Detective counted configuration

Abstract

A network node may identify at least one hostile device. The network node may send the counterfeit configuration to the at least one hostile device. The forgery configuration may be associated with a PHY technology. The counterfeit configuration may be sent to the at least one hostile device based on a location of the at least one hostile device. The at least one enemy device may be identified based on the at least one enemy device not owning any valid credentials. The network node may send the correct configuration to the genuine receiving device. The network node may send the counterfeit configuration and the correct configuration in parallel or based on time division multiplexing. Therefore, since the hostile device may waste time and power to perform algorithm operations based on the counterfeit configuration, the security of the entire system may be improved.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. patent application serial number 17 / 820,233, entitled “INTENTIONALLY FAKE CONFIGURATION TRANSMISSION” and filed on August 16, 2022, which is expressly incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates generally to communication systems, and more particularly to actively compromising a hostile device in a wireless communication system by sending a fake configuration to the hostile device. Background Art

[0004] Wireless communication systems are widely deployed to provide a variety of telecommunication services, such as telephony, video, data, messaging, and broadcast. Typical wireless communication systems may employ multiple access technologies capable of supporting communication with multiple users by sharing available system resources. Examples of such multiple access technologies include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single carrier frequency division multiple access (SC-FDMA) systems, and time division synchronous code division multiple access (TD-SCDMA) systems.

[0005] These multiple access technologies have been adopted in various telecommunication standards to provide a common protocol that enables different wireless devices to communicate at city, national, regional, and even global levels. An example telecommunication standard is 5G New Radio (NR). 5G NR is part of the continuous mobile broadband evolution promulgated by the Third Generation Partnership Project (3GPP) to meet new requirements associated with latency, reliability, security, scalability (e.g., with the Internet of Things (IoT)) and other requirements. 5G NR includes services associated with enhanced mobile broadband (eMBB), massive machine type communications (mMTC), and ultra-reliable low latency communications (URLLC). Certain aspects of 5G NR may be based on the 4G Long Term Evolution (LTE) standard. Further improvements to 5G NR technology are needed. In addition, these improvements may also be applicable to other multiple access technologies and telecommunication standards that employ these technologies. Summary of the invention

[0006] A simplified summary of one or more aspects is presented below to provide a basic understanding of these aspects. This summary is not an extensive review of all contemplated aspects. This summary is neither intended to identify key or important elements of all aspects, nor to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to a more detailed description presented later.

[0007] In one aspect of the present disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus may be a network node. The apparatus may identify at least one hostile device. The apparatus may send a forged configuration to the at least one hostile device. The forged configuration may be associated with a physical layer (PHY) technology.

[0008] To achieve the aforementioned and related purposes, one or more aspects include the features described in full below and particularly pointed out in the claims. The following description and the accompanying drawings set forth in detail some exemplary features of one or more aspects. However, these features are only indicative of only some of the various ways in which the principles of the various aspects can be employed. BRIEF DESCRIPTION OF THE DRAWINGS

[0009] Figure 1 is a diagram illustrating an example of a wireless communication system and an access network according to various aspects of the present disclosure.

[0010] Figure 2A is a diagram illustrating an example of a first frame according to various aspects of the present disclosure.

[0011] Figure 2B is a diagram illustrating an example of downlink (DL) channels within a subframe according to various aspects of the present disclosure.

[0012] Figure 2C is a diagram illustrating an example of a second frame according to various aspects of the present disclosure.

[0013] Figure 2D is a diagram illustrating an example of uplink (UL) channels within a subframe according to various aspects of the present disclosure.

[0014] Figure 3 is a diagram illustrating an example of a base station and a user equipment (UE) in an access network according to various aspects of the present disclosure.

[0015] Figure 4 is an example block diagram illustrating adding artificial physical layer (PHY) impairments in accordance with various aspects of the present disclosure.

[0016] Figure 5 is a diagram illustrating an example process of directionally sending a forged configuration to an adversary device according to various aspects of the present disclosure.

[0017] Figure 6 is a diagram illustrating an example process of sending a forged configuration to an adversary device in a broadcast manner according to various aspects of the present disclosure.

[0018] Figure 7 is a diagram of a communication flow of a method of wireless communication according to various aspects of the present disclosure.

[0019] Figure 8 is a flow chart of a method of wireless communication according to various aspects of the present disclosure.

[0020] Fig. 9 is a flow chart of a method of wireless communication according to various aspects of the present disclosure.

[0021] Fig.10 is a diagram illustrating an example of hardware implementation of an example apparatus and / or network entity according to various aspects of the present disclosure.

[0022] Fig.11 is a diagram illustrating an example of a hardware implementation for an example network entity according to various aspects of the present disclosure. DETAILED DESCRIPTION

[0023] Upper layer encryption technology can provide confidentiality and data integrity. In addition, reference signals may be important in many 5GNR functionalities (e.g., channel estimation, positioning, etc.). If there is a lack of security protection for reference signals, any transmission through reference signals may be vulnerable to malicious attacks, which may compromise the reliability of subsequent communication functions.

[0024] In some configurations, a legitimate sender may securely and reliably share (e.g., send) configurations to legitimate (genuine) receivers via reference signals in the presence of non-legitimate (malicious) receivers. The configuration sharing process may be passive in the sense that, although the hostile device may have exposed its malicious nature to the sender or the network (e.g., RAN or core network), the legitimate sender may not actively attempt to harm any hostile party (e.g., hostile device) at all.

[0025] According to one or more aspects of the present disclosure, a legitimate transmitter (e.g., a network node such as a base station) can actively seek to damage a hostile device (and disrupt the reliability of subsequent algorithmic tasks at the hostile device) by sending a forged configuration to the hostile device. Specifically, the legitimate transmitter can send the forged configuration in a directionally or broadcast manner while continuing to securely share the correct configuration in parallel with the real receiver. Thus, in this way, the hostile device may be forced to waste power and / or time running an algorithm based on the forged configuration.

[0026] The detailed description set forth below in conjunction with the accompanying drawings is a description of various configurations and does not represent the only configurations with which the concepts described herein can be practiced. In order to provide a thorough understanding of the various concepts, the specific embodiments include specific details. However, these concepts can be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form to avoid blurring these concepts.

[0027] Several aspects of the telecommunication system are also presented with reference to various apparatuses and methods. These apparatuses and methods are described in the following detailed description and are illustrated in the accompanying drawings by various blocks, components, circuits, processes, algorithms, etc. (collectively referred to as "elements"). These elements can be implemented using electronic hardware, computer software, or any combination thereof. Whether these elements are implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system.

[0028] As an example, an element or any part of an element or any combination of elements can be implemented as a "processing system", which includes one or more processors. The example of a processor includes a microprocessor, a microcontroller, a graphics processing unit (GPU), a central processing unit (CPU), an application processor, a digital signal processor (DSP), a reduced instruction set computing (RISC) processor, a system on a chip (SoC), a baseband processor, a field programmable gate array (FPGA), a programmable logic device (PLD), a state machine, a gate logic component, a discrete hardware circuit and other suitable hardware configured to perform various functionalities described throughout the present disclosure. One or more processors in a processing system can execute software. Whether referred to as software, firmware, middleware, microcode, hardware description language or other terms, software should be broadly interpreted as meaning instructions, instruction sets, codes, code segments, program codes, programs, subroutines, software components, applications, software applications, software packages, routines, subroutines, objects, executables, threads of execution, procedures, functions or any combination thereof.

[0029] Thus, in one or more example aspects, specific implementations and / or use cases, the described functionality may be implemented in hardware, software, or any combination thereof. If implemented in software, the functionality may be stored or encoded as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media. Storage media may be any available media that can be accessed by a computer. For example, such computer-readable media may include random access memory (RAM), read-only memory (ROM), electrically erasable programmable ROM (EEPROM), optical disk storage, magnetic disk storage, other magnetic storage devices, combinations of these types of computer-readable media, or any other medium that can be used to store computer-executable code in the form of instructions or data structures that can be accessed by a computer.

[0030] Although various aspects, specific implementations and / or use cases are described in this application by the illustration of some examples, additional or different aspects, specific implementations and use cases may be generated in many different arrangements and scenarios. The various aspects, specific implementations and / or use cases described herein can be implemented across many different platform types, devices, systems, shapes, sizes and packaging arrangements. For example, various aspects, specific implementations and / or use cases can be generated via integrated chip specific implementations and other devices based on non-module components (e.g., end-user devices, vehicles, communication equipment, computing equipment, industrial equipment, retail / purchase equipment, medical equipment, devices that enable artificial intelligence (AI), etc.). Although some examples may or may not be specifically for use cases or applications, the described examples may have a wide range of applicability. Various aspects, specific implementations and / or use cases can be in the range from chip-level or modular components to non-modular, non-chip-level specific implementations, and further to the range of aggregated, distributed or original equipment manufacturer (OEM) equipment or systems in conjunction with one or more technologies herein. In some practical environments, the equipment in conjunction with the various aspects and features described may also include additional components and features for implementing and practicing the claimed and described aspects. For example, the transmission and reception of wireless signals necessarily include multiple components for analog and digital purposes (e.g., hardware components including antennas, RF chains, power amplifiers, modulators, buffers, processors, interleavers, adders / summers, etc.) The various techniques described herein can be practiced in a wide variety of devices, chip-level components, systems, distributed arrangements, aggregated or disaggregated components, end-user devices, etc., of various sizes, shapes, and configurations.

[0031] The deployment of a communication system (such as a 5G NR system) can be arranged in a variety of ways with various components or constituent parts. In a 5G NR system or network, a network node, a network entity, a mobility element of a network, a radio access network (RAN) node, a core network node, a network element or network equipment such as a base station (BS), or one or more units (or one or more components) performing base station functionality can be implemented in an aggregated or decomposed architecture. For example, a BS (such as a Node B (NB), an evolved NB (eNB), an NR BS, a 5G NB, an access point (AP), a transmit receive point (TRP) or a cell, etc.) can be implemented as an aggregated base station (also referred to as an independent BS or a monolithic BS) or a decomposed base station.

[0032] A converged base station may be configured to utilize a radio protocol stack physically or logically integrated within a single RAN node. A decomposed base station may be configured to utilize a protocol stack physically or logically distributed between two or more units, such as one or more central or centralized units (CUs), one or more distributed units (DUs), or one or more radio units (RUs). In some aspects, a CU may be implemented within a RAN node, and one or more DUs may be co-located with the CU, or alternatively, may be geographically or virtually distributed in one or more other RAN nodes. A DU may be implemented to communicate with one or more RUs. Each of a CU, a DU, and a RU may be implemented as a virtual unit, i.e., a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU).

[0033] Base station operation or network design may take into account the aggregated nature of base station functionality. For example, a disaggregated base station may be utilized in an integrated access backhaul (IAB) network, an open radio access network (O-RAN (network configuration such as that initiated by the O-RAN Alliance)), or a virtualized radio access network (vRAN, also known as a cloud radio access network (C-RAN)). Decomposition may include distributing functionality across two or more units at various physical locations, as well as virtually distributing functionality of at least one unit, which may enable flexibility in network design. Individual units of a disaggregated base station or disaggregated RAN architecture may be configured for wired or wireless communication with at least one other unit.

[0034] Figure 1 1 is a diagram 100 illustrating an example of a wireless communication system and an access network. The illustrated wireless communication system includes a disaggregated base station architecture. The disaggregated base station architecture may include one or more CUs 110 that may communicate directly with a core network 120 via a backhaul link, or indirectly with the core network 120 through one or more disaggregated base station units, such as a near real-time (near RT) RAN intelligent controller (RIC) 125 via an E2 link, or a non-real-time (non-RT) RIC 115 associated with a service management and orchestration (SMO) framework 105, or both. The CU 110 may communicate with one or more DUs 130 via corresponding midhaul links, such as an F1 interface. The DU 130 may communicate with one or more RUs 140 via corresponding fronthaul links. The RU 140 may communicate with corresponding UEs 104 via one or more radio frequency (RF) access links. In some implementations, a UE 104 may be served simultaneously by multiple RUs 140.

[0035] Each of the units (i.e., CU 110, DU 130, RU 140, and near-RT RIC 125, non-RT RIC 115, and SMO framework 105) may include or be coupled to one or more interfaces configured to receive or send signals, data, or information (collectively, signals) via a wired or wireless transmission medium. Each of the units or an associated processor or controller that provides instructions to the communication interfaces of these units may be configured to communicate with one or more of the other units via a transmission medium. For example, these units may include a wired interface configured to receive signals on a wired transmission medium or send signals to one or more of the other units. Additionally, these units may include a wireless interface that may include a receiver, transmitter, or transceiver (such as an RF transceiver) configured to receive signals on a wireless transmission medium or send signals to one or more of the other units, or both.

[0036] In some aspects, CU 110 may host one or more higher layer control functions. Such control functions may include radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP), etc. Each control function may be implemented using an interface that is configured to communicate signals with other control functions hosted by CU 110. CU 110 may be configured to handle user plane functionality (i.e., central unit-user plane (CU-UP)), control plane functionality (i.e., central unit-control plane (CU-CP)), or a combination thereof. In some specific implementations, CU 110 may be logically divided into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RAN configuration, the CU-UP unit may communicate bidirectionally with the CU-CP unit via an interface (such as an E1 interface). As needed, CU 110 may be implemented to communicate with DU 130 for network control and signaling.

[0037] DU 130 may correspond to a logical unit that includes one or more base station functions for controlling the operation of one or more RUs 140. In some aspects, DU 130 may host one or more of a radio link control (RLC) layer, a medium access control (MAC) layer, and one or more high physical (PHY) layers (such as modules for forward error correction (FEC) encoding and decoding, scrambling, modulation and demodulation, etc.) depending at least in part on a functional split (such as a functional split defined by 3GPP). In some aspects, DU 130 may further host one or more low PHY layers. Each layer (or module) may be implemented using an interface that is configured to communicate signals with other layers (and modules) hosted by DU 130 or with control functions hosted by CU 110.

[0038] The lower layer functionality may be implemented by one or more RUs 140. In some deployments, a RU 140 controlled by a DU 130 may correspond to a logical node that hosts RF processing functions or low PHY layer functions (such as performing Fast Fourier Transform (FFT), Inverse FFT (iFFT), digital beamforming, physical random access channel (PRACH) extraction and filtering, etc.), or both, based at least in part on a functional partitioning (such as a lower layer functional partitioning). In such an architecture, the RU 140 may be implemented to handle over-the-air (OTA) communications with one or more UEs 104. In some implementations, real-time and non-real-time aspects of control plane and user plane communications with the RU 140 may be controlled by the corresponding DU 130. In some scenarios, this configuration may enable the implementation of the DU 130 and the CU 110 in a cloud-based RAN architecture (such as a vRAN architecture).

[0039] The SMO framework 105 may be configured to support RAN deployment and provisioning of non-virtualized network elements and virtualized network elements. For non-virtualized network elements, the SMO framework 105 may be configured to support the deployment of dedicated physical resources for RAN coverage requirements, which may be managed via an operation and maintenance interface (such as an O1 interface). For virtualized network elements, the SMO framework 105 may be configured to interact with a cloud computing platform (such as an open cloud (O-Cloud) 190) to perform network element lifecycle management (such as to instantiate virtualized network elements) via a cloud computing platform interface (such as an O2 interface). Such virtualized network elements may include, but are not limited to, CU 110, DU 130, RU 140, and near-RT RIC 125. In some specific implementations, the SMO framework 105 may communicate with hardware aspects of the 4G RAN (such as an open eNB (O-eNB) 111) via the O1 interface. Additionally, in some specific implementations, the SMO framework 105 may communicate directly with one or more RUs 140 via the O1 interface. The SMO framework 105 may also include a non-RT RIC 115 configured to support the functionality of the SMO framework 105 .

[0040] The non-RT RIC 115 may be configured to include logic functions that enable non-real-time control and optimization of RAN elements and resources, artificial intelligence (AI) / machine learning (ML) (AI / ML) workflows including model training and updating, or policy-based guidance of applications / features in the near-RT RIC 125. The non-RT RIC 115 may be coupled to or communicate with the near-RT RIC 125 (such as via an A1 interface). The near-RT RIC 125 may be configured to include logic functions that enable near-real-time control and optimization of RAN elements and resources via data collection and actions through an interface (such as via an E2 interface) that connects one or more CUs 110, one or more DUs 130, or both, and the O-eNB with the near-RT RIC 125.

[0041] In some implementations, in order to generate an AI / ML model to be deployed in the near-RT RIC 125, the non-RT RIC 115 may receive parameters or external enrichment information from an external server. Such information may be utilized by the near-RT RIC 125 and may be received from a non-network data source or from a network function at the SMO framework 105 or the non-RT RIC 115. In some examples, the non-RT RIC 115 or the near-RT RIC 125 may be configured to tune RAN behavior or performance. For example, the non-RT RIC 115 may monitor long-term trends and patterns of performance and employ AI / ML models to perform corrective actions through the SMO framework 105 (such as via reconfiguration of O1) or via the creation of RAN management policies (such as A1 policies).

[0042] At least one of the CU 110, the DU 130, and the RU 140 may be referred to as a base station 102. Therefore, the base station 102 may include one or more of the CU 110, the DU 130, and the RU 140 (each component is indicated by a dotted line to indicate that each component may be included in the base station 102 or may not be included in the base station). The base station 102 provides an access point to the core network 120 for the UE 104. The base station 102 may include a macro cell (a high-power cellular base station) and / or a small cell (a low-power cellular base station). Small cells include femto cells, pico cells, and micro cells. A network including both small cells and macro cells may be referred to as a heterogeneous network. A heterogeneous network may also include a home evolved Node B (eNB) (HeNB), which may provide services to a restricted group referred to as a closed subscriber group (CSG). The communication link between RU 140 and UE 104 may include uplink (UL) (also known as reverse link) transmission from UE 104 to RU 140 and / or downlink (DL) (also known as forward link) transmission from RU 140 to UE 104. The communication link may use multiple-input multiple-output (MIMO) antenna technology, including spatial multiplexing, beamforming and / or transmission diversity. The communication link may be through one or more carriers. For each carrier allocated in a carrier aggregation of up to Yx MHz (x component carriers) for transmission in each direction, the base station 102 / UE 104 may use a spectrum of up to Y MHz (e.g., 5MHz, 10MHz, 15MHz, 20MHz, 100MHz, 400MHz, etc.) bandwidth. The carriers may or may not be adjacent to each other. The allocation of carriers may be asymmetric with respect to DL and UL (e.g., more or fewer carriers may be allocated for DL ​​compared to UL). The component carrier may include a primary component carrier and one or more secondary component carriers. The primary component carrier may be referred to as a primary cell (PCell) and the secondary component carrier may be referred to as a secondary cell (SCell).

[0043] Some UEs 104 may communicate with each other using a device-to-device (D2D) communication link 158. The D2D communication link 158 may use DL / UL wireless wide area network (WWAN) spectrum. The D2D communication link 158 may use one or more sidelink channels, such as a physical sidelink broadcast channel (PSBCH), a physical sidelink discovery channel (PSDCH), a physical sidelink shared channel (PSSCH), and a physical sidelink control channel (PSCCH). The D2D communication may be through a variety of wireless D2D communication systems, such as, for example, Bluetooth, Wi-Fi based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard, LTE, or NR.

[0044] The wireless communication system may also include a Wi-Fi AP 150 that communicates with a UE 104 (also referred to as a Wi-Fi station (STA)) via a communication link 154, for example, in a 5 GHz unlicensed spectrum, etc. When communicating in an unlicensed spectrum, the UE 104 / AP 150 may perform a clear channel assessment (CCA) to determine whether a channel is available prior to communication.

[0045] The electromagnetic spectrum is typically subdivided into various categories, bands, channels, etc. based on frequency / wavelength. In 5GNR, two initial operating bands have been identified as frequency range designations FR1 (410 MHz–7.125 GHz) and FR2 (24.25 GHz–52.6 GHz). Although a portion of FR1 is greater than 6 GHz, FR1 is often (interchangeably) referred to as the “below 6 GHz” band in various documents and articles. A similar naming issue sometimes occurs with respect to FR2, which is often (interchangeably) referred to as the “millimeter wave” band in documents and articles, although it is different from the extremely high frequency (EHF) band (30 GHz–300 GHz) identified as the “millimeter wave” band by the International Telecommunication Union (ITU).

[0046] Frequencies between FR1 and FR2 are generally referred to as mid-band frequencies. Recent 5G NR research has identified the operating bands for these mid-band frequencies as frequency range designation FR3 (7.125GHz–24.25GHz). The bands falling within FR3 can inherit FR1 characteristics and / or FR2 characteristics, and thus the features of FR1 and / or FR2 can be effectively extended to mid-band frequencies. In addition, higher frequency bands are currently being explored to extend 5G NR operations to more than 52.6GHz. For example, three higher operating bands have been identified as frequency range designations FR2-2 (52.6GHz-71GHz), FR4 (71GHz-114.25GHz), and FR5 (114.25GHz-300GHz). Each of these higher frequency bands falls within the EHF band.

[0047] In view of the above, unless otherwise specifically stated, if the term "below 6 GHz" or the like is used in this document, it may broadly refer to frequencies that may be less than 6 GHz, may be within FR1, or may include mid-band frequencies. In addition, unless otherwise specifically stated, if the term "millimeter wave" or the like is used in this document, it may broadly refer to frequencies that may include mid-band frequencies, may be within FR2, FR4, FR2-2, and / or FR5, or may be within the EHF band.

[0048] The base station 102 and the UE 104 may each include multiple antennas (such as antenna elements, antenna panels, and / or antenna arrays) to facilitate beamforming. The base station 102 may send a beamformed signal 182 to the UE 104 in one or more transmit directions. The UE 104 may receive the beamformed signal from the base station 102 in one or more receive directions. The UE 104 may also send a beamformed signal 184 to the base station 102 in one or more transmit directions. The base station 102 may receive the beamformed signal from the UE 104 in one or more receive directions. The base station 102 / UE 104 may perform beam training to determine the best receive direction and transmit direction for each of the base station 102 / UE 104. The transmit direction and receive direction of the base station 102 may be the same or different. The transmit direction and receive direction of the UE 104 may be the same or different.

[0049] The base station 102 may include and / or be referred to as a gNB, a Node B, an eNB, an access point, a base transceiver station, a radio base station, a radio transceiver, a transceiver function, a basic service set (BSS), an extended service set (ESS), a transmit receive point (TRP), a network node, a network entity, a network equipment, or some other suitable term. The base station 102 may be implemented as an integrated access and backhaul (IAB) node, a relay node, a sidelink node, an aggregated (monolithic) base station with a baseband unit (BBU) (including a CU and a DU) and a RU, or as a decomposed base station including one or more of a CU, a DU, and / or a RU. A set of base stations that may include decomposed base stations and / or aggregated base stations may be referred to as a next generation (NG) RAN (NG-RAN).

[0050] The core network 120 may include an access and mobility management function (AMF) 161, a session management function (SMF) 162, a user plane function (UPF) 163, a unified data management (UDM) 164, one or more location servers 168, and other functional entities. AMF 161 is a control node that handles signaling between UE 104 and the core network 120. AMF 161 supports registration management, connection management, mobility management, and other functions. SMF 162 supports session management and other functions. UPF 163 supports packet routing, packet forwarding, and other functions. UDM 164 supports the generation of authentication and key agreement (AKA) credentials, user identity handling, access authorization, and subscription management. One or more location servers 168 are illustrated as including a gateway mobile location center (GMLC) 165 and a location management function (LMF) 166. However, in general, the one or more location servers 168 may include one or more location / positioning servers, which may include one or more of the GMLC 165, the LMF 166, the position determination entity (PDE), the serving mobile location center (SMLC), the mobile positioning center (MPC), etc. The GMLC 165 and the LMF 166 support UE location services. The GMLC 165 provides an interface for clients / applications (e.g., emergency services) to access UE positioning information. The LMF 166 receives measurement results and assistance information from the NG-RAN and the UE 104 via the AMF 161 to calculate the location of the UE 104. The NG-RAN may determine the location of the UE 104 using one or more positioning methods. Positioning the UE 104 may involve signal measurements, position estimation, and optional speed calculations based on these measurements. Signal measurements may be performed by the UE 104 and / or the serving base station 102. The measured signals may be based on a satellite positioning system (SPS) 170 (e.g., one or more of a global navigation satellite system (GNSS), a global positioning system (GPS), a non-terrestrial network (NTN), or other satellite positioning / positioning systems), LTE signals, wireless local area network (WLAN) signals, Bluetooth signals, a terrestrial beacon system (TBS), sensor-based information (e.g., an atmospheric pressure sensor, a motion sensor), an NR enhanced cell ID (NR E-CID) method, NR signals (e.g., multi-round trip time (multi-RTT), DL angle of departure (DL-AoD), DL time difference of arrival (DL-TDOA), UL time difference of arrival (UL-TDOA), and UL angle of arrival (UL-AoA) positioning), and / or one or more of other systems / signals / sensors.

[0051] Examples of UE 104 include cellular phones, smart phones, session initiation protocol (SIP) phones, laptops, personal digital assistants (PDAs), satellite radios, global positioning systems, multimedia devices, video devices, digital audio players (e.g., MP3 players), cameras, game consoles, tablet computers, smart devices, wearable devices, vehicles, electric meters, gas pumps, large or small kitchen appliances, healthcare equipment, implants, sensors / actuators, displays, or any other similarly functional devices. Some of the UEs 104 may be referred to as IoT devices (e.g., parking meters, gas pumps, toasters, vehicles, heart monitors, etc.). UE 104 may also be referred to as stations, mobile stations, subscriber stations, mobile units, subscriber units, wireless units, remote units, mobile devices, wireless devices, wireless communication devices, remote devices, mobile subscriber stations, access terminals, mobile terminals, wireless terminals, remote terminals, mobile phones, user agents, mobile clients, clients, or some other suitable terminology. In some scenarios, the term UE may also be applied to one or more supporting devices, such as in a device constellation arrangement. One or more of these devices may access the network collectively and / or individually.

[0052] Reference again Figure 1 In some aspects, the base station 102 may include a security component 199 that may be configured to identify at least one hostile device. The security component 199 may be configured to send a fake configuration to the at least one hostile device. The fake configuration may be associated with a PHY technology. Although the following description may focus on 5G NR, the concepts described herein may be applicable to other similar fields, such as LTE, LTE-A, CDMA, GSM, and other wireless technologies.

[0053] Figure 2A FIG200 is a diagram illustrating an example of a first subframe within a 5G NR frame structure. Figure 2B is a diagram 230 illustrating an example of DL channels within a 5G NR subframe. Figure 2C 250 is a diagram illustrating an example of a second subframe within a 5G NR frame structure. Figure 2D FIG280 is a diagram illustrating an example of UL channels within a 5G NR subframe. The 5G NR frame structure may be frequency division duplex (FDD) (wherein for a particular set of subcarriers (carrier system bandwidth), subframes within that subcarrier set are dedicated to either DL or UL), or may be time division duplex (TDD) (wherein for a particular set of subcarriers (carrier system bandwidth), subframes within that subcarrier set are dedicated to both DL and UL). Figure 2A , Figure 2CIn the example provided, the 5G NR frame structure is assumed to be TDD, where subframe 4 is configured with slot format 28 (most of which are DL), where D is DL, U is UL, and F is flexible between DL / UL, and subframe 3 is configured with slot format 1 (all of which are UL). Although subframes 3 and 4 are shown as having slot formats 1 and 28, respectively, any particular subframe may be configured with any of the various available slot formats 0 to 61. Slot formats 0 and 1 are both DL and both UL, respectively. Other slot formats 2-61 include a mix of DL, UL, and flexible symbols. The slot format is configured for the UE via a received slot format indicator (SFI) (dynamically configured via DL control information (DCI) or semi-statically / statically configured via radio resource control (RRC) signaling). Note that the following description also applies to the 5G NR frame structure as TDD.

[0054] FIG. 2A to FIG. 2D The frame structure is illustrated, and various aspects of the present disclosure are applicable to other wireless communication technologies that may have different frame structures and / or different channels. A frame (10ms) may be divided into 10 subframes (1ms) of the same size. Each subframe may include one or more time slots. A subframe may also include a microslot, which may include 7, 4, or 2 symbols. Each time slot may include 14 or 12 symbols, depending on whether the cyclic prefix (CP) is conventional or extended. For conventional CP, each time slot may include 14 symbols, and for extended CP, each time slot may include 12 symbols. The symbol on the DL may be a CP orthogonal frequency division multiplexing (OFDM) (CP-OFDM) symbol. The symbol on the UL may be a CP-OFDM symbol (for high throughput scenarios) or a discrete Fourier transform (DFT) spread OFDM (DFT-s-OFDM) symbol (also known as a single carrier frequency division multiple access (SC-FDMA) symbol) (for power-limited scenarios; limited to single-stream transmission). The number of time slots within a subframe is based on the CP and parameter set. The parameter set defines the subcarrier spacing (SCS) and effectively defines the symbol length / duration, which is equal to 1 / SCS.

[0055]

[0056] Table 1. Parameter sets, SCS and CP

[0057] For normal CP (14 symbols / slot), different parameter sets μ0 to 4 allow 1, 2, 4, 8, and 16 slots per subframe, respectively. For extended CP, parameter set 2 allows 4 slots per subframe. Accordingly, for normal CP and parameter set μ, there are 14 symbols / slot and 2 μ timeslots / subframe. The subcarrier spacing can be equal to 2 μ*15kHz, where μ is parameter set 0 to 4. Therefore, the subcarrier spacing for parameter set μ=0 is 15kHz, and the subcarrier spacing for parameter set μ=4 is 240kHz. The symbol length / duration is inversely related to the subcarrier spacing. FIG. 2A to FIG. 2D An example of a parameter set μ=2 with a normal CP of 14 symbols per slot and 4 slots per subframe is provided. The slot duration is 0.25 ms, the subcarrier spacing is 60 kHz, and the symbol duration is about 16.67 μs. Within a frame set, there may be one or more different bandwidth parts (BWPs) that are frequency-division multiplexed (see Figure 2B ). Each BWP can have a specific parameter set and CP (normal or extended).

[0058] A resource grid may be used to represent a frame structure. Each slot includes a resource block (RB) (also referred to as a physical RB (PRB)) extending over 12 consecutive subcarriers. The resource grid is divided into a plurality of resource elements (REs). The number of bits carried by each RE depends on the modulation scheme.

[0059] like Figure 2A As illustrated, some of the REs carry reference (pilot) signals (RS) for the UE. The RS may include a demodulation RS (DM-RS) (indicated as R for a particular configuration, but other DM-RS configurations are possible) and a channel state information reference signal (CSI-RS) for channel estimation at the UE. The RS may also include a beam measurement RS (BRS), a beam refinement RS (BRRS), and a phase tracking RS (PT-RS).

[0060] Figure 2BExamples of various DL channels within a subframe of a frame are illustrated. A physical downlink control channel (PDCCH) carries DCI within one or more control channel elements (CCEs) (e.g., 1, 2, 4, 8, or 16 CCEs), each CCE including six RE groups (REGs), each REG including 12 consecutive REs in an OFDM symbol of an RB. A PDCCH within a BWP may be referred to as a control resource set (CORESET). The UE is configured to monitor PDCCH candidates in a PDCCH search space (e.g., a common search space, a UE-specific search space) during a PDCCH monitoring opportunity on a CORESET, wherein the PDCCH candidates have different DCI formats and different aggregation levels. Additional BWPs may be located at higher and / or lower frequencies on the channel bandwidth. A primary synchronization signal (PSS) may be within symbol 2 of a particular subframe of a frame. The PSS is used by UE 104 to determine subframe / symbol timing and physical layer identification. A secondary synchronization signal (SSS) may be within symbol 4 of a particular subframe of a frame. The SSS is used by the UE to determine the physical layer cell identity group number and the radio frame timing. Based on the physical layer identity and the physical layer cell identity group number, the UE can determine the physical cell identifier (PCI). Based on the PCI, the UE can determine the location of the DM-RS. The physical broadcast channel (PBCH) carrying the master information block (MIB) can be logically grouped with the PSS and SSS to form a synchronization signal (SS) / PBCH block (also referred to as an SS block (SSB)). The MIB provides the system bandwidth and the number of RBs in the system frame number (SFN). The physical downlink shared channel (PDSCH) carries user data, broadcast system information such as system information blocks (SIBs) that are not sent via the PBCH, and paging messages.

[0061] like Figure 2C As illustrated, some of the REs carry DM-RS (indicated as R for a particular configuration, but other DM-RS configurations are possible) for channel estimation at the base station. The UE may send DM-RS for a physical uplink control channel (PUCCH) and DM-RS for a physical uplink shared channel (PUSCH). The PUSCH DM-RS may be sent in the first or first two symbols of the PUSCH. Depending on whether a short PUCCH or a long PUCCH is sent and depending on the specific PUCCH format used, the PUCCH DM-RS may be sent in different configurations. The UE may send a sounding reference signal (SRS). The SRS may be sent in the last symbol of a subframe. The SRS may have a comb structure, and the UE may send the SRS on one of the teeth of the comb. The SRS may be used by the base station for channel quality estimation to achieve frequency-dependent scheduling of the UL.

[0062] Figure 2DExamples of various UL channels within a subframe of a frame are illustrated. The PUCCH may be located at a position as indicated in one configuration. The PUCCH carries uplink control information (UCI), such as scheduling requests, channel quality indicators (CQI), precoding matrix indicators (PMI), rank indicators (RI), and hybrid automatic repeat request (HARQ) acknowledgement (ACK) (HARQ-ACK) feedback (i.e., one or more HARQ ACK bits indicating one or more ACKs and / or negative ACKs (NACKs)). The PUSCH carries data and may additionally be used to carry a buffer status report (BSR), a power headroom report (PHR), and / or UCI.

[0063] Figure 3 370 is a block diagram of a base station 310 in an access network communicating with a UE 350. In the DL, Internet Protocol (IP) packets may be provided to a controller / processor 375. The controller / processor 375 implements layer 3 and layer 2 functionality. Layer 3 includes a radio resource control (RRC) layer, and layer 2 includes a service data adaptation protocol (SDAP) layer, a packet data convergence protocol (PDCP) layer, a radio link control (RLC) layer, and a medium access control (MAC) layer. The controller / processor 375 provides RRC layer functionality associated with broadcasting of system information (e.g., MIB, SIB), RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-radio access technology (RAT) mobility, and measurement configuration for UE measurement reporting; PDCP layer functionality associated with header compression / decompression, security (encryption, decryption, integrity protection, integrity verification), and handover support functions; RLC layer functionality associated with delivery of upper layer packet data units (PDUs), error correction through ARQ, concatenation, segmentation and reassembly of RLC service data units (SDUs), re-segmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto transport blocks (TBs), demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority handling, and logical channel prioritization.

[0064] The transmit (TX) processor 316 and receive (RX) processor 370 implement layer 1 functionality associated with various signal processing functions. Layer 1 (which includes the physical (PHY) layer (PHY)) may include error detection on the transmission channel, forward error correction (FEC) decoding / decoding of the transmission channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. The TX processor 316 handles the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-order phase shift keying (M-PSK), M-order quadrature amplitude modulation (M-QAM)). The decoded and modulated symbols can then be divided into parallel streams. Subsequently, each stream can be mapped to an OFDM subcarrier, multiplexed with a reference signal (e.g., a pilot) in the time domain and / or frequency domain, and then combined using an inverse fast Fourier transform (IFFT) to produce a physical channel carrying a time domain OFDM symbol stream. The OFDM stream is spatially pre-coded to generate multiple spatial streams. Channel estimates from a channel estimator 374 may be used to determine the coding and modulation schemes, as well as for spatial processing. Channel estimates may be derived from reference signals and / or channel state feedback sent by the UE 350. Each spatial stream may then be provided to a different antenna 320 via a separate transmitter 318Tx. Each transmitter 318Tx may modulate a radio frequency (RF) carrier with a corresponding spatial stream for transmission.

[0065] At the UE 350, each receiver 354Rx receives a signal through its corresponding antenna 352. Each receiver 354Rx recovers the information modulated onto the RF carrier and provides the information to a receive (RX) processor 356. The TX processor 368 and the RX processor 356 implement layer 1 functionality associated with various signal processing functions. The RX processor 356 can perform spatial processing on the information to recover any spatial streams destined for the UE 350. If multiple spatial streams are destined for the UE 350, they can be merged into a single OFDM symbol stream by the RX processor 356. The RX processor 356 then converts the OFDM symbol stream from the time domain to the frequency domain using a fast Fourier transform (FFT). The frequency domain signal includes a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols on each subcarrier and the reference signal are recovered and demodulated by determining the most likely signal constellation point sent by the base station 310. These soft decisions can be based on channel estimates calculated by the channel estimator 358. The soft decisions are then decoded and deinterleaved to recover the data and control signals originally sent on the physical channel by the base station 310. The data and control signals are then provided to the controller / processor 359, which implements layer 3 and layer 2 functionality.

[0066] The controller / processor 359 may be associated with a memory 360 that stores program codes and data. The memory 360 may be referred to as a computer readable medium. In the UL, the controller / processor 359 provides demultiplexing between transport channels and logical channels, packet reassembly, decryption, header decompression, and control signal processing to recover IP packets. The controller / processor 359 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operations.

[0067] Similar to the functions described in conjunction with DL transmissions performed by the base station 310, the controller / processor 359 provides RRC layer functionality associated with system information (e.g., MIB, SIB) acquisition, RRC connection, and measurement reporting; PDCP layer functionality associated with header compression / decompression and security (encryption, decryption, integrity protection, integrity verification); RLC layer functionality associated with delivery of upper layer PDUs, error correction through ARQ, concatenation, segmentation and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto TBs, demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority handling, and logical channel prioritization.

[0068] The TX processor 368 may use channel estimates derived by the channel estimator 358 from a reference signal or feedback sent by the base station 310 to select the appropriate coding and modulation schemes and to facilitate spatial processing. The spatial streams generated by the TX processor 368 may be provided to different antennas 352 via separate transmitters 354Tx. Each transmitter 354Tx may modulate an RF carrier with a corresponding spatial stream for transmission.

[0069] UL transmissions are processed at the base station 310 in a manner similar to that described in conjunction with the receiver functionality at the UE 350. Each receiver 318Rx receives a signal through its respective antenna 320. Each receiver 318Rx recovers information modulated onto an RF carrier and provides the information to the RX processor 370.

[0070] The controller / processor 375 may be associated with a memory 376 that stores program codes and data. The memory 376 may be referred to as a computer readable medium. In the UL, the controller / processor 375 provides demultiplexing between transport channels and logical channels, packet reassembly, decryption, header decompression, control signal processing to recover IP packets. The controller / processor 375 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operations.

[0071] At least one of the TX processor 316, the RX processor 370, and the controller / processor 375 may be configured to combine Figure 1 The security component 199 performs various aspects.

[0072] Figure 4 4 is an example block diagram 400 illustrating adding artificial PHY impairments. Artificial PHY impairments (e.g., amplitude modulation to phase modulation (AMPM) impairments or frequency domain residual sideband (FDRSB) impairments) may be a PHY technique, as described below. For example, artificial PHY impairments may be used as a signature, both for verifying the identity of the transmitter and for encrypting the transmission. A receiver may receive an indication of the PHY impairment from the transmitter. Based on the indication, the receiver may confirm that a transmission with a PHY impairment consistent with the indication was sent by the transmitter. In addition, the receiver may recover the content of the transmission by removing the PHY impairment based on the indication. Adding artificial PHY impairments in the oversampled domain (e.g., the output of the digital front end (DFE) block 408, also referred to as the digital-to-analog converter (DAC) input) may introduce out-of-band leakage, which may result in violating the adjacent channel leakage ratio (ACLR) specification. Therefore, artificial PHY impairments may be added in the baseband domain at block 404 between the IFFT block 402 (the output of the baseband frequency domain processing 401 becomes the input to the IFFT block 402) and the DFE block 408.

[0073] Because artificial PHY impairments are introduced into the baseband domain, all impairments may be folded into the band, which may be associated with a cost in terms of error vector magnitude (EVM). In addition, the added artificial PHY impairments may be removed at the receiver. However, due to other impairments (e.g., thermal noise, channel noise, etc.), the removal of artificial PHY impairments at the receiver may not be perfect. In one or more configurations, if artificial PHY impairments are also added to at least one data portion of a downlink service (e.g., PDSCH and / or PDCCH), a digital post-distortion (DPoD) technique (which may be applied iteratively) may be utilized to improve (e.g., reduce) the EVM associated with at least one data portion of the downlink service.

[0074] In some configurations, a configuration describing (in whole or in part) the parameters of a particular PHY technique (e.g., a technique in a PHY intended for security, reliability, etc.) may be shared by a transmitter with a receiver in advance (i.e., before the PHY technique is actually implemented in future operations). The use of reference signals in the PHY to transmit (share) configurations may be associated with the benefit of having shorter response times due to the fast propagation characteristics in the PHY. In some configurations, the transmission of configurations from a legitimate transmitter may be protected directly in the PHY so that any hostile device (e.g., any unauthorized device with radio capabilities) attempting to steal information from the reference signals cannot learn of the configuration. Furthermore, the transmission of configurations from a legitimate transmitter may be credible because no device other than the legitimate transmitter can transmit and share the configuration.

[0075] With existing passive methods, a legitimate sender may not actively attempt to compromise any hostile device, even though the hostile device may have exposed its malicious nature to the sender or the network.

[0076] According to one or more aspects of the present disclosure, a legitimate transmitter (e.g., a network node such as a base station) can actively seek to compromise a hostile device by sending a forged configuration (e.g., a configuration that includes, in whole or in part, PHY technology parameters that are intentionally designed to be incorrect) to the hostile device, while continuing to securely share a correct configuration (e.g., a configuration that includes correct parameters for the PHY technology) in parallel with a legitimate receiver (e.g., a legitimate UE). In some configurations, the transmitter can send the forged configuration to the hostile device in a directional manner in the event that the legitimate transmitter or the network has detected the location of the hostile device. For example, directional transmission of the forged configuration may be suitable for scenarios where the transmitter may be equipped with multiple antennas and a sufficient number of RF chains.

[0077] In some other configurations, a legitimate transmitter can send a forged configuration in a broadcast manner (i.e., the transmission may not be associated with any particular direction), where the forged / false configuration may be intended for use against an adversary device that has not provided valid credentials (e.g., an adversary device that may not possess any valid credentials). For example, the broadcast transmission of the forged configuration may not use location information of the adversary device and may be suitable for scenarios where the transmitter may be equipped with a single antenna (e.g., the transmitter may be a low-cost device).

[0078] Figure 5is a diagram illustrating an example process 500 of sending a fake configuration to a hostile device in a directional manner. As shown, the (legitimate) transmitter 502 can be a transmitter equipped with multiple RF chains and multiple antennas 508. Therefore, the transmitter 502 can send signals in a directional manner (e.g., via beamforming). In some configurations, the transmitter 502 can send a fake configuration 510 directly to the hostile device 504 in a directional manner to impair subsequent algorithmic operations at the hostile device 504. For example, based on the fake configuration 510, the hostile device 504 may attempt to perform algorithmic operations to implement PHY technology. However, due to the fake nature of the fake configuration 510, the time and power consumed by the hostile device 504 in performing the algorithmic operations may be equivalent to a complete waste.

[0079] Specifically, a network (e.g., a RAN or core network) associated with transmitter 502 may gather information about hostile device 504. Information about hostile device 504 may be reported to the network by various legitimate devices (such as transmitters and / or receivers) (e.g., a legitimate device may have been attacked by hostile device 504). In addition, the information about hostile device 504 reported by each legitimate device may include, for example, one or more of a time slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a direction of arrival (DOA) of a signal, a reference signal received power (RSRP), or a received signal strength indicator (RSSI). Thus, the network may obtain the location of hostile device 504 (e.g., using triangulation, trilateration, etc.) with potential assistance from one or more of the legitimate devices.

[0080] The network may then inform legitimate transmitters within the communication range of adversary device 504 at least about the location of adversary device 504. Transmitter 502 may be one of the legitimate transmitters within the communication range of adversary device 504.

[0081] Upon receiving an indication of the location of the adversary device 504, in some configurations, each time the transmitter 502 prepares a correct configuration (e.g., correct configuration 512) for a legitimate receiver (e.g., a legitimate receiver 506, which may be a legitimate UE), the transmitter 502 may prepare a new fake configuration (e.g., fake configuration 510). Thereafter, based on the location of the adversary device 504, the transmitter 502 may send the fake configuration 510 directly to the adversary device 504 in a directional manner (e.g., using beamforming).

[0082] In some configurations, if the transmitter 502 has a sufficient number of RF chains, the transmitter 502 may dedicate one or more of these RF chains to the transmission of the counterfeit configuration 510, while using the remaining RF chains to transmit the correct configuration 512 in parallel (e.g., simultaneously) to a legitimate receiver (e.g., the legitimate receiver 506).

[0083] In some configurations, the transmitter 502 can dedicate all RF chains at once to transmission toward the same receiver (e.g., the transmitter 502 can have a single RF chain). Therefore, the transmitter 502 can send the fake configuration 510 and the correct configuration 512 to their respective intended directions in a time division multiplexed manner. For example, the transmitter 502 can send the fake configuration 512 and the correct configuration 510 to their respective intended directions using a time division pattern (e.g., a specific time slot among the n time slots for the correct configuration 510, and the remaining time slots for the fake configuration 512). In some configurations, the transmitter 502 can share the time division pattern with the legitimate receiver on layer 3 (L3) (e.g., securely shared using encryption techniques).

[0084] In some configurations, the transmitter 502 can transmit the counterfeit configuration 510 and the correct configuration 512 to their respective intended directions in a frequency division multiplexing manner.

[0085] Figure 6 608a and 608b, the transmitter 602 may broadcast a random signal to initialize the process. Any receiver (legal or illegal), including the hostile device 604 and the legal receiver 606, may respond to the broadcast random initialization signal and request configuration. Some receivers may send their own credentials to the transmitter 602 for verification.

[0086] In some configurations, the transmitter 602 may share a correct configuration with an authenticated receiver (e.g., a legitimate receiver 606, which may be a legitimate UE) that has provided valid credentials, and may send a forged configuration (rather than sending nothing) to any hostile receiver (e.g., hostile device 604) that fails to provide any valid credentials (e.g., as a hostile device that may not possess any valid credentials).

[0087] exist Figure 6 In the process illustrated in , the transmitter 602 may not know the location of the adversary device 604 or the legitimate receiver 606. Therefore, sending a fake configuration to the adversary device in a broadcast manner may be suitable for scenarios where the transmitter 602 may be equipped with a small number of antennas (e.g., a single antenna) and may be able to perform omnidirectional configuration transmissions but not directional transmissions in multiple directions.

[0088] Figure 6The illustrated process may include a random initialization phase, which may include, for example, 608a and 608b, and a configuration request / response phase, which may include, for example, 612, 614, 618, and 620. Figure 6 The process illustrated in can be completed within the channel coherence time (ie, the channel remains (approximately) the same duration) because, as will be described in further detail below, PHY security transmission can rely on channel reciprocity.

[0089] The transmitter 602 may perform a random initialization phase at 608a and 608b. Specifically, the transmitter 602 may broadcast a random initialization signal ψ that may carry a random phase. The random initialization signal may be received by the hostile device 604 and the legitimate receiver 606. In one or more configurations, the transmitter 602 may know the random phase ψ, but other devices may not know it.

[0090] To prevent any hostile device from recording the configuration requests and / or responses of a legitimate receiver and reusing the recorded information in the future to spoof the transmitter 602, i.e., to prevent replay attacks, the transmitter 602 may select or generate a new phase random value ψ each time the transmitter 602 broadcasts a new initialization signal.

[0091] The purpose of random initialization may be to provide a phase reference to any receiver. The random initialization signal may be affected by the unique channel between the transmitter 602 and a particular receiver. Based on the received random initialization signal that may include a phase reference, the receiver of the random initialization signal may be able to securely share the receiver's credentials by transmitting based on phase difference while requesting configuration from the transmitter 602.

[0092] The configuration request and response phase for any receiver (e.g., hostile device 604 or legitimate receiver 606) can be described as follows. In the following description, Figure 6 The superscript r in can represent either superscript u (for legitimate receivers) or superscript a (for adversaries).

[0093] After the transmitter 602 broadcasts the random initialization signal at 608a and 608b, the channel phase response at any receiver may become λ r =ψ+ω g→r , where ω g→r The phase rotation may be caused by the RF front end (at both the transmit and receive ends) and the signal propagation over the channel. The receiver may measure the received phase-rotated random initialization signal as

[0094] Based on the measured The receiver may prepare a configuration request. The configuration request may carry the receiver's credentials. Accordingly, the configuration request may include a phase value where β r is the phase modulation credentials of the receiver. For example, a legitimate receiver 606 may have valid credentials 610. In addition, a hostile device 604 may have invalid credentials 616 or no credentials at all. In other words, the hostile device 604 may not possess any valid credentials. Next, at 612 for the legitimate receiver 606 and at 618 for the hostile device 604, the receiver may transmit a configuration request to the transmitter 602.

[0095] Even if an arbitrary receiver (e.g., an eavesdropper) can measure But an eavesdropper may not learn the phase β r , because the eavesdropper may not know In other words, the credentials can be Transmitted in a PHY-safe manner.

[0096] The phase of the configuration request 612 / 618 received at the transmitter 602 may be Due to the channel reciprocity (i.e., ω r→g ≈ω g→r )as well as The fact that it can be (roughly) equated to β r Therefore, the phase of the received configuration request 612 / 618 can be measured by the transmitter 602 as Therefore, the phase β r The representation credential may become readily available to the sender 602, since the sender 602 already knows the initial random phase ψ.

[0097] The transmitter 602 may then perform a validation test (eg, a hypothesis test based on distribution, a similarity test based on Hamming distance, etc.) to determine whether the β r Indicates whether the received credentials are valid. Based on whether the credentials are valid, the sender 602 can prepare a configuration response.

[0098] If the credentials are valid (e.g., valid credentials 610 possessed by legitimate receiver 606 and conveyed in configuration request 612) and the verification is successful, transmitter 602 may prepare the correct configuration, which may be determined by the phase modulation parameter φ u On the other hand, if the credentials are invalid (e.g., invalid credentials 616 possessed by adversary device 604 and conveyed in configuration request 618, or no credentials at all, since adversary device 604 may not possess any valid credentials) and the verification fails, transmitter 602 may prepare a forged / false configuration, which may be represented by phase modulation parameter φ a express.

[0099] In some configurations, a valid credential may be associated with a lifespan, which may correspond to a predefined amount of time. The lifespan of a credential may be set by the network based on an attack scenario.

[0100] Based on the (correct or forged / false) configuration, the sender 602 may construct a configuration response as in can be the measured channel phase from a previous run, and φ r It can be configured (for the legal receiver 606 is φ u , or φ for hostile device 604 a ). Thereafter, at 614 for the legitimate receiver 606 and at 620 for the adversary device 604, the transmitter 602 may send the configuration response Sent back to a receiver (eg, legitimate receiver 606 or adversary device 604).

[0101] Even if the phase is measured by an arbitrary receiver (e.g., an eavesdropper) But the eavesdropper may not learn the phase φ r , because the eavesdropper may not know In other words, confidential configuration can be obtained through Transmitted in a PHY-safe manner.

[0102] The corresponding phases of the configuration response 614 / 620 at the receiver (eg, legitimate receiver 606 or adversary device 604) may become Due to channel reciprocity (i.e., ωr→g≈ω g→r )as well as The fact that Then, the residual phase The estimate of may be utilized by a receiver (e.g., legitimate receiver 606 or adversarial device 604) to r Learn about the configuration because May already be available to the receiver (for a receiver constructed previously by a configuration request ).

[0103] A receiver (eg, legitimate receiver 606 or adversary device 604) may not be able to inspect the received configuration φ r Is it a correct configuration or a forged / false configuration. Therefore, the hostile device 604 (which does not provide any valid credentials) may be forged / falsely configured a cheat.

[0104] In some configurations, the phase parameter β r and φ rThe length of can be multiple bits. Accordingly, multiple tones can be used in the frequency domain to send the phase parameter β in the configuration request 612 / 618 and the configuration response 614 / 620, respectively. r and φ r In some other configurations, a single tone may be used in the frequency domain to transmit the phase parameter β r and φ r Any one of .

[0105] In some configurations, the transmitter 602 may include (e.g., append) a cyclic redundancy check (CRC) in the phase parameter φ (e.g., using frequency domain resource blocks) to enable a receiver (e.g., a legitimate receiver 606) to verify the accuracy of the received phase φ and, therefore, the configuration. If the receiver identifies the received phase φ as inaccurate based on the CRC, the receiver may send a negative acknowledgement (NACK) to the transmitter 602. Thus, in some configurations, if the transmitter 602 does not receive a NACK (e.g., within a time window after the transmission), the transmitter 602 may assume that the receiver has correctly learned the configuration.

[0106] If the transmitter 602 receives a NACK, in one configuration, the transmitter 602 may follow the same process as described above to attempt to re-share the configuration. In another configuration, if the transmitter 602 receives a NACK, the transmitter 602 may suspend the configuration transmission process for a pre-configured time period. In some configurations, if the suspension time period is longer than the verification lifetime or channel coherence time selected by the network, the verification process may also be repeated before resuming the configuration transmission.

[0107] Due to channel reciprocity and phase estimation imperfections, β r -ψ and may be inaccurate / erroneous. Accordingly, in some configurations, a transmit-receive pair (e.g., a transmitter 602-legal receiver 606 pair) may (e.g., periodically, where the periodicity may be, for example, on the order of the channel coherence time Tc (e.g., every Tc, every 2×Tc, etc.)) exchange known phase parameters β and / or φ to measure and quantize the received value β r -ψ and expected value The error between (using ψ and Because ψ and are available to the respective relevant device / party).

[0108] In some configurations, the network may set (dynamically or statically) the β-link based on whether the data being sent is known to the receiver. r -ψ and In some configurations, the error threshold associated with β r -ψ and In some configurations, if for β r -ψ and If both error measures of Figure 6 On the other hand, if for β r -ψ and If at least one of the error measurements of β is below its corresponding threshold, the phase difference-based configuration sharing process may be suspended until the phase error is determined at least at the next measurement (e.g., with β r -ψ and / or associated error term).

[0109] Figure 7 700 is a diagram of a communication flow of a method of wireless communication. A network node 702, at least one adversary device 704, and at least one genuine receiving device 706 (e.g., an authorized receiver such as a network-authenticated UE) may correspond to a transmitter 502 / 602, an adversary device 504 / 604, and a legitimate receiver 506 / 606, respectively. At 708a and 708b, the network node 702 may send an initialization broadcast (e.g., a random initialization signal at 608a and 608b).

[0110] At 710 , network node 702 may receive a first configuration request from at least one adversarial device 704 .

[0111] At 712, network node 702 can identify that at least one adversary device 704 does not possess any valid credentials based on first configuration request 710 and verification test. For example, network node 702 can understand that device 704 is an adversary device because device 704 cannot respond at 710 with valid credentials.

[0112] In one or more configurations, the first validation test may include a distribution-based hypothesis test or a Hamming distance-based similarity test.

[0113] At 714 , network node 702 may identify at least one hostile device 704 .

[0114] At 716, the network node 702 may send a fake configuration to the at least one hostile device 704. The fake configuration may be associated with a PHY technology. In some configurations, the network node 702 may send a first configuration response to the at least one hostile device 704 including the fake configuration.

[0115] In one or more configurations, at 716 , a forged configuration can be sent to at least one adversarial device 704 based on a location of the at least one adversarial device 704 .

[0116] In one or more configurations, at 714, at least one adversarial device 704 may be identified based on the at least one adversarial device 704 not possessing any valid credentials.

[0117] In one or more configurations, the initialization broadcast 708a / 708b may include a random phase. The first configuration request 710 may include a first phase parameter. At 716, the first configuration response may include a fake configuration. At 716, the first configuration response may include a second phase parameter. In one or more configurations, the first phase parameter and the second phase parameter may each be associated with a plurality of tones. In one or more configurations, at 716, the first configuration request 710 and the first configuration response may be subject to reciprocal phase rotation in transmission (the physical channels associated with the first configuration request 710 and the first configuration response at 716 may be reciprocal, that is, the physical channels may be the same and the same phase rotation may be introduced to any signal propagating through them).

[0118] At 718 , the network node 702 may receive a second configuration request from the at least one real receiving device 706 .

[0119] At 720, the network node 702 may identify at least one genuine receiving device 706 as having valid credentials based on the second configuration request 718 and the verification test.

[0120] At 722, the network node 702 may send the correct configuration to the at least one real receiving device 706. In some configurations, the network node 702 may send a second configuration response to the at least one real receiving device 706 including the correct configuration.

[0121] In one or more configurations, the counterfeit configuration at 716 and the correct configuration at 722 may be transmitted in parallel via separate RF chains.

[0122] In one or more configurations, the fake configuration at 716 and the correct configuration at 722 may be sent based on time division multiplexing.

[0123] In one or more configurations, the second configuration response may further include a CRC.

[0124] In one or more configurations, the second configuration request 718 may include a third phase parameter. At 722, the second configuration response may include a fourth phase parameter. In one or more configurations, the third phase parameter and the fourth phase parameter may each be associated with a plurality of tones. In one or more configurations, at 722, the second configuration request 718 and the second configuration response may be subject to reciprocal phase rotation in transmission.

[0125] At 724, the network node 702 may receive a NACK from at least one real receiving device 706 based on the CRC.

[0126] At 726a , in response to the NACK, the network node 702 may resend a second configuration response to the at least one real receiving device 706 .

[0127] In some configurations, instead of 726a, at 726b, in response to the NACK, the network node 702 may refrain from sending a configuration response to the at least one real receiving device 706 for a predetermined period of time.

[0128] At 728 , the network node 702 may identify a phase error between the network node 702 and the at least one real receiving device 706 based on periodically exchanging one or more known phase parameters with the at least one real receiving device 706 .

[0129] At 730, the network node 702 may allow or suspend the configuration sharing process based on the comparison of the phase error to the threshold value.

[0130] Figure 8 800 is a flow chart of a method of wireless communication. The method may be performed by a base station or a network node (eg, base station 102 / 310; network node 702; network entity 1002). At 802, the network node may identify at least one hostile device. For example, 802 may be performed by Fig.11 Component 199 in the reference Figure 7 At 714 , the network node 702 may identify at least one hostile device 704 .

[0131] At 804, the network node may send a fake configuration to the at least one hostile device. The fake configuration may be associated with a PHY technology. For example, 804 may be performed by Fig.11 Component 199 in the reference Figure 7 At 716 , the network node 702 may send a forged configuration to at least one hostile device 704 .

[0132] Fig. 9 900 is a flow chart of a method of wireless communication. The method may be performed by a base station or a network node (eg, base station 102 / 310; network node 702; network entity 1002). At 906, the network node may identify at least one hostile device. For example, 906 may be performed by Fig.11 Component 199 in the reference Figure 7 At 714 , the network node 702 may identify at least one hostile device 704 .

[0133] At 908, the network node may send a fake configuration to the at least one hostile device. The fake configuration may be associated with a PHY technology. For example, 908 may be performed by Fig.11 Component 199 in the reference Figure 7 At 716 , the network node 702 may send a forged configuration to at least one hostile device 704 .

[0134] In one configuration, reference Figure 7 At 716 , a forged configuration may be sent to at least one hostile device 704 based on the location of the at least one hostile device 704 .

[0135] In one configuration, at 914a, the network node may send a correct configuration to at least one genuine receiving device. The correct configuration may be different from the forged configuration. For example, 914a may be Fig.11 Component 199 in the reference Figure 7 At 722 , the network node 702 may send the correct configuration to at least one real receiving device 706 .

[0136] In one configuration, the counterfeit configuration and the correct configuration may be sent in parallel via separate RF chains.

[0137] In one configuration, the fake configuration and the correct configuration may be sent based on time division multiplexing.

[0138] In one configuration, reference Figure 7 At 714, at least one adversarial device 704 may be identified based on at least one adversarial device 704 not possessing any valid credentials.

[0139] In one configuration, at 902, the network node may send an initialization broadcast. For example, 902 may be performed by Fig.11 Component 199 in the reference Figure 7 At 708a and 708b, the network node 702 may send an initialization broadcast.

[0140] At 904, the network node may receive a first configuration request from the at least one hostile device. For example, 904 may be performed by Fig.11 Component 199 in the reference Figure 7 At 710 , the network node 702 may receive a first configuration request from at least one hostile device 704 .

[0141] At 906a, the network node may identify that the at least one adversarial device does not possess any valid credentials based on the first configuration request and the first verification test. In some configurations, 906a may be a portion of 906. For example, 906a may be performed by Fig.11 Component 199 in the reference Figure 7At 712, the network node 702 may identify, based on the first configuration request 710 and the verification test, that the at least one adversarial device 704 does not possess any valid credentials.

[0142] In one configuration, at 910, the network node may receive a second configuration request from at least one real receiving device. For example, 910 may be performed by Fig.11 Component 199 in the reference Figure 7 At 718 , the network node 702 may receive a second configuration request from at least one real receiving device 706 .

[0143] At 912, the network node may identify that the at least one genuine receiving device has valid credentials based on the second configuration request and the second verification test. Fig.11 Component 199 in the reference Figure 7 At 720, the network node 702 may identify that the at least one genuine receiving device 706 has valid credentials based on the second configuration request 718 and the verification test.

[0144] At 914, the network node may send a second configuration response including the correct configuration to at least one real receiving device. Fig.11 Component 199 in the reference Figure 7 At 722, the network node 702 may send a second configuration response including a correct configuration to at least one real receiving device 706.

[0145] In one configuration, reference Figure 7 At 722, the second configuration response may also include a CRC.

[0146] In one configuration, at 916, the network node may receive a NACK from the at least one real receiving device based on the CRC. For example, 916 may be performed by Fig.11 Component 199 in the reference Figure 7 At 724, the network node 702 may receive a NACK from at least one real receiving device 706 based on the CRC.

[0147] In one configuration, at 918a, in response to the NACK, the network node may resend a second configuration response to at least one real receiving device. Fig.11 Component 199 in the reference Figure 7 At 726a, in response to the NACK, the network node 702 may resend a second configuration response to the at least one real receiving device 706.

[0148] In one configuration, instead of 918a (eg, when channel conditions are poor), at 918b, in response to the NACK, the network node may refrain from sending a configuration response to at least one real receiving device for a predetermined period of time. For example, 918b may be Fig.11 Component 199 in the reference Figure 7 At 726b, in response to the NACK, the network node 702 may refrain from sending a configuration response to the at least one real receiving device 706 for a predetermined period of time.

[0149] In one configuration, reference Figure 7 , the second configuration request 718 may include a third phase parameter. At 722, the second configuration response may include a fourth phase parameter.

[0150] In one configuration, the third phase parameter and the fourth phase parameter may each be associated with a plurality of tones.

[0151] In one configuration, reference Figure 7 At 722, the second configuration request 718 and the second configuration response may be subject to reciprocal phase rotation in transmission.

[0152] In one configuration, at 920, the network node may identify a phase error between the network node and the at least one real receiving device based on periodically exchanging one or more known phase parameters with the at least one real receiving device. For example, 920 may be performed by Fig.11 Component 199 in the reference Figure 7 At 728 , the network node 702 may identify a phase error between the network node 702 and the at least one real receiving device 706 based on periodically exchanging one or more known phase parameters with the at least one real receiving device 706 .

[0153] At 922, the network node may allow or suspend the configuration sharing process based on the comparison of the phase error with the threshold. For example, 922 may be performed by Fig.11 Component 199 in the reference Figure 7 At 730, the network node 702 may allow or suspend the configuration sharing process based on the comparison of the phase error with the threshold.

[0154] In one configuration, reference Figure 7 , the initialization broadcast 708a / 708b may include a random phase. At 716, the first configuration response may include a forged configuration. The first configuration request 710 may include a first phase parameter. At 716, the first configuration response may include a second phase parameter.

[0155] In one configuration, the first phase parameter and the second phase parameter may each be associated with a plurality of tones.

[0156] In one configuration, reference Figure 7 At 716, the first configuration request 710 and the first configuration response may be subject to reciprocal phase rotation in transmission.

[0157] In one configuration, the first verification test may include a distribution-based hypothesis test or a Hamming distance-based similarity test. Specifically, the hypothesis test may be a function for evaluating whether the received credential is authentic. Since the received signal for this purpose (i.e., the configuration response) involves random variables (e.g., channel gain), the distribution of these random variables can be used to construct the hypothesis test. The resulting test may be referred to as a distribution-based hypothesis test. In addition, for a Hamming distance-based similarity test, the distribution may not be considered; instead, the received vector involving the credential may be compared to the expected vector (because the credential is known at the receiver). If the two vectors are similar enough (e.g., if the difference between the two vectors is below a threshold), authenticity may be identified or assumed.

[0158] Fig.101000 is a diagram illustrating an example of a hardware implementation for an apparatus 1004. The apparatus 1004 may be a UE, a component of a UE, or may implement UE functionality. In some aspects, the apparatus 1004 may include a cellular baseband processor 1024 (also referred to as a modem) coupled to one or more transceivers 1022 (e.g., a cellular RF transceiver). The cellular baseband processor 1024 may include on-chip memory 1024'. In some aspects, the apparatus 1004 may also include one or more subscriber identity module (SIM) cards 1020 and an application processor 1006 coupled to a secure digital (SD) card 1008 and a screen 1010. The application processor 1006 may include on-chip memory 1006'. In some aspects, the device 1004 may also include a Bluetooth module 1012, a WLAN module 1014, an SPS module 1016 (e.g., a GNSS module), one or more sensor modules 1018 (e.g., an atmospheric pressure sensor / altimeter; motion sensors such as an inertial management unit (IMU), a gyroscope, and / or an accelerometer; light detection and ranging (LIDAR), radio-aided detection and ranging (RADAR), sound navigation and ranging (SONAR), magnetometer, audio, and / or other technologies for positioning), an additional memory module 1026, a power source 1030, and / or a camera 1032. The Bluetooth module 1012, the WLAN module 1014, and the SPS module 1016 may include an on-chip transceiver (TRX) (or in some cases, only a receiver (RX)). The Bluetooth module 1012, the WLAN module 1014, and the SPS module 1016 may include their own dedicated antennas and / or communicate using antennas 1080. The cellular baseband processor 1024 communicates with the UE 104 and / or with the RU associated with the network entity 1002 through the transceiver 1022 via one or more antennas 1080. The cellular baseband processor 1024 and the application processor 1006 may each include a computer-readable medium / memory 1024', 1006', respectively. The additional memory module 1026 may also be considered as a computer-readable medium / memory. Each computer-readable medium / memory 1024', 1006', 1026 may be non-transitory. The cellular baseband processor 1024 and the application processor 1006 are each responsible for general processing, including executing software stored on a computer-readable medium / memory. The software, when executed by the cellular baseband processor 1024 / application processor 1006, enables the cellular baseband processor 1024 / application processor 1006 to perform the various functions described above. The computer-readable medium / memory can also be used to store data manipulated by the cellular baseband processor 1024 / application processor 1006 when executing the software.The cellular baseband processor 1024 / application processor 1006 may be a component of the UE 350 and may include the memory 360 and / or at least one of the TX processor 368, the RX processor 356, and the controller / processor 359. In one configuration, the device 1004 may be a processor chip (modem and / or application) and include only the cellular baseband processor 1024 and / or the application processor 1006, and in another configuration, the device 1004 may be the entire UE (see, for example. Figure 3 350) and includes additional modules of device 1004.

[0159] Fig.111100 is a diagram illustrating an example of a hardware implementation for a network entity 1102. The network entity 1102 may be a BS, a component of a BS, or may implement BS functionality. The network entity 1102 may include at least one of a CU 1110, a DU 1130, or a RU 1140. For example, depending on the layer functionality handled by the component 199, the network entity 1102 may include a CU 1110; both a CU 1110 and a DU 1130; each of the CU 1110, the DU 1130, and the RU 1140; the DU 1130; both a DU 1130 and a RU 1140; or the RU 1140. The CU 1110 may include a CU processor 1112. The CU processor 1112 may include an on-chip memory 1112'. In some aspects, the CU 1110 may also include an additional memory module 1114 and a communication interface 1118. CU1110 communicates with DU 1130 via a midhaul link (such as an F1 interface). DU 1130 may include a DU processor 1132. DU processor 1132 may include on-chip memory 1132'. In some aspects, DU 1130 may also include additional memory modules 1134 and communication interfaces 1138. DU 1130 communicates with RU 1140 via a fronthaul link. RU 1140 may include a RU processor 1142. RU processor 1142 may include on-chip memory 1142'. In some aspects, RU 1140 may also include additional memory modules 1144, one or more transceivers 1146, antenna 1180, and communication interface 1148. RU 1140 communicates with UE 104. On-chip memory 1112', 1132', 1142' and additional memory modules 1114, 1134, 1144 may each be considered a computer-readable medium / memory. Each computer readable medium / memory may be non-transitory. Each of processors 1112, 1132, 1142 is responsible for general processing, including executing software stored on the computer readable medium / memory. The software, when executed by the corresponding processor, causes the processor to perform the various functions described above. The computer readable medium / memory can also be used to store data manipulated by the processor when executing the software.

[0160] As discussed above, component 199 is configured to identify at least one hostile device. Component 199 may be configured to send a fake configuration to the at least one hostile device. The fake configuration may be associated with a PHY technology. Component 199 may be within one or more processors of one or more of CU1110, DU 1130, and RU 1140. Component 199 may be one or more hardware components that are specifically configured to perform the stated process / algorithm, implemented by one or more processors configured to perform the stated process / algorithm, stored in a computer-readable medium so as to be implemented by one or more processors, or some combination of the above. Network entity 1102 may include multiple components configured for various functions. In one configuration, network entity 1102 includes a component for identifying at least one hostile device. Network entity 1102 includes a component for sending a fake configuration to the at least one hostile device. The fake configuration may be associated with a PHY technology.

[0161] In one configuration, the forged configuration may be sent to the at least one hostile device based on the location of the at least one hostile device. In one configuration, the network entity 1102 includes a component for sending a correct configuration to at least one real receiving device. The correct configuration may be different from the forged configuration. In one configuration, the forged configuration and the correct configuration may be sent in parallel via a separate RF chain. In one configuration, the forged configuration and the correct configuration may be sent based on time division multiplexing. In one configuration, the at least one hostile device may be identified based on the fact that the at least one hostile device does not have any valid credentials. In one configuration, the network entity 1102 includes a component for sending an initialization broadcast. The network entity 1102 includes a component for receiving a first configuration request from the at least one hostile device. The network entity 1102 includes a component for identifying that the at least one hostile device does not have any valid credentials based on the first configuration request and the first verification test. In one configuration, the network entity 1102 includes a component for receiving a second configuration request from at least one real receiving device. The network entity 1102 includes a component for identifying that the at least one real receiving device has a valid credential based on a second configuration request and a second verification test. The network entity 1102 includes a component for sending a second configuration response including a correct configuration to the at least one real receiving device. In one configuration, the second configuration response may also include a CRC. In one configuration, the network entity 1102 includes a component for receiving a NACK from the at least one real receiving device based on the CRC. In one configuration, in response to the NACK, the network entity 1102 includes a component for resending the second configuration response to the at least one real receiving device. In one configuration, in response to the NACK, the network entity 1102 includes a component for suppressing the sending of a configuration response to the at least one real receiving device within a predetermined time period. In one configuration, the second configuration request may include a third phase parameter. The second configuration response may include a fourth phase parameter. In one configuration, the third phase parameter and the fourth phase parameter may each be associated with a plurality of tones. In one configuration, the second configuration request and the second configuration response may be affected by a reciprocal phase rotation in transmission. In one configuration, the network entity 1102 includes a component for identifying a phase error between a network node and at least one real receiving device based on periodically exchanging one or more known phase parameters with at least one real receiving device. The network entity 1102 includes a component for allowing or suspending a configuration sharing process based on a comparison of the phase error with a threshold. In one configuration, the initialization broadcast may include a random phase. The first configuration response may include a fake configuration. The first configuration request may include a first phase parameter. The first configuration response may include a second phase parameter. In one configuration, the first phase parameter and the second phase parameter may each be associated with a plurality of tones.In one configuration, the first configuration request and the first configuration response may be subject to reciprocal phase rotation in transmission. In one configuration, the first verification test may include a distribution-based hypothesis test or a Hamming distance-based similarity test.

[0162] A means may be a component 199 of the network entity 1102 configured to perform the functions recited by the means. As described above, the network entity 1102 may include the TX processor 316, the RX processor 370, and the controller / processor 375. Thus, in one configuration, a means may be the TX processor 316, the RX processor 370, and / or the controller / processor 375 configured to perform the functions recited by the means.

[0163] Re-reference Figures 4 to 11 , a network node may identify at least one hostile device. The network node may send a forged configuration to the at least one hostile device. The forged configuration may be associated with a PHY technology. Therefore, since the hostile device may waste time and power to perform algorithmic operations based on the forged configuration, the security of the entire system may be improved.

[0164] It should be understood that the specific order or hierarchy of the blocks in the disclosed process / flowchart is only an illustration of the exemplary method. It should be understood that the specific order or hierarchy of the blocks in the process / flowchart can be rearranged based on design preferences. In addition, some blocks can be combined or omitted. The attached method claims provide the elements of each block in a sample order, but are not limited to the specific order or hierarchy provided.

[0165] The foregoing description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects. Therefore, the claims are not limited to the various aspects described herein, but should be given the full scope consistent with the language claims. Unless otherwise specified, reference to an element in the singular form does not mean "one and only one", but "one or more". Terms such as "if", "when ......" and "while" do not mean a direct temporal relationship or reaction. That is, these phrases, such as "when ......", do not mean an immediate action in response to the occurrence of an action or during the occurrence of an action, but simply imply that if the conditions are met, the action will occur, but no specific or immediate time limit is required for the occurrence of the action. The word "exemplary" is used herein to mean "used as an example, instance, or illustration". Any aspect described as "exemplary" herein is not necessarily interpreted as being preferred or having advantages over other aspects. Unless otherwise specified, the term "some" refers to one or more. Combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" include any combination of A, B, and / or C, and may include multiple A, multiple B, or multiple C. Specifically, combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B, and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" may be only A, only B, only C, A and B, A and C, B and C, or A and B and C, where any such combination may contain one or more members of A, B, or C. A set should be interpreted as a set of elements, where the number of elements is one or more. Thus, for a set of X, X will include one or more elements. If the first device receives data from the second device or sends data to the second device, data can be directly received / sent between the first device and the second device, or indirectly received / sent between the first device and the second device through a collection of devices. All structural and functional equivalents of the elements throughout the various aspects described in this disclosure that are known or will later be known to a person of ordinary skill in the art are expressly incorporated herein by reference and are covered by the claims. In addition, nothing disclosed herein is intended to be dedicated to the public, regardless of whether such disclosure is explicitly stated in the claims. Words such as "module", "mechanism", "element", "device", etc. cannot replace the word "component". Therefore, no claim element will be understood as a component plus function unless the element is explicitly stated using the phrase "component for..."

[0166] As used herein, the phrase "based on" should not be interpreted as referring to a closed set of information, one or more conditions, one or more factors, etc. In other words, the phrase "based on A" (where "A" can be information, a condition, a factor, etc.) should be interpreted as "based at least on A" unless specifically stated differently.

[0167] The following aspects are merely illustrative and may be combined with other aspects or teachings described herein without limitation.

[0168] Aspect 1 is a method of wireless communication at a network node, the method comprising: identifying at least one adversarial device; and sending a fake configuration to the at least one adversarial device, the fake configuration being associated with a PHY technology.

[0169] Aspect 2 is a method according to aspect 1, wherein the forged configuration is sent to the at least one hostile device based on a location of the at least one hostile device.

[0170] Aspect 3 is a method according to aspect 2, the method further comprising: sending a correct configuration to at least one genuine receiving device, wherein the correct configuration is different from the forged configuration.

[0171] Aspect 4 is the method according to aspect 3, wherein the counterfeit configuration and the correct configuration are transmitted in parallel via separate RF chains.

[0172] Aspect 5 is a method according to aspect 3, wherein the forged configuration and the correct configuration are sent based on time division multiplexing.

[0173] Aspect 6 is a method according to aspect 1, wherein the at least one adversarial device is identified based on the at least one adversarial device not possessing any valid credentials.

[0174] Aspect 7 is a method according to aspect 6, the method further comprising: sending an initialization broadcast; receiving a first configuration request from the at least one hostile device; and identifying that the at least one hostile device does not possess any valid credentials based on the first configuration request and a first verification test.

[0175] Aspect 8 is a method according to Aspect 7, which further includes: receiving a second configuration request from at least one real receiving device; identifying that the at least one real receiving device has valid credentials based on the second configuration request and a second verification test; and sending a second configuration response including a correct configuration to the at least one real receiving device.

[0176] Aspect 9 is a method according to aspect 8, wherein the second configuration response further includes a CRC.

[0177] Aspect 10 is a method according to Aspect 9, the method further comprising: receiving a NACK from the at least one true receiving device based on the CRC, wherein in response to the NACK, the method further comprises: resending the second configuration response to the at least one true receiving device; or suppressing sending a configuration response to the at least one true receiving device within a predetermined time period.

[0178] Aspect 11 is a method according to any one of aspects 8 to 10, wherein the second configuration request includes a third phase parameter, and the second configuration response includes a fourth phase parameter.

[0179] Aspect 12 is a method according to aspect 11, wherein the third phase parameter and the fourth phase parameter are each associated with a plurality of tones.

[0180] Aspect 13 is a method according to any one of aspects 8 to 12, wherein the second configuration request and the second configuration response are subject to reciprocal phase rotation in transmission.

[0181] Aspect 14 is a method according to any one of Aspects 8 to 13, the method further comprising: identifying a phase error between the network node and the at least one true receiving device based on periodically exchanging one or more known phase parameters with the at least one true receiving device; and allowing or suspending a configuration sharing process based on a comparison of the phase error with a threshold.

[0182] Aspect 15 is a method according to any one of aspects 7 to 14, wherein the initialization broadcast includes a random phase, the first configuration request includes a first phase parameter, the first configuration response includes the forged configuration, and the first configuration response includes a second phase parameter.

[0183] Aspect 16 is a method according to aspect 15, wherein the first phase parameter and the second phase parameter are each associated with a plurality of tones.

[0184] Aspect 17 is a method according to any one of aspects 15 and 16, wherein the first configuration request and the first configuration response are subject to reciprocal phase rotation in transmission.

[0185] Aspect 18 is a method according to any one of aspects 7 to 17, wherein the first verification test comprises a distribution-based hypothesis test or a Hamming distance-based similarity test.

[0186] Aspect 19 is an apparatus for wireless communication, the apparatus comprising: at least one processor, the at least one processor being coupled to a memory, and the at least one processor being configured to implement a method as described in any one of Aspects 1 to 18 based at least in part on information stored in the memory.

[0187] Aspect 20 may be combined with Aspect 19, and further comprises: a transceiver coupled to the at least one processor.

[0188] Aspect 21 is an apparatus for wireless communication, the apparatus comprising means for implementing any one of aspects 1 to 18.

[0189] Aspect 22 is a non-transitory computer-readable storage medium storing computer-executable code, wherein the code, when executed by a processor, causes the processor to implement any one of aspects 1 to 18.

[0190] Various aspects have been described herein. These and other aspects are within the scope of the following claims.

Claims

1. An apparatus for wireless communication at a network node, the apparatus comprising: Memory; and at least one processor coupled to the memory and based at least in part on the information stored in the memory, the at least one processor configured to: identifying at least one hostile device; as well as A counterfeit configuration is sent to the at least one adversarial device, the counterfeit configuration being associated with a physical layer (PHY) technology. 2 . The apparatus of claim 1 , wherein the forged configuration is sent to the at least one adversarial device based on a location of the at least one adversarial device.

3. The apparatus of claim 2, wherein the at least one processor is configured to: A correct configuration is sent to at least one genuine receiving device, wherein the correct configuration is different from the counterfeit configuration. 4 . The apparatus of claim 3 , wherein the counterfeit configuration and the correct configuration are transmitted in parallel via separate radio frequency (RF) chains. The apparatus according to claim 3 , wherein the forged configuration and the correct configuration are transmitted based on time division multiplexing.

6. The apparatus of claim 1, wherein the at least one adversarial device is identified based on the at least one adversarial device not possessing any valid credentials.

7. The apparatus of claim 6, wherein the at least one processor is configured to: Send initialization broadcast; receiving a first configuration request from the at least one adversarial device; and The at least one adversarial device is identified as not possessing any valid credentials based on the first configuration request and the first verification test.

8. The apparatus of claim 7, wherein the at least one processor is configured to: receiving a second configuration request from at least one real receiving device; identifying that the at least one genuine receiving device has valid credentials based on the second configuration request and the second verification test; and A second configuration response including the correct configuration is sent to the at least one real receiving device.

9. The apparatus of claim 8, wherein the second configuration response further comprises a cyclic redundancy check (CRC).

10. The apparatus of claim 9, wherein the at least one processor is configured to: receiving a negative acknowledgement (NACK) from the at least one real receiving device based on the CRC, Wherein in response to the NACK, the at least one processor is further configured to: resending the second configuration response to the at least one real receiving device; or Sending a configuration response to the at least one real receiving device is refrained from for a predetermined period of time.

11. The apparatus of claim 8, wherein the second configuration request comprises a third phase parameter and the second configuration response comprises a fourth phase parameter.

12. The apparatus of claim 11, wherein the third phase parameter and the fourth phase parameter are each associated with a plurality of tones.

13. The apparatus of claim 8, wherein the second configuration request and the second configuration response are subject to reciprocal phase rotation in transmission.

14. The apparatus of claim 8, wherein the at least one processor is configured to: identifying a phase error between the network node and the at least one true receiving device based on periodically exchanging one or more known phase parameters with the at least one true receiving device; and The configuration sharing process is allowed or suspended based on the comparison of the phase error to a threshold value.

15. The apparatus of claim 7, wherein the initialization broadcast comprises a random phase, the first configuration request comprises a first phase parameter, a first configuration response comprises the forged configuration, and the first configuration response comprises a second phase parameter.

16. The apparatus of claim 15, wherein the first phase parameter and the second phase parameter are each associated with a plurality of tones.

17. The apparatus of claim 15, wherein the first configuration request and the first configuration response are subject to reciprocal phase rotation in transmission.

18. The apparatus of claim 7, wherein the first validation test comprises a distribution-based hypothesis test or a Hamming distance-based similarity test.

19. The apparatus according to claim 1, further comprising: A transceiver is coupled to the at least one processor.

20. A method for wireless communication at a network node, the method comprising: identifying at least one hostile device; as well as A counterfeit configuration is sent to the at least one adversarial device, the counterfeit configuration being associated with a physical layer (PHY) technology.

21. The method of claim 20, wherein the counterfeit configuration is sent to the at least one adversarial device based on a location of the at least one adversarial device.

22. The method according to claim 21, further comprising: A correct configuration is sent to at least one genuine receiving device, wherein the correct configuration is different from the counterfeit configuration.

23. The method of claim 22, wherein the counterfeit configuration and the correct configuration are transmitted in parallel via separate radio frequency (RF) chains.

24. The method according to claim 22, wherein the fake configuration and the correct configuration are transmitted based on time division multiplexing.

25. The method of claim 20, wherein the at least one adversarial device is identified based on the at least one adversarial device not possessing any valid credentials.

26. The method according to claim 25, further comprising: Send initialization broadcast; receiving a first configuration request from the at least one adversarial device; as well as The at least one adversarial device is identified as not possessing any valid credentials based on the first configuration request and the first verification test.

27. The method according to claim 26, further comprising: receiving a second configuration request from at least one real receiving device; identifying that the at least one genuine receiving device has valid credentials based on the second configuration request and the second verification test; as well as A second configuration response including the correct configuration is sent to the at least one real receiving device.

28. The method of claim 27, wherein the second configuration request and the second configuration response are subject to reciprocal phase rotation in transmission.

29. The method according to claim 27, further comprising: identifying a phase error between the network node and the at least one true receiving device based on periodically exchanging one or more known phase parameters with the at least one true receiving device; as well as The configuration sharing process is allowed or suspended based on the comparison of the phase error to a threshold value.

30. A computer readable medium storing computer executable code at a network node, the code, when executed by a processor, causing the processor to: identifying at least one hostile device; and A counterfeit configuration is sent to the at least one adversarial device, the counterfeit configuration being associated with a physical layer (PHY) technology.

Images