L1 security signaling

Abstract

The UE may detect suspicious counterfeit transmission attacks at the UE based on the PHY security. The UE may send to the network node, and the network node may receive an indication of a suspicious counterfeit transmission attack from the UE. A network node may receive, from a UE, an indication of one or more characteristics associated with a potential attacker associated with a suspicious counterfeited transmission attack. The UE may send, via the sidelink, a second indication to at least one additional UE as to whether the UE identifies that the suspicious counterfeit transmission attack corresponds to the UE being attacked. The network node may identify a geographic location of the potential attacker based on a plurality of indications of one or more characteristics associated with the potential attacker. A network node may compile an opponent pool that includes one or more impaired identities.

Description

[0001] CROSS-REFERENCE TO RELATED APPLICATIONS

[0002] This application claims the benefit of U.S. patent application serial number 17 / 816,530, filed on August 1, 2022, and entitled “L1 SECURITYSIGNALING,” which is expressly incorporated herein by reference in its entirety. Technical Field

[0003] The present disclosure relates generally to communication systems, and more particularly to link security in wireless communication systems based on physical layer (PHY) security. Background Art

[0004] Wireless communication systems are widely deployed to provide a variety of telecommunication services, such as telephony, video, data, messaging, and broadcasting. Typical wireless communication systems may employ multiple access technologies that are capable of supporting communications with multiple users by sharing available system resources. Examples of such multiple access technologies include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, orthogonal frequency division multiple access (OFDMA) systems, single carrier frequency division multiple access (SC-FDMA) systems, and time division synchronous code division multiple access (TD-SCDMA) systems.

[0005] These multiple access technologies have been adopted in various telecommunication standards to provide a common protocol that enables different wireless devices to communicate at municipal, national, regional and even global levels. An example of a telecommunication standard is 5G New Radio (NR). 5GNR is part of the continuous mobile broadband evolution released by the Third Generation Partnership Project (3GPP) to meet new requirements related to latency, reliability, security, scalability (e.g., Internet of Things (IoT)) and other requirements. 5G NR includes services associated with enhanced mobile broadband (eMBB), massive machine type communication (mMTC) and ultra-reliable low latency communication (URLLC). Some aspects of 5G NR may be based on the 4G Long Term Evolution (LTE) standard. Further improvements to 5G NR technology are needed. These improvements may also be applicable to other multiple access technologies and telecommunication standards that employ these technologies.

[0006] User privacy and data confidentiality are integral parts of any secure and reliable transport protocol. Traditional 5G security may aim to provide adequate confidentiality and integrity for data, as well as ensure the availability of network services through cryptographic functions available in upper layers (not in PHY) to protect against denial of service (DoS) attacks. Security protection may be required in the PHY covering control channels and / or reference signals, as control channels and / or reference signals are important in many 5G NR functions (e.g., channel estimation, uplink (UL) / downlink (DL) grants, positioning, etc.). Summary of the invention

[0007] A brief summary of one or more aspects is presented below to provide a basic understanding of these aspects. This summary is not a general overview of all expected aspects. This summary is neither intended to identify the key or important elements of all aspects, nor to describe the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to a more detailed description presented later.

[0008] In one aspect of the present disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus may be a user equipment (UE). The apparatus may detect a suspected forged transmission attack based on physical layer (PHY) security at the UE. The apparatus may send an indication of the suspected forged transmission attack to a network node.

[0009] In one aspect of the present disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus may be a network node. The apparatus may receive an indication of a suspected forged transmission attack from a UE. The suspected forged transmission attack may be detected based on PHY security. The apparatus may receive an indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack. The indication of the one or more characteristics may be received from the UE.

[0010] To achieve the foregoing and related purposes, the one or more aspects include the features fully described below and particularly pointed out in the claims. The following description and the accompanying drawings set forth in detail certain illustrative features of one or more aspects. However, these features are only indicative of some of the various ways in which the principles of the various aspects can be employed. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] Figure 1 is a diagram illustrating an example of a wireless communication system and an access network.

[0012] Figure 2A is a diagram illustrating an example of a first frame according to various aspects of the present disclosure.

[0013] Figure 2B is a diagram illustrating an example of downlink (DL) channels within a subframe according to various aspects of the present disclosure.

[0014] Figure 2C is a diagram illustrating an example of a second frame according to various aspects of the present disclosure.

[0015] Figure 2D is a diagram illustrating an example of uplink (UL) channels within a subframe according to various aspects of the present disclosure.

[0016] Figure 3 is a diagram illustrating an example of a base station and a user equipment (UE) in an access network according to various aspects of the present disclosure.

[0017] Figure 4 is a diagram illustrating example layer 1 (L1) security signaling according to one or more aspects.

[0018] Figure 5 is a flow chart of a method of wireless communication in accordance with various aspects of the present disclosure.

[0019] Figure 6 is a flow chart of a method of wireless communication in accordance with various aspects of the present disclosure.

[0020] Figure 7 is a flow chart of a method of wireless communication in accordance with various aspects of the present disclosure.

[0021] Figure 8 is a flow chart of a method of wireless communication in accordance with various aspects of the present disclosure.

[0022] Fig. 9 is a flow chart of a method of wireless communication in accordance with various aspects of the present disclosure.

[0023] Fig.10 is a diagram illustrating examples of hardware implementations of example devices and / or network entities according to various aspects of the present disclosure.

[0024] Fig.11 is a diagram illustrating an example of a hardware implementation of an example network entity according to various aspects of the present disclosure. DETAILED DESCRIPTION

[0025] Security can be an integral part of communications. Communication security can be used to protect confidential information in different applications, such as business applications (e.g., financial, medical, or pharmaceutical applications, etc.), autonomous driving, applications for government organizations, military applications, personal data applications, or social networks. In some configurations, cryptography can be used to implement link security.

[0026] In some configurations, the UE may utilize L1 security (i.e., PHY security, i.e., security implemented in the physical layer) to distinguish genuine transmissions from forged transmissions. There may be a fundamental trade-off between security (added to protect the underlying communications) and performance in communications, because adding security may result in a reduction in performance. To manage the trade-off, the network may determine the amount or level of security required based on the threats present in the communication environment (e.g., the type and parameters of security protection techniques). If the UE is being attacked, but there is no mechanism for communicating this attack information to the network, the network may not be aware of the existence of the attack. As a result, the network may not be able to deploy a sufficient level of security to react or respond to the attack.

[0027] According to one or more aspects, a UE may detect a suspected forged transmission attack based on PHY security at the UE. The UE may send to a network node and the network node may receive an indication of a suspected forged transmission attack from the UE. The network node may receive from the UE an indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack. The UE may send to at least one additional UE via a side link a second indication of whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked. The network node may identify the geographic location of the potential attacker based on multiple indications of one or more characteristics associated with the potential attacker. The network node may compile an adversary pool including one or more compromised identities. Accordingly, L1 security for the wireless communication system may be optimized. In particular, the trade-off between network security and delay overhead may be optimized.

[0028] The specific embodiments described below in conjunction with the accompanying drawings describe various configurations and do not represent the only configurations in which the concepts described herein can be practiced. The specific embodiments include specific details to provide a thorough understanding of the various concepts. However, these concepts can be practiced without these specific details. In some cases, in order to avoid obscuring these concepts, well-known structures and components are shown in block diagram form.

[0029] Several aspects of telecommunication systems are presented with reference to various devices and methods. These devices and methods are described in the following detailed description and illustrated in the accompanying drawings by various blocks, components, circuits, processes, algorithms, etc. (collectively referred to as "elements" hereinafter). These elements can be implemented using electronic hardware, computer software, or any combination thereof. Whether these elements are implemented in hardware or software depends on the specific application and the design constraints imposed on the overall system.

[0030] As an example, an element, any part of an element, or any combination of multiple elements can be implemented as a "processing system" including one or more processors. Examples of processors include microprocessors, microcontrollers, graphics processing units (GPUs), central processing units (CPUs), application processors, digital signal processors (DSPs), reduced instruction set computing (RISC) processors, systems on chip (SoCs), baseband processors, field programmable gate arrays (FPGAs), programmable logic devices (PLDs), state machines, gating logic, discrete hardware circuits, and other suitable hardware configured to perform various functions described throughout the present disclosure. One or more processors in a processing system can execute software. Whether referred to as software, firmware, middleware, microcode, hardware description language, or other, software should be broadly interpreted as indicating instructions, instruction sets, codes, code segments, program codes, programs, subroutines, software components, applications, software applications, software packages, routines, subroutines, objects, executable programs, threads in execution, procedures, functions, etc.

[0031] Therefore, in one or more example aspects, implementations and / or use cases, the described functions may be implemented with hardware, software, firmware or any combination thereof. If implemented with software, the functions may be stored on a computer-readable medium or encoded as one or more instructions or codes on a computer-readable medium. Computer-readable media include computer storage media. Storage media may be any available medium that can be accessed by a computer. As an example, such a computer-readable medium may include a random access memory (RAM), a read-only memory (ROM), an electrically erasable programmable ROM (EEPROM), optical disk storage, magnetic disk storage, other magnetic storage devices, a combination of these types of computer-readable media, or any other medium that can be used to store computer executable code that can be accessed by a computer in the form of instructions or data structures.

[0032] Although aspects, implementations and / or use cases are described in this application by illustrating some examples, additional or different aspects, implementations and / or use cases may appear in many different arrangements and scenarios. Aspects, implementations and / or use cases described herein may be implemented on many different platform types, devices, systems, shapes, sizes and packaging arrangements. For example, implementations and / or use cases may be implemented via integrated chip embodiments and other devices based on non-module components (e.g., end-user devices, vehicles, communication devices, computing devices, industrial devices, retail / purchasing devices, medical devices, devices supporting artificial intelligence (AI), etc.). Although some examples may or may not be specifically for use cases or applications, various applicability of the described examples may occur. The scope of aspects, implementations and / or use cases may be extended from chip-level or modular components to non-modular, non-chip-level implementations, and further to aggregated, distributed or original equipment manufacturer (OEM) devices or systems containing one or more of the technologies herein. In some actual settings, the equipment containing the described aspects and features may also include additional components and features for implementing and implementing the claimed and described aspects. For example, the transmission and reception of wireless signals necessarily include several components for analog and digital purposes (e.g., hardware components, including antennas, RF chains, power amplifiers, modulators, buffers, processors, interleavers, adders / summers, etc.). The techniques described herein can be implemented in a variety of different devices, chip-level components, systems, distributed arrangements, aggregated or non-aggregated components, end-user devices, etc., having different sizes, shapes, and structures.

[0033] The deployment of a communication system (e.g., a 5G NR system) can be arranged in a variety of ways with various components or constituent parts. In a 5G NR system or network, a network node, a network entity, a mobility element of a network, a radio access network (RAN) node, a core network node, a network element, or a network device (e.g., a base station (BS)) or one or more units (or one or more components) performing base station functions can be implemented in an aggregated architecture or a non-aggregated architecture. For example, a BS (e.g., a Node B (NB), an evolved NB (eNB), an NR BS, a 5G NB, an access point (AP), a transmit receive point (TRP), or a cell, etc.) can be implemented as an aggregated base station (also called an independent BS or a single BS) or a non-aggregated base station.

[0034] An aggregated base station may be configured to utilize a radio protocol stack physically or logically integrated within a single RAN node. A non-aggregated base station may be configured to utilize a protocol stack physically or logically distributed among two or more units (e.g., one or more central or central units (CUs), one or more distributed units (DUs), or one or more radio units (RUs)). In some aspects, a CU may be implemented within a RAN node, and one or more DUs may be co-located with the CU, or alternatively, may be geographically or virtually distributed in one or more other RAN nodes. A DU may be implemented to communicate with one or more RUs. Each of a CU, a DU, and a RU may also be implemented as a virtual unit, i.e., a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU).

[0035] Base station operation or network design may take into account the aggregated nature of base station functions. For example, non-aggregated base stations may be used in an integrated access backhaul (IAB) network, an open radio access network (O-RAN (e.g., a network configuration sponsored by the O-RAN Alliance)), or a virtual radio access network (vRAN, also known as a cloud radio access network (C-RAN)). Non-aggregation may include allocating functions between two or more units at various physical locations, and allocating functions virtually for at least one unit, which may enable flexibility in network design. Individual units of a non-aggregated RAN architecture or a non-aggregated base station may be configured to communicate wired or wirelessly with at least one other unit.

[0036] Figure 1 100 is a diagram illustrating an example of a wireless communication system and an access network. The wireless communication system shown includes a non-aggregated base station architecture. The non-aggregated base station architecture may include one or more CUs 110, which may communicate directly with a core network 120 via a backhaul link, or indirectly with a core network 120 through one or more non-aggregated base station units (such as a near-real-time (near-RT) RAN intelligent controller (RIC) 125 via an E2 link, or a non-real-time (non-RT) RIC 115 associated with a service management and orchestration (SMO) framework 105, or both). The CU 110 may communicate with one or more DUs 130 via a corresponding midhaul link such as an F1 interface. The DU 130 may communicate with one or more RUs 140 via a corresponding fronthaul link. The RU 140 may communicate with a corresponding UE 104 via one or more radio frequency (RF) access links. In some implementations, a UE 104 may be served simultaneously by multiple RUs 140.

[0037] Each of the units (i.e., CU 110, DU 130, RU 140, near-RT RIC 125, non-RT RIC 115, and SMO framework 105) may include one or more interfaces, or be coupled to one or more interfaces, which are configured to receive or send signals, data, or information (collectively referred to as signals) via a wired or wireless transmission medium. Each of the units or an associated processor or controller that provides instructions to the communication interface of each unit may be configured to communicate with one or more other units via a transmission medium. For example, each unit may include a wired interface that is configured to receive signals or send signals to one or more other units via a wired transmission medium. In addition, each unit may include a wireless interface that may include a receiver, a transmitter, or a transceiver (e.g., an RF transceiver) that is configured to receive or send signals, or both, to one or more other units via a wireless transmission medium.

[0038] In some aspects, CU 110 may be in charge of one or more high-level control functions. Such control functions may include radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP), etc. Each control function may be implemented with an interface configured to transmit signals with other control functions managed by CU 110. CU 110 may be configured to process user plane functions (i.e., central unit-user plane (CU-UP)), control plane functions (i.e., central unit-control plane (CU-CP)), or a combination thereof. In some implementations, CU 110 may be logically split into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RAN configuration, the CU-UP unit may communicate bidirectionally with the CU-CP unit via an interface (such as an E1 interface). When necessary, CU 110 may be implemented to communicate with DU 130 for network control and signaling.

[0039] DU 130 may correspond to a logical unit that includes one or more base station functions to control the operation of one or more RU 140. In some aspects, DU 130 may host one or more of a radio link control (RLC) layer, a medium access control (MAC) layer, and one or more high physical (PHY) layers (such as modules for forward error correction (FEC) encoding and decoding, scrambling, modulation and demodulation, etc.), depending at least in part on a functional split (e.g., those defined by 3GPP). In some aspects, DU 130 may further host one or more low PHY layers. Each layer (or module) may be implemented using an interface that is configured to transmit signals with other layers (and modules) hosted by DU 130 or control functions hosted by CU 110.

[0040] The low-layer functions may be implemented by one or more RUs 140. In some deployments, a RU 140 controlled by a DU 130 may correspond to a logical node that manages RF processing functions or low PHY layer functions (such as performing fast Fourier transform (FFT), inverse FFT (iFFT), digital beamforming, physical random access channel (PRACH) extraction and filtering, etc.), or both, based at least in part on a functional split (e.g., a low-layer functional split). In such an architecture, the RU 140 may be implemented to handle over-the-air (OTA) communications with one or more UEs 104. In some implementations, real-time and non-real-time aspects of control and user plane communications with the RU 140 may be controlled by the corresponding DU 130. In some cases, this configuration may enable the DU 130 and CU 110 to be implemented in a cloud-based RAN architecture (such as a vRAN architecture).

[0041] The SMO framework 105 may be configured to support RAN deployment and provisioning of non-virtualized and virtualized network elements. For non-virtualized network elements, the SMO framework 105 may be configured to support the deployment of dedicated physical resources to meet RAN coverage requirements that can be managed via an operation and maintenance interface (such as, O1 interface). For virtualized network elements, the SMO framework 105 may be configured to interact with a cloud computing platform (e.g., an open cloud (O-cloud) 190) to perform network element lifecycle management (such as, to instantiate virtualized network elements) via a cloud computing platform interface (such as, O2 interface). Such virtualized network elements may include, but are not limited to, CU 110, DU 130, RU 140, and near-RT RIC 125. In some implementations, the SMO framework 105 may communicate with hardware aspects of the 4G RAN (such as, open eNB (O-eNB) 111) via the O1 interface. In addition, in some implementations, the SMO framework 105 may communicate directly with one or more RU 140 via the O1 interface. The SMO framework 105 may also include a non-RT RIC 115 configured to support the functionality of the SMO framework 105 .

[0042] The non-RT RIC 115 may be configured to include logic functions that enable non-real-time control and optimization of RAN elements and resources, artificial intelligence (AI) / machine learning (ML) (AI / ML) workflows (including model training and updating), or policy-based guidance of applications / functions in the near-RT RIC 125. The non-RT RIC 115 may be coupled or in communication with the near-RT RIC 125 (such as via an A1 interface). The near-RT RIC 125 may be configured to include logic functions that enable near-real-time control and optimization of RAN elements and resources via data collection and actions through an interface (such as via an E2 interface) that connects one or more CUs 110, one or more DUs 130, or both, and the O-eNB with the near-RT RIC 125.

[0043] In some implementations, in order to generate an AI / ML model to be deployed in the near-RT RIC 125, the non-RT RIC 115 may receive parameters or external enrichment information from an external server. Such information may be utilized by the near-RT RIC 125 and may be received from a non-network data source or from a network function at the SMO framework 105 or the non-RT RIC 115. In some examples, the non-RT RIC 115 or the near-RT RIC 125 may be configured to tune RAN behavior or performance. For example, the non-RT RIC 115 may monitor long-term trends and patterns for performance and use the AI / ML model to perform corrective actions through the SMO framework 105 (e.g., via reconfiguration of O1) or via the creation of a RAN management policy (e.g., A1 policy).

[0044] At least one of the CU 110, the DU 130, and the RU 140 may be referred to as a base station 102. Therefore, the base station 102 may include one or more of the CU 110, the DU 130, and the RU 140 (each component is represented by a dotted line to indicate that each component may be included in the base station 102 or may not be included in the base station 102). The base station 102 provides an access point to the core network 120 for the UE 104. The base station 102 may include a macro cell (a high-power cellular base station) and / or a small cell (a low-power cellular base station). Small cells include femto cells, pico cells, and micro cells. A network including both small cells and macro cells may be referred to as a heterogeneous network. A heterogeneous network may also include a home evolved Node B (eNB) (HeNB), which may provide services to a restricted group called a closed subscriber group (CSG). The communication link between RU 140 and UE 104 may include an uplink (UL) (also known as a reverse link) transmission from UE 104 to RU 140 and / or a downlink (DL) (also known as a forward link) transmission from RU 140 to UE 104. The communication link may use multiple-input multiple-output (MIMO) antenna technology, including spatial multiplexing, beamforming and / or transmit diversity. The communication link may pass through one or more carriers. Base station 102 / UE 104 may use a spectrum of up to Y MHz (e.g., 5, 10, 15, 20, 100, 400, etc. MHz) bandwidth per carrier allocated in a carrier aggregation of up to Yx MHz (x component carriers) for transmission in each direction. The carriers may or may not be adjacent to each other. The allocation of carriers may be asymmetric with respect to DL and UL (e.g., more or less carriers may be allocated to DL than to UL). Component carriers may include a primary component carrier and one or more secondary component carriers. The primary component carrier may be referred to as a primary cell (PCell), and the secondary component carrier may be referred to as a secondary cell (SCell).

[0045] Some UEs 104 may communicate with each other using a device-to-device (D2D) communication link 158. The D2D communication link 158 may use DL / UL wireless wide area network (WWAN) spectrum. The D2D communication link 158 may use one or more sidelink channels, such as a physical sidelink broadcast channel (PSBCH), a physical sidelink discovery channel (PSDCH), a physical sidelink shared channel (PSSCH), and a physical sidelink control channel (PSCCH). The D2D communication may be through various wireless D2D communication systems, such as, for example, Bluetooth, Wi-Fi based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 standard, LTE, or NR.

[0046] The wireless communication system may also include a Wi-Fi AP 150 that communicates with a UE 104 (also referred to as a Wi-Fi station (STA)) via a communication link 154, for example, in a 5 GHz unlicensed spectrum, etc. When communicating in an unlicensed spectrum, the UE 104 / AP 150 may perform a clear channel assessment (CCA) to determine whether a channel is available before communicating.

[0047] The electromagnetic spectrum is typically subdivided into various categories, bands, channels, etc. based on frequency / wavelength. In 5G NR, two initial operating bands have been identified with the frequency range names FR1 (410 MHz-7.125 GHz) and FR2 (24.25 GHz-52.6 GHz). Although a portion of FR1 is greater than 6 GHz, FR1 is often (interchangeably) referred to as the "sub-6 GHz" band in various documents and articles. Similar naming issues sometimes arise with respect to FR2, which is often (interchangeably) referred to as the "millimeter wave" band in documents and articles, although FR2 is different from the extremely high frequency (EHF) band (30 GHz-300 GHz) identified as the "millimeter wave" band by the International Telecommunication Union (ITU).

[0048] Frequencies between FR1 and FR2 are generally referred to as mid-band frequencies. Recent 5G NR research has identified the operating bands of these mid-band frequencies as the frequency range designation FR3 (7.125 GHz–24.25 GHz). The frequency bands falling within FR3 may inherit FR1 characteristics and / or FR2 characteristics, and thus may effectively extend the characteristics of FR1 and / or FR2 to mid-band frequencies. In addition, higher frequency bands are currently being explored to extend 5G NR operations above 52.6 GHz. For example, three higher operating frequency bands have been identified as the frequency range designations FR2-2 (52.6 GHz–71 GHz), FR4 (71 GHz–114.25 GHz), and FR5 (114.25 GHz–300 GHz). Each of these higher frequency bands falls within the EHF band.

[0049] In view of the above, unless otherwise specifically stated, if the term "sub-6 GHz" or the like is used herein, it may broadly refer to a frequency that may be less than 6 GHz, may be within FR1, or may include mid-band frequencies. In addition, unless otherwise specifically stated, if the term "millimeter wave" or the like is used herein, it may broadly refer to a frequency that may include mid-band frequencies, may be within FR2, FR4, FR2-2, and / or FR5, or may be within the EHF band.

[0050] The base station 102 and the UE 104 may each include multiple antennas, such as antenna elements, antenna panels, and / or antenna arrays, to facilitate beamforming. The base station 102 may transmit a beamformed signal 182 to the UE 104 in one or more transmit directions. The UE 104 may receive a beamformed signal from the base station 102 in one or more receive directions. The UE 104 may also transmit a beamformed signal 184 to the base station 102 in one or more transmit directions. The base station 102 may receive a beamformed signal from the UE 104 in one or more receive directions. The base station 102 / UE 104 may perform beam training to determine the best receive and transmit directions for each of the base station 102 / UE 104. The transmit direction and receive direction of the base station 102 may be the same or may be different. The transmit direction and receive direction of the UE 104 may be the same or may be different.

[0051] The base station 102 may include and / or be referred to as a gNB, a Node B, an eNB, an access point, a basic transceiver station, a radio base station, a radio transceiver, a transceiver function, a basic service set (BSS), an extended service set (ESS), a transmit receive point (TRP), a network node, a network entity, a network device, or some other suitable term. The base station 102 may be implemented as an integrated access and backhaul (IAB) node, a relay node, a sidelink node, an aggregated (monolithic) base station with a baseband unit (BBU) (including a CU and a DU) and a RU, or as a non-aggregated base station including one or more of a CU, a DU, and / or a RU. A base station set that may include non-aggregated base stations and / or aggregated base stations may be referred to as a next generation (NG) RAN (NG-RAN).

[0052] The core network 120 may include an access and mobility management function (AMF) 161, a session management function (SMF) 162, a user plane function (UPF) 163, a unified data management (UDM) 164, one or more location servers 168, and other functional entities. AMF 161 is a control node that handles signaling between UE 104 and the core network 120. AMF 161 supports registration management, connection management, mobility management, and other functions. SMF 162 supports session management and other functions. UPF 163 supports packet routing, packet forwarding, and other functions. UDM 164 supports generating authentication and key agreement (AKA) credentials, user identity processing, access authorization, and subscription management. One or more location servers 168 are shown as including a gateway mobile location center (GMLC) 165 and a location management function (LMF) 166. However, in general, the one or more location servers 168 may include one or more location / positioning servers, which may include one or more of the GMLC 165, the LMF 166, a position determination entity (PDE), a serving mobile location center (SMLC), a mobile positioning center (MPC), etc. The GMLC 165 and the LMF 166 support UE location services. The GMLC 165 provides an interface for clients / applications (e.g., emergency services) to access UE positioning information. The LMF 166 receives measurement and assistance information from the NG-RAN and the UE 104 via the AMF 161 to calculate the position of the UE 104. The NG-RAN may utilize one or more positioning methods in order to determine the position of the UE 104. Positioning the UE 104 may involve signal measurements, position estimation, and optional speed calculations based on the measurements. Signal measurements may be performed by the UE 104 and / or the serving base station 102. The measured signals may be based on a satellite positioning system (SPS) 170 (e.g., one or more of a global navigation satellite system (GNSS), a global positioning system (GPS), a non-terrestrial network (NTN), or other satellite position / location systems), LTE signals, wireless local area network (WLAN) signals, Bluetooth signals, a terrestrial beacon system (TBS), sensor-based information (e.g., air pressure sensor, motion sensor), NR enhanced cell ID (NRE-CID) method, NR signals (e.g., multi-round trip time (Multi-RTT), DL angle of departure (DL-AoD), DL time difference of arrival (DL-TDOA), UL time difference of arrival, and UL angle of arrival (UL-AoA) positioning) and / or other systems / signals / sensors.

[0053] Examples of UE 104 include cellular phones, smart phones, session initiation protocol (SIP) phones, laptops, personal digital assistants (PDAs), satellite radios, global positioning systems, multimedia devices, video devices, digital audio players (e.g., MP3 players), cameras, game consoles, tablet computers, smart devices, wearable devices, vehicles, electric meters, gas pumps, large or small kitchen appliances, healthcare equipment, implants, sensors / brakes, displays, or any other similar functional devices. Some UE 104 may be referred to as IoT devices (e.g., parking meters, gas pumps, toasters, vehicles, heart monitors, etc.). UE 104 may also be referred to as stations, mobile stations, subscriber stations, mobile units, subscriber units, wireless units, remote units, mobile devices, wireless devices, wireless communication devices, remote devices, mobile subscriber stations, access terminals, mobile terminals, wireless terminals, remote terminals, mobile phones, user agents, mobile clients, clients, or some other suitable terminology. In some scenarios, the term UE may also be applied to one or more companion devices, such as in a device constellation arrangement. One or more of these devices may access a network together and / or individually.

[0054] Refer again Figure 1 In some aspects, the UE 104 may include a security component 198, which may be configured to detect a suspected forged transmission attack based on PHY security at the UE. The security component 198 may be configured to send an indication of a suspected forged transmission attack to a network node. In some aspects, the base station 102 may include a security component 199, which may be configured to receive an indication of a suspected forged transmission attack from the UE. The suspected forged transmission attack may be detected based on PHY security. The security component 199 may be configured to receive an indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack. An indication of one or more characteristics may be received from the UE. Although the following description may focus on 5G NR, the concepts described herein may be applicable to other similar fields, such as LTE, LTE-A, CDMA, GSM, and other wireless technologies.

[0055] Figure 2A FIG200 is a diagram illustrating an example of a first subframe within a 5G NR frame structure. Figure 2B FIG230 is a diagram illustrating an example of DL channels within a 5G NR subframe. Figure 2C FIG250 is a diagram illustrating an example of a second subframe within a 5G NR frame structure. Figure 2DFIG280 is a diagram illustrating an example of UL channels within a 5G NR subframe. The 5G NR frame structure may be of frequency division duplex type (FDD), where for a particular set of subcarriers (carrier system bandwidth), subframes within the set of subcarriers are dedicated to either DL or UL; or the 5G NR frame structure may be of time division duplex type (TDD), where for a particular set of subcarriers (carrier system bandwidth), subframes within the set of subcarriers are dedicated to both DL and UL. Figure 2A , 2C In the example provided, the 5G NR frame structure is assumed to be of TDD type, where subframe 4 is configured with slot format 28 (primarily DL), where D is DL, U is UL, X is flexible for use between DL / UL, and subframe 3 is configured with slot format 1 (all UL). Although subframes 3 and 4 are shown as having slot formats 1 and 28, respectively, any particular subframe can be configured with any of the various available slot formats 0-61. Slot formats 0 and 1 are all DL and all UL, respectively. Other slot formats 2-61 include a mix of DL symbols, UL symbols, and flexible symbols. The UE is configured with a slot format by a received slot format indicator (SFI) (dynamically through DL control information (DCI) or semi-statically / statically through radio resource control (RRC) signaling). Note that the following description also applies to the TDD type 5GNR frame structure.

[0056] Figures 2A-2D The frame structure is shown, and aspects of the present disclosure may be applicable to other wireless communication technologies, which may have different frame structures and / or different channels. A frame (10ms) may be divided into 10 subframes (1ms) of equal size. Each subframe may include one or more time slots. A subframe may also include a mini-time slot, which may include 7, 4, or 2 symbols. Depending on whether the cyclic prefix (CP) is normal or extended, each time slot may include 14 or 12 symbols. For a normal CP, each time slot may include 14 symbols, and for an extended CP, each time slot may include 12 symbols. The symbol on the DL may be a CP orthogonal frequency division multiplexing (OFDM) (CP-OFDM) symbol. The symbol on the UL may be a CP-OFDM symbol (for high throughput scenarios) or a discrete Fourier transform (DFT) extended OFDM (DFT-s-OFDM) symbol (also known as a single carrier frequency division multiple access (SC-FDMA) symbol) (for power-limited situations; limited to single-stream transmission). The number of time slots within a subframe is based on the CP and numerology. The digital scheme defines a subcarrier spacing (SCS) and effectively defines a symbol length / duration which may be equal to 1 / SCS.

[0057]

[0058] Table 1: Correspondence between digital scheme (μ), SCS and CP

[0059] For normal CP (14 symbols / slot), different digital schemes μ0 to 4 allow 1, 2, 4, 8, and 16 slots per subframe, respectively. For extended CP, digital scheme 2 allows 4 slots per subframe. Therefore, for normal CP and digital scheme μ, there are 14 symbols per slot and 2 per subframe. μ time slots. The subcarrier spacing can be equal to 2 μ *15kHz, where μ is the digital scheme 0 to 4. Thus, digital scheme μ=0 has a subcarrier spacing of 15kHz and digital scheme μ=4 has a subcarrier spacing of 240kHz. The symbol length / duration is inversely proportional to the subcarrier spacing. Figures 2A-2D An example of a normal CP and a digital scheme μ=2 is provided, where each slot has 14 symbols and each subframe has 4 slots. The slot duration is 0.25ms, the subcarrier spacing is 60kHz, and the symbol duration is about 16.67μs. Within a frame, there can be one or more different bandwidth parts (BWPs) that are frequency-division multiplexed (see Figure 2B ). Each BWP can have a specific numbering scheme and CP (normal or extended).

[0060] A resource grid may be used to represent a frame structure. Each slot includes a resource block (RB) (also referred to as a physical RB (PRB)) extending over 12 consecutive subcarriers. The resource grid is divided into a plurality of resource elements (REs). The number of bits carried by each RE depends on the modulation scheme.

[0061] like Figure 2A As shown in , some REs carry reference (pilot) signals (RS) for UEs. RSs may include demodulation RSs (DM-RSs) (although indicated as Rs for a specific configuration, other DM-RS configurations are possible) and channel state information reference signals (CSI-RSs) for channel estimation at the UE. RSs may also include beam measurement RSs (BRSs), beam refinement RSs (BRRSs), and phase tracking RSs (PT-RSs).

[0062] Figure 2BExamples of various DL channels within a subframe of a frame are illustrated. The physical downlink control channel (PDCCH) carries DCI in one or more control channel elements (CCEs) (e.g., 1, 2, 4, 8, or 16 CCEs), each CCE includes 6 RE groups (REGs), and each REG includes 12 consecutive REs in the OFDM symbol of the RB. The PDCCH within a BWP may be referred to as a control resource set (CORESET). The UE is configured to monitor PDCCH candidates in a PDCCH search space (e.g., a common search space, a UE-specific search space) during a PDCCH monitoring opportunity on the CORESET, where the PDCCH candidates have different DCI formats and different aggregation levels. Additional BWPs may be located at higher and / or lower frequencies on the channel bandwidth. The primary synchronization signal (PSS) may be within symbol 2 of a specific subframe of a frame. The UE 104 uses the PSS to determine subframe timing / symbol timing and physical layer identity. The secondary synchronization signal (SSS) may be within symbol 4 of a specific subframe of a frame. The UE uses the SSS to determine the physical layer cell identity group number and the radio frame timing. Based on the physical layer identity and the physical layer cell identity group number, the UE can determine the physical cell identifier (PCI). Based on the PCI, the UE can determine the location of the DM-RS. The physical broadcast channel (PBCH) carrying the master information block (MIB) can be logically grouped with the PSS and SSS to form a synchronization signal (SS) / PBCH block (also called SS block (SSB)). The MIB provides the number of RBs in the system bandwidth and the system frame number (SFN). The physical downlink shared channel (PDSCH) carries user data, broadcast system information not sent via the PBCH (such as the system information block (SIB)), and paging messages.

[0063] like Figure 2C As shown in , some REs carry DM-RS for channel estimation at the base station (although indicated as R for a specific configuration, other DM-RS configurations are also possible). The UE can send DM-RS for the physical uplink control channel (PUCCH) and DM-RS for the physical uplink shared channel (PUSCH). The PUSCH DM-RS can be sent in the first one or two symbols of the PUSCH. Depending on whether a short PUCCH or a long PUCCH is sent and depending on the specific PUCCH format used, the PUCCH DM-RS can be sent in different configurations. The UE can send a sounding reference signal (SRS). The SRS can be sent in the last symbol in the subframe. The SRS can have a comb structure, and the UE can send the SRS on one of the combs. The SRS can be used by the base station for channel quality estimation to achieve frequency-dependent scheduling on the UL.

[0064] Figure 2DAn example of various UL channels within a subframe of a frame is illustrated. The PUCCH may be located at a position as indicated in one configuration. The PUCCH carries uplink control information (UCI), such as scheduling requests, channel quality indicators (CQI), precoding matrix indicators (PMI), rank indicators (RI), and hybrid automatic repeat request (HARQ) acknowledgement (ACK) (HARQ-ACK) feedback (i.e., one or more HARQ ACK bits indicating one or more ACKs and / or negative ACKs (NACKs)). The PUSCH carries data and may additionally be used to carry a buffer status report (BSR), a power headroom report (PHR), and / or UCI.

[0065] Figure 3 3 is a block diagram of a base station 310 communicating with a UE 350 in an access network according to various aspects of the present disclosure. In the DL, Internet Protocol (IP) packets from the EPC 160 may be provided to the controller / processor 375. The controller / processor 375 implements the functions of layer 3 and layer 2. Layer 3 includes a radio resource control (RRC) layer, and layer 2 includes a service data adaptation protocol (SDAP) layer, a packet data convergence protocol (PDCP) layer, a radio link control (RLC) layer, and a medium access control (MAC) layer. The controller / processor 375 provides RRC layer functions associated with broadcasting of system information (e.g., MIB, SIB), RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-radio access technology (RAT) mobility, and measurement configuration for UE measurement reporting; PDCP layer functions associated with header compression / decompression, security (encryption, decryption, integrity protection, integrity verification), and handover support functions; RLC layer functions associated with transmission of upper layer packet data units (PDUs), error correction through ARQ, concatenation, segmentation and reassembly of RLC service data units (SDUs), resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functions associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto transport blocks (TBs), demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority processing, and logical channel prioritization.

[0066] The transmit (TX) processor 316 and the receive (RX) processor 370 implement layer 1 functions associated with various signal processing functions. Layer 1 including the physical (PHY) layer may include error detection on the transmission channel, forward error correction (FEC) encoding / decoding of the transmission channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. The TX processor 316 processes the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-phase shift keying (M-PSK), M-quadrature amplitude modulation (M-QAM)). The coded and modulated symbols can then be divided into parallel streams. Each stream can then be mapped to an OFDM subcarrier, multiplexed with a reference signal (e.g., pilot) in the time domain and / or frequency domain, and then combined together using an inverse fast Fourier transform (IFFT) to generate a physical channel carrying a time domain OFDM symbol stream. The OFDM stream is spatially precoded to generate multiple spatial streams. Channel estimates from a channel estimator 374 may be used to determine coding and modulation schemes, as well as for spatial processing. The channel estimates may be derived from a reference signal and / or channel condition feedback transmitted by the UE 350. Each spatial stream may then be provided to a different antenna 320 via a separate transmitter 318Tx. Each transmitter 318Tx may modulate a radio frequency (RF) carrier with a corresponding spatial stream for transmission.

[0067] At the UE 350, each receiver 354Rx receives a signal through its respective antenna 352. Each receiver 354Rx recovers the information modulated onto the RF carrier and provides the information to a receive (RX) processor 356. The TX processor 368 and the RX processor 356 implement layer 1 functions associated with various signal processing functions. The RX processor 356 can perform spatial processing on the information to recover any spatial stream destined for the UE 350. If multiple spatial streams are destined for the UE 350, they can be combined into a single OFDM symbol stream by the RX processor 356. The RX processor 356 then converts the OFDM symbol stream from the time domain to the frequency domain using a fast Fourier transform (FFT). The frequency domain signal includes a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols and reference signals on each subcarrier are recovered and demodulated by determining the most likely signal constellation point sent by the base station 310. These soft decisions can be based on channel estimates calculated by the channel estimator 358. The soft decisions are then decoded and deinterleaved to recover the data and control signals originally sent on the physical channel by the base station 310. The data and control signals are then provided to the controller / processor 359 which implements layer 3 and layer 2 functions.

[0068] The controller / processor 359 may be associated with a memory 360 that stores program codes and data. The memory 360 may be referred to as a computer readable medium. In the UL, the controller / processor 359 provides demultiplexing between transport channels and logical channels, packet reassembly, decryption, header decompression, and control signal processing to recover IP packets. The controller / processor 359 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operations.

[0069] Similar to the functions described in conjunction with DL transmission performed by the base station 310, the controller / processor 359 provides RRC layer functions associated with system information (e.g., MIB, SIB) acquisition, RRC connection, and measurement reporting; PDCP layer functions associated with header compression / decompression, and security (encryption, decryption, integrity protection, integrity verification); RLC layer functions associated with transmission of upper layer PDUs, error correction through ARQ, concatenation, segmentation and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functions associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto TBs, demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through HARQ, priority processing, and logical channel prioritization.

[0070] Channel estimates derived by the channel estimator 358 based on a reference signal or feedback transmitted by the base station 310 may be used by the TX processor 368 to select the appropriate coding and modulation schemes and to facilitate spatial processing. The spatial streams generated by the TX processor 368 may be provided to different antennas 352 via separate transmitters 354Tx. Each transmitter 354Tx may modulate an RF carrier with a corresponding spatial stream for transmission.

[0071] UL transmissions are processed at the base station 310 in a manner similar to that described in conjunction with the receiver functionality at the UE 350. Each receiver 318Rx receives a signal through its respective antenna 320. Each receiver 318Rx recovers information modulated onto an RF carrier and provides the information to the RX processor 370.

[0072] The controller / processor 375 may be associated with a memory 376 that stores program codes and data. The memory 376 may be referred to as a computer readable medium. In the UL, the controller / processor 375 provides demultiplexing between transport channels and logical channels, packet reassembly, decryption, header decompression, control signal processing to recover IP packets. The controller / processor 375 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operations.

[0073] At least one of the TX processor 368, the RX processor 356, and the controller / processor 359 may be configured to perform operations related to Figure 1 Aspects related to the security component 198.

[0074] At least one of the TX processor 316, the RX processor 370, and the controller / processor 375 may be configured to perform operations related to Figure 1 Aspects related to security component 199.

[0075] Security can be an integral part of communications. Communication security can be used to protect confidential information in different applications, such as business applications (e.g., financial, medical, or pharmaceutical applications, etc.), autonomous driving, applications for government organizations, applications for the military, personal data applications, or social networks. In some configurations, cryptography can be used to implement link security. In general, cryptography can provide security through high-level (e.g., layer 3 (L3) or higher) cryptographic algorithms.

[0076] Cryptography-based security can have the advantage of being virtually unbreakable, since it can take a long time to crack the encryption algorithm. However, cryptography-based security can also be associated with certain disadvantages. For example, using 256-bit or 128-bit security keys in an encryption algorithm can add significant overhead, especially when the data packets to be sent are small. In addition, the encryption algorithm can impose a lower bound on the delay (in other words, further reducing the delay due to the use of the encryption algorithm may be difficult).

[0077] Due to the impact of encryption algorithms on latency, some scheduled downlink transmissions may not be cryptographically protected. Examples of these downlink transmissions may include MAC signaling (e.g., MAC-Control Element (CE) (MAC-CE)) (transmission latency for MAC signaling may be more important than reliability), broadcast information (e.g., SIB), and / or paging information. A malicious intruder may challenge (or even hijack) an unprotected transmission by forging a transmission with the same format as a legitimate transmission (e.g., a PDCCH transmission or a PDSCH transmission).

[0078] In some configurations, the UE may use L1 security (i.e., PHY security) to distinguish between real transmissions and forged transmissions. There may be a fundamental trade-off in communications between security (added to protect underlying communications) and performance, because adding security may result in a reduction in performance. To manage the trade-off, the network may determine the amount or level of security required based on the threats present in the communication environment (e.g., the type and parameters of security protection techniques). If the UE is being attacked, but there is no mechanism to communicate this attack information to the base station, the network may not be aware of the existence of the attack. Therefore, the network may not be able to deploy a sufficient level of security to react or respond to the attack.

[0079] In one or more configurations, adding the L1 security layer may enable the UE to identify whether the UE is under attack. In addition, based on the L1 security layer, the UE may generate or derive the probability that the attack actually occurred (e.g., the probability may be a value between 0 and 1, where probability 1 indicates that the UE is definitely under attack, and probability 0 indicates that the UE is definitely not under attack). In some further configurations, the UE may share the attack information with other nodes.

[0080] Figure 4 4 is a diagram illustrating example L1 security signaling according to one or more aspects. As shown, based on a PHY signature 410 (e.g., an amplitude modulation to phase modulation (AM / PM) impairment signature, a frequency domain residual sideband (FDRSB) signature, etc.) sent from a base station 404 to a UE 402, the UE 402 is able to identify whether a particular transmission is indeed from the base station 404. Accordingly, at 412, the UE 402 can estimate the signature associated with the incoming transmission and can calculate the likelihood that the UE 402 is attacked. The UE 412 can then send an indication of the likelihood of itself being attacked as feedback to the base station 404 at 414 (e.g., via layer 2 (L2) signaling or L3 signaling (e.g., RRC signaling)) and / or to one or more additional UEs (e.g., neighbor UE 406) at 416 (e.g., via a sidelink). Upon receiving the feedback 414, at 418, the base station 404 can decide on a manner to react or respond to the potential attack on the UE 402. At 420, the base station 404 may send an indication of the determined reaction 420 to the UE 402. In addition, at 422, the base station 404 may share the attack information with one or more additional base stations (e.g., neighbor base stations 408) via an Xn link. For example, a CU may communicate with other CUs via an Xn link, and DUs connected to the same CU may share attack information therebetween. In addition, in some configurations, the base station 404 may identify the geographic location of a potential attacker based on attack reports received from multiple UEs (e.g., by triangulation or trilateral measurement).

[0081] Figure 5 500 is a flow chart of an example method of wireless communication according to one or more aspects. At 506, UE 502 can detect a suspected forged transmission attack 552 based on PHY security at UE 502. If the probability that the purported source of the transmission is forged is greater than a predefined threshold, the transmission can correspond to a suspected forged transmission attack. For example, if UE 502 receives a transmission that purports to be from network node 504 but is associated with a PHY signature that is different from a pre-established PHY signature associated with network node 504, UE 502 can suspect that the transmission may correspond to a forged transmission attack 552, and UE 502 may be a potential victim of the suspected attack 552. The source device of the suspected forged transmission attack 552 can be referred to as a suspected / potential attacker (also known as an aggressor, interferer, or adversary) 550.

[0082] At 510 , UE 502 may send to network node 504 , and network node 504 may receive from UE 502 , an indication of a suspected forged transmission attack 552 .

[0083] In some configurations, the indication 510 of the suspected forged transmission attack 552 may include a likelihood (e.g., a probability, which may be a value between 0 and 1 on a linear scale) that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked. In some other configurations, the indication 510 of the suspected forged transmission attack 552 may include the result of the UE 502's own assessment of whether the UE 502 is being attacked (i.e., a false (0) or true (1) indication) (e.g., based on a comparison of the likelihood with a threshold, where the threshold may correspond to a suitable value (e.g., a value between 0 and 1), and in different configurations may be trained and / or adjusted based on, for example, the current communication environment, as described below). Accordingly, the indication 510 of the suspected forged transmission attack may include an indication of whether the UE 502 recognizes that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked. In one or more configurations, the UE 502 may select the content of the indication 510 based on a configuration received from the network node 504.

[0084] At 512 , UE 502 may send to network node 504 , and network node may receive from UE 502 , an indication of one or more characteristics associated with potential attacker 550 associated with suspected forged transmission attack 552 . The one or more characteristics may include one or more of the following: a slot index (an index of a slot within a frame), a time allocation (e.g., a time symbol (within a slot) on which an allocation or aggressor exists), a frequency allocation (e.g., a frequency tone (within a slot) on which an allocation or aggressor exists), a receive beam index (e.g., a transmission configuration indicator (TCI) state index associated with a receive beam), a timing offset (e.g., associated with a misalignment between an aggressor transmission and a slot or symbol timeline), a direction of arrival (DOA) of a signal (e.g., relative to the direction of a primary base station to a UE beam), a reference signal received power (RSRP) (e.g., the power of a reference signal spread over the full bandwidth and a narrowband), or a received signal strength indicator (RSSI) (e.g., the average total received power observed in an OFDM symbol containing a reference symbol for an antenna port in a measurement bandwidth over N resource blocks).

[0085] At 508, the network node 504 may send to the UE 502, and the UE 502 may receive from the network node 504, an indication of a threshold (e.g., a security threshold) for the UE 502. In one or more configurations, if the likelihood that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked is greater than the threshold, the UE 502 may identify that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked. Conversely, if the likelihood that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked is less than the threshold, the UE 502 may identify that the suspected forged transmission attack 552 does not correspond to the UE 502 being attacked.

[0086] At 518, the network node 504 can adjust the threshold. For example, the network node 504 can dynamically adjust the threshold to prevent the UE 502 and / or other UEs from overestimating or underestimating the presence of an attack.

[0087] At 520 , the network node 504 may send to the UE 502 , and the UE 502 may receive from the network node 504 , an updated indication of the threshold value following the adjustment 518 of the threshold value.

[0088] For example, if the network node 504 has been observing an increasing trend of attacks based on information collected from the network, the network node 504 may accordingly adjust the thresholds (e.g., lower the thresholds) for the UEs connected to the network node 504. For another example, the network node 504 may change (e.g., first lower and then increase) the thresholds in order to assess the potential for security threats in the environment (even if the network node 504 has not received any threat indications from the UE or the network, the network node 504 may initiate such an assessment on its own).

[0089] Accordingly, in one or more configurations, the adjustment 518 of the threshold value can be based on attack trends or associated with an assessment of the security threat environment (e.g., by the network node 504). In particular, the attack trend can be based on information from at least one network entity associated with the network node 504.

[0090] In one configuration, at 516, the UE 502 may send to the network node 504, and the network node 504 may receive from the UE 502, a request for adjustment of the threshold value prior to receiving 520 the updated indication. The adjustment 518 of the threshold value may be in response to the request 516. For example, the network node 504 may increase security for the UE 502 or the entire network based on the request 516 from the UE 502. Accordingly, the adjustment 518 of the threshold value may include a reduction of the threshold value. Furthermore, the adjustment 518 of the threshold value may be applied to the UE 502 or may be applied to a network associated with the network node.

[0091] In one configuration, at 522, via MAC-CE or RRC signaling, the network node 504 may send to the UE 502, and the UE 502 may receive from the network node 504, an indication of whether the UE 502 is allowed to share attack information with one or more additional UEs 526. The attack information may include information included in the indication of a suspected forged transmission attack 510 as described above, and / or one or more characteristics associated with the potential attacker 550 as described above.

[0092] If UE 502 is allowed to share attack information with one or more additional UEs 526, then at 524a, UE 502 can send a second indication to one or more additional UEs 526 via a sidelink regarding whether UE 502 identifies that suspected forged transmission attack 552 corresponds to UE 502 being attacked (e.g., based on a comparison of the likelihood with a threshold).

[0093] On the other hand, if UE 502 is not permitted to share attack information with one or more additional UEs 526, then at 524b, UE 502 may refrain from sending a second indication of whether UE 502 identified that suspected forged transmission attack 552 corresponds to UE 502 being attacked.

[0094] In one configuration, at 512a, the network node 504 may receive a plurality of indications of one or more characteristics (e.g., a slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a DOA of a signal, RSRP, or RSSI) associated with the potential attacker 550. The plurality of indications 512a may be received by the network node 504 from a plurality of UEs 514 including the UE 502.

[0095] At 526 , the network node 504 may identify a geographic location of the potential attacker 550 based on the plurality of indications 512 a of one or more characteristics associated with the potential attacker 550 .

[0096] In one configuration, at 528, the network node 504 may compile an adversary pool including one or more compromised identities associated with one or more attackers or one or more potential attackers including the potential attacker 550. The information about the attacker or potential attacker included in the adversary pool may be collected in a low layer (e.g., L1). The adversary pool may be used as a blacklist or block list. Each of the one or more compromised identities may be associated with one or more corresponding signatures (e.g., RF or signaling characteristics that may be used to identify the attacker or potential attacker, such as a sequence for confusing a UE).

[0097] In some configurations, if a Sybil attack is identified in the lower layers, where the attacker can send multiple data packets using different identities, some or all compromised identities can be added to the adversary pool. In some configurations, if an attacker impersonating an authorized UE is identified in the lower layers, the compromised identity can be added to the adversary pool. Accordingly, in one or more configurations, at least one compromised identity of the one or more compromised identities in the adversary pool can be associated with a Sybil attack or an impersonated identity.

[0098] At 530 , network node 504 may send the opponent pool to at least one other network node 532 via an Xn interface (ie, an interface between RAN nodes).

[0099] Figure 6600 is a flow chart of a method of wireless communication according to various aspects of the present disclosure. The method may be performed by a UE (e.g., UE 104 / 350 / 402 / 502; device 1004). At 602, the UE may detect a suspected forged transmission attack based on PHY security at the UE. For example, 602 may be performed by Fig.10 Component 198 in is executed. Figure 5 At 506 , the UE 502 can detect a suspected forged transmission attack 552 based on PHY security at the UE 502 .

[0100] At 604, the UE may send an indication of a suspected forged transmission attack to the network node. For example, 604 may be performed by Fig.10 Component 198 in is executed. Figure 5 At 510 , UE 502 may send an indication of a suspected forged transmission attack 552 to network node 504 .

[0101] Figure 7 700 is a flow chart of a method of wireless communication according to various aspects of the present disclosure. The method may be performed by a UE (e.g., UE 104 / 350 / 402 / 502; device 1004). At 702, the UE may detect a suspected forged transmission attack based on PHY security at the UE. For example, 702 may be performed by Fig.10 Component 198 in is executed. Figure 5 At 506 , the UE 502 can detect a suspected forged transmission attack 552 based on PHY security at the UE 502 .

[0102] At 706, the UE may send an indication of a suspected forged transmission attack to the network node. For example, 706 may be performed by Fig.10 Component 198 in is executed. Figure 5 At 510 , UE 502 may send an indication of a suspected forged transmission attack 552 to network node 504 .

[0103] In a configuration, refer to Figure 5 , the indication 510 of the suspected forged transmission attack 552 may be sent via L2 signaling or L3 signaling.

[0104] In one configuration, at 708, the UE may send an indication of one or more characteristics associated with a potential attacker associated with a suspected forged transmission attack. The one or more characteristics may include one or more of a time slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a DOA of a signal, RSRP, or RSSI. For example, 708 may be performed by Fig.10 Component 198 in is executed. Figure 5At 512 , UE 502 may send an indication of one or more characteristics associated with potential attacker 550 associated with suspected forged transmission attack 552 .

[0105] In a configuration, refer to Figure 5 The indication 510 of the suspected forged transmission attack 552 may include a likelihood that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked, or an indication as to whether the UE 502 recognizes that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked.

[0106] In a configuration, refer to Figure 5 If the possibility that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked is greater than a threshold, the UE 502 may identify that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked.

[0107] In one configuration, at 704, the UE may receive an indication of a threshold from a network node. For example, 704 may be Fig.10 Component 198 in is executed. Figure 5 At 508 , UE 502 may receive an indication of a threshold from network node 504 .

[0108] In one configuration, at 712, the UE may receive an updated indication of the threshold value after adjusting the threshold value. For example, 712 may be performed by Fig.10 Component 198 in is executed. Figure 5 At 520, UE 502 may receive an updated indication of the threshold value following the adjustment of the threshold value.

[0109] In one configuration, adjustments to the thresholds can be based on attack trends or in conjunction with an assessment of the security threat environment. Figure 5 , the attack trend may be based on information from at least one network entity associated with the network node 504 .

[0110] In one configuration, at 710, the UE may send a request for adjustment of the threshold before receiving the updated indication. The adjustment of the threshold may be responsive to the request. The adjustment of the threshold may include a decrease in the threshold. For example, 710 may be Fig.10 Component 198 in is executed. Figure 5 At 516, the UE 502 may send a request for an adjustment to the threshold before receiving 520 the updated indication.

[0111] In a configuration, refer to Figure 5, the adjustment 518 of the threshold may be applied to the UE 502 or may be applied to a network associated with the network node 504.

[0112] In one configuration, at 714, the UE may receive an indication via MAC-CE or RRC signaling as to whether the UE is allowed to share attack information with one or more additional UEs. For example, 714 may be performed by Fig.10 Component 198 in is executed. Figure 5 At 522, the UE 502 may receive an indication via MAC-CE or RRC signaling as to whether the UE 502 is allowed to share attack information with one or more additional UEs 526.

[0113] In some aspects, 716 may include 716a or 716b. In one configuration, at 716a, if the UE is allowed to share attack information with one or more additional UEs, the UE may send a second indication via a sidelink regarding whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked. For example, 716a may be Fig.10 Component 198 in is executed. Figure 5 At 524a, if UE 502 is allowed to share attack information with one or more additional UEs 526, UE 502 may send a second indication via a sidelink regarding whether UE 502 identifies that suspected forged transmission attack 552 corresponds to UE 502 being attacked.

[0114] Alternatively, at 716b, if the UE is not allowed to share attack information with one or more additional UEs, the UE may refrain from sending a second indication of whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked. Fig.10 Component 198 in is executed. Figure 5 At 524b, if UE 502 is not permitted to share attack information with one or more additional UEs 526, UE 502 may refrain from sending a second indication of whether UE 502 identifies that suspected forged transmission attack 552 corresponds to UE 502 being attacked.

[0115] Figure 8 800 is a flow chart of a method of wireless communication according to various aspects of the present disclosure. The method may be performed by a network node (e.g., base station 102 / 310 / 404 / 504; network entity 1002). At 802, the network node may receive an indication of a suspected forged transmission attack from a UE. The suspected forged transmission attack may be detectable based on PHY security. For example, 802 may be performed by Fig.11 Component 199 in the implementation. Figure 5At 510 , network node 504 may receive an indication of a suspected forged transmission attack 552 from UE 502 .

[0116] At 804, the network node may receive an indication of one or more characteristics associated with a potential attacker associated with a suspected forged transmission attack. The indication of the one or more characteristics may be received from the UE. For example, 804 may be received by Fig.11 Component 199 in the implementation. Figure 5 At 512 , network node 504 may receive an indication of one or more characteristics associated with potential attacker 550 associated with suspected forged transmission attack 552 .

[0117] Fig. 9 900 is a flow chart of a method of wireless communication according to various aspects of the present disclosure. The method may be performed by a network node (e.g., base station 102 / 310 / 404 / 504; network entity 1002). At 904, the network node may receive an indication of a suspected forged transmission attack from a UE. The suspected forged transmission attack may be detected based on PHY security. For example, 904 may be performed by Fig.11 Component 199 in the implementation. Figure 5 At 510 , network node 504 may receive an indication of a suspected forged transmission attack 552 from UE 502 .

[0118] At 906, the network node may receive an indication of one or more characteristics associated with a potential attacker associated with a suspected forged transmission attack. The indication of the one or more characteristics may be received from the UE. For example, 906 may be received by Fig.11 Component 199 in the implementation. Figure 5 At 512 , network node 504 may receive an indication of one or more characteristics associated with potential attacker 550 associated with suspected forged transmission attack 552 .

[0119] In a configuration, refer to Figure 5 , an indication 510 of a suspected forged transmission attack 552 may be received via L2 signaling or L3 signaling.

[0120] In one configuration, the one or more characteristics may include one or more of a slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a DOA of the signal, RSRP, or RSSI.

[0121] In a configuration, refer to Figure 5The indication 510 of the suspected forged transmission attack 552 may include a likelihood that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked, or an indication as to whether the suspected forged transmission attack 552 corresponds to the UE 502 being attacked.

[0122] In a configuration, refer to Figure 5 If the likelihood that the suspected forged transmission attack 552 corresponds to the UE 502 being attacked is greater than a threshold, then the suspected forged transmission attack 552 may correspond to the UE 502 being attacked.

[0123] In one configuration, at 902, the network node may send an indication of a threshold to the UE. For example, 902 may be Fig.11 Component 199 in the implementation. Figure 5 At 508 , the network node 504 may send an indication of the threshold to the UE 502 .

[0124] In one configuration, at 910, the network node may adjust the threshold based on the indication. For example, 910 may be performed by Fig.11 Component 199 in the implementation. Figure 5 At 518, the network node 504 may adjust the threshold based on the indication.

[0125] At 912, the network node may send an updated indication of the threshold value after adjusting the threshold value. For example, 912 may be Fig.11 Component 199 in the implementation. Figure 5 At 520 , the network node 504 may send an updated indication of the threshold value following the adjustment 518 of the threshold value.

[0126] In a configuration, refer to Figure 5 The adjustment 518 of the threshold value may be based on an attack trend or associated with an assessment of the security threat environment at the network node 504. The attack trend may be identified based on first information from at least one network entity associated with the network node 504.

[0127] In one configuration, at 908, the network node may receive a request for adjustment of the threshold before sending the updated indication. The adjustment of the threshold may be responsive to the request. The adjustment of the threshold may include a decrease in the threshold. For example, 908 may be performed by Fig.11 Component 199 in the implementation. Figure 5 At 516, the network node 504 may receive a request for an adjustment to the threshold before sending the updated indication.

[0128] In a configuration, refer to Figure 5, the adjustment 518 of the threshold may be applied to the UE 502 or may be applied to a network associated with the network node 504.

[0129] In one configuration, at 914, the network node may send an indication via MAC-CE or RRC signaling as to whether the UE is allowed to share attack information with one or more additional UEs. For example, 914 may be Fig.11 Component 199 in the implementation. Figure 5 At 522, the network node 504 may send an indication via MAC-CE or RRC signaling as to whether the UE 502 is allowed to share the attack information with one or more additional UEs 526.

[0130] In one configuration, at 916, the network node may receive multiple indications of one or more characteristics associated with a potential attacker. The multiple indications may be received from multiple UEs including a UE. For example, 916 may be received by Fig.11 Component 199 in the implementation. Figure 5 At 512a , network node 504 may receive a plurality of indications of one or more characteristics associated with potential attacker 550 .

[0131] At 918, the network node may identify a geographic location of the potential attacker based on the plurality of indications of one or more characteristics associated with the potential attacker. For example, 918 may be performed by Fig.11 Component 199 in the implementation. Figure 5 At 526 , the network node 504 may identify a geographic location of the potential attacker 550 based on the plurality of indications 512 a of one or more characteristics associated with the potential attacker 550 .

[0132] In one configuration, at 920, the network node may compile an adversary pool that includes one or more compromised identities associated with one or more attackers or one or more potential attackers including the potential attacker. Each of the one or more compromised identities may be associated with one or more corresponding signatures. For example, 920 may be composed of Fig.11 Component 199 in the implementation. Figure 5 At 528 , network node 504 may compile an adversary pool that includes one or more compromised identities associated with one or more attackers or one or more potential attackers including potential attacker 550 .

[0133] In one configuration, at least one of the one or more compromised identities may be associated with a Sybil attack or an impersonated identity.

[0134] In one configuration, at 922, the network node may send the opponent pool to at least one other network node via an Xn interface. For example, 922 may be Fig.11 Component 199 in the implementation. Figure 5 At 530, network node 504 may send the opponent pool to at least one other network node 532 via an Xn interface.

[0135] Fig.101000 is a diagram illustrating an example of a hardware implementation for an apparatus 1004 according to various aspects of the present disclosure. The apparatus 1004 may be a UE, a component of a UE, or may implement UE functionality. In some aspects, the apparatus 1004 may include a cellular baseband processor 1024 (also referred to as a modem) coupled to one or more transceivers 1022 (e.g., a cellular RF transceiver). The cellular baseband processor 1024 may include on-chip memory 1024'. In some aspects, the apparatus 1004 may also include one or more subscriber identity module (SIM) cards 1020 and an application processor 1006 coupled to a secure digital (SD) card 1008 and a screen 1010. The application processor 1006 may include on-chip memory 1006'. In some aspects, the device 1004 may also include a Bluetooth module 1012, a WLAN module 1014, an SPS module 1016 (e.g., a GNSS module), one or more sensor modules 1018 (e.g., a barometric pressure sensor / altimeter; a motion sensor such as an inertial management unit (IMU), a gyroscope, and / or an accelerometer; light detection and ranging (LIDAR), radio-aided detection and ranging (RADAR), sound navigation and ranging (SONAR), a magnetometer, audio, and / or other technologies for positioning), an additional memory module 1026, a power source 1030, and / or a camera 1032. The Bluetooth module 1012, the WLAN module 1014, and the SPS module 1016 may include an on-chip transceiver (TRX) (or in some cases, only a receiver (RX)). The Bluetooth module 1012, the WLAN module 1014, and the SPS module 1016 may include their own dedicated antennas and / or communicate using antennas 1080. The cellular baseband processor 1024 communicates with the UE 104 and / or with the RU associated with the network entity 1002 via one or more antennas 1080 through the transceiver 1022. The cellular baseband processor 1024 and the application processor 1006 can each include a computer-readable medium / memory 1024', 1006'. The additional memory module 1026 can also be considered as a computer-readable medium / memory. Each computer-readable medium / memory 1024', 1006', 1026 can be non-temporary. The cellular baseband processor 1024 and the application processor 1006 are each responsible for general processing, including executing software stored on the computer-readable medium / memory. When executed by the cellular baseband processor 1024 / application processor 1006, the software enables the cellular baseband processor 1024 / application processor 1006 to perform the various functions described above. The computer-readable medium / memory can also be used to store data manipulated by the cellular baseband processor 1024 / application processor 1006 when executing the software.The cellular baseband processor 1024 / application processor 1006 may be a component of the UE 350 and may include the memory 360 and / or at least one of the TX processor 368, the RX processor 356, and the controller / processor 359. In one configuration, the device 1004 may be a processor chip (modem and / or application) and only include the cellular baseband processor 1024 and / or the application processor 1006, and in another configuration, the device 1006 may be the entire UE (e.g., see. Figure 3 350) and includes additional modules of device 1004.

[0136] As described above, component 198 is configured to detect suspicious forged transmission attacks based on PHY security at UE. Component 198 can be configured to send an indication of a suspicious forged transmission attack to a network node. Component 198 can be in a cellular baseband processor 1024, in an application processor 1006, or in both a cellular baseband processor 1024 and an application processor 1006. Component 198 can be one or more hardware components specifically configured to perform the process / algorithm, implemented by one or more processors configured to perform the process / algorithm, stored in a computer-readable medium for one or more processors to implement, or some combination thereof. As shown, device 1004 may include various components configured for various functions. In one configuration, device 1004 and in particular cellular baseband processor 1024 and / or application processor 1006 include a unit for detecting suspicious forged transmission attacks based on PHY security at UE. Device 1004 and in particular cellular baseband processor 1024 and / or application processor 1006 include a unit for sending an indication of a suspicious forged transmission attack to a network node.

[0137] In one configuration, the indication of the suspected forged transmission attack may be sent via L2 signaling or L3 signaling. In one configuration, the device 1004 and in particular the cellular baseband processor 1024 and / or the application processor 1006 include a unit for sending an indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack. The one or more characteristics may include one or more of a time slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a DOA of a signal, RSRP, or RSSI. In one configuration, the indication of the suspected forged transmission attack may include the possibility that the suspected forged transmission attack corresponds to the UE being attacked, or an indication of whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked. In one configuration, if the possibility that the suspected forged transmission attack corresponds to the UE being attacked is greater than a threshold, the UE may identify that the suspected forged transmission attack corresponds to the UE being attacked. In one configuration, the device 1004 and in particular the cellular baseband processor 1024 and / or the application processor 1006 include a unit for receiving an indication of a threshold from a network node. In one configuration, the device 1004 and in particular the cellular baseband processor 1024 and / or the application processor 1006 include a unit for receiving an updated indication of the threshold value after the adjustment of the threshold value. In one configuration, the adjustment of the threshold value may be based on an attack trend or associated with an assessment of the security threat environment. The attack trend may be based on information from at least one network entity associated with the network node. In one configuration, the device 1004 and in particular the cellular baseband processor 1024 and / or the application processor 1006 include a unit for sending a request for adjustment of the threshold value before receiving the updated indication. The adjustment of the threshold value may be in response to the request. The adjustment of the threshold value may include a reduction of the threshold value. In one configuration, the adjustment of the threshold value may be applied to the UE, or may be applied to the network associated with the network node. In one configuration, the device 1004 and in particular the cellular baseband processor 1024 and / or the application processor 1006 include a unit for receiving an indication of whether the UE is allowed to share attack information with one or more additional UEs via MAC-CE or RRC signaling. In one configuration, the apparatus 1004 and in particular the cellular baseband processor 1024 and / or the application processor 1006 include a unit for transmitting via a sidelink a second indication of whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked if the UE is allowed to share attack information with one or more additional UEs. Alternatively, the apparatus 1004 and in particular the cellular baseband processor 1024 and / or the application processor 1006 include a unit for refraining from transmitting a second indication of whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked if the UE is not allowed to share attack information with one or more additional UEs.

[0138] The described means may be a component 198 of the apparatus 1004 configured to perform the functions recited by the described means. As described above, the apparatus 1004 may include a TX processor 368, an RX processor 356, and a controller / processor 359. Thus, in one configuration, the described means may be the TX processor 368, the RX processor 356, and / or the controller / processor 359 configured to perform the functions recited by the described means.

[0139] Fig.11 1100 is a diagram illustrating an example of a hardware implementation for a network entity 1102 according to various aspects of the present disclosure. The network entity 1102 may be a BS, a component of a BS, or may implement BS functionality. The network entity 1102 may include at least one of a CU 1110, a DU 1130, or a RU 1140. For example, depending on the layer functionality handled by the component 199, the network entity 1102 may include a CU 1110; both a CU 1110 and a DU 1130; each of the CU 1110, the DU 1130, and the RU 1140; the DU 1130; both a DU 1130 and a RU 1140; or the RU 1140. The CU 1110 may include a CU processor 1112. The CU processor 1112 may include an on-chip memory 1112'. In some aspects, the CU 1110 may also include an additional memory module 1114 and a communication interface 1118. CU 1110 communicates with DU 1130 via a midhaul link such as an F1 interface. DU 1130 may include a DU processor 1132. DU processor 1132 may include on-chip memory 1132'. In some aspects, DU 1130 may also include an additional memory module 1134 and a communication interface 1138. DU 1130 communicates with RU 1140 via a fronthaul link. RU 1140 may include a RU processor 1142. RU processor 1142 may include on-chip memory 1142'. In some aspects, RU 1140 may also include an additional memory module 1144, one or more transceivers 1146, an antenna 1180, and a communication interface 1148. RU 1140 communicates with UE 104. On-chip memory 1112', 1132', 1142' and additional memory modules 1114, 1134, 1144 may each be considered a computer-readable medium / memory. Each computer readable medium / memory may be non-transitory. Each of the processors 1112, 1132, 1142 is responsible for general processing, including executing software stored on the computer readable medium / memory. The software, when executed by the corresponding processor, causes the processor to perform the various functions described above. The computer readable medium / memory may also be used to store data manipulated by the processor when executing the software.

[0140] As described above, component 199 is configured to receive an indication of a suspected forged transmission attack from a UE. The suspected forged transmission attack may be detected based on PHY security. Component 199 may be configured to receive an indication of one or more characteristics associated with a potential attacker associated with a suspected forged transmission attack. An indication of one or more characteristics may be received from a UE. Component 199 may be within one or more processors of one or more of CU 1110, DU 1130, and RU 1140. Component 199 may be one or more hardware components specifically configured to execute the process / algorithm, implemented by one or more processors configured to execute the process / algorithm, stored in a computer-readable medium for one or more processors to implement, or some combination thereof. Network entity 1102 may include various components configured for various functions. In one configuration, network entity 1102 includes a unit for receiving an indication of a suspected forged transmission attack from a UE. Network entity 1102 includes a unit for receiving an indication of one or more characteristics associated with a potential attacker associated with a suspected forged transmission attack. An indication of one or more characteristics may be received from a UE. Suspected forged transmission attacks can be detected based on PHY security.

[0141] In one configuration, an indication of a suspected forged transmission attack may be received via L2 signaling or L3 signaling. In one configuration, one or more characteristics may include one or more of a time slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a DOA of a signal, RSRP, or RSSI. In one configuration, an indication of a suspected forged transmission attack may include a possibility that the suspected forged transmission attack corresponds to an attack on the UE, or an indication of whether the suspected forged transmission attack corresponds to an attack on the UE. In one configuration, if the possibility that the suspected forged transmission attack corresponds to an attack on the UE is greater than a threshold, the suspected forged transmission attack may correspond to an attack on the UE. In one configuration, the network entity 1102 includes a unit for sending an indication of a threshold to the UE. In one configuration, the network entity 1102 includes a unit for adjusting the threshold based on the indication; and a unit for sending an updated indication of the threshold after the adjustment of the threshold. In one configuration, the adjustment of the threshold may be based on an attack trend, or may be associated with an assessment of a security threat environment at a network node. The attack trend may be identified based on first information from at least one network entity associated with the network node. In one configuration, the network entity 1102 includes a unit for receiving a request for adjustment of the threshold before sending the updated indication. The adjustment of the threshold may be in response to the request. The adjustment of the threshold may include a reduction of the threshold. In one configuration, the adjustment of the threshold may be applied to the UE, or may be applied to a network associated with the network node. In one configuration, the network entity 1102 includes a unit for sending an indication of whether the UE is allowed to share attack information with one or more additional UEs via MAC-CE or RRC signaling. In one configuration, the network entity 1102 includes a unit for receiving multiple indications of one or more characteristics associated with a potential attacker. Multiple indications may be received from multiple UEs including the UE. The network entity 1102 includes a unit for identifying the geographic location of a potential attacker based on multiple indications of one or more characteristics associated with the potential attacker. In one configuration, the network entity 1102 includes a unit for compiling an adversary pool, which includes one or more compromised identities associated with one or more attackers or one or more potential attackers including the potential attacker. Each of the one or more compromised identities may be associated with one or more corresponding signatures. In one configuration, at least one of the one or more compromised identities may be associated with a Sybil attack or an impersonated identity.In one configuration, the network entity 1102 includes means for sending the adversary pool to at least one other network node via an Xn interface.

[0142] The described means may be a component 199 of the network entity 1102 configured to perform the functions recited by the described means. As described above, the network entity 1102 may include a TX processor 316, an RX processor 370, and a controller / processor 375. Thus, in one configuration, the described means may be the TX processor 316, the RX processor 370, and / or the controller / processor 375 configured to perform the functions recited by the described means.

[0143] Return to reference Figure 4-11 , the UE may detect a suspected forged transmission attack based on PHY security at the UE. The UE may send to a network node and the network node may receive from the UE an indication of the suspected forged transmission attack. The network node may receive from the UE an indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack. Accordingly, the L1 security of the wireless communication system may be optimized. In particular, the trade-off between network security and delay overhead may be optimized.

[0144] It should be understood that the specific order or hierarchy of the blocks in the disclosed process / flowchart is an illustration of an exemplary manner. Based on design preferences, it should be understood that the specific order or hierarchy of the blocks in the process / flowchart can be rearranged. In addition, some blocks can be combined or omitted. The attached method claims present the elements of each block in an exemplary order and are not limited to the specific order or hierarchy presented.

[0145] The previous description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein can be applied to other aspects. Therefore, the claims are not limited to the aspects shown herein, but to meet the full scope consistent with the language claims. Reference elements in the singular form do not represent "one and only one" (unless specifically stated), but "one or more". "If", "when..." and "when..." terms such as "at the same time" do not imply a direct temporal relationship or reaction. That is, these phrases (for example, "when...") do not mean to respond to the occurrence of the action or to take action immediately during the occurrence of the action, but only mean that if a certain condition is met, the action will occur, but does not require a specific or immediate time limit for the occurrence of the action. The word "exemplary" is used herein to represent "used as an example, instance or illustration". Any aspect described herein as "exemplary" is not necessarily interpreted as being preferred to or conducive to other aspects. Unless otherwise specified, the term "some" refers to one or more. Combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" include any combination of A, B, and / or C, and may include multiple A, multiple B, or multiple C. Specifically, combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B, and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" may be only A, only B, only C, A and B, A and C, B and C, or A and B and C, wherein any such combination may contain one or more members of A, B, or C. A set should be interpreted as a set of elements, wherein the elements are numbered one or more. Thus, for a set of X, X will include one or more elements. If a first device receives data from or sends data to a second device, the data may be received / sent directly between the first device and the second device, or indirectly received / sent between the first device and the second device through a group of devices. All structural and functional equivalents of the elements of the various aspects described throughout the present disclosure are known or will be known subsequently to those of ordinary skill in the art, are expressly incorporated herein by reference, and are covered by the claims. Moreover, nothing disclosed herein is dedicated to the public, regardless of whether these disclosures are clearly recorded in the claims. Words "module", "mechanism", "element", "equipment", etc. may not replace the word "unit". Therefore, no claim element is to be interpreted as a functional module unless the element is explicitly described using the phrase "unit for...".

[0146] As used herein, the phrase "based on" should not be interpreted as a reference to a closed set of information, one or more conditions, one or more factors, etc. In other words, the phrase "based on A" (where "A" can be information, conditions, factors, etc.) should be interpreted as "based at least on A" unless specifically stated otherwise.

[0147] The following aspects are merely illustrative and may be combined with other aspects or aspects taught herein, and are not limited thereto.

[0148] Aspect 1 is a method of wireless communication at a UE, comprising: detecting a suspected forged transmission attack based on PHY security at the UE; and sending an indication of the suspected forged transmission attack to a network node.

[0149] Aspect 2 is a method according to aspect 1, wherein the indication of the suspected forged transmission attack is sent via L2 signaling or L3 signaling.

[0150] Aspect 3 is a method according to any one of Aspects 1 and 2, further comprising: sending an indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack, wherein the one or more characteristics include a time slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a signal's DOA, RSRP, or RSSI.

[0151] Aspect 4 is a method according to any one of Aspects 1 to 3, wherein the indication of the suspected forged transmission attack includes a possibility that the suspected forged transmission attack corresponds to the UE being attacked, or an indication of whether the UE recognizes that the suspected forged transmission attack corresponds to the UE being attacked.

[0152] Aspect 5 is a method according to aspect 4, wherein if the possibility that the suspected forged transmission attack corresponds to the UE being attacked is greater than a threshold, the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked.

[0153] Aspect 6 is a method according to aspect 5, further comprising: receiving an indication of the threshold from the network node.

[0154] Aspect 7 is a method according to aspect 6, further comprising: receiving an updated indication of the threshold value after adjusting the threshold value.

[0155] Aspect 8 is a method according to Aspect 7, wherein the adjustment of the threshold is based on attack trends or is associated with an assessment of the security threat environment, and the attack trends are based on information from at least one network entity associated with the network node.

[0156] Aspect 9 is a method according to Aspect 7, further comprising: sending a request for adjustment of the threshold before receiving the updated indication, wherein the adjustment of the threshold is in response to the request, and wherein the adjustment of the threshold includes a reduction of the threshold.

[0157] Aspect 10 is a method according to aspect 9, wherein the adjustment of the threshold is applied to the UE or to a network associated with the network node.

[0158] Aspect 11 is a method according to any one of aspects 4 to 10, further comprising: receiving an indication of whether the UE is allowed to share attack information with one or more additional UEs via MAC-CE or RRC signaling.

[0159] Aspect 12 is a method according to Aspect 11, further comprising: if the UE is allowed to share the attack information with the one or more additional UEs, sending a second indication via a side link as to whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked; or if the UE is not allowed to share the attack information with the one or more additional UEs, prohibiting the sending of the second indication as to whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked.

[0160] Aspect 13 is a method of wireless communication at a network node, comprising: receiving an indication of a suspected forged transmission attack from a UE, wherein the suspected forged transmission attack is detected based on PHY security; and receiving an indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack, wherein the indication of the one or more characteristics is received from the UE.

[0161] Aspect 14 is a method according to aspect 13, wherein the indication of the suspected forged transmission attack is received via L2 signaling or L3 signaling.

[0162] Aspect 15 is a method according to any one of Aspects 13 and 14, wherein the one or more characteristics include one or more of time slot index, time allocation, frequency allocation, receive beam index, timing offset, DOA of the signal, RSRP or RSSI.

[0163] Aspect 16 is a method according to any one of aspects 13 to 15, wherein the indication of the suspected forged transmission attack includes a possibility that the suspected forged transmission attack corresponds to the UE being attacked, or an indication of whether the suspected forged transmission attack corresponds to the UE being attacked.

[0164] Aspect 17 is a method according to aspect 16, wherein if the possibility that the suspected forged transmission attack corresponds to the UE being attacked is greater than a threshold, then the suspected forged transmission attack corresponds to the UE being attacked.

[0165] Aspect 18 is a method according to aspect 17, further comprising: sending an indication of the threshold to the UE.

[0166] Aspect 19 is a method according to aspect 18, further comprising: adjusting the threshold based on the indication; and sending an updated indication of the threshold after the adjustment of the threshold.

[0167] Aspect 20 is a method according to Aspect 19, wherein the adjustment of the threshold is based on an attack trend or is associated with an assessment of the security threat environment at the network node, and the attack trend is identified based on first information from at least one network entity associated with the network node.

[0168] Aspect 21 is a method according to Aspect 19, further comprising: receiving a request for adjustment of the threshold before sending the updated indication, wherein the adjustment of the threshold is in response to the request, and wherein the adjustment of the threshold includes a reduction of the threshold.

[0169] Aspect 22 is a method according to aspect 21, wherein the adjustment of the threshold is applied to the UE or to a network associated with the network node.

[0170] Aspect 23 is a method according to any one of aspects 16 to 22, further comprising: sending an indication of whether the UE is allowed to share attack information with one or more additional UEs via MAC-CE or RRC signaling.

[0171] Aspect 24 is a method according to any one of Aspects 13 to 23, further comprising: receiving multiple indications of the one or more characteristics associated with the potential attacker, wherein the multiple indications are received from multiple UEs including the UE; and identifying the geographic location of the potential attacker based on the multiple indications of the one or more characteristics associated with the potential attacker.

[0172] Aspect 25 is a method according to any one of Aspects 13 to 24, further comprising: compiling an adversary pool, the adversary pool comprising one or more compromised identities associated with one or more attackers or one or more potential attackers including the potential attacker, wherein each of the one or more compromised identities is associated with one or more corresponding signatures.

[0173] Aspect 26 is a method according to aspect 25, wherein at least one of the one or more compromised identities is associated with a Sybil attack or an impersonated identity.

[0174] Aspect 27 is a method according to any one of aspects 25 and 26, further comprising: sending the opponent pool to at least one other network node via an Xn interface.

[0175] Aspect 28 is an apparatus for wireless communication, comprising: at least one processor coupled to a memory, and based at least in part on information stored in the memory, the at least one processor is configured to implement the method as described in any one of Aspects 1 to 27.

[0176] Aspect 29 may be combined with Aspect 28 and further include a transceiver coupled to the at least one processor.

[0177] Aspect 30 is an apparatus for wireless communication, comprising a unit for implementing any one of aspects 1 to 27.

[0178] Aspect 31 is a non-transitory computer-readable storage medium storing computer-executable code, wherein the code, when executed by a processor, causes the processor to implement any one of aspects 1 to 27.

[0179] Various aspects have been described herein. These and other aspects are within the scope of the following claims.

Claims

1. An apparatus for wireless communication at a user equipment (UE), comprising: Memory; as well as at least one processor coupled to the memory and, based at least in part on the information stored in the memory, configured to: detecting a suspected forged transmission attack based on physical layer (PHY) security at the UE; as well as An indication of the suspected forged transmission attack is sent to a network node.

2. The device according to claim 1, wherein: The indication of the suspected forged transmission attack is sent via layer 2 (L2) signaling or layer 3 (L3) signaling.

3. The apparatus of claim 1 , wherein the at least one processor is further configured to: sending an indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack, wherein The one or more characteristics include one or more of a time slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a direction of arrival (DOA) of a signal, a reference signal received power (RSRP), or a received signal strength indicator (RSSI).

4. The device according to claim 1, wherein: The indication of the suspected forged transmission attack includes a likelihood that the suspected forged transmission attack corresponds to the UE being attacked, or an indication of whether the UE recognizes that the suspected forged transmission attack corresponds to the UE being attacked.

5. The device according to claim 4, wherein: If the possibility that the suspected forged transmission attack corresponds to the UE being attacked is greater than a threshold, the UE recognizes that the suspected forged transmission attack corresponds to the UE being attacked.

6. The apparatus of claim 5, wherein the at least one processor is further configured to: An indication of the threshold is received from the network node.

7. The apparatus of claim 6, wherein the at least one processor is further configured to: An updated indication of the threshold value is received following the adjustment of the threshold value.

8. The device according to claim 7, wherein: The adjustment of the threshold is based on an attack trend or is associated with an assessment of a security threat environment, and the attack trend is based on first information from at least one network entity associated with the network node.

9. The apparatus of claim 7, wherein the at least one processor is further configured to: A request for said adjustment of said threshold is sent prior to receiving said updated indication, wherein: The adjustment of the threshold is in response to the request, and wherein the adjustment of the threshold comprises a decrease of the threshold.

10. The device according to claim 9, wherein: The adjustment of the threshold is applied to the UE or to a network associated with the network node.

11. The apparatus of claim 4, wherein the at least one processor is further configured to: An indication is received via medium access control (MAC)-control element (CE) (MAC-CE) or radio resource control (RRC) signaling as to whether the UE is allowed to share attack information with one or more additional UEs.

12. The apparatus of claim 11, wherein the at least one processor is further configured to: If the UE is allowed to share the attack information with the one or more additional UEs, sending a second indication via a sidelink regarding whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked; or If the UE is not allowed to share the attack information with the one or more additional UEs, then refraining from sending the second indication of whether the UE identifies that the suspected forged transmission attack corresponds to the UE being attacked.

13. The apparatus of claim 1, further comprising a transceiver coupled to the at least one processor.

14. A method of wireless communication at a user equipment (UE), comprising: detecting a suspected forged transmission attack based on physical layer (PHY) security at the UE; as well as An indication of the suspected forged transmission attack is sent to a network node.

15. An apparatus for wireless communication at a network node, comprising: Memory; as well as at least one processor coupled to the memory and, based at least in part on the information stored in the memory, configured to: receiving an indication of a suspected forged transmission attack from a user equipment (UE), the suspected forged transmission attack being detected based on physical layer (PHY) security; and An indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack is received, the indication of the one or more characteristics being received from the UE.

16. The device according to claim 15, wherein: The indication of the suspected forged transmission attack is received via layer 2 (L2) signaling or layer 3 (L3) signaling.

17. The device according to claim 15, wherein: The one or more characteristics include one or more of a time slot index, a time allocation, a frequency allocation, a receive beam index, a timing offset, a direction of arrival (DOA) of a signal, a reference signal received power (RSRP), or a received signal strength indicator (RSSI).

18. The device according to claim 15, wherein: The indication of the suspected forged transmission attack includes a likelihood that the suspected forged transmission attack corresponds to the UE being attacked, or an indication as to whether the suspected forged transmission attack corresponds to the UE being attacked.

19. The device according to claim 18, wherein: If the possibility that the suspected forged transmission attack corresponds to the UE being attacked is greater than a threshold, the suspected forged transmission attack corresponds to the UE being attacked.

20. The apparatus of claim 19, wherein the at least one processor is further configured to: An indication of the threshold is sent to the UE.

21. The apparatus of claim 20, wherein the at least one processor is further configured to: adjusting the threshold based on the indication; and An updated indication of the threshold value is sent following the adjustment of the threshold value.

22. The device according to claim 21, wherein The adjustment of the threshold is based on an attack trend or is associated with an assessment of a security threat environment at the network node, and the attack trend is identified based on first information from at least one network entity associated with the network node.

23. The apparatus of claim 21 , wherein the at least one processor is further configured to: receiving a request for said adjustment of said threshold value prior to sending said updated indication, wherein: The adjustment of the threshold is in response to the request, and wherein the adjustment of the threshold comprises a decrease of the threshold.

24. The device according to claim 23, wherein: The adjustment of the threshold is applied to the UE or to a network associated with the network node.

25. The apparatus of claim 18, wherein the at least one processor is further configured to: An indication of whether the UE is allowed to share attack information with one or more additional UEs is sent via medium access control (MAC)-control element (CE) (MAC-CE) or radio resource control (RRC) signaling.

26. The apparatus of claim 15, wherein the at least one processor is further configured to: receiving a plurality of indications of the one or more characteristics associated with the potential attacker, wherein: The plurality of indications are received from a plurality of UEs including the UE; as well as A geographic location of the potential attacker is identified based on the plurality of indications of the one or more characteristics associated with the potential attacker.

27. The apparatus of claim 15, wherein the at least one processor is further configured to: compiling an adversary pool comprising one or more compromised identities associated with one or more attackers or one or more potential attackers including the potential attacker, wherein: Each compromised identity of the one or more compromised identities is associated with one or more corresponding signatures.

28. The device according to claim 27, wherein At least one of the one or more compromised identities is associated with a Sybil attack or an impersonated identity.

29. The apparatus of claim 27, further comprising a transceiver coupled to the at least one processor, wherein: The at least one processor is further configured to: The opponent pool is sent to at least one other network node via an Xn interface.

30. A method of wireless communication at a network node, comprising: receiving an indication of a suspected forged transmission attack from a user equipment (UE), the suspected forged transmission attack being detected based on physical layer (PHY) security; as well as An indication of one or more characteristics associated with a potential attacker associated with the suspected forged transmission attack is received, the indication of the one or more characteristics being received from the UE.

Images