Secure physical random access channel resources for trusted user equipment

Abstract

The present disclosure relates to a technique for configuring secure (or hidden) physical random access channel (PRACH) resources for trusted user equipment (UE) in a wireless communication network. According to the technique, a network node signals a set of secure PRACH resources, each having an ID, to a trusted UE, preferably by using an encrypted message. When it is detected that a set of common PRACH resources currently used by the trusted UE for PRACH preamble transmission is subjected to a hostile attack (e.g., interference attack), the network node selects one or more secure PRACH resources from the set of secure PRACH resources that may be used in place of the common PRACH resources for PRACH preamble transmission. The ID of the selected secure PRACH resource is signaled by the network node to the UE. The PRACH resources so configured are better protected from hostile attacks.

Description

Technical Field

[0001] The present disclosure relates generally to the field of wireless communications, and more particularly to techniques for using hidden (or in other words, secure) physical random access channel (PRACH) resources for trusted user equipment (UE) in a wireless communication network. Background Art

[0002] Considering the potential applications of the upcoming sixth generation (6G) communication technology, it can be seen that it will be suitable for supporting more applications (including functions and optimizations) than the fifth generation (5G) communication technology. One of the areas of growth is campus networks (e.g., for industrial use), which are likely to include critical communications. Critical industries cannot tolerate interruptions to their production lines or operations due to the unavailability or unreliability of their communication channels. This is one of the main reasons why they are reluctant to use wireless / mobile technologies in their operational technology (OT) communication architecture. This concern has also been repeatedly raised for 5G industrial use cases. Another important area of ​​use is public safety, where robust design is even more important.

[0003] One of the main factors related to critical communications is the ability to resist interference, which has not been carefully considered in cellular communication system design so far. The traditional approach is to first detect and locate the presence of jammers, and then mitigate the interference of jammers by using different anti-interference means. The overall operation is achieved in a passive way. However, smart jammers can adapt their strategies by observing the reaction of the victim network. For example, if the jammer does not observe the network reaction at all, it can decide to increase its power or, on the contrary, stop sending any signal in order not to be detected.

[0004] Therefore, rather than dealing with smart jammers in a passive manner, it is better to provide built-in anti-jamming capabilities or resilience against jammers from the beginning of 6G communication technology (i.e., in an active manner) so that jammers cannot / are more difficult to affect the operation of the entire communication system. In this regard, PRACH is particularly interesting because it is one of the communication channels most vulnerable to jammer attacks. Until now, information sent over PRACH has been completely open to any device that can read the broadcast information. In view of this, even handheld smart jammers can easily attack communication systems through PRACH. Summary of the invention

[0005] This Summary is provided to introduce a selection of concepts in a simplified form that are further described below in the Detailed Description. This Summary is not intended to identify key features of the disclosure, nor is it intended to be used to limit the scope of the disclosure.

[0006] The purpose of the present disclosure is to provide a technical solution that allows switching from common PRACH resources to secure PRACH resources when needed (e.g., in case of an interference attack on common PRACH resources).

[0007] The above objects are achieved by the features of the independent claims in the attached claims. Further embodiments and examples are apparent from the dependent claims, the detailed description and the drawings.

[0008] According to a first aspect, a network node in a wireless communication network is provided. The network node includes at least one processor and at least one memory. At least one memory includes computer program code. At least one memory and computer program code are configured to, together with at least one processor, cause the network node to perform at least the following operations. First, the network node signals at least one common PRACH resource to at least one target (i.e., trusted) UE. Next, the network node signals at least one secure PRACH resource to each target UE in at least one target UE. Each secure PRACH resource in at least one secure PRACH resource has an identifier (ID). Then, the network node signals the ID of an activated secure PRACH resource in at least one secure PRACH resource to each target UE in at least one target UE. The activated secure PRACH resource can be used to replace at least one common PRACH resource. Thereafter, the network node monitors the PRACH preamble code from each target UE in at least one target UE based on at least one common PRACH resource or an activated secure PRACH resource. By dividing all PRACH resources into a common PRACH resource set (available to all UEs) and a secure PRACH resource set (available only to target or trusted UEs), the network node can allow the target UE to perform a common to secure PRACH resource switch when needed, thereby providing secure communication between the target UE and the network node (or any other network node). In addition, signaling at least one secure PRACH resource requires more resources than signaling the ID of the activated secure PRACH resource. This is because the PRACH resource configuration includes many parameters, while the ID is only a number. Therefore, it is beneficial to signal at least one secure PRACH resource infrequently, while allowing signaling for activating a certain secure PRACH resource to be sent more frequently, thereby providing flexibility. Then, it is feasible to signal the secure PRACH resource using radio resource control (RRC) signaling, while the activation of a certain secure PRACH resource can be accomplished using physical layer or medium access control (MAC) layer signaling.

[0009] In an exemplary embodiment of the first aspect, at least one memory and computer program code are further configured to, with at least one processor, cause the network node to signal an indication together with an ID of the activated secure PRACH resource, the indication indicating that each of the at least one target UE is allowed to: (i) initiate a random access (RA) procedure based on the activated secure PRACH resource; or (ii) initiate an RA procedure based on at least one common PRACH resource, and if the RA procedure based on the at least one common PRACH resource is unsuccessful, switch from the at least one common PRACH resource to the activated secure PRACH resource. The indication can provide flexibility for the UE side to decide the use of PRACH resources.

[0010] In an exemplary embodiment of the first aspect, at least one memory and computer program code are further configured to, with at least one processor, cause the network node to signal at least one secure PRACH resource in an encrypted message. In this embodiment, the encrypted message is encrypted using an encryption key known in advance to each of the at least one target UE (e.g., for a public security UE, the encryption key may be set prior to any network connection, or the target UE may be preconfigured to use the encryption key on a secure communication channel between the network node and the target UE). By using an encrypted message, the chance of a malicious UE learning of the secure PRACH resource may be minimized.

[0011] In an exemplary embodiment of the first aspect, at least one memory and computer program code are configured to, together with at least one processor, cause the network node to signal activated secure PRACH resources in response to an interference attack on at least one public PRACH resource. In this embodiment, the target UE can immediately (upon receiving the activated secure PRACH resource) switch from the public PRACH resource to the activated secure PRACH resource, thereby minimizing the possibility of further interference. This is because interference with secure PRACH resources is difficult because these resources can only be found by performing a blind search for the PRACH preamble sent by the target UE. This is actually impossible because it would require scanning across time, frequency, preamble format, and signature space using a PRACH receiver. Therefore, a malicious UE, or in other words, a jammer would need to include such a preamble search function and run it extensively before being able to find secure PRACH resources configured by the network node. In addition, secure PRACH resources are randomly selected by the network node, which makes it more difficult to find secure PRACH resources.

[0012] In an exemplary embodiment of the first aspect, at least one secure PRACH resource is valid within a geographic area including one or more cells (e.g., within a radio access network (RAN) notification area (RNA) preconfigured for the target UE). If the target UE moves quickly from one geographic area to another, it will be more difficult for a malicious UE to find the secure PRACH resources of a given cell within a given geographic area. Another benefit provided by this embodiment is that when the target UE has received signaling of at least one secure PRACH resource through cell 1 and the same signaling is also valid for cell 2, the target UE can move from cell 1 to cell 2 and use the secure PRACH resources in cell 2 after receiving an activation indication from cell 2 and before using public PRACH resources to make a secure connection with cell 2. In this way, the UE can connect to a cell that is under an interference attack, which has made the public PRACH resources in the cell unavailable.

[0013] In an exemplary embodiment of the first aspect, the ID of the activated secure PRACH resource includes at least one of the following: the format of the PRACH preamble; the system frame and subframe to send the PRACH preamble; the time domain position of the PRACH preamble; the frequency domain position of the PRACH preamble; and the logical root sequence index. By using such an ID of the activated secure PRACH resource, the activated secure PRACH resource can be more effectively "hidden" from malicious UEs.

[0014] In an exemplary embodiment of the first aspect, at least one memory and computer program code are further configured to, with at least one processor, cause the network node to signal, together with the activated secure PRACH resources, a duration for which the activated secure PRACH resources are valid. In other words, the network node may indicate how long a certain PRACH configuration defined by one or more secure PRACH resources will be activated. This may minimize the chance that a malicious UE (e.g., a jammer) learns of the activated secure PRACH resources, since the malicious UE will only have a limited time to find the activated secure PRACH resources. In addition, by using a timer for activating certain secure PRACH resources, PRACH resource allocation in the wireless communication network may be efficiently adjusted.

[0015] According to a second aspect, a UE in a wireless communication network is provided. The UE includes at least one processor and at least one memory. The at least one memory includes a computer program code. The at least one memory and the computer program code are configured to, together with the at least one processor, cause the UE to perform at least the following operations. First, the UE receives at least one common physical random access channel (PRACH) resource from a network node. Next, the UE receives at least one secure PRACH resource from the network node, another network node, or another UE, each secure PRACH resource having an ID. In addition, the UE receives an ID of an activated secure PRACH resource in at least one secure PRACH resource from the network node, the other network node, or the other UE. The activated secure PRACH resource can be used to replace at least one common PRACH resource. Thereafter, the UE starts sending a PRACH preamble to the network node or the other network node based on at least one common PRACH resource or the activated secure PRACH resource. By using PRACH resources that are divided into a common PRACH resource set (available to all UEs) and a secure PRACH resource set (available only to target or trusted UEs), the UE can perform a common to secure PRACH resource switch when needed, thereby providing secure communication between the UE and the network node (or any other network node). In addition, signaling at least one secure PRACH resource requires more resources than signaling the ID of the activated secure PRACH resource. This is because the PRACH resource configuration includes many parameters, while the ID is only a number. Therefore, it is beneficial to signal at least one secure PRACH resource infrequently, while allowing signaling for activating a certain secure PRACH resource to be sent more frequently, thereby providing flexibility. Then, it is feasible to signal the secure PRACH resource using RRC signaling, while the activation of a certain secure PRACH resource can be accomplished using physical layer or MAC layer signaling.

[0016] In an exemplary embodiment of the second aspect, at least one memory and computer program code are further configured to, together with at least one processor, cause the UE to receive, together with the ID of the activated secure PRACH resource, an indication that the UE is allowed to: (i) initiate an RA procedure based on the activated secure PRACH resource; or (ii) initiate an RA procedure based on at least one public PRACH resource, and if the RA procedure based on the at least one public PRACH resource is unsuccessful, switch from the at least one public PRACH resource to the activated secure PRACH resource. The indication can provide flexibility for the UE side to decide the use of PRACH resources.

[0017] In an exemplary embodiment of the second aspect, at least one memory and computer program code are further configured to, with at least one processor, cause the UE to receive at least one secure PRACH resource in an encrypted message. In this embodiment, the encrypted message is encrypted using an encryption key known in advance by the UE (for example, if the UE is a public security UE, the encryption key may be set before any network connection, or the UE may be preconfigured to use the encryption key on a secure communication channel between a network node and the UE). By using an encrypted message, the chance of a malicious UE learning of the secure PRACH resource can be minimized.

[0018] In an example embodiment of the second aspect, at least one secure PRACH resource is valid within a geographic area including one or more cells (e.g., within an RNA preconfigured for the UE). If the UE moves quickly from one geographic area to another, it will be more difficult for a malicious UE to find secure PRACH resources for a given cell within a given geographic area. Another benefit provided by this embodiment is that when the target UE has received signaling of at least one secure PRACH resource through cell 1 and the same signaling is also valid for cell 2, the target UE can move from cell 1 to cell 2 and use the secure PRACH resources in cell 2 after receiving an activation indication from cell 2 and before using public PRACH resources to establish a secure connection with cell 2. In this way, the UE can connect to a cell that is under an interference attack that has made the public PRACH resources in the cell unavailable.

[0019] In an exemplary embodiment of the second aspect, the ID of the activated secure PRACH resource includes at least one of the following: the format of the PRACH preamble; the system frame and subframe to send the PRACH preamble; the time domain position of the PRACH preamble; the frequency domain position of the PRACH preamble; and the logical root sequence index. By using such an ID of the activated secure PRACH resource, the secure PRACH resource can be more effectively "hidden" from malicious UEs (e.g., jammers).

[0020] In an exemplary embodiment of the second aspect, at least one memory and computer program code are further configured to, with at least one processor, cause the UE to receive, together with the ID of the activated secure PRACH resource, a duration for which the activated secure PRACH resource is valid. By using a duration (or in other words, a timer) for the activated secure PRACH resource, the chance of the malicious UE learning the activated secure PRACH resource can be minimized, since the malicious UE will only have a limited time to find the activated secure PRACH resource. In addition, by using a timer for activating certain secure PRACH resources, PRACH resource allocation in the wireless communication network can be efficiently adjusted.

[0021] According to a third aspect, a method for operating a network node in a wireless communication network is provided. The method begins with a step of signaling at least one common PRACH resource to at least one target UE. Next, the method proceeds to a step of sending at least one secure PRACH resource to each target UE in at least one target UE. Each secure PRACH resource in at least one secure PRACH resource has an ID. Then, the method proceeds to a step of signaling an ID of an activated secure PRACH resource in at least one secure PRACH resource. The activated secure PRACH resource can be used to replace at least one common PRACH resource. Thereafter, the method proceeds to a step of monitoring a PRACH preamble from each target UE in at least one target UE based on at least one common PRACH resource or an activated secure PRACH resource. By dividing all PRACH resources into a common PRACH resource set (available to all UEs) and a secure PRACH resource set (available only to target or trusted UEs), the network node can allow the target UE to perform a common to secure PRACH resource switch when needed, thereby providing secure communication between the target UE and the network node (or any other network node). Furthermore, signaling at least one secure PRACH resource requires more resources than signaling the ID of an activated secure PRACH resource. This is because a PRACH resource configuration includes many parameters, while an ID is only a number. Therefore, it is beneficial to signal at least one secure PRACH resource less frequently, while allowing for flexibility by sending signaling for activating a certain secure PRACH resource more frequently. Then, it is feasible to signal secure PRACH resources using RRC signaling, while activation of a certain secure PRACH resource can be done using physical layer or MAC layer signaling.

[0022] According to a fourth aspect, a method for operating a UE in a wireless communication network is provided. The method begins with a step of receiving at least one public PRACH resource from a network node. Next, the method proceeds to a step of receiving at least one secure PRACH resource from the network node, another network node, or another UE, each secure PRACH resource having an ID. The method also proceeds to a step of receiving an ID of an activated secure PRACH resource in at least one secure PRACH resource from the network node, the other network node, or the other UE. The activated secure PRACH resource can be used to replace at least one public PRACH resource. Thereafter, the method proceeds to a step of sending a PRACH preamble to the network node or the other network node based on at least one public PRACH resource or an activated secure PRACH resource. By using PRACH resources divided into a public PRACH resource set (available for all UEs) and a secure PRACH resource set (available only for target or trusted UEs), the UE can perform a public to secure PRACH resource switch when needed, thereby providing secure communication between the UE and the network node (or any other network node). Furthermore, signaling at least one secure PRACH resource requires more resources than signaling the ID of an activated secure PRACH resource. This is because a PRACH resource configuration includes many parameters, while an ID is only a number. Therefore, it is beneficial to signal at least one secure PRACH resource less frequently, while allowing for flexibility by sending signaling for activating a certain secure PRACH resource more frequently. Then, it is feasible to signal secure PRACH resources using RRC signaling, while activation of a certain secure PRACH resource can be done using physical layer or MAC layer signaling.

[0023] According to a fifth aspect, a network node in a wireless communication network is provided. The network node includes a component for signaling at least one common PRACH resource to at least one target UE. The network node also includes a component for signaling at least one secure PRACH resource to each target UE in the at least one target UE. Each secure PRACH resource in the at least one secure PRACH resource has an ID. The network node also includes a component for signaling the ID of an activated secure PRACH resource in at least one secure PRACH resource to each target UE in the at least one target UE. The network node also includes a component for monitoring the PRACH preamble code from each target UE in the at least one target UE based on at least one common PRACH resource or an activated secure PRACH resource. By dividing all PRACH resources into a common PRACH resource set (available for all UEs) and a secure PRACH resource set (available only for target or trusted UEs), the network node can allow the target UE to perform a common to secure PRACH resource switch when needed, thereby providing secure communication between the target UE and the network node (or any other network node). In addition, signaling at least one secure PRACH resource requires more resources than signaling the ID of the activated secure PRACH resource. This is because the PRACH resource configuration includes many parameters, while the ID is just a number. Therefore, it is beneficial to signal at least one secure PRACH resource infrequently, while allowing more frequent signaling for activating a certain secure PRACH resource, thus allowing flexibility. Then, it is feasible to signal secure PRACH resources using RRC signaling, while activation of a certain secure PRACH resource can be done using physical layer or MAC layer signaling.

[0024] According to a sixth aspect, a UE in a wireless communication network is provided. The UE includes a unit for receiving at least one public PRACH resource from a network node. The UE also includes a component for receiving at least one secure PRACH resource from the network node, another network node or another UE, each secure PRACH resource having an ID. The UE also includes a component for receiving an ID of an activated secure PRACH resource in at least one secure PRACH resource. The activated secure PRACH resource can be used to replace at least one public PRACH resource. The UE also includes a component for sending a PRACH preamble to the network node or the other network node based on at least one public PRACH resource or an activated secure PRACH resource. By using PRACH resources divided into a public PRACH resource set (available for all UEs) and a secure PRACH resource set (available only for target or trusted UEs), the UE can perform a public to secure PRACH resource switch when needed, thereby providing secure communication between the UE and the network node (or any other network node). In addition, signaling at least one secure PRACH resource requires more resources than signaling the ID of the activated secure PRACH resource. This is because the PRACH resource configuration includes many parameters, while the ID is just a number. Therefore, it is beneficial to signal at least one secure PRACH resource infrequently, while allowing more frequent signaling for activating a certain secure PRACH resource, thus allowing flexibility. Then, it is feasible to signal secure PRACH resources using RRC signaling, while activation of a certain secure PRACH resource can be done using physical layer or MAC layer signaling.

[0025] Other features and advantages of the present disclosure will be apparent upon reading the following detailed description, and upon viewing the accompanying drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] The present invention is described below in conjunction with the accompanying drawings, in which:

[0027] Figure 1 A block diagram of a network node according to an example embodiment is shown;

[0028] Figure 2 A method for operating according to an example embodiment is shown. Figure 1 A flowchart of a method for a network node;

[0029] Figure 3 shows a possible PRACH resource allocation according to an example embodiment;

[0030] Figure 4 A block diagram of a UE according to an example embodiment is shown;

[0031] Figure 5A method for operating according to an example embodiment is shown. Figure 4 A flowchart of a method for a UE;

[0032] Figure 6 A method for performing Figure 4 A flowchart of a method for performing public to secure PRACH resource switching at a UE;

[0033] Figure 7 In the case of using a validity period of a secure PRACH resource according to an example embodiment, Figure 4 How can a UE switch between common PRACH resources and secure PRACH resources?

[0034] Figure 8 According to another exemplary embodiment, a method for Figure 4 A flowchart of a method for performing public to secure PRACH resource switching at a UE;

[0035] Fig. 9 shows a signaling diagram between a gNB and a UE for configuring, activating and using secure PRACH resources according to a first exemplary embodiment;

[0036] Fig.10 shows a signaling diagram between two gNBs and a UE for configuring, activating and using secure PRACH resources according to a second example embodiment; and

[0037] Fig.11 A signaling diagram between two gNBs and two UEs for configuring, activating and using secure PRACH resources according to a third example embodiment is shown. DETAILED DESCRIPTION

[0038] Various embodiments of the present disclosure are further described in more detail with reference to the accompanying drawings. However, the present disclosure may be embodied in many other forms and should not be construed as limited to any specific structure or function discussed in the following description. Instead, these embodiments are provided to make the description of the present disclosure detailed and complete.

[0039] According to the detailed description, it will be clear to those skilled in the art that the scope of the present disclosure covers any embodiment disclosed herein, regardless of whether the embodiment is implemented independently or in conjunction with any other embodiment of the present disclosure. For example, the apparatus and method disclosed herein can be implemented in practice by using any number of embodiments provided herein. In addition, it should be understood that any embodiment of the present disclosure can be implemented using one or more elements presented in the attached claims.

[0040] Any embodiment described herein as an "exemplary embodiment" is not necessarily to be construed as preferred or having advantages over other embodiments unless otherwise stated.

[0041] Although numerical terms such as "first", "second", etc. may be used herein to describe various embodiments, elements, or features, these embodiments, elements, or features should not be limited by the numerical terms. The numerical terms are only used herein to distinguish one embodiment, element, or feature from another embodiment, element, or feature. Therefore, without departing from the teachings of the present disclosure, the first embodiment discussed below may be referred to as the second embodiment, and vice versa.

[0042] According to the example embodiments disclosed herein, a user equipment (UE) may refer to an electronic computing device configured to perform wireless communication. UE may be implemented as a mobile station, a mobile terminal, a mobile subscriber unit, a mobile phone, a cellular phone, a smart phone, a cordless phone, a personal digital assistant (PDA), a wireless communication device, a desktop computer, a laptop computer, a tablet computer, a gaming device, a netbook, a smartbook, an ultrabook, a medical mobile device or equipment, a biometric sensor, a wearable device (e.g., a smart watch, smart glasses, a smart wristband, etc.), an entertainment device (e.g., an audio player, a video player, etc.), a vehicle component or sensor (e.g., a driver assistance system), a smart meter / sensor, an unmanned vehicle (e.g., an industrial robot, a quadcopter, etc.) and its components (e.g., an autonomous vehicle computer), industrial manufacturing equipment, a global positioning system (GPS) device, an Internet of Things (IoT) device, an industrial IoT (IIoT) device, a machine type communication (MTC) device, a group of large-scale IoT (MIoT) or large-scale MTC (mMTC) devices / sensors, or any other suitable mobile device configured to support wireless communication. In some embodiments, a UE may refer to at least two juxtaposed and interconnected UEs defined in this way.

[0043] As used in the example embodiments disclosed herein, a network node may refer to a fixed point of communication / communication node of a UE in a specific wireless communication network. More specifically, a network node may be used to connect a UE to a data network (DN) via a core network (CN), and may be referred to as a base transceiver station (BTS) in 2G communication technology, a node B in 3G communication technology, an evolved node B (eNode B or eNB) in 4G communication technology, and a gNB in ​​5G new radio (NR) communication technology. A network node may serve different cells, such as macro cells, micro cells, pico cells, femto cells, and / or other types of cells. A macro cell may cover a relatively large geographic area (e.g., a radius of at least several kilometers). For example, a micro cell may cover a geographic area with a radius of less than two kilometers. A pico cell may cover a relatively small geographic area, such as an office, a shopping mall, a train station, a stock exchange, etc. A femto cell may cover an even smaller geographic area (e.g., a home). Accordingly, a network node serving a macro cell may be referred to as a macro node, a network node serving a micro cell may be referred to as a micro node, and the like.

[0044] According to the example embodiments disclosed herein, the wireless communication network in which the UE and the network node communicate with each other may refer to a cellular or mobile network, a wireless local area network (WLAN), a wireless personal area network (WPAN), a wireless wide area network (WWAN), a satellite communication (SATCOM) system, or any other type of wireless communication network. Each of these types of wireless communication networks supports wireless communication according to one or more communication protocol standards. For example, a cellular network may operate according to a global system for mobile communications (GSM) standard, a code division multiple access (CDMA) standard, a wideband code division multiple access (WCDM) standard, a time division multiple access (TDMA) standard, or any other communication protocol standard, a WLAN may operate according to one or more versions of the IEEE 802.11 standard, a WPAN may operate according to an infrared data association (IrDA), wireless USB, Bluetooth, or ZigBee standard, and a WWAN may operate according to a global microwave access interoperability (WiMAX) standard.

[0045] If the UE wants or needs to create an initial connection with a network node, it can use the Random Access Channel (RACH) procedure. This is one of the common procedures present in all earlier versions of wireless communication networks, including Global System for Mobile Communications (GSM), General Packet Radio Service (GPRS), Universal Mobile Telecommunications Service (UMTS), and Long Term Evolution (LTE), with some changes in the messages exchanged between the UE and the network node. The RACH procedure is done for many different reasons: the UE wants to connect for an outgoing call / data; the UE responds to a paging for an incoming call / data; switching to a new cell; beam recovery, etc. During the RACH procedure, the UE selects a preamble (i.e., a code sequence) and sends the preamble (as a message 1 or Msg1) on an uplink channel called the physical RACH (PRACH) using some pre-reserved time-frequency resources (called RACH opportunity (RO) in 5G technology). The UE then starts monitoring the downlink channel to see if the network node responds to the UE's request to connect to the wireless communication network. If not, the UE will make a new attempt with increased power. The random access response (RAR) (i.e., message 2 or Msg2) sent by the network node indicates which preamble it is associated with, the timing advance (TA) it should use, the scheduling grant (i.e., message 3 or Msg3) for sending the scheduled PUSCH transmission, and the temporary cell radio network temporary identifier (TC-RNTI). Msg3 may carry a radio resource control (RRC) request sent by the UE to the network node via the scheduled PUSCH, the RRC request having an ID for contention resolution. In response to Msg3, the network node sends message 4 or Msg4 to the UE, which may include an RRC setup carrying a contention resolution message with a contention resolution ID. Upon receiving Msg4, if the contention resolution ID is carried by Msg4, the UE sends an acknowledgment (ACK) message on the physical uplink control channel (PUCCH). Thereafter, the RACH process is completed, and the UE moves to the RRC connected state, and data communication between the UE and the network node can continue using normal dedicated transmissions. The above involves a 4-step RACH process. There is also a 2-step RACH process similar to the 4-step RACH process, but the information content of Msg1 and Msg3 is carried in one or more MsgA transmissions without waiting for feedback from the UE in between (i.e., Msg2); similarly, the information content of Msg2 and Msg4 is carried in one or more MsgB transmissions from the network node.

[0046] In 4G and 5G communication technologies, all PRACH resources are indicated in the broadcast system information. A malicious UE can read this information and, for example, start interfering with the PRACH resources. Interfering only with PRACH is an effective way to block the frequency band: knowing the location of the PRACH resources in the time and frequency domain is a normal UE process, and their interference can be limited to transmissions on certain sparse time-frequency resources, making it more difficult to identify malicious UEs. This problem exists in both contention-based RACH procedures and contention-free (4-step or 2-step) RACH procedures, because in both RACH procedures the overall PRACH resources are the same, and for the contention-free RACH procedure, a subset of the overall PRACH resources with downlink control information (DCI) is provided to the UE. Therefore, interfering with all PRACH resources will also block the contention-free RACH procedure.

[0047] In order to mitigate or even eliminate the above problems, the authors of this article decided to introduce the concept of hidden, or in other words, secure PRACH resources to build a highly reliable and secure PRACH framework (including PRACH's anti-interference capability). This concept involves the use of at least two types of PRACH resources: (1) Common PRACH resources that are configured by the network node using plain text broadcast system information and are therefore available to all UEs; and (2) Hidden or secure PRACH resources that are only available to trusted UEs (also referred to herein as target UEs). In other words, information about the secure PRACH resource configuration is not just distributed "to any concerned" UE, but is only distributed to a certain (e.g., user-defined) subset of all UEs present in the wireless communication network. For example, the target UE may refer to a public safety UE. The secure PRACH resources may be configured by a network node using one or more encrypted (e.g., RRC) messages. It is assumed that the target UE is pre-provisioned with an encryption key to retrieve information from the encrypted message. For example, when the UE was last in an RRC connected state, the network node may provide the encryption key to the target UE via a certain protocol layer (such as a packet data convergence protocol (PDCP) layer). Alternatively, the target UE may be configured to use the encryption key by default (e.g., according to factory settings) or by the user. As another alternative, the encryption key and / or secure PRACH resources may be provided to the target UE from another UE via, for example, a side link or another connection technology.

[0048] In view of the above, the example embodiments disclosed herein provide a technical solution that allows PRACH resources to be configured to be less accessible to malicious UEs (e.g., less susceptible to interference). To this end, all PRACH resources are divided into a set of public PRACH resources and a set of secure PRACH resources, both of which are configured by a network node for one or more target UEs. Each secure PRACH resource has an ID. The network node can indicate at any time that a secure PRACH resource is available or activated in a cell, but specifically, this indication can be made when it is detected that a public PRACH resource is subject to an interference attack. In this case, the network node can indicate that one or more secure PRACH resources in the configured secure PRACH resource set are activated. The network node signals the ID of the activated secure PRACH resource to the target UE (e.g., by using a plaintext broadcast message). Thereafter, the UE can start sending a PRACH preamble to the network node using the activated secure PRACH resource. After the network node has indicated that some secure PRACH resources are activated, the alternatives are that the target UE: (1) should use the activated secure PRACH resources for PRACH transmission; or (2) is allowed to choose between common PRACH resources and activated secure PRACH resources. Alternative (2) will allow the target UE to attempt a random access (RA) procedure using common PRACH resources, and only if the RA procedure is unsuccessful, start checking whether any secure PRACH resources are activated. Alternative (2) will also allow the target UE to start a RA procedure using common PRACH resources and search for activated secure PRACH resources at the same time, and if the target UE finds activated secure PRACH resources, the target UE can choose to continue the started RA procedure or start a new RA procedure using the activated secure PRACH resources. It should also be noted that each target UE can be preconfigured to follow either of the alternatives (1) and (2) indicated above by default (e.g., according to factory settings).

[0049] Figure 1 1 shows a block diagram of a network node 100 according to an example embodiment. The network node 100 is intended to communicate with one or more UEs in any wireless communication network described above. Figure 1 As shown, the network node 100 includes a processor 102, a memory 104, and a transceiver 106. The memory 104 stores processor-executable instructions 108, which, when executed by the processor 102, cause the processor 102 to perform various aspects of the present disclosure, as will be described in more detail below. It should be noted that Figure 1The number, arrangement and interconnection of the construction elements constituting the network node 100 shown in the figure are not intended to impose any limitations on the present disclosure, but are only used to provide a general concept of how the construction elements are implemented within the network node 100. For example, depending on the specific application, the processor 102 can be replaced with several processors, and the memory 104 can be replaced with several removable and / or fixed storage devices. In addition, in some embodiments, the transceiver 106 can be implemented as two separate devices, one of which is used for receiving operations and the other is used for sending operations. Regardless of its implementation, the transceiver 106 is intended to be able to perform different operations required to perform data reception and transmission, such as signal modulation / demodulation, encoding / decoding, etc. In other embodiments, the transceiver 106 can be part of the processor 102 itself.

[0050] The processor 102 may be implemented as a CPU, a general purpose processor, a single purpose processor, a microcontroller, a microprocessor, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), a digital signal processor (DSP), a complex programmable logic device, etc. It should also be noted that the processor 102 may be implemented as any combination of one or more of the foregoing. As an example, the processor 102 may be a combination of two or more microprocessors.

[0051] The memory 104 may be implemented as a classic non-volatile or volatile memory used in modern electronic computing machines. As examples, non-volatile memory may include read-only memory (ROM), ferroelectric random access memory (RAM), programmable ROM (PROM), electrically erasable PROM (EEPROM), solid-state drive (SSD), flash memory, magnetic disk storage (such as hard disk drives and tapes), optical disk storage (such as CDs, DVDs, and Blu-ray discs), etc. For volatile memory, examples include dynamic RAM, synchronous DRAM (SDRAM), double data rate SDRAM (DDR SDRAM), static RAM, etc.

[0052] The processor-executable instructions 108 stored in the memory 104 may be configured as computer-executable program code that causes the processor 102 to perform various aspects of the present disclosure. The computer-executable program code for performing the operations or steps of various aspects of the present disclosure may be written in any combination of one or more programming languages ​​(such as Java, C++, etc.). In some examples, the computer-executable program code may be in the form of a high-level language or in a pre-compiled form and generated on the fly by an interpreter (also pre-stored in the memory 104).

[0053] Figure 2 A flow chart of a method 200 for operating a network 100 is shown according to an example embodiment.

[0054] The method 200 starts at step S202, where the processor 102 (eg, via the transceiver 106) signals one or more common PRACH resources to one or more target UEs. Step S202 may be performed by any broadcast signaling.

[0055] Next, the method 200 proceeds to step S204, where the processor 102 (e.g., via the transceiver 106) signals one or more secure PRACH resources to the target UE. This step can be accomplished by using any dedicated signaling (e.g., RRC signaling). In addition, the secure PRACH resources can be signaled in an encrypted message generated by the processor 102 using an encryption key known in advance to the target UE, so that the target UE can correctly decrypt the encrypted message and retrieve information about the secure PRACH resources. An ID is provided for each secure PRACH resource. Each secure PRACH resource can be cell-specific. In addition, the secure PRACH resources can be valid within a certain geographic area including one or more cells (e.g., within a certain radio access network (RAN) notification area (RNA), where each cell can use different one or more secure PRACH resources). This can allow the capacity of the secure PRACH resources to be adjusted in a cell-specific manner. By changing the PRACH resource allocation / configuration between cells, the search for secure PRACH resources by malicious UEs (e.g., jammers) can be made more difficult because the PRACH resources revealed for a given cell will not necessarily apply to neighboring cells. Furthermore, if the target UE exits the RNA, a new set of secure PRACH resources may be applied, making it extremely difficult for a malicious UE to track such a change in secure PRACH resources. If secure PRACH resources are valid on multiple cells, a target UE that has received signaling of secure PRACH resources through one cell may connect to another cell by utilizing the secure PRACH resources of the other cell, even if the other cell is under interference attack on the common PRACH resources.

[0056] For each secure PRACH resource ID, it may be represented by one or more PRACH parameters. It should be noted that some of the PRACH parameters (such as preamble power and corresponding response window) may be common to public PRACH resources and secure PRACH resources. This is because knowing them will not make it easier for malicious UEs to find secure PRACH resources. At the same time, PRACH parameters that are important for hiding secure PRACH resources from malicious UEs may include: - The type or format of the PRACH preamble (usually indicated in the "PRACH-ConfigurationIndex" parameter commonly used for PRACH preamble generation); - PRACH preamble index; - The system frame and subframe in which the PRACH preamble is transmitted (also indicated in the "PRACH-ConfigurationIndex" parameter); - The frequency domain location of the PRACH preamble, which may be represented by one or more of the following parameters, typically indicated in the "RACH-ConfigGeneric" parameter: "msg1-FDM" (i.e., the number of PRACH transmission opportunities multiplexed in the frequency domain within one time instance), "msg1-FrequencyStart" (i.e., the offset of the lowest PRACH transmission opportunity in the frequency domain relative to physical resource block (PRB) 0), and "zeroCorrelationZoneConfig" (i.e., the number of root sequences required per cell for the selected PRACH); and - Logical root sequence index (referred to as the "PRACH-RootSequenceIndex" parameter for PRACH preamble generation, typically included in the "RACH-ConfigCommon" parameter).

[0057] The above PRACH parameters are well known in the art, so a detailed description thereof is omitted here. One or more of these PRACH parameters may be usefully used as an ID for each secure PRACH resource (e.g., signaled in an encrypted message), i.e., one or more of these PRACH parameters are associated with an ID.

[0058] In one embodiment, processor 102 may additionally signal (e.g., via transceiver 106) one or more PUSCH resources for each security PRACH resource along with the security PRACH resource. The joint use of security PRACH resources and PUSCH resources may be particularly beneficial in the case of scenarios associated with a two-step RACH procedure.

[0059] When the secure PRACH resource has been signaled to the target UE, the method 200 proceeds to step S206, where the processor 102 signals (e.g., via the transceiver 106) the ID of the activated secure PRACH resource to the target UE. This step can be performed using any broadcast signaling (e.g., layer 1 (L1), medium access control (MAC) or system information block type 1 (SIB1) signaling, etc.). The ID of the activated secure PRACH resource does not need to be sent in an encrypted message-a simple plaintext message is sufficient for this purpose. Each target UE can use the activated secure PRACH resource instead of the common PRACH resource (e.g., if the common PRACH resource is detected to be under a malicious attack). For example, if the processor 102 detects that the common PRACH resource used by the target UE to send a PRACH preamble to the network node 100 has been attacked by interference, step S206 can be performed. The processor 102 can detect an interference attack by purely observing the common PRACH resource. For example, in the absence of any PRACH preamble detected, an abnormally large power may indicate an interference attack. Typically, if normal RACH activity is "unexpected" - too few PRACH preambles are observed or the observed interference is too high - this may provide evidence of an interference attack. Additionally or alternatively, the network node 100 may rely on some UE assistance to detect interference attacks or any other malicious use of common PRACH resources. As an example, if a UE (not necessarily a target UE) has time division duplex (TDD) capabilities (i.e., it can measure in the same frequency band in which it normally transmits), the UE may potentially perform measurements in a RO that it is not currently using; if the interference in the RO is high, the UE may collect this information and provide it to the network node 100 for later analysis. As another example, if the UE attempts to perform the RA procedure multiple times and knows that the physical conditions should be good enough, the UE may also collect this information and report it to the network node 100 for later analysis. In the examples given above, the UE may provide the measurement information at a later time, or attempt to transmit the measurement information over other channels (e.g., over another UE / service (sidelink or similar)).

[0060] In step S206, if the secure PRACH resource set is pre-configured for the target UE, the processor 102 may select one or more secure PRACH resources to be activated for the target UE in the secure PRACH resource set (e.g., when an interference attack is detected). The selection may be based on different selection metrics, such as interference per RO, the number of RACH attempts, etc.

[0061] In one embodiment, the processor 102 may signal together with the ID of the activated secure PRACH resource an indication that each target UE is allowed to: (i) initiate an RA procedure based on the activated secure PRACH resource; or (ii) initiate an RA procedure based on the common PRACH resource, and if the RA procedure based on the common PRACH resource is unsuccessful, switch from the common PRACH resource to the activated secure PRACH resource. This may provide flexibility for the use of PRACH resources on the UE side.

[0062] In an additional or alternative embodiment, the processor 102 may signal the duration that the activated secure PRACH resource should be valid together with the ID of the activated secure PRACH resource. In other words, the network node 100 may indicate the validity period of the activated secure PRACH resource. The validity period may be a single time interval or a repetitive time interval (with a certain periodicity).

[0063] It should also be noted that steps S204 and S206 may be combined into a single step, where the processor 102 signals the entire set of secure PRACH resources and the ID of the activated secure PRACH resources to each target UE by using a single encrypted message.

[0064] The method 200 ends with step S208 , where the processor 102 starts monitoring the PRACH preamble from each target UE based on the common PRACH resources or the activated security PRACH resources.

[0065] By using the method 200, secure PRACH resources may be configured for one or more target UEs, but not activated by default. The target UEs are allowed to use the activated secure PRACH resources (if configured) only when the network node 100 signals the ID of the activated secure PRACH resources (e.g., in response to detecting an interference attack). In this way, secure PRACH resources may be pre-configured but do not occupy any network resources until they are actually needed (i.e., when the network node 100 decides that it is best to switch from common PRACH resources to certain secure PRACH resources in response to detecting an interference attack).

[0066] Figure 3 A possible PRACH resource allocation according to an example embodiment is shown. Figure 3 As shown, the overall PRACH resources are divided into two sets: a common PRACH resource set available to all UEs at certain common RACH occasions (RO), and another secure PRACH resource set available only to target UEs at certain secure PRACH occasions (SRO). According to method 200, the secure PRACH resource set is configured and reported to the target UE.

[0067] Figure 4 1 shows a block diagram of a UE 400 according to an example embodiment. The UE 400 is intended to communicate with the network node 100 in any of the above-mentioned wireless communication networks. Figure 4 As shown, UE 400 includes a processor 402, a memory 404, and a transceiver 406. Memory 404 stores processor-executable instructions 408, which, when executed by processor 402, cause processor 402 to implement various aspects of the present disclosure, as will be described in more detail below. It should be noted again that Figure 4 The number, arrangement, and interconnection of the building elements constituting the UE 400 shown in the figure are not intended to impose any limitation on the present disclosure, but are merely used to provide a general concept of how the building elements are implemented within the UE 400. Generally, the processor 402, the memory 404, the transceiver 406, and the processor-executable instructions 408 may be implemented in the same or similar manner as the processor 102, the memory 104, the transceiver 106, and the processor-executable instructions 108, respectively.

[0068] Figure 5 A flow chart of a method 500 for operating a UE 400 according to an example embodiment is shown. The method 500 begins at step S502, where the processor 402 receives (e.g., via the transceiver 406) a common PRACH resource from the processor 102 of the network node 100. Next, the method proceeds to step S504, where the processor 402 receives (e.g., via the transceiver 406) secure PRACH resources each having an ID from the processor 102 of the network node 100. The ID may be represented by any one or more of the PRACH parameters discussed above. As described above, the secure PRACH resources may be signaled in an encrypted message, and it is assumed that the UE 400 knows the encryption key required to decrypt the encrypted message. The method 500 also proceeds to step S506, where the processor 402 receives (e.g., via the transceiver 406) an ID of an activated secure PRACH resource from the network node. The processor 402 may replace the common PRACH resource with the activated secure PRACH resource. It should be noted that in steps S504 and S506, secure PRACH resources and / or activated secure PRACH resources may also be signaled to the UE 400 from another UE or a network node different from the network node 100. The method 500 ends with step S508, where the processor 402 transmits (e.g., via the transceiver 406) a PRACH preamble to the processor 102 of the network node 100 (or any other network node) by using the common PRACH resources or the activated secure PRACH resources.

[0069] In one embodiment, the configuration of the secure PRACH resources may be set so that the secure PRACH resources are available to the UE 400 even if the UE 400 enters the RRC idle state (RRC_IDLE). This persistent configuration may be limited to certain cells or areas (e.g., certain or certain RNAs). In one or more embodiments, the activated secure PRACH resources may also be valid during a validity period, which is also signaled together with the ID of the activated secure PRACH resources. As previously described, the validity period may refer to a single time interval or a repeating time interval.

[0070] Figure 6 A flow chart of a method 600 for performing a common to secure PRACH resource switch at a UE 400 according to an example embodiment is shown. The method 600 starts at step S602, where the processor 402 of the UE 400 initiates a RACH procedure with the network node 100. In the next step S604, the processor 402 checks whether the UE 400 has been configured with any secure PRACH resource set by the network node 100 (e.g., whether the UE 400 has received the above-mentioned encrypted message). If the check result is "no", the method 600 proceeds to step S606, where the processor 402 performs the RACH procedure by using the common PRACH resources. If the check result is "yes", the method 600 proceeds to step S608, where the processor 402 checks whether the network node 100 has instructed the UE 400 to use one or more activated secure PRACH resources in the configured secure PRACH resource set (i.e., whether the UE 400 has received the above-mentioned plain text message with the ID of the activated secure PRACH resource). If the check result is "no", the method 600 returns to step S606; otherwise (ie, if the check result is "yes"), the method 600 proceeds to step S608, where the processor 402 performs a RACH procedure by replacing the common PRACH resources with the activated security PRACH resources.

[0071] Figure 7 It is explained how the UE 400 may switch between common PRACH resources and activated secure PRACH resources (i.e., those that are "in use") in the case of using a validity period of secure PRACH resources according to an example embodiment. If the above-mentioned plain text message sent from the network node 100 to the UE 400 (in step S206 of the method 200) indicates a validity period, the UE 400 may trigger a timer corresponding to the validity period after receiving the plain text message. Once the timer expires, the UE 400 may switch from the activated secure PRACH resources to the common PRACH resources. As long as the validity period refers to a repetitive time interval, the UE 400 may repeatedly perform a common to secure PRACH resource switch and vice versa.

[0072] Figure 8 A flow chart of a method 800 for performing a common to secure PRACH resource switch at a UE 400 according to another example embodiment is shown. The method 800 starts at step S802, where the processor 402 starts performing a RACH procedure by using common PRACH resources. In other words, the processor 402 starts sending a PRACH preamble to the processor 102 using common PRACH resources. This is in contrast to the method 600, according to which the UE 400 should initiate a RACH procedure, but first checks whether there are secure PRACH resources configured by the network node 100, and only uses the common PRACH resources when no secure PRACH resources have been configured (by using the encrypted message in step S204 of the method 200) or activated (by using the plaintext message in step S206 of the method 200). In the method 800, the processor 402 checks for the presence of secure PRACH resources only after a failure in the RACH procedure using common PRACH. The failure means that the UE 400 has attempted multiple PRACH preamble transmissions and / or has reached the maximum PRACH preamble transmission power. When such a failure occurs, the method 800 proceeds to step S804, where the processor 402 checks whether there is at least one secure PRACH resource configured and activated for the UE 400. If the check result is "yes", the method 800 proceeds to step S806, where the processor 402 sends a PRACH preamble using an available secure PRACH resource; if the check result is "no", the method 800 ends.

[0073] It should be noted that based on the observation of PRACH preamble transmission on the preliminary security PRACH resources, the network node 100 may (1) allocate more security PRACH resources if the load on the preliminary PRACH resources exceeds its capacity, or (2) activate some security PRACH resources to be directly available without the target UE first attempting a PRACH preamble transmission over the common PRACH resources.

[0074] Fig. 9A signaling diagram 900 between a gNB and a UE for configuring, activating, and using secure PRACH resources according to a first example embodiment is shown. In the signaling diagram 900, it is assumed that the gNB is implemented as the network node 100 and the UE is implemented as the UE 400. The signaling diagram 900 starts at step S902, where the UE establishes an RRC connection with the gNB. After the RRC connection is established (i.e., the UE is in the RRC_CONNECTED state), the next step S904 is initiated, where the gNB signals the secure PRACH resource set to the UE by using one or more encrypted messages. Then, the signaling diagram 900 continues to step S906, where the gNB detects an interference attack on the common PRACH resource set currently used by the UE. In response to the interference attack, the gNB starts to periodically send one or more plaintext broadcast messages to the UE. The plaintext broadcast message includes one or more IDs (e.g., "PRACH-ConfigurationIndex") of the secure PRACH resources selected (and activated) by the gNB from the secure PRACH resource set for further use in PRACH preamble transmission. In addition, the signaling diagram 900 continues to steps S910 and S912, where the UE first initiates random access and sends a PRACH preamble code to the gNB by using the selected secure PRACH resource.

[0075] Fig.10A signaling diagram 1000 between two gNBs and a UE for configuring, activating, and using secure PRACH resources according to a second example embodiment is shown. In the signaling diagram 1000, it is assumed that each of gNB1 and gNB2 is implemented as a network node 100, and the UE is implemented as a UE 400. The signaling diagram 1000 can be used in a scenario when a secure PRACH resource set is valid for a given NRA, so that the UE can obtain the secure PRACH resource set through one gNB and later apply it to connect to another gNB that is under interference attack and located in the same RNA. The signaling diagram 1000 starts at step S1002, where the UE establishes an RRC connection with gNB1. After the RRC connection is established (i.e., the UE is in the RRC_CONNECTED state), the next step S1004 is initiated, where gNB1 signals the secure PRACH resource set to the UE by using one or more encrypted messages. Then, the signaling diagram 1000 proceeds to step S1006, where the UE transitions from the RRC connected state to the RRC idle state (i.e., RRC_IDLE). While the UE is in the RRC_IDLE state, gNB2 detects an interference attack on the common PRACH resource set in the next step S1008. In addition, the signaling diagram 1000 proceeds to step S1010, where gNB2 starts broadcasting one or more plaintext messages indicating the IDs of the secure PRACH resources (e.g., "PRACH-ConfigurationIndex") selected (i.e., activated) by gNB2 for further use in PRACH preamble transmission. In the next step S1012, the UE decides to establish an RRC connection with gNB2 (e.g., the UE has data to be transmitted via gNB2) and receives the plaintext message broadcast by gNB2. Thereafter, signaling diagram 1000 proceeds to step S1014, in which the UE finds one or more secure PRACH resources whose IDs are indicated in the received plain text message in the secure PRACH resource set configured by gNB1, and starts sending the PRACH preamble code to gNB2 by using the selected secure PRACH resources.

[0076] Fig.11A signaling diagram 1100 between two gNBs and two UEs for configuring, activating, and using secure PRACH resources according to a third example embodiment is shown. In the signaling diagram 1100, it is assumed that each of gNB1 and gNB2 is implemented as a network node 100, and each of UE1 and UE2 is implemented as a UE 400. The signaling diagram 1100 may be used in a scenario where one trusted UE may obtain a secure PRACH resource set from another trusted UE. It should be noted that gNB1 and gNB2 may be the same gNB serving both UE1 and UE2. The signaling diagram 1100 begins at step S1102, where UE1 establishes an RRC connection with gNB1. After the RRC connection is established (i.e., UE1 is in the RRC_CONNECTED state), the next step S1104 is initiated, where gNB1 signals the secure PRACH resource set to UE1 by using one or more encrypted messages. Then, the signaling diagram 1100 continues to step S1106, where a secure connection is established between UE1 and UE2. By using the secure connection, UE1 provides the secure PRACH resource set to UE2 by using one or more encrypted messages in the next step S1108. Next, the signaling diagram 1100 proceeds to step S1110, where gNB2 detects an interference attack on the common PRACH resource set used by UE2. In response to the interference attack, in the next step S1112, gNB2 starts broadcasting one or more plaintext messages indicating the IDs (e.g., "PRACH-ConfigurationIndex") of the secure PRACH resources selected (i.e., activated) by gNB2 for further use for PRACH preamble code transmission. Thereafter, the signaling diagram 1100 proceeds to step S1114, in which UE2 finds one or more secure PRACH resources whose IDs are indicated in the received plaintext message in the secure PRACH resource set provided by UE1, and starts sending PRACH preamble codes to gNB2 by using the selected secure PRACH resources.

[0077] It should be noted that each step or operation of methods 200, 500, 600 and 800 and interaction diagrams 900-1100, or any combination of these steps or operations, can be implemented by various means, such as hardware, firmware and / or software. As an example, one or more of the above steps or operations can be embodied by processor executable instructions, data structures, program modules and other suitable data representations. In addition, the processor executable instructions embodying the above steps or operations can be stored on corresponding data carriers and executed by processors 102 or 402, respectively. The data carrier can be implemented as any computer-readable storage medium configured to be readable by the at least one processor to execute processor executable instructions. Such computer-readable storage media can include volatile and non-volatile media, removable and non-removable media. As an example and not limitation, computer-readable media include media implemented in any method or technology suitable for storing information. In more detail, practical examples of computer-readable media include, but are not limited to, information transfer media, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disk (DVD), holographic media or other optical disk storage, magnetic tape, cassette, disk storage and other magnetic storage devices.

[0078] Although example embodiments of the present disclosure are described herein, it should be noted that any of the various changes and modifications may be made in the embodiments of the present disclosure without departing from the scope of legal protection defined by the appended claims. In the appended claims, the word "comprising" does not exclude other elements or operations, and the indefinite article "a" or "an" does not exclude a plurality. The mere fact that certain measures are recited in mutually different dependent claims does not indicate that a combination of these measures cannot be used to advantage.

Claims

1. A network node in a wireless communication network, comprising: at least one processor; as well as at least one memory including computer program code; wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the network node to: signaling at least one common physical random access channel (PRACH) resource to at least one target user equipment (UE); signaling at least one secure PRACH resource to each of the at least one target UE, each of the at least one secure PRACH resource having an identifier (ID); signaling, to each of the at least one target UE, the ID of an activated secure PRACH resource in the at least one secure PRACH resource, the activated secure PRACH resource being usable in place of the at least one common PRACH resource; as well as A PRACH preamble from each of the at least one target UE is monitored based on the at least one of the common PRACH resources or the activated security PRACH resources.

2. The network node of claim 1 , wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the network node to signal, together with the ID of the activated secure PRACH resource, an indication that each of the at least one target UE is allowed to: A random access (RA) procedure is initiated based on the activated security PRACH resources.

3. The network node of claim 1 , wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the network node to signal, together with the ID of the activated secure PRACH resource, an indication that each of the at least one target UE is allowed to: The RA procedure is initiated based on the at least one common PRACH resource, and if the RA procedure based on the at least one common PRACH resource is unsuccessful, switching from the at least one common PRACH resource to the activated security PRACH resource.

4. The network node according to any one of claims 1 to 3, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the network node to signal the at least one secure PRACH resource in an encrypted message, wherein the encrypted message is encrypted using an encryption key known in advance to each of the at least one target UE.

5. The network node according to any one of claims 1 to 4, wherein the at least one memory and the computer program code are configured to, together with the at least one processor, cause the network node to signal the activated secure PRACH resource in response to an interference attack on the at least one common PRACH resource.

6. The network node according to any one of claims 1 to 5, wherein the at least one security PRACH resource is valid within a geographical area comprising one or more cells.

7. The network node according to any one of claims 1 to 6, wherein the ID of the activated secure PRACH resource comprises at least one of the following: The format of the PRACH preamble; The system frame and subframe in which the PRACH preamble is to be sent; A time domain position for the PRACH preamble; A frequency domain position for the PRACH preamble; as well as Logical root sequence index.

8. The network node according to any one of claims 1 to 7, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the network node to signal a duration for which the activated security PRACH resource is valid together with the ID of the activated security PRACH resource.

9. A user equipment (UE) in a wireless communication network, comprising: at least one processor; as well as at least one memory including computer program code; The at least one memory and the computer program code are configured to, together with the at least one processor, cause the UE to: receiving at least one common physical random access channel (PRACH) resource from a network node; receiving at least one secured PRACH resource from the network node, another network node, or another UE, each secured PRACH resource having an identifier (ID); receiving, from the network node, the other network node or the other UE, the ID of an activated security PRACH resource in the at least one security PRACH resource, the activated security PRACH resource being usable to replace the at least one common PRACH resource; as well as A PRACH preamble is sent to the network node or the other network node based on the at least one common PRACH resource or the activated security PRACH resource.

10. The UE of claim 9, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the UE to receive, together with the ID of the activated secure PRACH resource, an indication that the UE is permitted to: A random access (RA) procedure is initiated based on the activated security PRACH resources.

11. The UE of claim 9, wherein the at least one memory and the computer program code are further configured to, with the at least one processor, cause the UE to receive, together with the ID of the activated secure PRACH resource, an indication that the UE is allowed to: The RA procedure is initiated based on the at least one common PRACH resource, and if the RA procedure based on the at least one common PRACH resource is unsuccessful, switching from the at least one common PRACH resource to the activated security PRACH resource.

12. The UE according to any one of claims 9 to 11, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the UE to receive the at least one secure PRACH resource in an encrypted message, wherein the encrypted message is encrypted using an encryption key known in advance by the UE.

13. The UE according to any one of claims 9 to 12, wherein the at least one security PRACH resource is valid within a geographical area including one or more cells.

14. The UE according to any one of claims 9 to 13, wherein the ID of the activated secure PRACH resource comprises at least one of the following: The format of the PRACH preamble; The system frame and subframe in which the PRACH preamble is to be sent; A time domain position for the PRACH preamble; A frequency domain position for the PRACH preamble; Logical root sequence index.

15. The UE according to any one of claims 9 to 14, wherein the at least one memory and the computer program code are further configured to, together with the at least one processor, cause the UE to receive, together with the ID of the activated security PRACH resource, a duration for which the activated security PRACH resource is valid.

16. A method for operating a network node in a wireless communication network, comprising: signaling at least one physical random access channel (PRACH) resource to at least one target user equipment (UE); signaling at least one secure PRACH resource to each of the at least one target UE, each of the at least one secure PRACH resource having an identifier (ID); signaling, to each of the at least one target UE, the ID of an activated secure PRACH resource in the at least one secure PRACH resource, the activated secure PRACH resource being usable in place of the at least one common PRACH resource; as well as A PRACH preamble from each of the at least one target UE is monitored based on the at least one common PRACH resource or the activated security PRACH resource.

17. The method of claim 16, wherein the network node signals, together with the ID of the activated secure PRACH resource, an indication that each of the at least one target UE is allowed to: A random access (RA) procedure is initiated based on the activated security PRACH resources.

18. The method of claim 16, wherein the network node signals, together with the ID of the activated secure PRACH resource, an indication that each of the at least one target UE is allowed to: The RA procedure is initiated based on the at least one common PRACH resource, and if the RA procedure based on the at least one common PRACH resource is unsuccessful, switching from the at least one common PRACH resource to the activated security PRACH resource.

19. The method according to any one of claims 16 to 18, wherein the network node signals the at least one secure PRACH resource in an encrypted message, the encrypted message being encrypted using an encryption key known in advance to each of the at least one target UE.

20. The method according to any one of claims 16 to 19, wherein the network node signals the activated secure PRACH resource in response to an interference attack on the at least one common PRACH resource.

21. The method according to any one of claims 16 to 20, wherein the at least one security PRACH resource is valid within a geographical area comprising one or more cells.

22. The method according to any one of claims 16 to 21, wherein the ID of the activated secure PRACH resource comprises at least one of the following: The format of the PRACH preamble; The system frame and subframe in which the PRACH preamble is to be sent; A time domain position for the PRACH preamble; A frequency domain position for the PRACH preamble; Logical root sequence index.

23. The method according to any one of claims 16 to 22, wherein the network node signals, together with the ID of the activated safety PRACH resource, a duration for which the activated safety PRACH resource is valid.

24. A method for operating a user equipment (UE) in a wireless communication network, comprising: receiving at least one common physical random access channel (PRACH) resource from a network node; receiving at least one secured PRACH resource from the network node, another network node, or another UE, each secured PRACH resource having an identifier (ID); receiving, from the network node, the other network node or the other UE, the ID of an activated security PRACH resource in the at least one security PRACH resource, the activated security PRACH resource being usable to replace the at least one common PRACH resource; as well as A PRACH preamble is sent to the network node or the other network node based on the at least one common PRACH resource or the activated security PRACH resource.

25. The method of claim 24, wherein the UE receives, together with the ID of the activated secure PRACH resource, an indication that the UE is allowed to: A random access (RA) procedure is initiated based on the activated security PRACH resources.

26. The method of claim 24, wherein the UE receives, together with the ID of the activated secure PRACH resource, an indication that the UE is allowed to: The RA procedure is initiated based on the at least one common PRACH resource, and if the RA procedure based on the at least one common PRACH resource is unsuccessful, switching from the at least one common PRACH resource to the activated security PRACH resource.

27. The method according to any one of claims 24 to 26, wherein the UE receives the at least one secure PRACH resource in an encrypted message, the encrypted message being encrypted using an encryption key known in advance by the UE.

28. The method according to any one of claims 24 to 27, wherein the at least one security PRACH resource is valid within a geographical area comprising one or more cells.

29. The method according to any one of claims 24 to 28, wherein the ID of the activated secure PRACH resource comprises at least one of the following: The format of the PRACH preamble; The system frame and subframe in which the PRACH preamble is to be sent; A time domain position for the PRACH preamble; A frequency domain position for the PRACH preamble; Logical root sequence index.

30. The method according to any one of claims 24 to 29, wherein the UE receives a duration for which the activated security PRACH resource is valid together with the ID of the activated security PRACH resource.

Images