Network response to malicious nodes

Abstract

Aspects of an apparatus for wireless communication are disclosed for cooperatively assisting a network entity in managing security at a physical (PHY) layer. A user equipment (UE) may send a report and associated information indicating an unlicensed network node. In response, the UE may receive a message from the network entity indicating security measures to be applied to communications between the UE and an authorized network node. The message may also be received in response to another report from the authorized node, the another report including additional information about the unauthorized node. In other aspects, the network entity may receive the report from the UE and send the message indicating the security measure.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. patent application serial number 17 / 812,162, entitled “NETWORK RESPONSE AGAINST MALICIOUS NODES” and filed on July 12, 2022, which is assigned to the assignee of the present invention and is incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates generally to communication systems and, more particularly, to security in wireless networks. Background Art

[0004] Wireless communication systems are widely deployed to provide a variety of telecommunication services, such as telephony, video, data, messaging, and broadcast. Typical wireless communication systems may employ multiple access technologies capable of supporting communication with multiple users by sharing available system resources. Examples of such multiple access technologies include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single carrier frequency division multiple access (SC-FDMA) systems, and time division synchronous code division multiple access (TD-SCDMA) systems.

[0005] These multiple access technologies have been adopted in various telecommunication standards to provide a common protocol that enables different wireless devices to communicate at city, country, region, and even global levels. An example telecommunication standard is 5G New Radio (NR). 5G NR is part of the continuous mobile broadband evolution promulgated by the Third Generation Partnership Project (3GPP) to meet new requirements associated with latency, reliability, security, scalability (e.g., with the Internet of Things (IoT)) and other requirements. 5GNR includes services associated with enhanced mobile broadband (eMBB), massive machine type communication (mMTC), and ultra-reliable low latency communication (URLLC). Certain aspects of 5G NR may be based on 4G Long Term Evolution (LTE) standards. It is necessary to further improve 5G NR technology. In addition, these improvements may also be applicable to other multiple access technologies and telecommunication standards that employ these technologies. Summary of the invention

[0006] The following presents a simplified summary of one or more aspects in order to provide a basic understanding of these aspects. This summary is not an extensive overview of all contemplated aspects, and is neither intended to identify key or important elements of all aspects, nor to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to a more detailed description presented later.

[0007] Physical control channels (i.e., PDCCH, PUCCH) and reference signals (RS) are key to performing many 5G NR functions, including, for example, channel estimation, uplink / downlink (UL / DL) grants, positioning capabilities, etc. However, physical control channels lack security protection at the physical layer (PHY). Instead, the entire security protection mechanism of 5G NR typically occurs in the upper layers through cryptographic algorithms. Therefore, there are currently no available procedures that enable cellular networks to collaboratively manage their nodes to detect malicious nodes or specify how the network or nodes should respond when such adversary nodes are detected.

[0008] In various aspects of the present disclosure, a set of PHY procedures are disclosed that, among other features, enable network entities and UEs to collaboratively detect malicious nodes. The detection may occur by actively or passively employing one or more base stations (e.g., gNBs), user equipment (UEs), or other network entities to assess the presence of an adversary, or by collecting warning reports from different base stations or UEs. The warning reports include information about one or more adversaries that have been detected. In addition, these aspects enable network entities to perform necessary PHY or cross-layer security protection techniques to return the security and reliability level of the network to a desired level.

[0009] The collaborative techniques disclosed herein provide significant advantages in supporting security and reliability in 5G networks. Such security and reliability are also envisioned as key performance measures for upcoming 6G implementations and other subsequent implementations of 5G.

[0010] In one aspect of the present disclosure, a method and apparatus for wireless communication at a UE are provided. The apparatus includes a transceiver, a memory, and at least one processor coupled to the memory and the transceiver. The at least one processor is configured to send a report indicating the presence of an unauthorized network node via the transceiver. The report may include information associated with the unauthorized network node. The at least one controller is also configured to receive a message indicating security measures to be applied to communications between authorized network nodes including the UE via the transceiver. The message may be received in response to the report and in response to another report from one of the authorized network nodes. The other report may include additional information associated with the unauthorized network node.

[0011] In another aspect of the present disclosure, a method and apparatus for wireless communication at a network entity are provided. The apparatus includes a transceiver, a memory, and at least one processor coupled to the memory and the transceiver. The at least one processor is configured to receive a plurality of reports via the transceiver, each of which indicates the presence of an unauthorized network node and includes information associated with the unauthorized network node. The plurality of reports are respectively from a plurality of authorized network nodes. The at least one processor is also configured to send a message indicating a security measure to be applied to communications between the authorized network nodes via the transceiver in response to the plurality of reports.

[0012] To achieve the foregoing and related ends, one or more aspects include the features fully described below and particularly pointed out in the claims. The following description and the accompanying drawings set forth in detail some illustrative features of one or more aspects. However, these features are merely indicative of some of the various ways in which the principles of the various aspects may be employed, and this specification is intended to include all such aspects and their equivalents. BRIEF DESCRIPTION OF THE DRAWINGS

[0013] Figure 1 is a diagram illustrating an example of a wireless communication system and an access network according to various aspects of the present disclosure.

[0014] Figure 2A is a diagram illustrating an example of a first frame according to various aspects of the present disclosure.

[0015] Figure 2B is a diagram illustrating an example of DL channels within a subframe according to various aspects of the present disclosure.

[0016] Figure 2C is a diagram illustrating an example of a second frame according to various aspects of the present disclosure.

[0017] Figure 2D is a diagram illustrating an example of UL channels within a subframe according to various aspects of the present disclosure.

[0018] Figure 3 is a diagram illustrating an example of a base station and a user equipment (UE) in an access network according to various aspects of the present disclosure.

[0019] Figure 4 is a timing diagram illustrating an example of communications between different network entities and a passive network response to a malicious node in accordance with various aspects of the present disclosure.

[0020] Figure 5 is a diagram illustrating an example of active network response to a malicious node according to various aspects of the present disclosure.

[0021] Figure 6is a diagram illustrating an example of active network response to a malicious node according to various aspects of the present disclosure.

[0022] Figure 7 is a flow chart of a wireless communication method according to various aspects of the present disclosure.

[0023] Figure 8 is a flow chart of a wireless communication method according to various aspects of the present disclosure.

[0024] Fig. 9 is a diagram illustrating an example of a hardware implementation for an example apparatus according to various aspects of the present disclosure.

[0025] Fig.10 is a diagram illustrating another example of a hardware implementation for another example apparatus according to various aspects of the present disclosure. DETAILED DESCRIPTION

[0026] The specific embodiments described below in conjunction with the accompanying drawings are intended as descriptions of various configurations and are not intended to represent the only configurations with which the concepts described herein can be practiced. In order to provide a thorough understanding of the various concepts, the specific embodiments include specific details. However, it is apparent to those skilled in the art that these concepts can be practiced without these specific details. In some cases, well-known structures and components are shown in block diagram form to avoid obscuring such concepts.

[0027] Several aspects of telecommunication systems will now be presented with reference to various apparatus and methods. These apparatus and methods will be described in the following detailed description and illustrated in the accompanying drawings by various blocks, components, circuits, processes, algorithms, etc. (collectively referred to as "elements"). These elements may be implemented using electronic hardware, computer software, or any combination thereof. Whether these elements are implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system.

[0028] As an example, an element, or any part of an element, or any combination of elements can be implemented as a "processing system", which includes one or more processors. Examples of processors include microprocessors, microcontrollers, graphics processing units (GPUs), central processing units (CPUs), application processors, digital signal processors (DSPs), reduced instruction set computing (RISC) processors, systems on chip (SoCs), baseband processors, field programmable gate arrays (FPGAs), programmable logic devices (PLDs), state machines, gated logic components, discrete hardware circuits, and other suitable hardware configured to perform various functionalities described throughout the present disclosure. One or more processors in a processing system can execute software. Whether it is referred to as software, firmware, middleware, microcode, hardware description language, or other names, software should be broadly interpreted as meaning instructions, instruction sets, codes, code segments, program codes, programs, subroutines, software components, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, procedures, functions, etc.

[0029] Therefore, in one or more example embodiments, the described functions can be implemented with hardware, software or any combination thereof. If implemented in software, the function can be stored or encoded on a computer-readable medium as one or more instructions or codes. Computer-readable media include computer storage media. Storage media can be any available medium that can be accessed by a computer. By way of example and not limitation, such computer-readable media can include random access memory (RAM), read-only memory (ROM), electrically erasable programmable ROM (EEPROM), optical disk storage device, magnetic disk storage device, other magnetic storage devices, a combination of computer-readable media of the above type, or any other medium that can be used to store computer executable code in the form of instructions or data structures that can be accessed by a computer.

[0030] There are no known procedures in wireless cellular networks on how the network manages its nodes to detect malicious nodes (e.g., adversaries) in authorized UEs and collaboratively handle them. The present disclosure applies to PHY-based security techniques to manage malicious nodes. In various aspects of the present disclosure, a set of PHY procedures are disclosed that, among other features, enable network entities and UEs to collaboratively detect malicious nodes. The detection may occur by actively or passively employing one or more base stations (e.g., gNBs), user equipment (UEs), or other network entities to assess the presence of adversaries, or by collecting warning reports from different base stations or UEs. The warning report includes information about one or more adversaries that have been detected. In addition, these aspects enable network entities to perform necessary PHY or cross-layer security protection techniques to return the security and reliability level of the network to a desired level.

[0031] When a malicious node is detected, either actively or passively, through an alert report, the network or representative entity may perform previously used PHY or cross-layer security techniques, as further explained below. Techniques that provide security at the PHY layer (e.g., measures for control channels and reference signals (RS)) may incur additional overhead in the form of greater computational complexity, such as when removing PHY signatures, or link traffic, such as in phase exchanges to authenticate a transmitter or receiver. This tradeoff between security and performance provided in the PHY may be referred to herein as security quality of service (QoS).

[0032] As an example of such a tradeoff, the network may apply conventional artificial impairments to the signal (e.g., an artificial PHY signature such as an AM / PM type impairment in the case of a power amplifier) ​​so that only authorized nodes have parameters sufficient to remove the applied impairments. In this case, impairments are applied here to prevent unauthorized receivers. However, the authorized receiver must still perform calculations to remove the impairments, which affects the security QoS. In another example, the UE may attempt to authenticate the signal transmission by verifying the identity of the transmitter to ensure that the transmission does not originate from a malicious node. One authentication process in the PHY layer is to transmit credentials in the form of phase modulation and rely on channel reciprocity for authentication. For example, the phase-modulated credentials may not be transmitted explicitly, but rather transmitted by the difference between the previous phase measurement on the received signal, so that the network node that only transmitted the previous signal can learn the credentials. Therefore, the phase information representing the credentials cannot be copied by a malicious node. The transmitter (e.g., another UE or network entity) may transmit identification information back to the UE to verify the transmitter identity to perform mutual authentication. As in the previous example, such techniques require additional signaling between the sending site and the receiving site, and therefore require additional signaling overhead.

[0033] To manage this tradeoff due to computation and link traffic, the network in some implementations may perform PHY or cross-layer security techniques as described in the following examples while actively detecting malicious nodes or acting passively against already detected malicious nodes. For example, the network typically does not apply every PHY technique to every user. Instead, the network may assess the capabilities of a given user (e.g., UE) before assigning an action to the user. In short, the principles of the present disclosure effectively balance the application of current PHY security techniques to manage malicious nodes while managing this tradeoff.

[0034] The collaborative techniques disclosed herein provide significant advantages in supporting security and reliability in 5G networks. Such security and reliability are also envisioned as key performance measures for upcoming 6G implementations and other subsequent implementations of 5G.

[0035] Figure 11 is a diagram illustrating an example of a wireless communication system and access network 100. The wireless communication system (also referred to as a wireless wide area network (WWAN)) includes a base station 102, a user equipment (UE) 104, an evolved packet core (EPC) 160, and another core network 190 (e.g., a 5G core (5GC)). The base station 102 may include a macro cell (a high-power cellular base station) and / or a small cell (a low-power cellular base station). A macro cell includes a base station. A small cell includes a femto cell, a pico cell, and a micro cell.

[0036] The base station 102 configured for 4G Long Term Evolution (LTE) (collectively referred to as Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (E-UTRAN)) can interface with the EPC 160 via a first backhaul link 132 (e.g., an S1 interface). The base station 102 configured for 5G New Radio (NR) (collectively referred to as Next Generation RAN (NG-RAN)) can interface with the core network 190 via a second backhaul link 184. Among other functions, the base station 102 can also perform one or more of the following functions: delivery of user data, radio channel encryption and decryption, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection establishment and release, load balancing, distribution of non-access stratum (NAS) messages, NAS node selection, synchronization, radio access network (RAN) sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment tracking, RAN information management (RIM), paging, positioning, and delivery of warning messages. The base stations 102 may communicate with each other directly or indirectly (eg, via the EPC 160 or the core network 190) via the third backhaul link 134 (eg, an X2 interface). The first backhaul link 132, the second backhaul link 184, and the third backhaul link 134 may be wired or wireless.

[0037] Base station 102 can communicate wirelessly with UE 104. Each of base stations 102 can provide communication coverage for a corresponding geographic coverage area 110. There may be overlapping geographic coverage areas 110. For example, a small cell 102' may have a coverage area 110' that overlaps with the coverage area 110 of one or more macro base stations 102. A network including both small cells and macro cells may be referred to as a heterogeneous network. A heterogeneous network may also include a home evolved Node B (eNB) (HeNB), which may provide services to a restricted group referred to as a closed subscriber group (CSG). A communication link 120 between base station 102 and UE 104 may include an uplink (UL) (also referred to as a reverse link) transmission from UE 104 to base station 102 and / or a downlink (DL) (also referred to as a forward link) transmission from base station 102 to UE 104. The communication link 120 may use multiple input multiple output (MIMO) antenna technology, including spatial multiplexing, beamforming and / or transmit diversity. The communication link may be through one or more carriers. For each carrier allocated in the carrier aggregation for up to a total of up to Yx MHz (x component carriers) for transmission in each direction, the base station 102 / UE 104 may use a spectrum with a bandwidth of up to Y megahertz (MHz) (e.g., 5 MHz, 10 MHz, 15 MHz, 20 MHz, 100 MHz, 400 MHz, etc.). These carriers may or may not be adjacent to each other. The allocation of carriers may be asymmetric with respect to DL and UL (e.g., more or fewer carriers may be allocated for DL ​​than for UL). The component carriers may include a primary component carrier and one or more secondary component carriers. The primary component carrier may be referred to as a primary cell (PCell) and the secondary component carrier may be referred to as a secondary cell (SCell).

[0038] Some UEs 104 may communicate with each other using a device-to-device (D2D) communication link 158. The D2D communication link 158 may use DL / UL WWAN spectrum. The D2D communication link 158 may use one or more sidelink channels, such as a physical sidelink broadcast channel (PSBCH), a physical sidelink discovery channel (PSDCH), a physical sidelink shared channel (PSSCH), and a physical sidelink control channel (PSCCH). D2D communication may be through a variety of wireless D2D communication systems, such as, for example, WiMedia, Bluetooth, ZigBee, Wi-Fi based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard, LTE, or NR.

[0039] The wireless communication system may also include a Wi-Fi access point (AP) 150 that communicates with a Wi-Fi station (STA) 152 via a communication link 154 in, for example, a 5 gigahertz (GHz) unlicensed spectrum. When communicating in the unlicensed spectrum, the STA 152 / AP 150 may perform a clear channel assessment (CCA) to determine whether a channel is available prior to communication.

[0040] The small cell 102' may operate in licensed and / or unlicensed spectrum. When operating in an unlicensed spectrum, the small cell 102' may employ NR and use the same unlicensed spectrum (e.g., 5 GHz, etc.) as used by the Wi-Fi AP 150. The small cell 102' employing NR in the unlicensed spectrum may improve the coverage of the access network and / or increase the capacity of the access network.

[0041] The electromagnetic spectrum is typically subdivided into various categories, bands, channels, etc. based on frequency / wavelength. In 5GNR, two initial operating bands have been identified as frequency range designations FR1 (410 MHz-7.125 GHz) and FR2 (24.25 GHz-52.6 GHz). The frequencies between FR1 and FR2 are typically referred to as mid-band frequencies. Although a portion of FR1 is greater than 6 GHz, FR1 is typically referred to (interchangeably) as the "below 6 GHz" band in various documents and articles. A similar naming problem sometimes occurs with respect to FR2, which is typically (interchangeably) referred to as the "millimeter wave" band in documents and articles, although different from the extremely high frequency (EHF) band (30 GHz-300 GHz) identified as the "millimeter wave" band by the International Telecommunication Union (ITU).

[0042] In view of the above aspects, unless otherwise specifically stated, it should be understood that if used in this article, the term "below 6 GHz" and the like can broadly represent frequencies that can be less than 6 GHz, can be within FR1, or can include mid-band frequencies. In addition, unless otherwise specifically stated, it should be understood that if the term "millimeter wave" and the like are used in this article, they can broadly represent frequencies that can include mid-band frequencies, can be within FR2, or can be within the EHF band.

[0043] The base station 102, whether a small cell 102' or a large cell (e.g., a macro base station), may include and / or be referred to as an eNB, a gNodeB (gNB), or another type of base station. Some base stations, such as gNB 180, may operate in the traditional sub-6 GHz spectrum, in millimeter wave frequencies, and / or near millimeter wave frequencies to communicate with the UE 104. When the gNB 180 operates in millimeter wave or near millimeter wave frequencies, the gNB 180 may be referred to as a millimeter wave base station. The millimeter wave base station 180 may utilize beamforming 182 with the UE 104 to compensate for path loss and short range. The base station 180 and the UE 104 may each include multiple antennas, such as antenna elements, antenna panels, and / or antenna arrays, to facilitate beamforming.

[0044] Base station 180 may transmit beamformed signals in one or more transmit directions 182′ to UE 104. UE 104 may receive beamformed signals from base station 180 in one or more receive directions 182″. UE 104 may also transmit beamformed signals to base station 180 in one or more transmit directions. Base station 180 may receive beamformed signals from UE 104 in one or more receive directions. Base station 180 / UE 104 may perform beam training to determine the optimal receive direction and transmit direction for each of base station 180 / UE 104. The transmit direction and receive direction of base station 180 may be the same or different. The transmit direction and receive direction of UE 104 may be the same or different.

[0045] The EPC 160 may include a mobility management entity (MME) 162, other MMEs 164, a serving gateway 166, an MBMS gateway 168, a broadcast multicast service center (BM-SC) 170, and a packet data network (PDN) gateway 172. The MME 162 may communicate with a home subscriber server (HSS) 174. The MME 162 is a control node that handles signaling between the UE 104 and the EPC 160. Typically, the MME 162 provides bearer and connection management. All user Internet Protocol (IP) packets are delivered through the serving gateway 166, which itself is connected to the PDN gateway 172. The PDN gateway 172 provides UE IP address allocation and other functions. The PDN gateway 172 and the BM-SC 170 are connected to IP services 176. The IP services 176 may include the Internet, an intranet, an IP multimedia subsystem (IMS), a PS streaming service, and / or other IP services. The BM-SC 170 may provide functions for MBMS user service configuration and delivery. BM-SC 170 may serve as an entry point for content provider MBMS delivery, may be used to authorize and initiate MBMS bearer services in a public land mobile network (PLMN), and may be used to schedule MBMS delivery. MBMS gateway 168 may be used to distribute MBMS services to base stations 102 belonging to a multicast broadcast single frequency network (MBSFN) area of ​​a broadcast specific service, and may be responsible for session management (start / stop) and for collecting eMBMS related billing information.

[0046] The core network 190 may include an access and mobility management function (AMF) 192, other AMFs 193, a session management function (SMF) 194, and a user plane function (UPF) 195. The AMF 192 may communicate with a unified data management (UDM) 196. The AMF 192 is a control node that handles signaling between the UE 104 and the core network 190. Typically, the AMF 192 provides quality of service (QoS) flows and session management. All user IP packets are delivered through the UPF 195. The UPF 195 provides UE IP address allocation and other functions. The UPF 195 is connected to an IP service 197. The IP service 197 may include the Internet, an intranet, an IMS, a packet switching (PS) streaming media service, and / or other IP services.

[0047] Base stations may include and / or be referred to as gNBs, Node Bs, eNBs, access points, base transceivers, radio base stations, radio transceivers, transceiver functions, basic service sets (BSSs), extended service sets (ESSs), transmit receive points (TRPs), or some other suitable terminology. Base stations 102 provide access points to EPC 160 or core network 190 for UEs 104. Examples of UEs 104 include cellular phones, smart phones, session initiation protocol (SIP) phones, laptops, personal digital assistants (PDAs), satellite radios, global positioning systems, multimedia devices, video devices, digital audio players (e.g., MP3 players), cameras, game consoles, tablets, smart devices, wearable devices, vehicles, electric meters, gas pumps, large or small kitchen appliances, healthcare devices, implants, sensors / actuators, displays, or any other similarly functional device. Some of the UEs 104 may be referred to as IoT devices (e.g., parking meters, gas pumps, toasters, vehicles, heart monitors, etc.). UE 104 may also be referred to as a station, a mobile station, a subscriber station, a mobile unit, a subscriber unit, a wireless unit, a remote unit, a mobile device, a wireless device, a wireless communication device, a remote device, a mobile subscriber station, an access terminal, a mobile terminal, a wireless terminal, a remote terminal, a handset, a user agent, a mobile client, a client, or some other suitable terminology.

[0048] Although the present disclosure may focus on 5G NR, the concepts and aspects described herein may be applicable to other similar areas such as LTE, Advanced LTE (LTE-A), Code Division Multiple Access (CDMA), Global System for Mobile Communications (GSM), and / or other wireless / radio access technologies.

[0049] Furthermore, although the present disclosure may focus on vehicle-to-everything (V2X), the concepts and various aspects described herein may be applicable to other similar areas, such as D2D communications, IoT communications, industrial IoT (IIoT) communications, and / or other standards / protocols for communications in wireless / access networks. Additionally or alternatively, the concepts and various aspects described herein may be particularly applicable to one or more specific areas, such as vehicle-to-pedestrian (V2P) communications, pedestrian-to-vehicle (P2V) communications, vehicle-to-infrastructure (V2I) communications, and / or other frameworks / models for communications in wireless / access networks. In these cases, malicious nodes may be identified, warning reports may be generated and sent to the network, and a scheme may be designed to identify example procedures for handling malicious nodes.

[0050] See again Figure 1In certain aspects, the UE may include a warning report generation component 198, which may be a dedicated hardware component, or a processor (processor group) executing routines in a memory, firmware, etc. The report generation component may generate a report indicating the presence of an unauthorized network node, the report including information associated with the node. Component 198 may provide the completed warning report to a transmitter for sending the warning report to a base station or network.

[0051] When UE 104 receives the message, the message may indicate security measures to be applied to communications between authorized network nodes including UE 104. The message may be received in response to the report and in response to another report from one of the authorized network nodes. The other report may include additional information associated with the unauthorized network node. The received message may advantageously include an optimal action or set of actions for managing malicious nodes, rather than actions that are generally performed without regard to adverse effects that UE 104 or other network nodes may face.

[0052] Similarly coupled to the base station 102 / 180 and the core network 190 is an aggregate warning report generation component and a quality QoS decision making component 199b. The base station 102 / 180 or another network entity (sometimes referred to as a "network") includes an aggregate warning report generation component 199a and a quality QoS decision making component 199b. The aggregate warning report generation component 199a can receive multiple reports from other network nodes (including base stations if the network entity is the core network 190, a component thereof, or another entity) at a receiver. Each report can be a warning report generated by a network node and indicating the presence of an unauthorized network node. For the purposes of this disclosure, an unauthorized network node is a malicious node or an adversary node. The report may include information associated with the unauthorized network node. The multiple reports are from multiple authorized network nodes, respectively. Next, the base station 102 / 180 or the network 190 (or similar network entity) can use the received warning reports and other known information about the network to determine the best response to repel unauthorized nodes and prevent unauthorized nodes from accessing data in the network. The best response may use component 199b to advantageously consider the presence or absence of potential adverse effects on various network components (noise, interference, activity level, battery requirements, etc.) when determining the best policy response. The base station 102 / 180 or network 190 may send a message indicating security measures to be applied to communications between authorized network nodes in response to multiple reports. The policy nature of the response means that, among other benefits, the 10am 10any impact on network performance is minimized, which is contrary to conventional security methods involving the PHY layer.

[0053] Figure 2AFIG200 is a diagram illustrating an example of a first subframe within a 5G NR frame structure. Figure 2B FIG230 is a diagram illustrating an example of DL channels within a 5G NR subframe. Figure 2C FIG250 is a diagram illustrating an example of a second subframe within a 5G NR frame structure. Figure 2D FIG280 is a diagram illustrating an example of an UL channel within a 5G NR subframe. The 5G NR frame structure may be frequency division duplex (FDD) (wherein for a particular set of subcarriers (carrier system bandwidth), a subframe within the subcarrier set is dedicated to either DL or UL), or may be time division duplex (TDD) (wherein for a particular set of subcarriers (carrier system bandwidth), a subframe within the subcarrier set is dedicated to both DL and UL). Figure 2A , Figure 2C In the example provided, the 5G NR frame structure is assumed to be TDD, where subframe 4 is configured with slot format 28 (most of which are DL), where D is DL, U is UL, and F is flexible between DL / UL, and subframe 3 is configured with slot format 34 (most of which are UL). Although subframes 3 and 4 are shown as having slot formats 34 and 28, respectively, any particular subframe may be configured with any of the various available slot formats 0 to 61. Slot formats 0 and 1 are full DL and full UL, respectively. Other slot formats 2 to 61 include a mix of DL, UL and flexible symbols. The UE is configured with the slot format through the received slot format indicator (SFI) (dynamically configured through DL control information (DCI) or semi-statically / statically configured through radio resource control (RRC) signaling). Note that the following description also applies to the 5G NR frame structure as TDD.

[0054] Other wireless communication technologies may have different frame structures and / or different channels. For example, a 10 millisecond (ms) frame may be divided into 10 equally sized subframes (1 ms). Each subframe may include one or more time slots. A subframe may also include a microslot, which may include 7, 4, or 2 symbols. Each time slot may include 7 or 14 symbols, depending on the time slot configuration. For time slot configuration 0, each time slot may include 14 symbols, and for time slot configuration 1, each time slot may include 7 symbols. The symbol on the DL may be a cyclic prefix (CP) orthogonal frequency division multiplexing (OFDM) (CP-OFDM) symbol. The symbol on the UL may be a CP-OFDM symbol (for high throughput scenarios) or a discrete Fourier transform (DFT) spread OFDM (DFT-s-OFDM) symbol (also known as a single carrier frequency division multiple access (SC-FDMA) symbol) (for power-constrained scenarios; limited to single-stream transmission). The number of time slots in a subframe is based on the time slot configuration and parameter set (numerology). For slot configuration 0, different parameter sets μ0 to 4 allow 1, 2, 4, 8, and 16 slots per subframe, respectively. For slot configuration 1, different parameter sets 0 to 2 allow 2, 4, and 8 slots per subframe, respectively. Accordingly, for slot configuration 0 and parameter set μ, there are 14 symbols per slot and 2 per subframe. μ time slots. The subcarrier spacing and symbol length / duration are functions of the parameter set. The subcarrier spacing can be equal to 2 μ *15 kilohertz (kHz), where μ is parameter set 0 to 4. Therefore, the subcarrier spacing for parameter set μ=0 is 15 kHz, and the subcarrier spacing for parameter set μ=4 is 240 kHz. The symbol length / duration is inversely related to the subcarrier spacing. FIG. 2A to FIG. 2D An example is provided for slot configuration 0 with 14 symbols per slot and parameter set μ=2 with 4 slots per subframe. The slot duration is 0.25 ms, the subcarrier spacing is 60 kHz, and the symbol duration is approximately 16.67 μs. Within a frame set, there may be one or more different bandwidth parts (BWPs) that are frequency-division multiplexed (see Figure 2B ). Each BWP can have a specific set of parameters.

[0055] A resource grid may be used to represent the frame structure. Each slot includes a resource block (RB) (also referred to as a physical RB (PRB)) extending over 12 consecutive subcarriers. The resource grid is divided into a plurality of resource elements (REs). The number of bits carried by each RE depends on the modulation scheme.

[0056] like Figure 2AAs illustrated, some of the REs carry reference (pilot) signals (RS) for the UE. The RS may include a demodulation RS (DM-RS) for channel estimation at the UE (indicated as R for a particular configuration). x , where 100x is the port number, but other DM-RS configurations are possible) and a channel state information reference signal (CSI-RS). RS may also include beam measurement RS (BRS), beam refinement RS (BRRS) and phase tracking RS (PT-RS).

[0057] Figure 2B Examples of various DL channels within a subframe of a frame are illustrated. The physical downlink control channel (PDCCH) carries DCI within one or more control channel elements (CCEs), each CCE including nine RE groups (REGs), each REG including four consecutive REs in an OFDM symbol. The PDCCH within a BWP may be referred to as a control resource set (CORESET). Additional BWPs may be located at higher and / or lower frequencies on the channel bandwidth. The primary synchronization signal (PSS) may be within symbol 2 of a specific subframe of a frame. The PSS is used by UE 104 to determine subframe / symbol timing and physical layer identification. The secondary synchronization signal (SSS) may be within symbol 4 of a specific subframe of a frame. The SSS is used by the UE to determine the physical layer cell identification group number and radio frame timing. Based on the physical layer identification and the physical layer cell identification group number, the UE may determine the physical cell identifier (PCI). Based on the PCI, the UE may determine the position of the aforementioned DM-RS. The physical broadcast channel (PBCH) carrying the master information block (MIB) can be logically grouped with the PSS and SSS to form a synchronization signal (SS) / PBCH block (also referred to as an SS block (SSB)). The MIB provides the number of RBs in the system bandwidth and the system frame number (SFN). The physical downlink shared channel (PDSCH) carries user data, broadcast system information not sent over the PBCH (such as the system information block (SIB)), and paging messages.

[0058] like Figure 2CAs illustrated, some of the REs carry DM-RS (indicated as R for a particular configuration, but other DM-RS configurations are possible) for channel estimation at the base station. The UE may send a DM-RS for a physical uplink control channel (PUCCH) and a DM-RS for a physical uplink shared channel (PUSCH). The PUSCH DM-RS may be sent in the first or first two symbols of the PUSCH. Depending on whether a short PUCCH or a long PUCCH is sent and depending on the specific PUCCH format used, the PUCCH DM-RS may be sent in different configurations. The UE may send a sounding reference signal (SRS). The SRS may be sent in the last symbol of a subframe. The SRS may have a comb structure, and the UE may send the SRS on one of the teeth of the comb. The SRS may be used by the base station for channel quality estimation to achieve frequency-dependent scheduling of the UL.

[0059] Figure 2D Examples of various UL channels within a subframe of a frame are illustrated. The PUCCH may be located at a position as indicated in one configuration. The PUCCH carries uplink control information (UCI), such as scheduling requests, channel quality indicator (CQI), precoding matrix indicator (PMI), rank indicator (RI), and hybrid automatic repeat request (HARQ) acknowledgement (ACK) / negative acknowledgement (NACK) feedback. The PUSCH carries data and may be used to carry, among other things, a buffer status report (BSR), a power headroom report (PHR), and / or UCI.

[0060] Figure 33 is a block diagram of a base station 310 in an access network communicating with a UE 350. In the DL, IP packets from the EPC 160 may be provided to the controller / processor 375. The controller / processor 375 implements layer 3 and layer 2 functionality. Layer 3 includes a radio resource control (RRC) layer, and layer 2 includes a service data adaptation protocol (SDAP) layer, a packet data convergence protocol (PDCP) layer, a radio link control (RLC) layer, and a medium access control (MAC) layer. The controller / processor 375 provides RRC layer functionality associated with broadcasting of system information (e.g., MIB, SIB), RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-radio access technology (RAT) mobility, and measurement configuration for UE measurement reporting; PDCP layer functionality associated with header compression / decompression, security (encryption, decryption, integrity protection, integrity verification), and handover support functions; RLC layer functionality associated with delivery of upper layer packet data units (PDUs), error correction through ARQ, concatenation, segmentation and reassembly of RLC service data units (SDUs), re-segmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto transport blocks (TBs), demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority handling, and logical channel prioritization.

[0061] The transmit (TX) processor 316 and receive (RX) processor 370 implement layer 1 functionality associated with various signal processing functions. Layer 1 (which includes the physical (PHY) layer) may include error detection on the transport channel, forward error correction (FEC) coding / decoding of the transport channel, interleaving, rate matching, mapping onto the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. The TX processor 316 handles the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-order phase shift keying (M-PSK), M-order quadrature amplitude modulation (M-QAM)). The coded and modulated symbols may then be split into parallel streams. Each stream may then be mapped to an OFDM subcarrier, multiplexed with a reference signal (e.g., pilot) in the time and / or frequency domain, and then combined together using an inverse fast Fourier transform (IFFT) to produce a physical channel carrying a time domain OFDM symbol stream. The OFDM stream is spatially pre-coded to generate multiple spatial streams. Channel estimates from a channel estimator 374 may be used to determine the coding and modulation schemes, as well as for spatial processing. Channel estimates may be derived from reference signals and / or channel condition feedback sent by the UE 350. Each spatial stream may then be provided to a different antenna 320 via a separate transmitter 318TX. Each transmitter 318TX may modulate an RF carrier with a corresponding spatial stream for transmission.

[0062] At the UE 350, each receiver 354RX receives a signal through its corresponding antenna 352. Each receiver 354RX recovers the information modulated onto the RF carrier and provides the information to a receive (RX) processor 356. The TX processor 368 and the RX processor 356 implement layer 1 functionality associated with various signal processing functions. The RX processor 356 can perform spatial processing on the information to recover any spatial stream destined for the UE 350. If multiple spatial streams are destined for the UE 350, they can be combined into a single OFDM symbol stream by the RX processor 356. The RX processor 356 then uses a fast Fourier transform (FFT) to convert the OFDM symbol stream from the time domain to the frequency domain. The frequency domain signal includes a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols on each subcarrier and the reference signal are recovered and demodulated by determining the signal constellation point most likely to be sent by the base station 310. These soft decisions can be based on channel estimates calculated by the channel estimator 358. The soft decisions are then decoded and deinterleaved to recover the data and control signals originally sent on the physical channel by the base station 310. The data and control signals are then provided to a controller / processor 359, which implements layer 3 and layer 2 functionality.

[0063] The controller / processor 359 may be associated with a memory 360 that stores program codes and data. The memory 360 may be referred to as a computer readable medium. In the UL, the controller / processor 359 provides demultiplexing between transport and logical channels, packet reassembly, decryption, header decompression, and control signal processing to recover IP packets from the EPC 160. The controller / processor 359 is also responsible for error detection using an ACK and / or NACK protocol to support HARQ operations.

[0064] Similar to the functionality described in conjunction with DL transmissions performed by the base station 310, the controller / processor 359 provides RRC layer functionality associated with system information (e.g., MIB, SIB) acquisition, RRC connection, and measurement reporting; PDCP layer functionality associated with header compression / decompression and security (encryption, decryption, integrity protection, integrity verification); RLC layer functionality associated with delivery of upper layer PDUs, error correction through ARQ, concatenation, segmentation and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto TBs, demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority handling, and logical channel prioritization.

[0065] Channel estimates derived by the channel estimator 358 based on a reference signal or feedback transmitted by the base station 310 may be used by the TX processor 368 to select the appropriate coding and modulation schemes and to facilitate spatial processing. The spatial streams generated by the TX processor 368 may be provided to different antennas 352 via separate transmitters 354TX. Each transmitter 354TX may modulate an RF carrier with a corresponding spatial stream for transmission.

[0066] UL transmissions are processed at the base station 310 in a manner similar to that described in conjunction with the receiver functionality at the UE 350. Each receiver 318RX receives a signal through its respective antenna 320. Each receiver 318RX recovers information modulated onto an RF carrier and provides the information to a RX processor 370.

[0067] The controller / processor 375 may be associated with a memory 376 that stores program codes and data. The memory 376 may be referred to as a computer readable medium. In the UL, the controller / processor 375 provides demultiplexing between transport channels and logical channels, packet reassembly, decryption, header decompression, control signal processing to recover IP packets from the UE 350. The IP packets from the controller / processor 375 may be provided to the EPC 160. The controller / processor 375 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operations.

[0068] At least one of the TX processor 368, the RX processor 356, and the controller / processor 359 may be configured to combine Figure 1 The 198 came to execute all aspects.

[0069] At least one of the TX processor 316, the RX processor 370, and the controller / processor 375 may be configured to combine Figure 1 The 198 came to execute all aspects.

[0070] The present disclosure is applicable to PHY-based security techniques to manage malicious nodes. As mentioned above, there is no known procedure in a wireless cellular network on how the network manages its nodes to detect malicious nodes (e.g., adversaries) in authorized UEs and deal with them in a collaborative manner. A PHY security procedure or a configuration of a cross-layer security protection technique is proposed to address these issues to improve network security and reliability to an acceptable level.

[0071] Malicious nodes as used in the present disclosure more broadly include any unauthorized node, which may be a UE or any physical network presence. Upon detecting a malicious node, either actively or passively through a warning report, the network or representative entity may perform previously used PHY or cross-layer security techniques, as further explained below.

[0072] Techniques that provide security at the PHY layer (e.g., measures for control channels and reference signals (RS)) may incur additional overhead in the form of greater computational complexity, such as when removing PHY signatures, or link traffic, such as in phase exchanges to authenticate a transmitter or receiver. This tradeoff between security and performance provided in the PHY may be referred to herein as security quality of service (QoS).

[0073] As an example of such a tradeoff, the network may apply conventional artificial impairments to the signal (e.g., an artificial PHY signature such as an AM / PM type impairment in the case of a power amplifier) ​​so that only authorized nodes have parameters sufficient to remove the applied impairments. In this case, impairments are applied here to prevent unauthorized receivers. However, the authorized receiver must still perform calculations to remove the impairments, which affects the security QoS. In another example, the UE may attempt to authenticate the signal transmission by verifying the identity of the transmitter to ensure that the transmission does not originate from a malicious node. One authentication process in the PHY layer is to transmit credentials in the form of phase modulation and rely on channel reciprocity for authentication. For example, the phase-modulated credentials may not be transmitted explicitly, but rather transmitted by the difference between the previous phase measurement on the received signal, so that the network node that only transmitted the previous signal can learn the credentials. Therefore, the phase information representing the credentials cannot be copied by a malicious node. The transmitter (e.g., another UE or network entity) may transmit identification information back to the UE to verify the transmitter identity to perform mutual authentication. As in the previous example, such techniques require additional signaling between the sending site and the receiving site, and therefore require additional signaling overhead.

[0074] To manage this tradeoff due to computation and link traffic, the network in some implementations may perform PHY or cross-layer security techniques as described in the following examples while actively detecting malicious nodes or acting passively against already detected malicious nodes. For example, the network typically does not apply every PHY technique to every user. Instead, the network may assess the capabilities of a given user (e.g., UE) before assigning an action to the user. In short, the principles of the present disclosure effectively balance the application of current PHY security techniques to manage malicious nodes while managing this tradeoff.

[0075] More specifically, in one aspect of the present disclosure, to achieve this balance, if the UE and base station (e.g., gNB) encounter any situation that detects or implies the presence of an active or passive malicious node, the network entity may configure these entities to prepare warning reports separately. Upon receiving a warning report from any gNB or UE, the network (via the network entity) may then determine which PHY and / or cross-layer security technology to apply while taking into account the gNB and UE capabilities and any adverse effects that may be associated with performing the technology in question. Based on this information, the network entity may determine the time, frequency, and set of one or more spatial (beam) resources for applying the identified security technology. For example, an example technique that takes into account the current information collected may be a technique to prevent networked UEs from constantly consuming additional energy. The network entity may then coordinate the gNB / UE to relay its individual warning reports in the UL / DL / SL channels when applicable. The network entity may generate its own aggregated warning report together with the collected information and any additional information. Such additional information may include the location of the malicious node obtained via the network or by the network entity via triangulation. The network may also perform security checks intermittently or using a prepared schedule. For example, the network may employ certain designated gNBs / UEs to implement various PHY-based security techniques for assessing the presence of malicious nodes or other malicious nodes since an action adverse to the network was attempted. The network may use information in one or more reports to perform such security checks. By configuring some gNBs and UEs to apply certain PHY security techniques, and based on the responses collected by the network from these nodes, the network may assess the presence of an adversary.

[0076] Malicious nodes can be active or passive. Active malicious nodes typically perform some type of signaling on the network, while passive malicious nodes simply listen to the network to gather information or otherwise.

[0077] When evaluating capabilities, the network entity may determine whether the gNB / UE is capable of performing a particular task. For example, the network may choose not to apply every PHY technology to every user. In the above case, the network entity may choose to apply artificial PHY impairments only to those nodes for which the network can effectively assume that the node has the ability to remove the impairment.

[0078] In another example, a network entity may avoid actions that produce undesirable adverse effects in the form of performance loss, such as excessive power consumption. For example, when applying a PHY technique to a power-constrained device (e.g., a battery-operated UE), then the entity may consider whether requiring such a node to perform security QoS tasks may be problematic for the power-constrained device due to the use of power-intensive tasks. Another adverse effect that the network may consider is excessive interference caused by the applied PHY technique. For example, the network may task the gNB to apply an artificial noise PHY technique to counter any malicious node with an unknown location, where the artificial noise is transmitted in every direction except the direction of authorized network nodes (e.g., gNB, UE) because the exact location of the malicious node is unknown. However, if it is determined that this technique causes some additional interference in neighboring cells and UEs, then the network may also consider this adverse effect and forgo applying the artificial noise in cancellation mode, i.e., assuming that the UE knows how to remove this interference, the artificial noise is now configured as interference and transmitted to the authorized UE along with regular transmissions.

[0079] In these configurations, the network can use information from the received reports to apply PHY techniques judiciously, rather than using resources solely to provide additional security and reliability at the PHY layer. To avoid unnecessary energy output or excessive interference or other adverse conditions, the network in these aspects may apply techniques only at specific times, in specific frequency bands, or using specific beams.

[0080] In various configurations, the UEs of the network may relay their individual warning reports to the gNB. In other arrangements, to maintain network throughput, the network entities and gNBs may configure the networked UEs to relay their reports to other UEs via a sidelink channel. As noted, the warning report may indicate the presence of a malicious node and characteristics of the UE or gNB that have been obtained or measured relative to the malicious node. Examples of such characteristics in the report may include received signal power, operating frequency and time slot, beam angle, directional information, and the identity of the unauthorized node (e.g., an invalid ID to which the malicious node previously attempted to gain access).

[0081] In various configurations, the network entity, upon receiving all warning reports, may also generate its own aggregate report that not only adds together relevant information from all individual warning reports, but also includes information generated or created by the network itself, whether that information is created using or based on the individual warning reports or otherwise. For example, the network may deduce the location of the adversary from user information included in the individual reports (e.g., using triangulation or other techniques). The network may include that location information in the aggregate report.

[0082] Figure 44 is a timing diagram 400 illustrating an example of communication between different network entities including a passive network response 437. A network 405 is shown in the upper left portion of the diagram as a cloud. The network 405 may include one or more network entities, such as EPC 160, core network 190 ( Figure 1 ), one or more components in EPC 160 or core network 190, or a combination of such components. Figure 4 It also includes gNB#1402, UE#1 404.1, UE#2 404.2 and opponent UE or other node 404.A. Figure 4 Demonstrate passive response 437.

[0083] One or both of UE 404.1 and 404.2 may collect information about adversary node 404.A, which for this example is a malicious node. UE 404.1 uses the information it collects or calculates with respect to 404.A and other potential malicious nodes (if any) to generate Warning Report #1. UE 404.2 also generates Warning Report #2 in a similar manner. As shown by arrows 411 and 415, respectively, UE 404.1 and UE 404 send their Warning Report #1 and Warning Report #2 to gNB 402, for example, using an uplink data or control channel. gNB 402 may then send separate Warning Report #1 and Warning Report #2 to a network entity in network 405. As described in dialog box 403 coupled to network 405 via a dotted line, a network entity in network 405 may use the information included in the received Warning Report #1 and Warning Report #2 to calculate the location of adversary 404.A. Based on the additional information in Warning Report #1 and Warning Report #2 received from gNB #1, the network entity in network 405 can determine the safety techniques to be applied to minimize the adverse events, as described above.

[0084] It should be understood that Figure 4 The network configuration shown in the diagram is simplistic in nature to avoid overly obscuring various aspects of the present disclosure. However, in other cases, the network may be configured to include more complex configurations with additional and different nodes, some of which are referred to as Figure 1 405. In addition, the network shown is 5G NR. However, the network configuration may include one or more additional or different network types. It should also be noted that, as indicated, the response of the network 405 in this configuration is passive (437). That is, the network 405 or the control entity does not transmit a response including the determined information in any particular direction. The network also does not transmit the information in a signal to a particular node.

[0085] Figure 55 is a diagram illustrating an example of an active network response 537 to a malicious node 504.A. For the purposes of this example, Figure 5 The procedures and configurations in Figure 4 . Thus, in this configuration, gNB 502 and 402 are identical. Furthermore, network 505 is identical to network 405 in this configuration, UE 504.1 and UE 504.2 are identical to UE 404.1 and UE 404.2, and adversary (malicious) node 504.A is identical to node 404.A. This need not be the case in other configurations.

[0086] See also Figure 5 , after calculating the location of the adversary (malicious) node 504.A and determining the reference Figure 4 After the optimal security techniques described are applied, a network entity in the network 505 may assemble this information with potentially other relevant information possessed, calculated, or determined by the network into an aggregate warning report 532. The network entity in the network 505 may transmit the aggregate report 532 to the gNB 502 via a channel. The gNB 402 may in turn release the aggregate warning report 532 (which for purposes of this disclosure may be considered to include a modified version thereof) to the UE 504.1 and UE 504.2 so that each node in the network is aware of the aggregate warning report 532.

[0087] According to some configuration, Figure 5 An example of a PHY technique indicated or suggested by the network 505 in the aggregate warning report 532 is a directional artificial noise (AN) injection scheme. As briefly described above, AN involves inserting artificial noise with one or more amplitudes, frequencies, or phases into a signal to make it difficult for a malicious node (adversary 504.A) to effectively capture the message.

[0088] Continue to refer Figure 5 For this example, it is assumed that the network entities in network 505 have successfully determined the location of adversary 504.A as additional information to be incorporated into the aggregated warning report 532 circulated to the authorized network node. This can be done, for example, via a network response to the Figure 4 The triangulation of the data included in the individual warning reports #1 and #2 received by the network (then 405) is performed. The looping of the aggregated warning report by the network 505 enables the network to inform the gNB 502 and UEs 504.1 and 504.2 of the location of the adversary 504.A. In response, the three nodes may apply a directional AN to the location of the adversary.

[0089] For example, Figure 5Three spatial transmit beams 528 are shown configured by the gNB 502 in response to an instruction to communicate with UE 504.1 and UE 504.2 using an AN. Here, the gNB 502 divides the beam into three segments. One of the spatial beams that is horizontally arranged relative to the figure includes data intended for UE 504.1 and an AN that interferes with the data. Similarly, one of the spatial beams that is vertically arranged also includes data intended for UE 504.2 along with an interfering AN. A third spatial beam that is diagonally arranged is oriented directly along the path of the location of the malicious node 504.A and includes only the AN. It is also assumed for this example that UE 504.1 and UE 504.2, which are authorized nodes, are aware of the AN measurements in order to successfully separate the data from the AN through applicable decoding techniques. The adversary node 504.A may receive a stronger AN signal through the diagonal spatial beam and receive additional ANs due to the horizontally and vertically arranged beams. The presence of the AN in each of these spatial beams may significantly degrade the quality of any data received by the malicious node 504.A on the applicable channel.

[0090] In the above example, while gNB 502 provides an AN, other configurations may cause one of UE 504.1 or UE 504.2 to alternatively (or additionally) provide an AN along with uplink data to gNB 502. The use of this configuration may be influenced or determined by the network 505's decision as to what steps to take to ameliorate the risk of an identified malicious node capturing data from the network, taking into account factors such as the available power of the UEs, the location and orientation of the respective nodes, and so forth.

[0091] In various embodiments, the network 505 or the UE may choose to implement AN elimination. In the case where the network 505 cannot determine the specific location of the adversary (malicious node), other network nodes are therefore unaware of the location from the aggregated warning report. Therefore, neither the network 505 nor any network node can use directional AN. Instead, they can apply AN elimination. In AN elimination, a node (such as a base station) can inject artificial noise on top of the data it transmits to the UE. Knowing the AN parameters, the UE can eliminate the AN from the signal to recover the data, but the adversary 504.A cannot eliminate the AN, which ideally prevents the adversary from decoding the associated data. In some configurations using AN elimination, the gNB 502 can design the AN based on the channel of the authorized UE, and therefore, any adversary that naturally has a different channel cannot eliminate AN interference, even if it captures associated data damaged by the AN interference.

[0092] In the event that the gNB is instead able to apply a directional AN noise scheme as described above (e.g., the location of the malicious node 504.A is known), the gNB may consider the interference that the AN will impose on the neighboring cells if the gNB applies the directional AN scheme. For example, depending on the amount of interference, the gNB may choose to change the technique to another technique (e.g., AN elimination). Thus, these specific implementations of the present disclosure provide network nodes with dynamic flexibility in determining what scheme is best based on different considerations. Here, if the interference to the neighboring cells is minimal, the directional AN may be decided as a more strategic option. However, if the interference level on one or more neighboring cells is significant, the gNB may choose AN elimination to reduce the interference that nearby authorized nodes may otherwise experience.

[0093] As from Figure 4 and Figure 5 As will be apparent from the context where appropriate, this disclosure may use the terms “network” and “network entity” interchangeably. In some configurations, a network may include a base station (e.g., a gNB), or a core network 190 or a component within the core network 190 ( Figure 1 )wait.

[0094] In another aspect of the present disclosure, techniques are disclosed for the network to act proactively or reactively based on the circumstances that exist. For the purposes of this disclosure, reactively acting refers to acting without any specific information about the presence of a malicious node, while reactively acting refers to acting after receiving a UE / base station warning about a malicious node. If any node (including but not limited to any UE and / or gNB) encounters any situation that suggests the presence of an active or passive malicious node, the node may individually assemble a warning report. Such a situation may occur in the following example situations.

[0095] As one such example, a UE may insert an artificial PHY signature in its signal as a security technique that is decodable by authorized receiving UEs. However, in some cases, the PHY signature expected by the UE is different from the signature actually received. In such scenarios, an active malicious node may be fairly implied. In another example, the UE may apply a CSI-based AN injection scheme that adds an AN to a data signal decodable by the receiving UE, because the AN is designed based on the channel state information (CSI) of the authorized receiver. If the data bits are not correctly decoded (e.g., CRC fails) at the UE (at least several times) despite the received signal-to-noise ratio being high enough, the presence of an active malicious node may be inferred.

[0096] In yet another example, the UE may apply a PHY-based authentication scheme that uses an exchanged phase of a signal to verify the transmitter of the data before the data itself is transmitted. If a sending UE participates in such a scheme but observes repeated authentication failures with a particular receiving node, the UE may determine that the receiving node that cannot be authenticated is a passive malicious node. For example, the UE may provide a phase value to a node that the UE expects the receiving node to apply to modulate a signal returned from the node to the UE that includes the identity of the node. Thus, in one case, the UE may expect the node to apply QPSK or other phase modulation to its identity and provide the modulated identity back to the UE based on the channel reciprocity between the UE and the node. If the received identity is not decodable or does not match the true identity expected by the UE, this fact is a fair indication that the other node is a passive malicious node.

[0097] In other aspects, upon receiving a warning report from any UE or gNB, the network may determine which PHY or cross-layer security technique to apply and the parameters of the technique. Along with this determination, the network may incorporate any adverse effects into the specific implementation of the technique, taking into account details such as the current network topology, the activity of the node, and the capabilities of the gNBs / UEs. Relative to the current topology, as noted, if a particular technique may cause interference to a neighboring cell, then the interference may be considered a detriment to the use of the relevant technique. The activity of the node includes, for example, whether a particular technique will affect active nodes served by a serving base station.

[0098] When a UE detects a malicious node, the information about the malicious node may only be approximate (e.g., the approximate time slot in which the malicious node exists, the approximate direction of the malicious node, the approximate power level of the signal from the malicious node, etc.). The UE may not be able to accurately determine the location of the adversary based on the limited antenna beamwidth of the UE and other factors. Therefore, the UE can still provide the network with what information it has in the warning report so that the network can collect all information about the malicious node from other UEs or base stations. Using this aggregated information, the network can determine the adversary location based on a collaborative effort. The NW can then proceed to select the security technology to be applied taking into account the malicious node, while taking into account the adverse effects of the technology on the UE and the other factors discussed above.

[0099] The NW may also consider the resources to which the technique is applied. For example, one alert report may indicate one frequency band in which an adversary is observed, while another alert report from another user may observe a different frequency band. Thus, the network may infer that if the adversary observed across frequency bands is the same as the adversary between the two UEs, the network may indicate these two specific frequency bands as resources to which the technique is to be applied.

[0100] As another exemplary security technique, the network may select the PHY signature type and related parameters to be implemented at the gNB so that individual UEs can remove the signature. If the UE is able to remove the embedded signature, the network may determine to apply the PHY signature embedding technique.

[0101] For artificial noise (AN) injection strategies, the network may decide whether the technique to be applied should be directional or non-directional in nature. This determination may be facilitated based on the availability of the UE's CSI, which will be affected by the gNB that will transmit the AN. Information in the corresponding CQI report may also be used. The network may also consider any interference management capabilities of neighboring cells to assess the impact of directional AN transmissions.

[0102] If the UE can eliminate AN, the network can apply AN elimination techniques. Moreover, because AN is based on CSI, the network will likely only apply this technique if it is aware of the CSI of the UE in question. Similarly, if the network has determined or is aware of the direction or specific location of the adversary / malicious node, the network can instead apply AN directional techniques.

[0103] In various configurations, as described above, the network applies the selected technology in determined time and frequency resources. The network can also apply the selected PHY and / or cross-layer security technology in accordance with factors such as when to start and end execution of the selected security procedures, what frequency band to use, etc.

[0104] The network can use the information related to the malicious node provided in the warning report to determine the time schedule and security techniques to be used. For example, if the malicious node was active in the previous time slot, the NW can infer from the warning report the time slots to apply the technique in the future based on the historical activity pattern of the malicious node. To this end, warning reports from different users can indicate to the network what specific patterns the adversary follows and the time slots in which the adversary will be active. Therefore, in some configurations, the time when the technique should be applied can be extrapolated based on these patterns (if available).

[0105] In various embodiments, the network may coordinate with the gNB to apply the selected techniques only when necessary and only for a given period of time so as to (i) not force the UE to continuously consume unnecessary energy based on the necessary task of carrying the activity in question, and (ii) not continuously and effectively congest or block the selected time and frequency slots. Following these guidelines, the network can conduct a very effective set of carefully selected security techniques that eliminate malicious nodes from the network using modest resources compared to traditional techniques.

[0106] To provide additional flexibility in the process, the network may coordinate the gNB and UE to relay their individual warning reports in the optimal channels based on network conditions. These channels may include uplink channels, downlink channels, or sidelink channels.

[0107] In various configurations, the network may generate an aggregate warning report based on individual warning reports from the gNB / UE, and the aggregate warning report may be relayed to the network node via an L3 link or via a trusted and PHY-secure L1 link (e.g., relying on channel reciprocity and phase value exchange by the transmitter and receiver to securely authenticate the transmitter, as previously described).

[0108] In various configurations, the network may also obtain the location of the malicious node by using individual warning reports provided by different gNB / UEs (e.g., via triangulation) and share the location within the aggregated warning report. The NW may also insert information about the selected security techniques and their parameters (e.g., the type of technique such as directional AN, the time schedule and frequency resources used to perform it) into the aggregated warning report.

[0109] Along with PHY signature embedding and AN injection as an effective security protection strategy, the network may implement other alternative PHY or cross-layer techniques in some configurations, including but not limited to the following:

[0110] (i) Additional Authentication Protection - In this strategy, the network instructs the gNB to re-authenticate the receiver using a phase difference technique (provided directly in the PHY via a request authentication tag for any transmission and / or via PHY security credential exchange).

[0111] (ii) Scrambling Sequence - Instead of deriving the seed for the scrambling sequence (for PDSCH or PDCCH) from upper layers or the physical cell ID, both of which can be guessed by a malicious node, in one implementation, the network instructs the transmitter and receiver to derive a mixed seed based on a common channel between the nodes (e.g., the nodes can measure a specific characteristic of the channel and apply that value to derive the seed). Because the channel is dedicated to the transmitter and receiver, the seed will be unguessable at the malicious node.

[0112] (iii) Upper layer encryption algorithms - These techniques are examples of cross-layer techniques that the network may choose to apply. Because the node's upper layers cannot determine the presence of an adversary, the network may instruct the node to transmit an indication from the physical layer to the upper layers in response to detecting an adversary at the PHY level. In response to receiving the indication, the upper layers may increase the applied encryption key length already used by the transmitter and receiver (e.g., from a 128-bit to a 256-bit key length).

[0113] (iv) Intentionally forging a PHY signature - In these configurations, if the UE uses PHY signature embedding as the initial security technique, the UE must typically communicate the parameters it uses for the artificial signature to another node to enable that node to remove the signature from the signal. In doing so, the malicious node may be the node that requested the signature parameters. Therefore, the network may instruct the UE to transmit fake signature parameters to such nodes to prevent them from being able to decrypt the data in the signal.

[0114] Although a few exemplary techniques are described above, numerous other techniques may additionally or alternatively be used without departing from the spirit and scope of the present disclosure.

[0115] In another aspect of the present disclosure, network entities may proactively perform security checks intermittently (on demand) or according to a given schedule in which the NW instructs nodes to implement certain techniques to detect malicious nodes.

[0116] For example, the network may employ some nodes that may apply a secure authentication technique (which modifies the phase difference technique described previously). Here, the network silences the authorized UE, instructing the authorized UE not to respond to requests from a specific gNB or requests within specific resources (time, frequency, beam). The network may also instruct the gNB to send authentication requests to other nodes requesting their identities. Typically, this authentication request will be followed by a configuration transmission that the malicious node expects, such as parameters for an artificial PHY signature that the node can use to decrypt the data. In order to obtain this data, the malicious node may want to confirm the authentication request according to standard procedures. However, the response is actually used to capture malicious nodes because the authorized UE has been instructed by the network not to respond back. If the gNB receives a response, the gNB may assume that the sender is a malicious node. The gNB may also verify this fact by checking whether the received identity is authentic (for example, by comparing it to a list of trusted identities). The gNB may therefore provide this information to the network entity in its warning report.

[0117] This approach is in contrast to the passive approach shown in the previous slides, in which the network responds passively or actively to the detection of an adversary by a base station or UE. In this aspect, the adversary has not yet been detected initially. Instead, in this aspect, the network actively initiates a procedure to determine if any adversaries are present. Once a warning report is transmitted to the network in response to the active procedure, the network's technology selection and other aspects of the present disclosure can be resumed as described above.

[0118] Figure 6 6 is a timing diagram 600 illustrating an example of an active network response to a malicious node. A gNB 602 is shown. It is assumed that the gNB 602 is in a plurality of nodes. For simplicity, Figure 6Nodes are represented as UE 604.1, UE 604.2, ..., UE 604.n, where 604.n is the last node in the cell and n is the total positive integer supported by the gNB 602. Although UEs are shown, any number of network configurations and UE types (e.g., vehicles, pedestrians, parking meters, etc.) can be used. In this embodiment, the gNB is connected to the network entity 606 via a backhaul link or other communication link. The network entity 606 can be part of the core network or, in some configurations, can be a base station. The type of network entity 606 used can depend on the network configuration. In this example, a 5G NR network is assumed.

[0119] In some configurations, one or more of UE 604.1, UE 604.2, ..., UE 604.n may have previously operated in the cell or a neighboring cell, or the UEs may have recently joined the cell. In various configurations, gNB 602 or network entity 606 may transmit instructions for UE 604.1 to UE 604.n to submit warning reports. In other configurations, warning reports may be transmitted intermittently or periodically.

[0120] Continue to refer Figure 6 , each UE in UE 604.1, UE 604.2, and so on until UE 604.n respectively sends warning report #1 on uplink channel 611, sends warning report #2 on uplink channel 613, and so on, and sends warning report #n on uplink channel 615. The warning report includes information known to the specific UE about potential unauthorized nodes (also referred to as malicious nodes or adversaries in this document), including the types of information discussed in the above configuration, such as relative location, reception of error signatures, etc. After receiving the warning report, gNB 602 may send warning reports 1 to warning reports n to NW entity 606, for example, via a backhaul link or other wired or wireless communication link.

[0121] The NW entity 606 can therefore use the information in the n warning reports as a basis for identifying information about unauthorized nodes, as in 610. The NW entity 606 can determine the appropriate security mechanism for responding to the presence of a malicious node (UE 604.A in this example) as needed. To this end, the NW entity can consider the information provided by each individual warning report. If the location has not yet been identified, the NW entity can attempt to locate the malicious node via triangulation or another approximation technique using the data in the warning report. As described in the aforementioned configuration, the NW entity 606 can also consider the activities and resources of the nodes in the network when determining the appropriate security measures or sets thereof. In other embodiments, one or more of the UEs may have taken one or another periodic measure with respect to malicious nodes in general (or malicious node 604.A in particular) and transmit the results of the information to the gNB, where the information is ultimately transmitted to the NW entity 606.

[0122] After taking the adverse effects into account, or concurrently with this process, the network entity 606 may then compile an aggregate report that includes relevant information about the malicious node 604.A or other expected malicious nodes from each of the reporting UEs. The aggregate report may also include information about neighboring cells, which may come from separate reports from the gNB transmitted on link 639.

[0123] At 617, the network entity may send an aggregate warning report back to the gNB 602 over link 617, which in some cases may be the same physical medium as 639. In addition to receiving a copy of the aggregate report, the gNB may send a copy of the report uplink over channel 615 to the UE 604.n, for example, using downlink channels 619, 621, 623. The aggregate report may contain a set of data related to the malicious nodes (including node 604.A), as well as instructions on how each individual node can work cooperatively under the security mechanism initially selected by the NW entity 606. The aggregate warning report may include instructions for one or more specific measures to be taken to balance neutralizing the threat of the malicious node 604.A by minimizing the use of network resources, minimizing interference, and minimizing potential overuse of power in devices operating wirelessly.

[0124] Therefore, in some configurations, one or more UEs may be assigned to perform certain measures to prevent malicious nodes from disrupting the network or gaining access to sensitive data. Figure 6In the example shown, the gNB 602 has been tasked with performing safety measures 629. For example, as shown, when transmitting data to one or more UEs via the wireless channel 608, the gNB has been instructed to use directional AN transmission 625, although other actions may be equally or more appropriate depending on factors such as the location of the node 604.A relative to other nodes and the location of nodes in neighboring cells. In this case, it can be assumed that the gNB uses multiple spatial beams to transmit artificial noise in the direction of the node 604.A, while simultaneously transmitting a combination of data and AN to the nodes intended to receive the data.

[0125] Having received the aggregate warning report and knowing the other facts in advance, the authorized nodes 604.1 to 604.n can be uniquely located to decode the data from the injected AN. As noted, one or more additional or different tasks may be used to defeat malicious nodes, whether initiated by a UE, gNB, NW entity, or some combination thereof, e.g., as enumerated in the aggregate warning report. For example, in Figure 6 UE 604.1 to UE 604.n may additionally or alternatively be tasked with performing other collaborative tasks 627 that keep the network burden to a minimum while effectively weeding out malicious nodes such as UE 604.A. These collaborative efforts may include any combination of existing tasks, such as one or more of those previously disclosed.

[0126] Figure 7 is a flow chart of a method of wireless communication. Figure 7 The steps in Figure 1 Any one of the UEs 104, UE 350 ( Figure 3 ), UE 404.1 or UE 404.2( Figure 4 ) and UE 504.1 or UE 504.2 ( Figure 5 ), UE604.1 to UE 604.n( Figure 6 ) any one of the UEs and the device 902 ( Fig. 9 ) to perform. UEs in different types of networks can also be used to perform Figure 7 Steps in .

[0127] Referring initially to 702, a UE may send a warning report indicating the presence of an unauthorized network node, the report including information associated with the unauthorized network. Thereafter, at 704, the UE may receive a message from a base station or a network entity indicating security measures to be applied to communications between authorized network nodes including the UE, the message received in response to the report and in response to another report from one of the authorized network nodes, the other report including additional information associated with the unauthorized network node. The other report may be sent, for example, from one of the other UEs of the network, a gNB, a network entity, or another network entity, etc.

[0128] Using information from the received message, the UE may detect the presence of the unauthorized network node in response to different security measures. For example, the UE may detect the unauthorized network node by detecting that the type of security measures associated with the unauthorized network node is different from the type of security measures of the authorized network node. In another example, the UE may detect the unauthorized network node by detecting that the security measures may be performed over a different time period than the security measures of the authorized network node. In another example, the UE may detect the unauthorized network node by detecting that the security measures associated with the unauthorized network node have a different effect on the authorized network node than the security measures of the authorized network node. The UE may perform, for example, one of the tasks identified in the present disclosure or another known task, and in some cases the UE may do so in collaboration with other UEs.

[0129] In various configurations, such as at 708, the UE may receive another message indicating that the UE is communicating a report in an uplink direction, a downlink direction, or a sidelink direction, wherein the report is sent after receiving the other message. Figure 6 The transmission of reports in a specific direction is discussed, but this need not be the case, and the network entity or gNB may utilize other transmission methods to avoid becoming a network bottleneck, among other motivations. This flexibility in the use of multiple channels provides significant benefits in situations where one of the directions is more available than another, or the sidechains are free, to name just a few possibilities.

[0130] In other configurations, the UE may receive an aggregate report at 710, the aggregate report including the information from the report and the additional information from the other report, wherein the aggregate report is received via an authentication link with at least one of the authorized network nodes. Thus, the aggregate report may provide substantial benefits by including messages and information from different authorized nodes. Unlike conventional approaches, the aggregation of reports may provide a tool for enabling the UE and other nodes to work collaboratively so that measures taken against unauthorized nodes are not only effective, but also do not unnecessarily overburden the network and its resources, and do not degrade communications or unnecessarily increase interference, for example in the case of high priority data or due to the current location of the node.

[0131] The actions taken need not be isolated; they may be coordinated and repeated, intermittent or periodic, as desired. At 712, the UE may receive another message indicating another security measure to be applied to communications between the authorized network node. Thus, depending on the nature of the threat and the network, more than one security measure or more than one type of security measure may be employed to further identify the above purpose. At 714, the UE may respond to the other message based on the other security measure to successfully detect the presence of the unauthorized network node. Thus, in some configurations, more than one security measure may be used to thwart unauthorized nodes.

[0132] Figure 8 is a flow chart of a method of wireless communication. Figure 8 The steps may be performed by a network or a network entity, which in some cases includes (partial or complete) a base station, a core network 190 ( Figure 1 ) or any one of the components of the core network, base station 310 ( Figure 3 )、Network Entity 405 / 505( Figure 4 and Figure 5 ), network entity 606 ( Figure 6 ) and device 1002( Fig.10 ).

[0133] Referring initially to 802, an applicable network entity may receive a plurality of warning reports, each indicating the presence of an unauthorized network node and including information associated with the unauthorized network node, wherein the plurality of reports are from a plurality of authorized network nodes, respectively. The network entity may aggregate the information and may send a message to one or more base stations, or in other configurations to UEs and other nodes of the network given their unique characteristics, in accordance with 804, indicating security measures to be applied to communications between authorized network nodes in response to the plurality of reports. As specified in 806, the security measures may be determined based on the adverse effects of the security measures on the authorized network node. Thus, the network entity may select security measures that have the least adverse effects on the node. The nature of the threat may also be a consideration, in which case stronger, longer, or repeated measures may be part of the initially determined security measures.

[0134] In various configurations, such as at 808, the network entity may send another message indicating that at least one of the authorized network nodes communicates a report in an uplink direction, a downlink direction, or a sidelink direction, wherein the plurality of reports are received after the message is sent. Figure 7 As described, such flexibility may enable network entities to avoid busy or congested routes while utilizing less busy routes. Such flexibility may also enable network entities to reduce their energy usage and the required interference that may be caused by sending data.

[0135] In another configuration, at 810, the sending of the report by the network entity may include sending an aggregate report including the information from each of the plurality of reports, wherein the aggregate report is sent to at least one of the authorized network nodes over the authentication link. Thus, while a single report from one node may not be sufficient to adequately inform the network of the nature of the threat, the aggregate information from all neighboring or related operational nodes may be sufficient to allow the network entity to determine the most effective security measures in the situation, which may require the authorized network nodes working in collaboration to remove the unauthorized node and prevent future access to additional malicious nodes.

[0136] At 812, the network entity may send another message indicating another security measure to be applied to communications between the authorized network nodes. Figure 7Consistent, where the UE applies more than one security measure. In some cases for the purposes of the present disclosure, the security measures selected by the network may include multiple separate security measures of the same type or different types, and they may be executed, for example, at a given time or over a longer period of time. Other advantages of this technique are that the network can achieve temporal continuity in protecting itself from malicious nodes. In other configurations, dynamic measures may be more appropriate so that the selected security measures can change with changing network conditions.

[0137] Fig. 9 9 is a diagram illustrating an example of a hardware implementation for an apparatus 902. For example, Fig. 9 The device in may (partially or in whole) describe Figure 1 The device 104, UE 350 ( Figure 3 ), UE 404.1 or UE 404.2( Figure 4 ) and UE504.1 or UE 504.2 ( Figure 5 ), UE 604.1 to UE 604.n( Figure 6 ) any one of the UEs and the device 902 ( Fig. 9). The device 902 is a UE and includes a cellular baseband processor 904 (also referred to as a modem) coupled to a cellular RF transceiver 922 and one or more subscriber identity modules (SIM) cards 920, an application processor 906 coupled to a secure digital (SD) card 908 and a screen 910, a Bluetooth module 912, a wireless local area network (WLAN) module 914, a global positioning system (GPS) module 916, and a power source 918. The cellular baseband processor 904 communicates with the UE 104 and / or the BS 102 / 180 via the cellular RF transceiver 922. The cellular baseband processor 904 may include a computer-readable medium / memory. The computer-readable medium / memory may be non-transitory. The cellular baseband processor 904 is responsible for general processing, including executing software stored on a computer-readable medium / memory. The software, when executed by the cellular baseband processor 904, causes the cellular baseband processor 904 to perform the various functions described above. The computer-readable medium / memory may also be used to store data manipulated by the cellular baseband processor 904 when executing the software. The cellular baseband processor 904 also includes a receiving component 930, a communication manager 932, and a transmitting component 934. The communication manager 932 includes one or more of the illustrated components. The components within the communication manager 932 may be stored in a computer-readable medium / memory and / or configured as hardware within the cellular baseband processor 904. The cellular baseband processor 904 may be a component of the UE 350 and may include a memory 360 and / or at least one of a TX processor 368, an RX processor 356, and a controller / processor 359. In one configuration, the device 902 may be a modem chip and include only the baseband processor 904, and in another configuration, the device 902 may be the entire UE (e.g., see Figure 3 350), and includes the aforementioned additional modules of device 902.

[0138] The communication manager 932 includes a warning report generating component 940, which is configured to generate a warning report for the UE, for example, as described in conjunction with reference Figure 7 The communication manager 932 also includes a triangulation component 942 that receives input in the form of coordinates of malicious nodes from the receiving component 930 and is configured to triangulate the location of the malicious nodes, for example, as described in conjunction with the information in the warning report that may be included in 702. The communication manager 932 also includes an AN component 944 that receives input in the form of information from the aggregate report receiving component 950 and the receiving component 930 and is configured to decrypt AN noise from data in the authorized transmission, for example, as described in conjunction with the example security measure Figure 7AN component 944 can also be configured to inject AN in the transmitted signal if the aggregate warning report so determines.

[0139] The communication manager 932 also includes a phase component 946 that receives information in the form of security measures identified from the aggregate report receiving component 954 and is configured to add a phase to the signal to encrypt the signal. Therefore, components 944 and 946, together with a security measures component 948 that can obtain information about security measures from the aggregate report receiving component 954, can each assist in detecting unauthorized nodes, such as Figure 7 706. The communication manager 932 may also include an adverse impact component 950 that may obtain information from the warning report generation component 940 and may use the information to insert into the warning report identified in step 702. The communication manager 932 may also include a resource component 952 that may consider one or more resources that are critical to the device 902 for reference. Figure 7 The communication manager may be used in the warning report generating component 940 sent in 702. As noted, the communication manager also includes an aggregate report receiving component 954, which may store the aggregate report received from the network entity, such as in step 704, and may obtain various information items about the unauthorized node from the aggregate report, including the warning report sent in 702.

[0140] The device may include executing Figure 7 Each of the boxes in the algorithm in the preceding flowchart is an additional component. Therefore, Figure 7 Each block in the aforementioned flow chart of can be performed by a component, and the apparatus may include one or more of those components. These components may be one or more hardware components that are specifically configured to perform the process / algorithm, implemented by a processor configured to perform the process / algorithm, stored in a computer-readable medium for implementation by a processor, or some combination thereof.

[0141] Fig.101000 is an example of a hardware implementation for an apparatus 1002. The apparatus 1002 is a network entity such as a core network or a portion thereof, or a base station, and includes a baseband unit 1004. The baseband unit 1004 can communicate with the UE 104 via a cellular RF transceiver. The baseband unit 1004 may include a computer-readable medium / memory. The baseband unit 1004 is responsible for general processing, including executing software stored on a computer-readable medium / memory. The software, when executed by the baseband unit 1004, causes the baseband unit 1004 to perform the various functions described above. The computer-readable medium / memory may also be used to store data manipulated by the baseband unit 1004 when executing the software. The baseband unit 1004 also includes a receiving component 1030, a communication manager 1032, and a sending component 1034. The communication manager 1032 includes one or more of the illustrated components. The components within the communication manager 1032 may be stored in a computer-readable medium / memory and / or configured as hardware within the baseband unit 1004. The baseband unit 1004 may be a component of the base station 310 and may include a memory 376 and / or at least one of the TX processor 316 , the RX processor 370 , and the controller / processor 375 .

[0142] The communication manager 1032 includes a report receiving component 1040 configured to receive messages including warning reports from nodes in the network, such as in conjunction with Figure 8 The communication manager 1032 also includes an aggregate report generation component 1042 that receives information from different reports in the report receiving component 1040 for determining and sending security measures, such as in conjunction with Figure 8 The communication manager 1032 also includes a safety mechanism determination component 1044, which receives information in the form of adverse effects from the warning report in component 1040 and is used to consider the adverse effects of different nodes when determining safety measures, for example, as combined Figure 8 The communication manager 1032 also includes an adverse impact component 1046, which is configured to store information about adverse impacts of network entities and different nodes for generating and sending aggregate reports and determining security measures, such as in Figure 8 804, 806 and 812.

[0143] Communications manager 1032 also includes a security mechanism resource component 1048 that obtains information about network resources and adverse effects from components 1040 and 1046 and determines security measures by taking those characteristics into account, such as in Figure 8802, 804 and 806. The communication manager also includes a channel component 1050, which is configured to obtain information about network resources and adverse effects from components 1040 and 1046, and is configured to determine a channel in which to send an aggregate warning report or instruct nodes to send their individual reports, such as Figure 8 As shown in 808.

[0144] The device may include executing Figure 8 Each of the blocks in the algorithm in the above flowchart is an additional component. Therefore, Figure 8 Each block in the aforementioned flow chart of can be performed by a component, and the apparatus may include one or more of those components. These components may be one or more hardware components that are specifically configured to perform the process / algorithm, implemented by a processor configured to perform the process / algorithm, stored in a computer-readable medium for implementation by a processor, or some combination thereof.

[0145] It should be understood that the specific order or hierarchy of the blocks in the disclosed process / flowchart is merely an illustration of the exemplary method. It should be understood that the specific order or hierarchy of the blocks in the process / flowchart may be rearranged based on design preferences. Further, some blocks may be combined or omitted. The attached method claims provide the elements of each block in a sample order, but are not meant to be limited to the specific order or hierarchy provided.

[0146] The foregoing description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects. Therefore, the claims are not intended to be limited to the aspects shown herein, but to conform to the full scope consistent with the language claims, wherein the elements mentioned in the singular are not intended to represent "one and only one", unless specifically so stated, but "one or more". Terms such as "if", "when ......" and "while ......" should be interpreted as "under the conditions of ......", rather than meaning an immediate time relationship or reaction. That is, these phrases, such as "when ......", do not mean an immediate action in response to the occurrence of an action or during the occurrence of an action, but simply imply that if the conditions are met, then the action will occur, but no specific or immediate time limit is required for the occurrence of the action. The word "exemplary" is used herein to mean "used as an example, instance, or illustration". Any aspect described as "exemplary" herein is not necessarily interpreted as being preferred or having advantages over other aspects. Unless otherwise specified, the term "some" refers to one or more. Combinations such as “at least one of A, B, or C,” “one or more of A, B, or C,” “at least one of A, B and C,” “one or more of A, B, and C,” and “A, B, C, or any combination thereof” include any combination of A, B, and / or C, which may include multiple A, multiple B, or multiple C. Specifically, combinations such as “at least one of A, B, or C,” “one or more of A, B, or C,” “at least one of A, B, and C,” “one or more of A, B, and C,” and “A, B, C, or any combination thereof” may be only A, only B, only C, A and B, A and C, B and C, or A and B and C, where any such combination may include one or more members of A, B, or C. All structural and functional equivalents to the elements of the various aspects described throughout the disclosure that are known or later become known to those of ordinary skill in the art are expressly incorporated herein by reference and are intended to be encompassed by the claims. Furthermore, nothing disclosed herein is intended to be dedicated to the public, regardless of whether such disclosure is explicitly recited in the claims. Words such as "module," "mechanism," "element," "device," etc. cannot replace the word "component." Therefore, no claim element will be construed as a component-plus-function unless the element is explicitly recited using the phrase "component for..."

[0147] The following examples are merely illustrative and may be combined with aspects of other embodiments or teachings described herein, but are not limited thereto.

[0148] Embodiment 1 is an apparatus for wireless communication at a user equipment, the apparatus comprising a memory; and at least one processor coupled to the memory, the at least one processor being configured to: send a report indicating the presence of an unauthorized network node, the report comprising information associated with the unauthorized network node; and receive a message indicating security measures to be applied to communications between authorized network nodes including the UE, the message being received in response to the report and in response to another report from one of the authorized network nodes, the other report comprising additional information associated with the unauthorized network node.

[0149] Embodiment 2 is the apparatus of embodiment 1, wherein the at least one processor is further configured to detect the presence of the unauthorized network node in response to a different security measure.

[0150] Embodiment 3 is the apparatus of any one of embodiments 1 and 2, wherein the security measure is based on an adverse effect of the security measure on the authorized network node.

[0151] Embodiment 4 is an apparatus according to any one of embodiments 1 to 3, wherein the adverse impact relates to a current topology of the authorized network nodes, an activity of at least one of the authorized network nodes, or a capability of the at least one of the authorized network nodes.

[0152] Embodiment 5 is the apparatus of any one of embodiments 1 to 4, wherein the message indicates resources in which the security measure is to be applied, wherein the resources are based on the information associated with the unauthorized network node.

[0153] Embodiment 6 is the apparatus according to any one of embodiments 1 to 5, wherein the resource is a time slot, at least one frequency band, or a beam.

[0154] Embodiment 7 is an apparatus according to any one of embodiments 1 to 6, wherein the at least one processor is further configured to receive another message instructing the UE to communicate a report in an uplink direction, a downlink direction, or a sidelink direction, wherein the report is sent after receiving the other message.

[0155] Embodiment 8 is an apparatus according to any one of embodiments 1 to 7, wherein the at least one processor is further configured to receive an aggregate report, the aggregate report including the information from the report and the additional information from the other report, wherein the aggregate report is received via an authentication link with at least one of the authorized network nodes.

[0156] Embodiment 9 is the apparatus of any one of embodiments 1 to 8, wherein the aggregate report indicates a location of the unauthorized network node, the location being based on the information from the report and the additional information from the another report.

[0157] Embodiment 10 is the apparatus of any one of embodiments 1 to 9, wherein the aggregate report includes the message indicating the security measure.

[0158] Embodiment 11 is the apparatus of any one of embodiments 1 to 10, wherein the security measure is a physical layer security measure or a cross-layer security measure.

[0159] Embodiment 12 is an apparatus according to any one of embodiments 1 to 11, wherein the at least one processor is further configured to: receive another message indicating another security measure to be applied to communications between the authorized network nodes; and in response to the another message, detect the presence of the unauthorized network node based on the another security measure.

[0160] Embodiment 13 is the apparatus of any one of embodiments 1 to 12, wherein the other message is received periodically or aperiodically.

[0161] Embodiment 14 is an apparatus for performing wireless communications at a network entity, the apparatus comprising: a memory; and at least one processor coupled to the memory, the at least one processor being configured to: receive a plurality of reports, each of the plurality of reports indicating the presence of an unauthorized network node and including information associated with the unauthorized network node, wherein the plurality of reports are respectively from a plurality of authorized network nodes; and send a message indicating security measures to be applied to communications between the authorized network nodes in response to the plurality of reports.

[0162] Embodiment 15 is the apparatus of embodiment 14, wherein the at least one processor is further configured to determine the security measure based on an adverse effect of the security measure on the authorized network node.

[0163] Embodiment 16 is an apparatus according to any one of embodiments 14 and 15, wherein the adverse impact relates to a current topology of the authorized network nodes, an activity of at least one of the authorized network nodes, or a capability of the at least one of the authorized network nodes.

[0164] Embodiment 17 is the apparatus of any one of embodiments 14 to 16, wherein the message indicates resources in which the security measure is to be applied, wherein the resources are based on the information associated with the unauthorized network node.

[0165] Embodiment 18 is an apparatus according to any one of embodiments 14 to 17, wherein the resource is a time slot, at least one frequency band, or a beam.

[0166] Embodiment 19 is an apparatus according to any one of embodiments 14 to 18, wherein the at least one processor is further configured to send another message, wherein the other message instructs at least one of the authorized network nodes to communicate a report in an uplink direction, a downlink direction, or a sidelink direction, wherein the multiple reports are received after the message is sent.

[0167] Embodiment 20 is an apparatus according to any one of embodiments 14 to 19, wherein the at least one processor is further configured to send an aggregate report including the information from each report in the multiple reports, wherein the aggregate report is sent to at least one of the authorized network nodes via an authentication link.

[0168] Embodiment 21 is an apparatus as described in any one of embodiments 14 to 20, wherein the aggregate report indicates a location of the unauthorized network node, the location being based on the information from each report of the plurality of reports.

[0169] Embodiment 22 is an apparatus according to any one of embodiments 14 to 21, wherein the aggregate report includes the message indicating the security measure.

[0170] Embodiment 23 is the apparatus of any one of embodiments 14 to 22, wherein the security measure is a physical layer security measure or a cross-layer security measure.

[0171] Embodiment 24 is an apparatus according to any one of embodiments 14 to 23, wherein the at least one processor is further configured to: send another message indicating another security measure to be applied to communications between the authorized network nodes; wherein the multiple reports are received in response to detecting the presence of the unauthorized network node based on the another security measure.

[0172] Embodiment 25 is an apparatus according to any one of embodiments 14 to 24, wherein the other message is sent periodically or aperiodically.

[0173] Embodiment 26 is a method for wireless communications at a user equipment (UE), the method comprising: sending a report indicating the presence of an unauthorized network node, the report including information associated with the unauthorized network node; and receiving a message indicating security measures to be applied to communications between authorized network nodes including the UE, the message being received in response to the report and in response to another report from one of the authorized network nodes, the other report including additional information associated with the unauthorized network node.

[0174] Embodiment 27 is a method according to embodiment 26, the method further comprising: detecting the presence of the unauthorized network node in response to a different security measure.

[0175] Embodiment 28 is a method according to any one of embodiments 26 and 27, wherein the security measure is based on an adverse effect of the security measure on the authorized network node.

[0176] Embodiment 29 is a method for performing wireless communications at a network entity, the method comprising: receiving a plurality of reports, each of the plurality of reports indicating the presence of an unauthorized network node and including information associated with the unauthorized network node, wherein the plurality of reports are respectively from a plurality of authorized network nodes; and sending a message indicating security measures to be applied to communications between the authorized network nodes in response to the plurality of reports.

[0177] Embodiment 30 is a method according to embodiment 29, the method further comprising: determining the security measure based on an adverse effect of the security measure on the authorized network node.

Claims

1. An apparatus for wireless communication at a user equipment (UE), the apparatus comprising: Transceiver; Memory; and at least one processor coupled to the memory and the transceiver, the at least one processor configured to: sending, via the transceiver, a report indicating the presence of an unauthorized network node, the report including information associated with the unauthorized network node, and A message is received via the transceiver indicating security measures to be applied to communications between authorized network nodes including the UE, the message being received in response to the report and in response to another report from one of the authorized network nodes, the another report including additional information associated with the unauthorized network node. 2 . The apparatus of claim 1 , wherein the at least one processor is further configured to detect the presence of the unauthorized network node in response to a different security measure.

3. The apparatus of claim 1, wherein the security measure is based on an adverse effect of the security measure on the authorized network node. 4 . The apparatus of claim 3 , wherein the adverse impact relates to a current topology of the authorized network nodes, an activity of at least one of the authorized network nodes, or a capability of the at least one of the authorized network nodes.

5. The apparatus of claim 1, wherein the message indicates resources in which the security measure is to be applied, wherein the resources are based on the information associated with the unauthorized network node. The apparatus according to claim 5 , wherein the resource is a time slot, at least one frequency band or a beam.

7. The apparatus of claim 1, wherein the at least one processor is further configured to receive, via a transceiver, another message instructing the UE to communicate a report in an uplink direction, a downlink direction, or a sidelink direction, wherein the report is sent after receiving the another message.

8. The apparatus of claim 1 , wherein the at least one processor is further configured to receive, via the transceiver, an aggregate report comprising the information from the report and the additional information from the another report, wherein the aggregate report is received via an authenticated link with at least one of the authorized network nodes.

9. The apparatus of claim 8, wherein the aggregate report indicates a location of the unauthorized network node, the location being based on the information from the report and the further information from the further report.

10. The apparatus of claim 8, wherein the aggregate report includes the message indicating the security measure. The apparatus according to claim 1 , wherein the security measure is a physical layer security measure or a cross-layer security measure.

12. The apparatus of claim 1, wherein the at least one processor is further configured to: receiving, via the transceiver, another message indicating another security measure to be applied to communications between the authorized network nodes; and In response to the further message, the presence of the unauthorized network node is detected based on the further security measure. The apparatus according to claim 12 , wherein the another message is received periodically or aperiodically.

14. An apparatus for wireless communication at a network entity, the apparatus comprising: Transceiver; Memory; and at least one processor coupled to the memory and the transceiver, the at least one processor configured to: receiving, via the transceiver, a plurality of reports each indicating the presence of an unauthorized network node and including information associated with the unauthorized network node, wherein the plurality of reports are respectively from a plurality of authorized network nodes, and A message is sent via the transceiver in response to the plurality of reports indicating security measures to be applied to communications between the authorized network nodes.

15. The apparatus of claim 14, wherein the at least one processor is further configured to determine the security measure based on an adverse effect of the security measure on the authorized network node.

16. The apparatus of claim 15, wherein the adverse impact relates to a current topology of the authorized network nodes, an activity of at least one of the authorized network nodes, or a capability of the at least one of the authorized network nodes.

17. The apparatus of claim 14, wherein the message indicates resources in which the security measure is to be applied, wherein the resources are based on the information associated with the unauthorized network node.

18. The apparatus of claim 17, wherein the resource is a time slot, at least one frequency band, or a beam.

19. The apparatus of claim 14, wherein the at least one processor is further configured to send, via the transceiver, another message instructing at least one of the authorized network nodes to communicate a report in an uplink direction, a downlink direction, or a sidelink direction, wherein the plurality of reports are received after the message is sent.

20. The apparatus of claim 14, wherein the at least one processor is further configured to send, via the transceiver, an aggregate report including the information from each of the plurality of reports, wherein the aggregate report is sent to at least one of the authorized network nodes over an authenticated link.

21. The apparatus of claim 20, wherein the aggregate report indicates a location of the unlicensed network node, the location being based on the information from each of the plurality of reports.

22. The apparatus of claim 20, wherein the aggregate report includes the message indicative of the security measure.

23. The apparatus of claim 14, wherein the security measure is a physical layer security measure or a cross-layer security measure.

24. The apparatus of claim 14, wherein the at least one processor is further configured to send, via the transceiver, another message indicating another security measure to be applied to communications between the authorized network nodes, wherein the plurality of reports are received in response to detecting the presence of the unauthorized network node based on the another security measure.

25. The apparatus of claim 24, wherein the another message is sent periodically or aperiodically.

26. A method of wireless communication performed by a user equipment (UE), the method comprising: sending a report indicating the presence of an unauthorized network node, the report including information associated with the unauthorized network node; as well as receiving a message indicating security measures to be applied to communications between authorized network nodes including the UE, the message being received in response to the report and in response to another report from one of the authorized network nodes, the another report including additional information associated with the unauthorized network node.

27. The method according to claim 26, further comprising: The presence of the unauthorized network node is detected responsive to a different security measure.

28. The method of claim 26, wherein the security measure is based on an adverse effect of the security measure on the authorized network node.

29. A method of wireless communication performed by a network entity, the method comprising: receiving a plurality of reports, each of the plurality of reports indicating the presence of an unauthorized network node and including information associated with the unauthorized network node, wherein the plurality of reports are respectively from a plurality of authorized network nodes; as well as A message is sent in response to the plurality of reports indicating security measures to be applied to communications between the authorized network nodes.

30. The method according to claim 29, further comprising: The security measure is determined based on an adverse effect of the security measure on the authorized network node.

Images