Microwave Access (WiMAX), 5G New Radio (NR) (e.g., using NG-RAN 135 and 5GC 140), etc. UE 105 can use a wireless local area network (WLAN) to support wireless communications, and the wireless local area network can use, for example, a digital subscriber line (DSL) or a packet cable to connect to other networks (e.g., the Internet). Using one or more of these RATs can allow UE 105 (e.g., via elements of 5GC 140 (not shown in Figure 1), or possibly via GMLC 125) to communicate with external clients 130 and / or allow external clients 130 (e.g., via GMLC 125) to receive location information about UE 105.

[0041] UE 105 may include a single entity or may include multiple entities, such as in a personal area network, where users may employ audio, video, and / or data I / O (input / output) devices, and / or body sensors and separate wired or wireless modems. The estimate of the location of UE 105 may be referred to as a location, location estimate, location fix, fix, position fix, position estimate, or position fix, and may be geographic, thereby providing location coordinates (e.g., latitude and longitude) about UE 105, which may or may not include an altitude component (e.g., height above sea level; height above or depth below ground level, floor level, or basement level). Alternatively, the location of UE 105 may be expressed as a municipal location (e.g., a postal address or a designation of a point or smaller area in a building, such as a specific room or floor). The location of UE 105 may be expressed as an area or volume (geographically or municipally defined) within which UE 105 is expected to be located with a certain probability or confidence level (e.g., 67%, 95%, etc.). The location of the UE 105 may be expressed as a relative location including, for example, a distance and direction relative to a known location. The relative location may be expressed as relative coordinates (e.g., X, Y (and Z) coordinates) defined relative to a certain origin at a known location, which may be defined, for example, geographically, in municipal form, or with reference to a point, area, or volume indicated, for example, on a map, floor plan, or building plan. In the description contained herein, the use of the term "location" may include any of these variants unless otherwise indicated. When calculating the location of the UE, local x, y, and possibly z coordinates are typically solved, and then (if necessary) the local coordinates are converted into absolute coordinates (e.g., with respect to latitude, longitude, and altitude above or below mean sea level).

[0042] UE 105 may be configured to communicate with other entities using one or more of a variety of technologies. UE 105 may be configured to be indirectly connected to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links. D2D P2P links may be supported using any suitable D2D radio access technology (RAT), such as LTE Direct (LTE-D), WiFi Direct (WiFi-D), Etc. One or more UEs in a group of UEs utilizing D2D communication may be located within a geographic coverage area of ​​a transmit / receive point (TRP), such as one or more of gNB 110a, gNB 110b, and / or ng-eNB 114. Other UEs in the group may be outside such geographic coverage area or may be unable to receive transmissions from the base station for other reasons. A group of UEs communicating via D2D communication may utilize a one-to-many (1:M) system, in which each UE may transmit to other UEs in the group. The TRP may facilitate the scheduling of resources for D2D communication. In other cases, D2D communication may be performed between UEs without involving a TRP. One or more UEs in a group of UEs utilizing D2D communication may be within a geographic coverage area of ​​a TRP. Other UEs in the group may be outside such geographic coverage area or may be unable to receive transmissions from the base station for other reasons. A group of UEs communicating via D2D communication may utilize a one-to-many (1:M) system, in which each UE may transmit to other UEs in the group. The TRP may facilitate the scheduling of resources for D2D communication. In other cases, D2D communication may be performed between UEs without involving a TRP.

[0043] The base stations (BS) in the NG-RAN 135 shown in FIG1 include NR Node Bs (referred to as gNB 110a and gNB 110b). Each pair of gNBs 110a, gNB 110b in the NG-RAN 135 may be connected to each other via one or more other gNBs. Access to the 5G network is provided to the UE 105 via wireless communication between the UE 105 and one or more of the gNBs 110a, gNB 110b, which may provide wireless communication access to the 5GC 140 on behalf of the UE 105 using 5G. In FIG1 , it is assumed that the serving gNB of the UE 105 is gNB 110a, but another gNB (e.g., gNB 110b) may serve as a serving gNB if the UE 105 moves to another location, or may serve as a secondary gNB to provide additional throughput and bandwidth to the UE 105.

[0044] The base stations (BSs) in the NG-RAN 135 shown in FIG1 may include ng-eNB 114, which is also referred to as a next generation evolved Node B. The ng-eNB 114 may be connected to one or more of gNBs 110a, gNB 110b in the NG-RAN 135 via one or more other gNBs and / or one or more other ng-eNBs. The ng-eNB 114 may provide LTE wireless access and / or evolved LTE (eLTE) wireless access to the UE 105. One or more of the gNBs 110a, gNB 110b, and / or ng-eNB 114 may be configured to function as a positioning-only beacon, which may transmit signals to assist in determining the location of the UE 105, but may not be able to receive signals from the UE 105 or other UEs.

[0045] The gNBs 110a, 110b, and / or the ng-eNB 114 may each include one or more TRPs. For example, each sector within a cell of a BS may include a TRP, but multiple TRPs may share one or more components (e.g., sharing a processor but having separate antennas). The system 100 may include only a macro TRP, or the system 100 may have different types of TRPs, such as a macro TRP, a pico TRP, and / or a femto TRP, among others. A macro TRP may cover a relatively large geographic area (e.g., a radius of several kilometers) and may allow unrestricted access by terminals with service subscriptions. A pico TRP may cover a relatively small geographic area (e.g., a pico cell) and may allow unrestricted access by terminals with service subscriptions. A femto or home TRP may cover a relatively small geographic area (e.g., a femto cell) and may allow restricted access by terminals associated with the femto cell (e.g., terminals of users in a home).

[0046] Each of the gNBs 110a, 110b, and / or ng-eNB 114 may include a radio unit (RU), a distributed unit (DU), and a central unit (CU). For example, the gNB 110a includes a RU 111, a DU 112, and a CU 113. The RU 111, the DU 112, and the CU 113 divide the functionality of the gNB 110a. Although the gNB 110a is shown as having a single RU, a single DU, and a single CU, the gNB may include one or more RUs, one or more DUs, and / or one or more CUs. The interface between the CU 113 and the DU 112 is referred to as the F1 interface. The RU 111 is configured to perform digital front end (DFE) functions (e.g., analog-to-digital conversion, filtering, power amplification, transmission / reception) and digital beamforming, and includes a portion of the physical (PHY) layer. The RU 111 may perform DFE using massive multiple input / multiple output (MIMO) and may be integrated with one or more antennas of the gNB 110a. DU 112 hosts the radio link control (RLC), medium access control (MAC), and physical layers of gNB 110a. One DU may support one or more cells, and each cell is supported by a single DU. The operation of DU 112 is controlled by CU 113. CU 113 is configured to perform functions for delivering user data, mobility control, radio access network sharing, positioning, session management, etc., although some functions are only assigned to DU 112. CU 113 hosts the radio resource control (RRC), service data adaptation protocol (SDAP), and packet data convergence protocol (PDCP) protocols of gNB 110a. UE 105 can communicate with CU 113 via RRC, SDAP, and PDCP layers, communicate with DU 112 via RLC, MAC, and PHY layers, and communicate with RU 111 via the PHY layer.

[0047] As mentioned, although FIG. 1 depicts nodes configured to communicate according to a 5G communication protocol, nodes configured to communicate according to other communication protocols (such as, LTE protocol or IEEE802.11x protocol) may also be used. For example, in an evolved packet system (EPS) that provides LTE wireless access to UE 105, the RAN may include an evolved universal mobile telecommunications system (UMTS) terrestrial radio access network (E-UTRAN), which may include base stations including evolved Node Bs (eNBs). The core network for the EPS may include an evolved packet core (EPC). The EPS may include the E-UTRAN plus the EPC, where the E-UTRAN corresponds to the NG-RAN 135 in FIG. 1 and the EPC corresponds to the 5GC 140 in the figure.

[0048] The gNB 110a, gNB 110b, and ng-eNB 114 may communicate with AMF 115; for positioning functionality, the AMF communicates with LMF 120. AMF 115 may support mobility of UE 105, including cell change and handover, and may participate in supporting signaling connections with UE 105 and possible data and voice bearers for UE 105. LMF 120 may communicate directly with UE 105, or directly with gNB 110a, 110b, and / or ng-eNB 114, for example, via wireless communications. The LMF 120 may support positioning of the UE 105 when the UE 105 accesses the NG-RAN 135, and may support various positioning procedures / methods, such as Assisted GNSS (A-GNSS), Observed Time Difference of Arrival (OTDOA) (e.g., downlink (DL) OTDOA or uplink (UL) OTDOA), Round Trip Time (RTT), Multi-cell RTT, Real-Time Kinematics (RTK), Precise Point Positioning (PPP), Differential GNSS (DGNSS), Enhanced Cell ID (E-CID), Angle of Arrival (AoA), Angle of Departure (AoD), and / or other positioning methods. The LMF 120 may process a location service request for the UE 105 received from, for example, the AMF 115 or the GMLC 125. The LMF 120 may be connected to the AMF 115 and / or the GMLC 125. The LMF 120 may be referred to by other names, such as a Location Manager (LM), a Location Function (LF), a Commercial LMF (CLMF), or a Value-Added LMF (VLMF). A node / system implementing LMF 120 may additionally or alternatively implement other types of location support modules, such as an enhanced serving mobile location center (E-SMLC) or a secure user plane location (SUPL) location platform (SLP). At least a portion of the positioning functionality (including the derivation of the location of UE 105) may be performed at UE 105 (e.g., using signal measurements obtained by UE 105 for signals sent by wireless nodes (such as gNB 110a, gNB 110b and / or ng-eNB 114), and / or assistance data provided to UE 105 by LMF 120, for example). AMF 115 may serve as a control node for processing signaling between UE 105 and 5GC 140, and may provide QoS (quality of service) flow and session management. AMF 115 may support the mobility of UE 105 (including cell changes and handovers), and may participate in supporting signaling connections to UE 105.

[0049] The server 150 (e.g., a cloud server) is configured to obtain a location estimate for the UE 105 and provide it to the external client 130. The server 150 may, for example, be configured to run a microservice / service that obtains a location estimate for the UE 105. The server 150 may, for example, obtain a location estimate from (e.g., by transmitting a location request) the UE 105, one or more of the gNBs 110a, 110b (e.g., via the RU 111, DU 112, and CU 113), and / or the ng-eNB 114, and / or the LMF 120. As another example, the UE 105, one or more of the gNBs 110a, 110b (e.g., via the RU 111, DU 112, and CU 113), and / or the LMF 120 may push the location estimate of the UE 105 to the server 150.

[0050] The GMLC 125 may support location requests for the UE 105 received from the external client 130 via the server 150, and may forward the location requests to the AMF 115 for forwarding by the AMF 115 to the LMF 120, or may forward the location requests directly to the LMF 120. A location response (e.g., containing a location estimate of the UE 105) from the LMF 120 may be returned to the GMLC 125 directly or via the AMF 115, and the GMLC 125 may then return the location response (e.g., containing the location estimate) to the external client 130 via the server 150. The GMLC 125 is shown as being connected to both the AMF 115 and the LMF 120, but may not be connected to either the AMF 115 or the LMF 120 in some implementations.

[0051] As further illustrated in FIG1 , LMF 120 may communicate with gNB 110a, gNB 110b, and / or ng-eNB 114 using a new radio positioning protocol A (which may be referred to as NPPa or NRPPa), which may be defined in 3GPP Technical Specification (TS) 38.455. NRPPa may be the same as, similar to, or an extension of LTE Positioning Protocol A (LPPa) defined in 3GPP TS 36.455, where NRPPa messages are communicated between gNB 110a (or gNB 110b) and LMF 120, and / or between ng-eNB 114 and LMF 120 via AMF 115. As further illustrated in FIG1 , LMF 120 and UE 105 may communicate using an LTE Positioning Protocol (LPP), which may be defined in 3GPP TS 36.355. The LMF 120 and the UE 105 may additionally or alternatively communicate using a new radio positioning protocol (which may be referred to as NPP or NRPP), which may be the same as, similar to, or an extension of the LPP. Here, LPP and / or NPP messages may be passed between the UE 105 and the LMF 120 via the AMF 115 and the serving gNB 110a, gNB 110b, or serving ng-eNB 114 of the UE 105. For example, the LPP and / or NPP messages may be passed between the LMF 120 and the AMF 115 using the 5G Location Services Application Protocol (LCS AP), and may be passed between the AMF 115 and the UE 105 using the 5G Non-Access Stratum (NAS) protocol. The LPP and / or NPP protocols may be used to support positioning of the UE 105 using UE-assisted and / or UE-based positioning methods such as A-GNSS, RTK, OTDOA, and / or E-CID. The NRPPa protocol may be used to support positioning of the UE 105 using a network-based positioning method such as E-CID (e.g., in conjunction with measurements obtained by the gNB 110a, 110b, or ng-eNB 114) and / or may be used by the LMF 120 to obtain location-related information from the gNB 110a, 110b, and / or ng-eNB 114, such as parameters defining directional SS (synchronization signal) or PRS transmissions from the gNB 110a, 110b, and / or ng-eNB 114. The LMF 120 may be co-located or integrated with the gNB or TRP, or may be located remotely from the gNB and / or TRP and configured to communicate directly or indirectly with the gNB and / or TRP.

[0052] Using UE-assisted positioning methods, UE 105 may obtain location measurements and transmit these measurements to a location server (e.g., LMF 120) for use in calculating a location estimate for UE 105. For example, the location measurements may include one or more of a received signal strength indication (RSSI), a round trip signal propagation time (RTT), a reference signal time difference (RSTD), a reference signal received power (RSRP), and / or a reference signal received quality (RSRQ) of gNB 110a, gNB 110b, ng-eNB 114, and / or WLAN AP. The location measurements may additionally or alternatively include measurements of GNSS pseudoranges, code phases, and / or carrier phases of SVs 190-193.

[0053] Using the UE-based positioning method, UE 105 can obtain position measurements (e.g., which can be the same or similar to position measurements for UE-assisted positioning methods), and the position of UE 105 can be calculated (e.g., with the aid of auxiliary data received from a location server (such as LMF 120) or broadcast by gNB 110a, gNB 110b, ng-eNB 114 or other base stations or APs).

[0054] With network-based positioning methods, one or more base stations (e.g., gNBs 110a, 110b and / or ng-eNB 114) or APs may obtain location measurements (e.g., measurements of RSSI, RTT, RSRP, RSRQ, or time of arrival (ToA) of signals sent by UE 105) and / or may receive measurements obtained by UE 105. The one or more base stations or APs may transmit the measurements to a location server (e.g., LMF 120) for use in calculating a location estimate for UE 105.

[0055] The information provided to LMF 120 by gNB 110a, gNB 110b and / or ng-eNB 114 using NRPPa may include timing and configuration information for directional SS or PRS transmission and location coordinates. LMF 120 may provide some or all of this information to UE 105 as assistance data in LPP and / or NPP messages via NG-RAN 135 and 5GC 140.

[0056] The LPP or NPP message transmitted from LMF 120 to UE 105 may instruct UE 105 to do any of a variety of things, depending on the desired functionality. For example, the LPP or NPP message may include instructions for UE 105 to obtain measurements for GNSS (or A-GNSS), WLAN, E-CID, and / or OTDOA (or some other positioning method). In the case of E-CID, the LPP or NPP message may instruct UE 105 to obtain one or more measurement parameters (e.g., beam ID, beam width, average angle, RSRP, RSRQ measurements) of directional signals transmitted within a particular cell supported by one or more of gNB 110a, gNB 110b, and / or ng-eNB 114 (or supported by some other type of base station (such as an eNB or WiFi AP)). UE 105 may transmit these measurement parameters back to LMF 120 in an LPP or NPP message (e.g., within a 5G NAS message) via serving gNB 110a (or serving ng-eNB 114) and AMF 115.

[0057] As noted, although the communication system 100 is described with respect to 5G technology, the communication system 100 may be implemented to support other communication technologies (such as GSM, WCDMA, LTE, etc.) that are used to support and interact with mobile devices (such as UE 105) (e.g., to implement voice, data, positioning, and other functionalities). In some such embodiments, the 5GC 140 may be configured to control different air interfaces. For example, the 5GC 140 may be connected to a WLAN using a non-3GPP interworking function (N3IWF, not shown in FIG. 1 ) in the 5GC 140. For example, the WLAN may support IEEE 802.11 WiFi access for the UE 105 and may include one or more WiFi APs. Here, the N3IWF may be connected to the WLAN and other elements in the 5GC 140, such as the AMF 115. In some embodiments, both the NG-RAN 135 and the 5GC 140 may be replaced by one or more other RANs and one or more other core networks. For example, in the EPS, the NG-RAN 135 may be replaced by an E-UTRAN including eNBs, and the 5GC 140 may be replaced by an EPC including a mobility management entity (MME) replacing the AMF 115, an E-SMLC replacing the LMF 120, and a GMLC that may be similar to the GMLC 125. In such an EPS, the E-SMLC may transmit and receive location information to and from the eNBs in the E-UTRAN using LPPa instead of NRPPa, and may use LPP to support positioning of the UE 105. In these other embodiments, positioning of the UE 105 using directional PRS may be supported in a manner similar to that described herein for a 5G network, except that the functions and processes described herein for gNB 110a, gNB 110b, ng-eNB 114, AMF 115, and LMF 120 may in some cases be applied alternatively to other network elements, such as eNBs, WiFi APs, MMEs, and E-SMLCs.

[0058] As mentioned, in some embodiments, positioning functionality may be implemented at least in part using directional SS or PRS beams transmitted by base stations (such as gNB 110a, gNB 110b, and / or ng-eNB 114) that are within range of a UE (e.g., UE 105 of FIG. 1) for which positioning is to be determined. In some instances, a UE may calculate the positioning of the UE using directional SS or PRS beams from multiple base stations (such as gNB 110a, gNB 110b, ng-eNB 114, etc.).

[0059] 2, UE 200 is an example of one of UEs 105, 106, and includes a computing platform including a processor 210, a memory 211 including software (SW) 212, one or more sensors 213, a transceiver interface 214 for a transceiver 215 (which includes a wireless transceiver 240 and a wired transceiver 250), a user interface 216, a satellite positioning system (SPS) receiver 217, a camera 218, and a positioning device (PD) 219. The processor 210, the memory 211, the sensor 213, the transceiver interface 214, the user interface 216, the SPS receiver 217, the camera 218, and the positioning device 219 can be communicatively coupled to each other via a bus 220 (which can be configured, for example, for optical communication and / or electrical communication). One or more of the devices shown (e.g., one or more of the camera 218, the positioning device 219, and / or the sensor 213, etc.) can be omitted from the UE 200. The processor 210 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 210 may include multiple processors, including a general / application processor 230, a digital signal processor (DSP) 231, a modem processor 232, a video processor 233, and / or a sensor processor 234. One or more of the processors 230-234 may include multiple devices (e.g., multiple processors). For example, the sensor processor 234 may include, for example, a processor for RF (radio frequency) sensing (wherein one or more (cellular) wireless signals and reflections sent are used to identify, map and / or track objects) and / or ultrasound, etc. The modem processor 232 may support dual SIM / dual connectivity (or even more SIMs). For example, a SIM (subscriber identity module or subscriber identity module) may be used by an original equipment manufacturer (OEM), and another SIM may be used by a terminal user of the UE 200 to obtain connectivity. The memory 211 is a non-transitory storage medium that may include a random access memory (RAM), a flash memory, a disk memory, and / or a read-only memory (ROM), etc. Memory 211 stores software 212, which may be processor-readable, processor-executable software code containing instructions that are configured to cause processor 210 to perform various functions described herein when executed. Alternatively, software 212 may not be directly executable by processor 210, but may be configured to cause processor 210 to perform functions, such as when compiled and executed. The description may reference processor 210 performing functions, but this includes other implementations, such as implementations in which processor 210 executes software and / or firmware. The description may reference processor 210 performing functions as shorthand for one or more of processors 230-234 performing the functions.The description may refer to UE 200 performing a function as shorthand for one or more appropriate components of UE 200 performing the function. Processor 210 may include memory with stored instructions in addition to and / or in lieu of memory 211. The functionality of processor 210 is discussed more fully below.

[0060] The configuration of UE 200 shown in FIG2 is an example and is not intended to limit the present disclosure (including the claims), and other configurations may be used. For example, an example configuration of the UE includes one or more of the processors 230-234 of the processor 210, a memory 211, and a wireless transceiver 240. Other example configurations include one or more of the processors 230-234 in the processor 210, a memory 211, a wireless transceiver, and one or more of the following: a sensor 213, a user interface 216, an SPS receiver 217, a camera 218, a PD 219, and / or a wired transceiver.

[0061] The UE 200 may include a modem processor 232 capable of performing baseband processing of signals received and down-converted by the transceiver 215 and / or the SPS receiver 217. The modem processor 232 may perform baseband processing of signals to be up-converted for transmission by the transceiver 215. Additionally or alternatively, the baseband processing may be performed by the general / application processor 230 and / or the DSP 231. However, other configurations may be used to perform baseband processing.

[0062] UE 200 may include sensor 213, which may include, for example, one or more of various types of sensors, such as one or more inertial sensors, one or more magnetometers, one or more environmental sensors, one or more optical sensors, one or more weight sensors, and / or one or more radio frequency (RF) sensors, etc. An inertial measurement unit (IMU) may include, for example, one or more accelerometers (e.g., collectively responsive to acceleration of UE 200 in three dimensions) and / or one or more gyroscopes (e.g., three-dimensional gyroscopes). Sensor 213 may include one or more magnetometers (e.g., three-dimensional magnetometers) to determine orientation (e.g., relative to magnetic north and / or true north), which may be used for any of a variety of purposes (e.g., to support one or more compass applications). Environmental sensors may include, for example, one or more temperature sensors, one or more air pressure sensors, one or more ambient light sensors, one or more camera imagers, and / or one or more microphones, etc. Sensor 213 may generate analog and / or digital signals, indications of which may be stored in memory 211 and processed by DSP 231 and / or general / application processor 230 to support one or more applications (such as applications involving positioning and / or navigation operations).

[0063] The sensor 213 may be used for relative position measurement, relative position determination, motion determination, etc. The information detected by the sensor 213 may be used for motion detection, relative displacement, dead reckoning, sensor-based position determination, and / or sensor-assisted position determination. The sensor 213 may be used to determine whether the UE 200 is fixed (stationary) or moving and / or whether to report certain useful information related to the mobility of the UE 200 to the LMF 120. For example, based on the information obtained / measured by the sensor 213, the UE 200 may notify / report to the LMF 120 that the UE 200 has detected movement or that the UE 200 has moved, and report the relative displacement / distance (e.g., via dead reckoning implemented by the sensor 213, or sensor-based position determination, or sensor-assisted position determination). In another example, for relative positioning information, the sensor / IMU may be used to determine the angle and / or orientation of another device relative to the UE 200, etc.

[0064] The IMU may be configured to provide measurements of the direction of motion and / or speed of motion of the UE 200, which may be used for relative position determination. For example, one or more accelerometers and / or one or more gyroscopes of the IMU may detect the linear acceleration and rotational speed of the UE 200, respectively. The linear acceleration measurements and rotational speed measurements of the UE 200 may be integrated over time to determine the instantaneous direction of motion and displacement of the UE 200. The instantaneous direction of motion and displacement may be integrated to track the position of the UE 200. For example, a reference position of the UE 200 at a certain moment may be determined, for example, using the SPS receiver 217 (and / or by some other means), and measurements obtained from the accelerometers and gyroscopes after that moment may be used for dead reckoning to determine the current position of the UE 200 based on the movement (direction and distance) of the UE 200 relative to the reference position.

[0065] The magnetometer may determine magnetic field strengths in different directions, which may be used to determine the orientation of the UE 200. For example, the orientation may be used to provide a digital compass for the UE 200. The magnetometer may include a two-dimensional magnetometer configured to detect and provide an indication of magnetic field strength in two orthogonal dimensions. The magnetometer may include a three-dimensional magnetometer configured to detect and provide an indication of magnetic field strength in three orthogonal dimensions. The magnetometer may provide a means for sensing a magnetic field and providing an indication of the magnetic field, for example, to the processor 210.

[0066] The transceiver 215 may include a wireless transceiver 240 and a wired transceiver 250 configured to communicate with other devices via wireless connections and wired connections, respectively. For example, the wireless transceiver 240 may include a wireless transmitter 242 and a wireless receiver 244 coupled to an antenna 246 for transmitting (e.g., on one or more uplink channels and / or one or more sidelink channels) and / or receiving (e.g., on one or more downlink channels and / or one or more sidelink channels) wireless signals 248 and converting signals from the wireless signals 248 to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to the wireless signals 248. The wireless transmitter 242 includes appropriate components (e.g., a power amplifier and a digital-to-analog converter). The wireless receiver 244 includes appropriate components (e.g., one or more amplifiers, one or more frequency filters, and an analog-to-digital converter). The wireless transmitter 242 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wireless receiver 244 may include multiple receivers that may be discrete components or combined / integrated components. The wireless transceiver 240 may be configured to communicate signals (e.g., with the TRP and / or one or more other devices) in accordance with various radio access technologies (RATs), such as 5G New Radio (NR), GSM (Global System for Mobile Communications), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), WiFi, WiFi Direct (WiFi-D), Zigbee, etc. The new radio may use millimeter wave frequencies and / or frequencies below 6 GHz. The wired transceiver 250 may include a wired transmitter 252 and a wired receiver 254 configured for wired communication, for example, a network interface that may be used to communicate with the NG-RAN 135 to transmit communications to the NG-RAN 135 and receive communications from the NG-RAN. The wired transmitter 252 may include a plurality of transmitters that may be discrete components or combined / integrated components, and / or the wired receiver 254 may include a plurality of receivers that may be discrete components or combined / integrated components. The wired transceiver 250 may be configured, for example, for optical communication and / or electrical communication. The transceiver 215 may be communicatively coupled to the transceiver interface 214, for example, via an optical connection and / or an electrical connection. The transceiver interface 214 may be at least partially integrated with the transceiver 215. The wireless transmitter 242, the wireless receiver 244 and / or the antenna 246 may include multiple transmitters, multiple receivers and / or multiple antennas, respectively, for transmitting and / or receiving appropriate signals, respectively.

[0067] The user interface 216 may include one or more devices such as, for example, a speaker, a microphone, a display device, a vibration device, a keyboard, a touch screen, etc. The user interface 216 may include more than one of these devices. The user interface 216 may be configured to enable a user to interact with one or more applications hosted by the UE 200. For example, the user interface 216 may store indications of analog and / or digital signals in the memory 211 in response to actions from the user to be processed by the DSP 231 and / or the general / application processor 230. Similarly, the application hosted on the UE 200 may store indications of analog and / or digital signals in the memory 211 to present output signals to the user. The user interface 216 may include an audio input / output (I / O) device, which includes, for example, a speaker, a microphone, a digital-to-analog circuit, an analog-to-digital circuit, an amplifier, and / or a gain control circuit (including more than one of these devices). Other configurations of audio I / O devices may be used. Additionally or alternatively, the user interface 216 may include one or more touch sensors that respond to touch and / or pressure on, for example, a keyboard and / or a touch screen of the user interface 216 .

[0068] The SPS receiver 217 (e.g., a global positioning system (GPS) receiver) can receive and acquire the SPS signal 260 via the SPS antenna 262. The SPS antenna 262 is configured to convert the SPS signal 260 from a wireless signal to a wired signal (e.g., an electrical signal or an optical signal), and can be integrated with the antenna 246. The SPS receiver 217 can be configured to process the acquired SPS signal 260 in whole or in part to estimate the position of the UE 200. For example, the SPS receiver 217 can be configured to determine the position of the UE 200 by performing trilateration using the SPS signal 260. The general / application processor 230, the memory 211, the DSP 231, and / or one or more dedicated processors (not shown) can be utilized in conjunction with the SPS receiver 217 to process the acquired SPS signal in whole or in part, and / or calculate the estimated position of the UE 200. The memory 211 may store indications (e.g., measurements) of the SPS signal 260 and / or other signals (e.g., signals obtained from the wireless transceiver 240) for use in performing positioning operations. The general / application processor 230, the DSP 231, and / or one or more special-purpose processors, and / or the memory 211 may provide or support a location engine for use in processing measurements to estimate the location of the UE 200.

[0069] UE 200 may include a camera 218 for capturing still or moving images. Camera 218 may include, for example, an imaging sensor (e.g., a charge coupled device or a CMOS (complementary metal oxide semiconductor) imager), a lens, analog-to-digital circuits, a frame buffer, etc. Additional processing, conditioning, encoding, and / or compression of signals representing captured images may be performed by general / application processor 230 and / or DSP 231. Additionally or alternatively, video processor 233 may perform conditioning, encoding, compression, and / or manipulation of signals representing captured images. Video processor 233 may decode / decompress stored image data for presentation on a display device (not shown) (e.g., of user interface 216).

[0070] Positioning device (PD) 219 may be configured to determine the location of UE 200, the movement of UE 200, and / or the relative location of UE 200, and / or time. For example, PD 219 may communicate with SPS receiver 217 and / or include a portion or all of the SPS receiver. PD 219 may work appropriately with processor 210 and memory 211 to perform at least a portion of one or more positioning methods, although the description herein may only refer to PD 219 being configured to perform or performing according to the positioning method according to the positioning method. PD 219 may be additionally or alternatively configured to: use ground-based signals (e.g., at least some signals 248) for trilateration, assist in obtaining and using SPS signals 260, or both to determine the location of UE 200. PD 219 may be configured to determine the location of UE 200 based on the cell of the serving base station (e.g., cell center) and / or another technology (such as E-CID). The PD 219 may be configured to determine the location of the UE 200 using one or more images from the camera 218 and image recognition combined with known locations of landmarks (e.g., natural landmarks (such as mountains) and / or artificial landmarks (such as buildings, bridges, streets), etc.). The PD 219 may be configured to determine the location of the UE 200 using one or more other techniques (e.g., relying on the UE's self-reported location (e.g., part of the UE's location beacon)), and may use a combination of techniques (e.g., SPS and ground positioning signals) to determine the location of the UE 200. The PD 219 may include one or more sensors 213 (e.g., gyroscopes, accelerometers, magnetometers, etc.), which may sense the orientation and / or movement of the UE 200 and provide an indication of the orientation and / or movement, and the processor 210 (e.g., general / application processor 230 and / or DSP 231) may be configured to use the indication to determine the movement of the UE 200 (e.g., velocity vector and / or acceleration vector). PD 219 may be configured to provide an indication of uncertainty and / or error in the determined position and / or motion. The functionality of PD 219 may be provided in a variety of ways and / or configurations, such as by general / application processor 230, transceiver 215, SPS receiver 217, and / or another component of UE 200, and may be provided by hardware, software, firmware, or various combinations thereof.

[0071] Referring also to FIG. 3 , an example of a TRP 300 for gNB 110a, gNB 110b, and / or ng-eNB 114 includes a computing platform including a processor 310, a memory 311 including software (SW) 312, and a transceiver 315. The processor 310, the memory 311, and the transceiver 315 may be communicatively coupled to each other via a bus 320 (which may be configured, for example, for optical communication and / or electrical communication). One or more of the devices shown (e.g., a wireless transceiver) may be omitted from the TRP 300. The processor 310 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 310 may include multiple processors (e.g., including a general / application processor, a DSP, a modem processor, a video processor, and / or a sensor processor, as shown in FIG. 2 ). The memory 311 is a non-transitory storage medium that may include a random access memory (RAM), a flash memory, a disk memory, and / or a read-only memory (ROM), etc. The memory 311 stores software 312, which may be processor-readable, processor-executable software code containing instructions that are configured to cause the processor 310 to perform various functions described herein when executed. Alternatively, the software 312 may not be directly executable by the processor 310, but may be configured to cause the processor 310 to perform functions, for example, when compiled and executed.

[0072] The description may reference processor 310 performing a function, but this includes other implementations, such as implementations in which processor 310 executes software and / or firmware. The description may reference processor 310 performing a function as shorthand for one or more processors included in processor 310 performing the function. The description may reference TRP 300 performing a function as shorthand for one or more appropriate components (e.g., processor 310 and memory 311) of TRP 300 (and therefore one of gNB 110a, 110b and / or ng-eNB 114) performing the function. Processor 310 may include a memory with stored instructions in addition to and / or in lieu of memory 311. The functionality of processor 310 is discussed more fully below.

[0073] The transceiver 315 may include a wireless transceiver 340 and / or a wired transceiver 350 configured to communicate with other devices via wireless connections and wired connections, respectively. For example, the wireless transceiver 340 may include a wireless transmitter 342 and a wireless receiver 344 coupled to one or more antennas 346 for transmitting (e.g., on one or more uplink channels and / or one or more downlink channels) and / or receiving (e.g., on one or more downlink channels and / or one or more uplink channels) wireless signals 348 and converting signals from the wireless signals 348 to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to the wireless signals 348. Thus, the wireless transmitter 342 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wireless receiver 344 may include multiple receivers that may be discrete components or combined / integrated components. The wireless transceiver 340 may be configured to communicate in accordance with a plurality of radio access technologies (RATs) such as 5G New Radio (NR), GSM (Global System for Mobile Communications), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), WiFi, WiFi Direct (WiFi-D), Zigbee, etc.) to communicate signals (e.g., with UE 200, one or more other UEs, and / or one or more other devices). The wired transceiver 350 may include a wired transmitter 352 and a wired receiver 354 configured for wired communication, for example, a network interface that can be used to communicate with the NG-RAN 135 to transmit communications to, for example, the LMF 120 and / or one or more other network entities and receive communications therefrom. The wired transmitter 352 may include a plurality of transmitters that may be discrete components or combined / integrated components, and / or the wired receiver 354 may include a plurality of receivers that may be discrete components or combined / integrated components. The wired transceiver 350 may be configured, for example, for optical communication and / or electrical communication.

[0074] The configuration of the TRP 300 shown in FIG3 is an example and is not intended to limit the present disclosure, including the claims, and other configurations may be used. For example, the description herein discusses that the TRP 300 is configured to perform several functions or that the TRP performs several functions, but one or more of these functions may be performed by the LMF 120 and / or the UE 200 (i.e., the LMF 120 and / or the UE 200 may be configured to perform one or more of these functions).

[0075] Referring also to FIG. 4 , the server 400 (LMF 120 is an example thereof) includes: a computing platform including a processor 410, a memory 411 including software (SW) 412, and a transceiver 415. The processor 410, the memory 411, and the transceiver 415 may be communicatively coupled to each other via a bus 420 (the bus may be configured, for example, for optical communication and / or electrical communication). One or more of the devices shown (e.g., a wireless transceiver) may be omitted from the server 400. The processor 410 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 410 may include multiple processors (e.g., including a general / application processor, a DSP, a modem processor, a video processor, and / or a sensor processor, as shown in FIG. 2 ). The memory 411 is a non-transitory storage medium that may include a random access memory (RAM), a flash memory, a disk memory, and / or a read-only memory (ROM), etc. Memory 411 stores software 412, which may be processor-readable, processor-executable software code containing instructions that are configured to cause processor 410 to perform various functions described herein when executed. Alternatively, software 412 may not be directly executable by processor 410, but may be configured to cause processor 410 to perform these functions, for example, when compiled and executed. The description may refer to processor 410 performing functions, but this includes other specific implementations, such as processor 410 executing software and / or firmware. The description may quote processor 410 performing functions as a shorthand for one or more processors included in processor 410 performing the functions. The description may quote server 400 performing functions as a shorthand for one or more appropriate components of server 400 performing the functions. Processor 410 may include a memory with stored instructions as a supplement and / or alternative to memory 411. The functionality of processor 410 is discussed more fully below.

[0076] The transceiver 415 may include a wireless transceiver 440 and / or a wired transceiver 450 configured to communicate with other devices via wireless connections and wired connections, respectively. For example, the wireless transceiver 440 may include a wireless transmitter 442 and a wireless receiver 444 coupled to one or more antennas 446 for transmitting (e.g., on one or more downlink channels) and / or receiving (e.g., on one or more uplink channels) wireless signals 448 and converting signals from the wireless signals 448 to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to the wireless signals 448. Thus, the wireless transmitter 442 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wireless receiver 444 may include multiple receivers that may be discrete components or combined / integrated components. The wireless transceiver 440 may be configured to communicate in accordance with a plurality of radio access technologies (RATs) such as 5G New Radio (NR), GSM (Global System for Mobile Communications), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), WiFi, WiFi Direct (WiFi-D), Zigbee, etc.) to communicate signals (e.g., with UE 200, one or more other UEs, and / or one or more other devices). The wired transceiver 450 may include a wired transmitter 452 and a wired receiver 454 configured for wired communication, for example, a network interface that can be used to communicate with the NG-RAN 135 to transmit communications to, for example, the TRP 300 and / or one or more other network entities and receive communications therefrom. The wired transmitter 452 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wired receiver 454 may include multiple receivers that may be discrete components or combined / integrated components. The wired transceiver 450 may be configured, for example, for optical communication and / or electrical communication.

[0077] The description herein may refer to processor 410 performing a function, but this includes other implementations, such as implementations in which processor 410 executes software (stored in memory 411) and / or firmware. The description herein may refer to server 400 performing a function as shorthand for one or more appropriate components of server 400 (e.g., processor 410 and memory 411) performing that function.

[0078] The configuration of the server 400 shown in FIG. 4 is an example and is not intended to limit the present disclosure (including the claims), and other configurations may be used. For example, the wireless transceiver 440 may be omitted. Additionally or alternatively, the description herein discusses that the server 400 is configured to perform several functions or that the server performs several functions, but one or more of these functions may be performed by the TRP 300 and / or the UE 200 (i.e., the TRP 300 and / or the UE 200 may be configured to perform one or more of these functions).

[0079] Positioning Technology

[0080] For terrestrial positioning of UEs in cellular networks, techniques such as Advanced Forward Link Trilateration (AFLT) and Observed Time Difference of Arrival (OTDOA) typically operate in a "UE-assisted" mode, where measurements of reference signals (e.g., PRS, CRS, etc.) transmitted by base stations are acquired by the UE and then provided to a location server. The location server then calculates the position of the UE based on these measurements and the known positions of the base stations. Because these techniques use a location server (rather than the UE itself) to calculate the position of the UE, these positioning techniques are not frequently used in applications such as automotive or cell phone navigation, which instead typically rely on satellite-based positioning.

[0081] The UE can use a satellite positioning system (SPS) (Global Navigation Satellite System (GNSS)) to use precise point positioning (PPP) or real-time kinematic (RTK) techniques for high accuracy positioning. These techniques use assistance data, such as measurements from ground-based stations. LTE Release 15 allows the data to be encrypted so that only UEs subscribed to the service can read the information. Such assistance data changes over time. As a result, a UE subscribed to the service may not be able to easily "crack the encryption" for other UEs by passing the data to other UEs that have not paid for the subscription. This transfer needs to be repeated every time the assistance data changes.

[0082] In UE-assisted positioning, the UE transmits measurements (e.g., TDOA, Angle of Arrival (AoA), etc.) to a positioning server (e.g., LMF / eSMLC). The positioning server has a base station almanac (BSA) that contains multiple "entries" or "records", one record per cell, where each record contains a geographic cell location, but may also include other data. An identifier of a "record" among multiple "records" in the BSA may be referenced. The BSA and the measurements from the UE may be used to calculate the positioning of the UE.

[0083] In conventional UE-based positioning, the UE calculates its own position, avoiding the transmission of measurements to the network (e.g., a location server), which in turn improves latency and scalability. The UE uses the relevant BSA record information from the network (e.g., the location of the gNB (more broadly, the base station)). The BSA information can be encrypted. However, since the BSA information changes much less frequently than, for example, the PPP or RTK assistance data described previously, it may be easier (compared to PPP or RTK information) to make the BSA information available to UEs that are not subscribed and have not paid for decryption keys. The transmission of reference signals by the gNB makes the BSA information potentially accessible to crowdsourcing or driving attacks, essentially enabling the BSA information to be generated based on in-the-field and / or over-the-top observations.

[0084] Positioning techniques may be characterized and / or evaluated based on one or more criteria, such as positioning determination accuracy and / or latency. Latency is the time elapsed between an event that triggers the determination of positioning-related data and the availability of the data at a positioning system interface (e.g., an interface of LMF 120). When the positioning system is initialized, the latency for the availability of positioning-related data is called the first lock time (TTFF) and is greater than the latency after the TTFF. The inverse of the time elapsed between two consecutive positioning-related data availabilities is called the update rate, i.e., the rate at which positioning-related data is generated after the first lock. Latency may depend on (e.g., UE's) processing capabilities. For example, assuming a 272 PRB (physical resource block) allocation, the UE may report the processing capability of the UE as the duration (in time units (e.g., milliseconds)) of the DL PRS symbol that the UE can process per T amount of time (e.g., T ms). Other examples of capabilities that may affect latency are the number of TRPs from which the UE can process PRSs, the number of PRSs that the UE can process, and the bandwidth of the UE.

[0085] One or more of many different positioning techniques (also referred to as positioning methods) may be used to determine the location of an entity (such as one of UEs 105, 106). For example, known location determination techniques include RTT, multi-RTT, OTDOA (also referred to as TDOA and including UL-TDOA and DL-TDOA), enhanced cell identification (E-CID), DL-AoD, UL-AoA, etc. RTT uses the time it takes for a signal to travel from one entity to another and back to determine the distance between the two entities. This distance plus the known position of the first of these entities and the angle (e.g., azimuth) between the two entities may be used to determine the position of the second of these entities. In multi-RTT (also referred to as multi-cell RTT), multiple distances from one entity (e.g., UE) to other entities (e.g., TRP) and the known positions of these other entities may be used to determine the position of the one entity. In TDOA techniques, the travel time differences between one entity and other entities may be used to determine the relative distances to these other entities, and those relative distances combined with the known positions of these other entities may be used to determine the position of the one entity. The angle of arrival and / or angle of departure can be used to help determine the location of an entity. For example, the angle of arrival or angle of departure of a signal combined with the distance between devices (the distance determined using the signal (e.g., the travel time of the signal, the received power of the signal, etc.)) and the known position of one of the devices can be used to determine the location of the other device. The angle of arrival or angle of departure can be an azimuth relative to a reference direction (such as true north). The angle of arrival or angle of departure can be a zenith angle relative to directly upward from the entity (i.e., relative to radially outward from the center of the earth). E-CID uses the identity of the serving cell, the timing advance (i.e., the difference between the reception time and the transmission time at the UE), the estimated timing and power of the detected neighboring cell signals, and possible angles of arrival (e.g., the angle of arrival of the signal from the base station at the UE, or vice versa) to determine the location of the UE. In TDOA, the difference in arrival time of signals from different sources at the receiving device together with the known positions of these sources and the known offsets of the transmission times from these sources are used to determine the location of the receiving device.

[0086] In network-centric RTT estimation, the serving base station commands the UE to scan / receive RTT measurement signals (e.g., PRS) on the serving cells of two or more neighboring base stations (and typically the serving base station, since at least three base stations are required). The one or more base stations transmit the RTT measurement signals on low reuse resources (e.g., resources used by the base station to transmit system information) allocated by the network (e.g., a location server, such as LMF 120). The UE records the arrival time (also referred to as reception time, received time, or arrival time (ToA)) of each RTT measurement signal relative to the current downlink timing of the UE (e.g., as derived by the UE from the DL signal received from its serving base station), and (e.g., when commanded by its serving base station) transmits a common or individual RTT response message (e.g., an SRS (sounding reference signal) for positioning, i.e., UL-PRS) to the one or more base stations, and may calculate the time difference T between the ToA of the RTT measurement signal and the transmission time of the RTT response message. Rx→Tx (i.e., UE T Rx-Tx or UE Rx-Tx ) is included in the payload of each RTT response message. The RTT response message will include a reference signal from which the base station can infer the ToA of the RTT response. By comparing the difference between the transmission time of the RTT measurement signal from the base station and the ToA of the RTT response at the base station, the base station can infer the ToA of the RTT response. Tx→Rx The time difference T reported by the UE Rx→Tx , the base station can infer the propagation time between the base station and the UE, based on which the base station can determine the distance between the UE and the base station by assuming the speed of light during the propagation time.

[0087] UE-centric RTT estimation is similar to the network-based approach, except that the UE sends uplink RTT measurement signals (e.g., when ordered by a serving base station), which are received by multiple base stations in the vicinity of the UE. Each base station involved responds with a downlink RTT response message, which may include in the RTT response message payload the time difference between the ToA of the RTT measurement signal at the base station and the transmission time of the RTT response message from the base station.

[0088] For both network-centric and UE-centric processes, the side performing the RTT calculation (the network or the UE) typically (but not always) sends a first message or signal (e.g., an RTT measurement signal), and the other side responds with one or more RTT response messages or signals, which may include the difference between the ToA of the first message or signal and the sending time of the RTT response message or signal.

[0089] Multi-RTT techniques may be used to determine positioning. For example, a first entity (e.g., a UE) may transmit one or more signals (e.g., unicast, multicast, or broadcast from a base station), and a plurality of second entities (e.g., other TSPs, such as base stations and / or UEs) may receive signals from the first entity and respond to the received signals. The first entity receives responses from the plurality of second entities. The first entity (or another entity, such as an LMF) may use the responses from the second entity to determine the distance to the second entity, and may use the plurality of distances and the known positions of the second entity to determine the position of the first entity by trilateration.

[0090] In some instances, additional information in the form of an angle of arrival (AoA) or angle of departure (AoD) may be obtained, which defines a straight line direction (e.g., which may be in the horizontal plane, or in three dimensions) or a range of possible directions (e.g., of the UE as seen from the location of a base station). The intersection of the two directions may provide another estimate of the UE's position.

[0091] For positioning techniques (e.g., TDOA and RTT) that use PRS (positioning reference signal) signals, PRS signals transmitted by multiple TRPs are measured, and the arrival times of these signals, the known transmission times, and the known locations of the TRPs are used to determine the distance from the UE to the TRP. For example, RSTD (reference signal time difference) can be determined for PRS signals received from multiple TRPs, and RSTD is used in TDOA techniques to determine the location (position) of the UE. Positioning reference signals may be referred to as PRS or PRS signals. PRS signals are typically transmitted using the same power, and PRS signals with the same signal characteristics (e.g., the same frequency shift) may interfere with each other, so that PRS signals from farther TRPs may be drowned out by PRS signals from closer TRPs, so that signals from farther TRPs may not be detected. PRS muting can be used to help reduce interference by muting some PRS signals (reducing the power of the PRS signal, for example, to zero and thereby not sending the PRS signal). In this way, the UE can more easily detect (at the UE) a weaker PRS signal without a stronger PRS signal interfering with the weaker PRS signal. The term RS and its variants (e.g., PRS, SRS, CSI-RS (Channel State Information - Reference Signal)) may refer to one reference signal or more than one reference signal.

[0092] Positioning reference signals (PRS) include downlink PRS (DL PRS, often referred to as PRS for short) and uplink PRS (UL PRS) (which may be referred to as SRS (sounding reference signal) for positioning). PRS may include a PN code (pseudo-random number) or be generated using a PN code (e.g., by modulating a carrier signal with a PN code) so that the source of the PRS can be used as a pseudo-satellite. The PN code may be unique to the PRS source (at least unique within a specified area so that the same PRS from different PRS sources do not overlap). PRS may include PRS resources and / or PRS resource sets of a frequency layer. A DL PRS positioning frequency layer (or simply frequency layer) is a collection of DL PRS resource sets from one or more TRPs, where the PRS resources have common parameters configured by higher layer parameters DL-PRS-PositioningFrequencyLayer, DL-PRS-ResourceSet, and DL-PRS-Resource. Each frequency layer has a DL PRS subcarrier spacing (SCS) for a DL PRS resource set and DL PRS resources in that frequency layer. Each frequency layer has a DL PRS cyclic prefix (CP) for the DL PRS resource set and DL PRS resources in that frequency layer. In 5G, a resource block occupies 12 consecutive subcarriers and a specified number of symbols. A common resource block is a set of resource blocks that occupy a channel bandwidth. A bandwidth part (BWP) is a set of consecutive common resource blocks and may include all common resource blocks within the channel bandwidth or a subset of these common resource blocks. In addition, the DL PRS point A parameter defines the frequency of the reference resource block (and the lowest subcarrier of the resource block), where DL PRS resources belonging to the same DL PRS resource set have the same point A, and all DL PRS resource sets belonging to the same frequency layer have the same point A. The frequency layers also have the same DL PRS bandwidth, the same starting PRB (and center frequency), and the same comb size value (i.e., the frequency of PRS resource elements per symbol, so that for comb-N, every Nth resource element is a PRS resource element). A PRS resource set is identified by a PRS resource set ID and can be associated with a specific TRP (identified by a cell ID) sent by the antenna panel of the base station. The PRS resource ID in a PRS resource set may be associated with an omni-directional signal and / or associated with a single beam (and / or beam ID) transmitted from a single base station (where a base station may transmit one or more beams). Each PRS resource in a PRS resource set may be transmitted on a different beam, and as such, a PRS resource (or simply a resource) may also be referred to as a beam. This does not imply anything about whether the UE knows the base station and beam that transmitted the PRS.

[0093] The TRP may be configured, for example, by instructions received from a server and / or by software in the TRP to transmit DL PRS on a schedule. According to the schedule, the TRP may transmit DL PRS intermittently (e.g., periodically at consistent intervals from the initial transmission). The TRP may be configured to transmit one or more PRS resource sets. A resource set is a collection of PRS resources across a TRP, where these resources have the same periodicity, a common muting mode configuration (if any), and the same cross-slot repetition factor. Each PRS resource set includes a plurality of PRS resources, where each PRS resource includes a plurality of OFDM (orthogonal frequency division multiplexing) resource elements (REs), which may be in a plurality of resource blocks (RBs) within N (one or more) consecutive symbols within a slot. PRS resources (or, in general, reference signal (RS) resources) may be referred to as OFDM PRS resources (or OFDM RS resources). RBs are RE sets that span a certain number of one or more consecutive symbols in the time domain and a certain number (12 for 5G RBs) of consecutive subcarriers in the frequency domain. Each PRS resource is configured with an RE offset, a slot offset, a symbol offset within a slot, and the number of consecutive symbols that the PRS resource can occupy within a slot. The RE offset defines the starting RE offset in frequency for the first symbol within the DL PRS resource. The relative RE offsets of the remaining symbols within the DL PRS resource are defined based on the initial offset. The slot offset is the starting slot of the DL PRS resource relative to the corresponding resource set slot offset. The symbol offset determines the starting symbol of the DL PRS resource within the starting slot. The transmitted REs may be repeated across slots, where each transmission is referred to as a repetition, so that there may be multiple repetitions in the PRS resource. The DL PRS resources in a DL PRS resource set are associated with the same TRP, and each DL PRS resource has a DL PRS resource ID. The DL PRS resource ID in a DL PRS resource set is associated with a single beam transmitted from a single TRP (although a TRP may transmit one or more beams).

[0094] PRS resources can also be defined by quasi co-location and starting PRB parameters. The quasi co-location (QCL) parameter can define any quasi co-location information of DL PRS resources with other reference signals. DL PRS can be configured as QCL type D with DL PRS or SS / PBCH (synchronization signal / physical broadcast channel) blocks from a serving cell or a non-serving cell. DL PRS can be configured as QCL type C with SS / PBCH blocks from a serving cell or a non-serving cell. The starting PRB parameter defines the starting PRB index of the DL PRS resource with respect to reference point A. The starting PRB index has a granularity of one PRB and can have a minimum value of 0 and a maximum value of 2176 PRBs.

[0095] A PRS resource set is a collection of PRS resources with the same periodicity, the same muting pattern configuration (if any), and the same repetition factor across time slots. Each time all repetitions of all PRS resources in a PRS resource set are configured to be transmitted is referred to as an "instance". Thus, an "instance" of a PRS resource set is a specified number of repetitions for each PRS resource and a specified number of PRS resources within a PRS resource set, such that once the specified number of repetitions is transmitted for each of the specified number of PRS resources, the instance is complete. An instance may also be referred to as an "opportunity". A DL PRS configuration including a DL PRS transmission schedule may be provided to a UE to facilitate (or even enable) the UE to measure a DL PRS.

[0096] Multiple frequency layers of PRS can be aggregated to provide an effective bandwidth greater than any bandwidth of the individual layers. Multiple frequency layers belonging to component carriers (which may be continuous and / or separate) and satisfying criteria such as quasi co-location (QCL) and having the same antenna port can be spliced ​​to provide a larger effective PRS bandwidth (for DL ​​PRS and UL PRS), thereby improving the accuracy of arrival time measurement. Splicing includes combining PRS measurements on various bandwidth segments into a unified fragment so that the spliced ​​PRS can be considered to be taken from a single measurement. In the case of QCL, different frequency layers behave similarly, so that the splicing of PRS produces a larger effective bandwidth. The larger effective bandwidth (which may be referred to as the bandwidth of the aggregated PRS or the frequency bandwidth of the aggregated PRS) provides better time domain resolution (e.g., the resolution of TDOA). The aggregated PRS includes a collection of PRS resources, and each PRS resource in the aggregated PRS may be referred to as a PRS component, and each PRS component may be sent on different component carriers, frequency bands or frequency layers, or on different parts of the same frequency band.

[0097] RTT positioning is an active positioning technology because RTT uses positioning signals transmitted by the TRP to the UE and by the UE (participating in RTT positioning) to the TRP. The TRP can transmit a DL-PRS signal received by the UE, and the UE can transmit an SRS (sounding reference signal) signal received by multiple TRPs. The sounding reference signal may be referred to as an SRS or an SRS signal. In 5G multi-RTT, coordinated positioning can be used, in which the UE transmits a single UL-SRS for positioning received by multiple TRPs, rather than transmitting a separate UL-SRS for positioning for each TRP. A TRP participating in multi-RTT will typically search for UEs currently residing on the TRP (served UEs, where the TRP is the serving TRP) and also search for UEs residing on adjacent TRPs (neighboring UEs). A neighbor TRP may be a TRP of a single BTS (base transceiver station) (e.g., a gNB), or may be a TRP of one BTS and a TRP of a separate BTS. For RTT positioning (including multi-RTT positioning), the DL-PRS signal and the UL-SRS positioning signal in the PRS / SRS positioning signal pair used to determine the RTT (and thereby the distance between the UE and the TRP) may occur close to each other in time so that errors due to UE motion and / or UE clock drift and / or TRP clock drift are within acceptable limits. For example, the signals in the PRS / SRS positioning signal pair may be sent from the TRP and the UE, respectively, within approximately 10 ms of each other. In the case where the SRS for positioning is being transmitted by the UE and the PRS and the SRS for positioning are communicated close to each other in time, it has been found that radio frequency (RF) signal congestion (which may result in excessive noise, etc.) may result (especially if many UEs are attempting to locate concurrently), and / or computational congestion may result at the TRP where many UEs are attempting to be measured concurrently.

[0098] RTT positioning can be UE-based or UE-assisted. In UE-based RTT, UE 200 determines the RTT and corresponding distance to each of TRPs 300, and determines the position of UE 200 based on the distance to TRP 300 and the known position of TRP 300. In UE-assisted RTT, UE 200 measures positioning signals and provides measurement information to TRP 300, and TRP 300 determines RTT and distance. TRP 300 provides the distance to a location server (e.g., server 400), and the server determines the position of UE 200, for example, based on the distance to different TRPs 300. RTT and / or distance may be determined by TRP 300 receiving signals from UE 200, by TRP 300 in combination with one or more other devices (e.g., one or more other TRPs 300 and / or server 400), or by one or more devices other than TRP 300 receiving signals from UE 200.

[0099] Various positioning technologies are supported in 5G NR. The NR native positioning methods supported in 5G NR include DL-only positioning methods, UL-only positioning methods, and DL+UL positioning methods. Downlink-based positioning methods include DL-TDOA and DL-AoD. Uplink-based positioning methods include UL-TDOA and UL-AoA. Combined DL+UL-based positioning methods include RTT with one base station and RTT with multiple base stations (multi-RTT).

[0100] A positioning estimate (e.g., for a UE) may be referred to by other names, such as a position estimate, a position, a fix, a position fix, a fix, etc. The positioning estimate may be geodetic and include coordinates (e.g., latitude, longitude, and possibly altitude), or may be municipal and include a street address, a postal address, or some other textual description of the location. The positioning estimate may be further defined relative to some other known location or in absolute terms (e.g., using latitude, longitude, and possibly altitude). The positioning estimate may include an expected error or uncertainty (e.g., by including an area or volume within which the location is expected to be contained with some specified or default confidence level).

[0101] Peer ranging

[0102] Various signal sequences can be used for ranging between devices (e.g., peer devices such as UE (user equipment)). Channel estimation sequences can be passed between devices and measured to determine channel estimates. For example, SYNC and / or STS (Secure Time Sequence) can be used for channel estimation, where SYNC is used for acquisition, preamble detection, and time and frequency synchronization, and STS provides security enhancement relative to SYNC, and is therefore used for channel estimation when security and integrity are desired. Preamble sequences (such as Ipatov sequences) have desirable autocorrelation properties that enable simpler channel estimation and more accurate positioning estimates. The transmitter transmits the preamble sequence, and the receiver, which knows what sequence to expect, uses the known sequence to perform correlation on the received signal to determine the channel estimate. Preamble sequences (such as Ipatov sequences) are well known and are therefore vulnerable to over-the-air (OTA) attacks, where the attack can manipulate the receiver's estimation process. Security attacks, such as for positioning, can take many forms, including cross-symbol attacks, where the attacker receives one or more PRS symbols, determines the transmission parameters, and generates new signals for subsequent PRS. Another attack is an inside job attack, where a disguised attacker receives a complete PRS configuration (e.g., by broadcasting auxiliary data (AD) or unicast RRC) and generates and sends the PRS to the receiver. Another attack is an intra-symbol attack, where the attacker observes the first part of a single OFDM symbol, detects the transmitted QAM (quadrature amplitude modulation) symbol, and generates and sends the second part of the OFDM symbol. It has been proposed to use encryption such as AES (Advanced Encryption Standard) encryption to implement physical layer (PHY layer) security for secure ranging. Information can be transmitted over a secure link (using AES encryption) so that only the transmitter and receiver will know the preamble sequence, thereby providing a more secure channel estimate, although it may have a lower associated accuracy. In large-scale collaborative positioning scenarios (e.g., public safety, IoT (Internet of Things)) and side links, several UEs will expect to perform relative ranging with each other in a secure manner by exchanging sequence information. This article discusses techniques for distributing information to support secure measurements.

[0103] The STS may be generated using a deterministic random bit generator (DRBG). For example, the DRBG may use a 96-bit plaintext portion in conjunction with a 32-bit counter to form a 128-bit plaintext. The 128-bit plaintext and the 128-bit encryption key may be used as input to an AES-128 encryption algorithm, which generates a 128-bit pseudo-random number based on the input that may be used as the STS.

[0104] Instead of generating and exchanging new encryption keys, two communicating devices can implicitly perform key derivation (also known as key rotation) to generate new encryption keys. Given a common data field (i.e., a data field P shared (known) by each device) and a random salt (random number), the derived encryption key can be obtained according to the following formula:

[0105] Derived key = KDF(P, salt)

[0106] Where KDF is a key derivation function, P is a common data field, and salt is a random salt. The random salt can be derived from information privately known to the sender device and the receiver device (e.g., session ID, MAC address, etc.). KDF provides a secure technique for generating new keys and is performed by both the sender and receiver devices so that the new key is known to both devices. The use of key derivation provides security against brute force attacks, which can be further strengthened using iteration values. The key derivation function is performed intermittently (e.g., periodically) during key rotation to help prevent attackers from predicting / cracking the sequence. Examples of well-known KDFs include PBKDF2, Bcrypt, Scrypt, and Argon2.

[0107] UEs may use different techniques for discovery and ranging session establishment. For example, an announcement UE may broadcast an announcement message and one or more monitoring UEs may receive the message. This discovery technique is referred to as Model A in LTE. As another example, a discoverer UE may transmit a solicitation message containing a discovery request, and one or more discoverer UEs may receive the discovery request and transmit a response message. This discovery technique is referred to as Model B in LTE. One or more of various signaling techniques (e.g., NR, UWB (ultra-wideband), WiFi, etc.) may be used to conduct ranging sessions. Ranging session establishment may be performed using broadcast, multicast, or unicast messaging. For example, for NR version 16, option 1 is a multicast side link establishment using only NACK HARQ (negative acknowledgement hybrid automatic repeat request) feedback, and option 2 is a multicast using ACK (acknowledgement) or NACK HARQ feedback. Information may be agreed upon between UEs, for example, by one UE sending to another UE to reach a unilateral agreement, or by a bilateral agreement of information known to two UEs by being transmitted from one UE to another UE or otherwise known to two UEs.

[0108] Referring also to FIG. 5 , UE 500 includes a processor 510, a transceiver 520, and a memory 530 that are communicatively coupled to each other via a bus 540. UE 500 may include the components shown in FIG. 5 . UE 500 is a wireless communication device and is a part of a monitoring vehicle (e.g., a car, a truck, a motorcycle, etc.) that is capable of monitoring another vehicle (e.g., analyzing one or more images of a target vehicle to determine and report one or more characteristics of the target vehicle, and / or receiving and reporting one or more messages about the target vehicle from another monitoring vehicle, etc.). UE 500 may include one or more other components (such as any of those components shown in FIG. 2 ), so that UE 200 may be an example of UE 500. For example, processor 510 may include one or more of the components of processor 210. The transceiver 520 may include one or more of the components of the transceiver 215, for example, the wireless transmitter 242 and the antenna 246, or the wireless receiver 244 and the antenna 246, or the wireless transmitter 242, the wireless receiver 244, and the antenna 246. Additionally or alternatively, the transceiver 520 may include the wired transmitter 252 and / or the wired receiver 254. The memory 530 may be configured similarly to the memory 211, for example, including software having processor-readable instructions configured to cause the processor 510 to perform functions.

[0109] The description herein may refer to the processor 510 performing a function, but this includes other implementations, such as an implementation in which the processor 510 executes software (stored in the memory 530) and / or firmware. The description herein may refer to the UE 500 performing a function as shorthand for one or more appropriate components of the UE 500 (e.g., the processor 510 and the memory 530) performing that function. The processor 510 (possibly in conjunction with the memory 530 and, where appropriate, the transceiver 520) may include a discovery unit 550 and a ranging unit 560. The discovery unit 550 and the ranging unit 560 are discussed further below, and the description may generally refer to the processor 510 or generally refer to the UE 500 performing any of the functions of the discovery unit 550 or the ranging unit 560, where the UE 500 is configured to perform the functions of the discovery unit 550 and the ranging unit 560.

[0110] 6 , TRP 600 includes a processor 610, a transceiver 620, and a memory 630 that are communicatively coupled to each other via a bus 640. TRP 600 may include the components shown in FIG6 . TRP 600 may include one or more other components (such as any of those components shown in FIG3 ), so that TRP 300 may be an example of TRP 600. For example, processor 610 may include one or more of the components of processor 310, transceiver 620 may include one or more of the components of transceiver 315, and / or memory 630 may be configured similarly to memory 311, e.g., including software having processor-readable instructions configured to cause processor 610 to perform functions.

[0111] The description herein may refer to the processor 610 performing a function, but this includes other implementations, such as an implementation in which the processor 610 executes software (stored in the memory 630) and / or firmware. The description herein may refer to the TRP 600 performing a function as shorthand for one or more appropriate components of the TRP 600 (e.g., the processor 610 and the memory 630) performing that function. The processor 610 (possibly in conjunction with the memory 630 and, where appropriate, the transceiver 620) includes a ranging unit 650. The ranging unit 650 is discussed further below, and the description may refer generally to the processor 610 or generally to the TRP 600 performing any of the functions of the ranging unit 650. The TRP 600 is configured to perform the functions of the ranging unit 650.

[0112] 7, an environment 700 for network-assisted positioning (e.g., using a ranging session) includes a TRP 600 and UEs 711, 712, 713, 714, 715, 716, 717, 718. In the environment 700, each of the UEs 711-718 is within the network coverage (i.e., within the communication range) of a network entity (here, the TRP 600). The UEs 711-718 may be a cooperative positioning network, in which the UEs 711-718 are able to cooperate with each other to perform ranging to determine one or more positioning estimates for one or more of the UEs 711-718. For example, UE 711-718 may perform pairwise positioning, and there may be a link between each of UE 711-718 (resulting in a total of 28 links), although only links 722, 723, 724, 725, 726, 727, 728 between UE 711 and UE 712-718 are shown in FIG7 , respectively. If each pairwise link is established separately, a large amount of overhead is involved in generating and negotiating a security sequence for each pairwise link. Each pair of UE 711-718 may participate in discovery, send and receive information to establish a connection and may send and / or receive information, and may agree on information for ranging.

[0113] In order to reduce the overhead involved in generating and negotiating a security sequence for each paired link, the TRP 600 may send (e.g., broadcast) network assistance data to the UEs 711-718. This may avoid or reduce the information transferred between each pair of UEs 711-718 to establish information for secure positioning. For example, the UE pair may avoid sending complete information for encryption key generation. The network assistance data may include common seed information for all UEs 711-718. The UEs 711-718 may use the common seed information to generate a security sequence for each paired link in a scalable manner. For example, each pair of UEs 711-718 may use a portion of the seed information as common data or a portion of the common data, and use another portion of the seed information in a key derivation function to construct a common key, and use a combination of the common data and the common key in an encryption function (e.g., an algorithm) to generate secure ranging information (security sequence) for channel estimation. This avoids exchanging and negotiating data / key combinations for each link between the appropriate UEs 711-718, thereby reducing the overhead and processing power for establishing secure ranging information and using the secure ranging information to perform channel estimation. The two UEs in a pair (Tx UE and Rx UE) individually generate a secure sequence for channel estimation, which can be used for ranging and therefore for secure positioning.

[0114] Referring also to FIG8 , a method 800 for generating a ciphertext for positioning to generate a secure sequence is shown. The method 800 uses plaintext and an encryption key as inputs to an encryption process 830 to change the plaintext into a ciphertext. The entire plaintext and encryption key may be sent by the TRP 600 as seed information. As another example, the seed information may include some of the plaintext and the encryption key, as in the example shown in FIG8 . As shown in FIG8 , an example plaintext 810 includes a plaintext portion 811, a source ID 812, a first destination ID 813, a second destination ID 814, and a counter 815. In this example, the example plaintext 810 is 128 bits and the plaintext portion 811 is 72 bits, the source ID 812 is 8 bits, the first destination ID 813 is 8 bits, the second destination ID 814 is 8 bits, and the counter 815 is 32 bits. The counter 815 may be incremented to establish a new value for the plaintext 810. The plaintext portion 811 and the counter 815 (at least the initial value of the counter 815) may be common fields, included in the network assistance data broadcast by the TRP 600, and are therefore common data (same data) for all UEs 711-718. The source ID 812 may also be included in the network assistance data and is therefore also common (same) for all UE pairs. The first destination ID 813 and the second destination ID 814 are the IDs of the UEs in each pair of UEs 711-718 and therefore depend on the specific pair in question, although other information (e.g., in addition to the UE ID) may be used / agreed upon. In this example, the first destination ID 813 is the ID of UE 712, and the second destination ID 814 is the ID of UE 713. The encryption key 820 may be obtained (e.g., retrieved from a memory or provided in the network assistance data), and is therefore a common field (same data) for each pair of UEs 711-718. The ranging unit 560 of each of the UEs can use the example plaintext 810 and the encryption key 820 (or a key derived therefrom as discussed below) as input to the encryption process 830 to generate a ciphertext 840 for a corresponding pair of UEs 711-718 (here UEs 712, 713) to be used as an STS for secure ranging. The encryption key 820 can be the same for different pairs of UEs 711-718, or different pairs of UEs can use different encryption keys. To establish the ciphertext, perhaps only the destination ID 813, 814 is sent between the UEs 712, 713, thus significantly reducing the overhead for generating the ciphertext compared to sending the full plaintext and the full encryption key for use in the encryption process 830.

[0115] The plaintext 810 and / or encryption key 820 may change over time. For example, the TRP 600 (e.g., ranging unit 650) may periodically send network assistance data, where the network assistance data changes with each transmission. The plaintext portion 811 may be different between different transmissions of the network AD. As another example, the discovery unit 550 in a pair of UEs (UE 712, 713 in this example) may agree on some or all of the common data during the discovery phase, for example, by secure unicast transmission. For example, the discovery unit 550 may agree to replace one or more bits of the plaintext portion 811 with one or more agreed bits.

[0116] For additional security, an encryption key may be determined by each pair of UEs 711-718 such that different encryption keys may be used for different pairs of UEs 711-718. For example, a KDF may be applied to the encryption key 820 of each pair of UEs 711-718 to determine a revised encryption key to be used as an input to the encryption process 830. For example, each pair of UEs 711-718 (e.g., the discovery unit 550 of each UE in each pair of UEs 711-718) may use the encryption key 820 as an input to a key derivation function to derive a key. For example, during unicast communication during discovery, the discovery unit 550 may agree on one or more KDF parameters, such as a random salt value, a key distribution function to be used, etc. The key derived using the KDF and the agreed upon KDF parameters may be different for each pair of UEs 711-718.

[0117] Additionally or alternatively, for additional security, the TRP 600 may provide a proprietary key generation strategy to one or more pairs of UEs 711-718. For example, the TRP 600 may indicate a proprietary key derivation function for use by the pair of UEs 711-718. As another example, the TRP 600 may indicate a strategy for determining an encryption key (e.g., a pair of UEs 711-718 may be provided with a proprietary strategy for determining an encryption key independent of the encryption key 820 (in which case the TRP 600 may not send the encryption key 820)).

[0118] Referring also to FIG. 9 , an environment 900 for out-of-network coverage positioning includes UEs 911, 912, 913, 914, 915, 916, 917, 918. In the environment 900, none of the UEs 911-918 are within the network coverage (i.e., within the communication range) of a network entity (such as TRP 600). The UEs 911-918 may be a cooperative positioning network, in which the UEs 911-918 are able to cooperate with each other to perform ranging to determine one or more positioning estimates for one or more of the UEs 911-918. For example, the UEs 911-918 may perform paired positioning, and there may be a link between each of the UEs 911-918 (resulting in a total of 28 links), although only links 922, 923, 924, 925, 926, 927, 928 between the UE 911 and the UEs 912-918 are shown in FIG. 9 , respectively. If each pairwise link is established individually, there is a significant overhead involved in generating and negotiating a security sequence for each pairwise link.Pairs of UEs 911-918 may participate in discovery, send and receive information to establish a connection and possibly send and / or receive information, and possibly agree on information for ranging.

[0119] In order to reduce the overhead involved in generating and negotiating a security sequence for each paired link, UE 911 may send (e.g., broadcast, multicast and / or unicast) auxiliary data to UE 912-918. This can avoid or reduce the information transferred between each pair of UE 912-918 to establish information for secure positioning. For example, the UE pair can avoid sending complete information for encryption key generation. The auxiliary data may include common seed information for all UE 912-918. UE 912-918 can use the common seed information to generate a security sequence for each paired link in a scalable manner. For example, each pair of UE 912-918 can use a portion of the seed information as common data or a portion of the common data, and use another portion of the seed information in a key derivation function to construct a common key, and use a combination of the common data and the common key in an encryption function (e.g., an algorithm) to generate secure ranging information (security sequence) for channel estimation. This avoids exchanging and negotiating data / key combinations for each link between appropriate UEs 912-918, thereby reducing the overhead and processing power for establishing secure ranging information and performing channel estimation using the secure ranging information. The two UEs in a pair (Tx UE and Rx UE) separately generate a secure sequence for channel estimation, which can be used for ranging and therefore for secure positioning. For example, if UE 911 is already communicating with UE 912 and UE 913, and each of UE 912, 913 has been notified of the communication with the other UE 912, 913, and UE 912, 913 wants to initiate a ranging session with each other, UE 912, 913 can use information from UE 911 to reduce overhead and save time and / or energy resources for establishing a secure ranging session.

[0120] Similar to the above discussion with respect to FIG. 8, the encryption process implemented by each pair of UEs 912-918 uses plaintext and encryption keys as inputs to the encryption process to change plaintext into ciphertext. The entire plaintext and encryption key may be sent by UE 911 as seed information. As another example, also referring to FIG. 10, the seed information may include some of the plaintext and encryption keys. As shown in FIG. 10, the example plaintext 1010 includes a plaintext portion 1011, a source ID 1012, a first destination ID 1013, a second destination ID 1014, and a counter 1015. In this example, the example plaintext 1010 is 128 bits and the plaintext portion 1011 is 72 bits, the source ID portion 1012 is 8 bits, the first destination ID 1013 is 8 bits, the second destination ID 1014 is 8 bits, and the counter 1015 is 32 bits. The counter 1015 may be incremented to establish a new value of the example plaintext 1010. The plaintext portion 1011 and the counter 1015 (at least the initial value of the counter 1015) may be common fields, included in the assistance data sent by the UE 911, and are therefore common data (same data) for all UEs 912-918 or at least one pair of UEs 912, 913. The source ID 1012 may also be included in the assistance data and is therefore also common (same) for all UE pairs. The first destination ID 1013 and the second destination ID 1014 are the IDs of the UEs in each pair of UEs 911-918 and therefore depend on the particular pair in question. In this example, the first destination ID 1013 is the ID of the UE 912, and the second destination ID 1014 is the ID of the UE 913. The encryption key 1020 may be obtained (e.g., retrieved from a memory or provided in the assistance data), and is therefore a common field (same data) for each pair of UEs 911-918 or at least each corresponding pair of UEs. The ranging unit 560 of each of the UEs can use the example plaintext 1010 and the encryption key 1020 (or a key derived therefrom as discussed below) as input to the encryption process to generate ciphertext for the corresponding pair of UEs 911-918 (here UE 912, 913) to be used as an STS for secure ranging. The encryption key 1020 can be the same for different pairs of UEs 911-918, or different UE pairs can use different encryption keys. To establish the ciphertext, perhaps only the destination ID 1013, 1014 is sent between the UEs 1012, 1013, thus significantly reducing the overhead for generating the ciphertext compared to sending the full plaintext and the full encryption key for use in the encryption process.

[0121] Similar to the above discussion, the example plaintext 1010 and / or encryption key 1020 may change over time and / or may provide additional security. For example, the UE 911 (e.g., ranging unit 650) may periodically send auxiliary data, where the auxiliary data changes with each transmission. For additional security, the encryption key may be determined by each pair of UEs 912-918, so that different encryption keys can be used for different pairs of UEs 912-918. For example, a KDF may be applied to the encryption key 1020 of each pair of UEs 912-918 to determine a revised encryption key to be used as an input to the encryption process (e.g., where the pair of UEs establishes one or more KDF parameters during unicast discovery). Additionally or alternatively, for additional security, the UE 911 may provide a proprietary key generation strategy to one or more pairs of UEs 912-918. For example, the UE 911 may indicate a proprietary key derivation function for use by a pair of UEs 912-718. As another example, UE 911 may indicate a policy for determining an encryption key (e.g., a pair of UEs 912-918 may be provided with a dedicated policy for determining an encryption key independent of encryption key 1020 (in which case UE 911 may not send encryption key 1020)).

[0122] Using KDF to generate keys provides additional security. For example, if one or more of UEs 911-918 is an attacker, two non-attacker UEs can use secure unicast communication to agree on one or more KDF values ​​(e.g., one or more input values ​​such as random salt, ID, or one or more parameters that affect operation) and generate uniqueness based on the agreed KDF values. Since it is hidden from other UEs, using such values ​​provides ranging that is robust to security attacks. The attacker will be limited to attacking the link involving the attacker, and the links between non-attackers will not be affected by the attacker.

[0123] The techniques discussed herein have applicability beyond ranging. For example, UE 912, 913 that have interacted with UE 911 may already be provided with some discovery phase information. For discovery between UE 912, 913, some redundancy in obtaining this discovery phase information may be eliminated. This is also true in a network coverage scenario, where UE 712, 713 receives information in network assistance data from TRP 600. Eliminating redundancy may speed up the discovery process and setup, and / or may save time and / or energy resources.

[0124] Referring to FIG. 11 , and further to FIGS. 1 to 10 , a timing diagram illustrates a signaling and process flow 1100 for reducing discovery overhead, and secure ranging includes the stages shown. Other flows are possible, for example, omitting one or more stages shown, adding one or more stages, and / or modifying one or more stages shown. For example, stages 1130, 1140, 1150 may be omitted and replaced with other stages, for example, for general communication.

[0125] At stage 1110, an AD source 1103 (assistance data source) sends assistance data 1111 to a first UE 1101 and sends assistance data 1112 to a second UE 1102. UEs 1101, 1102 may be examples of UE 500, for example, UE 712, 713 or UE 912, 913. AD source 1103 may be a network entity such as TRP 600 or another UE (e.g., UE 911). Assistance data 1111, 1112 may be a broadcast message, a multicast message, or a separate unicast message, or part of any of them. Assistance data 1111, 1112 may include common data such as discussed above. If the auxiliary data 1111, 1112 are unicast messages, the auxiliary data 1111 may indicate that the AD source 1103 communicates with the second UE 1102 (to provide / agree on the auxiliary data 1111), and the auxiliary data 1112 may indicate that the AD source 1103 communicates with the first UE 1101 (to provide / agree on the auxiliary data 1112).

[0126] At stage 1120, the first UE 1101 and the second UE 1102 participate in discovery. The UEs 1101, 1102 (e.g., the discovery units 550 of the UEs 1101, 1102) send one or more unicast communications 1122 to discover each other. As part of the unicast discovery process, the UEs 1101, 1102 may agree on common data and unique data as part of a plaintext / encrypted key combination, for example, as shown in and discussed with respect to FIG. 8 and FIG. 10. The UEs 1101, 1102 may agree on information by having one of the UEs 1101, 1102 send the information to the other of the UEs 1101, 1102, even without an explicit agreement (e.g., confirmation) by the receiving UE of the UEs 1101, 1102 provided (e.g., transmitted to the sending UE). The information received at stage 1110 is utilized at stage 1120 so that less information may be communicated at stage 1120 than if stage 1110 were not performed.

[0127] At stage 1130, a secure STS is generated by both UEs 1101, 1102. At sub-stages 1131, 1132, the ranging unit 560 of the UEs 1101, 1102 may generate a new encryption key based on the information received / agreed at stage 1120 (e.g., according to the KDF and information received / agreed at stage 1120 or otherwise obtained (e.g., retrieved from memory)). The ranging unit 560 of the UEs 1101, 1102 generates the same STS from the same plaintext and encryption key, for example, using the encryption key obtained at stage 1120 or otherwise obtained (e.g., generated using the KDF). The obtained STS is known only to the UEs 1101, 1102 and thus provides secure ranging between the UEs 1101, 1102.

[0128] At stage 1140, the UEs 1101, 1102 conduct a ranging session. The first UE 1101 may send a ranging signal 1141 (e.g., a UWB (ultra-wideband) ranging signal including the generated STS) to the second UE 1102, and / or the second UE 1102 may send a ranging signal 1142 to the first UE 1101. The ranging signals 1141, 1142 may change over time, for example by changing plain text and / or encryption keys and regenerating the STS.

[0129] At stage 1150, UE 1101, 1102 may determine and possibly report positioning information. For example, at sub-stage 1152, ranging unit 560 of second UE 1102 may measure received ranging signal 1141, and / or at sub-stage 1151, ranging unit 560 of first UE 1101 may measure received ranging signal 1142, for example, to determine positioning information (e.g., ToA, AoA, etc.). Either or both of UE 1101, 1102 may report some or all of the determined positioning information, for example, to the other of UE 1101, 1102 and / or to server 400 and / or other network entities. Either UE 1101, 1102 may use positioning information received from the other UE 1101, 1102 to determine and possibly report additional positioning information (e.g., range to the other UE 1101, 1102, positioning estimates for one or more of UEs 1101, 1102, etc.).

[0130] At stage 1160, the server 400 determines positioning information. The server 400 may determine the positioning information from positioning information reported by one or more of the UEs 1101, 1102 (e.g., one or more raw measurements and / or one or more processed measurements (e.g., ranges)). For example, the server 400 may determine a range between the UEs 1101, 1102 and / or a positioning estimate for the first UE 1101 and / or a positioning estimate for the second UE 1102. The server 400 may report positioning information to one or more of the UEs 1101, 1102 (e.g., positioning information not provided by the respective UEs 1101, 1102).

[0131] Referring to FIG. 12 , and further to FIG. 1 to FIG. 11 , a ranging method 1200 includes the stages shown. However, the method 1200 is an example and not a limitation. The method 1200 may be modified, for example, by adding, removing, rearranging, combining, performing concurrently, and / or splitting a single stage into multiple stages.

[0132] At stage 1210, method 1200 includes receiving encrypted input information from a first entity at a first UE. For example, first UE 1101 may receive AD 1111 from AD source 1103, for example, UE 711 (and / or any one of UE 712-718) may receive network AD from TRP 600, or UE 912 (and / or any one of UE 913-918) may receive AD from UE 911. The network AD from TRP 600 or the AD from UE 911 may include plaintext (or part thereof) and an encryption key (or information for determining the encryption key, such as KDF information). Processor 510 (possibly in combination with memory 530, in combination with transceiver 520 (e.g., wireless receiver 244 and antenna 246)) may include a component for receiving encrypted input information.

[0133] At stage 1220, the method 1200 includes communicating, by the first UE, with a second entity as a second UE to establish a ranging session with the second UE. For example, at stage 1120, the discovery unit 550 of the first UE 1101 sends and / or receives one or more unicast communications 1122 to / from the second UE 1102 to establish a ranging session between the UEs 1101, 1102. The processor 510 (possibly in combination with the memory 530, possibly in combination with the transceiver 520 (e.g., the wireless transmitter 242 and the antenna 246 and / or the wireless receiver 244 and the antenna 246)) may include a component for communicating to establish a ranging session with the second UE.

[0134] At stage 1230, method 1200 includes using the encrypted input information to generate an encrypted ranging signal. For example, at stage 1131, ranging unit 560 of UE 1101 generates an STS using information from AD 1111 (e.g., based on plaintext (some of which may come from AD 1111 and some of which may be agreed upon by UE 1101, 1102) and an encryption key (provided or derived)). Processor 510 (possibly in conjunction with memory 530) may include means for generating an encrypted ranging signal using the encrypted input information.

[0135] At stage 1240, method 1200 includes using the encrypted ranging signal for ranging between the first UE and the second UE in the ranging session. For example, at stage 1140, the first UE 1101 may transmit the ranging signal 1141 to the second UE 1102, and / or the second UE 1102 may transmit the ranging signal 1142 to the first UE 1101. As another example, at sub-stage 1151, the first UE 1101 may determine and possibly report positioning information based on the transmission of the ranging signal 1141 and / or the reception and measurement of the ranging signal 1142. The processor 510 (possibly in combination with the memory 530, possibly in combination with the transceiver 520 (e.g., the wireless transmitter 242 and the antenna 246 and / or the wireless receiver 244 and the antenna 246)) may include a component for using the encrypted ranging signal for ranging between the first UE and the second UE in the ranging session.

[0136] Implementations of the method 1200 may include one or more of the following features. In an example implementation, the encrypted input information is first encrypted input information, and wherein the ranging method 1200 further includes: communicating by the first UE and the second UE to agree on second encrypted input information; and generating an encrypted ranging signal at the first UE using the first encrypted input information and the second encrypted input information. For example, the first encrypted input information may include a plaintext portion 811 (or a portion thereof), a counter 815, and an encryption key 820, and the first UE 1101 may agree with the second UE 1102 on the second encrypted input information (such as a portion of the plaintext portion 811, a source ID 812, a first destination ID 813, and / or a second destination ID 814). The discovery units 550 of the UEs 1101, 1102 may communicate to agree on the second encrypted input information (e.g., a portion of the plaintext, an ID, and / or other information unique to the ranging session). The ranging unit 560 of the first UE 1101 can use the first encrypted input information and the second encrypted input information to generate an encrypted ranging signal, for example, using the example plaintext 810 and the encryption key 820 as inputs to the encryption process 830 to generate the ciphertext 840. The processor 510 (possibly in combination with the memory 530, possibly in combination with the transceiver 520 (e.g., the wireless transmitter 242 and the antenna 246 and / or the wireless receiver 244 and the antenna 246)) may include a component for communicating with the second UE to agree on the second encrypted input information, and the processor 510 (possibly in combination with the memory 530) may include a component for using the first encrypted input information and the second encrypted input information to generate the encrypted ranging signal. In another example implementation, the second encrypted input information includes a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof. For example, the agreed encrypted input information includes a source ID 812, a first destination ID 813, and / or a second destination ID 814. In yet another example implementation, at least some of the second encrypted input information replaces at least some of the first encrypted input information. For example, UE 1101, 1102 may receive the example plaintext portion 811 and agree to replace some or all of the example plaintext portion 811 with other information. In yet another example implementation, the second encrypted input information includes at least one key derivation function parameter, and the ranging method 1200 also includes using at least one key derivation function parameter as part of the key derivation function to generate an encrypted ranging signal. For example, UE 1101, 1102 may agree on KDF information (e.g., seed value, random salt, KDF parameters that affect the operation (e.g., the selected KDF function), etc.), and use the KDF information and / or select a KDF to generate an encrypted ranging signal, for example, by deriving an encryption key used in the encryption process 830 to generate a ciphertext 840.In another example implementation, at least one key derivation function parameter includes a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

[0137] Additionally or alternatively, a specific implementation of method 1200 may include one or more of the following features. In an example implementation, method 1200 also includes receiving encrypted input information from a transmit / receive point in a broadcast message at a first UE. For example, UE 1101 (e.g., UE 711) receives network AD as AD 1111, where AD source 1103 is TRP 600. In another example implementation, method 1200 includes receiving encrypted input information from a third UE in a positioning assistance message at the first UE, and at least one of the following: generating an encrypted ranging signal based on a positioning assistance message identifying a second UE; or using an encrypted ranging signal in a ranging session based on a positioning assistance message identifying a second UE; or a combination thereof. For example, UE 1101 (e.g., UE 912) receives AD 1111, where AD source 1103 is UE 911, and generates an STS based on the AD identifying the second UE 1102 (e.g., using information from AD 1111 to generate an STS for a ranging session with the second UE 1102) and / or uses the STS (e.g., providing it to UE 1101) for ranging in the ranging session with the second UE 1102 (e.g., sending the STS to the second UE 1102 and / or receiving and measuring the STS from the second UE 1102). The processor 510 (possibly in combination with the memory 530) may include a component for generating an encrypted ranging signal based on the positioning assistance message identifying the second UE. Processor 510 (possibly in conjunction with memory 530, possibly in conjunction with transceiver 520 (eg, wireless transmitter 242 and antenna 246 and / or wireless receiver 244 and antenna 246)) may include means for using encrypted ranging signals in a ranging session.

[0138] Referring to FIG. 13 , and further referring to FIG. 1 to FIG. 11 , the ranging information distribution method 1300 includes the stages shown. However, the method 1300 is an example and not a limitation. The method 1300 may be modified, for example, by adding, removing, rearranging, combining, concurrently executing, and / or splitting a single stage into multiple stages.

[0139] At stage 1310, method 1300 includes sending an encrypted message including encrypted input information from the device to at least the first UE and the second UE. For example, TRP 600 may be AD source 1103 and broadcast network AD as AD 1111, 1112 to UE 1101, 1102, wherein AD 1111, 1112 includes at least a portion of example plaintext 810 and / or at least a portion of encryption key 820 (or information for deriving encryption key 820). As another example, UE 911 may be AD source 1103 and broadcast, multicast, or unicast AD 1111, 1112 to UE 1101, 1102, wherein AD 1111, 1112 includes at least a portion of example plaintext 1010 and / or at least a portion of encryption key 1020 (or information for deriving encryption key 1020). Processor 610 (possibly in combination with memory 630, possibly in combination with transceiver 620 (e.g., wireless transmitter 342 and antenna 346 and / or wireless transmitter 442 and antenna 446 and / or wired transmitter 452)) may include means for sending encrypted messages. Processor 510 (possibly in combination with memory 530, possibly in combination with transceiver 520 (e.g., wireless transmitter 242 and antenna 246)) may include means for sending encrypted messages.

[0140] At stage 1320, method 1300 includes sending a ranging indication from the device to at least the first UE and the second UE, the ranging indication indicating that the encrypted input information is used to generate an encrypted ranging signal for ranging. For example, AD 1111, 1112 may indicate that AD 1111, 1112 is used to generate an STS for ranging. Processor 610 (possibly in combination with memory 630, possibly in combination with transceiver 620 (e.g., wireless transmitter 342 and antenna 346 and / or wireless transmitter 442 and antenna 446 and / or wired transmitter 452)) may include a component for sending a ranging indication. Processor 510 (possibly in combination with memory 530, possibly in combination with transceiver 520 (e.g., wireless transmitter 242 and antenna 246)) may include a component for sending a ranging indication.

[0141] A specific implementation of method 1300 may include one or more of the following features. In an example implementation, the device is a third UE, and the ranging indication indicates that the encrypted input information is used to generate an encrypted ranging signal for ranging between a first UE and a second UE. For example, UE 911 may be an AD source 1103, and AD 1111 may indicate that AD 1111 is used to generate an STS for ranging with a second UE 1102 (e.g., the information in AD 1111 is based on the communication between UE 911 and the second UE 1102), and / or AD 1112 may indicate that AD 1112 is used to generate an STS for ranging with a first UE 1101 (e.g., the information in AD 1112 is based on the communication between UE 911 and the first UE 1101). In another example implementation, the device is a sending / receiving point, and sending the ranging indication includes broadcasting an encrypted message. For example, AD source 1103 may be TRP 600, and ADs 1111, 1112 may be network ADs broadcast by TRP 600 to UEs 712, 713 (and to UEs 711, 714-718). In another example implementation, the encrypted input information includes a plaintext portion, or a counter, or an encryption key, or any combination thereof.

[0142] Specific implementation examples

[0143] Specific implementation examples are provided in the following numbered clauses.

[0144] Clause 1. A first UE, the first UE comprising:

[0145] a transceiver configured to transmit and receive wireless signals;

[0146] Memory; and

[0147] a processor communicatively coupled to the memory and the transceiver, the

[0148] The processor is configured to:

[0149] receiving encrypted input information from a first entity via the transceiver;

[0150] communicating, via the transceiver, with a second entity being a second UE to establish a ranging session with the second UE;

[0151] Using the encrypted input information to generate an encrypted ranging signal; and

[0152] The encrypted ranging signal is used in the ranging session for ranging between the first UE and the second UE.

[0153] Clause 2. The first UE of claim 1, wherein the encrypted input information is first encrypted input information, and wherein the processor is configured to:

[0154] communicating with the second UE via the transceiver to agree on second encrypted input information; and

[0155] The encrypted ranging signal is generated using the first encrypted input information and the second encrypted input information.

[0156] Clause 3. The first UE of claim 2, wherein the second encrypted input information comprises a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof.

[0157] Clause 4. The first UE of claim 2, wherein the second encrypted input information comprises at least one key derivation function parameter, and wherein the processor is configured to use the at least one key derivation function parameter as part of a key derivation function to generate the encrypted ranging signal.

[0158] Clause 5. The first UE of claim 4, wherein the at least one key derivation function parameter comprises a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

[0159] Clause 6. The first UE of claim 2, wherein at least some of the second encrypted input information replaces at least some of the first encrypted input information.

[0160] Clause 7. The first UE of claim 1 , wherein the processor is configured to receive the encrypted input information from a transmission / reception point in a broadcast message.

[0161] Clause 8. A first UE according to claim 1, wherein the processor is configured to receive the encrypted input information from a third UE in a positioning assistance message, and at least one of the following: configured to generate the encrypted ranging signal based on the positioning assistance message identifying the second UE, or to use the encrypted ranging signal in the ranging session based on the positioning assistance message identifying the second UE, or a combination thereof.

[0162] Clause 9. A distance measurement method, the distance measurement method comprising:

[0163] receiving, at the first UE, encrypted input information from the first entity;

[0164] The first UE communicates with a second entity as a second UE to establish a ranging session with the second UE;

[0165] Using the encrypted input information to generate an encrypted ranging signal; and

[0166] The encrypted ranging signal is used in the ranging session for ranging between the first UE and the second UE.

[0167] Clause 10. The ranging method according to claim 9, wherein the encrypted input information is first encrypted input information, and wherein the ranging method further comprises:

[0168] The first UE communicates with the second UE to agree on second encrypted input information;

[0169] as well as

[0170] The encrypted ranging signal is generated at the first UE using the first encrypted input information and the second encrypted input information.

[0171] Clause 11. The ranging method of claim 10, wherein the second encrypted input information comprises a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof.

[0172] Clause 12. A ranging method according to claim 10, wherein the second encrypted input information includes at least one key derivation function parameter, and wherein the ranging method also includes using the at least one key derivation function parameter as part of a key derivation function to generate the encrypted ranging signal.

[0173] Clause 13. The ranging method of claim 12, wherein the at least one key derivation function parameter comprises a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

[0174] Clause 14. The ranging method of claim 10, wherein at least some of the second encrypted input information replaces at least some of the first encrypted input information.

[0175] Clause 15. The ranging method of claim 9, further comprising receiving, at the first UE, the encrypted input information from a transmission / reception point in a broadcast message.

[0176] Clause 16. The ranging method of claim 9, further comprising receiving, at the first UE, the encrypted input information from a third UE in a positioning assistance message, and at least one of:

[0177] generating the encrypted ranging signal based on the positioning assistance message identifying the second UE; or

[0178] using the encrypted ranging signal in the ranging session based on the positioning assistance message identifying the second UE; or

[0179] A combination of them.

[0180] Clause 17. A first UE, the first UE comprising:

[0181] means for receiving encrypted input information from a first entity;

[0182] means for communicating with a second entity being a second UE to establish a ranging session with the second UE;

[0183] means for generating an encrypted ranging signal using the encrypted input information; and

[0184] means for using the encrypted ranging signal in the ranging session for ranging between the first UE and the second UE.

[0185] Clause 18. The first UE of claim 17, wherein the encrypted input information is first encrypted input information, and wherein the first UE further comprises:

[0186] means for communicating with the second UE to agree on second encrypted input information; and

[0187] means for generating the encrypted ranging signal using the first encrypted input information and the second encrypted input information.

[0188] Clause 19. The first UE of claim 18, wherein the second encrypted input information comprises a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof.

[0189] Clause 20. The first UE of claim 18, wherein the second encrypted input information comprises at least one key derivation function parameter, and wherein the first UE further comprises means for using the at least one key derivation function parameter as part of a key derivation function to generate the encrypted ranging signal.

[0190] Clause 21. The first UE of claim 20, wherein the at least one key derivation function parameter comprises a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

[0191] Clause 22. The first UE of claim 18, wherein at least some of the second encrypted input information replaces at least some of the first encrypted input information.

[0192] Clause 23. The first UE of claim 17, further comprising means for receiving the encrypted input information from a transmission / reception point in a broadcast message.

[0193] Clause 24. The first UE of claim 17, further comprising:

[0194] means for receiving the encrypted input information from a third UE in a positioning assistance message; and

[0195] At least one of the following:

[0196] means for generating the encrypted ranging signal based on the positioning assistance message identifying the second UE; or

[0197] means for using the encrypted ranging signal in the ranging session based on the positioning assistance message identifying the second UE; or

[0198] A combination of them.

[0199] Clause 25. A non-transitory processor-readable storage medium comprising processor-readable instructions for causing a processor of a first UE to:

[0200] receiving encrypted input information from a first entity;

[0201] communicating with a second entity being a second UE to establish a ranging session with the second UE;

[0202] Using the encrypted input information to generate an encrypted ranging signal; and

[0203] The encrypted ranging signal is used in the ranging session for ranging between the first UE and the second UE.

[0204] Clause 26. The non-transitory processor-readable storage medium of claim 25, wherein the encrypted input information is first encrypted input information, and wherein the non-transitory processor-readable storage medium further comprises processor-readable instructions for causing the processor to:

[0205] communicating with the second UE to agree on second encrypted input information; and

[0206] The encrypted ranging signal is generated using the first encrypted input information and the second encrypted input information.

[0207] Clause 27. A non-transitory processor-readable storage medium according to claim 26, wherein the second encrypted input information includes a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof.

[0208] Clause 28. A non-transitory processor-readable storage medium according to claim 26, wherein the second encrypted input information includes at least one key derivation function parameter, and wherein the non-transitory processor-readable storage medium also includes processor-readable instructions for causing the processor to use the at least one key derivation function parameter as part of a key derivation function to generate the encrypted ranging signal.

[0209] Clause 29. The non-transitory processor-readable storage medium of claim 28, wherein the at least one key derivation function parameter comprises a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

[0210] Clause 30. The non-transitory processor-readable storage medium of claim 26, wherein at least some of the second encrypted input information replaces at least some of the first encrypted input information.

[0211] Clause 31. The non-transitory processor-readable storage medium of claim 25, further comprising processor-readable instructions for causing the processor to receive the encrypted input information from a transmission / reception point in a broadcast message.

[0212] Clause 32. The non-transitory processor-readable storage medium of claim 25, further comprising:

[0213] processor-readable instructions for causing the processor to receive the encrypted input information from a third UE in a positioning assistance message; and

[0214] At least one of the following:

[0215] processor-readable instructions for causing the processor to generate the encrypted ranging signal based on the positioning assistance message identifying the second UE; or

[0216] processor-readable instructions for causing the processor to use the encrypted ranging signal in the ranging session based on the positioning assistance message identifying the second UE; or

[0217] A combination of them.

[0218] Clause 33. An apparatus, comprising:

[0219] a transceiver configured to transmit and receive wireless signals;

[0220] Memory; and

[0221] A processor is communicatively coupled to the memory and the transceiver, the processor being configured to send an encrypted message and a ranging indication to at least a first UE and a second UE via the transceiver, the encrypted message comprising encrypted input information, the ranging indication indicating that the encrypted input information is used to generate an encrypted ranging signal for ranging.

[0222] Clause 34. The apparatus of claim 33, wherein the apparatus is a third UE, and wherein the ranging indication indicates that the encrypted input information is used to generate the encrypted ranging signal for ranging between the first UE and the second UE.

[0223] Clause 35. The apparatus of claim 33, wherein the apparatus is a transmit / receive point, and wherein the processor is configured to transmit the ranging indication by causing the transceiver to broadcast the encrypted message.

[0224] Clause 36. The apparatus of claim 33, wherein the encrypted input information comprises a plaintext portion, or a counter, or an encryption key, or any combination thereof.

[0225] Clause 37. A method for distributing ranging information, the method comprising:

[0226] sending an encrypted message including the encrypted input information from the device to at least the first UE and the second UE; and

[0227] A ranging indication is sent from the apparatus to at least the first UE and the second UE, the ranging indication indicating that the encrypted input information is used to generate an encrypted ranging signal for ranging.

[0228] Clause 38. The ranging information distribution method of claim 37, wherein the device is a third UE, and wherein the ranging indication indicates that the encrypted input information is used to generate the encrypted ranging signal for ranging between the first UE and the second UE.

[0229] Clause 39. The ranging information distribution method of claim 37, wherein the device is a transmission / reception point, and wherein sending the ranging indication comprises broadcasting the encrypted message.

[0230] Clause 40. The ranging information distribution method according to claim 37, wherein the encrypted input information includes a plain text portion, or a counter, or an encryption key, or any combination thereof.

[0231] Clause 41. An apparatus, the apparatus comprising:

[0232] means for sending an encrypted message including encrypted input information to at least the first UE and the second UE; and

[0233] means for sending a ranging indication to at least the first UE and the second UE, the ranging indication indicating that the encrypted input information is used to generate an encrypted ranging signal for ranging.

[0234] Clause 42. The apparatus of claim 41, wherein the apparatus is a third UE, and wherein the ranging indication indicates that the encrypted input information is used to generate the encrypted ranging signal for ranging between the first UE and the second UE.

[0235] Clause 43. The apparatus of claim 41, wherein the apparatus is a transmit / receive point, and wherein the means for transmitting the ranging indication comprises means for broadcasting the encrypted message.

[0236] Clause 44. The apparatus of claim 41, wherein the encrypted input information comprises a plaintext portion, or a counter, or an encryption key, or any combination thereof.

[0237] Clause 45. A non-transitory processor-readable storage medium comprising processor-readable instructions for causing a processor of an apparatus to:

[0238] Sending an encrypted message including encrypted input information to at least a first UE and a second UE;

[0239] and

[0240] A ranging indication is sent to at least the first UE and the second UE, wherein the ranging indication indicates that the encrypted input information is used to generate an encrypted ranging signal for ranging.

[0241] Clause 46. The non-transitory processor-readable storage medium of claim 45, wherein the device is a third UE, and wherein the ranging indication indicates that the encrypted input information is used to generate the encrypted ranging signal for ranging between the first UE and the second UE.

[0242] Clause 47. A non-transitory processor-readable storage medium according to claim 45, wherein the device is a transmit / receive point, and wherein the processor-readable instructions for causing the processor to send the ranging indication include processor-readable instructions for causing the processor to broadcast the encrypted message.

[0243] Clause 48. The non-transitory processor-readable storage medium of claim 45, wherein the encrypted input information comprises a plaintext portion, or a counter, or an encryption key, or any combination thereof.

[0244] Other considerations

[0245] Other examples and implementations are within the scope of this disclosure and the appended claims. For example, due to the nature of software and computers, the functions described above may be implemented using software executed by a processor, hardware, firmware, hard wiring, or any combination thereof. Features that implement functions may also be physically located at different locations, including being distributed so that parts of the functions are implemented at different physical locations.

[0246] As used herein, the singular forms "a", "an", and "the" also include the plural forms, unless the context clearly indicates otherwise. As used herein, the terms "include", "comprising", and "include" specify the presence of the recited features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0247] Likewise, as used herein, “or” used in a list of items (possibly followed by “at least one of” or “one or more of”) indicates a disjunctive list, so that, for example, a list of “at least one of A, B, or C,” or a list of “one or more of A, B, or C,” or a list of “A or B or C” means A or B or C, or AB (A and B), or AC (A and C), or BC (B and C), or ABC (i.e., A and B and C), or a combination having more than one feature (e.g., AA, AAB, ABBC, etc.). Thus, a statement that an item (e.g., a processor) is configured to perform a function with respect to at least one of A or B, or a statement that an item is configured to perform function A or function B means that the item may be configured to perform a function with respect to A, or may be configured to perform a function with respect to B, or may be configured to perform functions with respect to both A and B. For example, the phrase "a processor configured to measure at least one of A or B" or "a processor configured to measure A or measure B" means that the processor may be configured to measure A (and may or may not be configured to measure B), or may be configured to measure B (and may or may not be configured to measure A), or may be configured to measure A and measure B (and may be configured to select which of A and B to measure or both). Similarly, the description of a component for measuring at least one of A or B includes: a component for measuring A (which may or may not be able to measure B), or a component for measuring B (and may or may not be configured to measure A), or a component for measuring A and B (which may be able to select which of A and B to measure or both). For another example, the description that an item (e.g., a processor) is configured to perform at least one of function X or perform function Y means that the item may be configured to perform function X, or may be configured to perform function Y, or may be configured to perform function X and perform function Y. For example, the phrase "a processor configured to measure at least one of X or Y" means that the processor may be configured to measure X (and may or may not be configured to measure Y), or may be configured to measure Y (and may or may not be configured to measure X), or may be configured to measure X and measure Y (and may be configured to select which or both of X and Y to measure).

[0248] As used herein, unless otherwise stated, a recitation that a function or operation is "based on" an item or condition means that the function or operation is based on the recited item or condition, and may be based on one or more items and / or conditions other than the recited item or condition.

[0249] Substantial variations can be made according to specific requirements. For example, customized hardware can also be used, and / or specific elements can be implemented in hardware, in software (including portable software, such as small applications, etc.) executed by a processor, or in both. In addition, connections with other computing devices such as network input / output devices can be adopted. Unless otherwise stated, components (functional or otherwise) such as connected or communicated to each other as shown in the figure and / or discussed herein are communicatively coupled. That is, these components can be directly or indirectly connected to realize communication between them.

[0250] The systems and devices discussed above are examples. Various configurations may appropriately omit, replace, or add various processes or components. For example, features described with respect to certain configurations may be combined in various other configurations. Different aspects and elements of a configuration may be combined in a similar manner. In addition, technology is constantly evolving, and therefore many elements are examples and do not limit the scope of the present disclosure or claims.

[0251] A wireless communication system is a system in which communications are transmitted wirelessly, i.e., by propagation of electromagnetic waves and / or sound waves through atmospheric space rather than by wires or other physical connections. A wireless communication network may not cause all communications to be sent wirelessly, but may be configured to cause at least some communications to be sent wirelessly. In addition, the term "wireless communication device" or similar terms does not require that the functionality of the device is exclusively or uniformly primarily used for communication, or that communications using the wireless communication device are exclusively or uniformly primarily wireless, or that the device is a mobile device, but rather indicates that the device includes wireless communication capabilities (unidirectional or bidirectional), for example, including at least one radio (each radio is part of a transmitter, receiver or transceiver) for wireless communication.

[0252] Specific details are given in this specification to provide a thorough understanding of example configurations (including specific implementations). However, configurations can be practiced without these specific details. For example, well-known circuits, processes, algorithms, structures, and techniques have been shown without unnecessary details to avoid confusing these configurations. This specification provides example configurations without limiting the scope, applicability, or configuration of the claims. On the contrary, the previous description of the configuration provides a description for implementing the technology. Various changes can be made to the functions and arrangements of the elements.

[0253] As used herein, the terms "processor-readable medium," "machine-readable medium," and "computer-readable medium" refer to any medium that participates in providing data that causes a machine to operate in a particular manner. Using a computing platform, various processor-readable media may be involved in providing instructions / codes to a processor for execution, and / or may be used to store and / or carry such instructions / codes (e.g., as signals). In many specific implementations, processor-readable media are physical and / or tangible storage media. Such media may take many forms, including, but not limited to, non-volatile media and volatile media. Non-volatile media include, for example, optical disks and / or magnetic disks. Volatile media include, but are not limited to, dynamic memory.

[0254] After describing several example configurations, various modifications, alternative constructions, and equivalents may be used. For example, the above elements may be components of a larger system, in which other rules may take precedence over the application of the present disclosure or otherwise modify the application of the present invention. In addition, several operations may be taken before, during, or after considering the above elements. Accordingly, the above description does not limit the scope of the claims.

[0255] Unless otherwise indicated, "approximately" and / or "about" as used herein in reference to a measurable value (such as an amount, a duration of time, etc.) encompasses variations of ±20% or ±10%, ±5%, or +0.1% from the specified value, as is appropriate in the context of the systems, devices, circuits, methods, and other specific implementations described herein. Unless otherwise indicated, "substantially" as used herein in reference to a measurable value (such as an amount, a duration of time, a physical property (such as frequency), etc.) also encompasses variations of ±20% or ±10%, ±5%, or +0.1% from the specified value, as is appropriate in the context of the systems, devices, circuits, methods, and other specific implementations described herein.

[0256] A statement that a value exceeds (or is greater than or above) a first threshold is equivalent to a statement that the value meets or exceeds a second threshold that is slightly greater than the first threshold, e.g., the second threshold is one value higher than the first threshold at the resolution of the computing system. A statement that a value is less than (or within or below) a first threshold is equivalent to a statement that the value is less than or equal to a second threshold that is slightly less than the first threshold, e.g., the second threshold is one value lower than the first threshold at the resolution of the computing system.

Claims

1. A first UE (user equipment), the first UE comprising: a transceiver configured to transmit and receive wireless signals; Memory; and a processor, the processor being communicatively coupled to the memory and the transceiver, the processor being configured to: receiving encrypted input information from a first entity via the transceiver; communicating, via the transceiver, with a second entity being a second UE to establish a ranging session with the second UE; Using the encrypted input information to generate an encrypted ranging signal; as well as The encrypted ranging signal is used in the ranging session for ranging between the first UE and the second UE.

2. The first UE according to claim 1, wherein the encrypted input information is first encrypted input information, and wherein the processor is configured to: communicating with the second UE via the transceiver to agree on second encrypted input information; and The encrypted ranging signal is generated using the first encrypted input information and the second encrypted input information.

3. The first UE according to claim 2, wherein the second encrypted input information comprises a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof.

4. The first UE of claim 2, wherein the second encrypted input information comprises at least one key derivation function parameter, and wherein the processor is configured to use the at least one key derivation function parameter as part of a key derivation function to generate the encrypted ranging signal. 5 . The first UE according to claim 4 , wherein the at least one key derivation function parameter comprises a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

6. The first UE of claim 2, wherein at least some of the second encrypted input information replaces at least some of the first encrypted input information. 7 . The first UE of claim 1 , wherein the processor is configured to receive the encrypted input information from a transmission / reception point in a broadcast message.

8. The first UE according to claim 1, wherein the processor is configured to receive the encrypted input information from the third UE in a positioning assistance message, and at least one of the following: configured to generate the encrypted ranging signal based on the positioning assistance message identifying the second UE, or to use the encrypted ranging signal in the ranging session based on the positioning assistance message identifying the second UE, or a combination thereof.

9. A distance measurement method, the distance measurement method comprising: Receiving encrypted input information from a first entity at a first UE (user equipment); The first UE communicates with a second entity as a second UE to establish a ranging session with the second UE; Using the encrypted input information to generate an encrypted ranging signal; as well as The encrypted ranging signal is used in the ranging session for ranging between the first UE and the second UE.

10. The ranging method according to claim 9, wherein the encrypted input information is first encrypted input information, and wherein the ranging method further comprises: The first UE communicates with the second UE to agree on second encrypted input information; as well as The encrypted ranging signal is generated at the first UE using the first encrypted input information and the second encrypted input information.

11. The ranging method according to claim 10, wherein the second encrypted input information comprises a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof.

12. The ranging method of claim 10, wherein the second encrypted input information comprises at least one key derivation function parameter, and wherein the ranging method further comprises using the at least one key derivation function parameter as part of a key derivation function to generate the encrypted ranging signal.

13. The ranging method according to claim 12, wherein the at least one key derivation function parameter comprises a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

14. The ranging method according to claim 10, wherein at least some of the second encrypted input information replaces at least some of the first encrypted input information.

15. The ranging method of claim 9, further comprising receiving, at the first UE, the encrypted input information from a transmission / reception point in a broadcast message.

16. The ranging method of claim 9, further comprising receiving, at the first UE, the encrypted input information from a third UE in a positioning assistance message, and at least one of: generating the encrypted ranging signal based on the positioning assistance message identifying the second UE; or using the encrypted ranging signal in the ranging session based on the positioning assistance message identifying the second UE; or A combination of them.

17. A first UE (user equipment), the first UE comprising: means for receiving encrypted input information from a first entity; means for communicating with a second entity being a second UE to establish a ranging session with the second UE; means for generating an encrypted ranging signal using the encrypted input information; and means for using the encrypted ranging signal in the ranging session for ranging between the first UE and the second UE.

18. The first UE according to claim 17, wherein the encrypted input information is first encrypted input information, and wherein the first UE further comprises: means for communicating with the second UE to agree on second encrypted input information; and means for generating the encrypted ranging signal using the first encrypted input information and the second encrypted input information.

19. The first UE of claim 18, wherein the second encrypted input information comprises a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof.

20. The first UE of claim 18, wherein the second encrypted input information comprises at least one key derivation function parameter, and wherein the first UE further comprises means for using the at least one key derivation function parameter as part of a key derivation function to generate the encrypted ranging signal.

21. The first UE of claim 20, wherein the at least one key derivation function parameter comprises a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

22. The first UE of claim 18, wherein at least some of the second encrypted input information replaces at least some of the first encrypted input information.

23. The first UE of claim 17, further comprising means for receiving the encrypted input information from a transmission / reception point in a broadcast message.

24. The first UE according to claim 17, wherein the first UE further comprises: means for receiving the encrypted input information from a third UE in a positioning assistance message; and At least one of the following: means for generating the encrypted ranging signal based on the positioning assistance message identifying the second UE; or means for using the encrypted ranging signal in the ranging session based on the positioning assistance message identifying the second UE; or A combination of them.

25. A non-transitory processor-readable storage medium, the non-transitory processor-readable storage medium comprising processor-readable instructions for causing a processor of a first UE (user equipment) to perform the following operations: receiving encrypted input information from a first entity; communicating with a second entity being a second UE to establish a ranging session with the second UE; Using the encrypted input information to generate an encrypted ranging signal; and The encrypted ranging signal is used in the ranging session for ranging between the first UE and the second UE.

26. The non-transitory processor-readable storage medium of claim 25, wherein the encrypted input information is first encrypted input information, and wherein the non-transitory processor-readable storage medium further comprises processor-readable instructions for causing the processor to: communicating with the second UE to agree on second encrypted input information; and The encrypted ranging signal is generated using the first encrypted input information and the second encrypted input information.

27. The non-transitory processor-readable storage medium of claim 26, wherein the second encrypted input information comprises a first identity associated with the first entity, or a second identity associated with the second entity, or a third identity associated with the first UE, or any combination thereof.

28. A non-transitory processor-readable storage medium according to claim 26, wherein the second encrypted input information includes at least one key derivation function parameter, and wherein the non-transitory processor-readable storage medium also includes processor-readable instructions for causing the processor to use the at least one key derivation function parameter as part of a key derivation function to generate the encrypted ranging signal.

29. The non-transitory processor-readable storage medium of claim 28, wherein the at least one key derivation function parameter comprises a random salt, or an indication of a proprietary key derivation function, or a combination thereof.

30. The non-transitory processor-readable storage medium of claim 26, wherein at least some of the second encrypted input information replaces at least some of the first encrypted input information.

Images