Physical layer (PHY) security for passive internet of things (IoT) devices

Abstract

This disclosure provides systems, methods, and apparatus, including computer programs encoded on a computer storage medium, for physical layer security for passive Internet of Things (IoT) devices. In some aspects, a source device and a reader device may communicate via a passive wireless device, such as an IoT tag, which may reflect or backscatter signaling from the source device to the reader device. The source device, the reader device, and the passive wireless device may secure communications in a physical layer (PHY) according to one or more PHY security keys. As such, the source device may send a first message to the passive wireless device according to the first PHY security key, and the passive wireless device may send a second message to the reader device according to the second PHY security key to secure communications to and from the passive wireless device.

Description

Technical Field

[0001] The present disclosure relates to wireless communications, including physical layer (PHY) security for passive Internet of Things (IoT) devices. Background Art

[0002] Wireless communication systems are widely deployed to provide various types of communication content, such as voice, video, packet data, messaging, broadcasting, etc. These systems may be able to support communication with multiple users by sharing available system resources (such as time, frequency and power). Examples of such multiple access systems include fourth generation (4G) systems (such as long term evolution (LTE) systems, advanced LTE (LTE-A) systems or LTE-A Pro systems) and fifth generation (5G) systems (which may be referred to as new radio (NR) systems). These systems may use techniques such as code division multiple access (CDMA), time division multiple access (TDMA), frequency division multiple access (FDMA), orthogonal FDMA (OFDMA) or discrete Fourier transform spread orthogonal frequency division multiplexing (DFT-S-OFDM). A wireless multiple access communication system may include one or more base stations (BS) or one or more network access nodes, each base station or network access node simultaneously supporting communication for multiple communication devices, which may be further referred to as user equipment (UE). Summary of the invention

[0003] The systems, methods and devices of the disclosure each have several innovative aspects, no single one of which is solely responsible for the desirable attributes disclosed herein.

[0004] One innovative aspect of the subject matter described in the present disclosure can be implemented in a method for wireless communication at a passive wireless device. The method may include: receiving a first message according to a first physical layer (PHY) security key, the first physical layer (PHY) security key protecting communication between a source device and the passive wireless device; and sending a second message via backscatter of the first message and according to a second PHY security key, the second PHY security key protecting communication between the passive wireless device and a reader device.

[0005] Another innovative aspect of the subject matter described in the present disclosure can be implemented in an apparatus for wireless communication at a passive wireless device. The apparatus may include an interface and a processing system. The interface may be configured to: obtain a first message based on a first PHY security key, the first PHY security key protecting communication between a source device and the passive wireless device; and output a second message via backscatter of the first message and based on a second PHY security key, the second PHY security key protecting communication between the passive wireless device and a reader device.

[0006] Another innovative aspect of the subject matter described in the present disclosure can be implemented in an apparatus for wireless communication at a passive wireless device. The apparatus may include: a processor; a memory coupled to the processor; and instructions stored in the memory. The instructions may be executable by the processor to cause the apparatus to perform the following operations: receive a first message according to a first PHY security key, the first PHY security key protecting communications between a source device and the passive wireless device; and send a second message via backscatter of the first message and according to a second PHY security key, the second PHY security key protecting communications between the passive wireless device and a reader device.

[0007] Another innovative aspect of the subject matter described in the present disclosure can be implemented in another apparatus for wireless communication at a passive wireless device. The apparatus may include: a means for receiving a first message according to a first PHY security key, the first PHY security key protecting communications between a source device and the passive wireless device; and a means for sending a second message via backscatter of the first message and according to a second PHY security key, the second PHY security key protecting communications between the passive wireless device and a reader device.

[0008] Another innovative aspect of the subject matter described in the present disclosure can be implemented in a non-transitory computer-readable medium storing code for wireless communication at a passive wireless device. The code can include instructions executable by a processor to perform the following operations: receiving a first message according to a first PHY security key that protects communications between a source device and the passive wireless device; and sending a second message via backscatter of the first message and according to a second PHY security key that protects communications between the passive wireless device and a reader device.

[0009] One innovative aspect of the subject matter described in the present disclosure can be implemented in a method for wireless communication at a reader device. The method can include: receiving a first message from a source device via a passive wireless device, the passive wireless device associated with backscatter of the first message; and decrypting the first message based on a PHY security key, the PHY security key protecting communications between the passive wireless device and the reader device.

[0010] Another innovative aspect of the subject matter described in the present disclosure can be implemented in an apparatus for wireless communication at a reader device. The apparatus may include an interface and a processing system. The interface may be configured to obtain a first message from a source device via a passive wireless device, the passive wireless device being associated with backscatter of the first message. The processing system may be configured to decrypt the first message based on a PHY security key, the PHY security key protecting communications between the passive wireless device and the reader device.

[0011] Another innovative aspect of the subject matter described in the present disclosure can be implemented in an apparatus for wireless communication at a reader device. The apparatus may include: a processor; a memory coupled to the processor; and instructions stored in the memory. The instructions may be executable by the processor to cause the apparatus to perform the following operations: receive a first message from a source device via a passive wireless device, the passive wireless device associated with backscatter of the first message; and decrypt the first message based on a PHY security key, the PHY security key protecting communications between the passive wireless device and the reader device.

[0012] Another innovative aspect of the subject matter described in the present disclosure can be implemented in another apparatus for wireless communication at a reader device. The apparatus may include: means for receiving a first message from a source device via a passive wireless device, the passive wireless device associated with backscatter of the first message; and means for decrypting the first message based on a PHY security key, the PHY security key protecting communications between the passive wireless device and the reader device.

[0013] Another innovative aspect of the subject matter described in the present disclosure can be implemented in a non-transitory computer-readable medium storing code for wireless communication at a reader device. The code can include instructions executable by a processor to: receive a first message from a source device via a passive wireless device associated with backscatter of the first message; and decrypt the first message based on a PHY security key that protects communications between the passive wireless device and the reader device.

[0014] One innovative aspect of the subject matter described in the present disclosure can be implemented in a method for wireless communication at a source device. The method can include: encrypting a first message based on a PHY security key, the PHY security key protecting communications between the source device and a passive wireless device; and sending the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0015] Another innovative aspect of the subject matter described in the present disclosure can be implemented in an apparatus for wireless communication at a source device. The apparatus may include an interface and a processing system. The processing system may be configured to: encrypt a first message according to a PHY security key, the PHY security key protecting communications between the source device and a passive wireless device. The interface may be configured to: output the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0016] Another innovative aspect of the subject matter described in the present disclosure can be implemented in an apparatus for wireless communication at a source device. The apparatus may include: a processor; a memory coupled to the processor; and instructions stored in the memory. The instructions may be executable by the processor to cause the apparatus to perform the following operations: encrypt a first message according to a PHY security key, the PHY security key protecting communications between the source device and a passive wireless device; and send the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0017] Another innovative aspect of the subject matter described in the present disclosure can be implemented in another apparatus for wireless communication at a source device. The apparatus may include: means for encrypting a first message based on a PHY security key, the PHY security key protecting communications between the source device and a passive wireless device; and means for sending the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscattering of the first message.

[0018] Another innovative aspect of the subject matter described in the present disclosure can be implemented in a non-transitory computer-readable medium storing code for wireless communication at a source device. The code can include instructions executable by a processor to: encrypt a first message according to a PHY security key that protects communications between the source device and a passive wireless device; and send the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0019] Details of one or more specific implementations of the subject matter described in the present disclosure are listed in the following drawings and description. Other features, aspects and advantages will become apparent from the description, drawings and claims. It should be noted that the relative sizes of the following drawings may not be drawn to scale. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 An example wireless communication system that supports physical layer (PHY) security for passive Internet of Things (IoT) devices is shown.

[0021] Figure 2 An example network architecture supporting PHY security for passive IoT devices is shown.

[0022] Figure 3 An example signaling diagram to support PHY security for passive IoT devices is shown.

[0023] Figure 4 An example key selection diagram is shown to support PHY security for passive IoT devices.

[0024] Figure 5 and Figure 6 An example communication timeline is shown to support PHY security for passive IoT devices.

[0025] Figure 7 An example process flow for supporting PHY security for passive IoT devices is shown.

[0026] Figure 8 and Fig. 9 A block diagram of an example device that supports PHY security for passive IoT devices is shown.

[0027] Figures 10 to 12 A flow chart illustrating an example method of supporting PHY security for passive IoT devices is shown.

[0028] Like reference numbers and designations in the various drawings indicate like elements. DETAILED DESCRIPTION

[0029] For the purpose of describing the innovative aspects of the present disclosure, the following description refers to some specific implementations. However, one of ordinary skill in the art will readily recognize that the teachings herein can be applied in a variety of different ways. The described specific implementations can be implemented in any device, system, or network capable of sending and receiving radio frequency (RF) signals in accordance with any one of the Institute of Electrical and Electronics Engineers (IEEE) 16.11 standards or any one of the following: IEEE 802.11 standards, Standard, Code Division Multiple Access (CDMA), Frequency Division Multiple Access (FDMA), Time Division Multiple Access (TDMA), Global System for Mobile Communications (GSM), GSM or General Packet Radio Service (GPRS), Enhanced Data GSM Environment (EDGE), Terrestrial Trunked Radio (TETRA), Wideband-CDMA (W-CDMA), Evolution-Data Optimized (EV-DO), 1xEV-DO, EV-DO Rev A, EV-DO RevB, High Speed ​​Packet Access (HSPA), High Speed ​​Downlink Packet Access (HSDPA), High Speed ​​Uplink Packet Access (HSUPA), Evolved High Speed ​​Packet Access (HSPA+), Long Term Evolution (LTE), AMPS, or other known signals for communicating within a wireless, cellular or IOT network, such as a system utilizing third generation (3G) technology, fourth generation (4G) technology, or fifth generation (5G) technology, or another specific implementation thereof.

[0030] In some wireless communication systems, a source device may send signaling to a reader device via a passive wireless device, which may be referred to or understood as a reflection device or a backscatter device. A wireless tag in an Internet of Things (IoT) deployment may be an example of such a passive wireless device. A passive wireless device may modulate information about the signaling received from a source device so that the reader device receives information from both the source device and the passive wireless device. For example, a passive wireless device may modulate information using signaling from a source device according to turning on reflection to send or transmit a first bit (such as a bit "1") and according to turning off reflection to send or transmit a second bit (such as a bit "0"). In some systems, communications between a source device and a passive wireless device and communications between a passive wireless device and a reader device may be unprotected, which may allow a malicious device to intercept the transmission of messages to or from a passive wireless device.

[0031] In some implementations, the source device, the reader device, and the passive wireless device may support one or more configuration-based or signaling-based mechanisms according to which the devices may implement physical layer (PHY) security for communications to and from the passive wireless device. For example, the source device may modulate or otherwise modify a first message using a first PHY security key, and may send the protected first message to the passive wireless device. The passive wireless device may remove the first PHY security key from the first message, and the passive wireless device may receive an indication of the first PHY security key or otherwise store the first PHY security key before receiving the first message. The passive wireless device may modulate or otherwise modify a second message using a second PHY security key, and send the second message to the reader device via a reflection technique or a backscatter technique. In addition, the source device and the reader device may support a third PHY security key that protects communications between the source device and the reader device, and the source device, the reader device, and the passive wireless device may support various mechanisms or procedures for selecting, receiving, identifying, ascertaining, obtaining, or otherwise determining which one or more PHY security keys are to be used to protect communications between the devices.

[0032] Specific implementations of the subject matter described in the present disclosure may be implemented to achieve one or more of the following potential advantages. For example, based on the use of PHY security keys to protect communications between source devices, reader devices, and passive wireless devices, these devices may achieve higher system security. Systems (such as IoT systems) involving the use of one or more passive wireless devices may also achieve or experience higher system-level security and increased resistance to attacks or data theft or protection from attacks or data theft, which may promote the deployment of such systems (because such systems meet more robust security constraints or guarantees). In other words, specific implementations of the subject matter described in the present disclosure may maintain the privacy and security of communications performed by or through passive wireless devices (such as RFID tags), and thus remedy security issues associated with systems that deploy passive wireless devices and promote greater adoption of passive wireless devices, which may increase data rates and system capacity in various networks. For example, systems involving protected passive wireless devices may provide relatively higher data rates, greater capacity, or otherwise perform enhanced operations compared to systems without protected passive wireless devices.

[0033] Figure 1An example wireless communication system 100 that supports PHY security for passive IoT devices is shown. The wireless communication system 100 may include one or more network entities 105, one or more UEs 115, and a core network 130. In some implementations, the wireless communication system 100 may be a Long Term Evolution (LTE) network, an Advanced LTE (LTE-A) network, an LTE-A Pro network, a New Radio (NR) network, or a network operating according to other systems and radio technologies (including future systems and radio technologies not explicitly mentioned herein).

[0034] The network entities 105 may be dispersed throughout a geographic area to form the wireless communication system 100 and may include devices in different forms or with different capabilities. In various examples, the network entities 105 may be referred to as network elements, mobility elements, radio access network (RAN) nodes, or network equipment, etc. In some implementations, the network entities 105 and the UEs 115 may communicate wirelessly via one or more communication links 125, such as radio frequency (RF) access links. For example, the network entities 105 may support a coverage area 110, such as a geographic coverage area, over which the UEs 115 and the network entities 105 may establish one or more communication links 125. The coverage area 110 may be an example of a geographic area over which the network entities 105 and the UEs 115 may support signal communications according to one or more radio access technologies (RATs).

[0035] The UEs 115 may be dispersed throughout the coverage area 110 of the wireless communication system 100, and each UE 115 may be stationary or mobile, or stationary and mobile at different times. The UEs 115 may be devices that take different forms or have different capabilities. Figure 1 Some example UEs 115 are illustrated in FIG. 1. The UEs 115 described herein may be able to communicate with various types of devices, such as Figure 1 105 or other UEs 115 or network entities 105 shown in FIG.

[0036] As described herein, a node of the wireless communication system 100 (which may be referred to as a network node or a wireless node) may be a network entity 105 (such as any network entity described herein), a UE 115 (such as any UE described herein), a network controller, an apparatus, a device, a computing system, one or more components, or another suitable processing entity configured to perform any of the techniques described herein. For example, the node may be a UE 115. As another example, the node may be a network entity 105. As another example, a first node may be configured to communicate with a second node or a third node. In one aspect of this example, the first node may be a UE 115, the second node may be a network entity 105, and the third node may be a UE 115. In another aspect of this example, the first node may be a UE 115, the second node may be a network entity 105, and the third node may be a network entity 105. In other aspects of this example, the first node, the second node, and the third node may be different relative to these examples. Similarly, references to UE 115, network entity 105, apparatus, device, computing system, etc. may include disclosure of UE 115, network entity 105, apparatus, device, computing system, etc. as nodes. For example, a disclosure that UE 115 is configured to receive information from network entity 105 also discloses that the first node is configured to receive information from a second node.

[0037] In some implementations, the network entities 105 may communicate with the core network 130, or with each other, or both. For example, the network entities 105 may communicate with the core network 130 via one or more backhaul communication links 120 (such as according to S1, N2, N3, or other interface protocols). In some implementations, the network entities 105 may communicate with each other on the backhaul communication links 120 (such as according to X2, Xn, or other interface protocols) directly (such as directly between the network entities 105) or indirectly (such as via the core network 130). In some implementations, the network entities 105 may communicate with each other via midhaul communication links 162 (such as according to a midhaul interface protocol) or fronthaul communication links 168 (such as according to a fronthaul interface protocol), or any combination thereof. The backhaul communication links 120, midhaul communication links 162, or fronthaul communication links 168 may be or include one or more wired links (such as electrical links, optical fiber links), one or more wireless links (such as radio links, wireless optical links), etc., or various combinations thereof. UE 115 may communicate with core network 130 via communication link 155 .

[0038] One or more of the network entities 105 described herein may include or may be referred to as a base station (BS) 140 (such as a transceiver base station, a radio BS, an NR BS, an access point, a radio transceiver, a Node B, an evolved Node B (eNB), a next-generation Node B, or a giga-Node B (any of which may be referred to as a gNB), a 5G NB, a next-generation eNB (ng-eNB), a home Node B, a home evolved Node B, or other suitable terms). In some specific implementations, the network entity 105 (such as BS 140) may be implemented in an aggregated (such as a monolithic, stand-alone) BS architecture, which may be configured to utilize a protocol stack physically or logically integrated within a single network entity 105 (such as a single RAN node, such as BS 140).

[0039] In some implementations, the network entity 105 may be implemented in a disaggregated architecture, such as a disaggregated base station architecture, a disaggregated RAN architecture, which may be configured to utilize a protocol stack physically or logically distributed between two or more network entities 105, such as an integrated access backhaul (IAB) network, an open RAN (O-RAN) such as a network configuration sponsored by the O-RAN Alliance, or a virtualized RAN (vRAN) such as a cloud RAN (C-RAN). For example, the network entity 105 may include one or more of the following: a central unit (CU) 160, a distributed unit (DU) 165, a radio unit (RU) 170, a RAN intelligent controller (RIC) 175 such as a near real-time RIC (near RT RIC), a non-real-time RIC (non-RT RIC), a service management and orchestration (SMO) 180 system, or any combination thereof. RU 170 may also be referred to as a radio head, a smart radio head, a remote radio head (RRH), a remote radio unit (RRU), or a transmit receive point (TRP). One or more components of the network entity 105 in the decomposed RAN architecture may be co-located, or one or more components of the network entity 105 may be located in distributed locations (such as separate physical locations). In some implementations, one or more network entities 105 of the decomposed RAN architecture may be implemented as virtual units (such as virtual CU (VCU), virtual DU (VDU), virtual RU (VRU)).

[0040] The functional split between CU 160, DU 165, and RU 170 is flexible and may support different functionalities, depending on which functions (such as network layer functions, protocol layer functions, baseband functions, RF functions, and any combination thereof) are performed at CU 160, DU 165, and RU 170. For example, a functional split of the protocol stack may be employed between CU 160 and DU 165, such that CU 160 may support one or more layers of the protocol stack, and DU 165 may support one or more different layers of the protocol stack. In some implementations, CU 160 may host higher protocol layer (such as layer 3 (L3), layer 2 (L2)) functionality and signaling (such as radio resource control (RRC), service data adaptation protocol (SDAP), packet data convergence protocol (PDCP)). The CU 160 may be connected to one or more DUs 165 or RUs 170, and the one or more DUs 165 or RUs 170 may host lower protocol layers, such as layer 1 (L1) (such as PHY) or L2 (such as radio link control (RLC) layer, medium access control (MAC) layer) functionality and signaling, and may each be at least partially controlled by the CU 160. Additionally or alternatively, a functional split of the protocol stack may be employed between the DU 165 and the RU 170, such that the DU 165 may support one or more layers of the protocol stack, and the RU 170 may support one or more different layers of the protocol stack. The DU 165 may support one or more different cells (such as via one or more RUs 170). In some implementations, the functional split between CU 160 and DU 165 or between DU 165 and RU 170 may be within the protocol layer (such as some functions of the protocol layer may be performed by one of CU 160, DU 165, or RU 170, while other functions of the protocol layer are performed by a different one of CU 160, DU 165, or RU 170). CU 160 may be further functionally split into CU control plane (CU-CP) and CU user plane (CU-UP) functions. CU 160 may be connected to one or more DUs 165 via midhaul communication links 162 (such as F1, F1-c, F1-u), and DU 165 may be connected to one or more RUs 170 via fronthaul communication links 168 (such as an open fronthaul (FH) interface). In some implementations, the midhaul communication link 162 or the fronthaul communication link 168 may be implemented based on an interface (such as a channel) between layers of a protocol stack supported by respective network entities 105 that communicate over such communication links.

[0041] In some wireless communication systems (such as wireless communication system 100), infrastructure and spectrum resources for radio access may support wireless backhaul link capabilities to supplement wired backhaul connections, thereby providing an IAB network architecture (such as to core network 130). In some specific implementations, in an IAB network, one or more network entities 105 (such as IAB nodes 104) may be partially controlled by each other. One or more IAB nodes 104 may be referred to as donor entities or IAB donors. One or more DUs 165 or one or more RUs 170 may be partially controlled by one or more CUs 160 associated with a donor network entity 105 (such as donor BS 140). One or more donor network entities 105 (such as IAB donors) may communicate with one or more additional network entities 105 (such as IAB nodes 104) via supported access and backhaul links (such as backhaul communication links 120). IAB nodes 104 may include IAB mobile terminations (IAB-MTs) controlled (such as scheduling) by DUs 165 of coupled IAB donors. The IAB-MT may include an independent antenna group for relaying communications with the UE 115, or may share the same antenna of the IAB node 104 (such as the RU 170) for access via the DU 165 of the IAB node 104 (such as referred to as a virtual IAB-MT (vIAB-MT)). In some implementations, the IAB node 104 may include a DU 165 that supports communication links with additional entities (such as the IAB node 104, UE 115) within a relay chain or configuration (such as downstream) of the access network. In such implementations, one or more components of the decomposed RAN architecture (such as one or more IAB nodes 104 or components of the IAB node 104) may be configured to operate according to the techniques described herein.

[0042] For example, an access network (AN) or RAN may include communications between an access node (such as an IAB donor), an IAB node 104, and one or more UEs 115. The IAB donor may facilitate a connection between the core network 130 and the AN (such as via a wired or wireless connection to the core network 130). That is, the IAB donor may refer to a RAN node having a wired or wireless connection to the core network 130. The IAB donor may include a CU 160 and at least one DU 165 (such as and RU 170), and in this specific implementation, the CU 160 may communicate with the core network 130 via an interface (such as a backhaul link). The IAB donor and the IAB node 104 may communicate over an F1 interface according to a protocol that defines signaling messages (such as an F1 AP protocol). Additionally or alternatively, CU 160 may communicate with the core network via an interface (which may be an example of part of a backhaul link) and may communicate with other CUs 160 (such as CU 160 associated with an alternative IAB donor) via an Xn-C interface (which may be an example of part of a backhaul link).

[0043] An IAB node 104 may refer to a RAN node that provides IAB functionality, such as access, wireless self-backhaul capabilities for UE 115. DU 165 may act as a distributed scheduling node toward child nodes associated with IAB node 104, and IAB-MT may act as a scheduled node toward a parent node associated with IAB node 104. That is, an IAB donor may be referred to as a parent node that communicates with one or more child nodes (such as an IAB donor may relay transmissions for UEs through one or more other IAB nodes 104). Additionally or alternatively, depending on the relay chain or configuration of the AN, an IAB node 104 may also be referred to as a parent node or child node of other IAB nodes 104. Thus, the IAB-MT entity of IAB node 104 may provide a Uu interface for child IAB node 104 to receive signaling from parent IAB node 104 , and a DU interface such as DU 165 may provide a Uu interface for parent IAB node 104 to signal to child IAB node 104 or UE 115 .

[0044] For example, the IAB node 104 may be referred to as a parent node supporting child IAB node communications and as a child node associated with the IAB donor. The IAB donor may include a CU 160 having a wired or wireless connection to the core network 130 (such as a backhaul communication link 120) and may act as a parent node of the IAB node 104. For example, the DU 165 of the IAB donor may relay transmissions to the UE 115 through the IAB node 104 and may directly signal the transmission to the UE 115. The CU 160 of the IAB donor may signal the establishment of a communication link to the IAB node 104 via the F1 interface, and the IAB node 104 may schedule transmissions (such as transmissions relayed from the IAB donor to the UE 115) through the DU 165. That is, data may be relayed to and from the IAB node 104 via signaling on the NR Uu interface of the MT to the IAB node 104. Communications with the IAB node 104 may be scheduled by the DU 165 of the IAB donor, and communications with the IAB node 104 may be scheduled by the DU 165 of the IAB node 104 .

[0045] In a specific implementation where the techniques described herein are applied to the context of a decomposed RAN architecture, one or more components of the decomposed RAN architecture may be configured to support PHY security for passive IoT devices as described herein. For example, some operations described as being performed by UE 115 or network entity 105 (such as BS 140) may be additionally or alternatively performed by one or more components of the decomposed RAN architecture (such as IAB node 104, DU 165, CU 160, RU 170, RIC 175, SMO 180).

[0046] UE 115 may include or may be referred to as a mobile device, a wireless device, a remote device, a handheld device, or a subscriber device, or some other suitable terminology, where a "device" may also be referred to as a unit, a station, a terminal, or a client, etc. UE 115 may also include or may be referred to as a personal electronic device, such as a cellular phone, a personal digital assistant (PDA), a tablet computer, a laptop computer, or a personal computer. In some specific implementations, UE 115 may include or be referred to as a wireless local loop (WLL) station, an IoT device, an Internet of Everything (IoE) device, or a machine type communication (MTC) device, etc., which may be implemented in various items such as appliances, or vehicles, meters, etc.

[0047] The UE 115 described herein may be capable of communicating with various types of devices, such as other UEs 115, which may sometimes act as relays, as well as network entities 105 and network equipment (including macro eNBs or gNBs, small cell eNBs or gNBs, or relay BSs, etc.), such as Figure 1 shown.

[0048] The UE 115 and the network entity 105 may communicate wirelessly with each other via one or more communication links 125 (such as access links) on one or more carriers. The term "carrier" may refer to a set of RF spectrum resources with a defined PHY structure to support the communication link 125. For example, a carrier for the communication link 125 may include a portion of an RF spectrum band (such as a bandwidth portion (BWP)) that operates according to one or more PHY channels for a given radio access technology (such as LTE, LTE-A, LTE-APro, NR). Each PHY channel may carry acquisition signaling (such as synchronization signals, system information), control signaling to coordinate operations for the carrier, user data, or other signaling. The wireless communication system 100 may support communications with the UE 115 using carrier aggregation or multi-carrier operation. Depending on the carrier aggregation configuration, the UE 115 may be configured to have multiple downlink component carriers and one or more uplink component carriers. Carrier aggregation may be used with both frequency division duplex (FDD) and time division duplex (TDD) component carriers. Communication between the network entity 105 and other devices may refer to communication between these devices and any part (such as an entity, a sub-entity) of the network entity 105. For example, the terms "send", "receive" or "communicate" when referring to the network entity 105 may refer to any part of the network entity 105 (such as BS 140, CU 160, DU 165, RU 170) of the RAN communicating with another device (such as directly or via one or more other network entities 105).

[0049] The signal waveform transmitted on the carrier may be composed of multiple subcarriers (such as using a multi-carrier modulation (MCM) technique, such as orthogonal frequency division multiplexing (OFDM) or discrete Fourier transform spread OFDM (DFT-S-OFDM)). In a system using MCM technology, a resource element may refer to a symbol period (such as the duration of a modulation symbol) and a subcarrier resource, and in this specific implementation, the symbol period and the subcarrier spacing may be inversely related. The number of bits carried by each resource element may depend on the modulation scheme (such as the order of the modulation scheme, the decoding rate of the modulation scheme, or both), so that the more resource elements a device receives and the higher the order of the modulation scheme, the higher the data rate for the device may be. Wireless communication resources may refer to a combination of RF spectrum resources, time resources, and spatial resources (such as spatial layers or beams), and the use of multiple spatial resources may increase the data rate or data integrity used for communication with UE 115.

[0050] The time interval for the network entity 105 or the UE 115 may be expressed in multiples of a basic time unit, which may be referred to as a sampling period T s=1 / (Δf max ·N f ) seconds, where Δf max It can represent the maximum supported subcarrier spacing, and N f The maximum supported discrete Fourier transform (DFT) size may be indicated. The time intervals of the communication resources may be organized according to radio frames each having a specific duration, such as 10 milliseconds (ms). Each radio frame may be identified by a system frame number (SFN), such as in the range of 0 to 1023.

[0051] Each frame may include a plurality of consecutively numbered subframes or time slots, and each subframe or time slot may have the same duration. In some implementations, a frame may be divided into subframes (such as in the time domain), and each subframe may be further divided into a certain number of time slots. Alternatively, each frame may include a variable number of time slots, and the number of time slots may depend on the subcarrier spacing. Each time slot may include a certain number of symbol periods (such as depending on the length of a cyclic prefix added in front of each symbol period). In some wireless communication systems 100, a time slot may be further divided into a plurality of mini-time slots containing one or more symbols. Excluding the cyclic prefix, each symbol period may contain one or more (such as N f The duration of a symbol period may depend on the subcarrier spacing or the operating frequency band.

[0052] A subframe, slot, mini-slot, or symbol may be the smallest scheduling unit of the wireless communication system 100 (such as in the time domain), and may be referred to as a transmission time interval (TTI). In some implementations, the TTI duration (such as a certain amount of symbol periods in a TTI) may be variable. Additionally or alternatively, the smallest scheduling unit of the wireless communication system 100 may be dynamically selected (such as in bursts of shortened TTIs (sTTIs)).

[0053] Physical channels may be multiplexed on a carrier according to various techniques. For example, physical control channels and physical data channels may be multiplexed on a downlink carrier using one or more of a time division multiplexing (TDM) technique, a frequency division multiplexing (FDM) technique, or a hybrid TDM-FDM technique. A control region for a physical control channel, such as a control resource set (CORESET), may be defined by a set of symbol periods and may extend across a system bandwidth or a subgroup of a system bandwidth of a carrier. One or more control regions, such as CORESETs, may be configured for a group of UEs 115. For example, one or more of the UEs 115 may monitor or search the control region for control information according to one or more search space sets, and each search space set may include one or more control channel candidates in one or more aggregation levels arranged in a cascaded manner. The aggregation level of the control channel candidates may refer to the number of control channel resources, such as control channel elements (CCEs), associated with the coding information for a control information format having a given payload size. The search space sets may include a common search space set configured for transmitting control information to a plurality of UEs 115 , and a UE-specific search space set for transmitting control information to a specific UE 115 .

[0054] In some implementations, the network entities 105 (such as BS 140, RU 170) can be mobile and thus provide communication coverage for mobile coverage areas 110. In some implementations, different coverage areas 110 associated with different technologies can overlap, but can be supported by the same network entity 105. In some other examples, overlapping coverage areas 110 associated with different technologies can be supported by different network entities 105. The wireless communication system 100 can include, for example, a heterogeneous network in which different types of network entities 105 provide coverage for various coverage areas 110 using the same or different radio access technologies.

[0055] Some UEs 115, such as MTC or IoT devices, may be low-cost or low-complexity devices and may provide automated communication between machines, such as via machine-to-machine (M2M) communication. M2M communication or MTC may refer to data communication technology that allows devices to communicate with each other or with a network entity 105, such as BS 140, without human intervention. In some implementations, M2M communication or MTC may include communication from devices that integrate sensors or meters to measure or capture information and relay such information to a central server or application that utilizes the information or presents the information to a person interacting with the application. Some UEs 115 may be designed to collect information or implement automated behavior of machines or other devices. Examples of applications for MTC devices include: smart metering, inventory monitoring, water level monitoring, equipment monitoring, health care monitoring, field survival monitoring, weather and geographic event monitoring, fleet management and tracking, remote security sensing, physical access control, and transaction-based commercial charging.

[0056] The wireless communication system 100 may be configured to support ultra-reliable communication or low-latency communication or various combinations thereof. For example, the wireless communication system 100 may be configured to support ultra-reliable low-latency communication (URLLC). UE 115 may be designed to support ultra-reliable, low-latency or critical functions. Ultra-reliable communication may include private communication or group communication, and may be supported by one or more services (such as push-to-talk, video or data). Support for ultra-reliable, low-latency functions may include prioritization of services, and such services may be used for public safety or general commercial applications. The terms ultra-reliable, low-latency and ultra-reliable low-latency are used interchangeably herein.

[0057] In some implementations, a UE 115 may be able to communicate directly with other UEs 115 over a device-to-device (D2D) communication link 135, such as according to a peer-to-peer (P2P), D2D, or sidelink protocol. In some implementations, one or more UEs 115 in a group that are performing D2D communications may be within a coverage area 110 of a network entity 105, such as a BS 140, a RU 170, which may support aspects of such D2D communications being configured or scheduled by the network entity 105. In some implementations, one or more UEs 115 in such a group may be outside of the coverage area 110 of the network entity 105, or may otherwise be unable or not configured to receive transmissions from the network entity 105. In some implementations, a group of UEs 115 communicating via D2D communications may support a one-to-many (1:M) system in which each UE 115 transmits to each of the other UEs 115 in the group. In some implementations, the network entity 105 may facilitate scheduling resources for D2D communications. In some other examples, D2D communications may be performed between UEs 115 without involving the network entity 105.

[0058] In some systems, the D2D communication link 135 may be an example of a communication channel (such as a sidelink communication channel) between vehicles (such as UE 115). In some implementations, the vehicles may communicate using vehicle-to-everything (V2X) communication, vehicle-to-vehicle (V2V) communication, or some combination of these. The vehicles may signal information related to traffic conditions, signal scheduling, weather, safety, emergency situations, or any other information related to the V2X system. In some implementations, the vehicles in the V2X system may communicate with roadside infrastructure (such as roadside units), or communicate with the network via one or more network nodes (such as network entity 105, base station 140, RU 170) using vehicle-to-network (V2N) communication, or both.

[0059] The core network 130 may provide user authentication, access authorization, tracking, Internet Protocol (IP) connectivity, and other access, routing, or mobility functions. The core network 130 may be an evolved packet core (EPC) or a 5G core (5GC), which may include at least one control plane entity (such as a mobility management entity (MME), an access and mobility management function (AMF)) for managing access and mobility, and at least one user plane entity (such as a serving gateway (S-GW), a packet data network (PDN) gateway (P-GW), or a user plane function (UPF)) for routing packets or interconnecting to an external network. The control plane entity may manage non-access stratum (NAS) functions, such as mobility, authentication, and bearer management of UE 115 served by a network entity 105 (such as a BS 140) associated with the core network 130. User IP packets may be delivered through a user plane entity, which may provide IP address allocation and other functions. The user plane entity may be connected to an IP service 150 for one or more network operators. IP services 150 may include access to the Internet, an intranet, an IP Multimedia Subsystem (IMS), or packet-switched streaming services.

[0060] The wireless communication system 100 may operate using one or more frequency bands that may be in the range of 300 megahertz (MHz) to 300 gigahertz (GHz). Typically, the region from 300 MHz to 3 GHz is referred to as the ultra-high frequency (UHF) region or decimeter band because the wavelength range length is about one decimeter to one meter. UHF waves may be blocked or redirected by buildings and environmental features, and these waves may be referred to as clusters, but these waves may be sufficient to penetrate structures so that macro cells provide services to UEs 115 located indoors. Transmission of UHF waves may be associated with smaller antennas and shorter distances (such as less than 100 kilometers) compared to transmission using smaller frequencies and longer waves in the high frequency (HF) or very high frequency (VHF) portion of the spectrum below 300 MHz.

[0061] The wireless communication system 100 may also operate in a super high frequency (SHF) zone using a frequency band from 3 GHz to 30 GHz (also referred to as a centimeter band) or in an extremely high frequency (EHF) zone of the spectrum (such as from 30 GHz to 300 GHz) (also referred to as a millimeter band). In some specific implementations, the wireless communication system 100 may support millimeter wave (mmW) communications between UE 115 and network entity 105 (such as BS140, RU170), and the EHF antenna of the corresponding device may be smaller and closer than the UHF antenna. In some specific implementations, this may facilitate the use of antenna arrays within the device. However, the propagation of EHF transmissions may be affected by atmospheric attenuation and a shorter range than SHF or UHF transmissions. The technology disclosed herein may be adopted across transmissions using one or more different frequency zones, and the use of frequency bands specified across these frequency zones may differ by country or regulatory agency.

[0062] The wireless communication system 100 may utilize both licensed RF spectrum bands and unlicensed RF spectrum bands. For example, the wireless communication system 100 may employ licensed assisted access (LAA), LTE unlicensed (LTE-U) radio access technology, or NR technology in unlicensed bands such as the 5 GHz industrial, scientific, and medical (ISM) band. When operating in an unlicensed RF spectrum band, devices such as the network entity 105 and the UE 115 may employ carrier sensing for conflict detection and avoidance. In some specific implementations, operations in unlicensed bands may be associated with a carrier aggregation configuration (such as LAA) in conjunction with component carriers operating in licensed bands. Operations in unlicensed spectrum may include downlink transmissions, uplink transmissions, P2P transmissions, or D2D transmissions, and the like.

[0063] The network entity 105 (such as BS 140, RU 170) or UE 115 may be equipped with multiple antennas that can be used to employ technologies such as transmit diversity, receive diversity, multiple-input multiple-output (MIMO) communication or beamforming. The antennas of the network entity 105 or UE 115 may be located in one or more antenna arrays or antenna panels that can support MIMO operations or transmit or receive beamforming. For example, one or more BS antennas or antenna arrays may be co-located at an antenna assembly (such as an antenna tower). In some specific implementations, the antennas or antenna arrays associated with the network entity 105 may be located at different geographical locations. The network entity 105 may have an antenna array having a set of rows and columns of antenna ports that the network entity 105 can use to support beamforming for communication with the UE 115. Similarly, the UE 115 may have one or more antenna arrays that can support various MIMO or beamforming operations. Additionally or alternatively, the antenna panel may support RF beamforming for signals sent via the antenna ports.

[0064] Beamforming (which may also be referred to as spatial filtering, directional transmission, or directional reception) is a signal processing technique that may be used at a transmitting device or a receiving device (such as a network entity 105, a UE 115) to form or direct an antenna beam (such as a transmit beam, a receive beam) along a spatial path between the transmitting device and the receiving device. Beamforming may be achieved by combining signals conveyed via antenna elements of an antenna array so that some signals propagating at a particular orientation relative to the antenna array experience constructive interference, while other signals experience destructive interference. Adjustments to signals conveyed via antenna elements may include the transmitting device or the receiving device applying an amplitude offset, a phase offset, or both to signals carried via antenna elements associated with the device. Adjustments associated with each of the antenna elements may be defined by a set of beamforming weights associated with a particular orientation (such as relative to the antenna array of the transmitting device or the receiving device, or relative to some other orientation).

[0065] The wireless communication system 100 may be a packet-based network that operates according to a layered protocol stack. In the user plane, communications at the bearer or PDCP layer may be IP-based. The RLC layer may perform packet segmentation and reassembly to communicate on a logical channel. The MAC layer may perform priority processing and multiplexing of logical channels to transport channels. The MAC layer may also use error detection techniques, error correction techniques, or both to support retransmission of the MAC layer to improve link efficiency. In the control plane, the RRC protocol layer may provide the establishment, configuration, and maintenance of an RRC connection that supports a radio bearer for user plane data between a UE 115 and a network entity 105 or a core network 130. At the PHY, a transport channel may be mapped to a physical channel.

[0066] In some specific implementations, by Figure 1 Examples and references Figure 1 The various devices described may support one or more configuration-based or signaling-based mechanisms to protect communications involving passive wireless devices in the PHY. For example, a source device and a reader device (each of which may be an example of a UE 115 or a network entity 105) may communicate via a passive wireless device according to a passive wireless device that reflects communications from the source device to the reader device. In addition, the passive wireless device may convey additional information (such as information in addition to the information sent by the source device) to the reader device according to a backscatter modulation technique. As described herein, information or signaling sent by a source device may be referred to or understood as a first message, and information or signaling conveyed by a passive wireless device may be referred to or understood as a second message.

[0067] Thus, according to example implementations described herein, a source device may encrypt a first message according to a first PHY security key and send the encrypted first message to a passive wireless device. The passive wireless device may receive the encrypted first message, decrypt the first message according to the first PHY security key, encrypt a second message according to a second PHY security key, and send the encrypted second message. The reader device may decrypt the second message according to the second PHY security key to obtain information signaled from the source device and the passive wireless device.

[0068] Figure 2An example network architecture 200 (such as a disaggregated base station architecture, a disaggregated RAN architecture) that supports PHY security for passive IoT devices is shown. The network architecture 200 may illustrate an example for implementing one or more aspects of the wireless communication system 100. The network architecture 200 may include one or more CUs 160-a, which may communicate directly with the core network 130-a via a backhaul communication link 120-a, or indirectly with the core network 130-a through one or more disaggregated network entities 105 (such as a near-RT RIC 175-b via an E2 link, or a non-RT RIC 175-a associated with an SMO 180-a (such as an SMO framework), or both. The CU 160-a may communicate with one or more DUs 165-a via corresponding midhaul communication links 162-a (such as an F1 interface). The DU 165-a may communicate with one or more RUs 170-a via corresponding fronthaul communication links 168-a. The RUs 170-a may be associated with respective coverage areas 110-a and may communicate with the UEs 115-a via one or more communication links 125-a. In some implementations, the UEs 115-a may be served by multiple RUs 170-a simultaneously.

[0069] Each of the network entities 105 of the network architecture 200 (such as CU 160-a, DU 165-a, RU 170-a, non-RT RIC 175-a, near-RT RIC 175-b, SMO 180-a, open cloud (O-Cloud) 205, open eNB (O-eNB) 210) may include one or more interfaces or may be coupled to one or more interfaces configured to receive or send signals (such as data, information) via a wired or wireless transmission medium. Each network entity 105 or an associated processor (such as a controller) that provides instructions to the interface of the network entity 105 may be configured to communicate with one or more of the other network entities 105 via the transmission medium. For example, the network entity 105 may include a wired interface that is configured to receive a signal on a wired transmission medium or to send a signal to one or more of the other network entities 105 on a wired transmission medium. Additionally or alternatively, the network entity 105 may include a wireless interface, which may include a receiver, transmitter, or transceiver (such as an RF transceiver) configured to receive signals on a wireless transmission medium, or to send signals to one or more of the other network entities 105 on the wireless transmission medium, or both.

[0070] In some specific implementations, CU 160-a may host one or more higher layer control functions. Such control functions may include RRC, PDCP, SDAP, etc. Each control function may be implemented using an interface that is configured to communicate signals with other control functions hosted by CU 160-a. CU 160-a may be configured to handle user plane functionality (such as CU-UP), control plane functionality (such as CU-CP), or a combination thereof. In some specific implementations, CU 160-a may be logically split into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RAN configuration, the CU-UP unit may communicate bidirectionally with the CU-CP unit via an interface (such as an E1 interface). As needed, CU 160-a may be implemented to communicate with DU 165-a for network control and signaling.

[0071] DU 165-a may correspond to a logical unit that includes one or more functions (such as base station functions, RAN functions) for controlling the operation of one or more RUs 170-a. In some implementations, DU 165-a may at least partially host one or more of one or more aspects of an RLC layer, a MAC layer, and a PHY (such as a high PHY, such as modules for FEC encoding and decoding, scrambling, modulation and demodulation, etc.), which depends at least in part on functional splits, such as those defined by the Third Generation Partnership Project (3GPP). In some implementations, DU 165-a may also host one or more low PHYs. Each layer may be implemented using an interface that is configured to communicate signals with other layers hosted by DU 165-a or with control functions hosted by CU 160-a.

[0072] In some implementations, lower layer functionality may be implemented by one or more RUs 170-a. For example, a RU 170-a controlled by a DU 165-a may correspond to a logical node that hosts RF processing functions or low PHY functions (such as performing fast Fourier transform (FFT), inverse FFT (iFFT), digital beamforming, or physical random access channel (PRACH) extraction and filtering, etc.) or both based at least in part on a functional split (such as a lower layer functional split). In such an architecture, the RU 170-a may be implemented to handle over-the-air (OTA) communications with one or more UEs 115-a. In some implementations, real-time and non-real-time aspects of control plane communications and user plane communications with the RU 170-a may be controlled by the corresponding DU 165-a. In some implementations, such a configuration may enable the DU 165-a and CU 160-a to be implemented in a cloud-based RAN architecture (such as a vRAN architecture).

[0073] The SMO 180-a may be configured to support RAN deployment and provisioning of non-virtualized and virtualized network entities 105. For non-virtualized network entities 105, the SMO 180-a may be configured to support the deployment of dedicated physical resources for RAN coverage requirements, which may be managed via an operation and maintenance interface (such as an O1 interface). For virtualized network entities 105, the SMO 180-a may be configured to interact with a cloud computing platform (such as O-Cloud 205) via a cloud computing platform interface (such as an O2 interface) to perform network entity lifecycle management (such as to instantiate virtualized network entities 105). Such virtualized network entities 105 may include, but are not limited to, CU 160-a, DU 165-a, RU 170-a, and near-RT RIC 175-b. In some specific implementations, the SMO 180-a may communicate (such as via an O1 interface) with components configured according to a 4G RAN. Additionally or alternatively, in some implementations, the SMO 180-a may communicate directly with one or more RUs 170-a via an O1 interface. The SMO 180-a may also include a non-RT RIC 175-a configured to support the functionality of the SMO 180-a.

[0074] The non-RT RIC 175-a may be configured to include logic functions that implement non-real-time control and optimization of RAN elements and resources, artificial intelligence (AI) or machine learning (ML) workflows including model training and updating, or policy-based guidance of applications / features in the near-RT RIC 175-b. The non-RT RIC 175-a may be coupled or communicate with the near-RT RIC 175-b (such as via an A1 interface). The near-RT RIC 175-b may be configured to include logic functions that implement near-real-time control and optimization of RAN elements and resources through data collection and actions via an interface connecting one or more CUs 160-a, one or more DUs 165-a, or both, and the O-eNB 210 to the near-RT RIC 175-b (such as via an E2 interface).

[0075] In some implementations, in order to generate an AI / ML model to be deployed in the near-RT RIC 175-b, the non-RT RIC 175-a may receive parameters or external enrichment information from an external server. Such information may be utilized by the near-RT RIC 175-b and may be received from a non-network data source or from a network function at the SMO 180-a or the non-RT RIC 175. In some implementations, the non-RT RIC 175-a or the near-RT RIC 175-b may be configured to tune RAN behavior or performance. For example, the non-RT RIC 175-a may monitor long-term trends and patterns of performance and employ an AI model or ML model to perform corrective actions through the SMO 180-a (such as via reconfiguration of O1) or via the generation of a RAN management policy (such as an A1 policy).

[0076] In some implementations, one or more devices, entities, or functionalities associated with the network architecture 200 may support one or more configuration-based or signaling-based mechanisms to protect communications involving passive wireless devices in the PHY. For example, a source device and a reader device (each of which may be an example of a UE 115 or a network entity 105) may communicate via a passive wireless device according to a passive wireless device that reflects communications from the source device to the reader device. In some aspects, such a passive wireless device may be an example of a UE 115 (with reduced capability (RedCap) or non-RedCap) that deploys a radio frequency identification (RFID) tag module or radio component, and the UE 115 may use the RFID tag module or radio component if in a power saving state (such as if the battery power of the UE 115 drops below a threshold battery power) or if performing low-power communications (such as transmitting using a transmit power less than a threshold transmit power). In other words, UE 115 may be an RFID device, a device using a low complexity receiver, or a device equipped with an RFID tag radio, and any of such devices may be an example of a passive wireless device. A passive wireless device may convey additional information (such as information in addition to the information sent by the source device) to a reader device based on a backscatter modulation technique.

[0077] As described herein, information or signaling sent by a source device may be referred to or understood as a first message, and information or signaling conveyed by a passive wireless device may be referred to or understood as a second message. The first message may be associated with a signal x(n) (such as conveyed via a signal), and the second message may be associated with a signal s(n)x(n) (such as conveyed via a signal). Thus, in some implementations, the source device may encrypt the first message based on modulating or otherwise modifying x(n) using a first PHY security key SK1(n). The passive wireless device may receive the encrypted SK1(n)x(n) and send the backscattered signal to the reader device based on a second PHY security key SK2(n). For example, the passive wireless device may reflect, relay, or send a signal SK2(n)s(n)x(n) to the reader device. The reader device may therefore decrypt the signaling based on the second PHY security key SK2(n) and obtain information associated with or conveyed by s(n) and x(n). In this way, the source device, the reader device, and the passive wireless device may exchange signaling in a protected manner.

[0078] Figure 3 An example signaling diagram 300 is shown to support PHY security for passive IoT devices. The signaling diagram 300 can implement or be implemented to implement aspects of the wireless communication system 100 or the network architecture 200. For example, the signaling diagram 300 illustrates communications between a source device 305 (such as a radio frequency source device), a reader device 310, and a passive wireless device 315 (which can be an example of a tag such as an IoT tag). In some implementations, the source device 305, the reader device 310, and the passive wireless device 315 can use one or more PHY security keys to protect communications between devices in the PHY.

[0079] In some aspects, the passive wireless device 315 can be an example of a passive IoT device and can employ energy harvesting and backscatter communications to communicate with one or both of the source device 305 and the reader device 310. For example, the passive wireless device 315 can support energy harvesting enabled communication services (EHECS) in a 5G system (5GS), and as such can be a battery-free device or a device that otherwise has limited energy storage (such as a capacitor). The passive wireless device 315 can be a low-level device, such as a device level similar to an RFID device, a RedCap device, or an enhanced RedCap (eRedCap) device.

[0080] Alternatively, the passive wireless device 315 may not be a RedCap device, and the described techniques may be applicable to non-RedCap implementations. For example, the passive wireless device 315 may be a cell phone, a laptop, a smart watch, smart jewelry, a robot, a manufacturing component, a vehicle, an IoT tag, an antenna panel, a repeater, one or more patch antennas, a smart reflective surface (RIS), an IoT device, a narrowband (NB)-IoT device, an RFID device, a UE 115 (such as a UE 115 equipped with an RFID tag module or radio component), a low complexity receiver or an industrial IoT device (IIoT), etc., which are associated with IoT applications or are capable of relaying or reflecting communications between the source device 305 and the reader device 310. In addition to or as an alternative to a passive IoT based on backscatter communication (where a battery-free device can harvest energy from ambient radio frequency signaling and use the harvested energy to redirect the signaling (such as an RFID tag)), the passive wireless device 315 can use energy harvesting to power components of the passive wireless device 315 (such as an analog-to-digital converter (ADC), a mixer, or one or more oscillators).

[0081] The passive wireless device 315 may support identification, tracking, power supply, access control or connectivity management, or location specific implementations, etc. In some 5G deployment scenarios, the passive wireless device may support or be associated with one or more constraints on data rate, power consumption, and density, and may support one or more procedures or technologies associated with onboarding (such as connection establishment), provisioning (such as connection management), and decommissioning (such as connection cancellation establishment) of the passive wireless device. In addition, the passive wireless device 315 may support one or more procedures or technologies associated with identification, authentication and authorization, access control, mobility management, security, and other communication mechanisms.

[0082] In an example where the passive wireless device 315 supports energy harvesting, the passive wireless device 315 may opportunistically harvest energy in the environment to charge a battery or otherwise obtain power to perform one or more operations (such as decoding, decryption, encryption, encoding, signal generation, or transmission). For example, the passive wireless device 315 may harvest or otherwise obtain energy from solar energy, thermal energy, or ambient radio frequency radiation, or any combination thereof, and store the harvested energy in a rechargeable battery. In some aspects, the passive wireless device 315 may support energy harvesting techniques to support operation on intermittently available energy harvested from the environment, because changes in the amount of harvested energy are expected. For example, a passive wireless device 315 (such as a NB-IOT device or an RFID device) may use energy harvested from solar energy to support one or more operations. In addition, changes in the amount of traffic (such as data traffic or communication traffic) are expected. As such, if operating on intermittently available energy harvested from the environment, the passive wireless device 315 may not (or at least may not be expected to) maintain relatively long continuous reception or transmission.

[0083] The passive wireless device 315 may reflect, relay, or backscatter communications from the source device 305 to the reader device 310, and in some aspects, may convey additional information (information other than that conveyed by the source device 305) to the reader device 310 via the reflected, relayed, or backscattered signals. For example, the passive wireless device 315 may receive a signal from the source device 305 and may modulate the additional information onto the signal according to an information modulation method. In some implementations, the information modulation method employed by the passive wireless device 315 (backscatter device) may be amplitude shift keying (ASK), according to which the passive wireless device 315 may turn on reflection when transmitting an information bit "1" and may turn off reflection when transmitting an information bit "0".

[0084] For example, source device 305 may transmit a radio wave denoted as x(n), and passive wireless device 315 may transmit information bits of s(n)∈{0,1}. As such, the signal received at reader device 310 may be defined by Equation 1 shown below.

[0085] y(n)=(h D1D2 (n)+σ f h D1T (n)h TD2 (n)s(n))x(n)+noise(1)

[0086] As shown in Formula 1, h D1D2 (n) may represent a channel 320 between the source device 305 and the reader device 310, σ f The reflection coefficient of the passive wireless device 315, hD1T (n) may represent a channel 325 between the source device 305 and the passive wireless device 315, h TD2 y(n) may represent the channel 330 between the passive wireless device 315 and the reader device 310, and noise may represent any channel noise that affects the signaling from the source device 305 to the reader device 310. Thus, if s(n)=0, reflections may be turned off at the passive wireless device 315, and the reader device 310 may receive a direct link signal from the source device 305 (and may not receive any reflected signals from the passive wireless device 315). In such a scenario where s(n)=0, y(n)=h D1D2 (n) x (n) + noise. In addition, if s(n) = 1, reflection can be turned on at the passive wireless device 315, and the reader device 310 can receive a superposition of both the direct link signal and the backscatter link signal, as shown in Equation 1.

[0087] In some wireless communication systems, secure communications may be critical to the successful application and practical use of wireless communications. In addition, IoT deployments may make security more critical because many devices may be connected to each other. However, in some systems, passive IoT communications may lack security outside of start and end commands, which are transmitted using passwords dedicated to or specific to the passive wireless device 315 (tag). Such passwords may be pre-configured at the wireless device 315, loaded at the passive wireless device 315 (such as in hardware or software), or configured or reconfigured at the passive wireless device 315 via L1, L2, or L3 signaling. For example, a passive IoT tag may only perform envelope detection to detect data (such as commands from a source device 305, which may be a gNB or other network entity 105 or network element), and tag communications may otherwise be unprotected in any layer. As such, signaling outside of the start and end commands may lack security, which may make the signaling vulnerable to sniffing, theft, interception, or other attacks against the device.

[0088] Thus, in some implementations, the source device 305, the reader device 310, and the passive wireless device 315 can support security mechanisms and authentication mechanisms to protect communications to and from the passive wireless device 315. For example, the source device 305, the reader device 310, and the passive wireless device 315 can support PHY security that is specifically associated with deployments involving the passive wireless device 315 (such as specifically associated with passive IoT devices and deployments). In some implementations, the passive wireless device 315 can store or be configured (such as via signaling from one or both of the source device 305 and the reader device 310) with one or more security keys to be used to protect communications between the passive wireless device 315 and one or both of the source device 305 and the reader device 310 (such as for protecting backscattered signals x(n) or for protecting read commands).

[0089] In some aspects, the source device 305, the reader device 310, and the passive wireless device 315 can implement PHY security based on a first PHY security key SK1(n) that protects communications between the source device 305 and the passive wireless device 315 and a second PHY security key SK2(n) that protects communications between the passive wireless device 315 and the reader device 310. For example, the source device 305 can perform encryption 350 to encrypt a signal x(n) (a command to be transmitted to the passive wireless device 315) using the first PHY security key SK1(n). To encrypt the signal x(n) using the first PHY security key SK1(n), the source device 305 can modulate x(n) using SK1(n) or can otherwise modify x(n) based on SK1(n). As described herein, encryption 350 can include one or more of an encryption operation and an encoding operation. For example, source device 305 may implement security of signal x(n) based on utilizing SK1(n) XOR data bits or based on multiplication of x(n) and SK1(n). As illustrated in example encryption 350, source device 305 may multiply x(n) and SK1(n) to obtain a protected first message 335. Thus, first message 335 may be conveyed via signal SK1(n)x(n). Source device 305 may send first message 335 using one or more of directional beam 345-a, directional beam 345-b, and directional beam 345-c.

[0090] The passive wireless device 315 may receive the first message 335 according to the first PHY security key SK1(n) and may perform decryption and encryption 355 to remove SK1(n) from x(n) (such as decrypting or decoding x(n)) and encrypt or encode the backscatter signal s(n) (the backscatter signal from the passive wireless device 315 to the reader device 310) according to the second PHY security key SK2(n). To decrypt or decode x(n) from SK1(n), the passive wireless device 315 may perform an inverse operation to the operation used by the source device 305 to encrypt x(n). To encrypt or encode the backscatter signal s(n) using the second PHY security key SK2(n), the passive wireless device 315 may modulate s(n) using SK2(n) or may otherwise modify s(n) according to SK2(n). As described herein, the decryption and encryption 355 may include one or more of a decryption operation, a decoding operation, an encryption operation, and an encoding operation. For example, the passive wireless device 315 can implement security for the signal s(n) based on utilizing SK2(n) to XOR data bits or based on multiplication of s(n) and SK2(n). As illustrated by example decryption and encryption 355, the passive wireless device 315 can multiply s(n) and SK2(n) to obtain a protected second message 340. As such, the second message 340 can be conveyed via the signal SK2(n)s(n)x(n).

[0091] Thus, taking into account the channel conditions, the passive wireless device 315 may receive (via a command or write to the passive wireless device 315) a signal y T (n), and the reader device 310 may receive (via reading from the passive wireless device 315) a signal y as defined according to Equation 2 and Equation 3, respectively, as shown below: D2 The reader device 310 may perform decryption 360 based on the second PHY security key SK2(n) to decrypt the second message 340 (such as to remove K2(n) from the second message 340). To decrypt s(n) from SK2(n), the reader device 310 may perform an inverse operation of the operation used by the passive wireless device 315 to encrypt s(n). As described herein, decryption 360 may include one or more of a decryption operation and a decoding operation.

[0092] y T (n) = h D1T (n)SK1(n)x(n)+noise(2)

[0093] y D2 (n)=(h D1D2 (n)+σ f h D1T (n)h TD2 (n)SK2(n)s(n))x(n)+noise(3)

[0094] In some implementations, the source device 305 and the reader device 310 can increase (such as double) the security of the backscattered signal by modulating or otherwise modifying the signal x(n) with a third PHY security key SK3(n) that protects communications between the source device 305 and the reader device 310. In such implementations, the reader device 310 can remove the third PHY security key SK3(n) upon receiving the signaling (from one or both of the direct links or via the passive wireless device 315). In this way, the reader device 310 can receive the signal y(n) as defined according to Formula 4 as shown below.

[0095] y(n)=(h D1D2 (n)+σ f h D1T (n)h TD2 (n)s(n))SK3(n)x(n)+noise(4)

[0096] In some implementations, the source device 305 and the reader device 310 may use the third PHY security key SK3(n) together with the second PHY security key SK2(n). In such implementations, the reader device 310 may receive (via reading from the passive wireless device 315) a signal y as defined according to Equation 5 as shown below: D2 The passive wireless device 315 may add SK2(n) to s(n), such as via encryption, modulation, multiplication, encoding, or other combining techniques, and may be left with SK3(n) (because the passive wireless device 315 may not know SK3(n)). Thus, the reader device 310 may use SK3(n) when reading from the passive wireless device 315, such as when the source device 305 transmits or writes a command to the reader device 310 and the passive wireless device 315 backscatters the command or writes.

[0097]

[0098] The third PHY security key SK3(n) may be associated with a slower rate or the same rate as s(n) (the signal from the passive wireless device 315). In addition, the third PHY security key SK3(n) may be associated with a faster rate than x(n). For example, SK3(n) may be associated with a first rate, s(n) may be associated with a second rate, and x(n) may be associated with a third rate, and the first rate may be faster, slower, or the same as the second or third rate. Such rates may refer to temporal rates and may be associated with or define changes in a signal over time (such as the periodicity of a signal or other timing information associated with a signal waveform or frequency that changes in phase and amplitude over time). In addition, x(n) or s(n) may be modulated or unmodulated and may be associated with a single tone signal (such that x(n) or s(n) is associated with a sine wave), a multi-tone signal, an OFDM signal, or a DFT-s-OFDM signal, among others.

[0099] In some implementations, the source device 305 can send an indication of SK3(n) to the reader device 310 using protected signaling, such as protected layer 2 (L2) or layer 3 (L3) signaling. For example, the source device 305 can send an indication of SK3(n) to the reader device 310 via RRC signaling, a MAC control element (MAC-CE), a protected physical downlink shared channel (PDSCH) message, a protected physical sidelink shared channel (PSSCH) message, or a protected physical uplink shared channel (PUSCH) message. By signaling SK3(n) using L2 or L3 protected signaling (or if protected, via L1), the source device 305 and the reader device 310 can avoid or prevent manipulation of the signaling by a fake attacker or other types of active attacks.

[0100] If the reader device 310 transmits read information (such as signaling received by the reader device 310 from the source device 305 and the passive wireless device 315) to the network entity 105 without decoding, or if the reader device 310 is the same device as the source device 305, then the reader device 310 (backscatter signal receiver) may not need to know SK3(n), and in such scenarios, it may not be desirable to receive an indication of SK3(n). In addition, in some implementations, one or more of the source device 305, the reader device 310, and the passive wireless device 315 may support multiple security keys. In such implementations, each of such devices that support multiple security keys may select which key to use from the multiple security keys available for use or select to switch between available keys according to a key selection procedure. By Figure 4 Examples and references Figure 4 Additional details related to such key selection procedures are described.

[0101] Figure 4 An example key selection diagram 400 is shown to support PHY security for passive IoT devices. The key selection diagram 400 can implement or be implemented to implement aspects of the wireless communication system 100, the network architecture 200, and the signaling diagram 300. For example, one or more of the source device 305, the reader device 310, and the passive wireless device 315 can select one or more PHY security keys according to the key selection diagram 400. As shown in FIG. Figure 4 As described, source device 305, reader device 310, and passive wireless device 315 may each be as described by Figure 3 Examples and references Figure 3 Examples of source device 305, reader device 310, and passive wireless device 315 are depicted.

[0102] In some implementations, the source device 305 and the passive wireless device 315 can switch between available security keys (such as switching between security keys for encryption or decryption) based on the selection criteria 405. For example, the source device 305 and the passive wireless device 315 can select between the stored key 410-a, the stored key 410-b, the stored key 410-c, and the stored key 410-d based on the selection criteria 405. The selection criteria 405 can be associated with a configured rule (such as a stored configured rule), a configuration or indication from another device (such as a configuration or indication from the source device 305 to the passive wireless device 315), a channel estimate, or a timer associated with one or more commands (such as one or more cancel commands transmitted from the source device 305 to the passive wireless device 315). As such, one or more of the source device 305, the reader device 310, and the passive wireless device 315 may select a security key from the set of available security keys or switch between available security keys based on using a security key generated from the channel, based on using a channel value between the source device 305 and the passive wireless device 315 and a channel value between the passive wireless device 315 and the reader device 310, or based on an instruction from the source device 305, from the reader device 310, or another network element or node. Thus, the security key selected from the set of available security keys may be the first PHY security key SK1(n), the second PHY security key SK2(n), or the third PHY security key SK3(n).

[0103] In a specific implementation where indication of one or more PHY security keys is indicated, the source device 305 (which may be the network entity 105, the UE 115, or another network element) or the reader device 310 (which may be the network entity 105, the UE 115, or another network element) may indicate which confidentiality key to use for communication using an L3 channel (such as RRC or PDSCH) or another protected channel to or from the passive wireless device 315. In other words, the source device 305 or the reader device 310 may indicate to each other or to the passive wireless device 315 the confidentiality key for tag communication from the source device 305 or for tag communication to the reader device 310, or both.

[0104] In implementations where one or more of the source device 305, the reader device 310, and the passive wireless device 315 use secret key extraction from channel randomness, such devices may transmit reference signals to each other, measure the reference signals, and calculate, compute, select, ascertain, or otherwise determine the security key based on the measurement of the reference signals. For example, two devices (such as the source device 305 and the passive wireless device 315, the reader device 310 and the passive wireless device 315, or in general, the network entity 105 and the UE 115) may send one or more reference signals to each other, and each (or at least one) device may use the one or more reference signals received by the device to estimate the channel. In implementations involving the passive wireless device 315, the reference signal sent by the passive wireless device 315 may be a reflection of the reference signal received at the passive wireless device 315.

[0105] In some embodiments, each (or at least one) device may obtain a metric based on the channel. Such metrics may include channel power, reference signal received power (RSRP), signal to interference plus noise ratio (SINR), or phase. One or more devices may quantize the metric or may use the metric as an input to a key derivation function (KDF). For example, the device may set the value of key to be equal to the metric obtained and may use derived_key=KDF(key...) to calculate the derived key using the key value. In some aspects, the KDF that can be used by the device may be defined by derived derived_key=HMACSHA256(key,[otherparameters]), where such other parameters may include any signaling-related parameters, capability-related parameters, or numerical values.

[0106] In some aspects, both of the two devices may use their respective channel metrics to calculate a security key. In some scenarios, such as in a high signal-to-noise ratio (SNR) scenario (where the SNR meets a threshold SNR), each of the two devices may expect that their respective derived security keys are the same and therefore protected. Otherwise, such as in a relatively low SNR scenario (where the SNR does not meet the threshold SNR), the device may perform some repetitions of the pilot signal or some other key refinement procedures so that the two devices obtain the same security key. In this way, the device may use the derived security key to protect a transmission or protect one or more fields within a physical channel, such as protecting some information carried on a physical control channel or data channel.

[0107] Additionally or alternatively, one or more of the source device 305, the reader device 310, and the passive wireless device may utilize one or more cancellation commands as part of a security key extraction procedure. Figure 5 and Figure 6 Examples and references Figure 5 and Figure 6 Additional details related to the use of such one or more cancel commands are described.

[0108] Figure 5 An example communication timeline 500 is shown to support PHY security for passive IoT devices. The communication timeline 500 can implement or be implemented to implement aspects of the wireless communication system 100, the network architecture 200, the signaling diagram 300, or the key selection diagram 400. For example, the communication timeline 500 can illustrate secure key extraction related communications between two devices, such as between a source device 305 and a passive wireless device 315, between a reader device 310 and a passive wireless device 315, or between a source device 305 and a reader device 310. As shown in FIG. Figure 5 As described, source device 305, reader device 310, and passive wireless device 315 may each be as described by Figure 3 Examples and references Figure 3 Examples of source device 305, reader device 310, and passive wireless device 315 are depicted.

[0109] The source device 305 (which may be the network entity 105) may use a password to initiate or start communications with the passive wireless device 315. The source device 305 may use the same password for commands associated with suspending, stopping, canceling, or otherwise terminating communications between the source device 305 and the passive wireless device 315. In some aspects, such commands may be referred to herein as cancel commands. In some implementations, the source device 305 and the passive wireless device 315 may use one or more cancel commands (which may be protected by a password) to generate one or more PHY security keys for communications to or from the passive wireless device 315. For example, the source device 305 and the passive wireless device 315 may support mutually understood rules or procedures according to which a key extraction process is associated with receiving a set of one or more cancel commands at known time and frequency locations.

[0110] As such, based on receiving a known or expected number (quantity) of cancellation command opportunities (at known or expected time and frequency locations), the passive wireless device 315 may know or expect that the passive wireless device 315 may use the timing of the received cancellation commands to generate security keys. For example, the passive wireless device 315 may receive cancellation commands 505-a, 505-b, and 505-c as expected according to a key extraction process (such that the passive wireless device 315 expects to receive cancellation commands 505-a, 505-b, and 505-c to trigger the key extraction process), and may use the timing information associated with the cancellation commands to calculate, compute, select, ascertain, or otherwise determine the security key. In some specific implementations, the passive wireless device 315 can generate a security key using a first time duration 515 (associated with a T1 value) between a cancellation command 505-a and a cancellation command 505-b, a second time duration 520 (associated with a T2 value) between a cancellation command 505-b and a cancellation command 505-c, and a third time duration 525 (associated with a T3 value) between a cancellation command 505-c and an operation 510 (a regular operation, such as an internal operation, a sending operation, or a receiving operation).

[0111] Thus, the passive wireless device 315 may generate a security key using the times or timers associated with T1, T2, and T3 (and typically up to TN) or any combination thereof (such as only T1 and T3) as input to the KDF. Such security keys may be used by any one or more of the source device 305, the reader device 310, and the passive wireless device 315 to protect communications to or from the passive wireless device 315. For example, the passive wireless device 315 may use the generated security key as a first PHY security key SK1(n) or a second PHY security key SK2(n). An attacker may not understand or be able to decrypt the cancel commands (because they may be protected by a tag password), which may protect such a signaling-based key extraction mechanism.

[0112] Figure 6 An example communication timeline 600 is shown to support PHY security for passive IoT devices. The communication timeline 600 can implement or be implemented to implement aspects of the wireless communication system 100, the network architecture 200, the signaling diagram 300, the key selection diagram 400, or the communication timeline 500. For example, the communication timeline 600 can illustrate secure key extraction related communications between two devices, such as between the source device 305 and the passive wireless device 315, between the reader device 310 and the passive wireless device 315, or between the source device 305 and the reader device 310. As shown in FIG. Figure 6 As described, source device 305, reader device 310, and passive wireless device 315 may each be as described by Figure 3 Examples and references Figure 3 Examples of source device 305, reader device 310, and passive wireless device 315 are depicted.

[0113] In some implementations, one or more of the source device 305, the reader device 310, and the passive wireless device 315 may use channel-based security key extraction. In implementations where a device uses channel-based security key extraction involving the passive wireless device 315, a device (such as the source device 305 or the reader device 310) may send a set of one or more reference signals to the passive wireless device 315, and the passive wireless device 315 may use these reference signals to estimate the channel from the device to the passive wireless device 315. The device that sent the reference signal may use reflections of the reference signal to estimate the channel from the passive wireless device 315 to the device. Thus, the devices may use the estimated channel to obtain the security key.

[0114] In some implementations, such a device may anticipate such a channel-based key extraction process initiation or start based on the sending or receiving of one or more cancellation command timings, which may further increase the security associated with the channel-based key extraction process. In other words, sending or receiving one or more cancellation commands based on the stored or indicated timing may trigger the channel-based key extraction process to initiate or start (so that the timing (if met) is known or expected as a trigger for the channel-based key extraction). In some aspects, the timing between the last or final cancellation command and the channel-based key extraction process may be stored at the passive wireless device 315 or indicated to the passive wireless device 315 via L1, L2, or L3 signaling (from one or both of the source device 305 and the reader device 310).

[0115] For example, and as illustrated by the communication timeline 600, the passive wireless device 315 may receive a cancellation command 605-a at a first time, and may receive a cancellation command 605-b at a second time (at a time duration 615 after the first time). As such, if the first time, the second time, and the time duration 615 between the first time and the second time are stored or indicated to the passive wireless device 315 as a trigger for a channel-based key extraction process, the passive wireless device 315 may perform the key extraction process 610 accordingly. In addition, although in Figure 6 6 is described as a channel-based key extraction process in the context of , but the key extraction process 610 can be an example of any key extraction process. As such, one or more of the source device 305, the reader device 310, and the passive wireless device 315 can use the channel estimate and a timer (such as the time between cancel commands) to generate a security key (such as a KDF that uses an input of the channel estimate or an input of the timing information, or both).

[0116] In some implementations, one or more of the source device 305, the reader device 310, and the passive wireless device 315 may obtain a security key from the channel and may use the security key for various operations. For example, such a device may use the security key as a seed to generate another security key using a KDF. In such examples, the security key obtained from the channel may be referred to as an intermediate key, and such a device may use the intermediate key as an input to another KDF to obtain a final security key. Additionally or alternatively, such a device may use the security key as a switch to change the current security key to a different security key among the configured, indicated, or stored security keys.

[0117] Figure 7An example process flow 700 for supporting PHY security for passive IoT devices is shown. The process flow 700 can implement or be implemented to implement aspects of the wireless communication system 100, the network architecture 200, the signaling diagram 300, the key selection diagram 400, the communication timeline 500, or the communication timeline 600. For example, the process flow 700 can illustrate communications between the source device 305, the reader device 310, and the passive wireless device 315. As shown in FIG. Figure 6 As described, source device 305, reader device 310, and passive wireless device 315 may each be as described by Figure 3 Examples and references Figure 3 Examples of source device 305, reader device 310, and passive wireless device 315 are depicted.

[0118] At 705, in some implementations, the source device 305 can send an indication of one or more security keys to the reader device 310. For example, the source device 305 can send an indication of a first PHY security key SK to the reader device 310. v The source device 305 may indicate to the reader device 310 an indication of one or both of a first PHY security key SK(n) protecting communications between the source device 305 and the passive wireless device 315 and a second PHY security key SK2(n) protecting communications between the passive wireless device 315 and the reader device 310. In some aspects, the source device 305 may indicate to the reader device 310 SK v (n), because the reader device 310 may receive a superposition of signaling associated with the direct link between the source device 305 and the reader device 310 and signaling reflected via the passive wireless device 315, which may result in the reader device 310 receiving signaling protected by both SK1(n) and SK2(n). Additionally or alternatively, the source device 305 may send an indication of a third PHY security key SK3(n) that protects direct communications between the source device 305 and the reader device 310.

[0119] At 710, in some implementations, the source device 305 can send an indication of one or more security keys to the passive wireless device 315. For example, the source device 305 can send an indication of one or both of a first PHY security key SK1(n) that protects communications between the source device 305 and the passive wireless device 315 and a second PHY security key SK2(n) that protects communications between the passive wireless device 315 and the reader device 310 to the passive wireless device 315. In some aspects, the passive wireless device 315 can receive a first set of security keys from the source device 305, wherein each security key in the first set of security keys can be used to protect communications between the source device 305 and the passive wireless device 315. Alternatively, the passive wireless device 315 can receive an indication of the first set of security keys from a different device, such as the reader device 310, or can store the first set of security keys.

[0120] At 715, in some implementations, the reader device 310 may send an indication of one or more security keys to the passive wireless device 315. For example, the reader device 310 may send to the passive wireless device 315. For example, the source device 305 may send to the passive wireless device 315 an indication of one or both of a first PHY security key SK1(n) that protects communications between the source device 305 and the passive wireless device 315 and a second PHY security key SK2(n) that protects communications between the passive wireless device 315 and the reader device 310. In some aspects, the passive wireless device 315 may receive a second set of security keys from the reader device 310, wherein each security key in the second set of security keys may be used to protect communications between the reader device 310 and the passive wireless device 315. Alternatively, the passive wireless device 315 may receive an indication of the second set of security keys from a different device, such as the source device 305, or may store the second set of security keys.

[0121] At 720, in some implementations, the source device 305 can send a set of one or more cancellation commands to the passive wireless device 315. In such implementations, the source device 305 and the passive wireless device 315 can support mutually understood rules or procedures according to which timing information associated with the set of one or more cancellation commands can be used to obtain one or more security keys. Additionally or alternatively, the source device 305 and the passive wireless device 315 can support mutually understood rules or procedures according to which one or more cancellation commands trigger a channel-based key extraction process.

[0122] At 725, the passive wireless device 315 may receive one or both of the first PHY security key SK1(n) and the second PHY security key SK2(n) as outputs of one or more KDFs, for example, based on inputting timing information associated with the cancel command into the one or more KDFs. Figure 5 Examples and references Figure 5 Additional details related to such use of timing information (associated with multiple cancel commands) to generate security commands are described.

[0123] At 730, in some implementations, the source device 305 may send a first set of one or more reference signals to the passive wireless device 315. The passive wireless device 315 may correspondingly obtain a first channel measurement of the first set of one or more reference signals. In some implementations, the source device 305 may send the first set of reference signals, and the passive wireless device 315 may expect to receive the first set of one or more reference signals based on receiving one or more cancellation commands at an expected timing to trigger a channel-based key extraction process. In some aspects, the passive wireless device 315 and the source device 305 may be configured or otherwise set a fixed time duration between the last command in the set of cancellation commands received at 720 and the first set of reference signals.

[0124] At 735, in some implementations, the reader device 310 may send a second set of one or more reference signals to the passive wireless device 315. The passive wireless device 315 may correspondingly obtain a second channel measurement of the second set of one or more reference signals. In some implementations, the reader device 310 may send the second set of reference signals, and the passive wireless device 315 may anticipate receiving the second set of one or more reference signals based on receiving one or more cancellation commands at an expected timing for triggering a channel-based key extraction process. In some aspects, the passive wireless device 315 and the reader device 310 may be configured or otherwise set to a fixed time duration between the last command in the set of cancellation commands received at 720 and the second set of reference signals.

[0125] At 740, the passive wireless device 315 may receive or otherwise obtain a first PHY security key SK1(n) as an output of the first KDF based on inputting a first metric associated with the first channel measurement into the first KDF. Additionally or alternatively, the passive wireless device 315 may receive or otherwise obtain a second PHY security key SK2(n) as an output of the second KDF based on inputting a second metric associated with the second channel measurement into the second KDF.

[0126] At 745, the source device 305 may determine the PHY security key SK according to the first PHY security key SK. vThe passive wireless device 315 may include or otherwise be associated with signaling defined by SK1(n)x(n), where x(n) may convey information (such as data or identification) from the source device 305. The passive wireless device 315 may decrypt the first message based on performing an inverse operation of the operation used by the source device 305 to encrypt x(n) using SK1(n), and may encrypt information conveyed by the passive wireless device using a second PHY security key SK2(n), which may be defined by s(n). Furthermore, in a specific implementation where the source device 305 additionally encrypts x(n) using SK3(n), the passive wireless device 315 may expect SK3(n) to be part of x(n) and may avoid attempting to remove SK3(n) from x(n).

[0127] At 750, the passive wireless device 315 may send a second message to the reader device 310 via backscattering of the first message and in accordance with a second PHY security key SK2(n) that protects communications between the passive wireless device 315 and the reader device 310. The second message may include or otherwise be associated with signaling defined by SK2(n)s(n)x(n), where s(n) may convey information (such as data or identification) from the passive wireless device 315, and x(n) may be an unmodulated signal (such as a single tone signal or a multi-tone signal, etc.) from the source device 305 (to be backscattered by the passive wireless device 315). The reader device 310 may decrypt the second message in accordance with performing an inverse operation of the operation used by the passive wireless device 315 to encrypt s(n) using SK2(n), and may thus receive a signal defined by s(n)x(n). In implementations where source device 305 additionally encrypts x(n) using SK3(n), reader device 310 may additionally decrypt the second message to remove the effects of SK3(n).

[0128] Figure 8 A block diagram 800 of an example device 805 supporting PHY security for passive IoT devices is shown. The device 805 may communicate (such as wirelessly) with one or more network entities (such as one or more components of one or more network entities 105), one or more UEs 115, or any combination thereof. The device 805 may include components for two-way voice and data communications, including components for sending and receiving communications, such as a communication manager 820, an input / output (I / O) controller 810, a transceiver 815, an antenna 825, a memory 830, code 835, and a processor 840. These components may be in electronic communication or otherwise coupled (such as operatively, communicatively, functionally, electronically, electrically) via one or more buses (such as bus 845).

[0129] I / O controller 810 can manage input signals and output signals of device 805. I / O controller 810 can also manage peripheral devices that are not integrated into device 805. In some implementations, I / O controller 810 can represent a physical connection or port to an external peripheral device. In some implementations, I / O controller 810 can utilize an operating system, such as or another known operating system. Additionally or alternatively, the I / O controller 810 may represent or interact with a modem, keyboard, mouse, touch screen, or similar device. In some implementations, the I / O controller 810 may be implemented as part of a processor or processing system (such as the processor 840). In some implementations, a user may interact with the device 805 via the I / O controller 810 or via hardware components controlled by the I / O controller 810.

[0130] In some implementations, the device 805 may include a single antenna 825. However, in some other implementations, the device 805 may have more than one antenna 825, which can concurrently send or receive multiple wireless transmissions. As described herein, the transceiver 815 can communicate bidirectionally via one or more antennas 825, wired or wireless links. For example, the transceiver 815 may represent a wireless transceiver and can communicate bidirectionally with another wireless transceiver. The transceiver 815 may also include a modem for modulating packets, providing the modulated packets to one or more antennas 825 for transmission, and demodulating packets received from one or more antennas 825. In some implementations, the transceiver 815 may include one or more interfaces, such as one or more interfaces coupled to one or more antennas 825 configured to support various receiving or obtaining operations, or one or more interfaces coupled to one or more antennas 825 configured to support various sending operations or output operations, or a combination thereof. In some implementations, the transceiver 815 may include or be configured to be coupled to one or more processors or memory components that are operable to perform or support operations associated with received or obtained information or signals, or to generate information or other signals for transmission or other output, or any combination thereof. In some implementations, the transceiver 815, or the transceiver 815 and one or more antennas 825, or the transceiver 815 and one or more antennas 825 and one or more processors or memory components (such as the processor 840, or the memory 830, or both) may be included in a chip or chip assembly installed in the device 805.

[0131] The memory 830 may include random access memory (RAM) and read-only memory (ROM). The memory 830 may store computer-readable, computer-executable code 835 including instructions that, when executed by the processor 840, cause the device 805 to perform various functions described herein. The code 835 may be stored in a non-transitory computer-readable medium (such as a system memory or another type of memory). In some implementations, the code 835 may not be directly executable by the processor 840, but may cause a computer (such as when compiled and executed) to perform the functions described herein. In some implementations, the memory 830 may include, among other things, a basic I / O system (BIOS) that may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0132] The processor 840 may be any one or more suitable processors capable of executing scripts or instructions of one or more software programs stored in the device 805 (such as in the memory 830). In some specific implementations, the processor 840 may be a component of a processing system. A processing system may generally refer to a system or a series of machines or components that receive inputs and process these inputs to produce an output set (which may be passed to other systems or components (such as the device 805)). For example, the processing system of the device 805 may refer to a system including various other components or subcomponents of the device 805, such as the processor 840, or the transceiver 815, or the communication manager 820, or other components or combinations of components of the device 805. The processing system of the device 805 may be docked with other components of the device 805, and may process information (such as input or signal) received from other components or output information to other components. For example, a chip or modem of the device 805 may include a processing system and an interface for outputting information or for obtaining information or both. The interface may be implemented as or otherwise include a first interface configured to output information and a second interface configured to obtain information. In some implementations, the first interface may refer to an interface between a processing system of a chip or modem and a transmitter, so that the device 805 can send information output from the chip or modem. In some implementations, the second interface may refer to an interface between a processing system of a chip or modem and a receiver, so that the device 805 can obtain information or signal input, and the information can be passed to the processing system. Those of ordinary skill in the art will readily recognize that the first interface may also obtain information or signal input, and the second interface may also output information or signal output.

[0133] The communication manager 820 may support wireless communication at a passive wireless device according to examples as disclosed herein. For example, the communication manager 820 may be configured to or otherwise support means for receiving a first message according to a first PHY security key that protects communications between a source device and a passive wireless device. The communication manager 820 may be configured to or otherwise support means for sending a second message via backscatter of the first message and according to a second PHY security key that protects communications between the passive wireless device and a reader device.

[0134] In some implementations, the communication manager 820 can be configured or otherwise support means for receiving an indication of the first PHY security key, the second PHY security key, or a combination thereof from one or both of the source device and the reader device.

[0135] In some implementations, the communication manager 820 can be configured or otherwise support means for receiving a set of multiple commands associated with termination of communications between the source device and the passive wireless device. In some implementations, the communication manager 820 can be configured or otherwise support means for receiving one or both of the first PHY security key and the second PHY security key as outputs of one or more key derivation functions based on inputting timing information associated with the set of multiple commands into the one or more key derivation functions.

[0136] In some implementations, the communication manager 820 can be configured to or otherwise support means for receiving a first set of one or more reference signals from a source device, wherein a first PHY security key is associated with a first channel measurement of the first set of one or more reference signals. In some implementations, the communication manager 820 can be configured to or otherwise support means for receiving a second set of one or more reference signals from a reader device, wherein a second PHY security key is associated with a second channel measurement of the second set of one or more reference signals.

[0137] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving a first PHY security key as an output of a first key derivation function based on inputting a first metric associated with a first channel measurement into the first key derivation function. In some implementations, the communications manager 820 can be configured or otherwise support means for receiving a second PHY security key as an output of a second key derivation function based on inputting a second metric associated with a second channel measurement into the second key derivation function.

[0138] In some implementations, the communication manager 820 may be configured to or otherwise support components for receiving a set of one or more commands associated with termination of communications between a source device and a passive wireless device, wherein timing of one or both of a first set of one or more reference signals and a second set of one or more reference signals is associated with the set of one or more commands, wherein the timing is further associated with a fixed time duration between a last command in the set of one or more commands and one or both of the first set of one or more reference signals and the second set of one or more reference signals.

[0139] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving the intermediate first PHY security key as an output of the first key derivation function based on inputting the first metric associated with the first channel measurement into the first key derivation function. In some implementations, the communications manager 820 can be configured or otherwise support means for receiving the first PHY security key as an output of the second key derivation function based on inputting the intermediate first PHY security key into the second key derivation function.

[0140] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving an intermediate second PHY security key as an output of the first key derivation function based on inputting a second metric associated with the second channel measurement into the first key derivation function. In some implementations, the communications manager 820 can be configured or otherwise support means for receiving a second PHY security key as an output of the second key derivation function based on inputting the intermediate second PHY security key into the second key derivation function.

[0141] In some implementations, the communications manager 820 may be configured to or otherwise support means for receiving an indication of a first set of PHY security keys that protect communications between a source device and a passive wireless device, wherein selecting a first PHY security key from the first set of PHY security keys is associated with the indication of the first set of PHY security keys.

[0142] In some implementations, selection of a first PHY security key from the first set of PHY security keys is associated with an indication of a selection by a source device, a first channel measurement of a first channel between the source device and the passive wireless device, timing information of a set of multiple commands associated with termination of communications between the source device and the passive wireless device, or any combination thereof.

[0143] In some implementations, the communications manager 820 can be configured to or otherwise support means for receiving an indication of a second set of PHY security keys that protect communications between the passive wireless device and the reader device, wherein selecting a second PHY security key from the second set of PHY security keys is associated with the indication of the second set of PHY security keys.

[0144] In some implementations, selection of a second PHY security key from the second set of PHY security keys is associated with an indication of a selection by the source device or the reader device, a second channel measurement of a second channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of communications between the source device and the passive wireless device, or any combination thereof.

[0145] In some implementations, prior to receiving the first message and sending the second message, the first PHY security key and the second PHY security key are stored at the passive wireless device.

[0146] In some implementations, the first modulation operation, the first multiplication operation, or the first logical exclusive OR operation, and wherein the communication between the reader device and the passive wireless device is protected according to performing a second operation on the second message and the first PHY security key, the second operation includes one or more of the following. In some implementations, the second modulation operation, the second multiplication operation, or the second logical exclusive OR operation.

[0147] In some implementations, the first message corresponds to a first radio wave associated with a first set of bits, and the second message corresponds to a second radio wave associated with a second set of bits. In some implementations, backscattering by the passive wireless device is associated with amplitude shift keying modulation of the first set of bits with the second set of bits via selective reflection by the passive wireless device.

[0148] Additionally or alternatively, the communication manager 820 can support wireless communications at the reader device according to examples as disclosed herein. For example, the communication manager 820 can be configured to or otherwise support means for receiving a first message from a source device via a passive wireless device associated with backscatter of the first message. The communication manager 820 can be configured to or otherwise support means for decrypting the first message according to a PHY security key that protects communications between the passive wireless device and the reader device.

[0149] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving an indication of a PHY security key.

[0150] In some implementations, the communication manager 820 can be configured or otherwise support means for sending a set of one or more reference signals to a passive wireless device, wherein a PHY security key is associated with a channel measurement of the set of one or more reference signals.

[0151] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving a PHY security key as an output of a key derivation function based on inputting a metric associated with a channel measurement into the key derivation function.

[0152] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving the intermediate PHY security key as an output of the first key derivation function based on inputting the metric associated with the channel measurement into the first key derivation function. In some implementations, the communications manager 820 can be configured or otherwise support means for receiving the PHY security key as an output of the second key derivation function based on inputting the intermediate PHY security key into the second key derivation function.

[0153] In some implementations, the communications manager 820 can be configured to or otherwise support means for receiving an indication of a set of PHY security keys that protect communications between the passive wireless device and the reader device, wherein selecting a PHY security key from the set of PHY security keys is associated with the indication of the set of PHY security keys.

[0154] In some implementations, selection of a PHY security key from a set of PHY security keys is associated with an indication of a selection by a source device or a reader device, a channel measurement of a channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of communications between the source device and the passive wireless device, or any combination thereof.

[0155] In some implementations, to support receiving the first message, the communication manager 820 can be configured or otherwise support means for receiving the first message in accordance with a second PHY security key that protects communications between the source device and the reader device.

[0156] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving an indication of a second PHY security key.

[0157] In some implementations, the communication manager 820 can be configured to or otherwise support means for sending a second message to the passive wireless device based on a second PHY security key that protects communications between the reader device and the passive wireless device, wherein the source device and the reader device are the same device, and wherein the first message is a backscattered version of the second message.

[0158] Additionally or alternatively, the communication manager 820 can support wireless communications at the source device according to examples as disclosed herein. For example, the communication manager 820 can be configured to or otherwise support means for encrypting a first message according to a first PHY security key that protects communications between the source device and the passive wireless device. The communication manager 820 can be configured to or otherwise support means for sending the first message to the reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0159] In some implementations, the communications manager 820 can be configured or otherwise support means for sending an indication of a PHY security key to a passive wireless device.

[0160] In some implementations, the communication manager 820 can be configured or otherwise support means for sending a set of multiple commands to the passive wireless device, the set of multiple commands associated with termination of communications between the source device and the passive wireless device. In some implementations, the communication manager 820 can be configured or otherwise support means for receiving a PHY security key as an output of a key derivation function based on inputting timing information associated with the set of multiple commands into the key derivation function.

[0161] In some implementations, the communication manager 820 can be configured or otherwise support means for sending a set of one or more reference signals to a passive wireless device, wherein a PHY security key is associated with a channel measurement of the set of one or more reference signals.

[0162] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving a PHY security key as an output of a key derivation function based on inputting a metric associated with a channel measurement into the key derivation function.

[0163] In some implementations, the communication manager 820 can be configured to or otherwise support means for sending a set of one or more commands to the passive wireless device, the set of one or more commands being associated with termination of communications between the source device and the passive wireless device, wherein timing of a set of one or more reference signals is associated with the set of one or more commands, wherein the timing is further associated with a fixed time duration between a last command in the set of one or more commands and the set of one or more reference signals.

[0164] In some implementations, the communications manager 820 can be configured or otherwise support means for receiving the intermediate PHY security key as an output of the first key derivation function based on inputting the metric associated with the channel measurement into the first key derivation function. In some implementations, the communications manager 820 can be configured or otherwise support means for receiving the PHY security key as an output of the second key derivation function based on inputting the intermediate PHY security key into the second key derivation function.

[0165] In some implementations, the communications manager 820 may be configured to or otherwise support means for sending an indication of a set of PHY security keys to the passive wireless device that protect communications between the source device and the passive wireless device, wherein selecting a PHY security key from the set of PHY security keys is associated with the indication of the set of PHY security keys.

[0166] In some implementations, selection of a PHY security key from a set of PHY security keys is associated with an indication of a selection by a source device or a passive wireless device, a channel measurement of a channel between the source device and the passive wireless device, timing information for a set of multiple commands associated with termination of communications between the source device and the passive wireless device, or any combination thereof.

[0167] In some implementations, the communication manager 820 can be configured or otherwise support means for sending an indication of a second PHY security key to one or both of the passive wireless device and the reader device that protects communications between the passive wireless device and the reader device.

[0168] In some implementations, the communications manager 820 may be configured to or otherwise support means for sending an indication of a second set of PHY security keys to one or both of the passive wireless device and the reader device that protect communications between the passive wireless device and the reader device, wherein selecting the second PHY security key from the second set of PHY security keys is associated with the indication of the second set of PHY security keys.

[0169] In some implementations, selecting the second PHY security key from the second set of PHY security keys is associated with an indication of a selection by the source device or the passive wireless device, a channel measurement of a channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of communications between the source device and the passive wireless device, or any combination thereof.

[0170] In some implementations, to support sending the first message, the communication manager 820 can be configured or otherwise support means for sending the first message in accordance with a second PHY security key that protects communications between the source device and the reader device.

[0171] In some implementations, the communications manager 820 can be configured or otherwise support means for sending an indication of the second PHY security key to the reader device.

[0172] In some implementations, the communication manager 820 can be configured to or otherwise support means for receiving a second message from the passive wireless device based on a second PHY security key that protects communications between the passive wireless device and a reader device, wherein the source device and the reader device are the same device, and wherein the second message is a backscattered version of the first message.

[0173] In some implementations, the communication manager 820 may be configured to use the transceiver 815, one or more antennas 825, or any combination thereof, or otherwise cooperate with them to perform various operations (such as receiving, monitoring, transmitting). Although the communication manager 820 is illustrated as a separate component, in some implementations, one or more functions described with reference to the communication manager 820 may be supported or performed by the processor 840, the memory 830, the code 835, or any combination thereof. For example, the code 835 may include instructions that are executable by the processor 840 to cause the device 805 to perform various aspects of PHY security for passive IoT devices as described herein, or the processor 840 and the memory 830 may be otherwise configured to perform or support such operations.

[0174] Fig. 9A block diagram 900 of an example device 905 supporting PHY security for passive IoT devices is shown. The device 905 may communicate with one or more network entities (such as one or more components of one or more network entities 105), one or more UEs 115, or any combination thereof, which communication may include communication through one or more wired interfaces, through one or more wireless interfaces, or any combination thereof. The device 905 may include components that support output and receive communications, such as a communication manager 920, a transceiver 910, an antenna 915, a memory 925, code 930, and a processor 935. These components may be in electronic communication or otherwise coupled (such as operatively, communicatively, functionally, electronically, electrically) via one or more buses (such as a bus 940).

[0175] As described herein, the transceiver 910 may support bidirectional communication via a wired link, a wireless link, or both. In some implementations, the transceiver 910 may include a wired transceiver and may communicate bidirectionally with another wired transceiver. Additionally or alternatively, in some implementations, the transceiver 910 may include a wireless transceiver and may communicate bidirectionally with another wireless transceiver. In some implementations, the device 905 may include one or more antennas 915, which may be able to send or receive wireless transmissions (such as concurrently). The transceiver 910 may also include a modem for modulating a signal, for providing a modulated signal for transmission (such as through one or more antennas 915, through a wired transmitter), for receiving a modulated signal (such as from one or more antennas 915, from a wired receiver) and for demodulating a signal. In some implementations, the transceiver may be operable to support communications via one or more communication links, such as communication link 125 , backhaul communication link 120 , midhaul communication link 162 , and fronthaul communication link 168 .

[0176] The memory 925 may include RAM and ROM. The memory 925 may store computer-readable, computer-executable code 930 including instructions that, when executed by the processor 935, cause the device 905 to perform various functions described herein. The code 930 may be stored in a non-transitory computer-readable medium (such as a system memory or another type of memory). In some implementations, the code 930 may not be directly executable by the processor 935, but may cause a computer (such as when compiled and executed) to perform the functions described herein. In some implementations, the memory 925 may include, among other things, a BIOS that may control basic hardware or software operations, such as interaction with peripheral components or devices.

[0177] The processor 935 may include an intelligent hardware device (such as a general-purpose processor, a DSP, an ASIC, a CPU, an FPGA, a microcontroller, a programmable logic device, a discrete gate or transistor logic component, a discrete hardware component, or any combination thereof). In some specific implementations, the processor 935 may be configured to operate a memory array using a memory controller. In some other specific implementations, the memory controller may be integrated into the processor 935. The processor 935 may be configured to execute computer-readable instructions stored in a memory (such as a memory 925) to enable the device 905 to perform various functions (such as functions or tasks that support PHY security for passive IoT devices). For example, the device 905 or a component of the device 905 may include a processor 935 and a memory 925 coupled to the processor 935, and the processor 935 and the memory 925 are configured to perform various functions described herein. The processor 935 may be an example of a cloud computing platform (such as one or more physical nodes and supporting software (such as an operating system, a virtual machine, or a container instance)), which may host functions (such as by executing code 930) to perform the functions of the device 905.

[0178] In some implementations, the bus 940 may support communications of a protocol layer (such as within a protocol layer) of a protocol stack. In some implementations, the bus 940 may support communications associated with a logical channel of a protocol stack (such as between protocol layers of a protocol stack), which may include communications performed within a component of the device 905, or communications performed between different components of the device 905 that may be co-located or located in different locations (such as where the device 905 may refer to a system in which one or more of the communication manager 920, transceiver 910, memory 925, code 930, and processor 935 may be located in one of the different components or divided between the different components).

[0179] In some implementations, the communication manager 920 can manage aspects of communications with the core network 130, such as via one or more wired or wireless backhaul links. For example, the communication manager 920 can manage the delivery of data communications for client devices, such as one or more UEs 115. In some implementations, the communication manager 920 can manage communications with other network entities 105, and can include a controller or scheduler for controlling communications with the UE 115 in collaboration with the other network entities 105. In some implementations, the communication manager 920 can support an X2 interface within an LTE / LTE-A wireless communication network technology to provide communications between network entities 105.

[0180] The communication manager 920 can support wireless communications at a reader device according to examples as disclosed herein. For example, the communication manager 920 can be configured to or otherwise support means for receiving a first message from a source device via a passive wireless device associated with backscatter of the first message. The communication manager 920 can be configured to or otherwise support means for decrypting the first message according to a PHY security key that protects communications between the passive wireless device and the reader device.

[0181] In some implementations, communications manager 920 can be configured or otherwise support means for receiving an indication of a PHY security key.

[0182] In some implementations, the communication manager 920 can be configured or otherwise support means for sending a set of one or more reference signals to a passive wireless device, wherein a PHY security key is associated with a channel measurement of the set of one or more reference signals.

[0183] In some implementations, the communications manager 920 can be configured or otherwise support means for receiving a PHY security key as an output of a key derivation function based on inputting a metric associated with a channel measurement into the key derivation function.

[0184] In some implementations, the communications manager 920 can be configured or otherwise support means for receiving the intermediate PHY security key as an output of the first key derivation function based on inputting the metric associated with the channel measurement into the first key derivation function. In some implementations, the communications manager 920 can be configured or otherwise support means for receiving the PHY security key as an output of the second key derivation function based on inputting the intermediate PHY security key into the second key derivation function.

[0185] In some implementations, the communications manager 920 can be configured to or otherwise support means for receiving an indication of a set of PHY security keys that protect communications between the passive wireless device and the reader device, wherein selecting a PHY security key from the set of PHY security keys is associated with the indication of the set of PHY security keys.

[0186] In some implementations, selection of a PHY security key from a set of PHY security keys is associated with an indication of a selection by a source device or a reader device, a channel measurement of a channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of communications between the source device and the passive wireless device, or any combination thereof.

[0187] In some implementations, to support receiving the first message, the communication manager 920 can be configured or otherwise support means for receiving the first message in accordance with a second PHY security key that protects communications between the source device and the reader device.

[0188] In some implementations, the communications manager 920 can be configured or otherwise support means for receiving an indication of a second PHY security key.

[0189] In some implementations, the communication manager 920 can be configured to or otherwise support means for sending a second message to the passive wireless device based on a second PHY security key that protects communications between the reader device and the passive wireless device, wherein the source device and the reader device are the same device, and wherein the first message is a backscattered version of the second message.

[0190] Additionally or alternatively, the communication manager 920 can support wireless communications at the source device according to examples as disclosed herein. For example, the communication manager 920 can be configured to or otherwise support means for encrypting a first message according to a first PHY security key that protects communications between the source device and the passive wireless device. The communication manager 920 can be configured to or otherwise support means for sending the first message to the reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0191] In some implementations, the communications manager 920 can be configured or otherwise support means for sending an indication of a PHY security key to a passive wireless device.

[0192] In some implementations, the communication manager 920 can be configured or otherwise support means for sending a set of multiple commands to the passive wireless device, the set of multiple commands associated with termination of communications between the source device and the passive wireless device. In some implementations, the communication manager 920 can be configured or otherwise support means for receiving a PHY security key as an output of a key derivation function based on inputting timing information associated with the set of multiple commands into the key derivation function.

[0193] In some implementations, the communication manager 920 can be configured or otherwise support means for sending a set of one or more reference signals to a passive wireless device, wherein a PHY security key is associated with a channel measurement of the set of one or more reference signals.

[0194] In some implementations, the communications manager 920 can be configured or otherwise support means for receiving a PHY security key as an output of a key derivation function based on inputting a metric associated with a channel measurement into the key derivation function.

[0195] In some implementations, the communication manager 920 can be configured to or otherwise support means for sending a set of one or more commands to the passive wireless device, the set of one or more commands being associated with termination of communications between the source device and the passive wireless device, wherein timing of a set of one or more reference signals is associated with the set of one or more commands, wherein the timing is further associated with a fixed time duration between a last command in the set of one or more commands and the set of one or more reference signals.

[0196] In some implementations, the communications manager 920 can be configured or otherwise support means for receiving the intermediate PHY security key as an output of the first key derivation function based on inputting the metric associated with the channel measurement into the first key derivation function. In some implementations, the communications manager 920 can be configured or otherwise support means for receiving the PHY security key as an output of the second key derivation function based on inputting the intermediate PHY security key into the second key derivation function.

[0197] In some implementations, the communications manager 920 may be configured to or otherwise support means for sending an indication of a set of PHY security keys to the passive wireless device that protect communications between the source device and the passive wireless device, wherein selecting a PHY security key from the set of PHY security keys is associated with the indication of the set of PHY security keys.

[0198] In some implementations, selection of a PHY security key from a set of PHY security keys is associated with an indication of a selection by a source device or a passive wireless device, a channel measurement of a channel between the source device and the passive wireless device, timing information for a set of multiple commands associated with termination of communications between the source device and the passive wireless device, or any combination thereof.

[0199] In some implementations, the communication manager 920 can be configured or otherwise support means for sending an indication of a second PHY security key to one or both of the passive wireless device and the reader device, the second PHY security key protecting communications between the passive wireless device and the reader device.

[0200] In some implementations, the communications manager 920 may be configured to or otherwise support means for sending an indication of a second set of PHY security keys to one or both of the passive wireless device and the reader device that protect communications between the passive wireless device and the reader device, wherein selecting a second PHY security key from the second set of PHY security keys is associated with the indication of the second set of PHY security keys.

[0201] In some implementations, selecting the second PHY security key from the second set of PHY security keys is associated with an indication of a selection by the source device or the passive wireless device, a channel measurement of a channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of communications between the source device and the passive wireless device, or any combination thereof.

[0202] In some implementations, to support sending and receiving the first message, the communication manager 920 can be configured or otherwise support means for sending the first message according to a second PHY security key that protects communications between the source device and the reader device.

[0203] In some implementations, the communications manager 920 can be configured or otherwise support means for sending an indication of the second PHY security key to the reader device.

[0204] In some implementations, the communications manager 920 can be configured to or otherwise support means for receiving a second message from the passive wireless device based on a second PHY security key that protects communications between the passive wireless device and a reader device, wherein the source device and the reader device are the same device, and wherein the second message is a backscattered version of the first message.

[0205] In some implementations, the communication manager 920 may be configured to use the transceiver 910, one or more antennas 915 (such as where applicable), or any combination thereof, or otherwise cooperate with them to perform various operations (such as receiving, obtaining, monitoring, outputting, transmitting). Although the communication manager 920 is illustrated as a separate component, in some implementations, one or more functions described with reference to the communication manager 920 may be supported or performed by the processor 935, the memory 925, the code 930, the transceiver 910, or any combination thereof. For example, the code 930 may include instructions executable by the processor 935 to cause the device 905 to perform various aspects of PHY security for passive IoT devices as described herein, or the processor 935 and the memory 925 may be otherwise configured to perform or support such operations.

[0206] Fig.10 A flow chart illustrating an example method 1000 for supporting PHY security for passive IoT devices is shown. The operations of the method 1000 may be implemented by a UE or a component thereof as described herein. For example, the operations of the method 1000 may be implemented by a UE or a component thereof as described herein. Figures 1 to 8 The described functions may be performed by the UE 115. In some implementations, the UE may execute a set of instructions to control the functional elements of the UE to perform the described functions. Additionally or alternatively, the UE may use dedicated hardware to perform various aspects of the described functions.

[0207] At 1005, the method may include: receiving a first message according to a first PHY security key, the first PHY security key protecting communications between the source device and the passive wireless device. The operations of 1005 may be performed according to examples disclosed herein. In some implementations, aspects of the operations of 1005 may be performed as described in reference to Figure 8 The communication manager 820 described above is executed.

[0208] At 1010, the method may include sending a second message via backscatter of the first message and according to a second PHY security key, the second PHY security key protecting communications between the passive wireless device and the reader device. The operations of 1010 may be performed according to examples as disclosed herein. In some implementations, aspects of the operations of 1010 may be performed as described in reference to Figure 8 The communication manager 820 described above is executed.

[0209] Fig.11 A flow chart illustrating an example method 1100 for supporting PHY security for passive IoT devices is shown. The operations of the method 1100 may be implemented by a UE or a network entity or a component thereof as described herein. For example, the operations of the method 1100 may be implemented by a UE or a network entity or a component thereof as described herein. Figures 1 to 8 UE 115 described or referred to in Figures 1 to 9 In some implementations, the UE or network entity may execute an instruction set to control the functional elements of the UE or network entity to perform the described functions. Additionally or alternatively, the UE or network entity may use dedicated hardware to perform various aspects of the described functions.

[0210] At 1105, the method may include: receiving a first message from a source device via a passive wireless device, the passive wireless device being associated with backscatter of the first message. The operations of 1105 may be performed according to examples disclosed herein. In some implementations, aspects of the operations of 1105 may be performed as described in reference to Figure 8 and Fig. 9 The described communication manager 820 or the communication manager 920 is performed.

[0211] At 1110, the method may include: decrypting the first message according to a PHY security key that protects communications between the passive wireless device and the reader device. The operations of 1110 may be performed according to examples disclosed herein. In some implementations, aspects of the operations of 1110 may be performed as described in reference to Figure 8 and Fig. 9 The described communication manager 820 or the communication manager 920 is performed.

[0212] Fig.12 A flow chart illustrating an example method 1200 for supporting PHY security for passive IoT devices is shown. The operations of the method 1200 may be implemented by a UE or a network entity or a component thereof as described herein. For example, the operations of the method 1200 may be implemented by a UE or a network entity or a component thereof as described herein. Figures 1 to 8 UE 115 as described or as referenced Figures 1 to 9 In some implementations, the UE or network entity may execute an instruction set to control the functional elements of the UE or network entity to perform the described functions. Additionally or alternatively, the UE or network entity may use dedicated hardware to perform various aspects of the described functions.

[0213] At 1205, the method may include: encrypting the first message according to a PHY security key, the PHY security key protecting the communication between the source device and the passive wireless device. The operation of 1205 may be performed according to the examples disclosed herein. In some specific implementations, various aspects of the operation of 1205 may be performed as described in reference to Figure 8 and Fig. 9 The described communication manager 820 or the communication manager 920 is performed.

[0214] At 1210, the method may include: sending a first message to a reader device via a passive wireless device, the passive wireless device being associated with backscatter of the first message. The operations of 1210 may be performed according to examples disclosed herein. In some implementations, aspects of the operations of 1210 may be performed as described in reference to Figure 8 and Fig. 9 The described communication manager 820 or the communication manager 920 is performed.

[0215] The following provides an overview of some aspects of the disclosure:

[0216] Aspect 1: A method for wireless communication at a passive wireless device, the method comprising: receiving a first message based on a first physical layer security key, wherein the first physical layer security key protects communication between a source device and the passive wireless device; and sending a second message via backscatter of the first message and based on a second physical layer security key, wherein the second physical layer security key protects communication between the passive wireless device and a reader device.

[0217] Aspect 2: The method according to aspect 1, further comprising: receiving an indication of the first physical layer security key, the second physical layer security key, or a combination thereof from one or both of the source device and the reader device.

[0218] Aspect 3: According to the method described in any one of Aspects 1 to 2, the method further includes: receiving a set of multiple commands, wherein the set of multiple commands is associated with the termination of the communication between the source device and the passive wireless device; and based on inputting timing information associated with the set of multiple commands into one or more key derivation functions, receiving one or both of the first physical layer security key and the second physical layer security key as outputs of the one or more key derivation functions.

[0219] Aspect 4: According to the method described in any one of Aspects 1 to 3, the method further includes: receiving a first group of one or more reference signals from the source device, wherein the first physical layer security key is associated with a first channel measurement of the first group of one or more reference signals; and receiving a second group of one or more reference signals from the reader device, wherein the second physical layer security key is associated with a second channel measurement of the second group of one or more reference signals.

[0220] Aspect 5: According to the method described in Aspect 4, the method also includes: receiving the first physical layer security key as an output of the first key derivation function based on inputting the first metric associated with the first channel measurement into the first key derivation function; and receiving the second physical layer security key as an output of the second key derivation function based on inputting the second metric associated with the second channel measurement into the second key derivation function.

[0221] Aspect 6: According to the method described in any one of Aspects 4 to 5, the method further includes: receiving a set of one or more commands, wherein the set of one or more commands is associated with the termination of the communication between the source device and the passive wireless device, wherein the timing of one or both of the first set of one or more reference signals and the second set of one or more reference signals is associated with the set of one or more commands, wherein the timing is also associated with the last command in the set of one or more commands and a fixed time duration between one or both of the first set of one or more reference signals and the second set of one or more reference signals.

[0222] Aspect 7: According to the method described in any one of Aspects 4 to 6, the method further includes: receiving an intermediate first physical layer security key as an output of a first key derivation function based on inputting a first metric associated with the first channel measurement into a first key derivation function; and receiving the first physical layer security key as an output of the second key derivation function based on inputting the intermediate first physical layer security key into a second key derivation function.

[0223] Aspect 8: According to the method described in any one of Aspects 4 to 7, the method further includes: receiving an intermediate second physical layer security key as an output of the first key derivation function based on inputting a second metric associated with the second channel measurement into a first key derivation function; and receiving the second physical layer security key as an output of the second key derivation function based on inputting the intermediate second physical layer security key into a second key derivation function.

[0224] Aspect 9: According to the method described in any one of Aspects 1 to 8, the method further includes: receiving an indication of a first group of physical layer security keys, wherein the first group of physical layer security keys protects communication between the source device and the passive wireless device, wherein the first physical layer security key is selected from the first group of physical layer security keys and is associated with the indication of the first group of physical layer security keys.

[0225] Aspect 10: A method according to Aspect 9, wherein the selection of the first physical layer security key from the first group of physical layer security keys is associated with: an indication of the selection made by the source device, a first channel measurement of a first channel between the source device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0226] Aspect 11: According to the method described in any one of Aspects 1 to 10, the method further includes: receiving an indication of a second set of physical layer security keys, wherein the second set of physical layer security keys protects the communication between the passive wireless device and the reader device, wherein the second physical layer security key is selected from the second set of physical layer security keys and is associated with the indication of the second set of physical layer security keys.

[0227] Aspect 12: A method according to Aspect 11, wherein the selection of the second physical layer security key from the second set of physical layer security keys is associated with: an indication of the selection made by the source device or the reader device, a second channel measurement of a second channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0228] Aspect 13: The method according to any one of aspects 1 to 12, wherein the first physical layer security key and the second physical layer security key are stored at the passive wireless device before receiving the first message and sending the second message.

[0229] Aspect 14: A method according to any one of Aspects 1 to 13, wherein the communication between the source device and the passive wireless device is protected by performing a first operation on the first message and the first physical layer security key, the first operation comprising one or more of the following: a first modulation operation, a first multiplication operation or a first logical exclusive OR operation, and wherein the communication between the reader device and the passive wireless device is protected by performing a second operation on the second message and the first physical layer security key, the second operation comprising one or more of the following: a second modulation operation, a second multiplication operation or a second logical exclusive OR operation.

[0230] Aspect 15: A method according to any one of Aspects 1 to 14, wherein the first message corresponds to a first radio wave associated with a first group of bits, and the second message corresponds to a second radio wave associated with a second group of bits, and the backscattering performed by the passive wireless device is associated with amplitude shift keying modulation of the first group of bits using the second group of bits via selective reflection performed by the passive wireless device.

[0231] Aspect 16: A method for wireless communication at a reader device, the method comprising: receiving a first message from a source device via a passive wireless device, the passive wireless device being associated with backscatter of the first message; and decrypting the first message based on a physical layer security key, the physical layer security key protecting communications between the passive wireless device and the reader device.

[0232] Aspect 17: The method according to aspect 16 further comprises: receiving an indication of the physical layer security key.

[0233] Aspect 18: According to the method of any one of Aspects 16 to 17, the method further includes: sending a set of one or more reference signals to the passive wireless device, wherein the physical layer security key is associated with a channel measurement of the set of one or more reference signals.

[0234] Aspect 19: The method according to aspect 18, the method further comprising: receiving the physical layer security key as an output of the key derivation function based on inputting the metric associated with the channel measurement into the key derivation function.

[0235] Aspect 20: According to the method described in any one of Aspects 18 to 19, the method further includes: receiving an intermediate physical layer security key as an output of a first key derivation function based on inputting a metric associated with the channel measurement into the first key derivation function; and receiving the physical layer security key as an output of the second key derivation function based on inputting the intermediate physical layer security key into the second key derivation function.

[0236] Aspect 21: According to a method described in any one of Aspects 16 to 20, the method further includes: receiving an indication of a set of physical layer security keys, wherein the set of physical layer security keys protects communications between the passive wireless device and the reader device, wherein the physical layer security key selected from the set of physical layer security keys is associated with the indication of the set of physical layer security keys.

[0237] Aspect 22: A method according to Aspect 21, wherein the selection of the physical layer security key from the set of physical layer security keys is associated with: an indication of the selection made by the source device to the reader device, a channel measurement of the channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0238] Aspect 23: A method according to any one of Aspects 16 to 22, wherein receiving the first message further comprises: receiving the first message according to a second physical layer security key, wherein the second physical layer security key protects communication between the source device and the reader device.

[0239] Aspect 24: The method according to aspect 23 further comprises: receiving an indication of the second physical layer security key.

[0240] Aspect 25: According to the method described in any one of Aspects 16 to 24, the method also includes: sending a second message to the passive wireless device based on a second physical layer security key, wherein the second physical layer security key protects the communication between the reader device and the passive wireless device, wherein the source device and the reader device are the same device, and wherein the first message is a backscattered version of the second message.

[0241] Aspect 26: A method for wireless communication at a source device, the method comprising: encrypting a first message based on a physical layer security key, the physical layer security key protecting communications between the source device and a passive wireless device; and sending the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0242] Aspect 27: The method according to aspect 26, the method further comprising: sending an indication of the physical layer security key to the passive wireless device.

[0243] Aspect 28: According to the method described in any one of Aspects 26 to 27, the method further includes: sending a set of multiple commands to the passive wireless device, wherein the set of multiple commands is associated with the termination of the communication between the source device and the passive wireless device; and receiving the physical layer security key as an output of the key derivation function based on inputting timing information associated with the set of multiple commands into the key derivation function.

[0244] Aspect 29: According to any one of Aspects 26 to 28, the method further includes: sending a set of one or more reference signals to the passive wireless device, wherein the physical layer security key is associated with a channel measurement of the set of one or more reference signals.

[0245] Aspect 30: The method according to aspect 29, further comprising: receiving the physical layer security key as an output of the key derivation function based on inputting the metric associated with the channel measurement into the key derivation function.

[0246] Aspect 31: According to the method described in any one of Aspects 29 to 30, the method further includes: sending a set of one or more commands to the passive wireless device, the set of one or more commands being associated with the termination of the communication between the source device and the passive wireless device, wherein the timing of the set of one or more reference signals is associated with the set of one or more commands, wherein the timing is also associated with a fixed time duration between the last command in the set of one or more commands and the set of one or more reference signals.

[0247] Aspect 32: According to the method described in any one of Aspects 29 to 31, the method further includes: receiving an intermediate physical layer security key as an output of a first key derivation function based on inputting a metric associated with the channel measurement into the first key derivation function; and receiving the physical layer security key as an output of the second key derivation function based on inputting the intermediate physical layer security key into the second key derivation function.

[0248] Aspect 33: According to the method described in any one of Aspects 26 to 32, the method further includes: sending an indication of a set of physical layer security keys to the passive wireless device, wherein the set of physical layer security keys protects the communication between the source device and the passive wireless device, wherein the physical layer security key selected from the set of physical layer security keys is associated with the indication of the set of physical layer security keys.

[0249] Aspect 34: A method according to Aspect 33, wherein the selection of the physical layer security key from the set of physical layer security keys is associated with: an indication of the selection made by the source device to the passive wireless device, a channel measurement of the channel between the source device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0250] Aspect 35: According to the method described in any one of Aspects 26 to 34, the method also includes: sending an indication of a second physical layer security key to one or both of the passive wireless device and the reader device, wherein the second physical layer security key protects the communication between the passive wireless device and the reader device.

[0251] Aspect 36: According to the method described in any one of Aspects 26 to 35, the method also includes: sending an indication of a second set of physical layer security keys to one or both of the passive wireless device and the reader device, the second set of physical layer security keys protecting the communication between the passive wireless device and the reader device, wherein a second physical layer security key selected from the second set of physical layer security keys is associated with the indication of the second set of physical layer security keys.

[0252] Aspect 37: A method according to Aspect 36, wherein the selection of the second physical layer security key from the second set of physical layer security keys is associated with: an indication of the selection made by the source device to the passive wireless device, a channel measurement of the channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0253] Aspect 38: A method according to any one of Aspects 26 to 37, wherein sending the first message comprises: sending the first message according to a second physical layer security key, wherein the second physical layer security key protects communication between the source device and the reader device.

[0254] Aspect 39: The method according to aspect 38, the method further comprising: sending an indication of the second physical layer security key to the reader device.

[0255] Aspect 40: According to the method described in any one of Aspects 26 to 39, the method also includes: receiving a second message from the passive wireless device based on a second physical layer security key, wherein the second physical layer security key protects the communication between the reader device and the passive wireless device, wherein the source device and the reader device are the same device, and wherein the second message is a backscattered version of the first message.

[0256] Aspect 41: An apparatus for wireless communication at a passive wireless device, the apparatus comprising: an interface, the interface being configured to: obtain a first message based on a first physical layer (PHY) security key, the first physical layer (PHY) security key protecting communication between a source device and the passive wireless device; and output a second message via backscattering of the first message and based on a second PHY security key, the second PHY security key protecting communication between the passive wireless device and a reader device.

[0257] Aspect 42: The apparatus of aspect 41, wherein the interface is further configured to obtain an indication of the first PHY security key, the second PHY security key, or a combination thereof from one or both of the source device and the reader device.

[0258] Aspect 43: An apparatus according to any one of Aspects 41 to 42, wherein: the interface is further configured to: obtain a set of multiple commands, the set of multiple commands being associated with the termination of the communication between the source device and the passive wireless device; and the processing system is configured to: obtain one or both of the first PHY security key and the second PHY security key as output of the one or more key derivation functions based on inputting timing information associated with the set of multiple commands into one or more key derivation functions.

[0259] Aspect 44: An apparatus according to any one of Aspects 41 to 43, wherein the interface is further configured to: obtain a first group of one or more reference signals from the source device, wherein the first PHY security key is associated with a first channel measurement of the first group of one or more reference signals; and obtain a second group of one or more reference signals from the reader device, wherein the second PHY security key is associated with a second channel measurement of the second group of one or more reference signals.

[0260] Aspect 45: An apparatus according to Aspect 44, wherein the apparatus includes a processing system, the processing system being configured to: obtain the first PHY security key as an output of a first key derivation function based on inputting a first metric associated with the first channel measurement into a first key derivation function; and obtain the second PHY security key as an output of the second key derivation function based on inputting a second metric associated with the second channel measurement into a second key derivation function.

[0261] Aspect 46: An apparatus according to any one of Aspects 44 to 45, wherein the interface is further configured to: obtain a set of one or more commands, the set of one or more commands being associated with the termination of the communication between the source device and the passive wireless device, wherein the timing of one or both of the first set of one or more reference signals and the second set of one or more reference signals is associated with the set of one or more commands, wherein the timing is also associated with a fixed time duration between the last command in the set of one or more commands and one or both of the first set of one or more reference signals and the second set of one or more reference signals.

[0262] Aspect 47: An apparatus according to any one of Aspects 44 to 46, wherein the apparatus includes a processing system, the processing system being configured to: obtain an intermediate first PHY security key as an output of a first key derivation function based on inputting a first metric associated with the first channel measurement into the first key derivation function; and obtain the first PHY security key as an output of the second key derivation function based on inputting the intermediate first PHY security key into a second key derivation function.

[0263] Aspect 48: An apparatus according to any one of Aspects 44 to 47, wherein the apparatus includes a processing system configured to: obtain an intermediate second PHY security key as an output of the first key derivation function based on inputting a second metric associated with the second channel measurement into a first key derivation function; and obtain the second PHY security key as an output of the second key derivation function based on inputting the intermediate second PHY security key into a second key derivation function.

[0264] Aspect 49: An apparatus according to any one of Aspects 41 to 48, wherein the interface is further configured to: obtain an indication of a first group of PHY security keys, wherein the first group of PHY security keys protects communications between the source device and the passive wireless device, wherein the first PHY security key is selected from the first group of PHY security keys and is associated with the indication of the first group of PHY security keys.

[0265] Aspect 50: An apparatus according to Aspect 49, wherein the selection of the first PHY security key from the first group of PHY security keys is associated with: an indication of the selection made by the source device, a first channel measurement of a first channel between the source device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0266] Aspect 51: An apparatus according to any one of Aspects 41 to 50, wherein the interface is further configured to: obtain an indication of a second set of PHY security keys, wherein the second set of PHY security keys protects communications between the passive wireless device and the reader device, wherein selecting the second PHY security key from the second set of PHY security keys is associated with the indication of the second set of PHY security keys.

[0267] Aspect 52: An apparatus according to Aspect 51, wherein the selection of the second PHY security key from the second set of PHY security keys is associated with the following: an indication of the selection made by the source device or the reader device, a second channel measurement of a second channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0268] Aspect 53: An apparatus according to any one of Aspects 41 to 52, wherein the first PHY security key and the second PHY security key are stored at the passive wireless device before receiving the first message and sending the second message.

[0269] Aspect 54: An apparatus according to any one of Aspects 41 to 53, wherein: the communication between the source device and the passive wireless device is protected by performing a first operation on the first message and the first PHY security key, the first operation comprising one or more of the following: a first modulation operation, a first multiplication operation, or a first logical exclusive OR operation; and the communication between the reader device and the passive wireless device is protected by performing a second operation on the second message and the first PHY security key, the second operation comprising one or more of the following: a second modulation operation, a second multiplication operation, or a second logical exclusive OR operation.

[0270] Aspect 55: An apparatus according to any one of Aspects 41 to 54, wherein: the first message corresponds to a first radio wave associated with a first group of bits, and the second message corresponds to a second radio wave associated with a second group of bits; and the backscattering performed by the passive wireless device is associated with amplitude shift keying modulation of the first group of bits using the second group of bits via selective reflection performed by the passive wireless device.

[0271] Aspect 56: An apparatus for wireless communication at a reader device, the apparatus comprising: an interface configured to obtain a first message from a source device via a passive wireless device, the passive wireless device being associated with backscatter of the first message; and a processing system configured to decrypt the first message based on a physical layer (PHY) security key, the physical layer (PHY) security key protecting communications between the passive wireless device and the reader device.

[0272] Aspect 57: The apparatus of aspect 56, wherein the interface is further configured to: obtain an indication of the PHY security key.

[0273] Aspect 58: An apparatus according to any one of Aspects 56 to 57, wherein the interface is further configured to: output a set of one or more reference signals to the passive wireless device, wherein the PHY security key is associated with a channel measurement of the set of one or more reference signals.

[0274] Aspect 59: The apparatus of aspect 58, wherein the processing system is further configured to obtain the PHY security key as an output of a key derivation function based on inputting a metric associated with the channel measurement into the key derivation function.

[0275] Aspect 60: An apparatus according to any one of Aspects 58 to 59, wherein the processing system is further configured to: obtain an intermediate PHY security key as an output of a first key derivation function based on inputting a metric associated with the channel measurement into the first key derivation function; and obtain the PHY security key as an output of the second key derivation function based on inputting the intermediate PHY security key into a second key derivation function.

[0276] Aspect 61: An apparatus according to any one of Aspects 56 to 60, wherein the interface is further configured to: obtain an indication of a set of PHY security keys, wherein the set of PHY security keys protects communications between the passive wireless device and the reader device, wherein selecting the PHY security key from the set of PHY security keys is associated with the indication of the set of PHY security keys.

[0277] Aspect 62: An apparatus according to Aspect 61, wherein the selection of the PHY security key from the set of PHY security keys is associated with: an indication of the selection made by the source device to the reader device, a channel measurement of a channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0278] Aspect 63: An apparatus according to any one of Aspects 56 to 62, wherein, in order to obtain the first message, the interface is further configured to: obtain the first message according to a second PHY security key, wherein the second PHY security key protects communication between the source device and the reader device.

[0279] Aspect 64: The apparatus of aspect 63, wherein the interface is further configured to: obtain an indication of the second PHY security key.

[0280] Aspect 65: An apparatus according to any one of Aspects 56 to 64, wherein the interface is further configured to: output a second message to the passive wireless device based on a second PHY security key, the second PHY security key protecting communication between the reader device and the passive wireless device, wherein the source device and the reader device are the same device, and wherein the first message is a backscattered version of the second message.

[0281] Aspect 66: An apparatus for wireless communication at a source device, the apparatus comprising: a processing system, the processing system being configured to: encrypt a first message based on a physical layer (PHY) security key, the physical layer (PHY) security key protecting communications between the source device and a passive wireless device; and an interface, the interface being configured to: output the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0282] Aspect 67: The apparatus of aspect 66, wherein the interface is further configured to: output an indication of the PHY security key to the passive wireless device.

[0283] Aspect 68: An apparatus according to any one of Aspects 66 to 67, wherein: the interface is further configured to: output a set of multiple commands to the passive wireless device, the set of multiple commands being associated with the termination of the communication between the source device and the passive wireless device; and the processing system is further configured to: obtain the PHY security key as an output of the key derivation function based on inputting timing information associated with the set of multiple commands into the key derivation function.

[0284] Aspect 69: An apparatus according to any one of Aspects 66 to 68, wherein the interface is further configured to: output a set of one or more reference signals to the passive wireless device, wherein the PHY security key is associated with a channel measurement of the set of one or more reference signals.

[0285] Aspect 70: The apparatus according to aspect 69, wherein the processing system is further configured to: obtain the PHY security key as an output of the key derivation function based on inputting a metric associated with the channel measurement into the key derivation function.

[0286] Aspect 71: An apparatus according to any one of Aspects 69 to 70, wherein the interface is further configured to: output a set of one or more commands to the passive wireless device, the set of one or more commands being associated with the termination of the communication between the source device and the passive wireless device, wherein the timing of the set of one or more reference signals is associated with the set of one or more commands, wherein the timing is also associated with a fixed time duration between the last command in the set of one or more commands and the set of one or more reference signals.

[0287] Aspect 72: An apparatus according to any one of Aspects 69 to 71, wherein the processing system is further configured to: obtain an intermediate PHY security key as an output of a first key derivation function based on inputting a metric associated with the channel measurement into the first key derivation function; and obtain the PHY security key as an output of the second key derivation function based on inputting the intermediate PHY security key into a second key derivation function.

[0288] Aspect 73: An apparatus according to any one of Aspects 66 to 72, wherein the interface is further configured to: output an indication of a set of PHY security keys to the passive wireless device, wherein the set of PHY security keys protects communications between the source device and the passive wireless device, wherein selecting the PHY security key from the set of PHY security keys is associated with the indication of the set of PHY security keys.

[0289] Aspect 74: An apparatus according to Aspect 73, wherein the selection of the PHY security key from the set of PHY security keys is associated with: an indication of the selection made by the source device or the passive wireless device, a channel measurement of a channel between the source device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0290] Aspect 75: An apparatus according to any one of Aspects 66 to 74, wherein the interface is further configured to: output an indication of a second PHY security key to one or both of the passive wireless device and the reader device, the second PHY security key protecting communications between the passive wireless device and the reader device.

[0291] Aspect 76: An apparatus according to any one of Aspects 66 to 75, wherein the interface is further configured to: output an indication of a second set of PHY security keys to one or both of the passive wireless device and the reader device, the second set of PHY security keys protecting communications between the passive wireless device and the reader device, wherein selecting a second PHY security key from the second set of PHY security keys is associated with the indication of the second set of PHY security keys.

[0292] Aspect 77: An apparatus according to Aspect 76, wherein the selection of the second PHY security key from the second set of PHY security keys is associated with: an indication of the selection made by the source device to the passive wireless device, a channel measurement of a channel between the source device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the reader device and the passive wireless device, or any combination thereof.

[0293] Aspect 78: An apparatus according to any one of Aspects 66 to 77, wherein, in order to output the first message, the interface is further configured to: output the first message according to a second physical layer security key, and the second PHY security key protects the communication between the source device and the reader device.

[0294] Aspect 79: The apparatus of aspect 78, wherein the interface is further configured to: output an indication of the second PHY security key to the reader device.

[0295] Aspect 80: An apparatus according to any one of Aspects 66 to 79, wherein the interface is further configured to: obtain a second message from the passive wireless device based on a second PHY security key, wherein the second PHY security key protects communication between the passive wireless device and the reader device, wherein the source device and the reader device are the same device, and wherein the second message is a backscattered version of the first message.

[0296] Aspect 81: An apparatus for wireless communication at a passive wireless device, the apparatus comprising: a component for receiving a first message based on a first physical layer security key, wherein the first physical layer security key protects communication between a source device and the passive wireless device; and a component for sending a second message via backscatter of the first message and based on a second physical layer security key, wherein the second physical layer security key protects communication between the passive wireless device and a reader device.

[0297] Aspect 82: The apparatus according to aspect 81, further comprising: means for receiving an indication of the first physical layer security key, the second physical layer security key, or a combination thereof from one or both of the source device and the reader device.

[0298] Aspect 83: An apparatus according to any one of Aspects 81 to 82, the apparatus comprising: a component for receiving a set of multiple commands, the set of multiple commands being associated with the termination of the communication between the source device and the passive wireless device; and a component for receiving one or both of the first physical layer security key and the second physical layer security key as outputs of the one or more key derivation functions based on inputting timing information associated with the set of multiple commands into the one or more key derivation functions.

[0299] Aspect 84: An apparatus according to any one of Aspects 81 to 83, the apparatus comprising: a component for receiving a first group of one or more reference signals from the source device, wherein the first physical layer security key is associated with a first channel measurement of the first group of one or more reference signals; and a component for receiving a second group of one or more reference signals from the reader device, wherein the second physical layer security key is associated with a second channel measurement of the second group of one or more reference signals.

[0300] Aspect 85: According to the device of Aspect 84, the device also includes: a component for receiving the first physical layer security key as the output of the first key derivation function based on inputting the first metric associated with the first channel measurement into the first key derivation function; and a component for receiving the second physical layer security key as the output of the second key derivation function based on inputting the second metric associated with the second channel measurement into the second key derivation function.

[0301] Aspect 86: An apparatus according to any one of Aspects 84 to 85, the apparatus comprising: a component for receiving a set of one or more commands, the set of one or more commands being associated with the termination of the communication between the source device and the passive wireless device, wherein the timing of one or both of the first set of one or more reference signals and the second set of one or more reference signals is associated with the set of one or more commands, wherein the timing is also associated with a fixed time duration between the last command in the set of one or more commands and one or both of the first set of one or more reference signals and the second set of one or more reference signals.

[0302] Aspect 87: An apparatus according to any one of Aspects 84 to 86, the apparatus comprising: a component for receiving an intermediate first physical layer security key as an output of a first key derivation function based on inputting a first metric associated with the first channel measurement into a first key derivation function; and a component for receiving the first physical layer security key as an output of a second key derivation function based on inputting the intermediate first physical layer security key into a second key derivation function.

[0303] Aspect 88: An apparatus according to any one of Aspects 84 to 87, the apparatus comprising: a component for receiving an intermediate second physical layer security key as an output of the first key derivation function based on inputting a second metric associated with the second channel measurement into the first key derivation function; and a component for receiving the second physical layer security key as an output of the second key derivation function based on inputting the intermediate second physical layer security key into the second key derivation function.

[0304] Aspect 89: An apparatus according to any one of Aspects 81 to 88, the apparatus comprising: a component for receiving an indication of a first set of physical layer security keys, wherein the first set of physical layer security keys protects communications between the source device and the passive wireless device, wherein the first physical layer security key is selected from the first set of physical layer security keys and is associated with the indication of the first set of physical layer security keys.

[0305] Aspect 90: An apparatus according to Aspect 89, wherein the selection of the first physical layer security key from the first group of physical layer security keys is associated with: an indication of the selection made by the source device, a first channel measurement of a first channel between the source device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0306] Aspect 91: An apparatus according to any one of Aspects 81 to 90, the apparatus comprising: a component for receiving an indication of a second set of physical layer security keys, wherein the second set of physical layer security keys protects communications between the passive wireless device and the reader device, wherein the second physical layer security key is selected from the second set of physical layer security keys and is associated with the indication of the second set of physical layer security keys.

[0307] Aspect 92: An apparatus according to Aspect 91, wherein the selection of the second physical layer security key from the second set of physical layer security keys is associated with: an indication of the selection made by the source device or the reader device, a second channel measurement of a second channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0308] Aspect 93: An apparatus according to any one of Aspects 81 to 92, wherein the first physical layer security key and the second physical layer security key are stored at the passive wireless device before receiving the first message and sending the second message.

[0309] Aspect 94: An apparatus according to any one of Aspects 81 to 93, wherein a first modulation operation, a first multiplication operation or a first logical exclusive OR operation, and wherein the communication between the reader device and the passive wireless device is protected by performing a second operation on the second message and the first physical layer security key, the second operation comprising one or more of: a second modulation operation, a second multiplication operation or a second logical exclusive OR operation.

[0310] Aspect 95: An apparatus according to any one of Aspects 81 to 94, wherein the first message corresponds to a first radio wave associated with a first group of bits, and the second message corresponds to a second radio wave associated with a second group of bits, and the backscattering performed by the passive wireless device is associated with amplitude shift keying modulation of the first group of bits using the second group of bits via selective reflection performed by the passive wireless device.

[0311] Aspect 96: An apparatus for wireless communication at a reader device, the apparatus comprising: a component for receiving a first message from a source device via a passive wireless device, the passive wireless device being associated with backscatter of the first message; and a component for decrypting the first message based on a physical layer security key, the physical layer security key protecting communications between the passive wireless device and the reader device.

[0312] Aspect 97: The apparatus according to Aspect 96, further comprising: means for receiving an indication of the physical layer security key.

[0313] Aspect 98: An apparatus according to any one of Aspects 96 to 97, the apparatus comprising: a component for sending a set of one or more reference signals to the passive wireless device, wherein the physical layer security key is associated with a channel measurement of the set of one or more reference signals.

[0314] Aspect 99: The apparatus according to Aspect 98, further comprising: means for receiving the physical layer security key as an output of the key derivation function based on inputting a metric associated with the channel measurement into the key derivation function.

[0315] Aspect 100: An apparatus according to any one of Aspects 98 to 99, the apparatus comprising: a component for receiving an intermediate physical layer security key as an output of a first key derivation function based on inputting a metric associated with the channel measurement into the first key derivation function; and a component for receiving the physical layer security key as an output of a second key derivation function based on inputting the intermediate physical layer security key into the second key derivation function.

[0316] Aspect 101: An apparatus according to any one of Aspects 96 to 100, the apparatus comprising: a component for receiving an indication of a set of physical layer security keys, wherein the set of physical layer security keys protects communications between the passive wireless device and the reader device, wherein the physical layer security key selected from the set of physical layer security keys is associated with the indication of the set of physical layer security keys.

[0317] Aspect 102: An apparatus according to Aspect 101, wherein the selection of the physical layer security key from the set of physical layer security keys is associated with: an indication of the selection made by the source device to the reader device, a channel measurement of a channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0318] Aspect 103: An apparatus according to any one of Aspects 96 to 102, wherein the component for receiving the first message also includes: a component for receiving the first message based on a second physical layer security key, and the second physical layer security key protects the communication between the source device and the reader device.

[0319] Aspect 104: The apparatus according to Aspect 103, further comprising: means for receiving an indication of the second physical layer security key.

[0320] Aspect 105: An apparatus according to any one of Aspects 96 to 104, the apparatus further comprising: a component for sending a second message to the passive wireless device based on a second physical layer security key, wherein the second physical layer security key protects communication between the reader device and the passive wireless device, wherein the source device and the reader device are the same device, and wherein the first message is a backscattered version of the second message.

[0321] Aspect 106: An apparatus for wireless communication at a source device, the apparatus comprising: a component for encrypting a first message based on a physical layer security key, the physical layer security key protecting communications between the source device and a passive wireless device; and a component for sending the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0322] Aspect 107: The apparatus according to aspect 106, the apparatus further comprising: means for sending an indication of the physical layer security key to the passive wireless device.

[0323] Aspect 108: An apparatus according to any one of Aspects 106 to 107, the apparatus further comprising: a component for sending a set of multiple commands to the passive wireless device, the set of multiple commands being associated with the termination of the communication between the source device and the passive wireless device; and a component for receiving the physical layer security key as an output of the key derivation function based on inputting timing information associated with the set of multiple commands into the key derivation function.

[0324] Aspect 109: An apparatus according to any one of Aspects 106 to 108, the apparatus comprising: a component for sending a set of one or more reference signals to the passive wireless device, wherein the physical layer security key is associated with a channel measurement of the set of one or more reference signals.

[0325] Aspect 110: The apparatus of aspect 109, further comprising means for receiving the physical layer security key as an output of a key derivation function based on inputting a metric associated with the channel measurement into the key derivation function.

[0326] Aspect 111: An apparatus according to any one of Aspects 109 to 110, the apparatus further comprising: a component for sending a set of one or more commands to the passive wireless device, the set of one or more commands being associated with the termination of the communication between the source device and the passive wireless device, wherein the timing of the set of one or more reference signals is associated with the set of one or more commands, wherein the timing is also associated with a fixed time duration between the last command in the set of one or more commands and the set of one or more reference signals.

[0327] Aspect 112: An apparatus according to any one of Aspects 109 to 111, the apparatus comprising: a component for receiving an intermediate physical layer security key as an output of a first key derivation function based on inputting a metric associated with the channel measurement into the first key derivation function; and a component for receiving the physical layer security key as an output of a second key derivation function based on inputting the intermediate physical layer security key into the second key derivation function.

[0328] Aspect 113: An apparatus according to any one of Aspects 106 to 112, the apparatus further comprising: a component for sending an indication of a set of physical layer security keys to the passive wireless device, the set of physical layer security keys protecting communications between the source device and the passive wireless device, wherein the physical layer security key selected from the set of physical layer security keys is associated with the indication of the set of physical layer security keys.

[0329] Aspect 114: An apparatus according to Aspect 113, wherein the selection of the physical layer security key from the set of physical layer security keys is associated with: an indication of the selection made by the source device to the passive wireless device, a channel measurement of a channel between the source device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0330] Aspect 115: An apparatus according to any one of Aspects 106 to 114, the apparatus further comprising: a component for sending an indication of a second physical layer security key to one or both of the passive wireless device and the reader device, wherein the second physical layer security key protects communications between the passive wireless device and the reader device.

[0331] Aspect 116: An apparatus according to any one of Aspects 106 to 115, the apparatus further comprising: a component for sending an indication of a second set of physical layer security keys to one or both of the passive wireless device and the reader device, the second set of physical layer security keys protecting communications between the passive wireless device and the reader device, wherein a second physical layer security key selected from the second set of physical layer security keys is associated with the indication of the second set of physical layer security keys.

[0332] Aspect 117: An apparatus according to Aspect 116, wherein the selection of the second physical layer security key from the second set of physical layer security keys is associated with: an indication of the selection made by the source device to the passive wireless device, a channel measurement of a channel between the reader device and the passive wireless device, timing information of a set of multiple commands associated with termination of the communication between the source device and the passive wireless device, or any combination thereof.

[0333] Aspect 118: An apparatus according to any one of Aspects 106 to 117, wherein the component for sending the first message includes: a component for sending the first message according to a second physical layer security key, wherein the second physical layer security key protects communication between the source device and the reader device.

[0334] Aspect 119: The apparatus according to aspect 118, the apparatus further comprising: means for sending an indication of the second physical layer security key to the reader device.

[0335] Aspect 120: An apparatus according to any one of Aspects 106 to 119, the apparatus further comprising: a component for receiving a second message from the passive wireless device based on a second physical layer security key, wherein the second physical layer security key protects communication between the reader device and the passive wireless device, wherein the source device and the reader device are the same device, and wherein the second message is a backscattered version of the first message.

[0336] Aspect 121: A non-transitory computer-readable medium storing code for wireless communication at a passive wireless device, the code comprising instructions executable by a processor to perform the following operations: receiving a first message based on a first physical layer security key, the first physical layer security key protecting communication between a source device and the passive wireless device; and sending a second message via backscatter of the first message and based on a second physical layer security key, the second physical layer security key protecting communication between the passive wireless device and a reader device.

[0337] Aspect 122: A non-transitory computer-readable medium storing code for wireless communication at a reader device, the code comprising instructions executable by a processor to: receive a first message from a source device via a passive wireless device, the passive wireless device being associated with backscatter of the first message; and decrypting the first message based on a physical layer security key, the physical layer security key protecting communications between the passive wireless device and the reader device.

[0338] Aspect 123: A non-transitory computer-readable medium storing code for wireless communication at a source device, the code comprising instructions executable by a processor to: encrypt a first message based on a physical layer security key, the physical layer security key protecting communications between the source device and a passive wireless device; and send the first message to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

[0339] As used herein, the terms "determine" or "determine" encompass a wide variety of actions, and thus, "determining" may include calculating, computing, processing, deriving, investigating, looking up (such as via looking up in a table, a database or another data structure), reasoning, ascertaining, etc. Additionally, "determining" may include receiving (such as receiving information), accessing (such as accessing data in a memory), etc. Additionally, "determining" may include resolving, selecting, choosing, establishing, and other such similar actions.

[0340] As used herein, a phrase referring to "at least one of" a list of items refers to any combination of those items (including single members). As an example, "at least one of a, b, or c" is intended to cover: a, b, c, ab, ac, bc, and abc.

[0341] The various illustrative logical components, logic blocks, modules, circuits, and algorithmic processes described in conjunction with the specific implementations disclosed herein may be implemented as electronic hardware, computer software, or a combination of both. The interchangeability of hardware and software has been generally described in terms of functionality and is exemplified in the various illustrative components, blocks, modules, circuits, and processes described above. Whether such functionality is implemented in hardware or software depends on the specific application and the design constraints imposed on the overall system.

[0342] The hardware and data processing apparatus for implementing the various exemplary logic components, logic blocks, modules and circuits described in conjunction with the various aspects disclosed herein may be implemented or executed using a general purpose single-chip or multi-chip processor, a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic component, a discrete hardware component or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, or any processor, controller, microcontroller or state machine. A processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. In some specific implementations, specific processes and methods may be performed by circuits specific to a given function.

[0343] In one or more aspects, the functions described may be implemented in hardware, digital electronic circuitry, computer software, firmware, including the structures disclosed in this specification and their structural equivalents, or any combination thereof. Specific implementations of the subject matter described in this specification may also be implemented as one or more computer programs, such as one or more modules of computer program instructions encoded on computer storage media for execution by a data processing device or for controlling the operation of a data processing device.

[0344] If implemented in software, the function may be stored as one or more instructions or codes on a computer-readable medium or sent via a computer-readable medium. The process of the method or algorithm disclosed herein may be implemented in a processor executable software module that may reside on a computer-readable medium. Computer-readable media include both computer storage media and communication media, and the communication media include any medium that can realize the transfer of a computer program from one place to another. The storage medium may be any available medium that a computer can access. By way of example and not limitation, such computer-readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, disk storage devices or other magnetic storage devices, or any other medium that can be used to store the desired program code in the form of an instruction or data structure and can be accessed by a computer. In addition, any connection may be appropriately referred to as a computer-readable medium. Disks and optical disks as used herein include compact disks (CDs), laser disks, optical disks, digital versatile disks (DVDs), floppy disks, and blue-ray disks, wherein disks generally reproduce data magnetically, and optical disks reproduce data optically with lasers. The above combination should also be included in the scope of computer-readable media. Additionally, the operations of a method or algorithm may reside as a code and instruction set, or any combination of code and instruction sets, on a machine-readable medium or computer-readable medium, which may be incorporated into a computer program product.

[0345] Various modifications to the specific implementations described in this disclosure will be apparent to those skilled in the art, and the general principles defined herein may be applied to other specific implementations without departing from the spirit or scope of the disclosure. Thus, the claims are not intended to be limited to the specific implementations shown herein, but should be granted the widest scope consistent with the disclosure, the principles and features disclosed herein.

[0346] Additionally, one of ordinary skill in the art will readily recognize that the terms "upper" and "lower" are sometimes used for ease of describing the drawings and indicate relative positions corresponding to the orientation of the drawings on a correctly oriented page, and may not reflect the correct orientation of any device as implemented.

[0347] Certain features described in this specification in the context of a single implementation may also be implemented in combination in a single implementation. Conversely, various features described in the context of separate implementations may also be implemented in multiple implementations individually or in any suitable subcombination. Furthermore, while features may be described above as functioning in some combination and even initially claimed as such, one or more features from a claimed combination may be removed from the combination, and a claimed combination may involve subcombinations or variations of subcombinations.

[0348] Similarly, although the operations are depicted in a specific order in the accompanying drawings, this should not be understood as requiring such operations to be performed in the specific order shown or in a sequential order, or to perform all illustrated operations to achieve the desired result. In addition, the accompanying drawings can schematically depict one or more example processes in the form of a flow chart. However, other operations not depicted can be incorporated into the example processes schematically illustrated. For example, one or more additional operations can be performed before, after, at the same time, or between any operations in the illustrated operations. In some environments, multitasking and parallel processing may be advantageous. In addition, the separation of various system components in the specific implementation described above should not be understood as requiring such separation in all specific implementations, but it should be understood that the described program components and systems can usually be integrated together in a single software product, or be packaged in multiple software products. In addition, other specific implementations are within the scope of the following claims. In some specific implementations, the actions narrated in the claims can be performed in different orders and still achieve the desired result.

Claims

1. An apparatus for wireless communication at a passive wireless device, the apparatus comprising: interface, the interface being configured as: obtaining a first message based on a first physical layer (PHY) security key, the first physical layer (PHY) security key protecting communications between a source device and the passive wireless device; as well as A second message is output via backscatter of the first message and in accordance with a second PHY security key that protects communications between the passive wireless device and a reader device.

2. The apparatus according to claim 1, wherein the interface is further configured to: An indication of the first PHY security key, the second PHY security key, or a combination thereof is obtained from one or both of the source device and the reader device.

3. The device according to claim 1, wherein: The interface is further configured as: obtaining a plurality of commands associated with termination of communications between the source device and the passive wireless device; and The processing system is configured to: Based on inputting timing information associated with the plurality of commands into one or more key derivation functions, one or both of the first PHY security key and the second PHY security key are obtained as outputs of the one or more key derivation functions.

4. The apparatus of claim 1, wherein the interface is further configured to: obtaining a first set of one or more reference signals from the source device, wherein the first PHY security key is associated with a first channel measurement of the first set of one or more reference signals; and A second set of one or more reference signals is obtained from the reader device, wherein the second PHY security key is associated with a second channel measurement of the second set of one or more reference signals.

5. The apparatus of claim 4, wherein the apparatus comprises a processing system configured to: obtaining the first PHY security key as an output of a first key derivation function based on inputting a first metric associated with the first channel measurement into a first key derivation function; and The second PHY security key is obtained as an output of a second key derivation function based on inputting a second metric associated with the second channel measurement into the second key derivation function.

6. The apparatus of claim 4, wherein the interface is further configured to: Obtaining a set of one or more commands associated with termination of the communication between the source device and the passive wireless device, wherein timing of one or both of the first set of one or more reference signals and the second set of one or more reference signals is associated with the set of one or more commands, wherein the timing is also associated with a fixed time duration between a last command in the set of one or more commands and one or both of the first set of one or more reference signals and the second set of one or more reference signals.

7. The apparatus of claim 4, wherein the apparatus comprises a processing system configured to: obtaining an intermediate first PHY security key as an output of a first key derivation function based on inputting a first metric associated with the first channel measurement into the first key derivation function; and Based on inputting the intermediate first PHY security key into a second key derivation function, the first PHY security key is obtained as an output of the second key derivation function.

8. The apparatus of claim 4, wherein the apparatus comprises a processing system configured to: obtaining an intermediate second PHY security key as an output of the first key derivation function based on inputting a second metric associated with the second channel measurement into the first key derivation function; and Based on inputting the intermediate second PHY security key into a second key derivation function, the second PHY security key is obtained as an output of the second key derivation function.

9. The apparatus of claim 1, wherein the interface is further configured to: An indication of a first set of PHY security keys is obtained, the first set of PHY security keys protecting communications between the source device and the passive wireless device, wherein the first PHY security key is selected from the first set of PHY security keys to be associated with the indication of the first set of PHY security keys.

10. The apparatus of claim 1, wherein the interface is further configured to: An indication of a second set of PHY security keys is obtained, the second set of PHY security keys protecting communications between the passive wireless device and the reader device, wherein the second PHY security key is selected from the second set of PHY security keys to be associated with the indication of the second set of PHY security keys.

11. The apparatus of claim 1, wherein the first PHY security key and the second PHY security key are stored at the passive wireless device prior to receiving the first message and sending the second message.

12. The device according to claim 1, wherein: protecting the communication between the source device and the passive wireless device based on performing a first operation on the first message and the first PHY security key, the first operation comprising one or more of: a first modulation operation, a first multiplication operation, or a first logical exclusive-OR operation; and The communication between the reader device and the passive wireless device is protected based on performing a second operation on the second message and the first PHY security key, the second operation comprising one or more of: a second modulation operation, a second multiplication operation, or a second logical exclusive-OR operation.

13. The device according to claim 1, wherein: The first message corresponds to a first radio wave associated with a first set of bits, and the second message corresponds to a second radio wave associated with a second set of bits; and The backscattering by the passive wireless device is associated with amplitude shift keying modulation of the first set of bits with the second set of bits via selective reflection by the passive wireless device.

14. An apparatus for wireless communication at a reader device, the apparatus comprising: interface, the interface being configured as: obtaining a first message from a source device via a passive wireless device associated with backscatter of the first message; and A processing system, the processing system being configured to: The first message is decrypted according to a physical layer (PHY) security key that protects communications between the passive wireless device and the reader device.

15. The apparatus of claim 14, wherein the interface is further configured to: An indication of the PHY security key is obtained.

16. The apparatus of claim 14, wherein the interface is further configured to: A set of one or more reference signals is output to the passive wireless device, wherein the PHY security key is associated with a channel measurement of the set of one or more reference signals.

17. The device according to claim 14, wherein: In order to obtain the first message, the interface is further configured to: The first message is obtained according to a second PHY security key, the second PHY security key protecting communications between the source device and the reader device.

18. The apparatus of claim 14, wherein the interface is further configured to: A second message is output to the passive wireless device according to a second PHY security key, the second PHY security key protecting communications between the reader device and the passive wireless device, wherein the source device and the reader device are the same device, and wherein the first message is a backscattered version of the second message.

19. An apparatus for wireless communication at a source device, the apparatus comprising: A processing system, the processing system being configured to: encrypting a first message according to a physical layer (PHY) security key, the physical layer (PHY) security key protecting communications between the source device and the passive wireless device; and interface, the interface being configured as: The first message is output to a reader device via the passive wireless device, the passive wireless device being associated with backscatter of the first message.

20. The apparatus of claim 19, wherein the interface is further configured to: An indication of the PHY security key is output to the passive wireless device.

21. The apparatus of claim 19, wherein: The interface is further configured as: outputting a plurality of commands to the passive wireless device, the plurality of commands associated with termination of the communication between the source device and the passive wireless device; and The processing system is further configured to: The PHY security key is obtained as an output of a key derivation function based on inputting timing information associated with the plurality of commands into the key derivation function.

22. The apparatus of claim 19, wherein the interface is further configured to: A set of one or more reference signals is output to the passive wireless device, wherein the PHY security key is associated with a channel measurement of the set of one or more reference signals.

23. The apparatus of claim 22, wherein the interface is further configured to: outputting a set of one or more commands to the passive wireless device, the set of one or more commands being associated with termination of the communication between the source device and the passive wireless device, wherein timing of the set of one or more reference signals is associated with the set of one or more commands, wherein the timing is also associated with a fixed time duration between a last command in the set of one or more commands and the set of one or more reference signals.

24. The apparatus of claim 19, wherein the interface is further configured to: An indication of a second PHY security key is output to one or both of the passive wireless device and the reader device, the second PHY security key protecting communications between the passive wireless device and the reader device.

25. The device according to claim 19, wherein In order to output the first message, the interface is further configured to: The first message is output according to a second PHY security key, the second PHY security key protecting communications between the source device and the reader device.

26. The apparatus of claim 19, wherein the interface is further configured to: A second message is obtained from the passive wireless device based on a second PHY security key that protects communications between the passive wireless device and the reader device, wherein the source device and the reader device are the same device, and wherein the second message is a backscattered version of the first message.

27. A method for wireless communication at a passive wireless device, the method comprising: receiving a first message according to a first physical layer (PHY) security key, the first physical layer (PHY) security key protecting communications between a source device and the passive wireless device; as well as A second message is sent via backscatter of the first message and in accordance with a second PHY security key that protects communications between the passive wireless device and a reader device.

28. The method according to claim 27, further comprising: An indication of the first PHY security key, the second PHY security key, or a combination thereof is received from one or both of the source device and the reader device.

29. The method according to claim 27, further comprising: receiving a plurality of commands associated with termination of the communication between the source device and the passive wireless device; as well as Based on inputting timing information associated with the plurality of commands into one or more key derivation functions, one or both of the first PHY security key and the second PHY security key are received as outputs of the one or more key derivation functions.

30. The method of claim 27, further comprising: receiving a first set of one or more reference signals from the source device, wherein the first PHY security key is associated with a first channel measurement of the first set of one or more reference signals; as well as A second set of one or more reference signals is received from the reader device, wherein the second PHY security key is associated with a second channel measurement of the second set of one or more reference signals.

Images