Security to movement positioning

Abstract

A positioning session signaling method includes obtaining, at a first wireless communication device, a first secure material including a ranging cryptographic key, or one or more cryptographic credentials, or a combination thereof; and transmitting a ranging signal from the first wireless communication device to a second wireless communication device, the ranging signal based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of Greek patent application serial number 20220100499, filed on June 16, 2022, entitled “SECURITY FOR MOBILE-TO-MOBILE POSITIONING”, which is assigned to the assignee of this application, and the entire contents of which are hereby incorporated herein by reference for all purposes. Background Art

[0003] Wireless communication systems have evolved over several generations, including first generation analog wireless telephone service (1G), second generation (2G) digital wireless telephone service (including transitional 2.5G and 2.75G networks), third generation (3G) high-speed data wireless service with Internet capabilities, fourth generation (4G) service (e.g., Long Term Evolution (LTE) or ), fifth generation (5G) services (e.g., 5G New Radio (NR)), etc. There are many different types of wireless communication systems in use today, including cellular and personal communications service (PCS) systems. Examples of known cellular systems include the cellular analog Advanced Mobile Phone System (AMPS), and digital cellular systems based on code division multiple access (CDMA), frequency division multiple access (FDMA), orthogonal frequency division multiple access (OFDMA), time division multiple access (TDMA), global system for mobile access (GSM) TDMA variants, etc.

[0004] The fifth generation (5G) mobile standard requires higher data transfer speeds, a greater number of connections, and better coverage, among other improvements. According to the Next Generation Mobile Network Alliance, the 5G standard is designed to provide data rates of tens of megabits per second to each of tens of thousands of users, with a data rate of 1 gigabit per second provided to dozens of workers on an office floor. In order to support large sensor deployments, hundreds of thousands of simultaneous connections should be supported. Therefore, the spectrum efficiency of 5G mobile communications should be significantly improved compared to the current 4G standard. In addition, signaling efficiency should be improved and latency should be significantly reduced compared to the current standard. Summary of the invention

[0005] An example first wireless communication device includes: a transceiver; a memory; and a processor, the processor being communicatively coupled to the transceiver and the memory and configured to: obtain a first security material, the first security material including a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and send a ranging signal to a second wireless communication device via the transceiver, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

[0006] An example positioning session signaling method includes: obtaining first security material at a first wireless communication device, the first security material including a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and sending a ranging signal from the first wireless communication device to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

[0007] Another example first wireless communication device includes: a component for obtaining a first security material, the first security material including a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and a component for sending a ranging signal to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

[0008] An example non-transitory processor-readable storage medium includes processor-readable instructions configured to cause a processor of a first wireless communication device to: obtain first security material, the first security material including a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and send a ranging signal to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a simplified diagram of an example wireless communication system.

[0010] Figure 2 yes Figure 1 A block diagram of components of an example user equipment is shown.

[0011] Figure 3 is a block diagram of the components of an example send / receive point.

[0012] Figure 4 is a block diagram of components of an example server, various implementations of which are described in Figure 1 Shown in.

[0013] Figure 5 is a simplified block diagram of an example user equipment.

[0014] Figure 6 is a simplified block diagram of example network entities.

[0015] Figure 7 is a diagram of a simplified environment for sidelink positioning.

[0016] Figure 8 It is the signaling and process flow used for sidelink positioning.

[0017] Fig. 9 It is the signaling and process flow used for network assisted / managed group formation and broadcast or unicast side link positioning.

[0018] Fig.10 Signaling and process flow for user equipment based group formation and broadcast or unicast sidelink positioning.

[0019] Fig.11 It is a flowchart of a positioning session signaling method. DETAILED DESCRIPTION

[0020] This article discusses technologies for providing security (e.g., confidentiality and / or integrity) for positioning (e.g., sidelink positioning) between wireless devices. One or more of the wireless devices may be mobile wireless communication devices, which may be referred to as user equipment (UE), and may store security materials such as one or more cryptographic keys (symmetric and / or asymmetric keys) and / or one or more digital certificates. Although the discussion herein focuses on mobile wireless communication devices, the discussion is applicable to the use of one or more non-mobile devices (e.g., roadside units (RSUs)). The security material may be stored in the mobile wireless communication device during and / or after manufacturing, for example, by receiving from another wireless communication device, such as downloading from a network entity or receiving from another UE. The UE may discover one or more other UEs using confidentiality-protected communications (which are encrypted using a cryptographic key of the security material or a cryptographic key derived from the security material) and / or integrity-protected communications (which are cryptographically signed and / or include cryptographic signatures), although discovery messaging is optional. The UE may participate in ranging with another UE by communicating messages and positioning reference signals (PRS), wherein the messages and / or PRS are protected by confidentiality and / or integrity. For example, the positioning signal (including the positioning message) may be encrypted using a cryptographic key included in or derived from the security material, and / or may be signed using a cryptographic key included in or derived from the security material. However, other examples may be implemented.

[0021] The items and / or techniques described herein may provide one or more of the following capabilities, as well as other capabilities not mentioned. Sensitive information contained in positioning signaling may be protected from discovery by undesired entities. For discovery signaling, identity privacy and / or service identification / privacy may be provided, and / or false service announcements / requests may be prevented from acting. For pre-PRS messages, identity privacy may be provided, parameter leakage (e.g., from targeted / optimized attacks) may be suppressed (e.g., prevented), and / or parameter modification (resulting in denial of service (DoS) or service degradation) may be suppressed (e.g., prevented). Identity privacy may be provided for PRS responses. Positioning errors due to PRS injection may be suppressed (e.g., prevented), thereby avoiding incorrect (too high / too low) distance estimates. For post-PRS messages, location privacy may be provided and / or measurement modification resulting in location errors may be suppressed (e.g., prevented). Other capabilities may be provided, and not every implementation according to the present disclosure necessarily provides any of the capabilities discussed, let alone all of them.

[0022] Obtaining the location of a mobile device accessing a wireless network can be used for many applications, including, for example, emergency calls, personal navigation, consumer asset tracking, locating friends or family members, etc. Existing positioning methods include methods based on measuring radio signals transmitted from various devices or entities, including satellite vehicles (SVs) and terrestrial radio sources such as base stations and access points in wireless networks. It is expected that standardization for 5G wireless networks will include support for various positioning methods, which can utilize reference signals transmitted by base stations for positioning determination in a manner similar to how LTE wireless networks currently utilize positioning reference signals (PRS) and / or cell-specific reference signals (CRS).

[0023] The description herein may refer to a sequence of actions to be performed by, for example, an element of a computing device. Each action described herein can be performed by a dedicated circuit (e.g., an application specific integrated circuit (ASIC)), by program instructions being executed by one or more processors, or by a combination of the two. The sequence of actions described herein may be implemented in a non-transient computer-readable medium having a corresponding set of computer instructions stored thereon, which, when executed, will cause an associated processor to perform the functionality described herein. Therefore, each example described herein may be embodied in several different forms, all of which fall within the scope of the present disclosure, including the claimed subject matter.

[0024] As used herein, the terms "user equipment" (UE) and "base station" are not dedicated to or otherwise limited to any particular radio access technology (RAT), unless otherwise specified. In general, a UE can be any wireless communication device (e.g., a mobile phone, a router, a tablet computer, a laptop computer, a consumer asset tracking device, an Internet of Things (IoT) device, etc.) used to communicate on a wireless communication network. A UE can be mobile or can be stationary (e.g., at certain times) and can communicate with a radio access network (RAN). As used herein, the term "UE" can be interchangeably referred to as an "access terminal" or "AT", "client device", "wireless device", "subscriber equipment", "subscriber terminal", "subscriber station", "user terminal" or UT, "mobile terminal", "mobile station", "mobile device", or variations thereof. In general, a UE can communicate with a core network via the RAN, and through the core network, the UE can connect to external networks such as the Internet and to other UEs. Of course, other mechanisms for connecting to the core network and / or the Internet are also possible for the UE, such as through a wired access network, A network (for example, based on IEEE (Institute of Electrical and Electronics Engineers) 802.11, etc.) and the like.

[0025] Depending on the network in which the base station is deployed, the base station may operate according to one of several RATs when communicating with the UE. Examples of base stations include access points (APs), network nodes, NodeBs, evolved NodeBs (eNBs), or general NodeBs (gNodeBs, gNBs). In addition, in some systems, the base station may only provide edge node signaling functions, while in other systems, the base station may provide additional control functions and / or network management functions.

[0026] The UE may be implemented by any of several types of devices, including but not limited to a printed circuit (PC) card, a compact flash device, an external or internal modem, a wireless or wired phone, a smart phone, a tablet device, a consumer asset tracking device, an asset tag, etc. The communication link through which the UE can transmit signals to the RAN is referred to as an uplink channel (e.g., a reverse traffic channel, a reverse control channel, an access channel, etc.). The communication link through which the RAN can transmit signals to the UE is referred to as a downlink or forward link channel (e.g., a paging channel, a control channel, a broadcast channel, a forward traffic channel, etc.). As used herein, the term "traffic channel (TCH)" may refer to an uplink / reverse traffic channel or a downlink / forward traffic channel.

[0027] As used herein, depending on the context, the term "cell" or "sector" may correspond to one of the multiple cells of a base station or to the base station itself. The term "cell" may refer to a logical communication entity used to communicate with a base station (e.g., on a carrier), and may be associated with an identifier to distinguish adjacent cells operating via the same or different carriers (e.g., physical cell identifier (PCID), virtual cell identifier (VCID)). In some examples, a carrier may support multiple cells, and different cells may be configured according to different protocol types that may provide access to different types of devices (e.g., machine type communication (MTC), narrowband Internet of Things (NB-IoT), enhanced mobile broadband (eMBB), or other protocol types). In some examples, the term "cell" may refer to a portion of a geographic coverage area (e.g., a sector) on which the logical entity operates.

[0028] refer to Figure 1 , an example of a communication system 100 includes a UE 105, a UE 106, a radio access network (RAN) (here, a fifth generation (5G) next generation (NG) RAN (NG-RAN) 135), a 5G core network (5GC) 140, and a server 150. The UE 105 and / or the UE 106 may be, for example, an IoT device, a location tracker device, a cellular phone, a vehicle (e.g., a car, a truck, a bus, a ship, etc.), or another device. A 5G network may also be referred to as a new radio (NR) network; the NG-RAN 135 may be referred to as a 5G RAN or an NR RAN; and the 5GC 140 may be referred to as an NG core network (NGC). Standardization of the NG-RAN and the 5GC is being conducted in the 3rd Generation Partnership Project (3GPP). Accordingly, the NG-RAN 135 and the 5GC 140 may follow current or future standards for 5G support from the 3GPP. The NG-RAN 135 may be another type of RAN, for example, a 3G RAN, a 4G Long Term Evolution (LTE) RAN, etc. UE 106 may be similarly configured and coupled to UE 105 to transmit and / or receive signals to and / or from similar other entities in system 100, but for simplicity of the drawing, the UE 106 is not shown in FIG. Figure 1105. Similarly, for simplicity, the discussion focuses on UE 105. The communication system 100 may utilize information from a constellation 185 of satellite vehicles (SVs) 190, 191, 192, 193 of a satellite positioning system (SPS), such as a global navigation satellite system (GNSS), such as a global positioning system (GPS), a global navigation satellite system (GLONASS), Galileo, or BeiDou or some other local or regional SPS, such as the Indian Regional Navigation Satellite System (IRNSS), the European Geostationary Navigation Overlay Service (EGNOS), or a Wide Area Augmentation System (WAAS). Additional components of the communication system 100 are described below. The communication system 100 may include additional or alternative components.

[0029] like Figure 1 As shown, the NG-RAN 135 includes NR nodeB (gNB) 110a, 110b and next generation eNodeB (ng-eNB) 114, and the 5GC 140 includes an access and mobility management function (AMF) 115, a session management function (SMF) 117, a location management function (LMF) 120, and a gateway mobile location center (GMLC) 125. The gNBs 110a, 110b, and ng-eNB 114 are communicatively coupled to each other, each configured to perform bidirectional wireless communication with the UE 105, and each communicatively coupled to the AMF 115 and configured to perform bidirectional communication with the AMF. The gNBs 110a, 110b, and ng-eNB 114 may be referred to as base stations (BSs). The AMF 115, the SMF 117, the LMF 120, and the GMLC 125 are communicatively coupled to each other, and the GMLC is communicatively coupled to the external client 130. SMF 117 may serve as an initial contact point for a service control function (SCF) (not shown) to create, control, and delete media sessions. A base station (such as gNB 110a, 110b, and / or ng-eNB 114) may be a macro cell (e.g., a high-power cellular base station), or a small cell (e.g., a low-power cellular base station), or an access point (e.g., a short-range base station configured to use a short-range technology (such as a Direct connection( -D) Low power consumption (BLE), One or more base stations (e.g., one or more of gNBs 110a, 110b, and / or ng-eNB 114) may be configured to communicate with UE 105 via multiple carriers. Each of gNBs 110a, 110b, and / or ng-eNB 114 may provide communication coverage for a corresponding geographic area (e.g., a cell). Each cell may be divided into multiple sectors according to base station antennas.

[0030] Figure 1 A generalized illustration of the various components is provided, any or all of which may be utilized as appropriate, and each component may be repeated or omitted as desired. Specifically, although one UE 105 is illustrated, many UEs (e.g., hundreds, thousands, millions, etc.) may be utilized in the communication system 100. Similarly, the communication system 100 may include a greater (or smaller) number of SVs (i.e., more or less than the four SVs 190-193 shown), gNBs 110a, 110b, ng-eNBs 114, AMFs 115, external clients 130, and / or other components. The illustrated connections connecting the various components in the communication system 100 include data and signaling connections, which may include additional (intermediate) components, direct or indirect physical and / or wireless connections, and / or additional networks. In addition, the various components may be rearranged, combined, separated, replaced, and / or omitted depending on the desired functionality.

[0031] Although Figure 1 A 5G-based network is illustrated, but similar network implementations and configurations may be used for other communication technologies, such as 3G, Long Term Evolution (LTE), etc. The implementations described herein (which are used for 5G technologies and / or for one or more other communication technologies and / or protocols) may be used to send (or broadcast) directional synchronization signals, receive and measure directional signals at a UE (e.g., UE 105), and / or provide location assistance to UE 105 (via GMLC 125 or other location servers), and / or calculate the position of UE 105 at a device with positioning capabilities such as UE 105, gNB 110a, 110b, or LMF 120 based on measurement parameters received at UE 105 for such directionally transmitted signals. The gateway mobile location center (GMLC) 125, location management function (LMF) 120, access and mobility management function (AMF) 115, SMF 117, ng-eNB (eNodeB) 114 and gNB (gNodeB) 110a, 110b are examples and may be replaced by or include various other location server functionalities and / or base station functionalities, respectively, in various embodiments.

[0032] The system 100 is capable of wireless communication because the components of the system 100 can communicate with each other (at least sometimes using wireless connections), directly or indirectly, for example, via gNB 110a, 110b, ng-eNB 114 and / or 5GC 140 (and / or one or more other devices not shown, such as one or more other transceiver base stations). For indirect communication, the communication can be modified during transmission from one entity to another, for example, to change header information of a data packet, change the format, etc. The UE 105 may include multiple UEs and may be a mobile wireless communication device, but may communicate wirelessly as well as via a wired connection. The UE 105 may be any of a variety of devices, such as a smart phone, a tablet computer, a vehicle-based device, etc., but these are merely examples, as the UE 105 need not be any of these configurations, and other configurations of the UE may be used. Other UEs may include wearable devices (e.g., smart watches, smart jewelry, smart glasses, or head-mounted devices, etc.). Other UEs may also be used, whether currently existing or developed in the future. In addition, other wireless devices (whether mobile or not) may be implemented within the system 100 and may communicate with each other and / or with the UE 105, the gNBs 110a, 110b, the ng-eNBs 114, the 5GC 140, and / or the external clients 130. For example, such other devices may include Internet of Things (IoT) devices, medical devices, home entertainment and / or automation devices, etc. The 5GC 140 may communicate with the external client 130 (e.g., a computer system), for example, to allow the external client 130 (e.g., via the GMLC 125) to request and / or receive location information about the UE 105.

[0033] UE 105 or other devices may be configured to communicate in various networks and / or for various purposes and / or using various technologies (e.g., 5G, Communications, Multi-Frequency communication, satellite positioning, one or more types of communication (e.g., GSM (Global System for Mobile), CDMA (Code Division Multiple Access), LTE (Long Term Evolution), V2X (Vehicle to Vehicle, e.g., V2P (Vehicle to Pedestrian), V2I (Vehicle to Infrastructure), V2V (Vehicle to Vehicle), etc.), IEEE802.11p, etc.). V2X communication can be cellular (Cellular-V2X (C-V2X)) and / or The system 100 may support operation on multiple carriers (waveform signals of different frequencies). A multi-carrier transmitter may send modulated signals simultaneously on multiple carriers. Each modulated signal may be a code division multiple access (CDMA) signal, a time division multiple access (TDMA) signal, an orthogonal frequency division multiple access (OFDMA) signal, a single carrier frequency division multiple access (SC-FDMA) signal, etc. Each modulated signal may be transmitted on a different carrier and may carry a pilot, overhead information, data, etc. UE 105, 106 may communicate with each other through UE-to-UE side link (SL) communication by transmitting on one or more side link (SL) channels such as a physical side link synchronization channel (PSSCH), a physical side link broadcast channel (PSBCH), or a physical side link control channel (PSCCH). Direct wireless device to wireless device communication (not through a network) may generally be referred to as side link communication without limiting the communication to a specific protocol.

[0034] UE 105 may include and / or may be referred to as a device, a mobile device, a wireless device, a mobile terminal, a terminal, a mobile station (MS), a terminal (SET) enabled with secure user plane location (SUPL), or some other name. In addition, UE 105 may correspond to a cellular phone, a smart phone, a laptop computer, a tablet device, a PDA, a consumer asset tracking device, a navigation device, an Internet of Things (IoT) device, a health monitor, a security system, a smart city sensor, a smart meter, a wearable tracker, or some other portable or mobile device. Typically, although not necessarily, UE 105 may use one or more radio access technologies (RATs) to support wireless communications, such as Global System for Mobile Communications (GSM), Code Division Multiple Access (CDMA), Wideband CDMA (WCDMA), LTE, High Rate Packet Data (HRPD), IEEE 802.11 (Also known as ), (BT), Global Interoperability for Microwave Access 5G New Radio (NR) (e.g., using NG-RAN 135 and 5GC 140), etc. UE 105 may use a wireless local area network (WLAN) to support wireless communications, and the wireless local area network may use, for example, a digital subscriber line (DSL) or packet cable to connect to other networks (e.g., the Internet). Using one or more of these RATs may allow UE 105 (e.g., via elements of 5GC 140 ( Figure 1 125), or possibly via GMLC 125) to communicate with external client 130 and / or allow external client 130 to receive location information about UE 105 (eg, via GMLC 125).

[0035] UE 105 may include a single entity or may include multiple entities, such as in a personal area network, where users may employ audio, video, and / or data I / O (input / output) devices, and / or body sensors and separate wired or wireless modems. The estimate of the location of UE 105 may be referred to as a location, location estimate, location fix, fix, position fix, position estimate, or position fix, and may be geographic, thereby providing location coordinates (e.g., latitude and longitude) of UE 105, which may or may not include an altitude component (e.g., height above sea level; height above or depth below ground level, floor level, or basement level). Alternatively, the location of UE 105 may be expressed as a municipal location (e.g., a postal address or a designation of a point or small area in a building (such as a specific room or floor)). The location of UE 105 may be expressed as an area or volume (geographically or municipally defined) within which UE 105 is expected to be located with a certain probability or confidence level (e.g., 67%, 95%, etc.). The location of the UE 105 may be expressed as a relative location including, for example, a distance and direction relative to a known location. The relative location may be expressed as relative coordinates (e.g., X, Y (and Z) coordinates) defined relative to a certain origin at a known location, which may be defined, for example, geographically, in municipal form, or with reference to a point, area, or volume indicated, for example, on a map, floor plan, or building plan. In the description contained herein, the use of the term "location" may include any of these variations unless otherwise indicated. When calculating the location of the UE, local x, y, and possibly z coordinates are typically solved, and then (if necessary) the local coordinates are converted into absolute coordinates (e.g., with respect to latitude, longitude, and altitude above or below mean sea level).

[0036] UE 105 may be configured to communicate with other entities using one or more of a variety of technologies. UE 105 may be configured to be indirectly connected to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links. D2D P2P links may be supported using any suitable D2D radio access technology (RAT), such as LTE Direct (LTE-D), Direct connection( -D) Etc. One or more UEs in the group of UEs utilizing D2D communication may be located within the geographic coverage area of ​​a transmit / receive point (TRP), such as one or more of gNB 110a, 110b and / or ng-eNB 114. Other UEs in the group may be outside such geographic coverage area or may be unable to receive transmissions from the base station for other reasons. The group of UEs communicating via D2D communication may utilize a one-to-many (1:M) system, in which each UE may transmit to other UEs in the group. The TRP may facilitate the scheduling of resources for D2D communication. In other cases, D2D communication may be performed between UEs without involving a TRP. One or more UEs in the group of UEs utilizing D2D communication may be located within the geographic coverage area of ​​a TRP. Other UEs in the group may be outside such geographic coverage area or may be unable to receive transmissions from the base station for other reasons. The group of UEs communicating via D2D communication may utilize a one-to-many (1:M) system, in which each UE may transmit to other UEs in the group. The TRP may facilitate the scheduling of resources for D2D communication. In other cases, D2D communication may be performed between UEs without involving TRP.

[0037] Figure 1 The base stations (BSs) in the NG-RAN 135 shown include NR Node Bs (referred to as gNB 110a and gNB 110b). Each pair of gNBs 110a, 110b in the NG-RAN 135 may be connected to each other via one or more other gNBs. Access to the 5G network is provided to the UE 105 via wireless communications between the UE 105 and one or more of the gNBs 110a, 110b, which may provide wireless communications access to the 5GC 140 on behalf of the UE 105 using 5G. Figure 1 , it is assumed that the serving gNB for UE 105 is gNB 110a, but another gNB (e.g., gNB 110b) may serve as the serving gNB if UE 105 moves to another location, or may serve as a secondary gNB to provide additional throughput and bandwidth to UE 105.

[0038] Figure 1The base stations (BSs) in the illustrated NG-RAN 135 may include an ng-eNB 114, which is also referred to as a next generation evolved Node B. The ng-eNB 114 may be connected to one or more of the gNBs 110a, 110b in the NG-RAN 135 via one or more other gNBs and / or one or more other ng-eNBs. The ng-eNB 114 may provide LTE wireless access and / or evolved LTE (eLTE) wireless access to the UE 105. One or more of the gNBs 110a, 110b and / or the ng-eNB 114 may be configured to function as a positioning-only beacon that may transmit signals to assist in determining the location of the UE 105, but may not receive signals from the UE 105 or other UEs.

[0039] The gNBs 110a, 110b, and / or the ng-eNB 114 may each include one or more TRPs. For example, each sector within a cell of the BS may include a TRP, but multiple TRPs may share one or more components (e.g., sharing a processor but having separate antennas). The system 100 may include only a macro TRP, or the system 100 may have different types of TRPs, such as a macro TRP, a pico TRP, and / or a femto TRP, among others. A macro TRP may cover a relatively large geographic area (e.g., a radius of several kilometers) and may allow unrestricted access to terminals with service subscriptions. A pico TRP may cover a relatively small geographic area (e.g., a pico cell) and may allow unrestricted access to terminals with service subscriptions. A femto TRP or a home TRP may cover a relatively small geographic area (e.g., a femto cell) and may allow restricted access to terminals associated with the femto cell (e.g., terminals of users in a home).

[0040] Each of the gNBs 110a, 110b, and / or ng-eNB 114 may include a radio unit (RU), a distributed unit (DU), and a central unit (CU). For example, the gNB 110b includes a RU 111, a DU 112, and a CU 113. The RU 111, the DU 112, and the CU 113 divide the functionality of the gNB 110b. Although the gNB 110b is shown as having a single RU, a single DU, and a single CU, the gNB may include one or more RUs, one or more DUs, and / or one or more CUs. The interface between the CU 113 and the DU 112 is referred to as the F1 interface. The RU 111 is configured to perform digital front end (DFE) functions (e.g., analog-to-digital conversion, filtering, power amplification, transmission / reception) and digital beamforming, and includes a portion of the physical (PHY) layer. The RU 111 may perform DFE using massive multiple input / multiple output (MIMO) and may be integrated with one or more antennas of the gNB 110b. DU 112 hosts the radio link control (RLC), medium access control (MAC), and physical layers of gNB 110b. One DU may support one or more cells, and each cell is supported by a single DU. The operation of DU 112 is controlled by CU 113. CU 113 is configured to perform functions for delivering user data, mobility control, radio access network sharing, positioning, session management, etc., although some functions are only assigned to DU 112. CU 113 hosts the radio resource control (RRC), service data adaptation protocol (SDAP), and packet data convergence protocol (PDCP) protocols of gNB 110b. UE 105 can communicate with CU 113 via RRC, SDAP, and PDCP layers, communicate with DU 112 via RLC, MAC, and PHY layers, and communicate with RU 111 via the PHY layer.

[0041] As pointed out, although Figure 1 Nodes configured to communicate according to a 5G communication protocol are depicted, but nodes configured to communicate according to other communication protocols (such as, for example, an LTE protocol or an IEEE 802.11x protocol) may also be used. For example, in an evolved packet system (EPS) that provides LTE wireless access to UE 105, the RAN may include an evolved universal mobile telecommunications system (UMTS) terrestrial radio access network (E-UTRAN), which may include base stations including evolved Node Bs (eNBs). The core network for the EPS may include an evolved packet core (EPC). The EPS may include the E-UTRAN plus the EPC, where the E-UTRAN corresponds to Figure 1 The NG-RAN 135 in the network and the EPC corresponds to the 5GC 140.

[0042] The gNBs 110a, 110b, and ng-eNB 114 may communicate with the AMF 115; for positioning functionality, the AMF communicates with the LMF 120. The AMF 115 may support mobility of the UE 105, including cell changes and handovers, and may participate in supporting signaling connections with the UE 105 and possible data and voice bearers for the UE 105. The LMF 120 may communicate directly with the UE 105, or directly with the gNBs 110a, 110b, and / or ng-eNB 114, for example, via wireless communications. The LMF 120 may support positioning of the UE 105 when the UE 105 accesses the NG-RAN 135, and may support various positioning procedures / methods, such as Assisted GNSS (A-GNSS), Observed Time Difference of Arrival (OTDOA) (e.g., Downlink (DL) OTDOA or Uplink (UL) OTDOA), Round Trip Time (RTT), Multi-cell RTT, Real-Time Kinematics (RTK), Precise Point Positioning (PPP), Differential GNSS (DGNSS), Enhanced Cell ID (E-CID), Angle of Arrival (AoA), Angle of Departure (AoD), and / or other positioning methods. The LMF 120 may process a location service request for the UE 105 received from, for example, the AMF 115 or the GMLC 125. The LMF 120 may be connected to the AMF 115 and / or the GMLC 125. The LMF 120 may be referred to by other names, such as a Location Manager (LM), a Location Function (LF), a Commercial LMF (CLMF), or a Value-Added LMF (VLMF). A node / system implementing LMF 120 may additionally or alternatively implement other types of location support modules, such as an enhanced serving mobile location center (E-SMLC) or a secure user plane location (SUPL) location platform (SLP). At least a portion of the positioning functionality (including the derivation of the location of UE 105) may be performed at UE 105 (e.g., using signal measurements obtained by UE 105 for signals sent by wireless nodes (such as gNB 110a, 110b and / or ng-eNB 114), and / or assistance data provided to UE 105 by LMF 120, for example). AMF 115 may serve as a control node for processing signaling between UE 105 and 5GC 140, and may provide QoS (quality of service) flow and session management. AMF 115 may support mobility of UE 105 (including cell changes and handovers), and may participate in supporting signaling connections to UE 105.

[0043] The server 150 (e.g., a cloud server) is configured to obtain a location estimate for the UE 105 and provide it to the external client 130. The server 150 may, for example, be configured to run a microservice / service that obtains a location estimate for the UE 105. The server 150 may, for example, obtain a location estimate from (e.g., by transmitting a location request) the UE 105, one or more of the gNBs 110a, 110b (e.g., via the RU 111, DU 112, and CU 113), and / or the ng-eNB 114, and / or the LMF 120. As another example, the UE 105, one or more of the gNBs 110a, 110b (e.g., via the RU 111, DU 112, and CU 113), and / or the LMF 120 may push the location estimate of the UE 105 to the server 150.

[0044] The GMLC 125 may support location requests for the UE 105 received from the external client 130 via the server 150, and may forward the location requests to the AMF 115 for forwarding by the AMF 115 to the LMF 120, or may forward the location requests directly to the LMF 120. A location response (e.g., containing a location estimate of the UE 105) from the LMF 120 may be returned to the GMLC 125 directly or via the AMF 115, and the GMLC 125 may then return the location response (e.g., containing the location estimate) to the external client 130 via the server 150. The GMLC 125 is shown as being connected to both the AMF 115 and the LMF 120, but may not be connected to either the AMF 115 or the LMF 120 in some implementations.

[0045] like Figure 1 As further illustrated, LMF 120 may communicate with gNB 110a, 110b and / or ng-eNB 114 using a new radio positioning protocol A (which may be referred to as NPPa or NRPPa), which may be defined in 3GPP Technical Specification (TS) 38.455. NRPPa may be the same as, similar to, or an extension of LTE Positioning Protocol A (LPPa) defined in 3GPP TS 36.455, wherein NRPPa messages are communicated between gNB 110a (or gNB 110b) and LMF 120, and / or between ng-eNB 114 and LMF 120 via AMF 115. Figure 1As further illustrated, the LMF 120 and the UE 105 may communicate using the LTE Positioning Protocol (LPP), which may be defined in 3GPP TS 36.355. The LMF 120 and the UE 105 may additionally or alternatively communicate using a new radio positioning protocol (which may be referred to as NPP or NRPP), which may be the same as, similar to, or an extension of the LPP. Here, LPP and / or NPP messages may be communicated between the UE 105 and the LMF 120 via the AMF 115 and the serving gNB 110a, 110b or the serving ng-eNB 114 of the UE 105. For example, the LPP and / or NPP messages may be communicated between the LMF 120 and the AMF 115 using the 5G Location Service Application Protocol (LCS AP), and may be communicated between the AMF 115 and the UE 105 using the 5G Non-Access Stratum (NAS) protocol. The LPP and / or NPP protocols may be used to support positioning of the UE 105 using UE-assisted and / or UE-based positioning methods such as A-GNSS, RTK, OTDOA, and / or E-CID. The NRPPa protocol may be used to support positioning of the UE 105 using a network-based positioning method such as E-CID (e.g., in conjunction with measurements obtained by the gNB 110a, 110b, or ng-eNB 114) and / or may be used by the LMF 120 to obtain location-related information from the gNB 110a, 110b, and / or ng-eNB 114, such as parameters defining directional SS or PRS transmissions from the gNB 110a, 110b, and / or ng-eNB 114. The LMF 120 may be co-located or integrated with the gNB or TRP, or may be located remotely from the gNB and / or TRP and configured to communicate directly or indirectly with the gNB and / or TRP.

[0046] Using UE-assisted positioning methods, UE 105 may obtain location measurements and transmit these measurements to a location server (e.g., LMF 120) for use in calculating a location estimate for UE 105. For example, the location measurements may include one or more of received signal strength indication (RSSI), round trip signal propagation time (RTT), reference signal time difference (RSTD), reference signal received power (RSRP), and / or reference signal received quality (RSRQ) of gNB 110a, 110b, ng-eNB 114, and / or WLAN APs. The location measurements may additionally or alternatively include measurements of GNSS pseudoranges, code phases, and / or carrier phases of SVs 190-193.

[0047] Using the UE-based positioning method, UE 105 can obtain position measurements (e.g., which can be the same or similar to the position measurements of the UE-assisted positioning method), and the position of UE 105 can be calculated (e.g., with the aid of auxiliary data received from a location server (such as LMF120) or broadcast by gNB 110a, 110b, ng-eNB 114 or other base stations or APs).

[0048] Using network-based positioning methods, one or more base stations (e.g., gNB 110a, 110b and / or ng-eNB 114) or APs may obtain location measurements (e.g., measurements of RSSI, RTT, RSRP, RSRQ, or time of arrival (ToA) of signals sent by UE 105) and / or may receive measurements obtained by UE 105. One or more base stations or APs may transmit the measurements to a location server (e.g., LMF 120) for use in calculating a location estimate for UE 105.

[0049] The information provided to LMF 120 by gNB 110a, 110b and / or ng-eNB 114 using NRPPa may include timing and configuration information for directional SS or PRS transmission and location coordinates. LMF 120 may provide some or all of this information to UE 105 as assistance data in LPP and / or NPP messages via NG-RAN 135 and 5GC 140.

[0050] The LPP or NPP message transmitted from LMF 120 to UE 105 may instruct UE 105 to do any of a variety of things, depending on the desired functionality. For example, the LPP or NPP message may include instructions for UE 105 to obtain measurements of GNSS (or A-GNSS), WLAN, E-CID, and / or OTDOA (or some other positioning method). In the case of E-CID, the LPP or NPP message may instruct UE 105 to obtain measurements of a base station supported by one or more of gNBs 110a, 110b, and / or ng-eNB 114 (or provided by some other type of base station, such as an eNB or The UE 105 may transmit one or more measurement parameters (e.g., beam ID, beam width, average angle, RSRP, RSRQ measurement) of a directional signal transmitted within a specific cell (supported by the UE AP) of the UE 105. The UE 105 may transmit these measurement parameters back to the LMF 120 in an LPP or NPP message (e.g., in a 5G NAS message) via the serving gNB 110a (or serving ng-eNB 114) and the AMF 115.

[0051] As noted, while the communication system 100 is described with respect to 5G technology, the communication system 100 may be implemented to support other communication technologies (such as GSM, WCDMA, LTE, etc.) for supporting and interacting with mobile devices (such as UE 105) (e.g., to implement voice, data, positioning, and other functionality). In some such embodiments, the 5GC 140 may be configured to control different air interfaces. For example, the non-3GPP interworking function (N3IWF, Figure 1 140 to a WLAN. For example, the WLAN may support IEEE 802.11 for UE 105. access, and may include one or more AP. Here, the N3IWF may be connected to the WLAN and other elements in the 5GC 140, such as the AMF 115. In some embodiments, both the NG-RAN 135 and the 5GC 140 may be replaced by one or more other RANs and one or more other core networks. For example, in the EPS, the NG-RAN 135 may be replaced by an E-UTRAN including eNBs, and the 5GC 140 may be replaced by an EPC including a mobility management entity (MME) instead of the AMF 115, an E-SMLC instead of the LMF 120, and a GMLC that may be similar to the GMLC 125. In such an EPS, the E-SMLC may use LPPa instead of NRPPa to transmit location information to and receive location information from the eNBs in the E-UTRAN, and may use LPP to support positioning of the UE 105. In these other embodiments, positioning of UE 105 using directional PRS may be supported in a manner similar to that described herein for 5G networks, except that the functions and processes described herein for gNB 110a, 110b, ng-eNB 114, AMF 115, and LMF 120 may in some cases be applied alternatively to other network elements, such as eNB, AP, MME and E-SMLC.

[0052] As noted, in some embodiments, positioning functionality may be implemented at least in part using directional SS or PRS beams transmitted by base stations (such as gNBs 110a, 110b and / or ng-eNB 114) that are located at the UE (e.g., Figure 1 In some instances, the UE may use directional SS or PRS beams from multiple base stations (such as gNB 110a, 110b, ng-eNB 114, etc.) to calculate the positioning of the UE.

[0053] Also refer to Figure 2UE 200 may be an example of one of UEs 105, 106, and may include a computing platform including a processor 210, a memory 211 including software (SW) 212, one or more sensors 213, a transceiver interface 214 for a transceiver 215 (which includes a wireless transceiver 240 and a wired transceiver 250), a user interface 216, a satellite positioning system (SPS) receiver 217, a camera 218, and a positioning device (PD) 219. The processor 210, the memory 211, the sensor 213, the transceiver interface 214, the user interface 216, the SPS receiver 217, the camera 218, and the positioning device 219 may be communicatively coupled to each other via a bus 220 (which may be configured, for example, for optical communication and / or electrical communication). One or more of the devices shown (e.g., the camera 218, the positioning device 219, and / or one or more of the sensors 213, etc.) may be omitted from the UE 200. The processor 210 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 210 may include multiple processors, including a general / application processor 230, a digital signal processor (DSP) 231, a modem processor 232, a video processor 233, and / or a sensor processor 234. One or more of the processors 230-234 may include multiple devices (e.g., multiple processors). For example, the sensor processor 234 may include, for example, a processor for RF (radio frequency) sensing (wherein one or more (cellular) wireless signals and reflections transmitted are used to identify, map and / or track objects) and / or ultrasound, etc. The modem processor 232 may support dual SIM / dual connectivity (or even more SIMs). For example, a SIM (subscriber identity module or subscriber identity module) may be used by an original equipment manufacturer (OEM), and another SIM may be used by a terminal user of the UE 200 to obtain connectivity. The memory 211 may be a non-transitory storage medium that may include a random access memory (RAM), a flash memory, a disk memory, and / or a read-only memory (ROM), etc. The memory 211 may store software 212, which may be a processor-readable, processor-executable software code containing instructions that may be configured to cause the processor 210 to perform various functions described herein when executed. Alternatively, the software 212 may not be directly executable by the processor 210, but may be configured to cause the processor 210 to perform these functions, for example, when compiled and executed. The description herein may refer to the processor 210 performing a function, but this includes other specific implementations, such as a specific implementation in which the processor 210 executes software and / or firmware. The description herein may refer to the processor 210 performing a function as a shorthand for one or more of the processors 230 to 234 performing the function.The description herein may refer to UE 200 performing a function as shorthand for one or more appropriate components of UE 200 performing that function. Processor 210 may include memory with stored instructions in addition to and / or in lieu of memory 211. The functionality of processor 210 is discussed more fully below.

[0054] Figure 2 The configuration of UE 200 shown is an example and does not limit the present disclosure including the claims, and other configurations may be used. For example, an example configuration of UE may include one or more of processors 230 to 234 in processor 210, memory 211, and wireless transceiver 240. Other example configurations may include one or more of processors 230 to 234 in processor 210, memory 211, wireless transceiver, and one or more of the following: sensor 213, user interface 216, SPS receiver 217, camera 218, PD 219, and / or wired transceiver.

[0055] The UE 200 may include a modem processor 232 capable of performing baseband processing of signals received and down-converted by the transceiver 215 and / or the SPS receiver 217. The modem processor 232 may perform baseband processing of signals to be up-converted for transmission by the transceiver 215. Additionally or alternatively, the baseband processing may be performed by the general / application processor 230 and / or the DSP 231. However, other configurations may be used to perform baseband processing.

[0056] UE 200 may include sensors 213, which may include, for example, one or more sensors of various types of sensors, such as one or more inertial sensors, one or more magnetometers, one or more environmental sensors, one or more optical sensors, one or more weight sensors, and / or one or more radio frequency (RF) sensors, etc. An inertial measurement unit (IMU) may include, for example, one or more accelerometers (e.g., collectively responsive to acceleration of UE 200 in three dimensions) and / or one or more gyroscopes (e.g., three-dimensional gyroscopes). Sensors 213 may include one or more magnetometers (e.g., three-dimensional magnetometers) to determine orientation (e.g., relative to magnetic north and / or true north), which may be used for any of a variety of purposes (e.g., to support one or more compass applications). Environmental sensors may include, for example, one or more temperature sensors, one or more barometric pressure sensors, one or more ambient light sensors, one or more camera imagers, and / or one or more microphones, etc. Sensors 213 may generate analog and / or digital signals, indications of which may be stored in memory 211 and processed by DSP 231 and / or general / application processor 230 to support one or more applications (e.g., applications involving positioning and / or navigation operations). The sensor 213 may include one or more of various other types of sensors, such as one or more optical sensors, one or more weight sensors, and / or one or more radio frequency (RF) sensors, among others.

[0057] The sensor 213 may be used for relative position measurement, relative position determination, motion determination, etc. The information detected by the sensor 213 may be used for motion detection, relative displacement, dead reckoning, sensor-based position determination, and / or sensor-assisted position determination. The sensor 213 may be used to determine whether the UE 200 is fixed (stationary) or mobile and / or whether to report certain useful information related to the mobility of the UE 200 to the LMF 120. For example, based on the information obtained / measured by the sensor 213, the UE 200 may notify / report to the LMF 120 that the UE 200 has detected movement or that the UE 200 has moved, and may report relative displacement / distance (e.g., via dead reckoning implemented by the sensor 213, or sensor-based position determination, or sensor-assisted position determination). In another example, for relative positioning information, the sensor / IMU may be used to determine the angle and / or orientation of another device relative to the UE 200, etc.

[0058] The IMU 270 may be configured to provide measurements of the direction of motion and / or speed of motion of the UE 200, which may be used for relative position determination. For example, one or more accelerometers 273 and / or one or more gyroscopes 274 of the IMU 270 may detect the linear acceleration and rotational speed of the UE 200, respectively. The linear acceleration measurements and rotational speed measurements of the UE 200 may be integrated over time to determine the instantaneous direction of motion and displacement of the UE 200. The instantaneous direction of motion and displacement may be integrated to track the position of the UE 200. For example, a reference position of the UE 200 at a certain moment may be determined, for example, using the SPS receiver 217 (and / or by some other means), and measurements obtained from the accelerometer 273 and the gyroscope 274 after that moment may be used for dead reckoning to determine the current position of the UE 200 based on the movement (direction and distance) of the UE 200 relative to the reference position.

[0059] The magnetometer 271 can determine the magnetic field strength in different directions, which can be used to determine the orientation of the UE 200. For example, the orientation can be used to provide a digital compass for the UE 200. The magnetometer may include a two-dimensional magnetometer configured to detect and provide an indication of the magnetic field strength in two orthogonal dimensions. The magnetometer 271 may include a three-dimensional magnetometer configured to detect and provide an indication of the magnetic field strength in three orthogonal dimensions. The magnetometer 271 may provide a means for sensing a magnetic field and providing an indication of the magnetic field to the processor 210, for example.

[0060] The transceiver 215 may include a wireless transceiver 240 and a wired transceiver 250 configured to communicate with other devices via wireless connections and wired connections, respectively. For example, the wireless transceiver 240 may include a wireless transmitter 242 and a wireless receiver 244 coupled to an antenna 246 for transmitting (e.g., on one or more uplink channels and / or one or more sidelink channels) and / or receiving (e.g., on one or more downlink channels and / or one or more sidelink channels) wireless signals 248 and converting signals from the wireless signals 248 to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to the wireless signals 248. The wireless transmitter 242 includes appropriate components (e.g., a power amplifier and a digital-to-analog converter). The wireless receiver 244 includes appropriate components (e.g., one or more amplifiers, one or more frequency filters, and an analog-to-digital converter). The wireless transmitter 242 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wireless receiver 244 may include multiple receivers that may be discrete components or combined / integrated components. The wireless transceiver 240 may be configured to communicate signals (e.g., with the TRP and / or one or more other devices) according to various radio access technologies (RATs), such as 5G New Radio (NR), GSM (Global System for Mobile Communications), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), Direct connection( -D) Etc. The new radio may use millimeter wave frequencies and / or sub-6 GHz frequencies. The wired transceiver 250 may include a wired transmitter 252 and a wired receiver 254 configured for wired communication, for example, a network interface that may be used to communicate with the NG-RAN 135 to transmit communications to the NG-RAN 135 and receive communications from the NG-RAN. The wired transmitter 252 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wired receiver 254 may include multiple receivers that may be discrete components or combined / integrated components. The wired transceiver 250 may be configured, for example, for optical communication and / or electrical communication. The transceiver 215 may be communicatively coupled to the transceiver interface 214, for example, via an optical connection and / or an electrical connection. The transceiver interface 214 may be at least partially integrated with the transceiver 215. The wireless transmitter 242, the wireless receiver 244 and / or the antenna 246 may include multiple transmitters, multiple receivers and / or multiple antennas, respectively, for transmitting and / or receiving appropriate signals, respectively.

[0061] The user interface 216 may include one or more devices such as, for example, a speaker, a microphone, a display device, a vibration device, a keyboard, a touch screen, etc. The user interface 216 may include more than one of these devices. The user interface 216 may be configured to enable a user to interact with one or more applications hosted by the UE 200. For example, the user interface 216 may store indications of analog and / or digital signals in the memory 211 in response to actions from the user to be processed by the DSP 231 and / or the general / application processor 230. Similarly, the application hosted on the UE 200 may store indications of analog and / or digital signals in the memory 211 to present output signals to the user. The user interface 216 may include an audio input / output (I / O) device, which includes, for example, a speaker, a microphone, a digital-to-analog circuit, an analog-to-digital circuit, an amplifier, and / or a gain control circuit (including more than one of these devices). Other configurations of audio I / O devices may be used. Additionally or alternatively, the user interface 216 may include one or more touch sensors that respond to touch and / or pressure on, for example, a keyboard and / or a touch screen of the user interface 216 .

[0062] The SPS receiver 217 (e.g., a global positioning system (GPS) receiver) may be capable of receiving and acquiring the SPS signal 260 via the SPS antenna 262. The SPS antenna 262 is configured to convert the SPS signal 260 from a wireless signal to a wired signal (e.g., an electrical signal or an optical signal), and may be integrated with the antenna 246. The SPS receiver 217 may be configured to process the acquired SPS signal 260 in whole or in part to estimate the position of the UE 200. For example, the SPS receiver 217 may be configured to determine the position of the UE 200 by performing trilateration using the SPS signal 260. The general / application processor 230, the memory 211, the DSP 231, and / or one or more dedicated processors (not shown) may be utilized in conjunction with the SPS receiver 217 to process the acquired SPS signal in whole or in part, and / or calculate the estimated position of the UE 200. The memory 211 may store indications (e.g., measurements) of the SPS signal 260 and / or other signals (e.g., signals obtained from the wireless transceiver 240) for use in performing positioning operations. The general / application processor 230, the DSP 231, and / or one or more special-purpose processors, and / or the memory 211 may provide or support a location engine for use in processing measurements to estimate the location of the UE 200.

[0063] UE 200 may include a camera 218 for capturing still or moving images. Camera 218 may include, for example, an imaging sensor (e.g., a charge coupled device or a CMOS (complementary metal oxide semiconductor) imager), a lens, analog-to-digital circuits, a frame buffer, etc. Additional processing, conditioning, decoding, and / or compression of signals representing captured images may be performed by general / application processor 230 and / or DSP 231. Additionally or alternatively, video processor 233 may perform conditioning, encoding, compression, and / or manipulation of signals representing captured images. Video processor 233 may decode / decompress stored image data for presentation on a display device (not shown) (e.g., of user interface 216).

[0064] Positioning device (PD) 219 may be configured to determine the location of UE 200, the movement of UE 200, and / or the relative location of UE 200, and / or time. For example, PD 219 may communicate with SPS receiver 217, and / or include part or all of an SPS receiver. PD 219 may work appropriately with processor 210 and memory 211 to perform at least a portion of one or more positioning methods, although the description herein may only refer to PD 219 being configured to perform or performing according to a positioning method according to a positioning method. PD 219 may be additionally or alternatively configured to: use ground-based signals (e.g., at least some wireless signals 248) for trilateration, assist in obtaining and use SPS signals 260, or both to determine the location of UE 200. PD 219 may be configured to determine the location of UE 200 based on the cell of a serving base station (e.g., a cell center) and / or another technology (such as E-CID). The PD 219 may be configured to determine the location of the UE 200 using one or more images from the camera 218 and image recognition combined with known locations of landmarks (e.g., natural landmarks (such as mountains) and / or artificial landmarks (such as buildings, bridges, streets), etc.). The PD 219 may be configured to determine the location of the UE 200 using one or more other techniques (e.g., relying on the UE's self-reported location (e.g., part of the UE's location beacon)), and may use a combination of techniques (e.g., SPS and ground positioning signals) to determine the location of the UE 200. The PD 219 may include one or more sensors 213 (e.g., gyroscopes, accelerometers, magnetometers, etc.), which may sense the orientation and / or movement of the UE 200 and provide an indication of the orientation and / or movement, and the processor 210 (e.g., general / application processor 230 and / or DSP 231) may be configured to use the indication to determine the movement of the UE 200 (e.g., velocity vector and / or acceleration vector). PD 219 may be configured to provide an indication of uncertainty and / or error in the determined position and / or motion. The functionality of PD 219 may be provided in a variety of ways and / or configurations, such as by general / application processor 230, transceiver 215, SPS receiver 217, and / or another component of UE 200, and may be provided by hardware, software, firmware, or various combinations thereof.

[0065] Also refer to Figure 3, an example of a TRP 300 for a gNB 110a, 110b, and / or ng-eNB 114 includes a computing platform including a processor 310, a memory 311 including software (SW) 312, and a transceiver 315. The processor 310, the memory 311, and the transceiver 315 may be communicatively coupled to one another via a bus 320 (which may be configured, for example, for optical communication and / or electrical communication). One or more of the illustrated devices (e.g., a wireless transceiver) may be omitted from the TRP 300. The processor 310 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 310 may include a plurality of processors (e.g., including a general / application processor, a DSP, a modem processor, a video processor, and / or a sensor processor, such as Figure 2 ). The memory 311 may be a non-transitory storage medium that may include random access memory (RAM), flash memory, disk memory, and / or read-only memory (ROM), etc. The memory 311 may store software 312, which may be a processor-readable, processor-executable software code containing instructions that are configured to cause the processor 310 to perform various functions described herein when executed. Alternatively, the software 312 may not be directly executable by the processor 310, but may be configured to cause the processor 310 to perform these functions, for example, when compiled and executed.

[0066] The description herein may refer to processor 310 performing a function, but this includes other specific implementations, such as a specific implementation in which processor 310 executes software and / or firmware. The description herein may refer to processor 310 performing a function as shorthand for one or more of the processors included in processor 310 performing the function. The description herein may refer to TRP 300 performing a function as shorthand for one or more appropriate components (e.g., processor 310 and memory 311) of TRP 300 (and therefore one of gNB 110a, 110b and / or ng-eNB 114) performing the function. Processor 310 may include a memory with stored instructions in addition to and / or in lieu of memory 311. The functionality of processor 310 is discussed more fully below.

[0067] The transceiver 315 may include a wireless transceiver 340 and / or a wired transceiver 350 configured to communicate with other devices via wireless connections and wired connections, respectively. For example, the wireless transceiver 340 may include a wireless transmitter 342 and a wireless receiver 344 coupled to one or more antennas 346 for transmitting (e.g., on one or more uplink channels and / or one or more downlink channels) and / or receiving (e.g., on one or more downlink channels and / or one or more uplink channels) wireless signals 348 and converting signals from the wireless signals 348 to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to the wireless signals 348. Thus, the wireless transmitter 342 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wireless receiver 344 may include multiple receivers that may be discrete components or combined / integrated components. The wireless transceiver 340 may be configured to communicate in accordance with a variety of radio access technologies (RATs) such as 5G New Radio (NR), GSM (Global System for Mobile Communications), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), Direct connection( -D) The wired transceiver 350 may include a wired transmitter 352 and a wired receiver 354 configured for wired communication, for example, a network interface that may be used to communicate with the NG-RAN 135 to transmit communications to, for example, the LMF 120 and / or one or more other network entities and receive communications therefrom. The wired transmitter 352 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wired receiver 354 may include multiple receivers that may be discrete components or combined / integrated components. The wired transceiver 350 may be configured, for example, for optical communication and / or electrical communication.

[0068] Figure 3 The configuration of the TRP 300 shown is an example and is not intended to limit the present disclosure, including the claims, and other configurations may be used. For example, the description herein discusses that the TRP 300 may be configured to perform several functions or that the TRP 300 performs several functions, but one or more of these functions may be performed by the LMF 120 and / or the UE 200 (i.e., the LMF 120 and / or the UE 200 may be configured to perform one or more of these functions).

[0069] Also refer to Figure 4 , the server 400 (LMF 120 may be an example thereof) may include: a computing platform including a processor 410, a memory 411 including software (SW) 412, and a transceiver 415. The processor 410, the memory 411, and the transceiver 415 may be communicatively coupled to each other via a bus 420 (the bus may be configured, for example, for optical communication and / or electrical communication). One or more of the devices shown (e.g., a wireless transceiver) may be omitted from the server 400. The processor 410 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 410 may include a plurality of processors (e.g., including a general / application processor, a DSP, a modem processor, a video processor, and / or a sensor processor, such as Figure 2 410). The memory 411 may be a non-transitory storage medium that may include random access memory (RAM), flash memory, disk storage, and / or read-only memory (ROM), etc. The memory 411 may store software 412, which may be a processor-readable, processor-executable software code containing instructions that are configured to cause the processor 410 to perform various functions described herein when executed. Alternatively, the software 412 may not be directly executable by the processor 410, but may be configured to cause the processor 410 to perform these functions, for example, when compiled and executed. The description herein may refer to the processor 410 performing functions, but this includes other specific implementations, such as specific implementations of the processor 410 executing software and / or firmware. The description herein may refer to the processor 410 performing functions as a shorthand for one or more processors included in the processor 410 performing the function. The description herein may refer to the server 400 performing functions as a shorthand for one or more appropriate components of the server 400 performing the function. The processor 410 may include a memory with stored instructions as a supplement and / or replacement for the memory 411. The functionality of processor 410 is discussed more fully below.

[0070] The transceiver 415 may include a wireless transceiver 440 and / or a wired transceiver 450 configured to communicate with other devices via wireless connections and wired connections, respectively. For example, the wireless transceiver 440 may include a wireless transmitter 442 and a wireless receiver 444 coupled to one or more antennas 446 for transmitting (e.g., on one or more downlink channels) and / or receiving (e.g., on one or more uplink channels) wireless signals 448 and converting signals from the wireless signals 448 to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to the wireless signals 448. Thus, the wireless transmitter 442 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wireless receiver 444 may include multiple receivers that may be discrete components or combined / integrated components. The wireless transceiver 440 may be configured to operate in accordance with a plurality of radio access technologies (RATs) such as 5G New Radio (NR), GSM (Global System for Mobile Communications), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long Term Evolution), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), Direct connection( -D) The wired transceiver 450 may include a wired transmitter 452 and a wired receiver 454 configured for wired communication, for example, a network interface that can be used to communicate with the NG-RAN 135 to transmit communications to, for example, the TRP 300 and / or one or more other network entities and receive communications therefrom. The wired transmitter 452 may include multiple transmitters that may be discrete components or combined / integrated components, and / or the wired receiver 454 may include multiple receivers that may be discrete components or combined / integrated components. The wired transceiver 450 may be configured, for example, for optical communication and / or electrical communication.

[0071] The description herein may refer to processor 410 performing a function, but this includes other implementations, such as implementations in which processor 410 executes software (stored in memory 411) and / or firmware. The description herein may refer to server 400 performing a function as shorthand for one or more appropriate components of server 400 (e.g., processor 410 and memory 411) performing that function.

[0072] Figure 4The configuration of the server 400 shown is an example and is not intended to limit the present disclosure, including the claims, and other configurations may be used. For example, the wireless transceiver 440 may be omitted. Additionally or alternatively, the description herein discusses that the server 400 is configured to perform several functions or that the server performs several functions, but one or more of these functions may be performed by the TRP 300 and / or the UE 200 (i.e., the TRP 300 and / or the UE 200 may be configured to perform one or more of these functions).

[0073] Positioning Technology

[0074] For terrestrial positioning of UEs in cellular networks, techniques such as Advanced Forward Link Trilateration (AFLT) and Observed Time Difference of Arrival (OTDOA) typically operate in a "UE-assisted" mode, where measurements of reference signals (e.g., PRS, CRS, etc.) transmitted by base stations are acquired by the UE and then provided to a location server. The location server calculates the position of the UE based on the measurements and the known positions of the base stations. Since these techniques use a location server (rather than the UE itself) to calculate the position of the UE, these positioning techniques are not frequently used in applications such as automotive or cell phone navigation, which instead typically rely on satellite-based positioning.

[0075] The UE can use a satellite positioning system (SPS) (Global Navigation Satellite System (GNSS)) to use precise point positioning (PPP) or real-time kinematic (RTK) techniques for high accuracy positioning. These techniques use assistance data, such as measurements from ground-based stations. LTE Release 15 allows the data to be encrypted so that only UEs subscribed to the service can read the information. Such assistance data changes over time. As a result, a UE subscribed to the service may not be able to easily "crack the encryption" for other UEs by passing the data to other UEs that have not paid for the subscription. This transfer needs to be repeated every time the assistance data changes.

[0076] In UE-assisted positioning, the UE transmits measurements (e.g., TDOA, Angle of Arrival (AoA), etc.) to a positioning server (e.g., LMF / eSMLC). The positioning server has a base station almanac (BSA) that contains multiple "entries" or "records", one record per cell, where each record contains a geographic cell location, but may also include other data. An identifier of a "record" among multiple "records" in the BSA may be referenced. The BSA and the measurements from the UE may be used to calculate the positioning of the UE.

[0077] In conventional UE-based positioning, the UE calculates its own position, avoiding the transmission of measurements to the network (e.g., a location server), which in turn improves latency and scalability. The UE uses the relevant BSA record information from the network (e.g., the location of the gNB (more broadly, the base station)). The BSA information can be encrypted. However, since the BSA information changes much less frequently than, for example, the PPP or RTK assistance data described previously, it may be easier (compared to PPP or RTK information) to make the BSA information available to UEs that are not subscribed and have not paid for decryption keys. The transmission of reference signals by the gNB makes the BSA information potentially accessible to crowdsourcing or driving attacks, essentially enabling the BSA information to be generated based on in-the-field observations and / or over-the-top observations.

[0078] Positioning techniques may be characterized and / or evaluated based on one or more criteria, such as positioning determination accuracy and / or latency. Latency is the time elapsed between an event that triggers the determination of positioning-related data and the availability of the data at a positioning system interface (e.g., an interface of LMF 120). When the positioning system is initialized, the latency for the availability of positioning-related data is called the time to first fix (TTFF) and is greater than the latency after the TTFF. The inverse of the time elapsed between two consecutive positioning-related data availabilities is called the update rate, i.e., the rate at which positioning-related data is generated after the first fix. Latency may depend on (e.g., UE's) processing capabilities. For example, assuming 272 PRBs (physical resource blocks) are allocated, the UE may report the processing capabilities of the UE as the duration (in time units (e.g., milliseconds) of the DL PRS symbols that the UE can process per T amount of time (e.g., Tms). Other examples of capabilities that may affect latency are the number of TRPs from which the UE can process PRSs, the number of PRSs that the UE can process, and the bandwidth of the UE.

[0079] One or more of many different positioning techniques (also referred to as positioning methods) may be used to determine the location of an entity (such as one of UEs 105, 106). For example, known positioning determination techniques include RTT, multi-RTT, OTDOA (also referred to as TDOA and including UL-TDOA and DL-TDOA), enhanced cell identification (E-CID), DL-AoD, UL-AoA, etc. RTT uses the time it takes for a signal to travel from one entity to another and back to determine the distance between the two entities. This distance plus the known position of a first one of the entities and the angle (e.g., azimuth) between the two entities may be used to determine the position of a second one of the entities. In multi-RTT (also referred to as multi-cell RTT), multiple distances from one entity (e.g., UE) to other entities (e.g., TRP) and the known positions of the other entities may be used to determine the position of the one entity. In TDOA techniques, the travel time difference between one entity and the other entities may be used to determine the relative distance to the other entities, and the relative distance combined with the known positions of the other entities may be used to determine the position of the one entity. The angle of arrival and / or angle of departure can be used to help determine the location of an entity. For example, the angle of arrival or angle of departure of a signal combined with the distance between devices (the distance determined using the signal (e.g., the travel time of the signal, the received power of the signal, etc.)) and the known position of one of the devices can be used to determine the location of the other device. The angle of arrival or angle of departure can be an azimuth relative to a reference direction (such as true north). The angle of arrival or angle of departure can be a zenith angle relative to directly upward from the entity (i.e., relative to radially outward from the center of the earth). E-CID uses the identity of the serving cell, the timing advance (i.e., the difference between the reception time and the transmission time at the UE), the estimated timing and power of the detected neighbor cell signals, and the possible angle of arrival (e.g., the angle of arrival of the signal from the base station at the UE, or vice versa) to determine the location of the UE. In TDOA, the difference in the arrival time of signals from different sources at the receiving device together with the known positions of these sources and the known offsets of the transmission times from these sources are used to determine the location of the receiving device.

[0080] In network-centric RTT estimation, the serving base station commands the UE to scan / receive RTT measurement signals (e.g., PRS) on the serving cells of two or more neighboring base stations (and usually the serving base station, because at least three base stations are required). The one or more base stations send the RTT measurement signals on low reuse resources (e.g., resources used by the base station to send system information) allocated by the network (e.g., a location server, such as LMF 120). The UE records the arrival time (also known as reception time, received time, received time, or arrival time (ToA)) of each RTT measurement signal relative to the current downlink timing of the UE (e.g., as derived by the UE from the DL signal received from its serving base station), and (e.g., when instructed by its serving base station) sends a common or individual RTT response message (e.g., SRS (sounding reference signal) for positioning, i.e., UL-PRS) to the one or more base stations, and the time difference T between the ToA of the RTT measurement signal and the sending time of the RTT response message may be calculated. Rx→Tx (i.e., UE T Rx-Tx or UE Rx-Tx ) is included in the payload of each RTT response message. The RTT response message will include a reference signal from which the base station can infer the ToA of the RTT response. Tx→Rx The difference between the sending time of the RTT measurement signal from the base station and the ToA of the RTT response at the base station and the time difference T reported by the UE Rx→Tx , and subtract UE Rx-Tx , the base station can infer the propagation time between the base station and the UE, from which the base station can determine the distance between the UE and the base station by assuming the speed of light during the propagation time.

[0081] UE-centric RTT estimation is similar to the network-based approach, except that the UE sends an uplink RTT measurement signal (e.g., when ordered by a serving base station), which is received by multiple base stations in the vicinity of the UE. Each base station involved responds with a downlink RTT response message, which may include in the RTT response message payload the time difference between the ToA of the RTT measurement signal at the base station and the transmission time of the RTT response message from the base station.

[0082] For both network-centric and UE-centric processes, the side performing the RTT calculation (the network or the UE) typically (but not always) sends a first message or signal (e.g., an RTT measurement signal), and the other side responds with one or more RTT response messages or signals, which may include the difference between the ToA of the first message or signal and the sending time of the RTT response message or signal.

[0083] Multi-RTT techniques may be used to determine positioning. For example, a first entity (e.g., a UE) may transmit one or more signals (e.g., unicast, multicast, or broadcast from a base station), and a plurality of second entities (e.g., other TSPs, such as base stations and / or UEs) may receive the signals from the first entity and respond to the received signals. The first entity receives responses from the plurality of second entities. The first entity (or another entity, such as an LMF) may use the responses from the second entity to determine the distance to the second entity, and may use the plurality of distances and the known positions of the second entities to determine the position of the first entity by trilateration.

[0084] In some examples, additional information may be available in the form of an angle of arrival (AoA) or angle of departure (AoD) that defines a straight line direction (e.g., which may be in the horizontal plane or in three dimensions) or a range of possible directions (e.g., of the UE as seen from the location of a base station). The intersection of the two directions may provide another estimate of the UE's position.

[0085] For positioning techniques (e.g., TDOA and RTT) that use PRS (positioning reference signal) signals, PRS signals transmitted by multiple TRPs are measured, and the arrival times of these signals, the known transmission times, and the known locations of the TRPs are used to determine the distance from the UE to the TRP. For example, RSTD (reference signal time difference) can be determined for PRS signals received from multiple TRPs, and the RSTD can be used in the TDOA technique to determine the location (position) of the UE. Positioning reference signals may be referred to as PRS or PRS signals. PRS signals are typically transmitted using the same power, and PRS signals with the same signal characteristics (e.g., the same frequency shift) may interfere with each other, so that PRS signals from farther TRPs may be drowned out by PRS signals from closer TRPs, so that signals from farther TRPs may not be detected. PRS muting can be used to help reduce interference by muting some PRS signals (reducing the power of the PRS signal, for example, to zero and thereby not sending the PRS signal). In this way, the UE can more easily detect (at the UE) a weaker PRS signal without a stronger PRS signal interfering with the weaker PRS signal. The term RS and its variants (e.g., PRS, SRS, CSI-RS (Channel State Information - Reference Signal)) may refer to one reference signal or more than one reference signal.

[0086] The positioning reference signal (PRS) includes a downlink PRS (DL PRS, often referred to as PRS for short) and an uplink PRS (UL PRS) (the uplink PRS may be referred to as an SRS (sounding reference signal) for positioning). The PRS may include a PN code (pseudo-random number) or be generated using a PN code (e.g., by modulating a carrier signal with a PN code) so that the source of the PRS can be used as a pseudo-satellite. The PN code may be unique to the PRS source (at least unique within a specified area so that the same PRS from different PRS sources do not overlap). The PRS may include PRS resources and / or PRS resource sets of a frequency layer. The DL PRS positioning frequency layer (or simply frequency layer) is a collection of DL PRS resource sets from one or more TRPs, where the PRS resources have common parameters configured by higher layer parameters DL-PRS-PositioningFrequencyLayer, DL-PRS-ResourceSet, and DL-PRS-Resource. Each frequency layer has a DL PRS subcarrier spacing (SCS) for the DL PRS resource set and DL PRS resource in the frequency layer. Each frequency layer has a DL PRS cyclic prefix (CP) for the DL PRS resource set and DL PRS resources in that frequency layer. In 5G, a resource block occupies 12 consecutive subcarriers and a specified number of symbols. A common resource block is a set of resource blocks that occupy a channel bandwidth. A bandwidth part (BWP) is a set of consecutive common resource blocks and may include all common resource blocks within the channel bandwidth or a subset of the common resource blocks. In addition, the DL PRS point A parameter defines the frequency of the reference resource block (and the lowest subcarrier of the resource block), where DL PRS resources belonging to the same DL PRS resource set have the same point A, and all DL PRS resource sets belonging to the same frequency layer have the same point A. The frequency layers also have the same DL PRS bandwidth, the same starting PRB (and center frequency), and the same comb size value (i.e., the frequency of PRS resource elements per symbol, so that for comb-N, every Nth resource element is a PRS resource element). A PRS resource set is identified by a PRS resource set ID and may be associated with a specific TRP (identified by a cell ID) sent by the antenna panel of the base station. The PRS resource ID in a PRS resource set may be associated with an omni-directional signal and / or associated with a single beam (and / or beam ID) transmitted from a single base station (where a base station may transmit one or more beams). Each PRS resource in a PRS resource set may be transmitted on a different beam, and as such, the PRS resources (or simply resources) may also be referred to as beams. This does not imply anything about whether the base station and beam on which the PRS is transmitted are known to the UE.

[0087] The TRP may be configured, for example, by instructions received from a server and / or by software in the TRP to transmit DL PRS on a schedule. According to the schedule, the TRP may transmit DL PRS intermittently (e.g., periodically at consistent intervals from the initial transmission). The TRP may be configured to transmit one or more PRS resource sets. A resource set is a collection of PRS resources across a TRP, where the resources have the same periodicity, a common muting mode configuration (if any), and the same cross-slot repetition factor. Each PRS resource set in a PRS resource set includes a plurality of PRS resources, where each PRS resource includes a plurality of OFDM (orthogonal frequency division multiplexing) resource elements (REs), which may be in a plurality of resource blocks (RBs) within N (one or more) consecutive symbols within a slot. PRS resources (or, in general, reference signal (RS) resources) may be referred to as OFDM PRS resources (or OFDM RS resources). RBs are RE sets that span a certain number of one or more consecutive symbols in the time domain and a certain number (12 for 5G RBs) of consecutive subcarriers in the frequency domain. Each PRS resource is configured with an RE offset, a slot offset, a symbol offset within a slot, and the number of consecutive symbols that the PRS resource can occupy within a slot. The RE offset defines the starting RE offset in frequency for the first symbol within the DL PRS resource. The relative RE offsets of the remaining symbols within the DL PRS resource are defined based on the initial offset. The slot offset is the starting slot of the DL PRS resource relative to the corresponding resource set slot offset. The symbol offset determines the starting symbol of the DL PRS resource within the starting slot. The transmitted REs may be repeated across slots, where each transmission is called a repetition, so that there may be multiple repetitions in the PRS resource. The DL PRS resources in a DL PRS resource set are associated with the same TRP, and each DL PRS resource has a DL PRS resource ID. The DL PRS resource ID in a DL PRS resource set is associated with a single beam transmitted from a single TRP (although a TRP may transmit one or more beams).

[0088] PRS resources may also be defined by quasi co-location parameters and starting PRB parameters. Quasi co-location (QCL) parameters may define any quasi co-location information of DLPRS resources with other reference signals. DL PRS may be configured as QCL type D with DL PRS or SS / PBCH (synchronization signal / physical broadcast channel) blocks from a serving cell or non-serving cell. DL PRS may be configured as QCL type C with SS / PBCH blocks from a serving cell or non-serving cell. The starting PRB parameter defines the starting PRB index of the DLPRS resource with respect to reference point A. The starting PRB index has a granularity of one PRB and may have a minimum value of 0 PRBs and a maximum value of 2176 PRBs.

[0089] A PRS resource set is a collection of PRS resources with the same periodicity, the same muting pattern configuration (if any), and the same repetition factor across time slots. Each time all repetitions of all PRS resources in a PRS resource set are configured to be transmitted is referred to as an "instance". Thus, an "instance" of a PRS resource set is a specified number of repetitions for each PRS resource and a specified number of PRS resources within a PRS resource set, such that once the specified number of repetitions is transmitted for each of the specified number of PRS resources, the instance is complete. An instance may also be referred to as an "opportunity". A DL PRS configuration including a DL PRS transmission schedule may be provided to a UE to facilitate (or even cause) the UE to measure a DL PRS.

[0090] Multiple frequency layers of PRS can be aggregated to provide an effective bandwidth that is greater than any bandwidth in the bandwidth of each layer. Multiple frequency layers belonging to component carriers (which can be continuous and / or separate) and satisfying criteria such as quasi-co-location (QCL) and having the same antenna port can be spliced ​​to provide a larger effective PRS bandwidth (for DL ​​PRS and UL PRS), thereby improving the accuracy of arrival time measurement. Splicing includes combining PRS measurements on various bandwidth segments into a unified segment so that the spliced ​​PRS can be regarded as taken from a single measurement. In the case of QCL, different frequency layers behave similarly, so that the splicing of PRS produces a larger effective bandwidth. The larger effective bandwidth (which can be referred to as the bandwidth of the aggregated PRS or the frequency bandwidth of the aggregated PRS) provides better time domain resolution (e.g., the resolution of TDOA). The aggregated PRS includes a collection of PRS resources, and each PRS resource in the aggregated PRS can be referred to as a PRS component, and each PRS component can be sent on different component carriers, frequency bands or frequency layers, or on different parts of the same frequency band.

[0091] RTT positioning is an active positioning technology because RTT uses positioning signals transmitted by the TRP to the UE and positioning signals transmitted by the UE (participating in RTT positioning) to the TRP. The TRP can transmit a DL-PRS signal received by the UE, and the UE can transmit an SRS (sounding reference signal) signal received by multiple TRPs. The sounding reference signal may be referred to as an SRS or an SRS signal. In 5G multi-RTT, coordinated positioning can be used, in which the UE transmits a single UL-SRS for positioning received by multiple TRPs, rather than transmitting a separate UL-SRS for positioning for each TRP. A TRP participating in multi-RTT will typically search for UEs currently residing on the TRP (served UEs, where the TRP is the serving TRP) and also search for UEs residing on adjacent TRPs (neighboring UEs). A neighbor TRP may be a TRP of a single BTS (base transceiver station) (e.g., a gNB), or may be a TRP of one BTS and a TRP of a separate BTS. For RTT positioning (including multi-RTT positioning), the DL-PRS signal and the UL-SRS positioning signal in the PRS / SRS positioning signal pair used to determine the RTT (and thereby the distance between the UE and the TRP) may occur close to each other in time so that errors due to UE motion and / or UE clock drift and / or TRP clock drift are within acceptable limits. For example, the signals in the PRS / SRS positioning signal pair may be sent from the TRP and the UE, respectively, within approximately 10 ms of each other. In the case where the SRS for positioning is being transmitted by the UE and the PRS and the SRS for positioning are transmitted close to each other in time, it has been found that radio frequency (RF) signal congestion (which may result in excessive noise, etc.) may result (especially if many UEs are attempting to locate concurrently) and / or computational congestion may result at the TRP where many UEs are attempting to measure concurrently.

[0092] RTT positioning can be UE-based or UE-assisted. In UE-based RTT, UE 200 determines the RTT and corresponding distance to each TRP in TRP 300, and determines the positioning of UE 200 based on the distance to TRP 300 and the known position of TRP 300. In UE-assisted RTT, UE 200 measures the positioning signal and provides the measurement information to TRP 300, and TRP 300 determines RTT and distance. TRP 300 provides the distance to a location server (e.g., server 400), and the server determines the position of UE 200 based on the distance to different TRPs 300, for example. RTT and / or distance can be determined by TRP 300 receiving signals from UE 200, determined by the TRP 300 in combination with one or more other devices (e.g., one or more other TRPs 300 and / or server 400), or determined by one or more devices other than TRP 300 that receive signals from UE 200.

[0093] Various positioning technologies are supported in 5G NR. The NR native positioning methods supported in 5G NR include DL-only positioning methods, UL-only positioning methods, and DL+UL positioning methods. Downlink-based positioning methods include DL-TDOA and DL-AoD. Uplink-based positioning methods include UL-TDOA and UL-AoA. Combined DL+UL-based positioning methods include RTT with one base station and RTT with multiple base stations (multi-RTT).

[0094] A positioning estimate (e.g., for a UE) may be referred to by other names, such as position estimate, position, fix, position fix, fix, etc. A positioning estimate may be geodetic and include coordinates (e.g., latitude, longitude, and possibly altitude), or may be municipal and include a street address, a postal address, or some other textual description of a location. A positioning estimate may be further defined relative to some other known location or in absolute terms (e.g., using latitude, longitude, and possibly altitude). A positioning estimate may include an expected error or uncertainty (e.g., by including an area or volume within which the location is expected to be contained with some specified or default confidence level). Position information may include one or more positioning signal measurements (e.g., of one or more satellite signals, PRS, and / or one or more other signals), and / or one or more values ​​based on one or more positioning signal measurements (e.g., one or more distances (possibly including one or more pseudoranges), and / or one or more position estimates, etc.).

[0095] Sidelink positioning security

[0096] Also refer to Figure 5UE 500 includes a processor 510, a transceiver 520, and a memory 530 that are communicatively coupled to each other via a bus 540. UE 500 may include Figure 5 UE 500 may include one or more other components (such as Figure 2 246, or a wireless receiver 244 and an antenna 246, or a wireless transmitter 242, a wireless receiver 244 and an antenna 246, or a wireless transmitter 242, a wireless receiver 244 and an antenna 246. Additionally or alternatively, the transceiver 520 may include a wired transmitter 252 and / or a wired receiver 254. The memory 530 may be configured similarly to the memory 211, for example, including software having processor-readable instructions configured to cause the processor 510 to perform functions.

[0097] The description herein may refer to the processor 510 performing a function, but this includes other specific implementations, such as a specific implementation in which the processor 510 executes software (stored in the memory 530) and / or firmware. The description herein may refer to the UE 500 performing a function as shorthand for one or more appropriate components of the UE 500 (e.g., the processor 510 and the memory 530) performing that function. The processor 510 (possibly in combination with the memory 530 and, where appropriate, the transceiver 520) includes a SL positioning unit 550. The SL positioning unit 550 is further discussed below, and the description may generally refer to the processor 510 or generally refer to the UE 500 performing any of the functions of the SL positioning unit 550. The UE 500 is configured to perform the functions of the SL positioning unit 550 discussed herein.

[0098] Also refer to Figure 6 , the network entity 600 includes a processor 610, a transceiver 620, and a memory 630 that are communicatively coupled to each other via a bus 640. The network entity 600 may include Figure 6 The network entity 600 may include one or more other components (such as Figure 3 and / or Figure 4), so that TRP 300 and / or server 400 may be examples of network entity 600. For example, processor 610 may include one or more of the components of processor 310 and / or processor 410. Transceiver 620 may include one or more of the components of transceiver 315 and / or transceiver 415. Memory 630 may be configured similarly to memory 311 and / or memory 411, for example, including software having processor-readable instructions configured to cause processor 610 to perform functions.

[0099] The description herein may refer to the processor 610 performing a function, but this includes other specific implementations, such as a specific implementation in which the processor 610 executes software (stored in the memory 630) and / or firmware. The description herein may refer to the network entity 600 performing a function as shorthand for one or more appropriate components of the network entity 600 (e.g., the processor 610 and the memory 630) performing the function. The processor 610 (possibly in combination with the memory 630 and, where appropriate, the transceiver 620) includes a RKMF 650 (ranging key management function). The RKMF unit 650 is further discussed below, and the description may generally refer to the processor 610 or generally refer to the network entity 600 performing any function of the RKMF 650. The network entity 600 is configured to perform the functions of the RKMF 650 discussed herein.

[0100] Also refer to Figure 7 , SL positioning can be performed in environment 700 to determine the distance between UEs and / or the location of the UEs. The distance and / or location of the UEs can be used for one or more of a variety of reasons, such as collision avoidance, navigation, consumer asset tracking, selecting a device for an emergency help request, etc. Environment 700 includes UEs 711, 712, 713, 714 and base stations 721, 722. In this example, UEs 711-713 are smart phones and UE 714 is a vehicle, but these are examples and not limitations of the present disclosure. UEs 711-714 are configured to transmit SL signals via a PC5 interface for one or more purposes (e.g., positioning, communication, etc.), while V2X and UE to UE use slightly different protocols, both of which use a PC5 link as an interface between UEs. UEs 711-714 and base stations 721, 722 are configured to communicate with each other over a Uu interface.

[0101] Also refer to Figure 8, the processing and signal flow 800 for SL positioning includes the stages shown, according to which any one of the UEs 711-714 may participate in SL positioning with one or more of the other UEs 711-714. A UE (e.g., UE 711) may perform one-to-one positioning with one of the UEs 712-714, or may perform one-to-N positioning with, for example, all of the UEs 712-714, and the positioning may be coordinated through an announcement-based handshake or a request-response handshake between the involved UEs. Figure 8 As shown in , an initiator UE 801 participates in SL positioning with a target UE 802, where the target UE 802 is a UE whose position is to be determined (e.g., relative to UE 801 and / or relative to a reference coordinate system such as an earth coordinate system). The positioning process is divided into two parts, namely a discovery part 810 and a positioning session part 820.

[0102] The discovery portion 810 is optional and, if included, can be either an announcement discovery or a request-response discovery. In the announcement discovery, the discovery message 812 transmitted by the UEs 801, 802 is a similar discovery message that broadcasts the capability of each UE to support SL positioning. In the request-response discovery, the discovery message 812 transmitted by the initiator UE 801 and the target UE 802 is different. The initiator UE 801 sends (broadcasts) a PRS request for SL positioning support, and the target UE 802 responds to receiving the PRS request by sending a PRS response indicating that the target UE 802 supports SL positioning. The signaling in both the discovery portion 810 and the positioning session portion 820 includes privacy-sensitive information that may be subject to tracking or targeted attacks in the absence of confidentiality protection, and tamper-resistant desired information that may result in service degradation or even denial of service in the absence of integrity / replay protection. If the signaling is not protected, the privacy-sensitive information may be read, and the tamper-resistant desired information may be transmitted by an attacker that causes service degradation or interruption (denial). Confidentiality protection (e.g., encryption) can protect privacy-sensitive information, while integrity protection can help ensure that the information comes from a trusted source or from a claimed source or has not been altered without making the information confidential. For the announcement discovery message, the privacy-sensitive information includes, for example, the V2X service identifier for SL positioning, and UE source user information (e.g., initiator ID), and the tamper-proof expected information includes, for example, the PRS carrier (e.g., licensed, unlicensed, ITS (Intelligent Transportation System)) and an indication of the UE's ability to act as an anchor UE (with a known location that can be used to help determine the location of the target UE). For the PRS request message for request-response discovery, the privacy-sensitive information includes, for example, the V2X service identifier for SL positioning, and UE source user information, and the tamper-proof expected information includes, for example, the PRS carrier, an indication of the UE's ability to act as an anchor UE, and the PRS format (e.g., comb number, number of symbols, TDM / FDM (time division multiplexing / frequency division multiplexing)). For a PRS response message for request-response discovery, the privacy-sensitive information includes, for example, a ranging session ID and a target application layer ID, and the tamper-proof desired information includes, for example, supported carriers for the PRS and a desired distance or location.

[0103] The positioning session portion 820 includes a group formation phase 825, a pre-PRS phase 830, a PRS response phase 840, a PRS phase 850, and a post-PRS phase 860. In the group formation phase 825, the discovered UEs communicate with each other to determine the formation of a group, which can be the basis for determining security information for protecting signaling between UEs in the group. For the pre-PRS message 832, the privacy-sensitive information includes, for example, the initiator-assigned session ID, the initiator ID, and the target UE ID list, and the tamper-proof expected information includes, for example, the PRS carrier, the PRS periodicity, the duration of the periodic PRS, the earliest PRS Tx time of the initiator UE, the indication that a PRS response is required, and the anchor UE capability indication. For the PRS response message 842, the privacy-sensitive information includes, for example, the ranging session ID and the target application layer ID, and the tamper-proof expected information includes, for example, the supported carriers for the PRS and the expected distance or position. The PRS 852 does not include privacy-sensitive information or tamper-proof expected information, but can be protected to help prevent attacks, such as spoofing of the PRS. For the PRS post-response message 862, the privacy-sensitive information includes, for example, the ranging session ID and the target application layer ID, and the tamper-proof desired information includes, for example, a list of PRS Rx-Tx differences (one difference for each initiator UE in the positioning session), the UE reference position, the antenna offset from the UE reference position at the PRS Tx time, the UE velocity at the PRS Tx time and the associated accuracy, the UE acceleration at the PRS Tx time and the associated accuracy, and the angle of arrival of the received PRS and the associated accuracy.

[0104] The signals transmitted in the process 800 for ProSe (Proximity Services) devices are susceptible to various threats. A ProSe device is a device that supports the PC5 interface and supports signaling between UEs. The discovery message (if transmitted) is broadcast, and the pre-PRS message 832, the PRS response message 842, the PRS 852, and the post-PRS message 862 can be broadcast (or multicast) or unicast. The multicast signaling can be managed or even based on, for example, the distance from the source of the signal (e.g., message, PRS, etc.). The discovery message 812 is susceptible to identity privacy, service identification / privacy, and false service announcement / request attacks. The pre-PRS message 832 is susceptible to identity privacy, parameter leakage (target / optimization), and parameter modification (DoS / service degradation) attacks. In a parameter leakage attack, an attacker is able to read the parameters and use the parameters to inject attack messages, for example, with different parameter values. For example, an attacker can spoof a message and instruct the recipient to use a different parameter value or can change (e.g., overwrite) another message. The PRS response message 842 is susceptible to identity privacy attacks. The PRS 852 is susceptible to PRS injection attacks, for example, resulting in over / underestimation of distance. The post-PRS message 862 is susceptible to location privacy attacks and measurement modification attacks (e.g., injection of incorrect distances) that may result in location errors. To combat message attacks, encryption, integrity protection, and / or replay protection may be used for broadcast and unicast messages. To combat PRS injection attacks, PRS signal randomization may be used. Depending on the application and / or scenario, confidentiality and / or integrity protection may be provided.

[0105] In order to provide security protection (e.g., confidentiality and / or integrity protection) for ranging / positioning signaling (including message delivery and / or non-message signal delivery), security material may be supplied to the UE. The security material may include one or more cryptographic keys (e.g., one or more symmetric keys and / or one or more asymmetric keys) and / or one or more cryptographic certificates. The RKMF 650 is configured to supply security material for ranging services to the UE. The RKMF 650 may pre-supply security material to the UE before the UE discovers each other to form a group for positioning, or may supply security material on demand (e.g., in response to a request based on a group being formed for positioning). Security material may be supplied for non-unicast message protection, i.e., broadcast message protection and / or multicast / groupcast message protection, for example, there is no distinction between broadcast protection and multicast / groupcast protection. Discussions herein may relate to broadcast protection, and such discussions also apply to multicast / groupcast protection.

[0106] For broadcast message protection, UEs (e.g., UEs 801, 802) in the current PRS session share encryption and integrity protection keys. For example, when each of UEs 801, 802 is within the coverage of network entity 600, RKMF 650 may supply keys to UEs 801, 802, which may not occur concurrently. Network entity 600 may be, for example, a server in 5GC 140 or an application server in the Internet. As another example, protection keys may be established as part of a group formation process. In such cases, RKMF 650 may supply UEs 801, 802 with certificates used by UEs 801, 802 to establish (e.g., derive) protection keys (before or concurrently with group formation), which may use more processing power than directly supplying protection keys by RKMF 650. UEs (e.g., UEs 801, 802) in the same group may share encryption keys and integrity keys. Keys may be pre-provisioned before group formation, and the risk of key compromise increases with the size of the group. Group formation may occur after discovery and before establishment of one or more keys for protecting PRS delivery.

[0107] For broadcast PRS protection, UEs in a PRS session may share a cryptographic key used to generate a PRS sequence. UEs in the same group share a key for generating a PRS sequence. The key and / or freshness parameter (e.g., a timer, a counter, a system frame number, a slot number, a symbol number, or any combination of two or more thereof) and / or a base PRS may be used as one or more inputs to an algorithm to generate a sequence of randomized PRSs. This may prevent an attacker (or any entity that does not know the base PRS and the key) from injecting a PRS that one or more of the UEs in the group use to determine the distance of a target UE, and therefore the location of the target UE. The cryptographic key may be provisioned similarly to the provisioning of keys for broadcast message protection, such as provisioned on demand by the RKMF 650 before the group is formed by the RKMF 650, or derived during group formation based on one or more certificates provisioned by the RKMF 650 before or concurrently with the group formation.

[0108] For unicast message and / or non-message signal protection, UEs (e.g., UE 801, 802) may authenticate each other and establish symmetric cryptographic keys known only to UE 801, 802. Symmetric keys may be used to provide confidentiality and integrity protection of signaling (e.g., messages and / or PRS), while asymmetric private keys may be used to provide integrity protection without providing confidentiality protection. Asymmetric private keys may be used to sign signals (e.g., messages or PRS) to provide integrity protection, where the receiving entity uses a public key corresponding to the private key to authenticate the received message. Cryptographic keys may be provisioned by RKMF 650 during group formation or prior to group formation, where UE 801, 802 receives the keys when connected to network entity 600, but not necessarily concurrently. RKMF 650 may pre-provision cryptographic keys without knowing the UEs 801, 802 to be involved. In such cases, a UE 801, 802 may be provisioned with numerous symmetric keys, each corresponding to a specific other UE, so that when the UEs 801, 802 discover each other, the UEs 801, 802 will likely have the appropriate symmetric keys. Provisioning keys on demand during group formation can help avoid storing a large number of keys because the desired UEs for the group are known. Public key-based cryptography can be used to provide scalability. The RKMF 650 may issue certificates to the UEs 801, 802 before the group is formed, or recognize certificates issued by a trusted service (providing a list of trusted certificate authorities to the UEs 801, 802). These certificates may be used by the UEs 801, 802 to determine symmetric cryptographic keys (e.g., as discussed further below). With symmetric keys established, a unicast link establishment procedure for V2X defined by 3GPP Technical Specification 33.536 may be used to establish a unicast link between the UEs 801, 802.

[0109] Network assistance / management team formation

[0110] Also refer to Fig. 9 , a process and signal flow 900 for network assisted / managed group formation and broadcast or unicast SL positioning in a group includes the stages shown. The network entity 600 (e.g., RKMF 650) may assist the initiator UE 901 and the target UE 902 in forming a group and have appropriate security materials for confidentiality protection and / or integrity protection of signaling during discovery and / or during a positioning session. Process 900 is an example and other processes may be used. For example, in the case where broadcast / multicast transmission of PRS response messages, PRS and post-PRS messages is used instead of unicast transmission, stage 940 may be omitted. As another example, in the case where there is no on-demand request for ranging keys for a unicast positioning session, stage 950 may be omitted.

[0111] At stage 910, appropriate security material is provisioned to the UE 901, 902. The UE 901, 902 may transmit a discovery request 911, 912 to the network entity 600 requesting security material for discovery messages. The network entity 600 (e.g., RKMF 650) may respond to the discovery request 911, 912 by transmitting a discovery response 913, 914 including the security material for the discovery message. Additionally or alternatively, the UE 901, 902 may transmit a ranging protection request 915, 916 to the network entity 600 requesting security material for positioning signaling (including positioning messages and PRS). The network entity 600 (e.g., RKMF 650) may respond to the ranging protection request 915, 916 by sending a ranging protection response 917, 918 including security material for ranging messages and PRS. The same security material may be used for both discovery and ranging, or separate security material may be provided for discovery and ranging. In some embodiments, discovery security material is provided without providing ranging security material. In some embodiments, ranging security material is provided but discovery security material is not provided.

[0112] The security material may be provided before the group is formed or on demand. The security material may be provided before forming a group including UE 901, 902, wherein the security material has a long validity period. The security material may be valid for one or more indication areas and / or one or more geographic locations and / or areas, for example, identified by a TAI (Tracking Area Identification) list. If the security material is provided before the group is formed, the UE 901, 902 may not be within the network coverage when the group is formed and / or during the positioning session (see the positioning session section 820). For the on-demand provision of security material, the UE (e.g., UE 901 and / or UE 902) requests the security material to join the positioning session. The UE (or TRP and / or AMF) may provide coarse location information (e.g., current TAC (Tracking Area Code), current cell ID) for the UE to help the network entity 600 form a group. The network entity 600 (e.g., RKMF 650) acts as a group manager for the UE 901, 902 for on-demand security material provision. Security material may be provided by network entity 600 for specific groups, for example, where different groups receive different security material.

[0113] The security material may include one or more cryptographic keys and / or one or more digital certificates (which may be referred to as cryptographic certificates or certificates). For example, the network entity 600 may supply the same symmetric cryptographic key (also referred to as a symmetric key) to both UEs 901 and 902. As another example, the security material may include one or more cryptographic certificates (or simply certificates) for one or more of the UEs 901 and 902. Each digital certificate includes a public key (which may be referred to as a public cryptographic key or a public asymmetric cryptographic key) and is associated with a private key (which may be referred to as a private cryptographic key or a private asymmetric cryptographic key). For example, the corresponding UE may generate a public / private key pair and request a certificate by providing the public key to the network entity 600. The network entity 600 signs the certificate using the private key of the network entity 600. As another example, the network entity 600 may supply a corresponding digital certificate (i.e., a public key of the UE signed by the network entity) to each of the UEs 901 and 902. The network entity 600 may generate a public / private key pair for the UE, sign the UE public key to generate a certificate, and provide the private key and certificate to the UE. In such cases, each certificate is a public key of the respective UE, signed by the network entity 600 using the private key of the network entity 600. As another example, the manufacturer of the UE may generate or otherwise provide public / private keys and provision the UE with these keys during manufacturing.

[0114] Broadcast / multicast signaling protection

[0115] Broadcast messages may be provided with confidentiality and / or integrity protection, where both UEs 901, 902 have the same symmetric key. According to 5G ProSe, 3GPP technical standard 33.503, confidentiality protection may be provided by security material supplied by the network entity 600 (e.g., RKMF 650) for protecting mobile-to-mobile positioning signaling. The security material is valid for the UEs in the group (e.g., UEs 901, 902). The security material may include DUSK (discovery user scrambling key), DUCK (discovery user confidentiality key), and DUIK (discovery user integrity key). DUSK, DUCK, and DUIK may be used to encrypt the entire message, encrypt one or more parts of the message, and protect the integrity of the message, respectively. Only a UE with DUCK can decrypt the DUCK-encrypted part of the message. DUIK may be used to protect the integrity of the entire message, for example, where the sending UE signs the message with DUIK and the receiving UE uses DUIK to confirm the integrity. DUSK, DUCK and DUIK may be used to protect the discovery message 922 at stage 920 and / or the pre-PRS message 932 at stage 930 based on the group formed during the group formation stage 925. The same key may be used for discovery protection and pre-PRS protection, or a key (e.g., a group key) may be used specifically for pre-PRS protection, where such key does not include DUSK, DUCK or DUIK. A group key (e.g., a cryptographic key provisioned by the network entity 600 for a group of UEs) may be used for multicast protection. For example, the UE 901, 902 may use the group key for AS layer (access stratum) multicast security, such as for public safety use cases. The AS layer is a protocol layer between a UE and a gNB or between a UE and a UE on the air interface. The broadcast / multicast key used for pre-PRS protection may also be used to protect a PRS response message 962 at stage 960 , a PRS 972 sent at stage 970 , and / or a post-PRS message 982 sent at stage 980 , where no unicast link is established or used between UEs 901 , 902 .

[0116] For broadcast or multicast PRS transmission, the provisioned key can be used as a ranging key to protect ranging signaling. For broadcast / multicast ranging, the ranging key can be used to randomize PRS. For example, the same group key can be used for discovery protection and for randomizing PRS. The SL positioning unit 550 of any of the UEs 901, 902 may use the group key and one or more other items (e.g., time (or frame number and / or time slot number), group / service ID as inputs to a function to generate a PRS sequence for the positioning session. Each PRS in the sequence will be different and will be known to (generated by) each UE that has an understanding of the group key, the function, and the inputs to the function. The ranging key may be provided, for example, in a discovery response 913, 914 or a ranging protection response 917, 918, where the technique for randomizing the PRS is known to the UEs 901, 902. As another example, an indication of the technique for randomizing the PRS (and / or an indication of which inputs will be used in the technique) may be indicated in the discovery response 913, 914 and / or the ranging protection response 917, 918.

[0117] Unicast signaling protection

[0118] A unicast link may be established at stage 940, and a ranging cryptographic key (e.g., a symmetric key) may be established or otherwise obtained at stages 960, 970, 980 for protecting unicast signaling for mobile-to-mobile positioning. The ranging cryptographic key may be referred to as a PC5 ranging key because the key is used to protect signaling on a PC5 interface between UEs. The ranging key may be obtained from the network entity 600, for example, on demand, or before establishing the unicast link or based on certificates of the UEs 901, 902.

[0119] In order to obtain the ranging key on demand, the UE 902 communicates with the network entity 600 at stage 950 to request and receive the ranging key from the network entity 600 (e.g., RKMF 650). For example, during stage 940, the UE 902 transmits a request to the UE 901 for a unicast positioning session with the UE 901. The UE 901 responds by sending an instruction to the UE 902 for the UE 902 to request the ranging key from the network entity 600 for the unicast positioning session with the UE 901. At stage 950, in the case that the UE 902 is in the coverage of the network to which the network entity 600 belongs, the SL positioning unit 550 of the UE 901 sends a request for the ranging key for unicast ranging between the UE 902 and the UE 902 to the network entity 600. The network entity 600 responds by providing a ranging key (e.g., a ranging remote user key (RRUK)). The ranging key is, for example, a pairwise, symmetric key that is currently session-specific for the UE 901, 902. The RKMF 650 is aware of the cryptographic key supplied to the UE 901, and derives the ranging key from the key supplied to the UE 901, and supplies the ranging key to the UE 902. The SL positioning unit 550 of the UE 901 derives the ranging key from the cryptographic key previously supplied by the RKMF 650 (when the UE 901 is in the coverage of the network including the network entity 600). The UE 901, 902 sends a privacy mode command message to each other to confirm that both the UE 901, 902 have obtained (e.g., the UE 901 has derived and the UE 902 has received) the ranging key.

[0120] The ranging key may be pre-provisioned, provided to the UE 901, 902 prior to stage 940. The network entity 600 or another entity may provision a plurality of ranging keys to each of the UEs 901, 902 for use in a positioning session with the respective UE. In response to stage 940, the UE 901 may retrieve the ranging key from a memory dedicated to the positioning session with the UE 902, and the UE 902 may retrieve the ranging key from a memory dedicated to the positioning session with the UE 901.

[0121] The ranging key may be obtained by the UE 901, 902 based on the certificate of the UE 901, 902. When located in the coverage of the network including the network entity 600, each of the UE 901, 902 may receive a certificate from the network entity 600. The UE 901, 902 may not be located in the coverage concurrently, or may not be located in the coverage when the positioning session is being established. Each of the UE 901, 902 transmits the public key of the respective UE 901, 902 to the network entity 600. The network entity 600 signs the UE public key using the private key of the network entity 600 to form a certificate and transmits the certificate to the respective UE 901, 902. Thus, each certificate includes the public key of the respective UE 901, 902 signed by the private asymmetric key of the network entity 600. The certificate may have one or more restrictions on use, such as being limited to a specific geographic area and / or a specified time window. The UE 901, 902 exchange their respective certificates. UE 901 uses the public key of network entity 600 to verify that the public key of UE 902 in the received certificate is authentic, and UE 902 performs the same operation for the public key of UE 901. The SL positioning unit 550 of UE 901, 902 uses the verified public key to derive (e.g., according to EAP-TLS (Extensible Authentication Protocol-Transport Layer Security)) a symmetric key. UE 901, 902 can use this symmetric key to provide confidentiality and / or integrity protection for the positioning session (e.g., to PRS response message 962, PRS 972, and PRS post-message 982). Although the pre-PRS message 932 is shown as going from UE 901 to UE 902, and the PRS response message 962 is shown as going from UE 902 to UE 901, the pre-PRS message can be transmitted from UE 902 to UE 901, and the PRS response message can be transmitted from UE 901 to UE 902. Deriving a symmetric key in this manner provides a scalable technique for determining a symmetric key for a positioning session.

[0122] UE-based autonomous group formation

[0123] Also refer to Fig.10 , a process and signal flow 1000 for UE-based group formation and broadcast or unicast SL positioning in the group for an initiator UE 1001 and a target UE 1002 includes the stages shown. Flow 1000 is an example, and other flows may be used. For example, in the case of using broadcast / multicast transmission of a PRS response message, a PRS, and a post-PRS message instead of unicast transmission, stage 1040 may be omitted.

[0124] At stage 1010, appropriate security material is provisioned to the UE 1001, 1002. The UE 1001, 1002 may transmit a discovery request 1011, 1012 to the network entity 600 requesting security material for discovery messages. The network entity 600 (e.g., RKMF 650) may respond to the discovery request 1011, 1012 by sending a discovery response 1013, 1014 including the security material for the discovery message. Additionally or alternatively, the UE 1001, 1002 may transmit a ranging protection request 1015, 1016 to the network entity 600 requesting security material for positioning signaling (including positioning messages and PRS). The network entity 600 (e.g., RKMF 650) may respond to the ranging protection request 1015, 1016 by sending a ranging protection response 1017, 1018 including security material for ranging messages and PRS. The network entity 600 may supply an indication to the UE 1001, 1002 to use autonomous group formation when out of network coverage (and / or an indication to use network-based group formation when in network coverage) for autonomous group formation, or for both network-based group formation or autonomous group formation. The same security material may be used for both discovery and ranging, or separate security materials may be provided for discovery and ranging. In some embodiments, discovery security material is provided without providing ranging security material. In some embodiments, ranging security material is provided without providing discovery security material.

[0125] The security material is provided before the group is formed and includes one or more certificates for each of the UEs 1001, 1002, wherein the security material has a long validity time. The certificates of the UEs 1001, 1002 include a public key of the UE 1001 signed by the network entity 600 and a public key of the UE 1002 signed by the network entity 600, respectively. Multiple certificates may be provided for each of the UEs 1001, 1002, wherein the sequence for using the multiple certificates is known to the UEs 1001, 1002 (e.g., the protocol is pre-programmed, or a local policy agreed upon by the UEs 1001, 1002, such as during unicast link establishment). Using multiple certificates and a certificate rotation protocol may help suppress tracking of UE communications, because the use of certificates by the UE 1001 (or UE 1002) is visible to other entities, and other entities may track communications by identifying the same identity information and key IDs in multiple communications. Changing certificates makes it more difficult to track the communications of the UE. During stage 1010 , the UE 1001 , 1002 may be provisioned with a list of trusted Certificate Authorities (CAs) to facilitate interoperability with other service providers, such as other MNOs (Mobile Network Operators).

[0126] Broadcast / multicast signaling protection

[0127] Integrity or authenticity protection may be provided to the broadcast message using the provisioned certificate. For example, each broadcast message (e.g., each discovery message 1022 at stage 1020, pre-PRS message 1032 at stage 1030, PRS response 1062 at stage 1060, PRS 1072 at stage 1070, and / or post-PRS message 1082 at stage 1080) appropriately transmitted by either UE 1001, 1002 is signed by the respective UE using the respective UE's private key. The certificate (or certificate chain) is carried in the message for verification by the receiving UE. The receiving UE verifies the message using the public key of the UE that sent the message, and verifies the public key of the sending UE using the public key of the RKMF 650. A group is formed at group formation stage 1025 based on the UEs that are aware of each other based on the discovery at stage 1020, where the group is used to establish security information for signaling protection (e.g., group key establishment for broadcast / multicast signal protection). Without input from the network entity 600, group formation is performed using the PC5 link.

[0128] For broadcast or groupcast PRS transmission (for discovery and / or ranging), the provisioned key or a key derived from the provisioned key may be used as a ranging key to protect ranging signaling. For broadcast / multicast ranging, a group key (e.g., ranging key) may be used to randomize PRS, e.g., as discussed above (e.g., based on time (or frame number and / or slot number), group / service ID, and the group key is used as an input to a function to generate a PRS sequence for a positioning session), where the group key is obtained from the network entity 600 in the ranging protection response 1017, 1018. Alternatively, the group key may be negotiated by the UE 1001, 1002 during group formation, e.g., with a group leader (e.g., initiator UE 1001) that distributes PRS session keys after unicast link establishment, e.g., with a group Diffie-Hellman key established during group formation. For example, if the group key has not been provisioned by the network entity 600 or is otherwise unavailable, one UE may provision the group key to other members of the group over a secure unicast link for each other group member.

[0129] Unicast signaling protection

[0130] A unicast link may be established at stage 1040, and a ranging cryptographic key (e.g., a symmetric key) may be established or otherwise obtained at stages 1060, 1070, 1080 for protecting unicast signaling for mobile-to-mobile positioning. The ranging cryptographic key may be referred to as a PC5 ranging key because the key is used to protect signaling on a PC5 interface between UEs. For example, the ranging key may be obtained based on a certificate of the UE 1001, 1002, similar to the discussion above for certificate-based key determination and protection for unicast transmissions (where the UE 1001, 1002 provides the respective certificate to the other UE 1001, 1002 and the symmetric key is determined based on the public key of the UE 1001, 1002).

[0131] operate

[0132] refer to Fig.11 , and further reference Figures 1 to 10 , the positioning session signaling method 1100 includes the stages shown. However, the method 1100 is an example and not a limitation. The method 1100 can be modified, for example, by adding, removing, rearranging, combining, performing concurrently, and / or splitting a single stage into multiple stages.

[0133] At stage 1110, method 1100 includes obtaining, at a first wireless communication device, first security material including a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof. For example, the SL positioning unit 550 of the UE 500 (e.g., UE 901, UE 902, UE1001, or UE 1002) may obtain security material (e.g., a symmetric key) from the network entity 600 via the transceiver 520 during stage 910 or 1010 (e.g., in response to a request for security material). The request may be transmitted by the first UE (e.g., the target UE 902) in response to the second UE (e.g., the initiator UE 901) instructing the first UE to contact the network entity 600 (e.g., the RKMF 650) to obtain the security material (e.g., the symmetric key). As another example, the SL positioning unit 550 may obtain the security material by retrieving the security material from the memory 530, for example, where the security material has been previously received from the network entity 600 or pre-stored in the memory 530, for example, during the manufacture of the UE 500. Processor 510 (possibly in combination with memory 530, possibly in combination with transceiver 520 (eg, wireless receiver 244 and antenna 246)) may include means for obtaining a first security material.

[0134] At stage 1120, method 1100 includes sending a ranging signal from the first wireless communication device to the second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof. The first security material may be provided at stage 910 (on demand or in advance) and / or the second security material may be provided at stages 940, 950. For example, UE 901 or UE 902 may broadcast PRS 972 based on a ranging key provided at stage 910 or provided at stage 950 for unicast signaling. The second security material may be provided on demand or before the group is formed. The first portion of the first security information may be a discovery key for ranging, or may be a ranging specific key. The ranging signal may be a broadcast, groupcast, or unicast (e.g., if a unicast link is established at stage 940 or stage 1040). The processor 510 (possibly in combination with the memory 530, in combination with the transceiver 520 (e.g., the wireless transmitter 242 and the antenna 246)) may include means for sending a ranging signal (and determining the ranging signal based on at least a first portion of the first security material and / or based on the second security material).

[0135] Implementations of method 1100 may include one or more of the following features. In an example implementation, the first security material includes a ranging cryptographic key as a symmetric cryptographic key, and the ranging signal includes a modified positioning reference signal based on a basic positioning reference signal and the ranging cryptographic key. For example, the modified PRS may be a randomized basic PRS (e.g., an initial PRS or a previous (e.g., most recent) PRS) (e.g., where the previous PRS is the most recently randomized PRS in a randomized PRS chain). The ranging cryptographic key may be the same key as the discovery cryptographic key. In another example implementation, the first security material includes a first cryptographic signature certificate, the first cryptographic signature certificate including a first asymmetric cryptographic key, and the positioning session signaling method further includes: sending the first cryptographic signature certificate from the first wireless communication device to the second wireless communication device; and receiving a second cryptographic signature certificate including a second asymmetric cryptographic key from the second wireless communication device at the first wireless communication device; wherein sending the ranging signal includes sending the ranging signal as an encrypted unicast ranging signal encrypted based on the symmetric cryptographic key, the symmetric cryptographic key being based on the first asymmetric cryptographic key and the second asymmetric cryptographic key. For example, the first security material may be a certificate including a public key of a first UE (e.g., UE 901, UE 902, UE 1001, or UE 1002) signed by a private key of RKMF 650. The UE (e.g., UE 901) may be configured to send and may send the certificate to another UE (e.g., UE 902), and may be configured to receive a similar certificate (of the public key of another UE signed by RKMF 650) from the other UE. The first UE may send a ranging signal encrypted using a symmetric key determined from the certificate (e.g., by using the UE's public key as an input to an algorithm (e.g., an EAP-TLS process)). The processor 510 (possibly in combination with the memory 530, in combination with the transceiver 520 (e.g., the wireless transmitter 242 and the antenna 246)) may include a component for sending a first cryptographically signed certificate. The processor 510 (possibly in combination with the memory 530, in combination with the transceiver 520 (e.g., the wireless receiver 244 and the antenna 246)) may include a component for receiving a second cryptographically signed certificate. In another example implementation, the first cryptographically signed certificate is sent based on the current location of the first wireless communication device within a validity area associated with the first cryptographically signed certificate. For example, the SL positioning unit 550 may be configured to not send a certificate for the signed public key of the UE 500 unless the UE 500 is currently located in an area in which the UE 500 is authorized by the certificate to be sent by the UE 500.

[0136] Additionally or alternatively, a specific implementation of method 1100 may include one or more of the following features. In an example implementation, method 1100 also includes receiving a ranging cryptographic key from a second wireless communication device or a network entity at the first wireless communication device, and the second security material includes the ranging cryptographic key. For example, at stage 950, UE 902 receives a cryptographic key (e.g., a symmetric key) from network entity 600. As another example, at stage 940, UE 901 receives a cryptographic key from UE 902 (the cryptographic key received by UE 902 from network entity 600 at stage 950). UE 901, 902 may use the ranging cryptographic key to protect (e.g., confidentiality protection by encryption and / or security protection by signing) ranging signals using the ranging cryptographic key. Processor 510 (possibly in combination with memory 530, possibly in combination with transceiver 520 (e.g., wireless receiver 244 and antenna 246)) may include a component for receiving a ranging cryptographic key. In another example implementation, the method 1100 also includes sending a discovery message based on at least a second portion of the first security material from the first wireless communication device to the second wireless communication device. The first portion and the second portion of the first security material may be the same (e.g., a symmetric group key), or the first portion and the second portion of the first security material may be any two of the following: a symmetric key; an asymmetric key; or a certificate. For example, the UE 902 may send a discovery message encrypted with a symmetric key, or signed using an asymmetric private key, or including a certificate. The processor 510 (possibly in combination with the memory 530, possibly in combination with the transceiver 520 (e.g., the wireless transmitter 242 and the antenna 246)) may include a component for sending a discovery message (and encrypting and / or signing the discovery message). In another example implementation, the first portion of the first security material is the same as the second portion of the first security material.

[0137] Additionally or alternatively, a specific implementation of method 1100 may include one or more of the following features. In an example implementation, the first security material includes a ranging cryptographic key, and the positioning session signaling method further includes: sending an indication from the first wireless communication device to the second wireless communication device for the second wireless communication device to contact a network entity to obtain a ranging cryptographic key; and determining the ranging cryptographic key at the first wireless communication device based on a basic cryptographic key stored at the first wireless communication device. For example, the initiator UE 901 sends an indication to the target UE 902 during stage 940 of unicast link establishment for the target UE 902 to contact the network entity 600 to obtain a ranging cryptographic key. The indication may include an ID and a freshness parameter of the initiator UE 901, and may include an indication of a cryptographic key (e.g., a basic key) supplied to the initiator UE 901 by the network entity 600 (e.g., RKMF 650). The initiator UE 901 may determine the ranging key based on the protocol or algorithm in which the cryptographic key supplied to the initiator UE 901 by the RKMF 650 and stored in the memory 530 and the basic cryptographic key known to both the initiator UE 901 and the RKMF 650 are used as input. The basic cryptographic key is stored by both the initiator UE 901 and the network entity 600. The basic cryptographic key may be an initial key, or may be a key previously derived from the initial key, or another key in the key chain back to the initial key. For example, the first UE and the second UE want to have a symmetric key for unicast security between them. The basic key is supplied to the first UE. The first UE and the RKMF 650 use the basic key and the freshness parameter (e.g., the first random number generated by the first UE and the second random number generated by the RKMF 650) as inputs to the key derivation function (KDF) to determine the symmetric key. The first UE transmits the first random number to the RKMF 650, and the RKMF 650 transmits the second random number to the first UE. Both the first UE and the RKMF 650 may generate a symmetric key knowing the base key and the first random number and the second random number. The processor 510 (possibly in combination with the memory 530, in combination with the transceiver 520 (e.g., the wireless transmitter 242 and the antenna 246)) may include means for sending an indication for the second UE to contact the network entity to obtain the ranging cryptographic key. The processor 510 (possibly in combination with the memory 530) may include means for determining the ranging cryptographic key based on the base cryptographic key.

[0138] Additionally or alternatively, a specific implementation of method 1100 may include one or more of the following features. In an example implementation, the first security material includes a plurality of cryptographically signed certificates, the cryptographically signed certificates including a public cryptographic key of the first wireless communication device cryptographically signed by an entity separate from the first wireless communication device and the second wireless communication device, and the positioning session signaling method further includes: sending a discovery message from the first wireless communication device to the second wireless communication device, the discovery message being cryptographically signed by the first wireless communication device and including at least one of the plurality of cryptographically signed certificates based on a certificate selection policy. For example, for autonomous group formation, the initiator UE 1001 may have a plurality of certificates stored in the memory 530 (where each certificate is a public key of the initiator UE 1001 signed by a private key of the network entity 600). At stage 1020, the initiator UE 1001 may transmit a discovery message 1022 signed by the initiator UE 1001 and including one or more of the certificates signed by the network entity 600. The certificate in the discovery message 1022 may be selected by the initiator UE 1001 according to a certificate selection policy known to both UEs 1001 and 1002. The processor 510 (possibly in combination with the memory 530, possibly in combination with the transceiver 520 (e.g., the wireless transmitter 242 and the antenna 246)) may include a component for sending a discovery message to the second UE. In another example implementation, the method 1100 also includes the first wireless communication device negotiating a ranging cryptographic key with the second wireless communication device during group formation, and the ranging signal includes a modified positioning reference signal based on a basic positioning reference signal, or a ranging cryptographic key, or a freshness parameter, or a combination thereof, wherein the freshness parameter includes a timer, a counter, a system frame number, a time slot number, a symbol number, or any combination of two or more thereof. Therefore, the basic PRS, or the ranging cryptographic key, or the freshness parameter may be used as an input to an algorithm to generate a randomized PRS. Alternatively, the basic PRS and the ranging cryptographic key, or the basic PRS and the freshness parameter, or the ranging cryptographic key and the freshness parameter, or the basic PRS and the ranging cryptographic key and the freshness parameter may be used as inputs to the algorithm for generating the randomized PRS. For example, the PRS sent by the initiator UE 1001 to the target UE 1002 (or from the target UE 1002 to the initiator UE 1001) may be randomized by using the cryptographic key negotiated by the UEs 1001, 1002 during group formation (where the UEs 1001, 1002 are determined as a group for the positioning session) as at least one input to the algorithm for randomizing the PRS. As an alternative or in addition to the key, the freshness parameter may be used additionally or alternatively as an input to the algorithm.The freshness parameter may be a timer, a counter, a system frame number, a time slot number, a symbol number, or any combination of two or more thereof (e.g., a timer and a system frame number; or a counter, a time slot number and a symbol number; etc.). The processor 510 (possibly in combination with the memory 530, in combination with the transceiver 520 (e.g., the wireless transmitter 242, the wireless receiver 244, and the antenna 246)) may include means for negotiating a ranging cryptographic key.

[0139] Additionally or alternatively, an implementation of method 1100 may include one or more of the following features. In an example implementation, the first security material is obtained in response to service establishment. For example, the first security material may be pre-provisioned and used when joining a PRS session. In another example implementation, the first security material is obtained in response to joining a ranging session. For example, the first security material may be obtained in response to the first wireless communication device joining an on-demand PRS session.

[0140] Specific implementation examples

[0141] Specific implementation examples are provided in the following numbered clauses.

[0142] Clause 1. A first wireless communication device comprising:

[0143] Transceiver;

[0144] Memory; and

[0145] a processor, the processor being communicatively coupled to the transceiver and the memory, the processor being configured to:

[0146] obtaining a first security material, the first security material comprising a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and

[0147] A ranging signal is sent via the transceiver to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

[0148] Clause 2. A first wireless communication device according to clause 1, wherein the first security material includes the ranging cryptographic key as a symmetric cryptographic key, and wherein the ranging signal includes a modified positioning reference signal, which is based on a basic positioning reference signal and the ranging cryptographic key.

[0149] Clause 3. The first wireless communication device of clause 1, wherein the first security material comprises a first cryptographic signing certificate, the first cryptographic signing certificate comprising a first asymmetric cryptographic key, and wherein the processor is further configured to:

[0150] transmitting, via the transceiver, the first cryptographically signed certificate to the second wireless communication device; and

[0151] receiving, via the transceiver, a second cryptographic signing certificate from the second wireless communication device, the second cryptographic signing certificate comprising a second asymmetric cryptographic key;

[0152] In order to send the ranging signal, the processor is configured to send the ranging signal as an encrypted unicast ranging signal that has been encrypted based on a symmetric cryptographic key, wherein the symmetric cryptographic key is based on the first asymmetric cryptographic key and the second asymmetric cryptographic key.

[0153] Clause 4. The first wireless communication device of Clause 3, wherein the processor is configured to send the first cryptographic signing certificate within a validity region associated with the first cryptographic signing certificate based on a current location of the first wireless communication device.

[0154] Clause 5. The first wireless communication device of Clause 1, wherein the processor is further configured to receive the ranging cryptographic key via the transceiver, and wherein the second security material includes the ranging cryptographic key.

[0155] Clause 6. The first wireless communication device of Clause 1, wherein the processor is further configured to send a discovery message to the second wireless communication device via the transceiver, the discovery message being based on at least a second portion of the first security material.

[0156] Clause 7. The first wireless communication device of Clause 6, wherein the first portion of the first security material is the same as the second portion of the first security material.

[0157] Clause 8. The first wireless communication device of clause 1, wherein the first security material comprises the ranging cryptographic key, and the processor is further configured to:

[0158] sending, via the transceiver, to the second wireless communication device an indication for the second wireless communication device to contact a network entity to obtain the ranging cryptographic key; and

[0159] The ranging cryptographic key is determined based on a base cryptographic key stored at the first wireless communication device.

[0160] Clause 9. The first wireless communication device of clause 1, wherein:

[0161] The first security material includes a plurality of cryptographically signed certificates including a public cryptographic key of the first wireless communication device cryptographically signed by an entity separate from the first wireless communication device and the second wireless communication device; and

[0162] The processor is further configured to send a discovery message to the second wireless communication device via the transceiver, the discovery message being cryptographically signed by the first wireless communication device and including at least one of the plurality of cryptographically signed certificates based on a certificate selection policy.

[0163] Clause 10. A first wireless communication device according to clause 9, wherein the processor is further configured to negotiate the ranging cryptographic key with the second wireless communication device during group formation, and wherein the ranging signal comprises a modified positioning reference signal based on a basic positioning reference signal, or the ranging cryptographic key, or a freshness parameter, or a combination of two or more thereof, wherein the freshness parameter comprises a timer, a counter, a system frame number, a time slot number, a symbol number, or any combination of two or more thereof.

[0164] Clause 11. The first wireless communication device of Clause 1, wherein the processor is configured to obtain the first security material in response to service establishment.

[0165] Clause 12. The first wireless communication device of Clause 1, wherein the processor is configured to obtain the first security material in response to joining a ranging session.

[0166] Clause 13. A positioning session signaling method, the positioning session signaling method comprising:

[0167] obtaining, at the first wireless communication device, first security material, the first security material comprising a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and

[0168] A ranging signal is sent from the first wireless communication device to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

[0169] Clause 14. A positioning session signaling method according to Clause 13, wherein the first security material includes the ranging cryptographic key as a symmetric cryptographic key, and wherein the ranging signal includes a modified positioning reference signal, which is based on a basic positioning reference signal and the ranging cryptographic key.

[0170] Clause 15. A method for positioning session signaling according to clause 13, wherein the first security material comprises a first cryptographic signature certificate, the first cryptographic signature certificate comprises a first asymmetric cryptographic key, and wherein the method for positioning session signaling further comprises:

[0171] sending the first cryptographic signing certificate from the first wireless communication device to the second wireless communication device; and

[0172] receiving, at the first wireless communication device, from the second wireless communication device, a second cryptographic signing certificate including a second asymmetric cryptographic key;

[0173] Wherein sending the ranging signal comprises sending the ranging signal as an encrypted unicast ranging signal that has been encrypted based on a symmetric cryptographic key, wherein the symmetric cryptographic key is based on the first asymmetric cryptographic key and the second asymmetric cryptographic key.

[0174] Clause 16. The positioning session signaling method of Clause 15, wherein the first cryptographically signed certificate is sent based on a current location of the first wireless communication device being within a validity region associated with the first cryptographically signed certificate.

[0175] Clause 17. A positioning session signaling method according to Clause 13, the positioning session signaling method also includes receiving the ranging cryptographic key at the first wireless communication device from the second wireless communication device or a network entity, and wherein the second security material includes the ranging cryptographic key.

[0176] Clause 18. The positioning session signaling method of clause 13, further comprising sending a discovery message from the first wireless communication device to the second wireless communication device, the discovery message being based on at least a second portion of the first security material.

[0177] Clause 19. The positioning session signaling method of Clause 18, wherein the first portion of the first security material is the same as the second portion of the first security material.

[0178] Clause 20. A positioning session signaling method according to clause 13, wherein the first security material comprises the ranging cryptographic key, and the positioning session signaling method further comprises:

[0179] sending, from the first wireless communication device to the second wireless communication device, an indication for the second wireless communication device to contact a network entity to obtain the ranging cryptographic key; and

[0180] The ranging cryptographic key is determined at the first wireless communication device based on a base cryptographic key stored at the first wireless communication device.

[0181] Clause 21. A positioning session signalling method according to clause 13, wherein:

[0182] The first security material includes a plurality of cryptographically signed certificates including a public cryptographic key of the first wireless communication device cryptographically signed by an entity separate from the first wireless communication device and the second wireless communication device; and

[0183] The positioning session signaling method further includes sending a discovery message from the first wireless communication device to the second wireless communication device, the discovery message being cryptographically signed by the first wireless communication device and including at least one of the plurality of cryptographically signed certificates based on a certificate selection policy.

[0184] Clause 22. According to the positioning session signaling method of Clause 21, the positioning session signaling method also includes: the first wireless communication device negotiates the ranging password key with the second wireless communication device during group formation, and wherein the ranging signal includes a modified positioning reference signal based on a basic positioning reference signal, or the ranging password key, or a freshness parameter, or a combination of two or more of them, wherein the freshness parameter includes a timer, a counter, a system frame number, a time slot number, a symbol number, or any combination of two or more of them.

[0185] Clause 23. The positioning session signaling method of clause 13, wherein the first security material is obtained in response to service establishment.

[0186] Clause 24. The positioning session signaling method of clause 13, wherein the first security material is obtained in response to joining a ranging session.

[0187] Clause 25. A first wireless communication device comprising:

[0188] means for obtaining first security material, the first security material comprising a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and

[0189] Means for sending a ranging signal to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

[0190] Clause 26. A first wireless communication device according to clause 25, wherein the first security material includes the ranging cryptographic key as a symmetric cryptographic key, and wherein the ranging signal includes a modified positioning reference signal, which is based on a basic positioning reference signal and the ranging cryptographic key.

[0191] Clause 27. The first wireless communication device of clause 25, wherein the first security material comprises a first cryptographic signing certificate, the first cryptographic signing certificate comprising a first asymmetric cryptographic key, and wherein the first wireless communication device further comprises:

[0192] means for sending the first cryptographic signing certificate to the second wireless communication device; and

[0193] means for receiving, from the second wireless communication device, a second cryptographic signing certificate comprising a second asymmetric cryptographic key;

[0194] Wherein the means for sending the ranging signal comprises means for sending the ranging signal as an encrypted unicast ranging signal that has been encrypted based on a symmetric cryptographic key, the symmetric cryptographic key being based on the first asymmetric cryptographic key and the second asymmetric cryptographic key.

[0195] Clause 28. The first wireless communication device of Clause 27, wherein the means for sending the first cryptographic signing certificate comprises means for sending the first cryptographic signing certificate within a validity region associated with the first cryptographic signing certificate based on a current location of the first wireless communication device.

[0196] Clause 29. The first wireless communication device of clause 25, further comprising means for receiving the ranging cryptographic key from the second wireless communication device or a network entity, and wherein the second security material comprises the ranging cryptographic key.

[0197] Clause 30. The first wireless communication device of Clause 25, further comprising means for sending a discovery message based on at least a second portion of the first security material to the second wireless communication device.

[0198] Clause 31. The first wireless communication device of clause 30, wherein the first portion of the first security material is the same as the second portion of the first security material.

[0199] Clause 32. The first wireless communication device of clause 25, wherein the first security material comprises the ranging cryptographic key, and the first wireless communication device further comprises:

[0200] means for sending an indication to the second wireless communication device for the second wireless communication device to contact a network entity to obtain the ranging cryptographic key; and

[0201] Means for determining the ranging cryptographic key based on a base cryptographic key stored at the first wireless communication device.

[0202] Clause 33. The first wireless communication device of clause 25, wherein:

[0203] The first security material includes a plurality of cryptographically signed certificates including a public cryptographic key of the first wireless communication device cryptographically signed by an entity separate from the first wireless communication device and the second wireless communication device; and

[0204] The first wireless communication device also includes means for sending a discovery message to the second wireless communication device, the discovery message being cryptographically signed by the first wireless communication device and including at least one of the plurality of cryptographically signed certificates based on a certificate selection policy.

[0205] Clause 34. A first wireless communication device according to clause 33, wherein the first wireless communication device also includes a component for negotiating the ranging cryptographic key with the second wireless communication device during group formation, and wherein the ranging signal includes a modified positioning reference signal based on a basic positioning reference signal, or the ranging cryptographic key, or a freshness parameter, or a combination of two or more thereof, wherein the freshness parameter includes a timer, a counter, a system frame number, a time slot number, a symbol number, or any combination of two or more thereof.

[0206] Clause 35. The first wireless communications device of Clause 25, wherein the means for obtaining the first security material comprises means for obtaining the first security material in response to service establishment.

[0207] Clause 36. The first wireless communications device of Clause 25, wherein the means for obtaining the first security material comprises means for obtaining the first security material in response to joining a ranging session.

[0208] Clause 37. A non-transitory processor-readable storage medium comprising processor-readable instructions configured to cause a processor of a first wireless communication device to:

[0209] obtaining a first security material, the first security material comprising a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and

[0210] A ranging signal is sent to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

[0211] Clause 38. A non-transitory processor-readable storage medium according to clause 37, wherein the first security material includes the ranging cryptographic key as a symmetric cryptographic key, and wherein the ranging signal includes a modified positioning reference signal, which is based on a basic positioning reference signal and the ranging cryptographic key.

[0212] Clause 39. The non-transitory processor-readable storage medium of clause 37, wherein the first security material comprises a first cryptographic signing certificate, the first cryptographic signing certificate comprising a first asymmetric cryptographic key, and wherein the processor-readable instructions further comprise processor-readable instructions configured to cause the processor to:

[0213] sending the first cryptographic signing certificate to the second wireless communication device; and

[0214] receiving a second cryptographic signing certificate from the second wireless communication device, the second cryptographic signing certificate comprising a second asymmetric cryptographic key;

[0215] The processor-readable instructions configured to cause the processor to send the ranging signal include the following processor-readable instructions, the processor-readable instructions configured to cause the processor to send the ranging signal as an encrypted unicast ranging signal that has been encrypted based on a symmetric cryptographic key, wherein the symmetric cryptographic key is based on the first asymmetric cryptographic key and the second asymmetric cryptographic key.

[0216] Clause 40. A non-transitory processor-readable storage medium according to clause 39, wherein the processor-readable instructions configured to cause the processor to send the first cryptographic signing certificate include the following processor-readable instructions, which are configured to cause the processor to send the first cryptographic signing certificate within a valid area associated with the first cryptographic signing certificate based on the current location of the first wireless communication device.

[0217] Clause 41. A non-transitory processor-readable storage medium according to clause 37, wherein the processor-readable instructions also include the following processor-readable instructions, which are configured to cause the processor to receive the ranging cryptographic key from the second wireless communication device or network entity, and wherein the second security material includes the ranging cryptographic key.

[0218] Clause 42. A non-transitory processor-readable storage medium according to clause 37, wherein the processor-readable instructions also include the following processor-readable instructions, which are configured to cause the processor to send a discovery message to the second wireless communication device, and the discovery message is based on at least a second portion of the first security material.

[0219] Clause 43. The non-transitory processor-readable storage medium of Clause 42, wherein the first portion of the first security material is the same as the second portion of the first security material.

[0220] Clause 44. The non-transitory processor-readable storage medium of clause 37, wherein the first security material comprises the ranging cryptographic key, and wherein the processor-readable instructions further comprise processor-readable instructions configured to cause the processor to:

[0221] sending an indication to the second wireless communication device for the second wireless communication device to contact a network entity to obtain the ranging cryptographic key; and

[0222] The ranging cryptographic key is determined based on a base cryptographic key stored at the first wireless communication device.

[0223] Clause 45. The non-transitory processor-readable storage medium of clause 37, wherein:

[0224] The first security material includes a plurality of cryptographically signed certificates including a public cryptographic key of the first wireless communication device cryptographically signed by an entity separate from the first wireless communication device and the second wireless communication device; and

[0225] The processor-readable instructions also include the following processor-readable instructions, which are configured to cause the processor to send a discovery message to the second wireless communication device, the discovery message being cryptographically signed by the first wireless communication device and including at least one of the multiple cryptographic signing certificates based on a certificate selection policy.

[0226] Clause 46. A non-transitory processor-readable storage medium according to clause 45, wherein the processor-readable instructions also include the following processor-readable instructions, which are configured to cause the processor to negotiate the ranging cryptographic key with the second wireless communication device during group formation, and wherein the ranging signal includes a modified positioning reference signal based on a basic positioning reference signal, or the ranging cryptographic key, or a freshness parameter, or a combination of two or more thereof, wherein the freshness parameter includes a timer, a counter, a system frame number, a time slot number, a symbol number, or any combination of two or more thereof.

[0227] Clause 47. A non-transitory processor-readable storage medium according to clause 37, wherein the processor-readable instructions configured to cause the processor to obtain the first security material include the following processor-readable instructions, which are configured to cause the processor to obtain the first security material in response to service establishment.

[0228] Clause 48. A non-transitory processor-readable storage medium according to clause 37, wherein the processor-readable instructions configured to cause the processor to obtain the first security material include the following processor-readable instructions, which are configured to cause the processor to obtain the first security material in response to joining a ranging session.

[0229] Other considerations

[0230] Other examples and implementations are within the scope of this disclosure and the appended claims. For example, due to the nature of software and computers, the functions described above may be implemented using software executed by a processor, hardware, firmware, hard wiring, or any combination thereof. Features that implement the functions may also be physically located at different locations, including being distributed so that various parts of the functions are implemented at different physical locations.

[0231] As used herein, the singular forms "a", "an", and "the" also include the plural forms, unless the context clearly indicates otherwise. Therefore, a device referred to in the singular form (e.g., "device", "the / said device"), included in the claims, includes one or more of such devices (e.g., "processor" includes one or more processors, "the / said processor" includes one or more processors, "memory" includes one or more memories, "the / said memory" includes one or more memories, etc.). As used herein, the term "comprising" indicates the presence of the recited features, integers, steps, operations, elements, and / or components, but does not exclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0232] Likewise, as used herein, “or” used in a list of items (possibly followed by “at least one of” or “one or more of”) indicates a disjunctive list, so that, for example, a list of “at least one of A, B, or C,” or a list of “one or more of A, B, or C,” or a list of “A or B or C” means A or B or C, or AB (A and B), or AC (A and C), or BC (B and C), or ABC (i.e., A and B and C), or a combination having more than one feature (e.g., AA, AAB, ABBC, etc.). Thus, a statement that an item (e.g., a processor) is configured to perform a function with respect to at least one of A or B, or a statement that an item is configured to perform function A or function B means that the item may be configured to perform a function with respect to A, or may be configured to perform a function with respect to B, or may be configured to perform functions with respect to both A and B. For example, the phrase "a processor configured to measure at least one of A or B" or "a processor configured to measure A or measure B" means that the processor may be configured to measure A (and may or may not be configured to measure B), or may be configured to measure B (and may or may not be configured to measure A), or may be configured to measure A and measure B (and may be configured to select which of A and B to measure or both). Similarly, the description of a component for measuring at least one of A or B includes: a component for measuring A (which may or may not be able to measure B), or a component for measuring B (and may or may not be configured to measure A), or a component for measuring A and B (which may be able to select which of A and B to measure or both). As another example, the description that an item (e.g., a processor) is configured to perform at least one of function X or perform function Y means that the item may be configured to perform function X, or may be configured to perform function Y, or may be configured to perform function X and perform function Y. For example, the phrase "a processor configured to measure at least one of X or Y" means that the processor may be configured to measure X (and may or may not be configured to measure Y), or may be configured to measure Y (and may or may not be configured to measure X), or may be configured to measure X and measure Y (and may be configured to select which one or both of X and Y to measure).

[0233] As used herein, unless otherwise stated, a statement that a function or operation is "based on" an item or condition means that the function or operation is based on the stated item or condition, and may be based on one or more items and / or conditions other than the stated item or condition.

[0234] Substantial changes may be made according to specific requirements. For example, customized hardware may also be used, and / or specific elements may be implemented in hardware, in software (including portable software, such as applets, etc.) executed by a processor, or in both. In addition, connections with other computing devices such as network input / output devices may be employed. Unless otherwise indicated, components (functional or otherwise) shown in the figures and / or discussed herein as being connected or communicating with each other are communicatively coupled. That is, these components may be connected directly or indirectly to enable communication between them.

[0235] The systems and devices discussed above are examples. Various configurations may appropriately omit, replace, or add various procedures or components. For example, features described with respect to certain configurations may be combined in various other configurations. Different aspects and elements of a configuration may be combined in a similar manner. In addition, technology is constantly evolving, and therefore many elements are examples and do not limit the scope of the present disclosure or claims.

[0236] A wireless communication system is a system in which communications are transmitted wirelessly between wireless communication devices, i.e., by propagation of electromagnetic waves and / or sound waves through the air space rather than by wires or other physical connections. A wireless communication system (also referred to as a wireless communication system, a wireless communication network, or a wireless communication network) may not have all communications transmitted wirelessly, but may be configured to have at least some communications transmitted wirelessly. In addition, the term "wireless communication device" or similar terms does not require that the functionality of the device is exclusively or even primarily used for communication, that the communication using the wireless communication device is exclusively or even primarily wireless, or that the device is a mobile device, but indicates that the device includes wireless communication capabilities (unidirectional or bidirectional), for example, including at least one radio component (each radio component is a part of a transmitter, a receiver, or a transceiver) for wireless communication. UE is a mobile wireless communication device, and the term "UE" does not require a specific form of mobile wireless communication device other than the description herein. The term "mobile" does not require that the mobile wireless communication device is in motion. The mobile wireless communication device is configured to be mobile, for example, lightweight and sized for transportation, such as a tablet computer or a smart phone, but the mobile wireless communication device is not limited to these forms of devices.

[0237] Specific details are given in this specification to provide a thorough understanding of example configurations (including specific implementations). However, configurations can be practiced without these specific details. For example, well-known circuits, processes, algorithms, structures, and techniques have been shown without unnecessary details to avoid confusing these configurations. The description herein provides example configurations without limiting the scope, applicability, or configuration of the claims. On the contrary, the previous description of the configuration provides a description for implementing the described technology. Various changes can be made to the functions and arrangements of the elements.

[0238] As used herein, the terms "processor-readable medium," "machine-readable medium," and "computer-readable medium" refer to any medium that participates in providing data that causes a machine to operate in a particular manner. Using a computing platform, various processor-readable media may be involved in providing instructions / codes to a processor for execution, and / or may be used to store and / or carry such instructions / codes (e.g., as signals). In many specific implementations, processor-readable media are physical and / or tangible storage media. Such media may take many forms, including, but not limited to, non-volatile media and volatile media. Non-volatile media include, for example, optical disks and / or magnetic disks. Volatile media include, but are not limited to, dynamic memory.

[0239] After describing several example configurations, various modifications, alternative constructions, and equivalents may be used. For example, the above elements may be components of a larger system, in which other rules may take precedence over the application of the present disclosure or otherwise modify the application of the present disclosure. In addition, several operations may be taken before, during, or after considering the above elements. Accordingly, the above description does not limit the scope of the claims.

[0240] Unless otherwise indicated, "approximately" and / or "about" as used herein in reference to a measurable value (such as an amount, a duration of time, etc.) encompasses variations of ±20% or ±10%, ±5%, or +0.1% from the specified value, as appropriate in the context of the systems, devices, circuits, methods, and other specific implementations described herein. Unless otherwise indicated, "substantially" as used herein in reference to a measurable value (such as an amount, a duration of time, a physical property (such as frequency), etc.) also encompasses variations of ±20% or ±10%, ±5%, or +0.1% from the specified value, as appropriate in the context of the systems, devices, circuits, methods, and other specific implementations described herein.

[0241] A statement that a value exceeds (or is greater than or above) a first threshold is equivalent to a statement that the value meets or exceeds a second threshold that is slightly greater than the first threshold, e.g., the second threshold is one value higher than the first threshold at the resolution of the computing system. A statement that a value is less than (or within or below) a first threshold is equivalent to a statement that the value is less than or equal to a second threshold that is slightly less than the first threshold, e.g., the second threshold is one value lower than the first threshold at the resolution of the computing system.

Claims

1. A first wireless communication device, the first wireless communication device comprising: Transceiver; Memory; and a processor, the processor being communicatively coupled to the transceiver and the memory, the processor being configured to: obtaining a first security material, the first security material comprising a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and A ranging signal is sent via the transceiver to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

2. The first wireless communication device of claim 1 , wherein the first security material comprises the ranging cryptographic key as a symmetric cryptographic key, and wherein the ranging signal comprises a modified positioning reference signal, the modified positioning reference signal being based on a basic positioning reference signal and the ranging cryptographic key.

3. The first wireless communication device of claim 1 , wherein the first security material comprises a first cryptographic signing certificate, the first cryptographic signing certificate comprising a first asymmetric cryptographic key, and wherein the processor is further configured to: transmitting, via the transceiver, the first cryptographically signed certificate to the second wireless communication device; and receiving, via the transceiver, a second cryptographic signing certificate from the second wireless communication device, the second cryptographic signing certificate comprising a second asymmetric cryptographic key; In order to send the ranging signal, the processor is configured to send the ranging signal as an encrypted unicast ranging signal that has been encrypted based on a symmetric cryptographic key, wherein the symmetric cryptographic key is based on the first asymmetric cryptographic key and the second asymmetric cryptographic key.

4. The first wireless communication device of claim 3, wherein the processor is configured to send the first cryptographic signing certificate within a validity region associated with the first cryptographic signing certificate based on a current location of the first wireless communication device.

5. The first wireless communication device of claim 1, wherein the processor is further configured to receive the ranging cryptographic key via the transceiver, and wherein the second security material includes the ranging cryptographic key.

6. The first wireless communication device of claim 1, wherein the processor is further configured to send a discovery message to the second wireless communication device via the transceiver, the discovery message being based on at least a second portion of the first security material.

7. The first wireless communication device of claim 6, wherein the first portion of the first security material is the same as the second portion of the first security material.

8. The first wireless communication device of claim 1 , wherein the first security material comprises the ranging cryptographic key, and the processor is further configured to: sending, via the transceiver, to the second wireless communication device an indication for the second wireless communication device to contact a network entity to obtain the ranging cryptographic key; and The ranging cryptographic key is determined based on a base cryptographic key stored at the first wireless communication device.

9. The first wireless communication device according to claim 1, wherein: The first security material includes a plurality of cryptographically signed certificates including a public cryptographic key of the first wireless communication device cryptographically signed by an entity separate from the first wireless communication device and the second wireless communication device; and The processor is further configured to send a discovery message to the second wireless communication device via the transceiver, the discovery message being cryptographically signed by the first wireless communication device and including at least one of the plurality of cryptographically signed certificates based on a certificate selection policy.

10. The first wireless communication device of claim 9, wherein the processor is further configured to negotiate the ranging cryptographic key with the second wireless communication device during group formation, and wherein the ranging signal comprises a modified positioning reference signal based on a basic positioning reference signal, or the ranging cryptographic key, or a freshness parameter, or a combination of two or more thereof, wherein the freshness parameter comprises a timer, a counter, a system frame number, a slot number, a symbol number, or any combination of two or more thereof.

11. A positioning session signaling method, the positioning session signaling method comprising: obtaining, at a first wireless communication device, first security material, the first security material comprising a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; as well as A ranging signal is sent from the first wireless communication device to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

12. The positioning session signaling method according to claim 11, wherein the first security material includes the ranging cryptographic key as a symmetric cryptographic key, and wherein the ranging signal includes a modified positioning reference signal, which is based on a basic positioning reference signal and the ranging cryptographic key.

13. The positioning session signaling method according to claim 11, wherein the first security material comprises a first cryptographic signature certificate, the first cryptographic signature certificate comprises a first asymmetric cryptographic key, and wherein the positioning session signaling method further comprises: sending the first cryptographic signing certificate from the first wireless communication device to the second wireless communication device; as well as receiving, at the first wireless communication device, from the second wireless communication device, a second cryptographic signing certificate, the second cryptographic signing certificate comprising a second asymmetric cryptographic key; Wherein sending the ranging signal comprises sending the ranging signal as an encrypted unicast ranging signal that has been encrypted based on a symmetric cryptographic key, wherein the symmetric cryptographic key is based on the first asymmetric cryptographic key and the second asymmetric cryptographic key.

14. The positioning session signaling method of claim 13, wherein the first cryptographically signed certificate is sent based on a current location of the first wireless communication device being within a validity region associated with the first cryptographically signed certificate.

15. The positioning session signaling method according to claim 11, further comprising receiving the ranging cryptographic key at the first wireless communication device from the second wireless communication device or a network entity, and wherein the second security material comprises the ranging cryptographic key.

16. The positioning session signaling method of claim 11, further comprising sending a discovery message from the first wireless communication device to the second wireless communication device, the discovery message being based on at least a second portion of the first security material. 17 . The positioning session signaling method according to claim 16 , wherein the first portion of the first security material is the same as the second portion of the first security material.

18. The positioning session signaling method according to claim 11, wherein the first security material comprises the ranging cryptographic key, and the positioning session signaling method further comprises: sending, from the first wireless communication device to the second wireless communication device, an indication for the second wireless communication device to contact a network entity to obtain the ranging cryptographic key; as well as The ranging cryptographic key is determined at the first wireless communication device based on a base cryptographic key stored at the first wireless communication device.

19. The positioning session signaling method according to claim 11, wherein: the first security material comprising a plurality of cryptographically signed certificates including a public cryptographic key of the first wireless communication device cryptographically signed by an entity separate from the first wireless communication device and the second wireless communication device; and The positioning session signaling method further includes sending a discovery message from the first wireless communication device to the second wireless communication device, the discovery message being cryptographically signed by the first wireless communication device and including at least one of the plurality of cryptographically signed certificates based on a certificate selection policy.

20. The positioning session signaling method according to claim 19, further comprising: The first wireless communication device negotiates the ranging cryptographic key with the second wireless communication device during group formation, and wherein the ranging signal comprises a modified positioning reference signal based on a basic positioning reference signal, or the ranging cryptographic key, or a freshness parameter, or a combination of two or more thereof, wherein the freshness parameter comprises a timer, a counter, a system frame number, a slot number, a symbol number, or any combination of two or more thereof.

21. A first wireless communication device, the first wireless communication device comprising: means for obtaining first security material, the first security material comprising a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and Means for sending a ranging signal to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

22. The first wireless communication device of claim 21, wherein the first security material comprises the ranging cryptographic key as a symmetric cryptographic key, and wherein the ranging signal comprises a modified positioning reference signal, the modified positioning reference signal being based on a basic positioning reference signal and the ranging cryptographic key.

23. The first wireless communication device of claim 21, wherein the first security material comprises a first cryptographic signing certificate, the first cryptographic signing certificate comprising a first asymmetric cryptographic key, and wherein the first wireless communication device further comprises: means for sending the first cryptographic signing certificate to the second wireless communication device; and means for receiving, from the second wireless communication device, a second cryptographic signing certificate comprising a second asymmetric cryptographic key; Wherein the means for sending the ranging signal comprises means for sending the ranging signal as an encrypted unicast ranging signal that has been encrypted based on a symmetric cryptographic key, the symmetric cryptographic key being based on the first asymmetric cryptographic key and the second asymmetric cryptographic key.

24. The first wireless communication device of claim 23, wherein the means for sending the first cryptographic signing certificate comprises means for sending the first cryptographic signing certificate within a validity region associated with the first cryptographic signing certificate based on a current location of the first wireless communication device.

25. The first wireless communication device of claim 21, further comprising means for receiving the ranging cryptographic key from the second wireless communication device or a network entity, and wherein the second security material comprises the ranging cryptographic key.

26. The first wireless communication device of claim 21, further comprising: Means for sending a discovery message based on at least a second portion of the first security material to the second wireless communication device.

27. The first wireless communication device of claim 26, wherein the first portion of the first security material is the same as the second portion of the first security material.

28. The first wireless communication device according to claim 21, wherein the first security material comprises the ranging cryptographic key, and the first wireless communication device further comprises: means for sending an indication to the second wireless communication device for the second wireless communication device to contact a network entity to obtain the ranging cryptographic key; and Means for determining the ranging cryptographic key based on a base cryptographic key stored at the first wireless communication device.

29. The first wireless communication device of claim 21, wherein: The first security material includes a plurality of cryptographically signed certificates including a public cryptographic key of the first wireless communication device cryptographically signed by an entity separate from the first wireless communication device and the second wireless communication device; and The first wireless communication device also includes means for sending a discovery message to the second wireless communication device, the discovery message being cryptographically signed by the first wireless communication device and including at least one of the plurality of cryptographically signed certificates based on a certificate selection policy.

30. A non-transitory processor-readable storage medium comprising processor-readable instructions configured to cause a processor of a first wireless communication device to: obtaining a first security material, the first security material comprising a ranging cryptographic key, or one or more cryptographic certificates, or a combination thereof; and A ranging signal is sent to a second wireless communication device, the ranging signal being based on at least a first portion of the first security material, or based on a second security material, or a combination thereof.

Images