Mobile communication uplink signal positioning method, sniffer device and positioning system

Abstract

The invention discloses a mobile communication uplink signal positioning method, a sniffer device and a positioning system, relates to the technical field of wireless communication, and has the advantages of flexible scheme, low cost, wide application scene and the like. The positioning method comprises the following steps: receiving an uplink signal of user equipment through a sniffer device equipped with an antenna; user equipment identification information is obtained in a collaborative or independent mode; extracting a corresponding target signal according to the identification information; and finally calculating the position of the user equipment according to the target signal. The invention further provides a'time-division switching antenna 'scheme, the effect of a large-scale array can be equivalent by using a low-cost small-scale antenna array, the hardware cost is remarkably reduced, and the technical pain point in the prior art can be effectively solved.

Description

TECHNICAL FIELD

[0001] The present application belongs to the technical field of wireless communication, in particular to a mobile communication uplink signal positioning method, a sniffer device and a positioning system. BACKGROUND

[0002] With the rapid development of mobile communication technology (such as 4G, 5G and future communication technology), high-precision and wide-coverage location services have become the basis for many emerging applications, especially in indoor environments where satellite signals are weak or missing. High-precision indoor positioning technology is in urgent need. Using mobile communication network signals for positioning has become a highly potential technical direction, which has the advantage of utilizing a large number of existing communication facilities without the need for large-scale deployment of dedicated positioning equipment.

[0003] Currently, the technical solutions for positioning using mobile communication signals can be mainly divided into the following categories according to their implementation principles and dependence on the network: (I) The first category is non-real-time and low-precision positioning based on network-side big data. For example, the method disclosed in Chinese patent application CN113423054A analyzes and mines massive user online log data in core network elements, associates the identifier of a user equipment (UE) with the connected base station, and combines the base station geographic position information library to realize cell-level (Cell ID) positioning of the user equipment. The accuracy of this method is usually above 100 meters, and it has a large delay, which cannot meet the real-time and high-precision positioning requirements.

[0004] (II) The second category is high-precision positioning based on physical layer signal measurement, which is also the current mainstream research direction. The core idea of this scheme is to measure the parameters of the uplink physical signal (such as SRS, PUCCH, etc.) sent by the user equipment, and use TDOA, AOA, etc. algorithm for precise positioning. In the implementation of this type of positioning, a single and completely network-dependent working paradigm is usually adopted. Specifically, it can be divided into: (1) The network-side device (such as the base station) as the measurement subject. For example, Chinese patent applications CN120302231A and CN118890687A disclose various positioning methods based on uplink SRS. In these schemes, the network-side device (one or more base stations) that masters all configuration information still dominates and performs the measurement, which is essentially still in the category of cooperative positioning. (2) Dependence on the base station side to provide explicit resource configuration information. For example, the scheme disclosed in Chinese patent application CN115550864A completely builds on the premise that the uplink resource time-frequency configuration information of the target UE can be sent by the mobile communication base station to realize the positioning system function.

[0005] In summary, although the existing high-precision positioning technical solutions have proven their effectiveness under ideal conditions, their inherent single working paradigm leads to one or more of the following key limitations: (a) Single working mode, serious lack of adaptability The existing high-precision positioning technology is designed as a single working paradigm, and its effectiveness is completely based on pushing accurate and complete directive information from a single source (base station). This rigid dependence on the active cooperation of the base station makes it completely unable to work in many non-cooperative actual scenarios that cannot meet this premise (such as due to the non-open interface of the equipment vendor, security policy restrictions, or cross-network deployment, etc.), showing great limitations and vulnerability.

[0006] (b) The problem of high hardware cost has not been solved In order to achieve high-precision Angle of Arrival (AoA) positioning, a large-scale antenna array needs to be deployed at the receiving end, and each antenna unit needs to be equipped with an independent radio frequency receiving channel. The existing technology does not provide a special solution to this problem, which results in high hardware cost, power consumption and physical size of the sensing device, greatly limiting its large-scale, low-cost commercial deployment. SUMMARY

[0007] The main purpose of the present application is to overcome the defects of the prior art such as single function, rigid architecture and high cost, and to provide a mobile communication uplink signal positioning method, a sniffer device and a positioning system. The present application aims to: (I) Provide a new and unified flexible positioning technology framework Overcome the rigid dependence of the existing technology on the cooperation of the base station. In a unified architecture, two complementary working modes, independent working mode and cooperative function mode, are innovatively provided. These two working modes can be used independently or simultaneously.

[0008] (II) Provide a method for implementing the above independent working mode As a key component of the above unified framework, the present application creates a technology path that does not require network-side cooperation. Through innovative methods such as blind search and blind demodulation, the target user equipment is autonomously discovered and associated, thereby enabling effective positioning in a "non-cooperative" scenario.

[0009] (III) Provide a method for the above cooperative working mode The cooperative working mode in the present application is no longer limited to pushing user information by the base station device, but is expanded into a flexible information fusion framework that can efficiently receive and utilize diverse cooperative information from different external sources (including base station devices, user equipment themselves, core networks, etc.). Different cooperative methods include: A. Base station cooperation By obtaining the uplink resource configuration information, identity or other related auxiliary information of the user equipment from the base station side, the sniffer device can accurately and efficiently guide the signal extraction and positioning calculation.

[0010] B. Terminal cooperation In a specific application scenario, the positioning system of the present application can be configured to receive the identity, location-related information or specific positioning auxiliary signal from the user equipment. This method simplifies the dependence on network operators and is suitable for specific vertical industry applications or special network environments.

[0011] C. Core network cooperation Through standardized information interaction with the network exposure function (NEF) entity of the 5G core network (5GC), the quasi-real-time and macro context information about the target user equipment is obtained. These information serve as prior knowledge to provide strong guidance and constraints for the search and analysis of the sniffer.

[0012] (IV) Provide a hardware implementation scheme that balances performance and cost Under the above unified framework, a low-cost and efficient sniffer device hardware implementation scheme is provided. Through "time division switching differential antenna array", the device cost and complexity are significantly reduced while ensuring high-precision AoA positioning capability, solving the core obstacle that limits the large-scale commercial deployment of this technology.

[0013] To achieve the above purpose, one of the solutions of the present application is: A mobile communication uplink signal positioning method, comprising the following steps: Step S1. Receive radio frequency signal Passively receive radio frequency signals in a mobile communication network through at least one sniffer device equipped with an antenna, wherein the radio frequency signals at least include uplink radio frequency signals sent by a user equipment; Step S2. Obtain user equipment identity information and related information for determining its uplink signal time-frequency resource The method for obtaining user equipment identity information includes: (1) Independent mode Perform a workflow that does not require active cooperation from network devices to obtain uplink resource configuration information related to the user equipment; (2) Cooperative mode Receive uplink resource configuration information related to the user equipment from an external source, which contains user equipment identity information and related information for determining its uplink signal time-frequency resource; Step S3. Extract target signal an uplink resource parsing module in the sniffer device, based on the user equipment identification information and the related information for determining the uplink signal time-frequency resource obtained in step S2, extracts the target signal corresponding to the user equipment from the uplink radio frequency signal through parsing and processing of the uplink radio frequency signal. Step S4. Positioning calculation The positioning server or the positioning function module integrated in the sniffer device calculates the position of the user equipment by using a positioning algorithm based on the target signal extracted by one or more sniffer devices.

[0014] The workflow of the independent mode in step S2 includes: Step S2.1: Establish a list of candidate radio network temporary identifiers in one of the following ways: (1) Listen to the downlink control channel of the mobile communication network, perform blind decoding on one or more captured downlink control channel candidates, and establish an active user list containing one or more radio network temporary identifiers (RNTIs); (2) Use a preset set containing all or part of possible radio network temporary identifiers as the active user list; Step S2.2: Use the active user list to perform association verification on one or more candidate signals in the captured uplink radio frequency signal. When the verification is successfully completed using a certain radio network temporary identifier in the list, the corresponding relationship between the radio network temporary identifier and the specific candidate signal is confirmed, and the radio network temporary identifier is used as the identification information of the user equipment. At the same time, the corresponding relationship itself or the time-frequency resource determined based on the corresponding relationship is used as the related information for determining the uplink signal time-frequency resource.

[0015] The uplink resource parsing module confirms the correct corresponding relationship between the extracted target signal and the user equipment by performing the following verification operations: (1) Association verification based on demodulation reference signal (DMRS) Correlation comparison is performed between the received uplink radio frequency signal and one or more candidate DMRS sequences generated based on the candidate user equipment identification information. When the result of the correlation comparison exceeds a preset threshold, the association between the target signal and the specific user equipment is preliminarily confirmed. (2) Affiliation confirmation based on cyclic redundancy check (CRC) Based on the user equipment identification information, perform CRC on the data transmission block associated with the target signal. When the verification is successful, it is finally confirmed that the target signal belongs to the user equipment.

[0016] The uplink resource parsing module is configured to: (1) Determine the bandwidth Within a preset range of receiving bandwidth, according to the relevant information for determining the uplink signal time-frequency resource acquired in step S2, or by analyzing the energy spectrum of the uplink radio frequency signal, a target sub-bandwidth containing the target signal and having a bandwidth smaller than the receiving bandwidth is determined; (2) Analysis and processing Only the signals in the target sub-bandwidth are subjected to subsequent analysis and processing, so as to reduce the calculation complexity.

[0017] Preferably, the mobile communication uplink signal positioning method is configured to be capable of being selected and switched between a cooperative working mode, an independent working mode and a hybrid working mode; wherein the cooperative working mode corresponds to the cooperative mode in step S2, the independent working mode corresponds to the independent mode in step S2, and the hybrid working mode is a fusion operation of the cooperative working mode and the independent working mode.

[0018] Preferably, the mobile communication uplink signal positioning method further comprises: By using the sniffer device equipped with an array antenna, the position information of the user equipment is calculated by jointly processing the multiple signals received from multiple antenna units of the array antenna.

[0019] Preferably, the manner of jointly processing the multiple signals received from multiple antenna units is: The joint processing includes calculating the angle of arrival of the user equipment relative to the sniffer device by analyzing the spatial relationship between the multiple signals received from multiple antenna units of the array antenna.

[0020] Preferably, the array antenna is a time-division switching antenna array, which switches at least one antenna unit in the array antenna as a reference channel providing a phase reference, switches the remaining antenna units to one or more switching channels in time, and obtains spatial phase information eliminating unknown modulation phase by differentially processing the signals of the switching channels and the reference channel, and uses the spatial phase information to calculate the angle of arrival.

[0021] The second solution of the present application is: A mobile communication uplink signal sniffer device, comprising at least one antenna, a radio frequency signal digitization module, a processing module and a data interface module; the processing module is configured to: be capable of working in an independent working mode to execute the mobile communication uplink signal positioning method and autonomously extract target signals from digitized collected signals.

[0022] Preferably, the processing module is further configured to: The processing module is capable of working in a cooperative mode, extracts a target signal from a digitized acquisition signal according to cooperative information related to a user equipment obtained from outside; wherein the cooperative information contains user equipment identification information and related information used to determine uplink signal time-frequency resources.

[0023] The antenna is used to passively receive a radio frequency signal, and the radio frequency signal at least contains an uplink radio frequency signal sent by a user equipment; the radio frequency signal digitization module is connected with the antenna and is used to generate a digitized acquisition signal; the processing module is configured to establish time synchronization between a sniffer device and a time-frequency transmission grid of a mobile communication network, and is capable of extracting a target signal corresponding to a specific user equipment from the digitized acquisition signal according to obtained user equipment identification information on the basis of the time synchronization; and the data interface module is used to send the target signal or measurement information based on the target signal to an external device.

[0024] Preferably, the antenna is an array antenna containing N antenna units, wherein N is an integer greater than 1.

[0025] Preferably, the mobile communication uplink signal sniffer device further comprises one or more radio frequency switches; the radio frequency signal digitization module comprises M radio frequency receiving channels, wherein M is an integer, 2≤M<N, and the M radio frequency receiving channels are configured to be phase-synchronized with each other; the radio frequency switch is connected between the N antenna units and the M radio frequency receiving channels; and the processing module is further configured to control the radio frequency switch to perform time-division acquisition of signals from different antenna units.

[0026] Preferably, when performing time-division switching, the processing module is further configured to: specify at least one of the M radio frequency receiving channels to be fixedly connected to at least one antenna unit in the array antenna as a reference channel; within a preset observation time window used to constitute a single angle of arrival measurement, time-divisionally switch the remaining antenna units to the remaining radio frequency receiving channels through the radio frequency switch as switching channels; perform differential processing on signals of the switching channels and the reference channel, calculate spatial phase information that has eliminated unknown modulation phase, and use the spatial phase information to calculate the angle of arrival.

[0027] Preferably, the observation time window corresponds to an uplink signal transmission period containing a plurality of time domain structure units, and the switching of the radio frequency switch is completed in the gaps between the time domain structure units.

[0028] Preferably, the time domain structure unit is an OFDM (Orthogonal Frequency Division Multiplexing) symbol, and the gap is a CP (Cyclic Prefix) period of the OFDM symbol.

[0029] The processing module establishes the time synchronization by receiving and decoding the downlink broadcast channel signal of the mobile communication network received by the antenna.

[0030] Preferably, the mobile communication uplink signal sniffer device further comprises a dedicated time synchronization hardware unit, and the processing module establishes the time synchronization through the time synchronization hardware unit.

[0031] The third solution of the present application is: A mobile communication uplink signal positioning system comprises at least one mobile communication uplink signal sniffer device and a location processing function entity; the location processing function entity is configured to finally determine the location of the user equipment by processing the data provided by the at least one sniffer device.

[0032] The mobile communication uplink signal positioning system is configured to work in a cooperative mode; the cooperative mode is realized by at least one of the following modes: (1) Network cooperation The location processing function entity is configured to obtain the uplink resource configuration information related to the user equipment from the network equipment of the mobile communication network, and send the uplink resource configuration information to the at least one sniffer device for extracting the target signal. (2) Terminal cooperation The location processing function entity is configured to receive the configuration information containing the identity sent by the user equipment, and send the configuration information to the at least one sniffer device for extracting the target signal.

[0033] Alternatively, the mobile communication uplink signal positioning system is configured to work in an independent mode; wherein the location processing function entity is further configured to deploy a blind search function module for performing blind decoding to establish an active user list, and provide the active user list to the at least one sniffer device to guide the at least one sniffer device to perform correlation verification on the uplink signal.

[0034] After the above technical solution is adopted, the present application has the following technical effects: (1) Advanced architecture and strong scene adaptability The present application provides a platform solution with unified architecture and flexible mode. The solution can provide two working modes of cooperation and independence in a technical framework, breaking the rigid dependence of existing high-precision positioning technology on the cooperation of base stations. This makes the solution not only seamlessly integrated into the cooperative network of operators, but also independently working in the "non-cooperative" environment where the interface is not open or cannot be coordinated, so as to be applicable to any actual deployment scenario, and has essential architectural advantages compared with the single functional point solution of the prior art.

[0035] (2) Significant cost advantage and commercialization potential The cost advantage of the present application is reflected in the system and device two levels. First, at the system level, the present application decouples the positioning sensing function from the base station mainly responsible for communication coverage, and completes the positioning task by deploying an independent sniffer device. This "communication and sensing separation" architecture enables the base station to focus only on optimizing communication coverage, greatly reducing the complexity and cost of network planning and maintenance. Secondly, at the device level, the core "time division switching differential antenna array" scheme of the present application adheres to the design philosophy of "time for space", which cleverly uses a small amount of radio frequency hardware to equivalently achieve the effect of a large-scale virtual antenna array by connecting an array containing N antenna units to M (where M is less than N) radio frequency receiving channels. This directly solves the cost problem of the most expensive multi-channel synchronous radio frequency front end in high-precision AoA positioning technology. The cost advantages of the above two aspects together remove the core obstacles to the large-scale, low-cost commercial deployment of high-precision positioning technology which has been limited by high cost in the past.

[0036] (3) Solution completeness and technical advancement The present application also provides a full-process, end-to-end positioning solution from signal sensing, target identification to position calculation. The solution organically integrates multiple positioning modes (cooperation / independence) and multiple positioning algorithms (TDOA / AOA) in a unified system architecture, which has significant advantages in technical architecture completeness and advancement compared with the scattered and single solutions of the prior art. BRIEF DESCRIPTION OF DRAWINGS

[0037] Figure 1 It is a schematic diagram of the overall architecture of the positioning system of the first embodiment of the present application.

[0038] Figure 2 It is a flowchart of the positioning method of the second embodiment of the present application.

[0039] Figure 3 It is a functional module block diagram of the sniffer device of the fourth embodiment of the present application.

[0040] Figure 4 It is a schematic diagram of the working principle of the time division switching antenna array of the fourth embodiment of the present application.

[0041] BRIEF DESCRIPTION OF DRAWINGS 100 - positioning system; 110 - sniffer device; 120 - positioning server; 130 - communication network; 140 - target user equipment; 150 - base station; 210 - antenna; 211 - radio frequency switch; 220 - radio frequency signal digitization module; 230 - processing module; 240 - data interface module; 250 - time synchronization unit. DETAILED DESCRIPTION

[0042] In order to make the objects, technical solutions and advantages of the present application clearer, the specific embodiments of the present application will be described in detail below with reference to the drawings. It should be noted that the specific embodiments described herein are only some of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by a person of ordinary skill in the art without creative work fall within the scope of protection of the present application.

[0043] It should be noted in advance that the "user equipment identification information" referred to in the present application is a general term and is intended to cover any information that can directly or indirectly point to a specific user equipment. In different embodiments, its specific form is different: in the cooperative working mode, it can be embodied as the combination of the user ID and the uplink resource configuration provided by the network side device; and in the independent working mode, it is preferably embodied as the radio network temporary identifier (RNTI) captured by listening to the downlink channel.

[0044] The first embodiment is as follows: Reference Figure 1 As shown in the figure, the figure shows the overall architecture diagram of the mobile communication uplink signal positioning system 100. The positioning system 100 logically mainly includes one or more sniffer devices 110 deployed in a distributed manner, and a location processing function entity (such as a positioning server 120).

[0045] In addition, the environment in which the positioning system 100 is located also includes user equipment (UE) to be positioned and various functional entities of the mobile communication network. These functional entities include mobile communication network base stations 150, and also include core network functional entities (such as AMF, SMF, NEF, etc.) not explicitly drawn in the figure. In the cooperative working mode, one or more functional entities (such as the positioning server 120) of the positioning system 100 can transmit information with these different functional entities according to the specific cooperative mode: in the network side cooperation, relevant information provided by the base station 150 is obtained, and / or the core network functional entity is interacted to obtain relevant information; in the terminal side cooperation, relevant information actively reported by the user equipment (UE) is received.

[0046] Physically, the sniffer device 110 and the positioning server 120 can be connected through any suitable communication network 130 (e.g. wired Ethernet, fiber, 5G private network, or Wi-Fi, etc.).

[0047] The core task of the sniffer device 110 is to passively listen to and collect mobile communication uplink signals within its coverage. The location processing function entity acts as the central node of the system, responsible for collecting and processing the information reported by one or more sniffer devices 110, and finally using the positioning algorithm to solve the position of the target user equipment (UE) 140. In some lightweight or edge computing deployment scenarios, all or part of the functions of the location processing function entity can also be integrated into a master sniffer device to realize a more integrated system form.

[0048] The second embodiment is as follows: Reference Figure 2 As shown, it shows a mobile communication uplink signal positioning method, which can work in a cooperative working mode, an independent working mode and a hybrid working mode combining the two according to the constraints and available resources of the actual application scenario: 1. Cooperative working mode In this mode, the positioning system 100 interacts and cooperates with the network equipment (such as eNB of 4G network or gNB of 5G network, hereinafter referred to as base station 150) of the mobile communication network, or the user equipment (UE). Its typical working process is as follows: 1.1 Obtain and distribute configuration information In the cooperative working mode, one or more function entities (such as the positioning server 120, or directly the sniffer device 110 itself) of the above-mentioned positioning system 100 obtain the uplink resource configuration information related to the target user equipment 140 from the network equipment (such as the base station 150) of the mobile communication network through a pre-defined interface (such as the E2 interface under the O-RAN architecture, or a private interface of the manufacturer). The information clearly indicates which UE (identified by its C-RNTI or other temporary identifier) will send the uplink signal on which specific time-frequency resource. After obtaining this information, the system ensures that the sniffer device 110 performing the measurement can obtain the configuration information as the basis for its subsequent operation. This information distribution process can be processed and distributed by the positioning server 120, or directly or indirectly obtained by the sniffer device 110 from the network equipment, and the present application is not limited to a specific information distribution path. In an optional cooperative working mode implementation, the above-mentioned user equipment identification information can also be obtained by receiving the information actively sent by the user equipment. This active sending can be completed through various paths, for example: One, through an independent short-range communication channel. A specific application (App) can be run on the user equipment. When the positioning service is needed, the application actively broadcasts or directly sends its own unique identifier, which is pre-allocated by the system, to the nearby sniffer device through an independent short-range communication channel (such as Bluetooth or Wi-Fi). After receiving the identifier, the sniffer device can use it as a target to match and extract the uplink signal.

[0049] Two, through the mobile communication network data service reporting. The application on the user equipment can also send the unique identifier to a designated application server through its own mobile data connection. The application server then informs the positioning server 120 of the present application of the identifier, thereby completing the acquisition of the user equipment identification information.

[0050] It should be emphasized that the above is only one specific example. Any information that can indicate the location of the user equipment and its uplink signal in time, frequency, code, or spatial domain resources should fall within the scope of the "uplink resource configuration information" referred to in the present application.

[0051] 1.2 Directional signal extraction The uplink resource analysis module in the sniffer device 110 performs directional processing on the received uplink radio frequency signal on the specified time-frequency resource based on the acquired resource configuration information to extract the target signal corresponding to the target user equipment 140. This process is a deterministic extraction based on the prior knowledge of the resource configuration information, which is in contrast to the blind processing method that requires a large amount of computational resources for unknown signal search in the independent working mode, thereby significantly improving the efficiency and reliability of target signal extraction. Specifically, in a 5G NR system implementation based on OFDM technology, the typical steps of the above directional signal extraction can include: first, the sniffer device 110 uses its built-in time synchronization module (which can be achieved by listening to the network downlink synchronization signal broadcast SSB, using wired synchronization protocols, or satellite synchronization) to establish a high-precision time synchronization reference with the mobile communication network. Based on this synchronization reference, the sniffer device 110 can determine the accurate reception time boundary of the uplink OFDM symbol. Then, depending on the positioning algorithm supported by the sniffer device, the processing method is also different: 1.2.1 For TDOA positioning scenarios The sniffer device (which can be equipped with only a single antenna at this time) performs a fast Fourier transform (FFT) on the sample data block of the target OFDM symbol in the received single-path signal, converting it into a frequency domain signal; then, the uplink resource analysis module selects the specified set of subcarriers from all the subcarriers according to the obtained PRB allocation information, and takes the data on these subcarriers as the target signal for subsequent time of arrival measurement and other processing.

[0052] 1.2.2 For array antenna scenarios for AoA positioning The sniffer device processes the multiple parallel received signals from its multiple antenna elements separately: performs a fast Fourier transform (FFT) on the sample data block of the same OFDM symbol in each signal, converting it from a time domain signal to multiple parallel frequency domain signals; then, the uplink resource analysis module synchronously selects the set of subcarriers specified by the PRB allocation information from all the subcarriers of each frequency domain signal, and takes the multiple parallel data on the same subcarriers as the target signal for subsequent phase difference calculation and other processing.

[0053] 1.3 Measurement and reporting Then, corresponding measurement processing is performed according to the system configured positioning algorithm. Specifically: 1.3.1 If TDOA positioning is used, multiple sniffer devices 110 measure the time of arrival (ToA) of the same wideband target signal (usually SRS) and report their respective ToA measurement results to the positioning server 120. The server calculates the time difference of arrival according to the ToA reported by different sniffers, and then solves the position of the UE. The above position solving can use any mature TDOA positioning algorithm in the art, such as Chan's algorithm, Taylor series expansion method, etc., which is not specifically limited by the present application.

[0054] 1.3.2 If AoA positioning is used, a single or multiple sniffer devices 110 measure the angle of arrival of the target signal using the array antenna equipped, and report the angle measurement results to the positioning server 120 for final single-angle positioning or multi-angle position estimation by the server. The above position estimation can be achieved by any mature positioning algorithm based on angle information in the art, such as the classic triangulation method or advanced MUSIC, ESPRIT, etc. subspace algorithm, which is also not specifically limited by the present application.

[0055] 2. Independent working mode In this mode, the positioning system 100 achieves the discovery, identification and final positioning of the target user equipment without any prior user equipment resource configuration information from the base station 150, by autonomously parsing the public broadcast channel and uplink control channel of the mobile communication network. The specific workflow includes the following steps: 2.1 Cell search and downlink synchronization The blind search function module in the system (which can be flexibly deployed in the sniffer device 110 or as a logical function on the positioning server 120 side) first performs cell search, i.e. scans and finds the synchronization signal / physical broadcast channel block (SS / PBCH Block) broadcast by the network in the preset frequency band. By successfully decoding the primary synchronization signal (PSS) and secondary synchronization signal (SSS) in the SSB, the module can obtain the physical cell ID (PCI) of the cell and establish accurate time and frequency synchronization with the time-frequency transmission grid of the cell. This step is the basis for all subsequent channel decoding operations. In an alternative embodiment, if the sniffer device 110 is deployed in a fixed environment with known network parameters, some or all of the information required for synchronization such as the PCI can also be pre-configured into the device to speed up the synchronization process. In another alternative embodiment, the sniffer device 110 can directly obtain time synchronization information associated with the time-frequency transmission grid of the cell from the outside, thereby simplifying the process of cell search and downlink synchronization. The present application does not limit the way to obtain this synchronization information, and any method that enables the sniffer to achieve downlink synchronization with the network is applicable to the present application.

[0056] 2.2 Blind decoding of downlink control information (DCI) and RNTI capture After completing the downlink synchronization, the blind search module performs blind decoding on the candidates of the PDCCH in the predetermined "search space" of the PDCCH. The process is as follows: since the cyclic redundancy check (CRC) code of the DCI is scrambled by the radio network temporary identifier (RNTI) corresponding to the target user before transmission, the module uses a list of potential RNTIs (such as all possible C-RNTI values) to try to descramble and CRC check the captured PDCCH candidates one by one. Once a CRC check is successfully passed using a certain RNTI, a successful blind decoding is completed. Through this process, the system can not only capture one or more C-RNTIs of active users in the current cell, but also selectively parse the content (such as uplink grant information) in the DCI. The system establishes and dynamically maintains a list of active C-RNTIs in the region by continuously performing this step. In an alternative embodiment, the list of active C-RNTIs in the region can also be set to all possible values of C-RNTI without blind decoding.

[0057] 2.3 Blind demodulation and association of uplink control channel This step is the core of the association between the user equipment identity and the physical instance of the uplink signal, aiming to establish a unique correspondence between the uplink physical signal and the user equipment to which it belongs. The present invention proposes two alternative technical paths for implementing this association: Path one: association method based on downlink monitoring guidance (preferred implementation) This path is the preferred implementation of the present invention, and its core idea is to use the monitoring results of the downlink control channel (PDCCH) to guide the demodulation of the uplink control channel (PUCCH), achieving efficient association. The basic principle is to use the active C-RNTI list obtained in the previous step by the blind search module to blindly attempt to demodulate the uplink control channel (PUCCH), and determine the ownership by CRC check. In the context of the present invention, "blind operation" specifically refers to the technical means of establishing the correspondence between a specific user equipment and its uplink signal through a trial and systematic search and demodulation process in the absence of prior information provided by the network side that explicitly specifies the correspondence between the two. The innovation of the present invention lies not in simply exhaustively searching the uplink channel without purpose, but in proposing a two-step workflow of "first downlink, then uplink": first, through the monitoring of the downlink common channel, a limited-scale "potential target RNTI list" is efficiently established; then, this list is used as a highly relevant "key set" to guide the subsequent association check of the uplink signal. This method greatly reduces the search space and is the key to achieving efficient and reliable association in non-cooperative scenarios.

[0058] Path two: direct association method In certain specific scenarios, such as when the monitoring of PDCCH is severely interfered or cannot be effectively performed, the present invention also provides a supplementary direct association method. This method does not rely on the RNTI list obtained in step 2.2, but directly descrambles and CRC checks the captured uplink PUCCH candidate signal by systematically traversing all possible RNTI values.

[0059] Specifically, this method will skip or ignore the results of downlink monitoring and directly use a universal set containing all possible C-RNTI values (for example, for 5G NR, C-RNTI is 16 bits, so the traversal range is 1-65535) as a "key set" to attempt descrambling of PUCCH CRC. If a certain RNTI value is used to successfully pass the CRC check, the association between the signal and the user identity is also completed. Although the instantaneous computational complexity of this method is higher than that of path one, it does not depend on the downlink channel quality and provides stronger robustness under certain conditions.

[0060] By providing the above two paths, the independent working mode of the application can flexibly select the most efficient or most reliable way to complete the association of user identity and uplink signal according to the actual channel conditions and system resource constraints, thereby ensuring the universality and robustness of the entire positioning method.

[0061] In a 5G NR system implementation, the applicability of the method is strongly related to the format of PUCCH. According to the 3GPP TS 38.212 standard, only when the number of bits of uplink control information (UCI) is greater than 11 bits, the information block will be accompanied by a 24-bit CRC check code scrambled by C-RNTI. Therefore, the applicable and inapplicable formats are as follows: the inapplicable formats are PUCCH Format 0 and Format 1, which are usually used to carry 1-2 bits of scheduling request (SR) or HARQ-ACK, do not carry CRC, so the blind demodulation method of the application is not applicable to such signals, and its identification depends on the resource scheduling of GNB and cannot be independently sniffed; the preferred applicable formats are PUCCH Format 2, 3 and 4, which are designed to carry multi-bit UCI (such as CSI report or multi-bit HARQ-ACK), and therefore necessarily carry CRC scrambled by C-RNTI, which is the preferred target signal for blind demodulation and association of the application.

[0062] The blind demodulation and association method proposed by the application is based on the establishment of a multi-stage processing procedure that does not depend on prior information from the network side, but only on public standards and the characteristics of the signal itself. A typical implementation step suitable for PUCCH Format 2, 3 and 4 is as follows: 2.3.1 Wideband signal capture and transformation First, the radio frequency front end of the sniffer device 110 captures and digitizes an uplink wideband signal containing the entire or part of the mobile communication channel bandwidth. Then, the processing module performs a fast Fourier transform (FFT) on the digital baseband signal, transforming it from the time domain to the time-frequency two-dimensional resource grid, and subsequent processing is performed on this resource grid. This step clearly defines the technical process of having a global view first and then making a local analysis.

[0063] 2.3.2 DMRS guided candidate PUCCH blind detection This step aims to identify the candidate signal that is most likely to be the target PUCCH from the received wideband signal. This process is not a blind search, but an efficient association detection based on the deterministic structural characteristics of the demodulation reference signal (DMRS): 2.3.2.1 Search space constraint based on common signaling and physical layer specification: This is the first step to achieve efficient blind detection, the core of which is to narrow down the search range as much as possible. This invention mainly uses the following two ways to constrain the search space: (a) Constraint using common broadcast information By decoding the downlink broadcast system information block 1 (SIB1), the sniffer can obtain the common PUCCH resource configuration information of the cell level, that is, the pucch-ConfigCommon signaling. This signaling clearly defines a plurality of common PUCCH resource sets (Resource Set), which contains a set of specific physical resource parameters such as starting physical resource block (PRB), number of continuous OFDM symbols, initial cyclic shift, etc. This provides a high-priority, limited-range initial search target area for the sniffer.

[0064] (b) Constraint using channel structure inherent specification According to the specification of 3GPP TS 38.211, different formats of PUCCH and its DMRS have strict structure constraints in the time domain. For example, for PUCCH Format 3, the position of its DMRS in L transmission symbols is predefined (for example, fixed at the 0th symbol and the floor(L / 2)th symbol). This determined time domain structure feature provides an accurate matching template for subsequent correlation search, so that the sniffer does not need to search in all OFDM symbols, greatly reducing the complexity of detection.

[0065] 2.3.2.2 Generating reference DMRS sequence: According to the standard, the DMRS sequence used by PUCCH is generated based on the base sequence related to the physical cell ID (PCI) of the cell and the cyclic shift (Cyclic Shift) index, and is independent of the user-specific RNTI. Since the sniffer has obtained the PCI in the downlink synchronization step, and can traverse all possible cyclic shifts, it can independently generate all possible DMRS reference sequences as a reference for subsequent correlation matching.

[0066] 2.3.2.3 Perform correlation search: The sniffer performs correlation calculation on the received signal and the locally generated DMRS reference sequence within the time-frequency search space constrained in the above steps. When a significant peak value appears in the correlation calculation result, the time-frequency position and DMRS sequence corresponding to the peak value are jointly marked as a high-probability PUCCH candidate signal.

[0067] 2.3.3 Blind CRC Check with RNTI Association: This step aims to finalize the high-probability candidate signals selected in the previous steps and complete their association with a specific user equipment. For each candidate signal detected by DMRS, the processing module continues to perform channel equalization, symbol demodulation, and channel decoding (such as polar code decoding), outputting the decoded uplink control information (UCI) bit block and its accompanying CRC checksum. Crucially, this CRC is scrambled at the transmitting end by the user's corresponding RNTI. Therefore, the processing module uses the list of active RNTIs previously captured in the downlink PDCCH blind decoding to attempt to descramble the decoded CRC one by one. If a particular RNTI in the list (denoted as RNTI_A) successfully descrambles and passes the CRC check, the final confirmation of the candidate signal and user identity is achieved. This process of locating candidate signals via DMRS and then determining signal attribution through CRC checksum associated with the RNTI is the core technical contribution of this invention's independent operating mode.

[0068] 2.4 Positioning and Tracking After the above binding is completed, the PUCCH signal successfully associated with a specific RNTI_A can serve as the "target signal" for the user equipment, used for subsequent positioning calculations. For example, the PUCCH signal can be used immediately for AoA measurement. Since the PUCCH signal is sent periodically or triggered by events, the system can achieve real-time tracking of the target user equipment by continuously executing the above process. For subsequent AoA positioning processing, the system will use mature positioning algorithms in this field (such as MUSIC, ESPRIT subspace algorithms, or other applicable algorithms) for angle estimation and position calculation. The specific algorithm selection can be flexibly configured according to the accuracy requirements and computational resource constraints of the actual application scenario.

[0069] 3. Switchable working modes The method of the present invention can be flexibly configured, allowing the system to select or switch between the above-mentioned collaborative and independent working modes to adapt to different application scenarios.

[0070] 4. Hybrid working mode In this mode, the system can use macroscopic information obtained from the collaborative working mode (such as the UE's camp cell obtained from the core network and the service type obtained from the terminal) as prior knowledge to significantly reduce the search space and reduce ambiguity in the independent working mode, thereby greatly improving the efficiency and robustness of the positioning process while ensuring high accuracy.

[0071] The third embodiment is as follows: The third embodiment is a low-cost time-division switching differential method supporting AoA positioning. Building upon the first and second embodiments, it further elaborates on how to implement a specific, low-cost, and high-precision angle-of-arrival (AoA) positioning scheme. This scheme is the key technical support for the significant cost advantage and commercialization potential of this invention, especially solving the fundamental technical problem that single-channel time-division switching schemes are difficult to apply directly in non-cooperative scenarios due to the inability to know the phase of the signal source itself (e.g., unknown phase introduced by data modulation).

[0072] 1. General Architecture and Principles This invention proposes a general differential time-division switching architecture, the core idea of ​​which is to use at least one fixed reference channel to calibrate the phase of the signal acquired by the switching channel.

[0073] 1.1 The general hardware configuration is as follows: 1.1.1 Antenna array: An array antenna containing N antenna elements.

[0074] 1.1.2 Receiving Channels: M strictly synchronized radio frequency receiving channels, where 2≤M<N.

[0075] 1.1.3 Channel Connection: At least one antenna element (or a fixed subarray) is fixedly connected to a receiving channel as a reference channel to provide a phase reference; the remaining N-1 (or N-m_ref, where m_ref is the number of reference antennas) antenna elements are connected to the remaining M-1 switching channels through one or more RF switch groups.

[0076] 1.1.4 Control and Synchronization: A controller (such as an FPGA, DSP, or processor) is responsible for precisely controlling the switching timing of the RF switch and ensuring that the switching action is strictly synchronized with the specific time-domain structure of the target uplink signal (e.g., the cyclic prefix (CP) between OFDM symbols). To ensure that the switching operation does not affect the valid data portion of the OFDM symbol, the RF switch should be completed within the cyclic prefix (CP) time window. For example, for a 5G NR signal with a 15kHz subcarrier spacing, its typical CP duration is approximately 4.7 microseconds; therefore, the switching speed of the RF switch should be significantly better than this value, for example, within 2 microseconds.

[0077] 1.2 The general working principle is as follows: 1.2.1 Synchronous Switching Sampling: During the observation of the target signal, the reference channel continuously receives signals from its fixed antenna. Simultaneously, the controller drives the RF switches to enable the M-1 switching channels to scan the remaining N-1 antenna elements in a time-division multiple manner within multiple consecutive time-domain structural units (such as multiple OFDM symbol periods).

[0078] 1.2.2 Differential Information Extraction: The switched channel signal and the reference channel signal acquired at each time step are processed (e.g., FFT), and then differential processing is performed to calculate the relative relationship between the switched channel signal and the reference channel signal. This operation can effectively eliminate the unknown phase term common to all antenna elements (such as data modulation phase) inherent in the signal source itself, retaining only the pure spatial phase difference reflecting the angle of arrival caused by the signal path difference. Specifically, let the frequency domain signal of the reference channel be S_ref(f, t), and the frequency domain signal received by the switched channel connected to the i-th antenna at time t be S_sw_i(f,t). Then, the normalized response can be extracted by calculating the complex ratio R_i(f, t) = S_sw_i(f, t) / S_ref(f, t). Its phase arg[R_i(f, t)] is the pure phase difference between the i-th antenna and the reference antenna.

[0079] 1.2.3 Virtual Array Snapshot Construction: By collecting the clean spatial phase differences of all antenna elements relative to the reference channel, an N-dimensional virtual array snapshot without phase ambiguity can be constructed.

[0080] 1.2.4 Angle of Arrival Estimation: By inputting one or more virtual array snapshots into any high-resolution direction-finding algorithm (such as MUSIC, ESPRIT, etc.), the precise angle of arrival (AoA) of the signal can be calculated.

[0081] 2. Detailed Implementation Scheme of the Third Embodiment The above general architecture is illustrated below using a specific configuration of N=8 and M=2 as an example, but this should not be regarded as a limitation of the present invention.

[0082] 2.1 System Architecture 2.1.1 Antenna Array: An 8-element uniform circular array (UCA) is used, labeled as antennas 1 to 8.

[0083] 2.1.2 Receive Channel: Configure two strictly time-synchronized RF receive channels, labeled as Receiver 1 and Receiver 2.

[0084] 2.1.3 Channel Connection: Reference channel: The output of antenna 1 is fixedly connected to receiver 1.

[0085] Switching channels: The outputs of antennas 2 through 8 are connected to the input of a single-pole seven-throw (SP7T) RF switch, and the common output of the switch is connected to receiver 2.

[0086] 2.2 Workflow Suppose that the sniffer has locked onto a specific time-domain resource of the uplink PUCCH channel of a 5G user equipment and has completed downlink synchronization.

[0087] 2.2.1 Synchronous Handover: A handover scan is performed over a continuous series of OFDM symbols on a PUCCH channel. For example, in the valid portion of the k-th OFDM symbol, receiver 1 samples the signal from antenna 1, and receiver 2 samples the signal from antenna 2. After sampling is complete, within the immediately following cyclic prefix (CP) time window, the controller switches the switch to the next position (antenna 3). This process is repeated in the (k+1)-th OFDM symbol period. This process continues for 7 OFDM symbol periods, completing a full scan of antennas 2 through 8.

[0088] 2.2.2 Signal Processing and Information Extraction: 2.2.2.1 Perform FFT on the two time-domain signals acquired in each symbol period to obtain complex information on all subcarriers f. In a specific OFDM symbol period t, when the switching channel is connected to the i-th antenna (i∈{2,...,8}), we obtain the reference channel signal S_ref(f, t) and the switching channel signal S_sw_i(f, t).

[0089] 2.2.2.2 Subsequent differential processing can be performed only on the specific time-domain symbol t and frequency-domain subcarrier f occupied by the target user.

[0090] 2.2.2.3 On these identified target time-frequency resources, differential processing is performed to calculate the normalized response R_i(f, t) = S_sw_i(f, t) / S_ref(f, t) of the switched i-th antenna relative to the reference antenna. Without loss of generality, we assume that during symbol periods t=1,2…7, the switching channels are connected to the 2nd to 8th antennas respectively, thus obtaining S_ref(f, 1)…S_ref(f, N-1) and S_sw_2(f, 1)…S_sw_8(f, N-1). The calculated R_i(f) = S_sw_i(f, t) / S_ref(f, t), where i=2..8. Its phase arg[R_i(f)] is the pure phase difference. To ensure angle measurement accuracy, the phase consistency between each receiving channel needs to be pre-calibrated. This calibration can be performed by injecting a common-mode calibration signal into the input of each channel and measuring the response of each channel to calculate the calibration coefficient. The residual phase error after calibration should be as small as possible (e.g., better than 1 degree).

[0091] 2.2.3 Constructing a virtual array snapshot: Collect all differential phases calculated within 7 symbol periods, together with the reference channel itself with a phase of 0, to form an 8-dimensional array response vector (snapshot): a(f) = [1, R_2(f), R_3(f), ..., R_8(f)]^T.

[0092] 2.2.4 AoA Estimation: The constructed array snapshot vector (or the covariance matrix composed of multiple snapshots) is input into the MUSIC algorithm, and the precise angle of arrival of the user signal is calculated by searching for the peak of the spatial spectrum.

[0093] The third embodiment cleverly achieves the effect of a large-scale virtual antenna array with a small number of radio frequency channels by "trading time for space" and combining "differential ambiguity elimination" design. This is the key to the present invention in significantly reducing equipment cost and complexity while ensuring high-precision AoA positioning capability.

[0094] The fourth embodiment is as follows: refer to Figure 3 As shown, this illustrates the functional modules of a mobile communication uplink signal sniffer device 110. In its specific implementation, the core technical features of this sniffer device 110 can be summarized into the following aspects: 1. Basic Hardware Architecture The sniffer device 110 includes: (a) At least one antenna 210: for passively receiving uplink radio frequency signals transmitted by user equipment.

[0095] (b) A radio frequency signal digitization module 220: connected to the antenna described above, used to perform filtering, amplification, downconversion and analog-to-digital conversion on the received radio frequency signal to generate a digitized baseband acquisition signal.

[0096] (c) A processing module 230: serving as the control core of the sniffer, typically implemented by an FPGA, DSP, and / or processor. It is configured to establish time-frequency synchronization with the mobile communication network. This processing module includes an uplink resource resolution unit configured to extract the target signal corresponding to a specific user equipment from the digitized baseband acquisition signal, based on the time synchronization and according to the acquired user equipment identification information and relevant information used to determine its uplink signal time-frequency resources.

[0097] (d) A data interface module 240: for transmitting the target signal or measurement information based thereon to an external location processing function entity.

[0098] exist Figure 3To clearly illustrate the time synchronization function, a time synchronization unit 250 is also shown. It should be understood that the function represented by this time synchronization unit 250 can be implemented by software or hardware logic within the processing module 230 (e.g., achieving air interface synchronization by decoding broadcast channel signals received by antenna 210), or it can be implemented by a separate hardware unit connected through an external interface (e.g., a network interface module with clock recovery function, a GNSS or PTP synchronization module). This invention is not limited to its specific implementation.

[0099] 2. Configurable working modes The aforementioned processing module 230 can be configured to one or more of the following working states, depending on the deployment scenario and cost requirements: (a) Cooperative working mode: The device can be configured to work only in cooperative mode, relying entirely on signaling interactions with network functional entities (such as base stations, user equipment, etc.) to obtain the information required for positioning.

[0100] (b) Standalone operating mode: The device can be configured to operate only in standalone mode, independently and without the need for active cooperation from the network side to complete the parsing of key parameters of the user's uplink signal. This mode is suitable for special environments where network coordination is impossible or inconvenient.

[0101] (c) Hybrid working mode: The device can be configured to support both collaborative working mode and independent working mode simultaneously, and can dynamically switch between the two or deeply integrate the information of the two modes according to preset strategies or real-time environmental assessment.

[0102] 3. Core technical features supporting AoA positioning: low-cost time-division switching differential architecture In order to achieve high-precision AoA positioning under strict cost, power consumption and size constraints, the sniffer device 110 of the present invention preferably adopts an innovative "time-division switching differential antenna array" architecture.

[0103] 3.1 Hardware Structure The sniffer device's antenna 210 is an array antenna containing N antenna elements, while its radio frequency signal digitization module 220 is equipped with only M radio frequency receiving channels, where 2 ≤ M < N. Between the antenna elements and the M radio frequency receiving channels, there is also a radio frequency switch 211 controlled by the processing module 230.

[0104] 3.2 Differential Architecture Configuration and Working Principle 3.2.1 Reference Channel: The processing module designates at least one of the M channels and fixes it to at least one antenna element in the array antenna as a reference channel to provide a stable phase reference for the entire array.

[0105] 3.2.2 Switching Channels: The remaining antenna units are connected to the remaining radio frequency receiving channels via time-division switching of RF switch 211.

[0106] 3.2.3 Synchronization and Control: The processing module 230 precisely controls the switching timing of the RF switch 211 to keep it synchronized with the specific time-domain structure (e.g., OFDM symbol) of the target uplink signal.

[0107] 3.2.4 Differential processing and solution: The processing module processes signals from the reference channel and the switching channel in parallel, eliminates unknown data modulation phase through complex number operations, retains only the pure spatial phase difference, and uses it to construct a virtual array snapshot, and finally solves the accurate angle of arrival.

[0108] 3.3 A specific preferred implementation scheme refer to Figure 4 As shown, it schematically depicts the core working principle of the fourth embodiment. The following example uses an N=8, M=2 configuration: antenna 1 is fixedly connected to receiver 1 (reference), and antennas 2 through 8 are connected to receiver 2 via a switch (switching). The controller switches within the CP window of multiple consecutive OFDM symbols of the PUCCH signal, acquiring signals from all 8 antennas. After differential processing, an unambiguous 8D array snapshot is obtained, which is then input into the MUSIC algorithm to obtain a high-precision AoA result.

[0109] Through the above multi-level embodiments, the present invention provides a new generation of mobile communication uplink signal positioning solution that is fully functional, high-performance, cost-controllable, and flexible in deployment, and can effectively overcome many limitations of the prior art.

[0110] Other technical considerations are as follows: To further enhance the integrity and robustness of the technical solution of this invention, those skilled in the art can make the following extensions or optimizations based on the core ideas of this invention: Anomaly Handling Mechanism – In independent operating mode, if the blind search function module fails to decode any PDCCH or associate any PUCCH within a preset time window, the system can be configured to enter a short sleep-wake cycle to reduce power consumption, or automatically switch to other preset backup frequency bands for scanning, thereby improving the system's adaptability in complex electromagnetic environments.

[0111] Multi-user and interference scenarios – In scenarios with a large number of users, signals from multiple users may be received on the same time-frequency resources. If the orthogonal codes of users sharing the time-frequency resources are unknown, the preliminary AoA estimation results obtained by this invention can be used in conjunction with spatial filtering techniques such as beamforming to separate and suppress signals from different directions. Then, more refined parameter estimation and correlation verification can be performed on the separated target signals to obtain multi-user positioning measurements.

Claims

1. A mobile communication uplink signal positioning method, characterized by Comprising the following steps: Step S1. Receiving radio frequency signals Passively receiving radio frequency signals in a mobile communication network through at least one sniffer device equipped with an antenna, the radio frequency signals at least including uplink radio frequency signals sent by user equipment; Step S2. Obtaining user equipment identification information and related information for determining uplink signal time-frequency resources The method for obtaining user equipment identification information comprises: (1) Independent mode Performing a workflow that does not require active cooperation of network equipment to obtain uplink resource configuration information related to the user equipment; (2) Cooperative mode Receiving uplink resource configuration information related to the user equipment from an external source, which contains user equipment identification information and related information for determining uplink signal time-frequency resources of the user equipment; Step S3. Extracting target signals An uplink resource analysis module in the sniffer device extracts target signals corresponding to the user equipment from the uplink radio frequency signals based on the user equipment identification information and related information for determining uplink signal time-frequency resources obtained in step S2 through analysis and processing of the uplink radio frequency signals; Step S4. Positioning A positioning server or a positioning function module integrated in the sniffer device calculates the position of the user equipment using a positioning algorithm based on the target signals extracted by one or more sniffer devices.

2. The mobile communication uplink signal positioning method of claim 1, wherein, The workflow of the independent mode in step S2 comprises: Step S2.

1. Establishing a list of candidate radio network temporary identifiers in one of the following ways: (1) Listening to the downlink control channel of the mobile communication network, performing blind decoding on one or more captured downlink control channel candidates, and establishing an active user list containing one or more radio network temporary identifiers; (2) Using a pre-set set containing all or part of possible radio network temporary identifiers as an active user list; Step S2.

2. Using the active user list to perform association verification on one or more candidate signals in the captured uplink radio frequency signals. When the verification is successfully completed using a certain radio network temporary identifier in the list, the corresponding relationship between the radio network temporary identifier and the specific candidate signal is confirmed, and the radio network temporary identifier is used as the identification information of the user equipment. At the same time, the corresponding relationship itself or the time-frequency resources determined based on the corresponding relationship are used as the related information for determining the uplink signal time-frequency resources.

3. The mobile communication uplink signal positioning method of claim 1, wherein, The uplink resource analysis module confirms the correct correspondence between the extracted target signal and the user equipment by performing the following verification operations: (1) Association verification based on demodulation reference signals Correlation comparison is performed between the received uplink radio frequency signals and one or more candidate DMRS sequences generated based on candidate user equipment identification information. When the result of the correlation comparison exceeds a pre-set threshold, the association between the target signal and the specific user equipment is preliminarily confirmed; (2) Ownership confirmation based on cyclic redundancy check Based on the user equipment identification information, perform CRC on the data transmission block associated with the target signal. When the verification is successful, it is finally confirmed that the target signal belongs to the user equipment.

4. The mobile communication uplink signal positioning method of claim 1, wherein, The uplink resource analysis module is configured to: (1) Determine the bandwidth In a predetermined range of the received bandwidth, according to the relevant information for determining the uplink signal time-frequency resource of the user equipment obtained in step S2, or by analyzing the energy spectrum of the uplink radio frequency signal, a target sub-band containing the target signal is determined, and the bandwidth of the target sub-band is less than the received bandwidth; (2) Analysis and processing Only the signal in the target sub-band is executed for subsequent analysis and processing.

5. The mobile communication uplink signal positioning method according to any one of claims 1 to 4, characterized in that: The positioning method is configured to be able to select and switch between a cooperative working mode, an independent working mode and a hybrid working mode; wherein the cooperative working mode corresponds to the cooperative mode in step S2, the independent working mode corresponds to the independent mode in step S2, and the hybrid working mode is the fusion operation of the cooperative working mode and the independent working mode.

6. The mobile communication uplink signal positioning method of claim 5, wherein, Further comprising: Using a sniffer device equipped with an array antenna, the position information of the user equipment is calculated by jointly processing the multiple signals received from multiple antenna elements of the array antenna.

7. The mobile communication uplink signal positioning method of claim 6, wherein, The way of jointly processing multiple signals received from multiple antenna elements is: The joint processing includes using the array antenna to calculate the angle of arrival of the user equipment relative to the sniffer device by analyzing the spatial relationship between the multiple signals received from multiple antenna elements.

8. The mobile communication uplink signal positioning method according to claim 7, characterized in that: The array antenna is a time-division switching antenna array, at least one antenna element in the array antenna is used as a reference channel providing a phase reference, the remaining antenna elements are switched to one or more switching channels in time, and the spatial phase information without unknown modulation phase is obtained by differentially processing the signals of the switching channels and the reference channel, and is used to calculate the angle of arrival.

9. A mobile communication uplink signal sniffer device, comprising at least one antenna, a radio frequency signal digitizing module, a processing module, and a data interface module; characterized in that, The processing module is configured to: be able to work in an independent working mode, and be used for executing the mobile communication uplink signal positioning method according to claims 1 to 8, and autonomously extracting the target signal from the digitized acquisition signal.

10. The mobile communication uplink signal sniffer apparatus of claim 9, wherein, The processing module is further configured to: be able to work in a cooperative working mode, and the processing module extracts the target signal from the digitized acquisition signal according to the cooperative information related to the user equipment obtained from the outside; wherein the cooperative information includes user equipment identification information and relevant information for determining the uplink signal time-frequency resource of the user equipment.

11. The mobile communication uplink signal sniffer device according to claim 9 or 10, characterized in that The antenna is used to passively receive radio frequency signals, and the radio frequency signals at least include uplink radio frequency signals sent by the user equipment; The radio frequency signal digitization module is connected with the antenna, and is used to generate a digitized acquisition signal; The processing module is configured to establish time synchronization between the sniffer device and the time-frequency transmission grid of the mobile communication network, and is able to extract the target signal corresponding to a specific user equipment from the digitized acquisition signal according to the obtained user equipment identification information on the basis of the time synchronization; The data interface module is configured to send the target signal or measurement information based on the target signal to an external device.

12. The mobile communication uplink signal sniffer device of claim 11, wherein: The antenna is an array antenna comprising N antenna elements, where N is an integer greater than 1.

13. The mobile communication uplink signal sniffer device of claim 12, wherein: Further comprising one or more radio frequency switches; The radio frequency signal digitization module comprises M radio frequency receiving channels, where M is an integer and 2≤M 14. The mobile communication uplink signal sniffer apparatus of claim 13, wherein The processing module, when performing time division switching, is further configured to: specify at least one of the M radio frequency receiving channels to be fixedly connected to at least one antenna element in the array antenna as a reference channel; within a preset observation time window for constructing a single angle of arrival measurement, switch the remaining antenna elements through the radio frequency switches to be connected to the remaining radio frequency receiving channels as switching channels in time division; perform differential processing on the signals of the switching channels and the reference channel, calculate spatial phase information that has eliminated unknown modulation phase, and use the spatial phase information to calculate the angle of arrival.

15. The mobile communication uplink signal sniffer device of claim 14, wherein: The observation time window corresponds to an uplink signal transmission period comprising a plurality of time domain structure units, and the switching of the radio frequency switches is completed in the gaps between the time domain structure units.

16. The mobile communication uplink signal sniffer device of claim 15, wherein: The time domain structure unit is an OFDM symbol, and the gap is a cyclic prefix period of the OFDM symbol.

17. The mobile communication uplink signal sniffer device of claim 11, wherein: The processing module establishes the time synchronization by receiving and decoding downlink broadcast channel signals of the mobile communication network received by the antenna.

18. The mobile communication uplink signal sniffer device of claim 11, wherein: Further comprising a dedicated time synchronization hardware unit, and the processing module establishes the time synchronization through the time synchronization hardware unit.

19. A mobile communication uplink signal positioning system, characterized by comprises at least one mobile communication uplink signal sniffer device as claimed in any one of claims 9 to 18, and a location processing function entity; the location processing function entity is configured to finally determine the location of the user equipment by processing data provided by the at least one sniffer device.

20. A mobile communications uplink signal positioning system as claimed in claim 19, characterized in that is configured to work in a cooperative working mode; the cooperative working mode is realized by at least one of the following ways: (1) network cooperation The position processing function entity is configured to acquire uplink resource configuration information related to the user equipment from a network device of a mobile communication network and send it to at least one sniffer device for extracting a target signal; (2) terminal cooperation The position processing function entity is configured to receive configuration information containing an identity sent actively by the user equipment and send it to at least one sniffer device for extracting a target signal.

21. The mobile communication uplink signal positioning system of claim 19, characterized in that: The position processing function entity is configured to work in an independent working mode; wherein the position processing function entity is further configured to be deployed with a blind search function module for performing blind decoding to establish an active user list, and provide the active user list to at least one sniffer device to guide it to perform correlation checking on the uplink signal.

Images