Security of downlink signaling

Abstract

Methods, systems, and devices for wireless communication are described. A user equipment (UE) may monitor a set of resources for one or more synchronization signal blocks (SSBs) associated with one or more pseudorandom sequences. The one or more pseudorandom sequences and the set of resources may be indicated by an output of a pseudorandom function (PRF) based on a timing parameter, a cell identifier, and a key. In some examples, the UE may monitor a set of resources for a downlink control channel within a set of control resources, where the set of resources for the downlink control channel is based on an output of the PRF. The UE communicates with a network entity via a cell associated with the cell identifier based on the monitoring.

Description

[0001] Cross-reference

[0002] This patent application claims the benefit of U.S. Patent Application No. 18 / 083,332, titled "SECURITY FOR DOWNLINK SIGNALING," filed on December 16, 2022, by Takeda et al., which is assigned to the assignee of the present application and is hereby expressly incorporated herein by reference. Technical Field

[0003] The following relates to wireless communication, including security of downlink signaling. Background Art

[0004] Wireless communication systems are widely deployed to provide various types of communication content, such as voice, video, packet data, messaging, broadcasting, etc. These systems may be capable of supporting communication with multiple users by sharing available system resources (e.g., time, frequency, and power). Examples of such multi-access systems include fourth-generation (4G) systems (such as Long-Term Evolution (LTE) systems, LTE-Advanced (LTE-A) systems, or LTE-A Pro systems) and fifth-generation (5G) systems (which may be referred to as New Radio (NR) systems). These systems may employ techniques such as Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal FDMA (OFDMA), or Discrete Fourier Transform Spread Orthogonal Frequency Division Multiplexing (DFT-S-OFDM). A wireless multi-access communication system may include one or more base stations, each of which supports wireless communication for communication devices, which may be referred to as User Equipment (UE). Summary of the Invention

[0005] The described techniques relate to improved methods, systems, devices, and apparatuses for supporting the security of downlink signaling. For example, the described techniques provide for using a Pseudo-Random Function (PRF) to randomize the resources or aspects of a Synchronization Signal Block (SSB) or a control channel pseudo-randomly. For example, a User Equipment or a network entity or both may utilize the PRF to effect frequency hopping of the SSB. The PRF may use a key (e.g., a UE-specific key or a UE common key), timing information, and a physical cell identifier as inputs, and the PRF may output timing information, frequency information, or sequence information for the SSB. For example, the PRF may output timing information for the SSB, such as the starting symbol for an SSB burst. In some examples, the PRF may output frequency information for the SSB, such as a frequency index or a synchronization raster index for an SSB burst. In some examples, the PRF may output a sequence index for an SSB burst or for individual SSBs of an SSB burst. In some examples, an initial control resource set or an initial downlink bandwidth part may be configured to be offset from the SSB, and the offset may be indicated or output by the PRF.

[0006] Similar techniques may be implemented to randomize the parameters for a control channel, such as a Physical Downlink Control Channel (PDCCH). For example, the timing information, frequency information, and scrambling information for the PDCCH may be randomized. The UE may determine the timing information, frequency information, or scrambling information for the control channel via the output of the PRF. In some examples, the parameters for a control resource set including the PDCCH or a search space set including the PDCCH may be randomized.

[0007] A method for wireless communication at a UE is described. The method may include: monitoring a resource set for one or more SSBs associated with one or more pseudo-random sequences, where the one or more pseudo-random sequences and the resource set are indicated by an output of a PRF based on timing parameters, a cell identifier, and a key; and communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the one or more SSBs.

[0008] An apparatus for wireless communication at a UE is described. The apparatus may include a processor, a memory coupled to the processor, and instructions stored in the memory. The instructions may be executable by the processor to cause the apparatus to: monitor a resource set for one or more SSBs associated with one or more pseudo-random sequences, where the one or more pseudo-random sequences and the resource set are indicated by an output of a PRF based on timing parameters, a cell identifier, and a key; and communicate with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the one or more SSBs.

[0009] Describes another apparatus for wireless communication at a UE. The apparatus may include: components for monitoring a resource set of one or more SSBs associated with one or more pseudo-random sequences, where the one or more pseudo-random sequences and the resource set are indicated by an output of a PRF based on timing parameters, a cell identifier, and a key; and components for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set of the one or more SSBs.

[0010] Describes a non-transitory computer-readable medium storing code for wireless communication at a UE. The code may include instructions executable by a processor for: monitoring a resource set of one or more SSBs associated with one or more pseudo-random sequences, where the one or more pseudo-random sequences and the resource set are indicated by an output of a PRF based on timing parameters, a cell identifier, and a key; and communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set of the one or more SSBs.

[0011] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, monitoring the resource set may include operations, features, components, or instructions for: monitoring a first burst of an SSB associated with a first pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the PRF; and monitoring a second burst of an SSB associated with a second pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the PRF.

[0012] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may also include operations, features, components, or instructions for: generating the first pseudo-random sequence and the second pseudo-random sequence based on one or more calls to the PRF.

[0013] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, monitoring the resource set may include operations, features, components, or instructions for: monitoring a first SSB of a burst of an SSB associated with a first pseudo-random sequence among the one or more pseudo-random sequences, where the first pseudo-random sequence may be indicated by the output of the PRF; and monitoring a second SSB of the burst of the SSB associated with a second pseudo-random sequence among the one or more pseudo-random sequences, where the second pseudo-random sequence may be indicated by the output of the PRF.

[0014] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, monitoring the resource set can include operations, features, components, or instructions for: monitoring a first burst of SSBs, wherein a first ordering of SSB indices for the first burst of synchronization blocks can be indicated by the output of the PRF; and monitoring a second burst of SSBs, wherein a second ordering of SSB indices for the second burst of synchronization blocks can be indicated by the output of the PRF.

[0015] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the output of the PRF indicates the first ordering and the second ordering based on the number of symbols per half-frame.

[0016] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein can further include operations, features, components, or instructions for: monitoring a first SSB of a burst of SSBs during a start symbol of the burst, wherein the start symbol can be indicated by the output of the PRF.

[0017] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the output of the PRF indicates the start symbol of the burst of SSBs based on the number of symbols per half-frame.

[0018] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, monitoring the resource set can include operations, features, components, or instructions for: monitoring a first burst of SSBs that is frequency-offset from a reference point by a first offset indicated by the output of the PRF; and monitoring a second burst of SSBs that is frequency-offset from the reference point by a second offset indicated by the output of the PRF.

[0019] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the output of the PRF indicates a first index of a synchronization raster for the first offset and a second index of the synchronization raster for the second offset.

[0020] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, monitoring the resource set can include operations, features, components, or instructions for: monitoring a first synchronization signal in a first SSB of the one or more SSBs, wherein a first sequence of the first synchronization signal can be indicated by the output of the PRF; and monitoring a second synchronization signal in the first SSB, wherein a second sequence of the second synchronization signal can be indicated by the output of the PRF.

[0021] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may also include operations, features, components, or instructions for: monitoring a control resource set that may be frequency-offset from the one or more SSBs by a fixed number of resource blocks.

[0022] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may also include operations, features, components, or instructions for: monitoring a control resource set during a first duration according to a first offset in frequency from a first burst of the SSB among the one or more SSBs, the first offset being indicated by the output of the PRF; and monitoring the control resource set during a second duration according to a second offset in frequency from a second burst of the SSB among the one or more SSBs, the second offset being indicated by the output of the PRF.

[0023] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the first offset may be indicated by the output of the PRF based on a first value indicated by a first master information block of the first burst of the SSB, and the second offset may be indicated by the output of the PRF based on a second value indicated by a second master information block of the second burst of the SSB.

[0024] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may also include operations, features, components, or instructions for: receiving, via a secure wireless channel, a control message indicating the key, where the key may be a UE-specific key or a UE public key.

[0025] A method for wireless communication at a UE is described. The method may include: monitoring a resource set for a downlink control channel within a control resource set, where the resource set is based on an output of a PRF, and where the output of the PRF is based on a timing parameter, a cell identifier, and a key; and communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel.

[0026] An apparatus for wireless communication at a UE is described. The apparatus may include a processor, a memory coupled to the processor, and instructions stored in the memory. The instructions may be executable by the processor to cause the apparatus to: monitor a resource set for a downlink control channel within a control resource set, where the resource set is based on an output of a PRF, and where the output of the PRF is based on a timing parameter, a cell identifier, and a key; and communicate with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel.

[0027] Describes another apparatus for wireless communication at a UE. The apparatus may include: means for monitoring a resource set for a downlink control channel within a control resource set, wherein the resource set is based on an output of a PRF, and wherein the output of the PRF is based on a timing parameter, a cell identifier, and a key; and means for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel.

[0028] Describes a non-transitory computer-readable medium storing code for wireless communication at a UE. The code may include instructions executable by a processor for: monitoring a resource set for a downlink control channel within a control resource set, wherein the resource set is based on an output of a PRF, and wherein the output of the PRF is based on a timing parameter, a cell identifier, and a key; and communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel.

[0029] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, monitoring the resource set may include operations, features, means, or instructions for: monitoring a first set of resource blocks for a first downlink control channel, wherein a first initial resource block in the first set of resource blocks may be indicated by the output of the PRF; and monitoring a second set of resource blocks for a second downlink control channel, wherein a second initial resource block in the second set of resource blocks may be indicated by the output of the PRF.

[0030] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the first set of resource blocks may be continuous within a downlink bandwidth part of the cell.

[0031] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the first set of resource blocks may be non-continuous and adjacent to a frequency edge of the downlink bandwidth part of the cell.

[0032] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may further include operations, features, means, or instructions for: determining the control resource set from a set of multiple control resource sets based on the output of the PRF, wherein the output of the PRF may be based on a search space identifier of a search space of the downlink control channel.

[0033] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may also include operations, features, components, or instructions for performing the following: receiving control signaling indicating that control resource set hopping can be implemented, where the control resource set can be determined from a set of multiple control resource sets based on the implementation of the control resource set hopping.

[0034] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, monitoring the resource set may include operations, features, components, or instructions for performing the following: monitoring a subset of search space sets from a set of multiple search space sets, where the subset of the search space set can be indicated by the output of the PRF.

[0035] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may also include operations, features, components, or instructions for performing the following: determining a parameter set for the control resource set from a set of multiple parameter sets, where the parameter set can be indicated by the output of the PRF.

[0036] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the parameter set for the control resource set includes frequency domain resource allocation, control resource set duration, control channel element to resource element group mapping, precoder granularity, transmission configuration indicator status, or any combination thereof.

[0037] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may also include operations, features, components, or instructions for performing the following: determining a parameter set for the search space set of the downlink control channel from a set of multiple parameter sets, where the parameter set can be indicated by the output of the PRF.

[0038] In some examples of the methods, apparatuses, and non-transitory computer-readable media described herein, the parameter set for the search space set includes a monitoring period or a resource indicator for a monitoring occasion, or both.

[0039] A method for wireless communication at a UE is described. The method may include: monitoring a resource set for a control message via a downlink control channel; and descrambling a payload of the control message based on a scrambling sequence, where the scrambling sequence is indicated by an output of a PRF based on timing parameters, a cell identifier, and a key.

[0040] Describes an apparatus for wireless communication at a UE. The apparatus may include a processor, a memory coupled to the processor, and instructions stored in the memory. The instructions may be executable by the processor to cause the apparatus to: monitor a resource set for control messages via a downlink control channel; and descramble a payload of the control message based on a scrambling sequence, where the scrambling sequence is indicated by an output of a PRF based on timing parameters, a cell identifier, and a key.

[0041] Describes another apparatus for wireless communication at a UE. The apparatus may include: means for monitoring a resource set for control messages via a downlink control channel; and means for descrambling a payload of the control message based on a scrambling sequence, where the scrambling sequence is indicated by an output of a PRF based on timing parameters, a cell identifier, and a key.

[0042] Describes a non-transitory computer-readable medium storing code for wireless communication at a UE. The code may include instructions executable by a processor for: monitoring a resource set for control messages via a downlink control channel; and descrambling a payload of the control message based on a scrambling sequence, where the scrambling sequence is indicated by an output of a PRF based on timing parameters, a cell identifier, and a key.

[0043] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may also include operations, features, means, or instructions for: determining an initial value of the scrambling sequence based on the output of the PRF; and descrambling the payload based on the initial value of the scrambling sequence.

[0044] Describes a method for wireless communication at a UE. The method may include: monitoring a resource set for control messages via a downlink control channel; and demodulating the control message based on a set of multiple demodulation reference signals received via the downlink control channel, where a sequence for the set of multiple demodulation reference signals is indicated by an output of a PRF based on timing parameters, a cell identifier, and a key.

[0045] Describes an apparatus for wireless communication at a UE. The apparatus may include a processor, a memory coupled to the processor, and instructions stored in the memory. The instructions may be executable by the processor to cause the apparatus to: monitor a resource set for control messages via a downlink control channel; and demodulate the control message based on a set of multiple demodulation reference signals received via the downlink control channel, where a sequence for the set of multiple demodulation reference signals is indicated by an output of a PRF based on timing parameters, a cell identifier, and a key.

[0046] Describes another apparatus for wireless communication at a UE. The apparatus may include: components for monitoring a resource set for control messages via a downlink control channel; and components for demodulating the control message based on a set of multiple demodulation reference signals received via the downlink control channel, wherein a sequence for the set of multiple demodulation reference signals is indicated by an output of a PRF based on timing parameters, a cell identifier, and a key.

[0047] Describes a non-transitory computer-readable medium storing code for wireless communication at a UE. The code may include instructions executable by a processor for: monitoring a resource set for control messages via a downlink control channel; and demodulating the control message based on a set of multiple demodulation reference signals received via the downlink control channel, wherein a sequence for the set of multiple demodulation reference signals is indicated by an output of a PRF based on timing parameters, a cell identifier, and a key.

[0048] Some examples of the methods, apparatuses, and non-transitory computer-readable media described herein may further include operations, features, components, or instructions for: determining quadrature phase shift keying symbols for the set of multiple demodulation reference signals based on the sequence for the set of multiple demodulation reference signals. BRIEF DESCRIPTION OF THE DRAWINGS

[0049] Figure 1 Illustrates examples of wireless communication systems supporting security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0050] Figure 2 Illustrates examples of wireless communication systems supporting security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0051] Figure 3 Illustrates examples of sequence randomization supporting security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0052] Figure 4 Illustrates examples of beam pattern randomization supporting security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0053] Figure 5 Illustrates examples of frequency domain randomization supporting security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0054] Figure 6 Illustrates examples of initial bandwidth part configuration supporting security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0055] Figure 7Illustrates an example of a control resource set hopping configuration that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0056] Figure 8 Illustrates an example of a search space set randomization that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0057] Figure 9 Illustrates an example of a process flow that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0058] Figure 10 Illustrates an example of a process flow that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0059] Figure 11 and Figure 12 Illustrates a block diagram of a device that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0060] Figure 13 Illustrates a block diagram of a communication manager that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0061] Figure 14 Illustrates a diagram of a system that includes a device that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure.

[0062] Figures 15 to 18 Illustrates a flowchart of a method that shows support for the security of downlink signaling in accordance with one or more aspects of the present disclosure. Detailed Description

[0063] A user equipment (UE) and network entities may communicate critical information on multiple different channels. For example, a synchronization signal block (SSB) may be a critical channel for processes such as initial access procedures, maintaining synchronization, radio link monitoring (RLM), radio resource management (RRM), beam management, etc. In some systems, the SSB is transmitted at a set period in set time-frequency resources, which may enable the UE to easily detect and track the SSB to perform critical processes. For higher security networks (such as tactical networks), it is desirable to implement physical layer security to prevent jammers or attacker devices from interfering with or receiving signaling carrying critical and secure information. For example, a jammer device may emit noise at a relatively low power onto the SSB bandwidth to prevent legitimate devices from receiving SSB signaling. In another example, if critical signals are transmitted or configured predictably, a spoofing or eavesdropping device may obtain network configuration (e.g., system information).

[0064] The wireless communication system described herein may utilize a Pseudo-Random Function (PRF) to implement frequency hopping of SSBs. The PRF may use a shared key (e.g., a UE-specific key or a UE common key), timing information, and a physical cell identifier as inputs, and the PRF may output timing information, frequency information, or sequence information for the SSBs. For example, the PRF may output timing information for the SSBs, such as the starting symbol for an SSB burst. In some examples, the PRF may output frequency information for the SSBs, such as a frequency index or a synchronization raster index for an SSB burst. In some examples, the PRF may output a sequence index for an SSB burst or for individual SSBs of an SSB burst. In some examples, an initial control resource set (e.g., control resource set 0) may be configured to be offset from the SSB, and the offset may be indicated or output by the PRF.

[0065] Similar techniques may be implemented to randomize parameters for control channels (such as the Physical Downlink Control Channel (PDCCH)). For example, the timing information, frequency information, and scrambling information for the PDCCH may be randomized. The UE may determine the timing information, frequency information, or scrambling information for the control channel via the output of the PRF. In some examples, the parameters for a control resource set including the PDCCH or a search space set including the PDCCH may be randomized.

[0066] Aspects of the present disclosure are first described in the context of a wireless communication system. Aspects of the present disclosure are further illustrated by device diagrams, system diagrams, and flowcharts relating to the security of downlink signaling, and aspects of the present disclosure are described with reference to these diagrams.

[0067] Figure 1 An example of a wireless communication system 100 that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure is illustrated. The wireless communication system 100 may include one or more network entities 105, one or more UEs 115, and a core network 130. In some examples, the wireless communication system 100 may be a Long-Term Evolution (LTE) network, an LTE-Advanced (LTE-A) network, an LTE-A Pro network, a New Radio (NR) network, or a network operating according to other systems and radio technologies including future systems and radio technologies not explicitly mentioned herein.

[0068] Network entity 105 can be dispersed throughout a geographical area to form a wireless communication system 100 and can include devices in different forms or with different capabilities. In various examples, network entity 105 can be referred to as a network element, a mobility element, a radio access network (RAN) node, or network equipment, among other designations. In some examples, network entity 105 and UE 115 can communicate wirelessly via one or more communication links 125 (e.g., radio frequency (RF) access links). For example, network entity 105 can support a coverage area 110 (e.g., a geographical coverage area) within which UE 115 and network entity 105 can establish one or more communication links 125. Coverage area 110 can be an example of a geographical area within which network entity 105 and UE 115 can support signal communication according to one or more radio access technologies (RATs).

[0069] UE 115 can be dispersed throughout coverage area 110 of wireless communication system 100, and each UE 115 can be stationary or mobile or stationary and mobile at different times. UE 115 can be a device in different forms or with different capabilities. Figure 1 Some example UEs 115 are illustrated. The UEs 115 described herein can be capable of supporting communication with various types of devices (such as other UEs 115 or network entity 105 as Figure 1 shown).

[0070] As described herein, a node of the wireless communication system 100 (which may be referred to as a network node or a wireless node) can be a network entity 105 (e.g., any network entity described herein), a UE 115 (e.g., any UE described herein), a network controller, a device, an equipment, a computing system, one or more components, or another suitable processing entity configured to perform any of the techniques described herein. For example, the node can be a UE 115. As another example, the node can be a network entity 105. As yet another example, a first node can be configured to communicate with a second node or a third node. In one aspect of this example, the first node can be a UE 115, the second node can be a network entity 105, and the third node can be a UE 115. In another aspect of this example, the first node can be a UE 115, the second node can be a network entity 105, and the third node can be a network entity 105. In other aspects of this example, the first node, the second node, and the third node can be different from these examples. Similarly, references to UE 115, network entity 105, device, equipment, computing system, etc. can include the disclosure of UE 115, network entity 105, device, equipment, computing system, etc. as nodes. For example, the disclosure that UE 115 is configured to receive information from network entity 105 also discloses that a first node is configured to receive information from a second node.

[0071] In some examples, network entity 105 can communicate with core network 130, or with each other, or both. For example, network entity 105 can communicate with core network 130 via one or more backhaul communication links 120 (e.g., according to S1, N2, N3, or other interface protocols). In some examples, network entity 105 can communicate with each other directly (e.g., directly between network entities 105) or indirectly (e.g., via core network 130) via backhaul communication link 120 (e.g., according to X2, Xn, or other interface protocols). In some examples, network entity 105 can communicate with each other via midhaul communication link 162 (e.g., according to midhaul interface protocol) or fronthaul communication link 168 (e.g., according to fronthaul interface protocol) or any combination thereof. Backhaul communication link 120, midhaul communication link 162, or fronthaul communication link 168 can be or include one or more wired links (e.g., electrical link, optical fiber link), one or more wireless links (e.g., radio link, wireless optical link), etc. or various combinations thereof. UE 115 can communicate with core network 130 via communication link 155.

[0072] One or more of the network entities 105 described herein may include or may be referred to as a base station 140 (e.g., transceiver base station, radio base station, NR base station, access point, radio transceiver, Node B, evolved Node B (eNB), next-generation Node B or gigabit Node B (any of which may be referred to as a gNB), 5G NB, next-generation eNB (ng-eNB), home Node B, home evolved Node B, or other suitable terms). In some examples, the network entity 105 (e.g., base station 140) may be implemented in an integrated (e.g., monolithic, stand-alone) base station architecture that may be configured to utilize a protocol stack physically or logically integrated within a single network entity 105 (e.g., a single RAN node, such as base station 140).

[0073] In some examples, the network entity 105 may be implemented in a disaggregated architecture (e.g., disaggregated base station architecture, disaggregated RAN architecture) that may be configured to utilize a protocol stack physically or logically distributed among two or more network entities 105 (such as an integrated access backhaul (IAB) network, an open RAN (O-RAN) (e.g., a network configuration sponsored by the O-RAN Alliance), or a virtualized RAN (vRAN) (e.g., cloud RAN (C-RAN))). For example, the network entity 105 may include one or more of the following: a central unit (CU) 160, a distributed unit (DU) 165, a radio unit (RU) 170, a RAN intelligent controller (RIC) 175 (e.g., near-real-time RIC (near-RT RIC), non-real-time RIC (non-RT RIC)), a service management and orchestration (SMO) 180 system, or any combination thereof. The RU 170 may also be referred to as a radio head, intelligent radio head, remote radio head (RRH), remote radio unit (RRU), or transmit receive point (TRP). One or more components of the network entity 105 in a disaggregated RAN architecture may be co-located, or one or more components of the network entity 105 may be located in distributed locations (e.g., separate physical locations). In some examples, one or more network entities 105 of the disaggregated RAN architecture may be implemented as virtual units (e.g., virtual CU (VCU), virtual DU (VDU), virtual RU (VRU)).

[0074] The functional split between the CU 160, DU 165, and RU 170 is flexible and can support different functions, depending on which functions are performed at the CU 160, DU 165, or RU 170 (e.g., network layer functions, protocol layer functions, baseband functions, RF functions, and any combination thereof). For example, a functional split of the protocol stack can be employed between the CU 160 and DU 165 such that the CU 160 can support one or more layers of the protocol stack and the DU 165 can support one or more different layers of the protocol stack. In some examples, the CU 160 can host higher protocol layer (e.g., layer 3 (L3), layer 2 (L2)) functions and signaling (e.g., radio resource control (RRC), service data adaptation protocol (SDAP), packet data convergence protocol (PDCP)). The CU 160 can be connected to one or more DU 165s or RU 170s, and one or more DU 165s or RU 170s can host lower protocol layers, such as layer 1 (L1) (e.g., physical (PHY) layer) or L2 (e.g., radio link control (RLC) layer, media access control (MAC) layer) functions and signaling, and can each be at least partially controlled by the CU 160. Additionally or alternatively, a functional split of the protocol stack can be employed between the DU 165 and RU 170 such that the DU 165 can support one or more layers of the protocol stack and the RU 170 can support one or more different layers of the protocol stack. The DU 165 can support one or more different cells (e.g., via one or more RU 170s). In some cases, the functional split between the CU 160 and DU 165 or between the DU 165 and RU 170 can be within a protocol layer (e.g., some functions of the protocol layer can be performed by one of the CU 160, DU 165, or RU 170, while other functions of the protocol layer are performed by a different one of the CU 160, DU 165, or RU 170). The CU 160 can be further functionally split into a CU control plane (CU-CP) and a CU user plane (CU-UP) function. The CU 160 can be connected to one or more DU 165s via an intermediate transport communication link 162 (e.g., F1, F1-c, F1-u), and the DU 165 can be connected to one or more RU 170s via a fronthaul communication link 168 (e.g., open fronthaul (FH) interface). In some examples, the intermediate transport communication link 162 or the fronthaul communication link 168 can be implemented according to the interfaces (e.g., channels) between the layers of the protocol stack, which are supported by the corresponding network entities 105 communicating via these communication links.

[0075] In some wireless communication systems (e.g., wireless communication system 100), the infrastructure and spectrum resources for radio access may support wireless backhaul link capabilities to supplement wired backhaul connections and thus provide an IAB network architecture (e.g., to core network 130). In some cases, in an IAB network, one or more network entities 105 (e.g., IAB node 104) may be controlled in part by each other. One or more IAB nodes 104 may be referred to as donor entities or IAB donors. One or more DUs 165 or one or more RUs 170 may be controlled in part by one or more CUs 160 associated with a donor network entity 105 (e.g., donor base station 140). One or more donor network entities 105 (e.g., IAB donors) may communicate with one or more additional network entities 105 (e.g., IAB nodes 104) via the supported access and backhaul links (e.g., backhaul communication link 120). An IAB node 104 may include an IAB mobile terminal (IAB-MT) controlled (e.g., scheduled) by a DU 165 of a coupled IAB donor. The IAB-MT may include a separate set of antennas for relaying communications with the UE 115 or may share the same antennas (e.g., of an RU 170 of the IAB node 104) for access via the DU 165 of the IAB node 104 (e.g., referred to as a virtual IAB-MT (vIAB-MT)). In some examples, the IAB node 104 may include a DU 165 that supports communication links with additional entities (e.g., IAB nodes 104, UEs 115) within a relay chain or configuration (e.g., downstream) of the access network. In such cases, one or more components of the split RAN architecture (e.g., one or more IAB nodes 104 or components of the IAB node 104) may be configured to operate in accordance with the techniques described herein.

[0076] For example, the access network (AN) or RAN may include communication between an access node (e.g., an IAB donor), an IAB node 104, and one or more UEs 115. The IAB donor may facilitate the connection between the core network 130 and the AN (e.g., via a wired or wireless connection to the core network 130). That is, the IAB donor may refer to a RAN node having a wired or wireless connection to the core network 130. The IAB donor may include a CU 160 and at least one DU 165 (e.g., and a RU 170), in which case the CU 160 may communicate with the core network 130 via an interface (e.g., a fronthaul link). The IAB donor and the IAB node 104 may communicate via an F1 interface according to a protocol defining signaling messages (e.g., the F1 AP protocol). Additionally or alternatively, the CU 160 may communicate with the core network via an interface (which may be an example of a part of the fronthaul link), and may communicate with other CUs 160 (e.g., CUs 160 associated with alternative IAB donors) via an Xn-C interface (which may be an example of a part of the fronthaul link).

[0077] The IAB node 104 may refer to a RAN node that provides IAB functionality (e.g., access for the UE 115, wireless self-backhaul capabilities, etc.). The DU 165 may act as a distributed scheduling node towards the child nodes associated with the IAB node 104, and the IAB-MT may act as a scheduled node towards the parent node associated with the IAB node 104. That is, the IAB donor may be referred to as a parent node that communicates with one or more child nodes (e.g., the IAB donor may relay the transmission of the UE through one or more other IAB nodes 104). Additionally or alternatively, depending on the relay chain or configuration of the AN, the IAB node 104 may also be referred to as a parent node or a child node of other IAB nodes 104. Thus, the IAB-MT entity of the IAB node 104 may provide a Uu interface for the child IAB node 104 to receive signaling from the parent IAB node 104, and the DU interface (e.g., DU 165) may provide a Uu interface for the parent IAB node 104 to signal to the child IAB node 104 or the UE 115.

[0078] For example, the IAB node 104 may be referred to as a parent node that supports communication for a child IAB node or as a child IAB node associated with an IAB donor or both. The IAB donor may include a CU 160 having a wired or wireless connection (e.g., a backhaul communication link 120) to the core network 130 and may act as the parent node of the IAB node 104. For example, the DU 165 of the IAB donor may relay transmissions to the UE 115 via the IAB node 104, or may signal transmissions directly to the UE 115, or both. The CU 160 of the IAB donor may signal communication link establishment to the IAB node 104 via the F1 interface, and the IAB node 104 may schedule transmissions (e.g., transmissions relayed from the IAB donor to the UE 115) via the DU 165. That is, data may be relayed to and from the IAB node 104 via signaling over the NR Uu interface to the MT of the IAB node 104. Communication with the IAB node 104 may be scheduled by the DU 165 of the IAB donor, and communication with the IAB node 104 may be scheduled by the DU 165 of the IAB node 104.

[0079] In the case where the techniques described herein are applied in the context of a split RAN architecture, one or more components of the split RAN architecture may be configured to support the security of downlink signaling as described herein. For example, some operations described as being performed by the UE 115 or the network entity 105 (e.g., the base station 140) may additionally or alternatively be performed by one or more components of the split RAN architecture (e.g., the IAB node 104, the DU 165, the CU 160, the RU 170, the RIC 175, the SMO 180).

[0080] The UE 115 may include or may be referred to as a mobile device, a wireless device, a remote device, a handheld device, or a subscriber device, or some other suitable term, where "device" may also be referred to as a unit, a station, a terminal, or a client, etc. The UE 115 may also include or may be referred to as a personal electronic device, such as a cellular phone, a personal digital assistant (PDA), a tablet computer, a laptop computer, or a personal computer. In some examples, the UE 115 may include or may be referred to as a wireless local loop (WLL) station, an Internet of Things (IoT) device, an Internet of Everything (IoE) device, or a machine type communication (MTC) device, etc., which may be implemented in various objects such as appliances or vehicles, meters, etc.

[0081] The UE 115 described herein may be capable of communicating with various types of devices such as other UE 115s that may sometimes act as relays, as well as network entities 105 and network equipment including macro eNBs or gNBs, small cell eNBs or gNBs, or relay base stations, etc., asFigure 1 as shown

[0082] UE 115 and network entity 105 may wirelessly communicate with each other via one or more communication links 125 (e.g., access links) using resources associated with one or more carriers. The term “carrier” may refer to a set of RF spectrum resources having a defined physical layer structure for supporting communication link 125. For example, a carrier for communication link 125 may include a portion (e.g., bandwidth part (BWP)) of an RF spectrum band operating according to one or more physical layer channels for a given radio access technology (e.g., LTE, LTE-A, LTE-A Pro, NR). Each physical layer channel may carry acquisition signaling (e.g., synchronization signals, system information), control signaling for coordinating carrier operation, user data, or other signaling. Wireless communication system 100 may support communication with UE 115 using carrier aggregation or multi-carrier operation. According to a carrier aggregation configuration, UE 115 may be configured to have multiple downlink component carriers and one or more uplink component carriers. Carrier aggregation may be used for both frequency division duplex (FDD) and time division duplex (TDD) component carriers. Communication between network entity 105 and other devices may refer to communication between these devices and any part (e.g., entity, sub-entity) of network entity 105. For example, the terms “transmit,” “receive,” or “communicate” when referring to network entity 105 may refer to any part of network entity 105 of the RAN (e.g., base station 140, CU 160, DU 165, RU 170) communicating with another device (e.g., directly or via one or more other network entities 105).

[0083] In some examples, such as in a carrier aggregation configuration, a carrier may also have acquisition signaling or control signaling for coordinating the operation of other carriers. A carrier may be associated with a frequency channel (e.g., evolved universal mobile telecommunications system terrestrial radio access (E-UTRA) absolute RF channel number (EARFCN)) and may be identified according to a channel raster for discovery by UE 115. A carrier may operate in stand-alone mode, in which case initial acquisition and connection may be performed by UE 115 via the carrier, or a carrier may operate in non-stand-alone mode, in which case a different carrier (e.g., of the same or different radio access technology) is used to anchor the connection.

[0084] The communication link 125 shown in the wireless communication system 100 may include a downlink transmission (e.g., forward link transmission) from the network entity 105 to the UE 115, an uplink transmission (e.g., reverse link transmission) from the UE 115 to the network entity 105, or both, as well as other transmission configurations. A carrier may carry downlink communication or uplink communication (e.g., in FDD mode), or may be configured to carry both downlink communication and uplink communication (e.g., in TDD mode).

[0085] A carrier may be associated with a particular bandwidth of the RF spectrum, and in some examples, the carrier bandwidth may be referred to as the "system bandwidth" of the carrier or the wireless communication system 100. For example, the carrier bandwidth may be one of a set of bandwidths of carriers of a particular radio access technology (e.g., 1.4 megahertz (MHz), 3 MHz, 5 MHz, 10 MHz, 15 MHz, 20 MHz, 40 MHz, or 80 MHz). Devices of the wireless communication system 100 (e.g., the network entity 105, the UE 115, or both) may have a hardware configuration that supports communication using a particular carrier bandwidth, or may be capable of being configured to support communication using one of a set of carrier bandwidths. In some examples, the wireless communication system 100 may include a network entity 105 or a UE 115 that supports concurrent communication using carriers associated with multiple carrier bandwidths. In some examples, each served UE 115 may be configured to operate using a portion (e.g., sub-band, BWP) or all of the carrier bandwidth.

[0086] The signal waveform transmitted via a carrier may include a plurality of subcarriers (e.g., using a multi-carrier modulation (MCM) technique such as orthogonal frequency division multiplexing (OFDM) or discrete Fourier transform spread OFDM (DFT-S-OFDM)). In a system employing an MCM technique, a resource element may refer to the resource of one symbol period (e.g., the duration of one modulation symbol) and one subcarrier, in which case the symbol period and the subcarrier spacing may be inversely related. The number of bits carried by each resource element may depend on the modulation scheme (e.g., the order of the modulation scheme, the decoding rate of the modulation scheme, or both), such that a relatively high number of resource elements (e.g., during the transmission duration) and a relatively high order of the modulation scheme may correspond to a relatively high communication rate. Wireless communication resources may refer to a combination of RF spectrum resources, time resources, and spatial resources (e.g., spatial layers or beams), and the use of multiple spatial resources may increase the data rate or data integrity for communication with the UE 115.

[0087] One or more parameter sets for a carrier are supported, and the parameter sets may include subcarrier spacing (Δf) and cyclic prefix. A carrier may be divided into one or more BWPs with the same or different parameter sets. In some examples, UE 115 may be configured with multiple BWPs. In some examples, a single BWP of a carrier may be active at a given time, and the communication of UE 115 may be restricted to one or more active BWPs.

[0088] A time interval for network entity 105 or UE 115 can be expressed as a multiple of a basic time unit, which may refer to, for example, the sampling period T. s = 1 / (Δf max ·N f ) seconds, where Δf max may represent the supported subcarrier spacing, and N f may represent the supported discrete Fourier transform (DFT) size. The time intervals of communication resources can be organized according to radio frames each having a specified duration (e.g., 10 milliseconds (ms)). Each radio frame can be identified by a system frame number (SFN) (e.g., ranging from 0 to 1023).

[0089] Each frame may include a plurality of consecutively numbered subframes or time slots, and each subframe or time slot may have the same duration. In some examples, a frame may be divided (e.g., in the time domain) into subframes, and each subframe may be further divided into a certain number of time slots. Alternatively, each frame may include a variable number of time slots, and the number of time slots may depend on the subcarrier spacing. Each time slot may include a certain number of symbol periods (e.g., depending on the length of the cyclic prefix appended to each symbol period). In some wireless communication systems 100, a time slot may be further divided into a plurality of mini-slots associated with one or more symbols. Excluding the cyclic prefix, each symbol period may be associated with one or more (e.g., N f ones) sampling periods. The duration of a symbol period may depend on the subcarrier spacing or the operating frequency band.

[0090] A subframe, time slot, mini-slot or symbol may be the smallest scheduling unit (e.g., in the time domain) of wireless communication system 100 and may be referred to as a transmission time interval (TTI). In some examples, the TTI duration (e.g., the number of symbol periods in a TTI) may be variable. Additionally or alternatively, the smallest scheduling unit of wireless communication system 100 may be dynamically selected (e.g., in a burst of shortened TTIs (sTTIs)).

[0091] Physical channels can be multiplexed according to various techniques for communication using a carrier. For example, one or more of time-division multiplexing (TDM) techniques, frequency-division multiplexing (FDM) techniques, or hybrid TDM-FDM techniques can be used to multiplex physical control channels and physical data channels for signaling via a downlink carrier. The control region of a physical control channel (e.g., a control resource set (CORESET)) can be defined by a set of symbol periods and can extend across the system bandwidth of a carrier or a subset of the system bandwidth. One or more control regions (e.g., CORESETs) can be configured for a set of UEs 115. For example, one or more of the UEs 115 can monitor or search a control region for control information according to one or more search space sets, and each search space set can include one or more control channel candidates in one or more aggregation levels arranged in a cascaded manner. The aggregation level of a control channel candidate can refer to the amount of control channel resources (e.g., control channel elements (CCEs)) associated with the coded information for a control information format with a given payload size. The search space sets can include a common search space set configured to transmit control information to multiple UEs 115 and a UE-specific search space set for transmitting control information to a specific UE 115.

[0092] The network entity 105 can provide communication coverage via one or more cells (e.g., macro cells, small cells, hotspots, or other types of cells or any combination thereof). The term "cell" can refer to a logical communication entity for communicating with the network entity 105 (e.g., using a carrier) and can be associated with an identifier (e.g., a physical cell identifier (PCID), a virtual cell identifier (VCID), or other identifier) for distinguishing adjacent cells. In some examples, a cell can also refer to a coverage area 110 or a portion of the coverage area 110 (e.g., a sector) within which the logical communication entity operates. Depending on various factors (such as the capabilities of the network entity 105), the scope of such a cell can range from a smaller area (e.g., a structure, a subset of a structure) to a larger area. For example, a cell can be or can include a building, a subset of a building, or an external space between or overlapping coverage areas 110, etc.

[0093] Macro cells typically cover a relatively large geographical area (e.g., with a radius of several kilometers) and may allow unrestricted access to UEs 115 having a service subscription with the network provider that supports the macro cell. Compared with macro cells, small cells may be associated with lower power network entities 105 (e.g., lower power base stations 140), and small cells may operate using the same or different (e.g., licensed, unlicensed) frequency bands as macro cells. Small cells may provide unrestricted access to UEs 115 having a service subscription with the network provider, or may provide restricted access to UEs 115 associated with the small cell (e.g., UEs 115 in a closed subscriber group (CSG), UEs 115 associated with users in a home or office). Network entity 105 may support one or more cells and may also support communication via one or more cells using one or more component carriers.

[0094] In some examples, a carrier may support multiple cells and may be configured with different cells according to different protocol types that may provide access for different types of devices (e.g., MTC, narrowband IoT (NB-IoT), enhanced mobile broadband (eMBB)).

[0095] In some examples, network entity 105 (e.g., base station 140, RU 170) may be movable and thus provide communication coverage for a mobile coverage area 110. In some examples, different coverage areas 110 associated with different technologies may overlap, but different coverage areas 110 may be supported by the same network entity 105. In some other examples, overlapping coverage areas 110 associated with different technologies may be supported by different network entities 105. The wireless communication system 100 may include, for example, a heterogeneous network in which different types of network entities 105 use the same or different radio access technologies to provide coverage for various coverage areas 110.

[0096] The wireless communication system 100 may support synchronous or asynchronous operation. For synchronous operation, network entity 105 (e.g., base station 140) may have similar frame timing, and transmissions from different network entities 105 may be approximately aligned in time. For asynchronous operation, network entity 105 may have different frame timing, and in some examples, transmissions from different network entities 105 may not be aligned in time. The techniques described herein may be used for synchronous or asynchronous operation.

[0097] Some UEs 115, such as MTC or IoT devices, can be low-cost or low-complexity devices and can allow for automated communication between machines (e.g., via machine-to-machine (M2M) communication). M2M communication or MTC can refer to data communication technologies that allow devices to communicate with each other or with network entity 105 (e.g., base station 140) without human intervention. In some examples, M2M communication or MTC can include communication from devices with integrated sensors or meters to measure or capture information and relay such information to a central server or application that uses the information or presents the information to a person interacting with the application. Some UEs 115 can be designed to collect information or enable automated behavior of machines or other devices. Examples of applications for MTC devices include: smart metering, inventory monitoring, water level monitoring, equipment monitoring, healthcare monitoring, wilderness survival monitoring, weather and geographical event monitoring, formation management and tracking, remote security sensing, physical access control, and transaction-based commercial charging.

[0098] Some UEs 115 can be configured to operate in power-saving modes, such as half-duplex communication (e.g., a mode that supports one-way communication via transmission or reception but not concurrent transmission and reception). In some examples, half-duplex communication can be performed at a reduced peak rate. Other power-saving techniques for UEs 115 include: entering a power-saving deep sleep mode when not participating in active communication, operating using limited bandwidth (e.g., according to narrowband communication), or a combination of these techniques. For example, some UEs 115 can be configured to operate using a narrowband protocol type associated with a defined portion or range (e.g., a set of subcarriers or resource blocks (RBs)) within a carrier, within a guard band of the carrier, or outside the carrier.

[0099] Wireless communication system 100 can be configured to support ultra-reliable communication or low-latency communication or various combinations thereof. For example, wireless communication system 100 can be configured to support ultra-reliable low-latency communication (URLLC). UEs 115 can be designed to support ultra-reliable or low-latency or critical functions. Ultra-reliable communication can include private communication or group communication and can be supported by one or more services (such as push-to-talk, video, or data). Support for ultra-reliable, low-latency functions can include prioritization of services, and such services can be used for public safety or general commercial applications. The terms ultra-reliable, low-latency, and ultra-reliable low-latency can be used interchangeably herein.

[0100] In some examples, UE 115 may be configured to support communicating directly with other UEs 115 via a device-to-device (D2D) communication link 135 (e.g., according to a peer-to-peer (P2P), D2D, or sidelink protocol). In some examples, one or more UEs 115 performing D2D communication in a group may be within the coverage area 110 of a network entity 105 (e.g., base station 140, RU 170), which may support aspects of such D2D communication configured (e.g., scheduled) by the network entity 105. In some examples, one or more UEs 115 in such a group may be outside the coverage area 110 of the network entity 105, or may otherwise be unable or not configured to receive transmissions from the network entity 105. In some examples, a group of UEs 115 communicating via D2D communication may support a one-to-many (1:M) system, where each UE 115 transmits to each of the other UEs 115 in the group. In some examples, the network entity 105 may facilitate scheduling of resources for D2D communication. In some other examples, D2D communication may be performed between UEs 115 without involving the network entity 105.

[0101] In some systems, the D2D communication link 135 may be an example of a communication channel (such as a sidelink communication channel) between vehicles (e.g., UE 115). In some examples, vehicles may communicate using vehicle-to-everything (V2X) communication, vehicle-to-vehicle (V2V) communication, or some combination of these. Vehicles may signal information related to traffic conditions, signal scheduling, weather, safety, emergencies, or any other information related to the V2X system. In some examples, vehicles in a V2X system may communicate with roadside infrastructure (such as roadside units), or communicate with the network via one or more network nodes (e.g., network entity 105, base station 140, RU 170) using vehicle-to-network (V2N) communication, or both.

[0102] The core network 130 can provide user authentication, access authorization, tracking, Internet Protocol (IP) connectivity, and other access, routing, or mobility functions. The core network 130 can be an evolved packet core (EPC) or a 5G core (5GC), which can include at least one control plane entity for managing access and mobility (e.g., a mobility management entity (MME), an access and mobility management function (AMF)) and at least one user plane entity for routing packets or interconnecting to an external network (e.g., a serving gateway (S-GW), a packet data network (PDN) gateway (P-GW), or a user plane function (UPF)). The control plane entity can manage non-access stratum (NAS) functions, such as mobility, authentication, and bearer management of the UE 115 served by a network entity 105 (e.g., a base station 140) associated with the core network 130. User IP packets can be transmitted through the user plane entity, which can provide IP address allocation and other functions. The user plane entity can be connected to the IP services 150 of one or more network operators. The IP services 150 can include access to the Internet, an intranet, an IP multimedia subsystem (IMS), or a packet-switched streaming service.

[0103] The wireless communication system 100 can operate using one or more frequency bands in the range of 300 megahertz (MHz) to 300 gigahertz (GHz). Generally, the region from 300 MHz to 3 GHz is referred to as the ultra-high frequency (UHF) region or the decimeter band, because in terms of length, the wavelength range is from approximately one decimeter to one meter. UHF waves can be blocked or redirected by buildings and environmental features (which can be referred to as clutter), but these waves can be sufficient to penetrate structures so that macro cells can serve UEs 115 located indoors. Compared with communication using smaller frequencies and longer wavelengths in the high frequency (HF) or very high frequency (VHF) portions of the spectrum below 300 MHz, communication using UHF waves can be associated with smaller antennas and shorter ranges (e.g., less than 100 kilometers).

[0104] The wireless communication system 100 may also operate in the super high frequency (SHF) region (also known as the centimeter band) that can be in the range of 3 GHz to 30 GHz or in the extremely high frequency (EHF) region of the spectrum (e.g., 30 GHz to 300 GHz) (also known as the millimeter band). In some examples, the wireless communication system 100 may support millimeter wave (mmW) communication between the UE 115 and the network entity 105 (e.g., the base station 140, the RU 170), and the EHF antennas of the corresponding devices may be smaller and closer spaced than UHF antennas. In some examples, such techniques may facilitate the use of antenna arrays within the device. However, the propagation of EHF transmission may have even greater attenuation and shorter range compared to SHF or UHF transmission. The techniques disclosed herein may be employed across transmissions using one or more different frequency regions, and the use of frequency bands designated across these frequency regions may vary by country or regulatory body.

[0105] The wireless communication system 100 may utilize licensed and unlicensed RF spectrum bands. For example, the wireless communication system 100 may use an unlicensed band (such as the 5 GHz industrial, scientific, and medical (ISM) band) to employ licensed-assisted access (LAA), long term evolution unlicensed (LTE-U) radio access technology, or NR technology. When operating using an unlicensed RF spectrum band, devices such as the network entity 105 and the UE 115 may employ carrier sensing for collision detection and avoidance. In some examples, the operation using the unlicensed band may be based on a carrier aggregation configuration (e.g., LAA) in combination with the operation using a licensed band. The operation using the unlicensed spectrum may include downlink transmission, uplink transmission, peer-to-peer (P2P) transmission, device-to-device (D2D) transmission, and so on.

[0106] The network entity 105 (e.g., the base station 140, the RU 170) or the UE 115 may be equipped with multiple antennas, which may be used to employ techniques such as transmit diversity, receive diversity, multiple-input multiple-output (MIMO) communication, or beamforming. The antennas of the network entity 105 or the UE 115 may be located within one or more antenna arrays or antenna panels, which may support MIMO operation or transmit or receive beamforming. For example, one or more base station antennas or antenna arrays may be co-located at an antenna assembly, such as an antenna tower. In some examples, the antennas or antenna arrays associated with the network entity 105 may be located at different geographical locations. The network entity 105 may include an antenna array having a set of antenna ports in multiple rows and columns that the network entity 105 may use to support beamforming for communication with the UE 115. Similarly, the UE 115 may include one or more antenna arrays, which may support various MIMO or beamforming operations. Additionally or alternatively, the antenna panel may support RF beamforming for signals transmitted via the antenna ports.

[0107] The network entity 105 or the UE 115 can use MIMO communication to utilize multipath signal propagation and improve spectral efficiency by transmitting or receiving multiple signals via different spatial layers. Such techniques can be referred to as spatial multiplexing. The multiple signals can be transmitted, for example, by a transmitting device via different antennas or different combinations of antennas. Similarly, the multiple signals can be received by a receiving device via different antennas or different combinations of antennas. Each of the multiple signals can be referred to as a separate spatial stream and can carry information associated with the same data stream (e.g., the same codeword) or different data streams (e.g., different codewords). Different spatial layers can be associated with different antenna ports for channel measurement and reporting. MIMO techniques include: single-user MIMO (SU-MIMO), for which multiple spatial layers are transmitted to the same receiving device; and multi-user MIMO (MU-MIMO), for which multiple spatial layers are transmitted to multiple devices.

[0108] Beamforming (which can also be referred to as spatial filtering, directional transmission, or directional reception) is a signal processing technique that can be used at a transmitting device or a receiving device (e.g., the network entity 105, the UE 115) to shape or direct an antenna beam (e.g., a transmit beam, a receive beam) along a spatial path between the transmitting device and the receiving device. Beamforming can be achieved by combining signals conveyed via the antenna elements of an antenna array such that some signals propagating in a particular direction relative to the antenna array experience constructive interference while other signals experience destructive interference. The adjustment of the signals conveyed via the antenna elements can include the transmitting device or the receiving device applying an amplitude offset, a phase offset, or both to the signals carried via the antenna elements associated with the device. The adjustment associated with each of these antenna elements can be defined by a set of beamforming weights associated with a particular direction (e.g., relative to the antenna array of the transmitting device or the receiving device or relative to some other direction).

[0109] The network entity 105 or the UE 115 may use beam scanning techniques as part of beamforming operations. For example, the network entity 105 (e.g., the base station 140, the RU 170) may use multiple antennas or antenna arrays (e.g., antenna panels) to perform beamforming operations for directional communication with the UE 115. Some signals (e.g., synchronization signals, reference signals, beam selection signals, or other control signals) may be sent by the network entity 105 multiple times in different directions. For example, the network entity 105 may send signals according to different beamforming weight sets associated with different transmission directions. Transmissions along different beam directions may be used to identify (e.g., by the transmitting device such as the network entity 105, or by the receiving device such as the UE 115) the beam directions for later transmission or reception by the network entity 105.

[0110] Some signals (such as data signals associated with a particular receiving device) may be sent by a transmitting device (e.g., the transmitting network entity 105, the transmitting UE 115) along a single beam direction (e.g., the direction associated with the receiving device such as the receiving network entity 105 or the receiving UE 115). In some examples, the beam direction associated with the transmission along a single beam direction may be determined based on signals transmitted along one or more beam directions. For example, the UE 115 may receive one or more of the signals sent by the network entity 105 in different directions, and may report to the network entity 105 an indication of the signal that the UE 115 receives with the highest signal quality or other acceptable signal quality.

[0111] In some examples, transmissions performed by a device (e.g., by network entity 105 or UE 115) may be carried out using multiple beam directions, and the device may use a combination of digital precoding or beamforming to generate a combined beam for transmission (e.g., from network entity 105 to UE 115). UE 115 may report feedback indicating precoding weights for one or more beam directions, and the feedback may correspond to a set of configured beams across the system bandwidth or one or more sub-bands. Network entity 105 may transmit reference signals (e.g., cell-specific reference signal (CRS), channel state information reference signal (CSI-RS)), which may or may not be precoded. UE 115 may provide feedback for beam selection, which may be a precoding matrix indicator (PMI) or codebook-based feedback (e.g., multi-panel type codebook, linear combination type codebook, port selection type codebook). Although these techniques are described with reference to signals transmitted by network entity 105 (e.g., base station 140, RU 170) in one or more directions, UE 115 may use similar techniques for transmitting signals multiple times in different directions (e.g., for identifying beam directions used by UE 115 for subsequent transmission or reception), or for transmitting signals in a single direction (e.g., for transmitting data to a receiving device).

[0112] A receiving device (e.g., UE 115) may perform receiving operations according to multiple receiving configurations (e.g., directional listening) when receiving various signals (such as synchronization signals, reference signals, beam selection signals, or other control signals) from a receiving device (e.g., network entity 105). For example, the receiving device may perform receiving according to multiple receiving directions by: receiving via different antenna sub-arrays, processing the received signals according to different antenna sub-arrays, receiving according to different sets of receive beamforming weights (e.g., different directional listening weight sets) applied to the signals received at multiple antenna elements of the antenna array, or processing the received signals according to different sets of receive beamforming weights applied to the signals received at multiple antenna elements of the antenna array, where any of these may refer to "listening" according to different receiving configurations or receiving directions. In some examples, the receiving device may use a single receiving configuration to receive along a single beam direction (e.g., when receiving a data signal). The single receiving configuration may be aligned along a beam direction determined based on listening according to different receiving configuration directions (e.g., a beam direction determined to have the highest signal strength, highest signal-to-noise ratio (SNR), or other acceptable signal quality based on listening according to multiple beam directions).

[0113] The wireless communication system 100 can be a packet-based network that operates according to a layered protocol stack. In the user plane, the communication at the bearer or PDCP layer can be IP-based. The RLC layer can perform packet segmentation and reassembly for conveyance via logical channels. The MAC layer can perform priority handling and multiplexing of logical channels into transport channels. The MAC layer can also implement error detection techniques, error correction techniques, or both to support retransmission to improve link efficiency. In the control plane, the RRC layer can provide the establishment, configuration, and maintenance of the RRC connection that supports the radio bearers for user plane data between the UE 115 and the network entity 105 or the core network 130. The PHY layer can map the transport channels to physical channels.

[0114] The UE 115 and the network entity 105 can support the retransmission of data to increase the likelihood that the data is successfully received. Hybrid automatic repeat request (HARQ) feedback is a technique for increasing the likelihood of correctly receiving data via a communication link (e.g., communication link 125, D2D communication link 135). HARQ can include a combination of error detection (e.g., using cyclic redundancy check (CRC)), forward error correction (FEC), and retransmission (e.g., automatic repeat request (ARQ)). HARQ can improve the throughput at the MAC layer under poor radio conditions (e.g., low signal-to-noise ratio conditions). In some examples, the device can support same-slot HARQ feedback, in which case the device can provide HARQ feedback for the data received via the previous symbols in a particular slot in that slot. In some other examples, the device can provide HARQ feedback in a subsequent slot or according to some other time interval.

[0115] The UE 115 can periodically monitor the PDCCH, such as in the configured symbols of each slot. The broadcast PDCCH can be configured such that any UE 115 can read the broadcast PDCCH. For example, the CRC of the broadcast PDCCH can be scrambled by a preconfigured or known corresponding radio network temporary identifier (RNTI). The unicast PDCCH can be configured such that only the target UE 115 can read the unicast PDCCH. The CRC of the unicast PDCCH can be scrambled by a UE-specific RNTI.

[0116] PDCCH resources can be configured in the frequency domain as part of a control resource set. The control resource set information element can indicate (e.g., via a bitmap) the frequency domain resources for the control resource set in the downlink bandwidth part. Each bit can correspond to six consecutive physical resource blocks (PRBs) starting from the lowest PRB in the downlink bandwidth part and indicate whether the control resource set is mapped to that corresponding PRB. The time domain resources for the control resource set can be configured as part of a search space. The search space information element can indicate the slot period offset, duration for monitoring, and symbols within the slot for monitoring, which can indicate on which slot the UE 115 is to monitor the PDCCH in the search space set.

[0117] The PDCCH can carry critical information for the UE 115, but in some systems, it may be vulnerable to attacker devices. For example, a jammer device can prevent the UE 115 from receiving signaling on the PDCCH. If the jammer knows the slot timing of the PDCCH, the jammer can send interfering signaling during the first three symbols of the slot to interfere with the PDCCH. Additionally, eavesdroppers in some systems may read the broadcast PDCCH. The eavesdropper can obtain the MIB, SIB1, and UE-specific RRC signaling by guessing where the PDCCH candidates are and performing brute-force blind decoding for various hypotheses. In some cases, a spoofing device can send false information on the PDCCH or to the UE by obtaining the broadcast PDCCH and performing random spoofing on the UE-specific PDCCH.

[0118] The SSB can be used for cell detection and time-frequency synchronization. The SSB can be periodically transmitted at the frequency positions of the synchronization grid. The SSB can include synchronization signals (such as the primary synchronization signal (PSS) and the secondary synchronization signal (SSS)) and the physical broadcast channel (PBCH) carrying the master information block (MIB). The PSS and SSS sequences can be generated based on the cell identifier of the cell transmitting the SSB.

[0119] Candidate SSB indices can be configured based on the carrier frequency range and subcarrier spacing (SCS) of the radio frequency band for the SSB. The candidate SSBs can be mapped on specific resources (e.g., symbols) identified based on the time range (e.g., every half-frame) and the indices of the candidate SSBs. The network (e.g., network entity 105) can determine whether to actually transmit a candidate SSB. For a carrier, multiple SSBs can be transmitted to support multiple SSB beams for that carrier. The PBCH demodulation reference signal (DMRS) sequence and the PBCH payload bits can indicate information about the index of the SSB in the cell. The CRB grid can be identified from the lowest resource block position of the detected SSB and the subcarrier offset between the common resource block (CRB) grid and the SSB (e.g., k SSB ) which can be indicated by the MIB and the payload bits of the PBCH.

[0120] Based on the detected SSB, the initial access UE 115 can identify symbol, slot, subframe, or frame index in the time domain and CRB grid information in the frequency domain. The PBCH of the SSB can provide information on the initial control resource set (such as control resource set 0) and the initial downlink bandwidth part. The UE 115 can receive a physical downlink shared channel (PDSCH) carrying a system information block (SIB) (such as SIB1) scheduled by a PDCCH in a type 0 common search space (CSS) set. The SIB (e.g., SIB1) or an RRC message can indicate information for the control resource set, such as the absolute frequency and reference point (e.g., point A) of the SSB, the offset from the reference point to the SSB, and the actual SSB mapping in the SSB burst and SSB burst transmission period.

[0121] The SSB can be a key channel for processes such as the initial access process, synchronization maintenance, RLM and RRM, and beam management. In some systems, the SSB is transmitted at a set period in set time-frequency resources, which enables the UE 115 in these systems to easily detect and track the SSB to perform key processes. However, predictable SSB configurations may make these systems vulnerable to spoofing or attacker devices because these attacker devices may interfere with the signaling carrying critical and secure information. For example, a jammer device can emit noise at a relatively low power onto the SSB bandwidth to prevent legitimate devices from receiving SSB signaling. In another example, if the key signal is sent or configured predictably, a spoofing or eavesdropping device can obtain network configuration (e.g., system information).

[0122] The wireless communication system described herein, such as the wireless communication system 100, may utilize a PRF to implement randomization for SSB. For example, the wireless communication system 100 may utilize a PRF to implement randomization or frequency hopping of sequence indexes, time resources, frequency resources, sequence information, or beams, antenna ports, or spatial information, or any combination thereof for SSB. The wireless communication system 100 may be an example of a secure network, such as a tactical network, which may implement physical layer security to prevent a spoofer or attacker device from interfering with or receiving signaling carrying critical and secure information. The PRF may use parameters representing a key (e.g., a UE-specific key or a UE public key), timing information, and a physical cell identifier as input, and the PRF may output timing information, frequency information, sequence information, or beam / antenna port / spatial information for the SSB. For example, the PRF may output timing information for the SSB, such as a start symbol for an SSB burst. In some examples, the PRF may output frequency information for the SSB, such as a frequency index or a synchronization grid index for an SSB burst. In some examples, the PRF may output a sequence index for an SSB burst or for each SSB of an SSB burst. In some examples, the PRF may output a beam or antenna port index for an SSB burst or for each SSB of an SSB burst. In some examples, an initial control resource set (e.g., control resource set 0) may be configured to be offset from an SSB, and the offset may be indicated or output by the PRF.

[0123] Figure 2 An example of a wireless communication system 200 that supports security of downlink signaling in accordance with one or more aspects of the present disclosure is illustrated. The wireless communication system 200 may include a UE 115-a and a network entity 105-a, which may be respective examples of a UE 115 and a network entity 105 as described herein. The wireless communication system 200 may be an example of a secure or tactical network and may implement techniques for providing physical layer security.

[0124] For example, UE 115-a or network entity 105-a or both may use PRF 205 to implement frequency hopping of SSBs. UE 115-a may input information such as key 210, cell identifier 215, and time 220 (or timing information) into PRF 205. PRF 205 may output, for example, timing information 225, frequency information 230, sequence information 235, or beam or antenna port information for an SSB or an SSB burst, or any combination thereof, and UE 115-a may monitor, search for, or receive SSBs based on this output. Key 210 may be an example of a security key or a shared key. In some examples, key 210 may be a UE public key or a UE-specific key. Key 210 may be provided to UE 115-a via a security means, such as being pre-configured in UE 115-a, installed in the hardware of UE 115-a, or provided via a secure channel. Cell identifier 215 may be an identifier of the cell or network entity 105 that transmits the SSB, such as an identifier of network entity 105-a or a cell identifier. In some examples, time 220 may be absolute time information (e.g., Coordinated Universal Time) with a specific (e.g., pre-configured or configured) granularity (such as a specific millisecond, microsecond, etc.).

[0125] In some examples, PRF 205 may output timing information 225. The timing information 225 may indicate the symbol associated with an SSB burst, such as the first symbol of the SSB burst. For example, the timing information 225 may indicate a symbol index, such as an index within the time slot or subframe in which the SSB burst occurs or within a half radio frame or a full radio frame (or a longer cycle).

[0126] In some examples, PRF 205 may output frequency information 230. The frequency information 230 may indicate the frequency index associated with an SSB burst. For example, PRF 205 may output a frequency index associated with an SSB burst, which may be an index of a synchronization raster within a possible or configured communication bandwidth. In some examples, the bandwidth of the communication may be known to UE 115-a (e.g., may be configured or pre-configured), or an indication of the bandwidth may be provided to UE 115-a via a security means (such as a secure channel).

[0127] In some examples, the PRF 205 may output sequence information 235. The sequence information 235 may indicate a sequence index associated with all SSBs of an SSB burst or a sequence index associated with each SSB of an SSB burst. The sequence index may be used (e.g., by network entity 105-a) to generate sequences for PSS, SSS, PBCH DMRS, or any combination thereof. For the SSBs in an SSB burst, the sequences may be common or different. In some examples, the UE 115-a may monitor the SSB based on determining the sequence information 235, such as by identifying the correct sequence in the SSB burst and obtaining information from the SSB after identifying the correct sequence.

[0128] In some examples, the PRF 205 may output index order information 240. For example, the SSB index order may be randomized or interleaved by the PRF 205. The UE 115-a may identify the SSB having an index in a different SSB position in different SSB bursts based on the index order information 240 output by the PRF 205.

[0129] In some examples, the PSS and SSS sequences may be generated based on or using the PRF 205. In some examples, the sequence or sequence generation may be based on seed parameters selected by using the sequence information 235 output by the PRF 205. For example, the network entity 105-a may send sequences used in other systems, but the selection of the sequences for the SSB or for the SSB burst may be randomized based on a seed (such as the sequence information 235) output by the PRF 205. Additionally or alternatively, the sequence information 235 may be used as an index for the sequences of PSS, SSS, or PBCH DMRS, or any combination thereof. For example, the bits output by the PRF 205 (such as the sequence information 235) may be used to generate a bit sequence using a shift register, and the bit sequence may be further modulated to generate a binary phase shift keying (BPSK) sequence or a quadrature phase shift keying (QPSK) sequence for PSS or SSS or both. Additionally or alternatively, the bits output by the PRF 205 (such as the sequence information 235) may be modulated to generate a BPSK sequence or a QPSK sequence for PSS or SSS or both. This may prevent an attacker from using a shift register to estimate the input from the initial output.

[0130] The wireless communication system 200 may additionally support techniques for randomizing aspects of the PDCCH. For example, the UE 115-a or the network entity 105-a or both may use the PRF 205 to implement PDCCH randomization.

[0131] In some examples of PDCCH randomization, the key 210 can be a UE common key or a UE-specific key. For example, the key 210 can be a UE common key for a CSS set or a UE-specific key for a UE-specific search space (USS) set. The UE common key can be known or provided to the UE 115-a through secure means, such as being installed in the UE hardware or provided via a secure channel. The UE-specific key can be provided via a high-layer configuration, such as an RRC message. For different control resource sets or search spaces, the UE-specific key can be common or different.

[0132] In some examples, the PRF 205 can output timing information 225 indicating the symbols associated with the PDCCH to be monitored. For example, the PRF 205 can output symbol indices corresponding to indices in a time slot or subframe, or symbol indices corresponding to indices in a half radio frame or full radio frame (or longer cycle) corresponding to the PDCCH to be monitored by the UE 115-a.

[0133] In some examples, the PRF 205 can output frequency information 230 associated with the PDCCH to be monitored by the UE 115-a. For example, the PRF 205 can output a frequency index for the PDCCH, such as an index of a synchronization grid within a possible communication bandwidth.

[0134] In some examples, the PRF 205 can output scrambling information 245, such as a scrambling sequence information index associated with the PDCCH to be monitored by the UE 115-a. The sequence index can be used to generate a scrambling sequence for the PDCCH payload, CRC, or hash function, or any combination thereof, for the PDCCH to be monitored by the UE 115-a.

[0135] In some examples, the frequency domain resources for the PDCCH may be randomized based on the PRF 205. For example, the association between the search space set and the control resource set may be randomized or interleaved by the PRF 205. In some examples, the association between the search space set and the control resource set may be randomized or interleaved based on the implementation of control resource set hopping. By configuring different frequency domain resource allocations (FDRAs) for different control resource sets, control resource set hopping may be implemented. In some examples, the control resource set duration, the control channel element (CCE) to resource element group (REG) mapping, or any combination thereof may be randomized. For example, the association between the search space set and the control resource set may be frequency-hopped based on the output of the PRF 205, where the input to the PRF 205 includes one or more keys, such as the key 210, the time 220, the physical cell identifier, and the search space identifier. The PRF 205 may output frequency information 230 indicating different control resource sets for different occasions based on this input. For example, a search space may be configured for a set of DCI formats, a candidate quantity, a monitoring period, and a monitoring occasion, and this search space may be associated with multiple different control resource sets across different occasions based on the output of the PRF 205. In some examples, each control resource set may have an FDRA, a control resource set duration, a CCE to REG mapping, a precoder granularity, and a transmit configuration indicator (TCI) state configured for that control resource set, which may be the same as or different from other control resource sets.

[0136] In some examples, the time domain resources for the PDCCH may be randomized based on the PRF 205. For example, the UE 115-a may selectively monitor a subset of the search space set instead of monitoring all of the configured search space sets in the downlink bandwidth part. The time granularity for this selective monitoring may be per time slot, per subframe, per frame, or any combination thereof. For example, the PRF 205 may output timing information 225, which may indicate a subset of the search space set for the UE 115-a to monitor (e.g., instead of monitoring all search space sets).

[0137] In some examples, multiple parameter sets may be configured for a control resource set. The UE 115-a or the network entity 105-a or both may use one parameter set to identify the control resource set configuration at a given time. The selected parameter set may be based on the output of the PRF 205. For example, the UE 115-a may identify the parameter set for the control resource set (e.g., from multiple parameter sets for the control resource set) based on the output of the PRF 205. For example, each parameter set may include an FDRA, a control resource set duration, a CCE to REG mapping, a precoder granularity, or a TCI state, or any combination thereof.

[0138] In some examples, multiple parameter sets may be configured for a search space set. UE 115-a or network entity 105-a or both may use one of the parameter sets to identify the search space set configuration at a given time. The selected parameter set may be based on the output of PRF 205. For example, UE 115-a may identify the parameter set for the search space set (e.g., from among multiple parameter sets for the search space set) based on the output of PRF 205. For example, each parameter set may include a monitoring period, a set of monitoring occasions, or both.

[0139] In some examples, the wireless communication system 200 may support PDCCH payload scrambling, such as to distinguish UEs 115. For example, in some systems, the PDCCH payload may be scrambled with a static sequence {c(0), c(1), …, c(M bit -1)}, where M bit is the number of bits of the PDCCH payload. UE 115-a may identify the initial value of the static sequence based on Equation (1), where if a scrambling identifier is provided, n RNTI is the C-RNTI of the USS, otherwise 0, and if a scrambling identifier is provided for the USS, n ID is the scrambling identifier, otherwise the physical cell identifier.

[0140] c init =(n RNTI *2 16 +n ID ) mod (2 31 ) (1)

[0141] The wireless communication system 200 may support determining c init based on PRF 205. For example, c int may be a function or output of PRF 205, such as via Equation (2). For example, the input to PRF 205 may be a key 210 (e.g., the public key of the CSS or the UE-specific key of the USS), a time 220 (e.g., a symbol index in a frame or superframe), and a cell identifier 215.

[0142] c init =(PRF1(key, time, PCID)) mod 2 31 (2)

[0143] The selection of M bit from {c(0), c(1), …, c(M bit -1)} may use PRF for frequency hopping, such as by using Equation (3).

[0144] b~(i) = (b(i) + c((i + PRF2(key, time, PCID)) mod M PN ) mod 2 (3)

[0145] In some examples, the wireless communication system 200 may support randomizing PDCCH DMRS sequences, such as to distinguish different transmission points. For example, in some systems, the sequence {c((i))} may be used to generate QPSK symbols. The initial value, c init , may be determined according to Equation (4), where if a scrambling identifier is provided, N ID is the scrambling identifier, otherwise it is the physical cell identifier, and is the symbol index in the radio frame.

[0146]

[0147] In some examples, QPSK symbols may be generated based on Equation (5).

[0148]

[0149] The wireless communication system 200 may support determining c init based on PRF 205. For example, c init may be the output or a function of PRF 205, such as via Equation (2). For example, the inputs to PRF 205 may be a key 210 (e.g., the common key for CSS or the UE-specific key for USS), a time 220 (e.g., the symbol index in a frame or superframe), and a cell identifier 215. The selection of 2N from {c(0), c(1), …, c(M PN - 1)} may use PRF for frequency hopping, such as via Equation (7).

[0150]

[0151] In some examples, the output of PRF 205 may be used as a bit sequence to generate a QPSK sequence for PDCCH DMRS. In some examples, avoiding the use of a shift register in m-sequence generation may provide additional security.

[0152] In some examples, the wireless communication system 200 may support using PRF 205 for a hash function, such as to reduce PDCCH blocking. For example, some systems may determine the CCE for blind decoding based on Equation (8), where for any CSS, and for USS, where for control resource set index p mod3 = 0, A p= 39827, for control resource set index p mod 3 = 1, A p = 39829, and for control resource set index p mod 3 = 2, A p = 39839, and Y p,-1 = n RNTI ≠ 0.

[0153] A wireless communication system may support using symbol-level hashing (e.g., ) instead of slot-level hashing and using the output of PRF 205 to determine Y p,-1 . For example, Y p,-1 may be a function of PRF 205 for both CSS and USS.

[0154] Figure 3 Illustrates examples of sequence randomization 300 and sequence randomization 301 that support the security of downlink signaling according to one or more aspects of the present disclosure.

[0155] UE 115 may receive an SSB in an SSB burst from network entity 105. As described herein, the sequence for the SSB or the sequence for the SSB burst may be randomized based on a PRF. For example, UE 115 or network entity 105 or both may input a key, time information, and a cell identifier into the PRF, and the PRF may output sequence information for the SSB.

[0156] For sequence randomization 300, the PRF may output sequence information indicating the sequence index associated with all SSBs of an SSB burst. For example, the SSB in SSB burst 305-a may have a first sequence 310-a. At the next occasion, the SSB in SSB burst 305-b may have a second sequence 310-b. Similarly, the SSB in SSB burst 305-c may have a third sequence 310-c, and the SSB in SSB burst 305-d may have a fourth sequence 310-d. In sequence randomization 300, each SSB of an SSB burst may have the same sequence, but the sequence of the SSB burst may be randomized based on the output of the PRF. For example, there may be a common sequence across the SSBs in one SSB burst, but different sequences across SSB bursts.

[0157] For sequence randomization 301, the PRF may output sequence information indicating the sequence index associated with each SSB of the SSB burst. For example, different sequences may exist across the SSBs in a burst, and different sequences may exist across SSB bursts. For example, the first SSB of SSB burst 305-e may have the third sequence 310-c, the second SSB of SSB burst 305-e may have the first sequence 310-a, the third SSB of SSB burst 305-e may have the fourth sequence 310-d, and the fourth SSB of SSB burst 305-e may have the second sequence 310-b. SSB burst 305-f, SSB burst 305-g, and SSB burst 305-h may each have different sequences or sequence orderings or both. For example, some SSBs in some SSB bursts may have other sequences than the sequences shown (e.g., sequences not included in another SSB burst).

[0158] Figure 4 An example of beam pattern randomization 400 that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure is illustrated.

[0159] UE 115 may receive an SSB in an SSB burst from network entity 105. As described herein, the beam pattern for the SSB in the SSB burst may be randomized based on the PRF. For example, UE 115 or network entity 105 or both may input a key, time information, and a cell identifier into the PRF, and the PRF may output beam pattern information or an index order for the SSB.

[0160] For example, in addition to time-frequency resource and sequence randomization, the SSB index ordering may be randomized or interleaved by the PRF. UE115 may identify SSBs having indices in different SSB positions in different SSB bursts. In some examples, network entity 105 may change the SSB beam scanning pattern in different SSB bursts.

[0161] For example, SSB burst 405-a may have a first SSB beam pattern 410-a. SSB burst 405-b may have a second SSB beam pattern 410-b, which may have a different pattern for the beam index of the SSB. Similarly, SSB burst 405-c may have a third SSB beam pattern 410-c, and SSB burst 405-d may have a fourth SSB beam pattern 410-d, each of which may be randomized based on the output of the PRF.

[0162] Figure 5 An example of frequency domain randomization 500 that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure is illustrated.

[0163] UE 115 may receive SSBs in an SSB burst from network entity 105. As described herein, the frequency domain information for the SSB burst may be randomized based on a PRF. For example, UE 115 or network entity 105 or both may input one or more keys, time information, and a cell identifier into the PRF, and the PRF may output the frequency information for the SSB burst.

[0164] The SSB may be mapped on a synchronization raster in a frequency bandwidth. For example, in the frequency domain, the hopping position may be at a point or position defined as the synchronization raster. The frequency bandwidth may be equal to or less than the carrier bandwidth for secure communication.

[0165] In some examples, regardless of how the SSB hops in the frequency domain, SIB1 or an RRC message may indicate the absolute frequency of the SSB, a reference point (e.g., point A 515), and the offset from the reference point to the SSB. For example, network entity 105 may indicate the absolute frequency of the SSB (e.g., absoluteFrequencySSB), the reference point (e.g., absoluteFrequencyPointA), and the offset from the reference point to the SSB (OffsetToPointA). In some examples, the offset from the reference point to the SSB may be a fixed offset. The parameters may be reinterpreted based on the same PRF such that the CRB grid or CRB index is fixed or invariant over time.

[0166] For example, for SSB burst 505-a, UE 115-a may determine the position of SSB burst 505-a in the frequency domain based on reinterpreting offset 510-a and point A 515 using the PRF. Similarly, UE 115-a may determine the positions of SSB burst 505-b, SSB burst 505-c, and SSB burst 505-d based on reinterpreting offsets 510-b, 510-c, and 510-d from point A 515 using the PRF, respectively.

[0167] In some examples, UE 115 may reinterpret the symbols per half-frame or per time slot based on the PRF. For example, at a subcarrier spacing of 15 kHz, there may be {2 + 8} + 14n symbols per half-frame, and the index of the candidate SSB may be n = 0, 1 for below 3 GHz and n = 0, 1, 2, 3 for radio frequency bands above 3 GHz. In some examples, UE115 may reinterpret the index of the candidate SSB based on the PRF.

[0168] Figure 6 Examples of initial bandwidth part configuration 600 and initial bandwidth part configuration 601 that support the security of downlink signaling in accordance with one or more aspects of the present disclosure are illustrated.

[0169] UE 115 may receive an SSB in an SSB burst from network entity 105, and frequency information, timing information, sequence information, or beam index information, or any combination thereof, may be randomized for the SSB or SSB burst. In some examples, an initial bandwidth part or a control resource set (such as an initial control resource set or control resource set 0) may correspond to the time-frequency resources of the SSB burst.

[0170] For example, for initial bandwidth part configuration 600, initial bandwidth part 610-a may hop on time and frequency resources synchronized with the SSB. For example, initial bandwidth part 610-a may be synchronized with the time and frequency resources of SSB burst 605-a at a first instance, SSB burst 605-b at a second instance, SSB burst 605-c at a third instance, and SSB burst 605-d at a fourth instance. In some examples, the SSB index may remain unchanged, and in other examples, the SSB index may change (e.g., using a PRF). In some examples, initial bandwidth part configuration 600 may support initial access using a narrow bandwidth.

[0171] In some examples, the initial bandwidth part may be randomized based on a PRF. For example, in initial bandwidth part configuration 601, initial bandwidth part 610-b may hop on time and frequency resources independently of the SSB. For example, initial bandwidth part 610-b may have a different hopping configuration or hopping value from SSB burst 605-e, SSB burst 605-f, SSB burst 605-g, and SSB burst 605-h. In some examples, the hopping value may be determined based on the output of a PRF as described herein. In some examples, the SSB index may remain unchanged, and in other examples, the SSB index may change (e.g., using a PRF). In some examples, initial bandwidth part configuration 601 may provide additional security for initial bandwidth part 610-b based on determining hopping using a PRF.

[0172] In some examples, the initial bandwidth part may be mapped on a CRB grid. For example, k sSB or the gap between the SSB and the common resource block may be fixed over time (e.g., unchanged, or not reinterpreted by a PRF), so the CRB grid is fixed. In some examples, a configured offset of a resource block may be used to identify the initial resource block of the initial bandwidth part. For example, the 0th resource block of the initial bandwidth part may be offset by a number of resource blocks (e.g., an offset) from the SSB of the SSB burst. The offset of the resource block may be configured or pre-configured at UE 115, indicated via a secure channel, indicated via an SSB, or any combination thereof.

[0173] In some examples, the offset of a resource block may be reinterpreted by a PRF. For example, the configured number of resource blocks offset between the 0th resource block of an initial bandwidth part and the SSB may be reinterpreted by the PRF to indicate the actual offset between the initial bandwidth part and the SSB. The UE 115 or the network entity 105 or both may reinterpret the value of the offset in the resource block based on the PRF used for each SSB burst. In some examples, the key used to reinterpret the number of offset resource blocks may be the same as or different from the key used for SSB randomization. The key used to reinterpret the offset may be configured or pre-configured at the UE 115, or indicated via a secure channel.

[0174] In some examples, an initial bandwidth part or an initial control resource set may be offset by an SSB based on a value indicated by the MIB. In some examples, the mapping between the value indicated by the MIB (e.g., the pdcch-ConfigSIB1 indicator in the MIB) and the corresponding row of the table indicating the offset may be interleaved by the PRF. For example, the value indicated by the MIB may be reinterpreted by the PRF output. The mapping interleaving or the reinterpretation of the value may be based on the PRF used for each SSB burst. In some examples, the key of the PRF used for reinterpretation may be the same as or different from the key used for SSB randomization. The key may be configured or pre-configured at the UE 115, or indicated via a secure channel.

[0175] Figure 7 An example of a control resource set hopping configuration 700 that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure is illustrated.

[0176] The UE 115 may receive downlink control signaling from the network entity 105 via a downlink control channel such as a PDCCH. To improve the security of the control signaling, the timing resource, the frequency resource, or the scrambling information, or any combination thereof may be randomized based on the output of a PRF as described herein.

[0177] For example, the mapping between the frequency domain resource indicator and the PRBs of the PDCCH control resource set 715 in a downlink bandwidth part 705 (e.g., an active downlink bandwidth part) may be randomized by the PRF. For example, the UE 115 may receive control signaling indicating the frequency domain resource for a control resource set, and the mapping between the indicated frequency domain resource and the actual location of the PRBs of the PDCCH control resource set 715 in the downlink bandwidth part 705 may be randomized or interleaved based on the PRF. In some examples, the PRF may use the control resource set identifier as an input to the randomization output.

[0178] For example, in time slot 710-a, the position of PDCCH control resource set 715 in the frequency domain may be randomized based on the output of the PRF. The UE 115 may receive control signaling indicating a bitmap for frequency domain resources, and the UE 115 may reinterpret the bitmap for the frequency domain resources based on the PRF. For example, the actual frequency domain position of the PRBs for the PDCCH control resource set 715 may be randomized based on the position of the indicated frequency domain resources. Similarly, at time slot 710-b, the position of the PDCCH control resource set 715 may be randomized, such as in different PRBs than in time slot 710-a. In some examples, the UE 115 may determine the frequency allocation of the PRBs for the PDCCH control resource set 715 at each PDCCH monitoring occasion, symbol, subframe, or time slot (such as time slot 710-a, time slot 710-b, time slot 710-c, and time slot 710-d).

[0179] In some examples, the PRBs of the PDCCH control resource set 715 may be randomized such that the PRBs do not exceed the upper limit or edge of the downlink bandwidth part. For example, the PRBs of the PDCCH control resource set 715 may be continuous within the downlink bandwidth part 705. For example, the i-th bit in the indicated bitmap may indicate that the PRBs of the PDCCH control resource set 715 are mapped to the (i + j)-th six PRBs in the downlink bandwidth part 705, where j is determined based on the PRF at each PDCCH monitoring occasion, symbol, time slot, or subframe, and is selected such that the (i + j)-th six PRBs do not exceed the upper limit or edge of the downlink bandwidth part 705. For example, the PRBs of the PDCCH control resource set 715 may be continuous within the downlink bandwidth part 705.

[0180] In some examples, the PRBs of the PDCCH control resource set 715 may span the upper or lower boundary or upper or lower edge of the downlink bandwidth part 705. For example, the PRBs of the PDCCH control resource set 715 may be discontinuous within the downlink bandwidth part 705. For example, the i-th bit in the bitmap may indicate that the PDCCH control resource set 715 is mapped to the (i + j) mod N-th six PRBs in the downlink bandwidth part 705, where j is determined based on the PRF at each PDCCH monitoring occasion, symbol, time slot, or subframe, and N is the number of six PRBs in the downlink bandwidth part 705. For example, in time slot 710-c, the PRBs of the PDCCH control resource set 715 may be at both the highest frequency part and the lowest frequency part of the downlink bandwidth part 705, such that the PRBs of the PDCCH control resource set 715 may be adjacent to the frequency edge of the downlink bandwidth part of the cell.

[0181] Figure 8An example of search space set randomization 800 that supports the security of downlink signaling in accordance with one or more aspects of the present disclosure is illustrated.

[0182] UE 115 may receive downlink control signaling from network entity 105 via a downlink control channel, such as a PDCCH. To improve the security of the control signaling, timing resources, frequency resources, or scrambling information, or any combination thereof, may be randomized based on the output of a PRF as described herein.

[0183] In some examples, the PDCCH monitoring occasion may be randomized by a PRF. For example, UE 115 may receive control signaling including a search space information element indicating the PDCCH monitoring occasion, and the time or frequency resources for the PDCCH monitoring occasion may be randomized by the PRF. In some examples, the PRF may use the search space identifier as an input to the randomization output. For example, the output indicating the randomized PDCCH monitoring occasion may be based on using the search space identifier as an input.

[0184] In some examples, the monitoring occasion for CSS 805 or the monitoring occasion for USS 810 or both may be randomized. In some examples, UE 115 may use the UE public key for CSS 805. In some examples, UE 115 may use the UE-specific key for USS 810.

[0185] In some examples, CSS 805 and USS 810 may be misaligned based on the randomization. For example, in time slots 815-a and 815-c, USS 810 and CSS 805 may not overlap in the time domain. In time slots 815-b and 815-d, USS 810 and CSS 805 may at least partially overlap. If CSS 805 and USS 810 are misaligned, UE 115 may be configured with multiple occasions within a time slot.

[0186] In some examples, in a time slot where UE 115 has PDCCH monitoring occasions for CSS 805 and USS 810 in different spans, UE 115 may monitor USS 810 or UE-specific information in the PDCCH monitoring occasion for CSS 805. For example, in time slot 815-a, UE 115 may monitor the PDCCH monitoring occasion for CSS 805 for both CSS 805 and USS 810. For example, UE-specific information may be sent to UE 115 via the resources of CSS 805. In some cases, monitoring USS 810 in CSS 805 may be more efficient and may reduce the likelihood that the UE-specific key is not used.

[0187] In some other examples, UE 115 may monitor the PDCCH monitoring occasion for USS 810 for both CSS 805 and USS 810. For example, UE 115 may monitor CSS 805 or UE public information in the PDCCH monitoring occasion for USS 810. In some examples, monitoring CSS 805 in USS 810 may be more secure because network entity 105 may send information multiple times for different UEs 115 using different keys.

[0188] In a time slot in which UE 115 has PDCCH monitoring occasions for both CSS 805 and USS 810 in the same span, UE 115 may monitor both CSS 805 and USS 810. For example, in time slot 815-b, UE 115 may monitor both CSS 805 and USS 810.

[0189] Figure 9 An example of process flow 900 that supports security of downlink signaling in accordance with one or more aspects of the present disclosure is illustrated. Process flow 900 may be implemented by UE 115-b or network entity 105-b or both, which may be corresponding examples of UE 115 and network entity 105 as described herein.

[0190] Process flow 900 may illustrate an example of using a PRF to randomize resources or aspects of an SSB or an SSB burst. At 905, UE 115-b may generate an output of the PRF. For example, UE 115-b may input timing parameters, a key (e.g., a parameter representing a key), and a cell identifier into the PRF, and the PRF may output information for one or more SSBs, one or more SSB bursts, or an initial control resource set (e.g., an initial downlink bandwidth part), or any combination thereof, such as timing information, frequency information, sequence information, or beam index information, or any combination thereof. In some examples, the key may be a UE-specific key or a UE public key.

[0191] At 910, UE 115-b may monitor a resource set for one or more SSBs associated with one or more pseudo-random sequences, where the one or more pseudo-random sequences and the resource set are indicated by an output of the PRF that is at least partially based on timing parameters, a cell identifier, and a key.

[0192] In some examples, UE 115-b may monitor a burst of SSBs associated with a first pseudo-random sequence among one or more pseudo-random sequences indicated by the output of a PRF. UE 115-b may monitor a second burst of SSBs associated with a second pseudo-random sequence among one or more pseudo-random sequences indicated by the output of a PRF. For example, the SSBs within an SSB burst may have a common pseudo-random sequence, but different SSB bursts may have different pseudo-random sequences. In some examples, UE 115-b may generate the first pseudo-random sequence and the second pseudo-random sequence based on one or more calls to the PRF.

[0193] In some examples, UE 115-b may monitor a first SSB of a burst of SSBs associated with a first pseudo-random sequence among one or more pseudo-random sequences, where the first pseudo-random sequence is indicated by the output of a PRF. UE 115-b may monitor a second SSB of a burst of SSBs associated with a second pseudo-random sequence among one or more pseudo-random sequences, where the second pseudo-random sequence is indicated by the output of a PRF. For example, different SSBs of an SSB burst may have different pseudo-random sequences, and different pseudo-random sequences may also exist across SSB bursts.

[0194] In some examples, beam sorting within an SSB burst may be randomized. For example, UE 115-b may monitor a first burst of SSBs, where a first sorting of SSB indices for the first burst of SSBs is indicated by the output of a PRF, and UE 115-b may monitor a second burst of SSBs, where a second sorting of SSB indices for the second burst of SSBs is indicated by the output of a PRF.

[0195] In some examples, the time resources for an SSB or an SSB burst may be randomized based on the output of a PRF. For example, UE 115-b may monitor a first SSB of the burst of SSBs during a starting symbol of the burst of SSBs, where the starting symbol is indicated by the output of a PRF.

[0196] Additionally or alternatively, the frequency resources for an SSB or an SSB burst may be randomized based on the output of a PRF. For example, UE 115-b may monitor a first burst of SSBs with a reference point frequency-offset by a first offset indicated by the output of a PRF, and UE 115-b may monitor a second burst of SSBs with the reference point frequency-offset by a second offset indicated by the output of a PRF.

[0197] At 915, network entity 105-b may transmit SSBs associated with one or more pseudo-random sequences via a resource set. In some examples, network entity 105-b may similarly determine, generate, or identify pseudo-random sequences and resource sets based on the output of a PRF. At 920, UE 115-b may communicate with network entity 105-b via a cell associated with a cell identifier based on monitoring a resource set for one or more SSBs.

[0198] Figure 10 An example of process flow 1000 that illustrates securing downlink signaling in accordance with one or more aspects of the present disclosure is shown. Process flow 1000 may be implemented by UE 115-c or network entity 105-c or both, which may be corresponding examples of UE 115 and network entity 105 as described herein.

[0199] Process flow 1000 may illustrate an example of using a PRF to randomize resources or aspects of a downlink control channel. At 1005, UE 115-c may generate an output of a PRF. For example, UE 115-b may input timing parameters, a key, and a cell identifier into the PRF, and the PRF may output information for a downlink control channel, a control resource set, a monitoring occasion, or any combination thereof, such as timing information, frequency information, scrambling information, or any combination thereof.

[0200] At 1010, UE 115-c may monitor a resource set within a control resource set for a downlink control channel. The resource set may be based on the output of a PRF, where the output of the PRF is based on timing parameters, a cell identifier, and a key.

[0201] In some examples, UE 115-c may monitor a first set of resource blocks for a first downlink control channel, where a first initial resource block in the first set of resource blocks is indicated by the output of the PRF; and UE 115-c may monitor a second set of resource blocks for a second downlink control channel, where a second initial resource block in the second set of resource blocks is indicated by the output of the PRF. In some examples, the first set of resource blocks is contiguous within a downlink bandwidth part of a cell. In some examples, the first set of resource blocks is non-contiguous and adjacent to a frequency edge of a downlink bandwidth part of an adjacent cell.

[0202] In some examples, UE 115-c may determine a control resource set from a set of multiple control resource sets based on the output of a PRF, where the output of the PRF is based on a search space identifier of a search space of a downlink control channel. In some examples, UE 115-c may monitor a subset of search space sets from a set of multiple search space sets, where the subset of the search space sets is indicated by the output of the PRF.

[0203] In some examples, UE 115-c may determine a parameter set for a control resource set from a set of multiple parameter sets, where the parameter set is indicated by the output of the PRF. In some examples, the control resource set includes frequency domain resource allocation, control resource set duration, control channel element to resource element group mapping, pre-coder granularity, transmission configuration indicator status, or any combination thereof.

[0204] In some examples, UE 115-c may determine a parameter set for a search space set of a downlink control channel from a set of multiple parameter sets, where the parameter set is indicated by the output of the PRF. In some examples, the parameter set for the search space set includes a monitoring period or a resource indicator for a monitoring occasion, or both.

[0205] At 1015, network entity 105-c may send control signaling on a downlink control channel via a resource set within a control resource set. In some examples, network entity 105-b may similarly determine, generate, or identify information for a downlink control channel based on the output of the PRF. At 1020, UE 115-c may communicate with network entity 105-c via a cell associated with a cell identifier based on monitoring a resource set for a downlink control channel.

[0206] Figure 11 Block diagram 1100 illustrates a device 1105 that supports security of downlink signaling in accordance with one or more aspects of the present disclosure. Device 1105 may be an example of aspects of UE 115 as described herein. Device 1105 may include a receiver 1110, a transmitter 1115, and a communication manager 1120. Device 1105 may also include a processor. Each of these components may communicate with one another (e.g., via one or more buses).

[0207] Receiver 1110 may provide components for receiving information (such as packets, user data, control information, or any combination thereof) associated with various information channels (e.g., a control channel, a data channel, an information channel related to security of downlink signaling). The information may be passed to other components of device 1105. Receiver 1110 may utilize a single antenna or a collection of multiple antennas.

[0208] Transmitter 1115 may provide components for transmitting signals generated by other components of device 1105. For example, transmitter 1115 may transmit information such as packets, user data, control information, or any combination thereof associated with various information channels (e.g., control channels, data channels, information channels related to the security of downlink signaling). In some examples, transmitter 1115 may be co-located with receiver 1110 in a transceiver module. Transmitter 1115 may utilize a single antenna or an array of multiple antennas.

[0209] Communication manager 1120, receiver 1110, transmitter 1115, or various combinations or components thereof may be examples of components for performing various aspects of the security of downlink signaling as described herein. For example, communication manager 1120, receiver 1110, transmitter 1115, or various combinations or components thereof may support methods for performing one or more of the functions described herein.

[0210] In some examples, communication manager 1120, receiver 1110, transmitter 1115, or various combinations or components thereof may be implemented in hardware (e.g., in a communication management circuit). The hardware may include a processor, a digital signal processor (DSP), a central processing unit (CPU), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), or other programmable logic devices, a microcontroller, discrete gate or transistor logic components, discrete hardware components, or any combination thereof configured as or otherwise supporting components for performing the functions described in this disclosure. In some examples, a processor and a memory coupled to the processor may be configured to perform one or more of the functions described herein (e.g., by the processor executing instructions stored in the memory).

[0211] Additionally or alternatively, in some examples, communication manager 1120, receiver 1110, transmitter 1115, or various combinations or components thereof may be implemented in code executed by a processor (e.g., as communication management software or firmware). If implemented in code executed by a processor, the functions of communication manager 1120, receiver 1110, transmitter 1115, or various combinations or components thereof may be performed by a general-purpose processor, DSP, CPU, ASIC, FPGA, microcontroller, or any combination of these or other programmable logic devices configured as or otherwise supporting components for performing the functions described in this disclosure.

[0212] In some examples, the communication manager 1120 may be configured to perform various operations (e.g., receive, obtain, monitor, output, transmit) using or otherwise in cooperation with the receiver 1110, the transmitter 1115, or both. For example, the communication manager 1120 may receive information from the receiver 1110, convey information to the transmitter 1115, or be integrated with the receiver 1110, the transmitter 1115, or both in combination to obtain information, output information, or perform various other operations as described herein.

[0213] According to examples disclosed herein, the communication manager 1120 may support wireless communication at the UE. For example, the communication manager 1120 may be configured as or otherwise support a component for monitoring a resource set for one or more synchronization signal blocks associated with one or more pseudo-random sequences, wherein the one or more pseudo-random sequences and the resource set are indicated by an output of a pseudo-random function based on timing parameters, a cell identifier, and a key. The communication manager 1120 may be configured as or otherwise support a component for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the one or more synchronization signal blocks.

[0214] Additionally or alternatively, according to examples disclosed herein, the communication manager 1120 may support wireless communication at the UE. For example, the communication manager 1120 may be configured as or otherwise support a component for monitoring a resource set for a downlink control channel within a control resource set, wherein the resource set is based on an output of a pseudo-random function, and wherein the output of the pseudo-random function is based on timing parameters, a cell identifier, and a key. The communication manager 1120 may be configured as or otherwise support a component for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel.

[0215] Additionally or alternatively, according to examples disclosed herein, the communication manager 1120 may support wireless communication at the UE. For example, the communication manager 1120 may be configured as or otherwise support a component for monitoring a resource set for a control message via a downlink control channel. The communication manager 1120 may be configured as or otherwise support a component for descrambling a payload of the control message based on a scrambling sequence, wherein the scrambling sequence is indicated by an output of a pseudo-random function based on timing parameters, a cell identifier, and a key.

[0216] Additionally or alternatively, according to examples as disclosed herein, the communication manager 1120 may support wireless communication at a UE. For example, the communication manager 1120 may be configured as or otherwise support a component for monitoring a resource set for control messages via a downlink control channel. The communication manager 1120 may be configured as or otherwise support a component for demodulating the control message based on a set of multiple demodulation reference signals received via the downlink control channel, wherein the sequence of the set of multiple demodulation reference signals is indicated by an output of a pseudo-random function based on a timing parameter, a cell identifier, and a key.

[0217] By including or configuring a communication manager 1120 according to examples as described herein, a device 1105 (e.g., a processor that controls or is otherwise coupled to a receiver 1110, a transmitter 1115, a communication manager 1120, or a combination thereof) may support techniques for higher security initial access signaling and control signaling.

[0218] Figure 12 Block diagram 1200 illustrates a device 1205 that supports security of downlink signaling in accordance with one or more aspects of the present disclosure. The device 1205 may be an example of aspects of the device 1105 or the UE 115 as described herein. The device 1205 may include a receiver 1210, a transmitter 1215, and a communication manager 1220. The device 1205 may also include a processor. Each of these components may communicate with each other (e.g., via one or more buses).

[0219] The receiver 1210 may provide a component for receiving information (such as packets, user data, control information, or any combination thereof) associated with various information channels (e.g., a control channel, a data channel, an information channel related to the security of downlink signaling). The information may be passed to other components of the device 1205. The receiver 1210 may utilize a single antenna or a set of multiple antennas.

[0220] The transmitter 1215 may provide a component for transmitting signals generated by other components of the device 1205. For example, the transmitter 1215 may transmit information such as packets, user data, control information, or any combination thereof associated with various information channels (e.g., a control channel, a data channel, an information channel related to the security of downlink signaling). In some examples, the transmitter 1215 may be co-located with the receiver 1210 in a transceiver module. The transmitter 1215 may utilize a single antenna or a set of multiple antennas.

[0221] Device 1205 or its various components can be examples of components for performing various aspects of the security of downlink signaling as described herein. For example, communication manager 1220 can include SSB monitoring component 1225, communication component 1230, control resource set monitoring component 1235, control channel monitoring component 1240, payload descrambling component 1245, DMRS demodulation component 1250, or any combination thereof. Communication manager 1220 can be an example of aspects of communication manager 1120 as described herein. In some examples, communication manager 1220 or its various components can be configured to perform various operations (e.g., receive, obtain, monitor, output, transmit) using or otherwise in cooperation with receiver 1210, transmitter 1215, or both. For example, communication manager 1220 can receive information from receiver 1210, convey information to transmitter 1215, or integrate with receiver 1210, transmitter 1215, or both in combination to obtain information, output information, or perform various other operations as described herein.

[0222] According to examples disclosed herein, communication manager 1220 can support wireless communication at a UE. SSB monitoring component 1225 can be configured as or otherwise support a component for monitoring a resource set for one or more synchronization signal blocks associated with one or more pseudo-random sequences, wherein the one or more pseudo-random sequences and the resource set are indicated by an output of a pseudo-random function based on timing parameters, cell identifier, and key. Communication component 1230 can be configured as or otherwise support a component for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the one or more synchronization signal blocks.

[0223] Additionally or alternatively, according to examples disclosed herein, communication manager 1220 can support wireless communication at a UE. Control resource set monitoring component 1235 can be configured as or otherwise support a component for monitoring a resource set within a control resource set for a downlink control channel, wherein the resource set is based on an output of a pseudo-random function, and wherein the output of the pseudo-random function is based on timing parameters, cell identifier, and key. Communication component 1230 can be configured as or otherwise support a component for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel.

[0224] Additionally or alternatively, according to examples as disclosed herein, communication manager 1220 may support wireless communication at a UE. Control channel monitoring component 1240 may be configured as or otherwise support a component for monitoring a resource set for control messages via a downlink control channel. Payload descrambling component 1245 may be configured as or otherwise support a component for descrambling the payload of the control message based on a scrambling sequence, where the scrambling sequence is indicated by an output of a pseudorandom function based on timing parameters, a cell identifier, and a key.

[0225] Additionally or alternatively, according to examples as disclosed herein, communication manager 1220 may support wireless communication at a UE. Control channel monitoring component 1240 may be configured as or otherwise support a component for monitoring a resource set for control messages via a downlink control channel. DMRS demodulation component 1250 may be configured as or otherwise support a component for demodulating the control message based on a set of multiple demodulation reference signals received via the downlink control channel, where the sequence for the set of multiple demodulation reference signals is indicated by an output of a pseudorandom function based on timing parameters, a cell identifier, and a key.

[0226] Figure 13 Block diagram 1300 illustrates a communication manager 1320 that supports security of downlink signaling in accordance with one or more aspects of the present disclosure. Communication manager 1320 may be an example of aspects of communication manager 1120, communication manager 1220, or both as described herein. Communication manager 1320 or its various components may be examples of components for performing various aspects of the security of downlink signaling as described herein. For example, communication manager 1320 may include an SSB monitoring component 1325, a communication component 1330, a control resource set monitoring component 1335, a control channel monitoring component 1340, a payload descrambling component 1345, a DMRS demodulation component 1350, a PRF input component 1355, a PRF component 1360, a control resource set hopping component 1365, or any combination thereof. Each of these components may communicate directly or indirectly with each other (e.g., via one or more buses).

[0227] According to an example as disclosed herein, the communication manager 1320 may support wireless communication at a UE. The SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a resource set for one or more synchronization signal blocks associated with one or more pseudo-random sequences, where the one or more pseudo-random sequences and the resource set are indicated by an output of a pseudo-random function based on timing parameters, a cell identifier, and a key. The communication component 1330 may be configured as or otherwise support a component for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the one or more synchronization signal blocks.

[0228] In some examples, to support monitoring the resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a first burst of a synchronization signal block associated with a first pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the pseudo-random function. In some examples, to support monitoring the resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a second burst of a synchronization signal block associated with a second pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the pseudo-random function.

[0229] In some examples, the PRF component 1360 may be configured as or otherwise support a component for generating the first pseudo-random sequence and the second pseudo-random sequence based on one or more calls to the pseudo-random function.

[0230] In some examples, to support monitoring the resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a first synchronization signal block associated with a first pseudo-random sequence among the one or more pseudo-random sequences for a burst of the synchronization signal block, where the first pseudo-random sequence is indicated by the output of the pseudo-random function. In some examples, to support monitoring the resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a second synchronization signal block associated with a second pseudo-random sequence among the one or more pseudo-random sequences for the burst of the synchronization signal block, where the second pseudo-random sequence is indicated by the output of the pseudo-random function.

[0231] In some examples, to support a monitoring resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a first burst of a synchronization signal block, wherein a first ordering of the synchronization signal block index of the first burst for the synchronization block is indicated by the output of the pseudo-random function. In some examples, to support a monitoring resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a second burst of a synchronization signal block, wherein a second ordering of the synchronization signal block index of the second burst for the synchronization block is indicated by the output of the pseudo-random function.

[0232] In some examples, the output of the pseudo-random function indicates the first ordering and the second ordering based on the number of symbols per half-frame.

[0233] In some examples, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a first synchronization signal block of the burst of the synchronization signal block during a start symbol of the burst, wherein the start symbol is indicated by the output of the pseudo-random function.

[0234] In some examples, the output of the pseudo-random function indicates the start symbol of the burst of the synchronization signal block based on the number of symbols per half-frame.

[0235] In some examples, to support a monitoring resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a first burst of a synchronization signal block that is frequency-offset from a reference point by a first offset indicated by the output of the pseudo-random function. In some examples, to support a monitoring resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a second burst of a synchronization signal block that is frequency-offset from the reference point by a second offset indicated by the output of the pseudo-random function.

[0236] In some examples, the output of the pseudo-random function indicates a first index of a synchronization raster for the first offset and a second index of the synchronization raster for the second offset.

[0237] In some examples, to support a monitoring resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a first synchronization signal in a first synchronization signal block of the one or more synchronization signal blocks, wherein a first sequence of the first synchronization signal is indicated by the output of the pseudo-random function. In some examples, to support a monitoring resource set, the SSB monitoring component 1325 may be configured as or otherwise support a component for monitoring a second synchronization signal in the first synchronization signal block, wherein a second sequence of the second synchronization signal is indicated by the output of the pseudo-random function.

[0238] In some examples, the control resource set monitoring component 1335 may be configured as or otherwise support a component for monitoring a control resource set that is frequency-offset from the one or more synchronization signal blocks by a fixed number of resource blocks.

[0239] In some examples, the control resource set monitoring component 1335 may be configured as or otherwise support a component for monitoring a control resource set during a first duration according to a first offset in frequency of a first burst of synchronization signals in the one or more synchronization signal blocks, the first offset being indicated by the output of the pseudo-random function. In some examples, the control resource set monitoring component 1335 may be configured as or otherwise support a component for monitoring a control resource set during a second duration according to a second offset in frequency of a second burst of synchronization signals in the one or more synchronization signal blocks, the second offset being indicated by the output of the pseudo-random function.

[0240] In some examples, the first offset is indicated by the output of the pseudo-random function based on a first value indicated by a first master information block of the first burst of the synchronization signal block, and the second offset is indicated by the output of the pseudo-random function based on a second value indicated by a second master information block of the second burst of the synchronization signal block.

[0241] In some examples, the PRF input component 1355 may be configured as or otherwise support a component for receiving a control message indicating a key via a secure radio channel, where the key is a UE-specific key or a UE common key.

[0242] Additionally or alternatively, according to examples disclosed herein, the communication manager 1320 may support wireless communication at the UE. The control resource set monitoring component 1335 may be configured as or otherwise support a component for monitoring a resource set for a downlink control channel within a control resource set, where the resource set is based on the output of the pseudo-random function, and where the output of the pseudo-random function is based on timing parameters, a cell identifier, and a key. In some examples, the communication component 1330 may be configured as or otherwise support a component for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel.

[0243] In some examples, to support monitoring resource sets, the control resource set monitoring component 1335 may be configured as or otherwise support a component for monitoring a first set of resource blocks for a first downlink control channel, where a first initial resource block in the first set of resource blocks is indicated by the output of the pseudo-random function. In some examples, to support monitoring resource sets, the control resource set monitoring component 1335 may be configured as or otherwise support a component for monitoring a second set of resource blocks for a second downlink control channel, where a second initial resource block in the second set of resource blocks is indicated by the output of the pseudo-random function.

[0244] In some examples, the first set of resource blocks is continuous within the downlink bandwidth part of the cell.

[0245] In some examples, the first set of resource blocks is non-continuous and adjacent to a frequency edge of the downlink bandwidth part of the cell.

[0246] In some examples, the PRF component 1360 may be configured as or otherwise support a component for determining a control resource set from a set of multiple control resource sets based on the output of the pseudo-random function, where the output of the pseudo-random function is based on a search space identifier of a search space of the downlink control channel.

[0247] In some examples, the control resource set hopping component 1365 may be configured as or otherwise support a component for receiving control signaling indicating that control resource set hopping is implemented, where the control resource set is determined from the set of multiple control resource sets based on the implementation of the control resource set hopping.

[0248] In some examples, to support monitoring resource sets, the control resource set monitoring component 1335 may be configured as or otherwise support a component for monitoring a subset of a search space set from a set of multiple search space sets, where the subset of the search space set is indicated by the output of the pseudo-random function.

[0249] In some examples, the PRF component 1360 may be configured as or otherwise support a component for determining a parameter set for the control resource set from a set of multiple parameter sets, where the parameter set is indicated by the output of the pseudo-random function.

[0250] In some examples, the parameter set for the control resource set includes frequency domain resource allocation, control resource set duration, control channel element to resource element group mapping, pre-coder granularity, transmit configuration indicator status, or any combination thereof.

[0251] In some examples, the PRF component 1360 may be configured as or otherwise support a component for determining a parameter set for a search space set for the downlink control channel from a set of multiple parameter sets, where the parameter set is indicated by the output of the pseudo-random function.

[0252] In some examples, the parameter set for the search space set includes a monitoring period or a resource indicator for a monitoring occasion or both.

[0253] Additionally or alternatively, according to examples disclosed herein, the communication manager 1320 may support wireless communication at the UE. The control channel monitoring component 1340 may be configured as or otherwise support a component for monitoring a set of resources for control messages via the downlink control channel. The payload descrambling component 1345 may be configured as or otherwise support a component for descrambling the payload of the control message based on a scrambling sequence, where the scrambling sequence is indicated by the output of a pseudo-random function based on timing parameters, a cell identifier, and a key.

[0254] In some examples, an initial value of the scrambling sequence is determined based on the output of the pseudo-random function. In some examples, the payload is descrambled based on the initial value of the scrambling sequence.

[0255] Additionally or alternatively, according to examples disclosed herein, the communication manager 1320 may support wireless communication at the UE. In some examples, the control channel monitoring component 1340 may be configured as or otherwise support a component for monitoring a set of resources for control messages via the downlink control channel. The DMRS demodulation component 1350 may be configured as or otherwise support a component for demodulating the control message based on a set of multiple demodulation reference signals received via the downlink control channel, where a sequence for the set of multiple demodulation reference signals is indicated by the output of a pseudo-random function based on timing parameters, a cell identifier, and a key.

[0256] In some examples, the DMRS demodulation component 1350 may be configured as or otherwise support a component for determining quadrature phase shift keying symbols for the set of multiple demodulation reference signals based on the sequence for the set of multiple demodulation reference signals.

[0257] Figure 14FIG. illustrates a system 1400 including a device 1405 that supports security for downlink signaling, in accordance with one or more aspects of the present disclosure. The device 1405 may be an example of the device 1105, the device 1205, or the UE 115 as described herein, or may include components thereof. The device 1405 may communicate (e.g., wirelessly) with one or more network entities 105, one or more UEs 115, or any combination thereof. The device 1405 may include components for two-way voice and data communication, including components for sending and receiving communications, such as a communication manager 1420, an input / output (I / O) controller 1410, a transceiver 1415, an antenna 1425, a memory 1430, code 1435, and a processor 1440. These components may communicate electronically or otherwise be coupled (e.g., operatively, communicatively, functionally, electronically, electrically) via one or more buses (e.g., bus 1445).

[0258] The I / O controller 1410 may manage input signals and output signals of the device 1405. The I / O controller 1410 may also manage peripheral devices not integrated into the device 1405. In some cases, the I / O controller 1410 may represent a physical connection or port to an external peripheral device. In some cases, the I / O controller 1410 may utilize an operating system, such as or another known operating system. Additionally or alternatively, the I / O controller 1410 may represent, or interact with, a modem, a keyboard, a mouse, a touch screen, or similar device. In some cases, the I / O controller 1410 may be implemented as part of a processor (such as the processor 1440). In some cases, a user may interact with the device 1405 via the I / O controller 1410 or via hardware components controlled by the I / O controller 1410.

[0259] In some cases, device 1405 may include a single antenna 1425. However, in some other cases, device 1405 may have more than one antenna 1425, and the more than one antenna may be capable of concurrently transmitting or receiving multiple wireless transmissions. Transceiver 1415 may communicate bidirectionally via one or more antennas 1425, wired or wireless links as described herein. For example, transceiver 1415 may represent a wireless transceiver and may communicate bidirectionally with another wireless transceiver. Transceiver 1415 may also include a modem for: modulating a packet; providing the modulated packet to one or more antennas 1425 for transmission; and demodulating a packet received from one or more antennas 1425. Transceiver 1415 or transceiver 1415 and one or more antennas 1425 may be examples of transmitter 1115, transmitter 1215, receiver 1110, receiver 1210, or any combination thereof or components thereof as described herein.

[0260] Memory 1430 may include random access memory (RAM) and read only memory (ROM). Memory 1430 may store computer-readable, computer-executable code 1435 including instructions that, when executed by processor 1440, cause device 1405 to perform the various functions described herein. Code 1435 may be stored in a non-transitory computer-readable medium (such as system memory or another type of memory). In some cases, code 1435 may not be directly executable by processor 1440 but may (e.g., when compiled and executed) cause a computer to perform the functions described herein. In some cases, memory 1430 may contain a basic input / output system (BIOS), etc., which may control basic hardware or software operations, such as interactions with peripheral components or devices.

[0261] Processor 1440 may include intelligent hardware devices (e.g., general purpose processor, DSP, CPU, microcontroller, ASIC, FPGA, programmable logic device, discrete gate or transistor logic components, discrete hardware components, or any combination thereof). In some cases, processor 1440 may be configured to operate a memory array using a memory controller. In some other cases, the memory controller may be integrated into processor 1440. Processor 1440 may be configured to execute computer-readable instructions stored in a memory (e.g., memory 1430) to cause device 1405 to perform various functions (e.g., functions or tasks supporting security for downlink signaling). For example, device 1405 or components of device 1405 may include processor 1440 and memory 1430 coupled or coupled to processor 1440, and processor 1440 and memory 1430 are configured to perform the various functions described herein.

[0262] According to examples disclosed herein, communication manager 1420 may support wireless communication at a UE. For example, communication manager 1420 may be configured as or otherwise support a component for monitoring a resource set for one or more synchronization signal blocks associated with one or more pseudo-random sequences, where the one or more pseudo-random sequences and the resource set are indicated by outputs of a pseudo-random function based on timing parameters, a cell identifier, and a key. Communication manager 1420 may be configured as or otherwise support a component for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the one or more synchronization signal blocks.

[0263] Additionally or alternatively, according to examples disclosed herein, communication manager 1420 may support wireless communication at a UE. For example, communication manager 1420 may be configured as or otherwise support a component for monitoring a resource set for a downlink control channel within a control resource set, where the resource set is based on an output of a pseudo-random function, and where the output of the pseudo-random function is based on timing parameters, a cell identifier, and a key. Communication manager 1420 may be configured as or otherwise support a component for communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel.

[0264] Additionally or alternatively, according to examples disclosed herein, communication manager 1420 may support wireless communication at a UE. For example, communication manager 1420 may be configured as or otherwise support a component for monitoring a resource set for a control message via a downlink control channel. Communication manager 1420 may be configured as or otherwise support a component for descrambling a payload of the control message based on a scrambling sequence, where the scrambling sequence is indicated by an output of a pseudo-random function based on timing parameters, a cell identifier, and a key.

[0265] Additionally or alternatively, according to examples disclosed herein, communication manager 1420 may support wireless communication at a UE. For example, communication manager 1420 may be configured as or otherwise support a component for monitoring a resource set for a control message via a downlink control channel. Communication manager 1420 may be configured as or otherwise support a component for demodulating the control message based on a set of multiple demodulation reference signals received via the downlink control channel, where a sequence for the set of multiple demodulation reference signals is indicated by an output of a pseudo-random function based on timing parameters, a cell identifier, and a key.

[0266] By including or configuring a communication manager 1420 according to examples as described herein, the device 1405 may support techniques for higher security initial access signaling and control signaling.

[0267] In some examples, the communication manager 1420 may be configured to perform various operations (e.g., receive, monitor, transmit) using or otherwise in cooperation with the transceiver 1415, one or more antennas 1425, or any combination thereof. Although the communication manager 1420 is illustrated as a separate component, in some examples, one or more functions described with reference to the communication manager 1420 may be supported or performed by the processor 1440, the memory 1430, the code 1435, or any combination thereof. For example, the code 1435 may include instructions that can be executed by the processor 1440 to cause the device 1405 to perform various aspects of the security of downlink signaling as described herein, or the processor 1440 and the memory 1430 may otherwise be configured to perform or support such operations.

[0268] Figure 15 A flowchart illustrating a method 1500 for supporting the security of downlink signaling in accordance with one or more aspects of the present disclosure is shown. The operations of the method 1500 may be implemented by a UE or its components as described herein. For example, the operations of the method 1500 may be performed by a UE 115 as described with reference to Figures 1 to 14 as described. In some examples, the UE may execute an instruction set to control functional elements of the UE to perform the described functions. Additionally or alternatively, the UE may use dedicated hardware to perform aspects of the described functions.

[0269] At 1505, the method may include: monitoring a resource set for one or more synchronization signal blocks associated with one or more pseudo-random sequences, wherein the one or more pseudo-random sequences and the resource set are indicated by an output of a pseudo-random function based on timing parameters, a cell identifier, and a key. The operation of 1505 may be performed in accordance with examples as disclosed herein. In some examples, aspects of the operation of 1505 may be performed by an SSB monitoring component 1325 as described with reference to Figure 13 as described.

[0270] At 1510, the method may include: communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the one or more synchronization signal blocks. The operation of 1510 may be performed in accordance with examples as disclosed herein. In some examples, aspects of the operation of 1510 may be performed by a communication component 1330 as described with reference to Figure 13 as described.

[0271] Figure 16FIG. 1600 is a flow chart illustrating a method 1600 that supports security of downlink signaling in accordance with one or more aspects of the present disclosure. Operations of method 1600 may be implemented by a UE or components thereof as described herein. For example, operations of method 1600 may be performed by UE 115 as described with reference to Figures 1 to 14 In some examples, the UE may execute an instruction set to control functional elements of the UE to perform the described functions. Additionally or alternatively, the UE may use dedicated hardware to perform aspects of the described functions.

[0272] At 1605, the method may include: monitoring a resource set for a downlink control channel within a control resource set, where the resource set is based on an output of a pseudo-random function, and where the output of the pseudo-random function is based on a timing parameter, a cell identifier, and a key. The operation of 1605 may be performed in accordance with examples as disclosed herein. In some examples, aspects of the operation of 1605 may be performed by a control resource set monitoring component 1335 as described with reference to Figure 13 In some examples, aspects of the operation of 1605 may be performed by a control resource set monitoring component 1335 as described with reference to

[0273] At 1610, the method may include: communicating with a network entity via a cell associated with the cell identifier based on monitoring the resource set for the downlink control channel. The operation of 1610 may be performed in accordance with examples as disclosed herein. In some examples, aspects of the operation of 1610 may be performed by a communication component 1330 as described with reference to Figure 13 In some examples, aspects of the operation of 1610 may be performed by a communication component 1330 as described with reference to

[0274] Figure 17 FIG. 1700 is a flow chart illustrating a method 1700 that supports security of downlink signaling in accordance with one or more aspects of the present disclosure. Operations of method 1700 may be implemented by a UE or components thereof as described herein. For example, operations of method 1700 may be performed by UE 115 as described with reference to Figures 1 to 14 In some examples, the UE may execute an instruction set to control functional elements of the UE to perform the described functions. Additionally or alternatively, the UE may use dedicated hardware to perform aspects of the described functions.

[0275] At 1705, the method may include: monitoring a resource set for a control message via a downlink control channel. The operation of 1705 may be performed in accordance with examples as disclosed herein. In some examples, aspects of the operation of 1705 may be performed by a control channel monitoring component 1340 as described with reference to Figure 13 In some examples, aspects of the operation of 1705 may be performed by a control channel monitoring component 1340 as described with reference to

[0276] At 1710, the method may include: descrambling the payload of the control message based on a scrambling sequence, where the scrambling sequence is indicated by an output of a pseudo-random function based on timing parameters, a cell identifier, and a key. The operation at 1710 may be performed according to the examples disclosed herein. In some examples, aspects of the operation at 1710 may be performed by a payload descrambling component 1345 as described with reference to Figure 13 The descrambling component 1345 described with reference to

[0277] Figure 18 FIG. 6 illustrates a flow diagram of a method 1800 that illustrates securing downlink signaling in accordance with one or more aspects of the present disclosure. The operations of method 1800 may be implemented by a UE or components thereof as described herein. For example, the operations of method 1800 may be performed by a UE 115 as described with reference to Figures 1 to 14 In some examples, the UE may execute an instruction set to control functional elements of the UE to perform the described functions. Additionally or alternatively, the UE may use dedicated hardware to perform aspects of the described functions.

[0278] At 1805, the method may include: monitoring a resource set for control messages via a downlink control channel. The operation at 1805 may be performed according to the examples disclosed herein. In some examples, aspects of the operation at 1805 may be performed by a control channel monitoring component 1340 as described with reference to Figure 13 The control channel monitoring component 1340 described with reference to

[0279] At 1810, the method may include: demodulating the control message based on a set of multiple demodulation reference signals received via the downlink control channel, where the sequence for the set of multiple demodulation reference signals is indicated by an output of a pseudo-random function based on timing parameters, a cell identifier, and a key. The operation at 1810 may be performed according to the examples disclosed herein. In some examples, aspects of the operation at 1810 may be performed by a DMRS demodulation component 1350 as described with reference to Figure 13 The DMRS demodulation component 1350 described with reference to

[0280] An overview of aspects of the present disclosure is provided below:

[0281] Aspect 1: A method for wireless communication at a UE, the method comprising: monitoring a resource set for one or more synchronization signal blocks associated with one or more pseudo-random sequences, where the one or more pseudo-random sequences and the resource set are indicated by an output of a pseudo-random function based at least in part on timing parameters, a cell identifier, and a key; and communicating with a network entity via a cell associated with the cell identifier at least in part based on monitoring the resource set for the one or more synchronization signal blocks.

[0282] Aspect 2: The method according to Aspect 1, wherein monitoring the resource set includes: monitoring a first burst of a synchronization signal block associated with a first pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the pseudo-random function; and monitoring a second burst of a synchronization signal block associated with a second pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the pseudo-random function.

[0283] Aspect 3: The method according to Aspect 2, the method further comprising: generating the first pseudo-random sequence and the second pseudo-random sequence at least in part based on one or more calls to the pseudo-random function.

[0284] Aspect 4: The method according to any one of Aspects 1 to 3, wherein monitoring the resource set includes: monitoring a first synchronization signal block of a burst of a synchronization signal block associated with a first pseudo-random sequence among the one or more pseudo-random sequences, wherein the first pseudo-random sequence is indicated by the output of the pseudo-random function; and monitoring a second synchronization signal block of the burst of the synchronization signal block associated with a second pseudo-random sequence among the one or more pseudo-random sequences, wherein the second pseudo-random sequence is indicated by the output of the pseudo-random function.

[0285] Aspect 5: The method according to any one of Aspects 1 to 4, wherein monitoring the resource set includes: monitoring a first burst of a synchronization signal block, wherein a first sorting of synchronization signal block indices for the first burst of the synchronization block is indicated by the output of the pseudo-random function; and monitoring a second burst of a synchronization signal block, wherein a second sorting of synchronization signal block indices for the second burst of the synchronization block is indicated by the output of the pseudo-random function.

[0286] Aspect 6: The method according to Aspect 5, wherein the output of the pseudo-random function indicates the first sorting and the second sorting at least in part based on the number of symbols per half-frame.

[0287] Aspect 7: The method according to any one of Aspects 1 to 6, the method further comprising: monitoring a first synchronization signal block of the burst of the synchronization signal block during a start symbol of the burst of the synchronization signal block, wherein the start symbol is indicated by the output of the pseudo-random function.

[0288] Aspect 8: The method according to Aspect 7, wherein the output of the pseudo-random function indicates the start symbol of the burst of the synchronization signal block at least in part based on the number of symbols per half-frame.

[0289] Aspect 9: The method according to any one of Aspects 1 to 8, wherein monitoring the resource set includes: monitoring a first burst of a synchronization signal block that is frequency-offset from a reference point by a first offset indicated by the output of the pseudo-random function; and monitoring a second burst of a synchronization signal block that is frequency-offset from the reference point by a second offset indicated by the output of the pseudo-random function.

[0290] Aspect 10: The method according to aspect 9, wherein the output of the pseudo-random function indicates a first index of a synchronization raster for the first offset and a second index of the synchronization raster for the second offset.

[0291] Aspect 11: The method according to any one of Aspects 1 to 10, wherein monitoring the resource set includes: monitoring a first synchronization signal in a first synchronization signal block among the one or more synchronization signal blocks, wherein a first sequence of the first synchronization signal is indicated by the output of the pseudo-random function; and monitoring a second synchronization signal in the first synchronization signal block, wherein a second sequence of the second synchronization signal is indicated by the output of the pseudo-random function.

[0292] Aspect 12: The method according to any one of Aspects 1 to 11, the method further includes: monitoring a control resource set that is frequency-offset from the one or more synchronization signal blocks by a fixed number of resource blocks.

[0293] Aspect 13: The method according to any one of Aspects 1 to 12, the method further includes: monitoring a control resource set within a first duration according to a first offset in frequency from a first burst of a synchronization signal block among the one or more synchronization signal blocks, the first offset being indicated by the output of the pseudo-random function; and monitoring the control resource set within a second duration according to a second offset in frequency from a second burst of a synchronization signal block among the one or more synchronization signal blocks, the second offset being indicated by the output of the pseudo-random function.

[0294] Aspect 14: The method according to aspect 13, wherein the first offset is indicated by the output of the pseudo-random function at least partially based on a first value indicated by a first master information block of the first burst of the synchronization signal block, and the second offset is indicated by the output of the pseudo-random function at least partially based on a second value indicated by a second master information block of the second burst of the synchronization signal block.

[0295] Aspect 15: The method according to any one of Aspects 1 to 14, the method further includes: receiving a control message indicating the key via a secure radio channel, wherein the key is a UE-specific key or a UE common key.

[0296] Aspect 16: A method for wireless communication at a UE, the method comprising: monitoring a resource set for a downlink control channel within a control resource set, wherein the resource set is at least partially based on an output of a pseudo-random function, and wherein the output of the pseudo-random function is at least partially based on a timing parameter, a cell identifier, and a key; and communicating with a network entity via a cell associated with the cell identifier, at least partially based on monitoring the resource set for the downlink control channel.

[0297] Aspect 17: The method according to aspect 16, wherein monitoring the resource set comprises: monitoring a first set of resource blocks for a first downlink control channel, wherein a first initial resource block in the first set of resource blocks is indicated by the output of the pseudo-random function; and monitoring a second set of resource blocks for a second downlink control channel, wherein a second initial resource block in the second set of resource blocks is indicated by the output of the pseudo-random function.

[0298] Aspect 18: The method according to aspect 17, wherein the first set of resource blocks is contiguous within a downlink bandwidth part of the cell.

[0299] Aspect 19: The method according to any one of aspects 17 to 18, wherein the first set of resource blocks is non-contiguous and adjacent to a frequency edge of a downlink bandwidth part of the cell.

[0300] Aspect 20: The method according to any one of aspects 16 to 19, the method further comprising: determining the control resource set from a plurality of control resource sets, at least partially based on the output of the pseudo-random function, wherein the output of the pseudo-random function is at least partially based on a search space identifier of a search space of the downlink control channel.

[0301] Aspect 21: The method according to aspect 20, the method further comprising: receiving control signaling indicating that control resource set hopping is implemented, wherein the control resource set is determined from the plurality of control resource sets, at least partially based on the control resource set hopping being implemented.

[0302] Aspect 22: The method according to any one of aspects 16 to 21, wherein monitoring the resource set comprises: monitoring a subset of a search space set from a plurality of search space sets, wherein the subset of the search space set is indicated by the output of the pseudo-random function.

[0303] Aspect 23: The method according to any one of aspects 16 to 22, the method further comprising: determining a parameter set for the control resource set from a plurality of parameter sets, wherein the parameter set is indicated by the output of the pseudo-random function.

[0304] Aspect 24: The method according to aspect 23, wherein the set of parameters for the control resource set includes frequency domain resource allocation, control resource set duration, control channel element to resource element group mapping, pre-coder granularity, transmission configuration indicator status, or any combination thereof.

[0305] Aspect 25: The method according to any one of aspects 16 to 24, the method further comprising: determining a set of parameters for a search space set for the downlink control channel from a plurality of sets of parameters, wherein the set of parameters is indicated by the output of the pseudo-random function.

[0306] Aspect 26: The method according to aspect 25, wherein the set of parameters for the search space set includes a monitoring period or a resource indicator for a monitoring occasion, or both.

[0307] Aspect 27: A method for wireless communication at a UE, the method comprising: monitoring, via a downlink control channel, a resource set for a control message; and descrambling at least part of a payload of the control message based on a scrambling sequence, wherein the scrambling sequence is indicated by an output of a pseudo-random function that is at least partially based on timing parameters, a cell identifier, and a key.

[0308] Aspect 28: The method according to aspect 27, wherein an initial value of the scrambling sequence is determined at least partially based on the output of the pseudo-random function, and the payload is descrambled at least partially based on the initial value of the scrambling sequence.

[0309] Aspect 29: A method for wireless communication at a UE, the method comprising: monitoring, via a downlink control channel, a resource set for a control message; and demodulating the control message at least partially based on a plurality of demodulation reference signals received via the downlink control channel, wherein a sequence for the plurality of demodulation reference signals is indicated by an output of a pseudo-random function that is at least partially based on timing parameters, a cell identifier, and a key.

[0310] Aspect 30: The method according to aspect 29, the method further comprising: determining quadrature phase shift keying symbols for the plurality of demodulation reference signals at least partially based on the sequence for the plurality of demodulation reference signals.

[0311] Aspect 31: An apparatus for wireless communication at a UE, the apparatus comprising: a processor; a memory coupled to the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to perform the method according to any one of aspects 1 to 15.

[0312] Aspect 32: An apparatus for wireless communication at a UE, the apparatus including at least one component for performing the method according to any one of Aspects 1 to 15.

[0313] Aspect 33: A non-transitory computer-readable medium storing code for wireless communication at a UE, the code including instructions executable by a processor to perform the method according to any one of Aspects 1 to 15.

[0314] Aspect 34: An apparatus for wireless communication at a UE, the apparatus including: a processor; a memory coupled to the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to perform the method according to any one of Aspects 16 to 26.

[0315] Aspect 35: An apparatus for wireless communication at a UE, the apparatus including at least one component for performing the method according to any one of Aspects 16 to 26.

[0316] Aspect 36: A non-transitory computer-readable medium storing code for wireless communication at a UE, the code including instructions executable by a processor to perform the method according to any one of Aspects 16 to 26.

[0317] Aspect 37: An apparatus for wireless communication at a UE, the apparatus including: a processor; a memory coupled to the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to perform the method according to any one of Aspects 27 to 28.

[0318] Aspect 38: An apparatus for wireless communication at a UE, the apparatus including at least one component for performing the method according to any one of Aspects 27 to 28.

[0319] Aspect 39: A non-transitory computer-readable medium storing code for wireless communication at a UE, the code including instructions executable by a processor to perform the method according to any one of Aspects 27 to 28.

[0320] Aspect 40: An apparatus for wireless communication at a UE, the apparatus including: a processor; a memory coupled to the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to perform the method according to any one of Aspects 29 to 30.

[0321] Aspect 41: An apparatus for wireless communication at a UE, the apparatus including at least one component for performing the method according to any one of Aspects 29 to 30.

[0322] Aspect 42: A non-transitory computer-readable medium storing code for wireless communication at a UE, the code including instructions executable by a processor to perform the method according to any one of Aspects 29 to 30.

[0323] It should be noted that the methods described herein depict possible specific implementations, and the operations and steps may be rearranged or otherwise modified and other specific implementations are possible. Additionally, aspects from two or more methods may be combined.

[0324] Although aspects of LTE, LTE-A, LTE-A Pro, or NR systems may be described for example purposes and the LTE, LTE-A, LTE-A Pro, or NR terminology may be used in most of the description, the techniques described herein may also be applicable to networks other than LTE, LTE-A, LTE-A Pro, or NR networks. For example, the described techniques may be applicable to various other wireless communication systems such as Ultra Mobile Broadband (UMB), Institute of Electrical and Electronics Engineers (IEEE) 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash-OFDM, and other systems and radio technologies not explicitly mentioned herein.

[0325] The information and signals described herein may be represented using any of a variety of different technologies and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips referred to throughout the specification may be represented by voltages, currents, electromagnetic waves, magnetic fields or magnetic particles, optical fields or optical particles, or any combination thereof.

[0326] The various illustrative blocks and components described in connection with the disclosure herein may be implemented or performed using a general-purpose processor, DSP, ASIC, CPU, FPGA, or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. The general-purpose processor may be a microprocessor, but in the alternative, the processor may be any processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices (e.g., a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors in conjunction with a DSP core, or any other such configuration).

[0327] The functions described herein can be implemented using hardware, software executed by a processor, firmware, or any combination thereof. If implemented using software executed by a processor, the functions can be stored as one or more instructions or code on a computer-readable medium or transmitted using one or more instructions or code on a computer-readable medium. Other examples and specific implementations are within the scope of the present disclosure and the appended claims. For example, due to the nature of software, the functions described herein can be implemented using software executed by a processor, hardware, firmware, hardwiring, or any combination of these items. The features implementing the functions can also be physically located at different positions, including being distributed such that different parts of the functions are implemented at different physical positions.

[0328] Computer-readable media includes both non-transitory computer storage media and communication media, which includes any medium that facilitates transfer of a computer program from one location to another. The non-transitory storage media can be any available media that can be accessed by a general or special purpose computer. By way of example, and not limitation, non-transitory computer-readable media can include RAM, ROM, electrically erasable programmable ROM (EEPROM), flash memory, compact disc (CD) ROM or other optical disc storage, magnetic disk storage or other magnetic storage devices, or any other non-transitory medium that can be used to carry or store desired program code components in the form of instructions or data structures and that can be accessed by a general or special purpose computer or a general or special purpose processor. Also, any connection is properly termed a computer-readable medium. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of computer-readable medium. As used herein, disk and disc include CD, laser disc, optical disc, digital versatile disc (DVD), floppy disk, and Blu-ray disc. Disk can magnetically reproduce data, and disc can optically reproduce data using lasers. Combinations of the above are also included within the scope of computer-readable media.

[0329] As used herein, including in the claims, the "or" used in a list of items (e.g., a list of items accompanied by a phrase such as "at least one of" or "one or more of") indicates an inclusive listing such that, for example, the listing of at least one of A, B, or C means A or B or C or AB or AC or BC or ABC (i.e., A and B and C). Additionally, as used herein, the phrase "based on" should not be construed as a reference to a closed set of conditions. For example, an example step described as "based on condition A" can be based on both condition A and condition B without departing from the scope of the present disclosure. In other words, as used herein, the phrase "based on" should be interpreted in the same manner as the phrase "at least partially based on".

[0330] The term "determine" encompasses a variety of actions and, thus, "determine" can include calculating, computing, processing, deriving, investigating, looking up (such as looking up in a table, database, or other data structure), ascertaining, and similar actions. Additionally, "determine" can include receiving (e.g., receiving information), accessing (e.g., accessing data stored in a memory), etc. Further, "determine" can include parsing, obtaining, selecting, choosing, establishing, and other such similar actions.

[0331] In the figures, similar components or features may have the same reference numeral. Additionally, various components of the same type can be distinguished by adding a dash and a second numeral used to differentiate between similar components after the reference numeral. If only the first reference numeral is used in the specification, the description can apply to any of the similar components having the same first reference numeral, regardless of the second reference numeral or other subsequent reference numerals.

[0332] The description set forth herein with reference to the figures describes example configurations and does not represent all examples that can be implemented or that are within the scope of the claims. The term "example" as used herein means "serving as an example, instance, or illustration" and not "preferred" or "advantageous over other examples". The detailed description includes specific details for providing an understanding of the described techniques. However, the techniques can be practiced without these specific details. In some instances, well-known structures and devices are shown in block diagram form to avoid obscuring the concepts of the described examples.

[0333] The present description is provided to enable a person of ordinary skill in the art to make or use the present disclosure. Various modifications to the present disclosure will be apparent to a person of ordinary skill in the art, and the general principles defined herein can be applied to other variations without departing from the scope of the present disclosure. Thus, the present disclosure is not limited to the examples and designs described herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. An apparatus for wireless communication at a user equipment (UE), the apparatus comprising: a processor; a memory coupled to the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to: monitor a resource set for one or more synchronization signal blocks associated with one or more pseudo-random sequences, wherein the one or more pseudo-random sequences and the resource set are indicated by an output of a pseudo-random function that is at least partially based on a timing parameter, a cell identifier, and a key; and communicate with a network entity via a cell associated with the cell identifier, at least partially based on monitoring the resource set for the one or more synchronization signal blocks.

2. The apparatus of claim 1, wherein the instructions for monitoring the resource set are executable by the processor to cause the apparatus to: monitor a first burst of a synchronization signal block associated with a first pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the pseudo-random function; and monitor a second burst of a synchronization signal block associated with a second pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the pseudo-random function.

3. The apparatus of claim 2, wherein the instructions are further executable by the processor to cause the apparatus to: generate the first pseudo-random sequence and the second pseudo-random sequence, at least partially based on one or more calls to the pseudo-random function.

4. The apparatus of claim 1, wherein the instructions for monitoring the resource set are executable by the processor to cause the apparatus to: monitor a first synchronization signal block of a burst of synchronization signal blocks associated with a first pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the pseudo-random function; and monitor a second synchronization signal block of the burst of synchronization signal blocks associated with a second pseudo-random sequence among the one or more pseudo-random sequences indicated by the output of the pseudo-random function.

5. The apparatus of claim 1, wherein the instructions for monitoring the resource set are executable by the processor to cause the apparatus to: monitor a first burst of synchronization signal blocks, wherein a first ordering of synchronization signal block indices for the first burst of synchronization blocks is indicated by the output of the pseudo-random function; and monitor a second burst of synchronization signal blocks, wherein a second ordering of synchronization signal block indices for the second burst of synchronization blocks is indicated by the output of the pseudo-random function.

6. The apparatus of claim 5, wherein the output of the pseudo-random function indicates the first ordering and the second ordering at least partially based on the number of symbols per half-frame.

7. The apparatus of claim 1, wherein the instructions are further executable by the processor to cause the apparatus to: Monitor a first synchronization signal block of the burst of the synchronization signal block during a start symbol of the burst of the synchronization signal block, wherein the start symbol is indicated by the output of the pseudo-random function.

8. The apparatus according to claim 7, wherein the output of the pseudo-random function indicates the start symbol of the burst of the synchronization signal block at least in part based on the number of symbols per half-frame.

9. The apparatus according to claim 1, wherein the instructions for monitoring the resource set are executable by the processor to cause the apparatus to: Monitor a first burst of a synchronization signal block that is frequency-offset from a reference point by a first offset indicated by the output of the pseudo-random function; and Monitor a second burst of a synchronization signal block that is frequency-offset from the reference point by a second offset indicated by the output of the pseudo-random function.

10. The apparatus according to claim 9, wherein the output of the pseudo-random function indicates a first index of a synchronization raster for the first offset and a second index of the synchronization raster for the second offset.

11. The apparatus according to claim 1, wherein the instructions for monitoring the resource set are executable by the processor to cause the apparatus to: Monitor a first synchronization signal in a first synchronization signal block of the one or more synchronization signal blocks, wherein a first sequence of the first synchronization signal is indicated by the output of the pseudo-random function; and Monitor a second synchronization signal in the first synchronization signal block, wherein a second sequence of the second synchronization signal is indicated by the output of the pseudo-random function.

12. The apparatus according to claim 1, wherein the instructions are further executable by the processor to cause the apparatus to: Monitor a control resource set that is frequency-offset from the one or more synchronization signal blocks by a fixed number of resource blocks.

13. The apparatus according to claim 1, wherein the instructions are further executable by the processor to cause the apparatus to: Monitor a control resource set during a first duration according to a first offset in frequency from a first burst of a synchronization signal block in the one or more synchronization signal blocks, the first offset being indicated by the output of the pseudo-random function; and Monitor the control resource set during a second duration according to a second offset in frequency from a second burst of a synchronization signal block in the one or more synchronization signal blocks, the second offset being indicated by the output of the pseudo-random function.

14. The apparatus according to claim 13, wherein the first offset is indicated by the output of the pseudo-random function at least in part based on a first value indicated by a first master information block of the first burst of the synchronization signal block, and the second offset is indicated by the output of the pseudo-random function at least in part based on a second value indicated by a second master information block of the second burst of the synchronization signal block.

15. The apparatus according to claim 1, wherein the instructions are further executable by the processor to cause the apparatus to: Receive a control message indicating the key via a secure radio channel, wherein the key is a UE-specific key or a UE common key.

16. An apparatus for wireless communication at a user equipment (UE), the apparatus comprising: a processor; a memory coupled to the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to: monitor a resource set for a downlink control channel within a control resource set, wherein the resource set is at least partially based on an output of a pseudo-random function, and wherein the output of the pseudo-random function is at least partially based on a timing parameter, a cell identifier, and a key; and communicate with a network entity via a cell associated with the cell identifier, at least partially based on monitoring the resource set for the downlink control channel.

17. The apparatus of claim 16, wherein the instructions for monitoring the resource set are executable by the processor to cause the apparatus to: monitor a first set of resource blocks for a first downlink control channel, wherein a first initial resource block in the first set of resource blocks is indicated by the output of the pseudo-random function; and monitor a second set of resource blocks for a second downlink control channel, wherein a second initial resource block in the second set of resource blocks is indicated by the output of the pseudo-random function.

18. The apparatus of claim 17, wherein the first set of resource blocks is continuous within a downlink bandwidth part of the cell.

19. The apparatus of claim 17, wherein the first set of resource blocks is non-continuous and adjacent to a frequency edge of the downlink bandwidth part of the cell.

20. The apparatus of claim 16, wherein the instructions are further executable by the processor to cause the apparatus to: determine the control resource set from a plurality of control resource sets, at least partially based on the output of the pseudo-random function, wherein the output of the pseudo-random function is at least partially based on a search space identifier of a search space of the downlink control channel.

21. The apparatus of claim 20, wherein the instructions are further executable by the processor to cause the apparatus to: receive control signaling indicating that control resource set hopping is implemented, wherein the control resource set is determined from the plurality of control resource sets at least partially based on the control resource set hopping being implemented.

22. The apparatus of claim 16, wherein the instructions for monitoring the resource set are executable by the processor to cause the apparatus to: monitor a subset of a search space set from a plurality of search space sets, wherein the subset of the search space set is indicated by the output of the pseudo-random function.

23. The apparatus of claim 16, wherein the instructions are further executable by the processor to cause the apparatus to: determine a parameter set for the control resource set from a plurality of parameter sets, wherein the parameter set is indicated by the output of the pseudo-random function.

24. The apparatus according to claim 23, wherein the set of parameters for the control resource set includes frequency domain resource allocation, control resource set duration, control channel element to resource element group mapping, precoder granularity, transmission configuration indicator status, or any combination thereof.

25. The apparatus according to claim 16, wherein the instructions can be further executed by the processor to cause the apparatus to: Determine a set of parameters for a search space set for the downlink control channel from a plurality of sets of parameters, wherein the set of parameters is indicated by the output of the pseudo-random function.

26. The apparatus according to claim 25, wherein the set of parameters for the search space set includes a monitoring period or a resource indicator for a monitoring occasion, or both.

27. An apparatus for wireless communication at a user equipment (UE), the apparatus comprising: A processor; A memory coupled to the processor; And Instructions stored in the memory and executable by the processor to cause the apparatus to: Monitor a resource set for a control message via a downlink control channel; And Descramble a payload of the control message at least in part based on a scrambling sequence, wherein the scrambling sequence is indicated by an output of a pseudo-random function that is at least in part based on a timing parameter, a cell identifier, and a key.

28. The apparatus according to claim 27, wherein: An initial value of the scrambling sequence is determined at least in part based on the output of the pseudo-random function, and The payload is descrambled at least in part based on the initial value of the scrambling sequence.

29. An apparatus for wireless communication at a user equipment (UE), the apparatus comprising: A processor; A memory coupled to the processor; And Instructions stored in the memory and executable by the processor to cause the apparatus to: Monitor a resource set for a control message via a downlink control channel; And Demodulate the control message at least in part based on a plurality of demodulation reference signals received via the downlink control channel, wherein a sequence for the plurality of demodulation reference signals is indicated by an output of a pseudo-random function that is at least in part based on a timing parameter, a cell identifier, and a key.

30. The apparatus according to claim 29, wherein the instructions can be further executed by the processor to cause the apparatus to: Determine quadrature phase shift keying symbols for the plurality of demodulation reference signals at least in part based on the sequence for the plurality of demodulation reference signals.

Images