Security vulnerability detection and prevention for wireless positioning

Abstract

A first user equipment (UE) may transmit a first ranging message. The second UE may receive a first ranging message. The second UE may calculate a carrier frequency offset (CFO) based on the ranging message. The second UE may transmit a response message including control information for modifying the transmission protocol. The transmission of the response message may be responsive to the calculated CFO being greater than or equal to a threshold. The calculated CFO may indicate a possible security vulnerability between the first UE and the second UE. The first UE may receive, after transmission of the first ranging message, a response message including control information for modifying the transmission protocol. The first UE may then transmit a second ranging message based on the control information. The second ranging message may prevent or mitigate the detected possible security vulnerabilities.

Description

[0001] Cross-reference to related applications

[0002] This application claims the benefit of U.S. Non-Provisional Patent Application Serial No. 18 / 492,711, filed on October 23, 2023, entitled "SECURITY VULNERABILITY DETECTION AND PREVENTION FORWIRELESS POSITIONING", the entire contents of which are expressly incorporated herein by reference. Technical Field

[0003] This disclosure relates generally to communication systems, and more specifically to wireless positioning systems. Background Technology

[0004] Wireless communication systems are widely deployed to provide a variety of telecommunications services, such as telephone, video, data, messaging, and broadcasting. Typical wireless communication systems may employ multiple access technologies capable of supporting communication with multiple users by sharing available system resources. Examples of such multiple access technologies include Code Division Multiple Access (CDMA) systems, Time Division Multiple Access (TDMA) systems, Frequency Division Multiple Access (FDMA) systems, Orthogonal Frequency Division Multiple Access (OFDMA) systems, Single Carrier Frequency Division Multiple Access (SC-FDMA) systems, and Time Division Synchronous Code Division Multiple Access (TD-SCDMA) systems.

[0005] These multiple access technologies have been adopted in various telecommunications standards to provide a common protocol that enables different wireless devices to communicate at the city, national, regional, and even global levels. An example telecommunications standard is 5G New Radio (NR). 5G NR is part of the Continuous Evolution of Mobile Broadband (CEM) program issued by the 3rd Generation Partnership Project (3GPP) to meet new requirements associated with latency, reliability, security, scalability (e.g., with the Internet of Things (IoT),) and other requirements. 5G NR includes services associated with enhanced mobile broadband (eMBB), massive machine-type communications (mMTC), and ultra-reliable low-latency communications (URLLC). Some aspects of 5G NR can be based on the 4G Long Term Evolution (LTE) standard. Further improvements to 5G NR technology are needed. Furthermore, these improvements can also be applied to other multiple access technologies and telecommunications standards that adopt these technologies. Summary of the Invention

[0006] The following is a simplified summary of one or more aspects to provide a basic understanding of these aspects. This summary is not a comprehensive overview of all conceived aspects. It neither identifies key or essential elements of all aspects nor describes the scope of any or all aspects. Its sole purpose is to present some concepts of one or more aspects in a simplified form as a prelude to the more detailed descriptions that follow.

[0007] In one aspect of this disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus may include user equipment (UE). The apparatus may receive ranging messages. The apparatus may calculate a carrier frequency offset (CFO) based on the ranging messages. The apparatus may send a response message including control information for modifying a transmission protocol. The transmission of the response message may be in response to the calculated CFO being greater than or equal to a threshold.

[0008] In one aspect of this disclosure, a method, a computer-readable medium, and an apparatus are provided. The apparatus may include a UE. The apparatus may transmit a first ranging message. The apparatus may receive a response message including control information for modifying a transmission protocol after the transmission of the first ranging message. The apparatus may transmit a second ranging message based on the control information.

[0009] To achieve the foregoing and related objectives, one or more aspects may include the features fully described below and specifically pointed out in the claims. The following description and drawings set forth some exemplary features of one or more aspects in detail. However, these features indicate only a few of the various ways in which the principles of the various aspects may be employed. Attached Figure Description

[0010] Figure 1 This is a diagram illustrating an example of a wireless communication system and an access network.

[0011] Figure 2A This is an illustration of an example of the first frame according to various aspects of this disclosure.

[0012] Figure 2B This is a diagram illustrating examples of downlink (DL) channels within a subframe according to various aspects of this disclosure.

[0013] Figure 2C This is an illustration of an example of a second frame according to various aspects of this disclosure.

[0014] Figure 2D This is a diagram illustrating examples of uplink (UL) channels within a subframe according to various aspects of this disclosure.

[0015] Figure 3 This is a diagram illustrating examples of base stations and user equipment (UEs) in an access network.

[0016] Figure 4 This is a diagram illustrating an example of positioning based on positioning signal measurements.

[0017] Figure 5A This is a connection flowchart illustrating an example of ranging signals exchanged between positioning wireless devices.

[0018] Figure 5B This is a connection flowchart illustrating an example of ranging signals exchanged between positioning wireless devices.

[0019] Figure 6A This is a diagram illustrating an example of a ranging session between wireless devices.

[0020] Figure 6B This is an example Figure 6A An example diagram of the distance measurement cycle.

[0021] Figure 7 Includes illustrations of example group configurations used for ranging.

[0022] Figure 8 The diagram includes exemplary components illustrating a method for generating secure pseudo-random numbers.

[0023] Figure 9A This is an illustration illustrating an example of a counterfeiter mimicking a first wireless device sending a ranging signal to a second wireless device.

[0024] Figure 9B This is an example of... Figure 9A A diagram illustrating an example of the timing of packets sent by a first wireless device and an impersonator and received by a second wireless device.

[0025] Figure 10 This is a diagram illustrating examples of timing for valid and spoofed ranging signals.

[0026] Figure 11A This is a diagram illustrating an example of a set of ranging signals used for positioning between wireless devices.

[0027] Figure 11B This is a diagram illustrating an example of a set of ranging signals used for positioning between wireless devices.

[0028] Figure 12 This is a diagram illustrating an example of the timing of packets sent and received during a ranging session between wireless devices in a spoofing scenario.

[0029] Figure 13 This is a diagram illustrating an example of the timing of packets sent and received during a ranging session between wireless devices in a spoofing scenario.

[0030] Figure 14This is a connection flow diagram illustrating an example of a wireless device configured to detect and prevent security vulnerabilities related to wireless location.

[0031] Figure 15 This is a connection flow diagram illustrating an example of a wireless device configured to detect and prevent security vulnerabilities related to wireless location.

[0032] Figure 16 This is a flowchart of a wireless communication method.

[0033] Figure 17 This is a flowchart of a wireless communication method.

[0034] Figure 18 This is a flowchart of a wireless communication method.

[0035] Figure 19 This is a flowchart of a wireless communication method.

[0036] Figure 20 This is a flowchart of a wireless communication method.

[0037] Figure 21 This is a flowchart of a wireless communication method.

[0038] Figure 22 These are illustrations illustrating specific hardware implementations used for example devices and / or network entities. Detailed Implementation

[0039] The following description relates to examples intended to illustrate the innovative aspects of this disclosure. However, those skilled in the art will recognize that the teachings herein can be applied in numerous ways. Some or all of the examples described can be implemented in any device, system, or network capable of transmitting and receiving radio frequency (RF) signals according to one or more of the following: the Institute of Electrical and Electronics Engineers (IEEE) 1402.11 standard, the IEEE 1402.15 standard, Bluetooth as defined by the Bluetooth Special Interest Group (SIG). ®The standards, or Long Term Evolution (LTE), 3G, 4G, or 5G (New Radio (NR)) standards published by the 3rd Generation Partnership Project (3GPP), etc. The described examples can be implemented in any device, system, or network capable of transmitting and receiving RF signals according to one or more of the following technologies or techniques: Code Division Multiple Access (CDMA), Time Division Multiple Access (TDMA), Frequency Division Multiple Access (FDMA), Orthogonal FDMA (OFDMA), Single Carrier FDMA (SC-FDMA), Space Division Multiple Access (SDMA), Rate Split Multiple Access (RSMA), Multi-User Shared Access (MUSA), Single-User (SU) Multiple-Input Multiple-Output (MIMO), and Multi-User (MU)-MIMO. The described examples can also be implemented using other wireless communication protocols or RF signals suitable for use in one or more of the following networks: Wireless Personal Area Network (WPAN), Wireless Local Area Network (WLAN), Wireless Wide Area Network (WWAN), Wireless Metropolitan Area Network (WMAN), or Internet of Things (IoT) networks.

[0040] Various aspects are involved in wireless positioning systems as a whole. Some aspects are more specifically related to detecting and mitigating security vulnerabilities between ranging devices in wireless positioning systems. In some examples, a first user equipment (UE) may send a first ranging message. A second UE may receive the first ranging message. The second UE may calculate a carrier frequency offset (CFO) based on the ranging message. The second UE may send a response message including control information for modifying the transmission protocol. The transmission of the response message may be in response to the calculated CFO being greater than or equal to a threshold. The calculated CFO may indicate a potential security vulnerability between the first UE and the second UE. The first UE may receive the response message including control information for modifying the transmission protocol after the transmission of the first ranging message. The first UE may then send a second ranging message based on the control information. The second ranging message can prevent or mitigate the detected potential security vulnerability by modifying which ranging messages the second UE processes based on the control information.

[0041] In some aspects, control messages can mitigate security vulnerabilities related to mixing (MD) manipulation between wireless devices performing positioning or ranging. In some aspects, a first UE (e.g., an initiator) can estimate the clock frequency offset (CFO) of ranging messages (e.g., a ranging initiation message (RIM), a ranging response message (RRM)) and observe when the CFO may be greater than or equal to a threshold. The first UE can respond to this observation by transmitting a response message (e.g., a ranging control update message (RCUM)) to a second UE (e.g., a responder). The response message may include one or more frequency offsets. The frequency offset may include a different frequency offset associated with each preamble symbol in the preamble symbol set. The second UE may (a) transmit the ranging message (e.g., the RRM) at the frequency offset included in the response message, and (b) transmit the ranging message at a different frequency offset for each preamble symbol in the ranging message. In some aspects, the first UE can use a threshold to discard, ignore, and / or skip a portion of a preamble with a CFO greater than or equal to the threshold. In other words, the first UE can assume that such preambles are subject to spoofing stretching and advance (SA) manipulation. In some respects, the UE (e.g., the responder, the initiator) can estimate the CFO based on narrowband (NB) packets and determine when the CFO is greater than or equal to a threshold. The UE determining when the CFO is greater than or equal to the threshold can send an indicator (e.g., a control message) with additional control information to the entity sending the ranging message, which can be used to modify one or more upcoming transmissions. This entity can send a synchronization portion (SYNC) of the packet, which has a different code index for each subset of one or more corresponding preamble symbols. Code index information can be included in the additional control information.

[0042] Specific aspects of the subject matter described in this disclosure can be implemented to achieve one or more of the following potential advantages. In some examples, by monitoring when the CFO of a ranging message is greater than or equal to a threshold, the described techniques can be used to indicate to the transmitting device when a security vulnerability has been detected (e.g., MD manipulation for single-sided (SS) two-way ranging (SS-TWR) or SA manipulation for narrowband-assisted (NBA) multi-millisecond (NBA-MMS) ranging). The indicator may include control information, such as an RCUM that includes control information. The transmitting device can then use the control information to modify the transmission of one or more future ranging messages to minimize the impact of the detected security vulnerability.

[0043] The detailed descriptions following, illustrated with reference to the accompanying drawings, describe various configurations and do not represent the only configurations in which the concepts described herein can be practiced. To provide a thorough understanding of the various concepts, the detailed descriptions include specific details. However, these concepts can be practiced without these specific details. In some instances, well-known structures and components are shown in block diagram form to avoid obscuring these concepts.

[0044] Various apparatuses and methods are presented with reference to several aspects of a telecommunications system. These apparatuses and methods are described in detail below and illustrated in the accompanying drawings by various blocks, components, circuits, processes, algorithms, etc. (collectively, “elements”). These elements can be implemented using electronic hardware, computer software, or any combination thereof. Whether such elements are implemented as hardware or software depends on the specific application and the design constraints imposed on the system as a whole.

[0045] As an example, an element, any part of an element, or any combination of elements may be implemented as a "processing system" including one or more processors. When multiple processors are implemented, the multiple processors may perform functions individually or in combination. Examples of processors include microprocessors, microcontrollers, graphics processing units (GPUs), central processing units (CPUs), application processors, digital signal processors (DSPs), reduced instruction set computing (RISC) processors, system-on-a-chip (SoCs), baseband processors, field-programmable gate arrays (FPGAs), programmable logic devices (PLDs), state machines, gate logic, discrete hardware circuits, and other suitable hardware configured to perform the various functionalities described throughout this disclosure. One or more processors in a processing system may execute software. Whether referred to as software, firmware, middleware, microcode, hardware description language, or other terms, software should be broadly interpreted as instructions, instruction sets, code, code segments, program code, programs, subroutines, software components, applications, software applications, software packages, routines, subroutines, objects, executable files, threads of execution, procedures, functions, or any combination thereof.

[0046] Therefore, in one or more example aspects, specific implementations, and / or use cases, the described functionality may be implemented in hardware, software, or any combination thereof. If implemented in software, the functionality may be stored or encoded as one or more instructions or code on a computer-readable medium. Computer-readable media include computer storage media. Storage media can be any available medium that can be accessed by a computer. By way of example, such computer-readable media may include random access memory (RAM), read-only memory (ROM), electrically erasable programmable ROM (EEPROM), optical disc storage devices, magnetic disk storage devices, other magnetic storage devices, combinations of these types of computer-readable media, or any other medium that can be used to store computer-executable code in the form of instructions or data structures accessible by a computer.

[0047] While aspects, implementations, and / or use cases are described herein by way of example, additional or different aspects, implementations, and / or use cases may arise in many different arrangements and scenarios. The aspects, implementations, and / or use cases described herein can be implemented across many different platform types, devices, systems, shapes, sizes, and package arrangements. For example, aspects, implementations, and / or use cases may arise via integrated chip implementations and other devices based on non-modular components (e.g., end-user devices, vehicles, communication devices, computing devices, industrial equipment, retail / purchasing devices, medical devices, AI-enabled devices, etc.). While some examples may or may not be specific to a use case or application, the described examples may exhibit broad applicability. Aspects, implementations, and / or use cases can range from chip-level or modular components to non-modular, non-chip-level implementations, and further to aggregated, distributed, or original equipment manufacturer (OEM) devices or systems incorporating one or more of the technologies described herein. In some practical settings, devices incorporating the described aspects and features may also include additional components and features for implementing and practicing the claimed and described aspects. For example, the transmission and reception of wireless signals necessarily involve multiple components for analog and digital purposes (e.g., hardware components including antennas, RF chains, power amplifiers, modulators, buffers, processors, interleavers, adders / summers, etc.). The techniques described herein can be practiced in a wide variety of devices, chip-level components, systems, distributed arrangements, aggregated or decomposed components, end-user equipment, etc., of various sizes, shapes, and configurations.

[0048] Communication systems, such as 5G NR systems, can be deployed in various ways with a variety of components or parts. In a 5G NR system or network, network nodes, network entities, network mobility elements, radio access network (RAN) nodes, core network nodes, network elements or network equipment (such as base stations (BS)) or one or more units (or components) performing base station functions can be implemented in aggregated or decomposed architectures. For example, BSs (such as Node B (NB), evolved NB (eNB), NR BS, 5G NB, access point (AP), transmit / receive point (TRP), or cell, etc.) can be implemented as aggregated base stations (also known as standalone BS or monolithic BS) or decomposed base stations.

[0049] Aggregated base stations can be configured to utilize a radio protocol stack that is physically or logically integrated within a single RAN node. Decentralized base stations can be configured to utilize a protocol stack that is physically or logically distributed across two or more units, such as one or more central or centralized units (CUs), one or more distributed units (DUs), or one or more radio units (RUs). In some respects, the CU may be implemented within a RAN node, and one or more DUs may co-located with the CU, or alternatively, may be geographically or virtually distributed across one or more other RAN nodes. DUs may be implemented to communicate with one or more RUs. Each of the CUs, DUs, and RUs may be implemented as a virtual unit, namely a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU).

[0050] Base station operation or network design can take into account the aggregation characteristics of base station functionality. For example, decomposed base stations can be utilized in Integrated Access Backhaul (IAB) networks, Open Radio Access Networks (O-RAN (such as network configurations initiated by the O-RAN Alliance)), or Virtualized Radio Access Networks (vRAN, also known as Cloud Radio Access Networks (C-RAN)). Decomposition can include distributing functionality across two or more units in various physical locations, as well as virtually distributing the functionality of at least one unit, which enables flexibility in network design. The various units of a decomposed base station or decomposed RAN architecture can be configured to communicate wirelessly with at least one other unit.

[0051] Figure 1Figure 100 illustrates an example of a wireless communication system and access network. The illustrated wireless communication system includes a decomposed base station architecture. The decomposed base station architecture may include one or more CUs 110, which may communicate directly with the core network 120 via a backhaul link, or indirectly with the core network 120 via one or more decomposed base station units, such as a near real-time (near-RT) RAN Intelligent Controller (RIC) 125 via an E2 link, or a non-real-time (non-RT) RIC 115 associated with a Service Management and Orchestration (SMO) framework 105, or both. CUs 110 may communicate with one or more DUs 130 via a corresponding midhaul link (such as an F1 interface). DUs 130 may communicate with one or more RUs 140 via a corresponding fronthaul link. RUs 140 may communicate with a corresponding UE 104 via one or more radio frequency (RF) access links. In some implementations, a UE 104 may be served simultaneously by multiple RUs 140.

[0052] Each of the units (i.e., CU 110, DU 130, RU 140, and near-RT RIC 125, non-RT RIC 115, and SMO frame 105) may include or be coupled to one or more interfaces configured to receive or transmit signals, data, or information (collectively, signals) via wired or wireless transmission media. Each of the units, or an associated processor or controller providing instructions to the communication interfaces of these units, may be configured to communicate with one or more other units via transmission media. For example, these units may include wired interfaces configured to receive signals via wired transmission media or transmit signals to one or more other units. Additionally, these units may include wireless interfaces that may include receivers, transmitters, or transceivers (such as RF transceivers) configured to receive signals via wireless transmission media or transmit signals to one or more other units, or both.

[0053] In some aspects, the CU 110 can host one or more higher-level control functions. Such control functions may include Radio Resource Control (RRC), Packet Data Convergence Protocol (PDCP), Serving Data Adaptation Protocol (SDAP), etc. Each control function can be implemented using an interface configured to signal to other control functions hosted by the CU 110. The CU 110 can be configured to handle user plane functionality (i.e., Central Unit-User Plane (CU-UP)), control plane functionality (i.e., Central Unit-Control Plane (CU-CP)), or a combination thereof. In some implementations, the CU 110 can be logically split into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RAN configuration, the CU-UP units can communicate bidirectionally with the CU-CP units via an interface such as an E1 interface. The CU 110 can be implemented to communicate with the DU 130 for network control and signaling, as needed.

[0054] DU 130 may correspond to a logic unit that includes one or more base station functions for controlling the operation of one or more RU 140s. In some aspects, DU 130 may at least partially host one or more of the Radio Link Control (RLC) layer, Media Access Control (MAC) layer, and one or more high physical (PHY) layers (such as modules for forward error correction (FEC) encoding and decoding, scrambling, modulation, demodulation, etc.) according to functional splits (such as those defined by 3GPP). In some aspects, DU 130 may also host one or more low PHY layers. Each layer (or module) may be implemented using an interface configured to communicate signals with other layers (and modules) hosted by DU 130 or with control functions hosted by CU 110.

[0055] Lower-layer functionality can be implemented by one or more RU 140s. In some deployments, an RU140 controlled by a DU 130 may correspond to a logical node that hosts RF processing functions or low-PHY layer functions (such as performing Fast Fourier Transform (FFT), Inverse FFT (iFFT), digital beamforming, Physical Random Access Channel (PRACH) extraction and filtering, or both, based at least in part on functional decomposition (such as lower-layer functional decomposition). In such architectures, the RU 140 may be implemented to handle over-the-air (OTA) communications with one or more UEs 104. In some specific implementations, the real-time and non-real-time aspects of control plane and user plane communications with the RU 140 may be controlled by the corresponding DU 130. In some scenarios, this configuration enables the implementation of the DU 130 and CU 110 in cloud-based RAN architectures such as vRAN architectures.

[0056] SMO framework 105 can be configured to support RAN deployment and provisioning of both non-virtualized and virtualized network elements. For non-virtualized network elements, SMO framework 105 can be configured to support the deployment of dedicated physical resources for RAN coverage requirements, which can be managed via operation and maintenance interfaces such as the O1 interface. For virtualized network elements, SMO framework 105 can be configured to interact with a cloud computing platform such as Open Cloud (O-Cloud) 190 to perform network element lifecycle management (such as instantiating virtualized network elements) via a cloud computing platform interface such as the O2 interface. Such virtualized network elements may include, but are not limited to, CU 110, DU 130, RU 140, and near-RT RIC 125. In some implementations, SMO framework 105 can communicate with hardware aspects of the 4G RAN, such as Open eNB (O-eNB) 111, via the O1 interface. Additionally, in some implementations, SMO framework 105 can communicate directly with one or more RU 140s via the O1 interface. SMO framework 105 may also include a non-RT RIC 115 configured to support the functionality of SMO framework 105.

[0057] The non-RT RIC 115 can be configured to include logical functions enabling non-real-time control and optimization of RAN elements and resources, including artificial intelligence (AI) / machine learning (ML) workflows for model training and updates, or policy-based guidance for applications / features in the near-RT RIC 125. The non-RT RIC 115 can be coupled to or communicate with the near-RT RIC 125, such as via an A1 interface. The near-RT RIC 125 can be configured to include logical functions enabling near real-time control and optimization of RAN elements and resources via data collection and actions through an interface such as an E2 interface, connecting one or more CU 110s, one or more DU 130s, or both, and O-eNBs to the near-RT RIC 125.

[0058] In some implementations, to generate AI / ML models to be deployed in the near-RT RIC 125, the non-RT RIC 115 may receive parameters or external enrichment information from an external server. This information can be utilized by the near-RT RIC 125 and can be received from non-network data sources or network functions at the SMO framework 105 or the non-RT RIC 115. In some examples, the non-RT RIC 115 or the near-RT RIC 125 may be configured to tune RAN behavior or performance. For example, the non-RT RIC 115 may monitor long-term trends and patterns in performance and use AI / ML models to perform corrective actions via the SMO framework 105 (such as reconfiguration via O1) or by creating RAN management policies (such as A1 policies).

[0059] At least one of CU 110, DU 130, and RU 140 may be referred to as base station 102. Therefore, base station 102 may include one or more of CU 110, DU 130, and RU 140 (each component is indicated by a dashed line to indicate that each component may or may not be included in base station 102). Base station 102 provides UE 104 with an access point to core network 120. Base station 102 may include macro cells (high-power cellular base stations) and / or small cells (low-power cellular base stations). Small cells include femtocells, picocells, and microcells. A network that includes both small cells and macro cells may be referred to as a heterogeneous network. A heterogeneous network may also include an evolved home node B (eNB) (HeNB), which can provide service to a restricted group referred to as a closed subscriber group (CSG). The communication link between RU140 and UE 104 may include uplink (UL) transmission (also known as reverse link) from UE 104 to RU 140 and / or downlink (DL) transmission (also known as forward link) transmission from RU 140 to UE 104. The communication link may utilize multiple-input multiple-output (MIMO) antenna techniques, including spatial multiplexing, beamforming, and / or transmit diversity. The communication link may use one or more carriers. For each carrier allocated in a carrier aggregation of up to Yx MHz (x component carriers) for transmission in each direction, base station 102 / UE 104 may use a spectrum with a bandwidth of up to Y MHz (e.g., 5MHz, 10MHz, 15MHz, 20MHz, 100MHz, 400MHz, etc.). Carriers may be adjacent to each other or may not be adjacent to each other. Carrier allocation may be asymmetric with respect to DL and UL (e.g., more or fewer carriers may be allocated to DL compared to UL). Component carriers may include primary component carriers and one or more secondary component carriers. The primary component carrier can be referred to as the primary cell (PCell) and the secondary component carrier can be referred to as the secondary cell (SCell).

[0060] Some UEs 104 can communicate with each other using device-to-device (D2D) communication link 158. D2D communication link 158 can use DL / UL wireless wide area network (WWAN) spectrum. D2D communication link 158 can use one or more sidelink channels, such as Physical Sidelink Broadcast Channel (PSBCH), Physical Sidelink Discovery Channel (PSDCH), Physical Sidelink Shared Channel (PSSCH), and Physical Sidelink Control Channel (PSCCH). D2D communication can be achieved through various wireless D2D communication systems, such as Bluetooth. ™ (Bluetooth is a trademark of the Bluetooth Special Interest Group (SIG), and is based on the IEEE 1402.11 standard for Wi-Fi.) ™ (Wi-Fi is a trademark of the Wi-Fi Alliance, LTE or NR)

[0061] The wireless communication system may also include a Wi-Fi AP 150, which communicates with the UE 104 (also referred to as a Wi-Fi station (STA)) via a communication link 154, for example, in an unlicensed spectrum such as 5 GHz. When communicating in unlicensed spectrum, the UE 104 / AP 150 may perform a free channel assessment (CCA) to determine whether the channel is available before communication.

[0062] The electromagnetic spectrum is typically subdivided into various categories, bands, channels, etc., based on frequency / wavelength. In 5G NR, two initial operating bands have been designated as frequency ranges FR1 (410MHz to 7.125GHz) and FR2 (24.25GHz to 52.6GHz). Although a portion of FR1 is greater than 6GHz, FR1 is generally (interchangeably) referred to as the "sub-6GHz" band in various documents and articles. Similar naming issues sometimes occur with FR2, which is generally (interchangeably) referred to as the "millimeter wave" band in documents and articles, although this is distinct from the Extremely High Frequency (EHF) band (30GHz to 300GHz) designated as "millimeter wave" by the International Telecommunication Union (ITU).

[0063] The frequencies between FR1 and FR2 are generally referred to as mid-band frequencies. Recent 5G NR studies have identified the operating bands used for these mid-band frequencies as the frequency range designation FR3 (7.125 GHz to 24.25 GHz). Bands falling within FR3 can inherit FR1 and / or FR2 characteristics, thus effectively extending the features of FR1 and / or FR2 to mid-band frequencies. Additionally, higher frequency bands are currently being explored to extend 5G NR operation beyond 52.6 GHz. For example, three higher operating frequency bands have been identified as the frequency range designations FR2-2 (52.6 GHz – 71 GHz), FR4 (71 GHz – 114.25 GHz), and FR5 (114.25 GHz – 300 GHz). Each of these higher frequency bands falls within the EHF band.

[0064] In view of the above, unless otherwise specifically stated, the term "below 6 GHz" as used herein can broadly refer to frequencies less than 6 GHz, within FR1, or including intermediate frequency band frequencies. Furthermore, unless otherwise specifically stated, the term "millimeter wave" as used herein can broadly refer to frequencies that can include intermediate frequency band frequencies, within FR2, FR4, FR2-2 and / or FR5, or within the EHF band.

[0065] Base station 102 and UE 104 may each include multiple antennas (such as antenna elements, antenna panels, and / or antenna arrays) to facilitate beamforming. Base station 102 may transmit beamformed signals 182 to UE 104 in one or more transmit directions. UE 104 may receive beamformed signals from base station 102 in one or more receive directions. UE 104 may also transmit beamformed signals 184 to base station 102 in one or more transmit directions. Base station 102 may receive beamformed signals from UE 104 in one or more receive directions. Base station 102 / UE 104 may perform beamforming training to determine the optimal receive and transmit directions for each of base station 102 / UE 104. The transmit and receive directions of base station 102 may be the same or different. The transmit and receive directions of UE 104 may be the same or different.

[0066] Base station 102 may include and / or be referred to as gNB, Node B, eNB, access point, base transceiver, radio base station, radio transceiver, transceiver function, basic service set (BSS), extended service set (ESS), TRP, network node, network entity, network equipment, or some other suitable terminology. Base station 102 may be implemented as an integrated access and backhaul (IAB) node, relay node, sidelink node, aggregated (monolithic) base station with baseband units (BBU) (including CU and DU) and RU, or may be implemented as a decomposed base station including one or more of CU, DU, and / or RU. A collection of base stations that may include decomposed base stations and / or aggregated base stations may be referred to as Next Generation (NG) RAN (NG-RAN).

[0067] The core network 120 may include Access and Mobility Management Function (AMF) 161, Session Management Function (SMF) 162, User Plane Function (UPF) 163, Unified Data Management (UDM) 164, one or more location servers 168, and other functional entities. AMF 161 is the control node that processes signaling between UE 104 and the core network 120. AMF 161 supports registration management, connection management, mobility management, and other functions. SMF 162 supports session management and other functions. UPF 163 supports packet routing, packet forwarding, and other functions. UDM 164 supports authentication and key agreement (AKA) credential generation, user identity processing, access authorization, and subscription management. One or more location servers 168 are exemplified as including a Gateway Mobile Location Center (GMLC) 165 and a Location Management Function (LMF) 166. However, generally, one or more location servers 168 may include one or more location / positioning servers, which may include one or more of GMLC 165, LMF 166, Position Determination Entity (PDE), Serving Mobile Location Center (SMLC), Mobile Location Center (MPC), etc. GMLC 165 and LMF 166 support UE location services. GMLC 165 provides an interface for clients / applications (e.g., emergency services) to access UE location information. LMF 166 receives measurement and auxiliary information from NG-RAN and UE 104 via AMF 161 to calculate the location of UE 104. NG-RAN may use one or more positioning methods to determine the location of UE 104. Positioning UE 104 may involve signal measurement, location estimation, and optional speed calculation based on these measurements. Signal measurement may be performed by UE 104 and / or base station 102 serving UE 104. The measured signals may be based on one or more of the following: Satellite Positioning System (SPS) 170 (e.g., one or more of Global Navigation Satellite System (GNSS), Global Positioning System (GPS), Non-Terrestrial Network (NTN) or other satellite positioning / location systems), LTE signals, Wireless Local Area Network (WLAN) signals, Bluetooth signals, Terrestrial Beacon System (TBS), sensor-based information (e.g., barometric pressure sensor, motion sensor), NR Enhanced Cell ID (NR E-CID) method, NR signals (e.g., multiple round-trip time (multiple RTT), DL departure angle (DL-AoD), DL time difference of arrival (DL-TDOA), UL time difference of arrival (UL-TDOA), and UL angle of arrival (UL-AoA) positioning) and / or other systems / signals / sensors.

[0068] Examples of UE 104 include cellular phones, smartphones, Session Initiation Protocol (SIP) phones, laptops, personal digital assistants (PDAs), satellite radios, GPS devices, multimedia devices, video devices, digital audio players (e.g., MP3 players), cameras, game consoles, tablets, smart devices, wearable devices, vehicles, electricity meters, air pumps, large or small kitchen appliances, healthcare devices, implants, sensors / actuators, displays, or any other similarly functional device. Some UEs in UE 104 may be referred to as IoT devices (e.g., parking timers, air pumps, toasters, vehicles, heart monitors, etc.). UE 104 may also be referred to as a station, mobile station, subscriber station, mobile unit, subscriber unit, wireless unit, remote unit, mobile device, wireless device, wireless communication device, remote device, mobile subscriber station, access terminal, mobile terminal, wireless terminal, remote terminal, mobile phone, user agent, mobile client, client, or some other suitable terminology. In some scenarios, the term UE may also be applied to one or more companion devices, such as in a device constellation arrangement. One or more of these devices may access the network together and / or individually.

[0069] Refer again Figure 1 In some aspects, UE 104 may have a secure receiving component 198, which is configured to receive ranging messages. The secure receiving component 198 may be configured to calculate the CFO based on the ranging messages. The secure receiving component 198 may be configured to send a response message including control information for modifying the transmission protocol. The transmission of the response message may be in response to the calculated CFO being greater than or equal to a threshold. In some aspects, base station 102 may have a secure transmitting component 199, which is configured to transmit a first ranging message. The secure transmitting component 199 may be configured to receive a response message including control information for modifying the transmission protocol after the transmission of the first ranging message. The secure transmitting component 199 may be configured to transmit a second ranging message based on the control information.

[0070] Figure 2A Figure 200 illustrates an example of the first subframe within a 5G NR frame structure. Figure 2B Figure 230 illustrates an example of a DL channel within a 5G NR subframe. Figure 2C Figure 250 is an example of a second subframe within a 5G NR frame structure. Figure 2DFigure 280 illustrates an example of a UL channel within a 5G NR subframe. The 5G NR frame structure can be Frequency Division Duplex (FDD) (where subframes within a specific set of subcarriers (carrier system bandwidth) are dedicated to either DL or UL) or Time Division Duplex (TDD) (where subframes within a specific set of subcarriers (carrier system bandwidth) are dedicated to both DL and UL). Figure 2A , Figure 2C In the provided example, the 5G NR frame structure is assumed to be TDD, where subframe 4 is configured with slot format 28 (most of which are DL), where D is DL, U is UL, and F is flexible and can be used between DL / UL, and subframe 3 is configured with slot format 1 (all of which are UL). Although subframes 3 and 4 are shown as having slot formats 1 and 28 respectively, any particular subframe can be configured with any of the various available slot formats 0 to 61. Slot formats 0 and 1 are both DL and UL, respectively. Other slot formats 2 to 61 include a mixture of DL, UL, and flexible symbols. The slot format is configured for the UE via the received Slot Format Indicator (SFI) (dynamically configured via DL Control Information (DCI) or semi-statically / statically configured via Radio Resource Control (RRC) signaling). Note that the following description also applies to the 5G NR frame structure as TDD.

[0071] Figures 2A to 2D The frame structure is illustrated, and aspects of this disclosure are applicable to other wireless communication technologies that may have different frame structures and / or different channels. A frame (10 ms) can be divided into 10 equal-sized subframes (1 ms). Each subframe may include one or more time slots. Subframes may also include micro-time slots, which may include 7, 4, or 2 symbols. Each time slot may include 14 or 12 symbols, depending on whether the cyclic prefix (CP) is normal or extended. For normal CP, each time slot may include 14 symbols, and for extended CP, each time slot may include 12 symbols. Symbols on the DL may be CP Orthogonal Frequency Division Multiplexing (OFDM) (CP-OFDM) symbols. Symbols on the UL may be CP-OFDM symbols (for high-throughput scenarios) or Discrete Fourier Transform (DFT) Extended OFDM (DFT-s-OFDM) symbols (for power-constrained scenarios; limited to single-stream transmission). The number of time slots within a subframe is based on the CP and a parameter set. The parameter set defines the subcarrier spacing (SCS) (see Table 1). The symbol length / duration can be scaled by 1 / SCS.

[0072]

[0073] Table 1: Parameter Set, SCS, and CP

[0074] For a normal CP (14 symbols / slot), different parameter sets µ 0 through 4 allow 1, 2, 4, 8, and 16 slots per subframe, respectively. For an extended CP, parameter set 2 allows 4 slots per subframe. Therefore, for a normal CP and parameter set µ, there are 14 symbols / slot and 2... µ One time slot / subframe. Subcarrier spacing can be equal to ,in The parameter sets are 0 to 4. Therefore, the subcarrier spacing is 15 kHz for parameter set µ=0 and 240 kHz for parameter set µ=4. The symbol length / duration is negatively correlated with the subcarrier spacing. Figures 2A to 2D Examples of a normal frequency division multiplexing (CP) with 14 symbols per time slot and a parameter set of µ=2 with 4 time slots per subframe are provided. The time slot duration is 0.25 ms, the subcarrier spacing is 60 kHz, and the symbol duration is approximately 16.67 μs. Within the frame set, there may be one or more distinct bandwidth portions (BWPs) of frequency division multiplexing (see [link to relevant documentation]). Figure 2B Each BWP can have a specific set of parameters and CP (normal or extended).

[0075] A resource grid can be used to represent the frame structure. Each time slot consists of a resource block (RB) extending for 12 consecutive subcarriers (also known as a physical RB (PRB)). The resource grid is divided into multiple resource elements (REs). The number of bits carried by each RE depends on the modulation scheme.

[0076] like Figure 2A As illustrated, some of the REs carry reference (pilot) signals (RS) for the UE. RS may include demodulation RS (DM-RS) (indicated as R for a particular configuration, but other DM-RS configurations are possible) and channel state information reference signals (CSI-RS) for channel estimation at the UE. RS may also include beam measurement RS (BRS), beam refinement RS (BRRS), and phase tracking RS (PT-RS).

[0077] Figure 2BExamples of various DL channels within a subframe of a frame are illustrated. The Physical Downlink Control Channel (PDCCH) carries the DCI within one or more Control Channel Elements (CCEs) (e.g., 1, 2, 4, 8, or 16 CCEs), each CCE comprising six RE Groups (REGs), each REG comprising 12 coherent REs in the OFDM symbol of the RB. A PDCCH within a BWP can be referred to as a Control Resource Set (CORESET). The UE is configured to monitor PDCCH candidates in the PDCCH search space (e.g., the common search space, the UE-specific search space) during PDCCH monitoring timing on the CORESET, where the PDCCH candidates have different DCI formats and different aggregation levels. Additional BWPs may be located at higher and / or lower frequencies on the channel bandwidth. The Primary Synchronization Signal (PSS) may be located within symbol 2 of a specific subframe of the frame. The PSS is used by the UE 104 to determine subframe / symbol timing and physical layer identification. The Secondary Synchronization Signal (SSS) may be located within symbol 4 of a specific subframe of the frame. The SSS is used by the UE to determine the Physical Layer Cell Identifier Group Number and radio frame timing. Based on the Physical Layer Identifier and the Physical Layer Cell Identifier Group Number, the UE can determine the Physical Cell Identifier (PCI). Based on the PCI, the UE can determine the location of the DM-RS. The Physical Broadcast Channel (PBCH), carrying the Master Information Block (MIB), can be logically grouped with the PSS and SSS to form a Synchronization Signal (SS) / PBCH block (also known as an SS block (SSB)). The MIB provides the System Frame Number (SFN) and the number of Restricted Frames (RBs) in the system bandwidth. The Physical Downlink Shared Channel (PDSCH) carries user data, broadcast system information not transmitted via the PBCH (such as System Information Blocks (SIBs)), and paging messages.

[0078] like Figure 2C As illustrated, some REs in the REs carry DM-RS (indicated as R for one particular configuration, but other DM-RS configurations are possible) for channel estimation at the base station. The UE can transmit DM-RS for the Physical Uplink Control Channel (PUCCH) and DM-RS for the Physical Uplink Shared Channel (PUSCH). The PUSCH DM-RS can be transmitted in the first or first two symbols of the PUSCH. Depending on whether a short or long PUCCH is transmitted and depending on the specific PUCCH format used, the PUCCH DM-RS can be transmitted in different configurations. The UE can transmit a Sounding Reference Signal (SRS). The SRS can be transmitted in the last symbol of a subframe. The SRS can have a comb structure, and the UE can transmit the SRS on one of the comb teeth. The SRS can be used by the base station for channel quality estimation to enable frequency-dependent scheduling of the UL.

[0079] Figure 2DExamples of various UL channels within a subframe of a frame are illustrated. The PUCCH may be located as indicated in one configuration. The PUCCH carries uplink control information (UCI), such as scheduling requests, channel quality indicators (CQI), pre-decoding matrix indicators (PMI), rank indicators (RI), and hybrid automatic repeat request (HARQ) acknowledgment (ACK) (HARQ-ACK) feedback (i.e., one or more HARQ ACK bits indicating one or more ACKs and / or negative ACKs (NACKs)). The PUCCH carries data and may additionally be used to carry buffer status reports (BSR), power clearance reports (PHR), and / or UCIs.

[0080] Figure 3 This is a block diagram of UE 310 communicating with UE 350 via a D2D communication link, such as an ultra-wideband (UWB) connection, a sidelink channel, or DL / UL WWAN spectrum. In some examples, UE 310 and UE 350 may communicate via UWB or other D2D communication. This communication may be based on a sidelink using a PC5 interface. Packets may be provided to a controller / processor 375 that implements Layer 3 and Layer 2 functionality. Layer 3 includes the Radio Resource Control (RRC) layer, and Layer 2 includes the Packet Data Convergence Protocol (PDCP) layer, the Radio Link Control (RLC) layer, and the Media Access Control (MAC) layer.

[0081] Transmit (TX) processor 316 and receive (RX) processor 370 implement Layer 1 functionality associated with various signal processing functions. Layer 1 (which includes the physical (PHY) layer) may include error detection on the transport channel, forward error correction (FEC) decoding / decoding of the transport channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. TX processor 316 processes the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-order phase shift keying (M-PSK), M-order quadrature amplitude modulation (M-QAM)). The decoded and modulated symbols can then be divided into parallel streams. Each stream can then be mapped to OFDM subcarriers, multiplexed with a reference signal (e.g., a pilot) in the time and / or frequency domains, and then combined using inverse fast Fourier transform (IFFT) to produce a physical channel carrying a stream of time-domain OFDM symbols. The OFDM stream is spatially pre-decoded to generate multiple spatial streams. A channel estimate from channel estimator 374 is used to determine the decoding and modulation scheme, as well as for spatial processing. This channel estimate can be derived from a reference signal transmitted by UE 350 and / or channel condition feedback. Each spatial stream can then be provided to a different antenna 320 via a separate transmitter 318Tx. Each transmitter 318Tx can use the corresponding spatial stream to modulate a radio frequency (RF) carrier for transmission.

[0082] At UE 350, each receiver 354Rx receives signals via its corresponding antenna 352. Each receiver 354Rx recovers the information modulated onto the RF carrier and provides that information to the receive (RX) processor 356. The TX processor 368 and RX processor 356 implement Layer 1 functionality associated with various signal processing functions. The RX processor 356 can perform spatial processing on the information to recover any spatial stream destined for UE 350. If multiple spatial streams are destined for UE 350, the RX processor 356 can combine them into a single OFDM symbol stream. The RX processor 356 then uses a Fast Fourier Transform (FFT) to transform the OFDM symbol stream from the time domain to the frequency domain. The frequency domain signal consists of a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols on each subcarrier, along with the reference signal, are recovered and demodulated by determining the most probable signal constellation point transmitted by UE 310. These soft decisions can be based on a channel estimate calculated by the channel estimator 358. Subsequently, the soft decision is decoded and deinterleaved to recover the data and control signals originally transmitted by UE 310 on the physical channel. The data and control signals are then provided to controller / processor 359, which implements layer 3 and layer 2 functionality.

[0083] The controller / processor 359 may be associated with at least one memory 360 storing program code and data. The at least one memory 360 may be referred to as a computer-readable medium. The controller / processor 359 provides packet reassembly, decryption, header decompression, control signal processing, and demultiplexing between transport and logical channels to recover IP packets. The controller / processor 359 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operation.

[0084] Similar to the functions described in conjunction with DL transmission by UE 310, controller / processor 359 provides RRC layer functions associated with system information (e.g., MIB, SIB) acquisition, RRC connectivity, and measurement reporting; PDCP layer functions associated with header compression / decompression and security (encryption, decryption, integrity protection, integrity verification); RLC layer functions associated with upper-layer PDU delivery, error correction via ARQ, concatenation, segmentation, and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functions associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs to TBs, demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction via HARQ, priority handling, and logical channel priority ordering.

[0085] The TX processor 368 can use the channel estimate derived from the reference signal or feedback transmitted by the channel estimator 358 from the UE 310 to select an appropriate decoding and modulation scheme and facilitate spatial processing. The spatial stream generated by the TX processor 368 can be provided to different antennas 352 via individual transmitters 354Tx. Each transmitter 354Tx can use the corresponding spatial stream to modulate an RF carrier for transmission.

[0086] Transmission is processed at UE 310 in a manner similar to that described in conjunction with the receiver function at UE 350. Each receiver 318Rx receives the signal via its corresponding antenna 320. Each receiver 318Rx recovers the information modulated onto the RF carrier and provides that information to the RX processor 370.

[0087] The controller / processor 375 may be associated with at least one memory 376 storing program code and data. The at least one memory 376 may be referred to as a computer-readable medium. The controller / processor 375 provides packet reassembly, decryption, header decompression, control signal processing, and demultiplexing between transport and logical channels to recover IP packets. The controller / processor 375 is also responsible for error detection using ACK and / or NACK protocols to support HARQ operation.

[0088] At least one of the TX processor 368, RX processor 356, and controller / processor 359 can be configured to perform and Figure 1 The secure receiving component 198 integrates various aspects.

[0089] At least one of the TX processor 368, RX processor 356, and controller / processor 359 can be configured to perform and Figure 1 The secure transmission component 199 combines various aspects.

[0090] At least one of the TX processor 316, RX processor 370, and controller / processor 375 can be configured to perform and Figure 1 The secure receiving component 198 integrates various aspects.

[0091] At least one of the TX processor 316, RX processor 370, and controller / processor 375 can be configured to perform and Figure 1 The secure transmission component 199 combines various aspects.

[0092] Figure 4 Figure 400 illustrates an example of a positioning session based on positioning signal measurements. The positioning signal can be any reference signal that can be measured to calculate the positioning or location attributes of a wireless device, such as a Positioning Reference Signal (PRS), Sounding Reference Signal (SRS), Channel State Information (CSI) Reference Signal (CSI-RS), or Synchronization and Signal Block (SSB). Wireless device 402 can be a base station (such as a TRP), or a UE with a known positioning / location (such as a Positioning Reference Unit (PRU)), or a UE with a high-accuracy sensor (e.g., a GNSS sensor or GPS sensor) that can identify the UE's location. Wireless device 406 can be a base station or a UE with a known positioning / location. Wireless device 404 can be a UE or TRP configured to perform positioning to collect data (e.g., collect data to train an artificial intelligence machine learning (AI / ML or AIML) model, test positioning signal strength, or test positioning noise attributes in an area). Wireless device 404 can be at time T... SRS_TX Send UL-SRS 412, and at time T PRS_RX Receives DL Positioning Reference Signal (PRS) (DL-PRS) 410. Wireless device 406 can receive the DL positioning reference signal (PRS) at time T. SRS_RX Receive UL-SRS 412, and at time T PRS_TXSend DL-PRS 410. Wireless device 404 may receive DL-PRS 410 before sending UL-SRS 412, or may send UL-SRS 412 before receiving DL-PRS 410. In both cases, the location server (e.g., location server 168, LMF 166) or wireless device 404 may base its signal on ||T. SRS_RX -T PRS_TX |-|T SRS_TX -T PRS_RX || to determine RTT 414. Therefore, multi-RTT positioning can utilize the UE Rx-Tx time difference measurement (i.e., |T) of downlink signals received from multiple radio devices 402, 406 and measured by radio device 404. SRS_TX -T PRS_RX |) and DL-PRS reference signal received power (RSRP) (DL-PRS-RSRP), and the TRP Rx-Tx time difference measurement of the uplink signal transmitted from wireless device 404 at multiple wireless devices 402, 406 (i.e., |T) SRS_RX -T PRS_TX |) and UL-SRS-RSRP. Wireless device 404 can use auxiliary data received from the location server to measure the UE Rx-Tx time difference (and optionally, the DL-PRS-RSRP of the received signal), and wireless devices 402 and 406 use auxiliary data received from the location server to measure the gNB Rx-Tx time difference (and optionally, the UL-SRS-RSRP of the received signal). The measurements can be used at the location server or wireless device 404 to determine the RTT. The RTT can be used to estimate the location of wireless device 404. Other methods for determining the RTT are possible, such as, for example, using DL-TDOA and / or UL-TDOA measurements.

[0093] DL-AoD positioning can utilize the measured DL-PRS-RSRP of downlink signals received at wireless device 404 from multiple wireless devices 402, 406. Wireless device 404 can use auxiliary data received from a positioning server to measure the DL-PRS-RSRP of the received signals, and the resulting measurement, together with the azimuth departure (A-AoD), zenith departure (Z-AoD), and / or other configuration information, can be used to locate wireless device 404 relative to neighboring wireless devices 402, 406.

[0094] DL-TDOA positioning can utilize the DL Reference Signal Time Difference (RSTD) (and optionally, DL-PRS-RSRP) of downlink signals received at wireless device 404 from multiple wireless devices 402, 406. Wireless device 404 can use auxiliary data received from a positioning server to measure the DL RSTD (and optionally, DL-PRS-RSRP) of the received signals, and the resulting measurement, along with other configuration information, can be used to locate the position / location of wireless device 404 relative to neighboring wireless devices 402, 406.

[0095] UL-TDOA positioning can utilize the UL relative time of arrival (RTOA) (and optionally, UL-SRS-RSRP) of the uplink signal transmitted from wireless device 404 at multiple wireless devices 402, 406. Wireless devices 402, 406 can use auxiliary data received from a positioning server to measure the UL-RTOA (and optionally, UL-SRS-RSRP) of the received signal, and the resulting measurement can be used, along with other configuration information, to estimate the location of wireless device 404.

[0096] UL-AoA positioning utilizes the azimuth angle (A-AoA) and zenith angle (Z-AoA) of the uplink signal transmitted from wireless device 404, measured at multiple wireless devices 402 and 406. Wireless devices 402 and 406 can use auxiliary data received from a positioning server to measure the A-AoA and Z-AoA of the received signal, and the resulting measurements, along with other configuration information, can be used to estimate the position of wireless device 404.

[0097] Additional positioning methods can be used to estimate the location of the wireless device 404, such as, for example, UE-side UL-AoD and / or DL-AoA. It should be noted that data / measurements from various technologies can be combined in various ways to increase accuracy, determine and / or enhance certainty, supplement / improve measurements, and / or replace / provide missing information.

[0098] In some respects, two wireless devices can be configured to perform ranging operations on each other, for example, by exchanging location signals with each other and estimating the distance between the devices based on measured time of arrival (ToA), round-trip time (RTT), reference signal strength indicator (RSSI), or reference signal received power (RSRP). Figure 5A and Figure 5B An example of UEs configured to perform ranging operations on each other is shown.

[0099] Figure 5AFigure 500 illustrates an example of a UE 502 configured to perform ranging with UE 504. UE 502 may include an Enhanced Ranging Device (ERDEV). UE 504 may include an ERDEV. UE 502 may be a controller for the ranging session. In other words, UE 502 can control the ranging session and can define ranging parameters for the ranging session between UE 502 and UE 504. UE 504 may be a controlled entity in the ranging session. In other words, UE 504 can use the ranging parameters received from UE 502 to perform ranging with UE 502.

[0100] UE 502 may send a ranging control message (RCM) 506 to UE 504. UE 504 may receive RCM 506 from UE 502. The RCM may include a set of ranging parameters configured by UE 502. The ranging parameters may include, for example, timing, bandwidth, period, and / or measurement configuration for the ranging session. RCM 506 may designate UE 502 as the initiator of the ranging session and UE 504 as the responder of the ranging session. In other words, UE 502 may initiate a ranging exchange between UE 502 and UE 504 by sending a first exchange message to UE 504, and UE 504 may respond to the first exchange message with a response message. For example, UE 502 may send a ranging initiation message (RIM) 508 to UE 504 based on the parameters of RCM 506. RIM 508 may be the first message for a ranging exchange between UE 502 and UE 504. UE 504 may receive RIM 508 based on the parameters of RCM 506. In response to receiving RIM 508, UE 504 may send a ranging response message (RRM) 512 to UE 502 based on the configuration parameters of RCM 506. UE 502 may receive RRM 512 based on the parameters of RCM 506. UE 502 may perform ranging based on RRM 512. UE 502 may perform any suitable positioning based on RRM 512. In one aspect, UE 502 may measure the RTT of the ranging session based on RRM 512. In another aspect, RRM 512 may include indicators (e.g., ToA, RSRP) of the set of measurements performed by UE 504, and UE 502 may calculate the range between UE 502 and UE 504 based on these measurements.

[0101] In some respects, UE 502 can use update messages to change a subset of parameters used in the ranging session. For example, UE 502 can send a ranging control update message (RCUM) 514 to UE 504. UE 504 can receive RCUM 514 from UE 502. RCUM 514 may include updates to a subset of parameters, such as timing updates or encoding updates. UE 502 can then send RIM 516 to UE 504 based on the parameters of RCUM 514. UE 504 can receive RIM 516 from UE 502 based on the parameters of RCUM 514. UE 504 can send RRM 518 to UE 502 based on the parameters of RCUM 514. UE 502 can receive RRM 518 from UE 504 based on the parameters of RCUM 514. UE 502 can then perform ranging based on RRM 518 received from UE 504.

[0102] Figure 5B Figure 550 is an example of a UE 552 configured to perform ranging together with UE 554. UE 552 may include ERDEV. UE 554 may include ERDEV. UE 552 may be a controller for the ranging session. UE 554 may be a controlled device for the ranging session.

[0103] UE 552 can send RCM 556 to UE 554. UE 554 can receive RCM 556 from UE 552. The RCM may include a set of ranging parameters configured by UE 552. RCM 556 may designate UE 554 as the initiator of the ranging session and UE 552 as the responder of the ranging session. In other words, UE 554 can initiate a ranging exchange between UE 552 and UE 554 by sending a first message of the exchange to UE 552, and UE 552 can respond to the first message of the exchange with a response message. For example, UE 554 may send RIM 558 to UE 552 based on the parameters of RCM 556. RIM 558 may be the first message of the ranging exchange between UE 552 and UE 554. UE 552 can receive RIM 558 based on the parameters of RCM 556. In response to receiving RIM 558, UE 552 may send RRM 562 to UE 554 based on the configuration parameters of RCM 556. UE 554 may receive RRM 562 based on the parameters of RCM 556. UE 554 may perform ranging based on RRM 562.

[0104] In some respects, UE 552 can use update messages to modify a subset of parameters used in the ranging session. For example, UE 552 can send RCUM 564 to UE 554. UE 554 can receive RCUM 564 from UE 552. RCUM 564 may include updates to the subset of parameters, such as timing updates or encoding updates. UE 554 can then send RIM 566 to UE 552 based on the parameters of RCUM 564. UE 552 can receive RIM 566 from UE 554 based on the parameters of RCUM 564. UE 552 can also send RRM 568 to UE 554 based on the parameters of RCUM 564. UE 554 can then receive RRM 568 from UE 552 based on the parameters of RCUM 564. UE 554 can then perform ranging based on the RRM 568 received from UE 552.

[0105] As shown in the figure, the initiating or responding device in a ranging session can be a controller, which can send RCM or RCUM messages to another ranging device to specify the parameters of the ranging session between the initiating and responding devices. A ranging session can include a RIM from the initiator to the responder and an RRM from the responder to the initiator.

[0106] Figure 6A Figure 600 illustrates signals that can be exchanged between wireless devices for use in a ranging session between wireless devices. The ranging session can be performed using ultra-wideband (UWB) signals (e.g., time-scheduled ranging, contention-free ranging). The ranging session may include ranging messages comprising a set of consecutive ranging blocks, such as ranging block 602. Each ranging block may have multiple ranging rounds. The multiple ranging rounds may have a series of consecutive ranging rounds, for example, from the first ranging round 604 to the Nth ranging round 606. Each ranging round in a ranging block may be referenced by a ranging round index relative to the first ranging round 604 in the ranging block. Each ranging round may have multiple ranging time slots. The multiple ranging time slots may have a series of consecutive ranging time slots from the first ranging time slot 608 to the Mth ranging time slot 610. Each ranging time slot in a ranging round may be referenced by a ranging time slot index relative to the first ranging time slot 608 in the ranging block. Distance rounds can have sufficient duration to complete a distance measurement cycle. The distance round usage pattern can be repeated in subsequent distance blocks to periodically update the distance measurement.

[0107] Figure 6B This is an example Figure 6A Figure 650 shows an example of a ranging round (e.g., the first ranging round 604 or the Nth ranging round 606). Figure 6BThe ranging round 652 may include a ranging control phase 654, a ranging phase 656, and a measurement reporting phase 658. Within a ranging block, the responding wireless device may send a message within a single round. The round index may be statically configured by the controller wireless device or selected according to a hopping pattern. Time slots within a selected round may be used sequentially to perform ranging, for example, based on RTT or based on Time Difference of Arrival (TDoA). The ranging control phase 654 of a round may include one or two time slots, for example, one time slot for the initiating wireless device to initiate the ranging round, or two time slots for the initiating wireless device to initiate the ranging round and respond to the initiation message. When a UWB fragment is sent by the transmitting wireless device and measured by the receiving wireless device, the ranging phase 656 may include multiple time slots. The measurement reporting phase 658 may include multiple time slots in which the measuring device can report measurements. In some aspects, the ranging round may not include a measurement reporting phase when the receiving wireless device calculates the distance itself.

[0108] Figure 7 Figures 700, 720, 740, and 760 illustrate examples of packet configurations used for ranging. These figures may represent PPDU fields in Physical Layer Protocol Data Unit (PPDU) format. Figure 700 illustrates a packet configuration including a Synchronization (SYNC) preamble 702, a Start-of-Frame Delimiter (SFD) 704, a Physical Layer Header (PHR) 706, and a Physical (PHY) payload 708. The SYNC preamble 702 may include a sequence, such as an Ipatov ternary sequence, which has good correlation properties compared to other sequences to improve channel estimation at the receiver, thereby improving the accuracy of measurements such as ToA estimation. In other words, the SYNC preamble 702 assists the receiver in frame detection (i.e., channel estimation) and synchronization (e.g., timing, phase, frequency). The SFD 704 helps distinguish the SYNC preamble 702 from the PHR 706 and the PHY payload 708. The grouping configuration shown in Figure 700 may include a reference marker (RMARKER) reference positioning 710, which can be used to reference the payload of the group.

[0109] Because the SYNC preamble 702 can be broadcast by the transmitting wireless device, it may be vulnerable to over-the-air (OTA) spoofing attacks, such as replay attacks. For example, a spoofer could amplify the signal to replay the SYNC preamble 702, thereby mimicking the strength of the original transmitting wireless device located closer to the receiving wireless device. Secure packet configuration may include Secure Sequences (STS) to enhance packet security. STS may include secure sequences generated in counter mode using a deterministic random bit generator (DRBG) based on Advanced Encryption Standard (AES) 128-bit (AES-128).

[0110] Figure 720 illustrates an STS packet configuration including a SYNC preamble 722, SFD 724, STS 732, PHR 726, and PHY payload 728. The STS packet configuration shown in Figure 720 may include an RMARRER reference positioning 730, which can be used to reference the starting positions of STS 732, PHR 726, and PHY payload 728 from SFD 724. The STS packet configuration in Figure 720 can be used to securely transmit data payloads using UWB signaling.

[0111] Figure 740 illustrates an STS packet configuration including a SYNC preamble 742, SFD 744, PHR 746, PHY payload 748, and STS 752. The STS packet configuration shown in Figure 740 may include an RMARRER reference positioning 750, which can be used to reference the start positions of PHR 746, PHY payload 748, and STS 752 from SFD 744. The STS packet configuration in Figure 740 can also be used to securely transmit a data payload using UWB signals, wherein a secure STS is appended to the end of the PHY payload 748.

[0112] Figure 760 illustrates an STS packet configuration including a SYNC preamble 762, an SFD 764, and an STS 772. The STS packet configuration shown in Figure 760 may include an RMARRKER reference positioning 770, which can be used to reference the starting position of the STS 772 from the SFD 764. The SFD 764 helps distinguish the SYNC preamble 762 from the STS 772. The STS packet configuration shown in Figure 760 can be used for positioning or ranging because the size of the STS packets is optimized in the absence of a data communication payload.

[0113] A SYNC preamble followed by an SFD, such as SYNC preamble 702 followed by SFD 704 or SYNC preamble 722 followed by SFD 724, can be called a Synchronization Header (SHR) preamble. Each field can be represented by a ternary sequence of {-1, 0, +1}, where -1 represents a negative pulse, +1 represents a positive pulse, and 0 represents a neutral pulse. In some respects, a {0, 1}-bit binary sequence can be mapped to a {-1, 0, +1} ternary sequence by allowing 0 to be mapped to -1. In other words, when using a binary phase shift keying (BPSK) symbol sequence for transmission, a {0, 1}-bit binary sequence can be mapped to a {-1, +1}-bit ternary sequence. The end of this payload can be zero-padded to form a {-1, 0, +1} ternary burst positioning modulation (BPM) sequence.

[0114] The SHR preamble can be constructed using a preamble code set and an SFD code set. The preamble codes can be predefined by a table that associates a set of code indices with a set of code sequences (see Table 2). Each code index can also be associated with a channel number.

[0115]

[0116] Table 2: SHR preamble code (31-bit length)

[0117] As shown in Table 2, each channel can be associated with two unique preamble codes with a length of 31 ternary sequences of {-1, 0, +1}. The combination of channel number and preamble code sequences can also be called a composite channel. In some respects, longer preamble code sequences can be defined, such as preamble codes with a length of 127 ternary sequences (see Table 3).

[0118]

[0119] Table 3: SHR preamble code (127 characters long)

[0120] In some respects, preamble symbols can be constructed based on the following Kronecker operation:

[0121]

[0122] It can be the preamble symbol i.

[0123] It can be the preamble code sequence i.

[0124]

[0125] L can be the padding length factor.

[0126] For example, by adding L-1=3 zeros after each ternary preamble code symbol, such as [-1, 0, 0, 0, +1, 0, 0, 0, 0, 0, 0], a preamble code sequence [-1, +1, 0] can be used to construct a preamble symbol with L=4. In some respects, the SYNC preamble of the SHR preamble... Sequence lengths can include 16, 64, 1024, or 4096.

[0127] Figure 8This is a diagram 800 illustrating exemplary components for generating a 128-bit pulse for a secure STS. The STS can be generated using AES-128 DRBG. The STS can be encrypted and decrypted using a symmetric key algorithm with a private key 806. A counter seed 804 is run by a counter 808 and combined with a public key 802 to generate a combined key 810. The private key 806 and the combined key 810 can be fed to an AES-128 812 to encrypt the private key 806, thereby generating a pseudo-random number 814 of ciphertext. The pseudo-random numbers 814 can be stacked on top of each other to form the pulse of the STS. A set bit can be represented as a positive pulse, and a reset bit can be represented as a negative pulse.

[0128] Figure 9A Figure 900 illustrates an example of an impersonator 904 that can mimic responder 902 sending ranging signals to initiator 906. Responder 902 and initiator 906 can perform one-sided two-way ranging (SS-TWR) as a positioning method. In other words, initiator 906 and responder 902 can have bidirectional exchange of ranging frames to calculate the RTT between initiator 906 and responder 902. Initiator 906 can send a first ranging frame to responder 902. Responder 902 can receive the first ranging frame from initiator 906. In response to receiving the first ranging frame from initiator 906, responder 902 can send a second ranging frame to initiator 906. When initiator 906 receives the second ranging frame from responder 902, initiator 906 can compensate for clock frequency offset and / or carrier frequency offset (CFO) between initiator 906 and responder 902 to improve ranging accuracy. In other words, the clock of responder 902 can operate differently from the clock of initiator 906. Furthermore, although ranging frames sent from both responder 902 and initiator 906 can use the same carrier frequency... When sending data, responder 902 may be calibrated slightly differently from initiator 906, resulting in CFO drift. Responder 902 and initiator 906 can maintain their center frequencies. Send a ranging frame. The initiator 906 can calculate the error offset c in parts per million (ppm). The initiator 906 can then use the formula... Calculate the clock frequency offset c, where It is a round-based RTT, and This is the response time from the responder (902) to the initiator (906). Value It can also be referred to as the inaccuracy factor used to calculate the response time of responder 902 and initiator 906.

[0129] In some respects, the impersonator 904 can attempt to spoof ranging frames sent from the responder 902 to the initiator 906. In other words, the impersonator 904 can attempt to overlap its own transmission with the transmission from the responder 902 to deceive the initiator 906 into believing that its transmission originated from the responder 902. This can be termed mixing (MD) manipulation against SS-TWR. The impersonator 904 can receive transmissions from the responder 902 and at the carrier frequency... It sends its own spoofed transmission. The carrier frequency from the spoofer is 904. It can be less than the carrier frequency sent from responder 902. In some respects, counterfeit 904 can be based on carrier frequency. The received ranging frames are down-converted, and can be based on the carrier frequency. The resulting data is up-converted. The initiator 906 can estimate c based on the carrier frequency offset (CFO) of the signal received from the impersonator 904, if the initiator 906 uses a signal with a carrier frequency... If a spoofed signal is detected, the carrier frequency offset will be unreasonable. This CFO may cause a reduction in the distance calculation between initiator 906 and responder 902. In other words, when responder 902 sends a ranging frame to initiator 906, initiator 906 may incorrectly calculate that responder 902 is closer than it actually is.

[0130] Figure 9B It is shown by Figure 9A Figure 950 illustrates an example of the timing of packets sent by responder 902 and impersonator 904 and received by initiator 906. Responder 902 may send a SYNC preamble 954 from a first position. Impersonator 904 may receive the SYNC preamble 954. Impersonator 904 may send a SYNC preamble 958 from a second position. In other words, impersonator 904 may send a SYNC preamble 958 from a first carrier frequency (…). ) Receives SYNC preamble 954 from responder 902, and can use different carrier frequencies ( Replay / send SYNC preamble 958. In some aspects, the impersonator 904 can replay the SYNC preamble 954 received from the responder 902 as SYNC preamble 958 with higher power. The initiator 906 can receive SYNC preamble 958 from the impersonator 904 as SYNC preamble 962, and can use SYNC preamble 962, sent as SYNC preamble 958, instead of the preamble sent as SYNC preamble 954, to perform ranging with the responder 902. This can produce a distance reduction effect when the initiator 906 calculates the distance between the initiator 906 and the responder 902 based on SYNC preamble 962.

[0131] In some respects, the calculated The changes could vary depending on what would happen if the ranging frame were based on the response from party 902. ,in It is the change of 'c' between responder 902 and counterfeiter 904, and This is the response time for the 902 error. While the 904 error for the counterfeiter may not be changeable. When the impersonator 904 replays the ranging frame sent by the responder 902, the impersonator 904 can change the carrier frequency used to replay the ranging frame. To change Value. In some respects, counterfeit 904 can reduce the calculated value of c by 25 ppm (e.g., This can greatly reduce the distance calculated by the initiator 906.

[0132] Figure 10 This is an example of being configured to detect and prevent wireless location security vulnerabilities (e.g., Figure 9A and Figure 9B The connection flow diagram 1000 illustrates an example of UE 1002 and UE 1004 (illustrated by the MD manipulation vulnerability). UE 1002 may send a ranging message 1006 to UE 1004. UE 1004 may receive the ranging message 1006 from UE 1002. The ranging message 1006 may be, for example, a RIM or RRM. In other words, UE 1002 may be the initiator sending a RIM to UE 1004 as the responder, or UE 1002 may be the responder sending an RRM in response to receiving a RIM from UE 1004. In some aspects, UE 1004 may be a controller that sends an RCM or RCUM to UE 1002 to configure or modify the ranging between UE 1002 and UE 1004. UE 1002 may be a controller that receives configuration messages from UE 1004. In other respects, UE 1002 may be a controller that sends RCM or RCUM to UE 1004 to configure or modify the ranging between UE 1002 and UE 1004. UE 1004 may be a controlled device that receives configuration messages from UE 1002. However, UE 1004 may be configured via RCM or RCUM from UE 1002 to send an RRM with a payload instructing UE 1002 to modify its upcoming transmission, as further described below.

[0133] UE 1004 can be accessed from other devices (e.g., similar to...) Figure 9A and Figure 9BThe impersonating device (904) in the UE receives at least one other ranging message (such as ranging message 1008). Ranging message 1008 may be a replay of ranging message 1006 from UE 1002 with altered attributes (e.g., increased transmit power and / or altered carrier frequency). If UE 1004 bases its ranging on ranging message 1008 instead of ranging message 1006, this could cause UE 1004 to incorrectly calculate its range relative to UE 1002. Since ranging message 1008 can be transmitted with a higher transmit power than ranging message 1006, ranging message 1008 may interfere with UE 1004's reception of ranging message 1006, thus negatively impacting UE 1004's ability to measure ranging message 1006.

[0134] At 1010, UE 1004 can calculate the CFO of the received ranging messages. UE 1004 can compare the calculated CFO with a threshold (e.g., T1). The threshold can be based on a standard or a configuration threshold received from a network device, or it can be calculated based on previous ranging messages received from UE 1002. In some aspects, if the calculated CFO is greater than or equal to the threshold, then at 1012, UE 1004 can configure control information for UE 1002. In other aspects, if the number of times the calculated CFO is greater than or equal to the threshold (e.g., T1) is greater than or equal to a second threshold (e.g., T2), then at 1012, UE 1004 can configure control information for UE 1002. In other words, received ranging messages may have an abnormally large CFO due to normal unstable behavior of UE 1002. However, if the unstable behavior persists over time (e.g., beyond two or four ranging cycles), UE 1004 can determine that the impersonator is repeatedly sending ranging messages with an inappropriately large CFO. UE 1004 can process ranging messages with a calculated CFO less than or equal to a threshold (e.g., CFO < 0.05). T1 or CFO < T1), and ranging messages with a calculated CFO greater than or equal to the threshold can be ignored / skipped / avoided (e.g., CFO). T1 or CFO > T1).

[0135] UE 1004 may send a response message 1014 to UE 1002. Response message 1014 may be an RCUM or RRM. Response message 1014 may include control information configured at 1012. Response message 1014 may include an indicator for UE 1002 to modify its upcoming ranging message in response to UE 1004 detecting a potential security vulnerability. Response message 1014 may be an RCUM or RRM with additional control information for UE 1002 to modify its upcoming transmission. Response message 1014 may be encoded using STS and a payload.

[0136] The control information may include an indicator for UE 1002 to send ranging message set 1018 based on a frequency offset set. The indicator may be, for example, an index to the frequency offset set indicated in the RCM / RCUM sent by UE 1002 to UE 1004 (e.g., if UE 1002 is the controller) or by UE 1004 to UE 1002 (e.g., if UE 1004 is the controller).

[0137] In one aspect, at 1016, UE 1002 may modify the ranging message set 1018 based on a frequency offset set. In some aspects, the frequency offset set may include a single frequency offset, such that UE 1002 transmits each ranging message in the ranging message set based on that single frequency offset. In other aspects, the frequency offset set may be drawn from a pseudo-random sequence, such that UE 1002 transmits each ranging message in the ranging message set based on a discrete but known frequency offset. For example, if the ranging message set 1018 includes a set of RRMs transmitted in response to receiving a set of RIMs from UE 1004, the RIM set may be received at a center frequency, and each RRM in the RRM set may be transmitted with a discrete frequency offset from the center frequency. In another example, if the ranging message set 1018 includes a set of RIMs, each of the RIMs may be transmitted with a known defined frequency offset, such that the center frequency of each RIM in the RIM set is offset from the known defined frequency based on a discrete frequency offset associated with that RIM. UE 1004 can receive ranging message set 1018. At 1022, UE 1004 can process ranging message set 1018 based on control information, for example by decoding and measuring messages with a calculated CFO less than or equal to a threshold (calculated based on the indicated frequency offset set), and by ignoring messages with a calculated CFO greater than or equal to the threshold (calculated based on the indicated frequency offset set). Therefore, if UE 1004 receives other ranging messages (e.g., ranging message set 1020) from the phishing device, UE 1004 can ignore / skip such messages.

[0138] On the other hand, at 1016, UE 1002 may modify each preamble symbol (e.g., each symbol of the SYNC preamble) of each ranging message in the ranging message set 1018 based on a set of frequency offsets. In other words, response message 1014 may indicate multiple frequency offsets, each of which is associated with a preamble symbol of each ranging message in the ranging message set 1018. UE 1002 may transmit each preamble symbol of each ranging message in the ranging message set 1018 based on discrete but known frequency offsets drawn from a pseudo-random sequence. For example, if the ranging message set 1018 includes an RRM set transmitted in response to receiving a RIM set from UE 1004, the RIM set may be received at a center frequency, and each preamble symbol in the RRM set may be transmitted with a discrete frequency offset of the center frequency of the associated RIM. In another example, where the ranging message set 1018 includes a set of RIMs, each preamble symbol in the RIM set can be sent offset from a known defined frequency, such that the center frequency of each preamble symbol in the RIM set is offset from the known defined frequency based on a set of discrete frequency offsets associated with the RIM. In some aspects, UE 1002 can insert guard / empty cycles between preamble symbols for carrier handover. In other words, UE 1002 can fill preamble symbols with a set of guard cycles for carrier handover. Response message 1014 can indicate to UE 1002 whether to fill preamble symbols. UE 1004 can receive the ranging message set 1018. At 1022, UE 1004 can process ranging message set 1018 based on control information, for example by decoding and measuring preamble symbols with a calculated CFO less than or equal to a threshold (calculated based on the indicated frequency offset set), and by ignoring preamble symbols with a calculated CFO greater than or equal to the threshold (calculated based on the indicated frequency offset set). Therefore, if UE 1004 receives other ranging messages (e.g., ranging message set 1020) from the spoofing device, UE 1004 can ignore / skip such messages. Even if the spoofing device can successfully perform MD manipulation on a portion of the preamble, UE 1004 can calculate the CFO of each portion of the preamble and use the remaining portions for processing (e.g., calculating time synchronization, calculating frequency synchronization, performing channel estimation, calculating ToA) to discard portions that may have been affected by the spoofing.

[0139] In some respects, a pair of ranging devices can perform other types of ranging, such as narrowband assisted multi-millisecond (NBA-MMS) ranging. Figure 11AFigure 1100 illustrates an example of a ranging signal set used for NBA-MMS ranging. The ranging signal set may include UWB signals. UWB signals may not exceed -14 dBm. The ranging signal set may include NB signals, such as Bluetooth signals. NB signals may be transmitted at 0 dBm or 20 dBm. The ranging signal set may include a combination of NB signal sets and UWB signal sets.

[0140] For example, the UE can be configured to first transmit NB signal 1102, followed by multiple UWB signals: UWB signal 1104, UWB signal 1106, UWB signal 1108, and UWB signal 1110. NB signal 1102 can be transmitted with a smaller bandwidth but a higher range than the multiple UWB signals. NB signal 1102 can be used to perform a coarse estimation of the timing / frequency offset between the transmitter and receiver radio devices, while the multiple UWB signals can be used to perform a fine estimation of the timing / frequency offset between the transmitter and receiver radio devices. SYNC packets can use less memory to compute more accurate estimates of timing and / or frequency synchronization. Multiple UWB signals can be transmitted in 1-millisecond (ms) cycles.

[0141] NB signal 1102 can be a Bluetooth signal. Multiple UWB signals, including UWB signals 1104, 1106, 1108, and 1110, can include SYNC packets. While using multiple SYNC packets for ranging can improve the accuracy of ranging calculations, ranging cycles without STS (Single-Side Transmission) may be easily counterfeited due to their lower security.

[0142] Figure 11B Figure 1150 illustrates another example of a ranging signal set that can be used for NBA-MMS ranging. The ranging signal set may include a combination of an NB signal set and a UWB signal set. For example, the UE may be configured to first transmit an NB signal 1152, followed by multiple UWB signals, UWB signal 1154, UWB signal 1156, UWB signal 1158, and UWB signal 1160. The NB signal 1152 can be transmitted with a smaller bandwidth but a higher range than the multiple UWB signals. The NB signal 1152 can be used to perform a coarse estimation of the timing / frequency offset between the transmitter radio device and the receiver radio device, and the multiple UWB signals can be used to perform a fine estimation of the timing / frequency offset between the transmitter radio device and the receiver radio device. Multiple UWB signals can be transmitted at a period of 1 ms.

[0143] NB signal 1152 can be a Bluetooth signal. Multiple UWB signals, including UWB signals 1154, 1156, 1158, and 1160, can include SYNC packets and STS. The receiver wireless device can use NB signal 1152 to perform a coarse estimation of timing / frequency offset, use UWB signal 1154 to perform a fine estimation of timing / frequency offset, and use UWB signals 1156, 1158, and 1160 to perform secure ranging. Furthermore, the CFO calculated for STS can be cross-referenced with the CFO calculated for SYNC to detect if an impersonator is attempting to mimic signals from the transmitter wireless device. SYNC packets can use less memory to calculate more accurate estimates of timing and / or frequency synchronization. With improved timing / frequency estimation, STS can be used for security while still using less memory / complexity than NB signal 1152 or UWB signal 1154.

[0144] Figure 12 Figure 1200 illustrates an example of the timing of packets transmitted and received during a ranging session between transmitter 1202 and receiver 1222 in a spoofing scenario. Transmitter 1202 may transmit NB packets 1204 for receiver 1222 to use for coarse timing / frequency synchronization calculations. Spoofer 1212 may receive NB packets 1204 from transmitter 1202 and may use MD manipulation attacks (e.g., using higher power, changing carrier frequency) to replay NB packets 1204 as NB packets 1214. Receiver 1222 may receive NB packets 1214 from spoofer 1212 as NB packets 1224. Due to the attack by spoofer 1212, receiver 1222 may incorrectly calculate the coarse range between transmitter 1202 and receiver 1222 as smaller than normal.

[0145] Then, transmitter 1202 may send SYNC packet 1206 for receiver 1222 to use for fine timing / frequency synchronization calculations. The impersonator 1212 may send SYNC packet 1216 before transmitter 1202 sends SYNC packet 1206 for receiver 1222. This can be referred to as stretching and advance (SA) manipulation against NBA-MMS. The impersonator 1212 may select the code sequence based on indicators, such as the code index in transmitter's NB packet 1204 or the code index indicated by either transmitter 1202 or receiver 1222 in a previous transmission. The impersonator 1212 may send SYNC packet 1216 once based on an MD manipulation attack while sending NB packet 1214, thereby simulating a transmission by transmitter 1202 at a location closer to receiver 1222 than the actual location of transmitter 1202. Receiver 1222 may receive SYNC packet 1216 as SYNC packet 1226 earlier than when receiver 1222 receives SYNC packet 1206 from transmitter 1202. Therefore, receiver 1222 may incorrectly calculate the ToA of the SYNC packet as ToA 1232 instead of ToA 1234.

[0146] Transmitter 1202 may continue to periodically send packets after sending SYNC packet 1206. For example, transmitter 1202 may send SYNC / STS packet 1208 for receiver 1222 to use for ranging. SYNC / STS packet 1208 may be a SYNC packet without security, or it may be an STS packet encrypted using a private key known to transmitter 1202 and receiver 1222. Similar to SYNC packet 1216, impersonator 1212 may send SYNC / STS packet 1218 before transmitter 1202 sends SYNC / STS packet 1208, thereby simulating transmission by transmitter 1202 at a location closer to receiver 1222 than the actual location of transmitter 1202. If SYNC / STS packet 1208 is an STS packet, the impersonator can use random bits to advance SYNC / STS packet 1218 until it receives SYNC / STS packet 1208 from the transmitter, and then can replay bits of SYNC / STS packet 1208 for use in SYNC / STS packet 1218. Receiver 1222 can receive SYNC / STS packet 1218 as SYNC / STS packet 1228 earlier than when receiver 1222 receives SYNC / STS packet 1208 from transmitter 1202. If SYNC / STS packet 1218 is an STS packet, receiver 1222 can interpret SYNC / STS packet 1228 as a noisy but real transmission because the later part of SYNC / STS packet 1228 is a real replay of SYNC / STS packet 1208 from transmitter 1202. Therefore, receiver 1222 may continue to incorrectly calculate the ToA of SYNC / STS packet 1228.

[0147] In summary, even if SYNC / STS packet 1208 includes STS, the counterfeiter 1212 can use SA manipulation techniques to reduce the distance between SYNC packet 1206 and SYNC / STS packet 1208.

[0148] Figure 13 Figure 1300 illustrates an example of the timing of packets received by a receiver wireless device during an SA (Search Engine Assist) spoofing scenario used in a ranging session between wireless devices. The receiver wireless device (such as...) Figure 12 Receiver 1222 in the middle can first receive the counterfeit wireless device (such as...) at time 1304. Figure 12 The impersonator (1212) receives a fake SYNC packet 1306. Then, the receiver wireless device can receive the fake SYNC packet from the real transmitter wireless device (such as...) at time 1302. Figure 12Transmitter 1202 receives genuine SYNC packet 1308. While a spoofed SYNC packet 1306 can be transmitted with a higher power than the genuine SYNC packet 1308, the receiving wireless device can filter out the spoofed SYNC packet 1306 as noise if it can identify it as a false signal, especially if the receiving wireless device knows the code sequence used by the spoofer. Even if the spoofer continues to transmit spoofed SYNC / STS packets 1310 before the transmitter wireless device transmits the genuine SYNC / STS packet 1312, the receiver wireless device can continue to filter out the spoofed SYNC / STS packets 1310 based on its knowledge that the spoofer transmitted the false packet at time 1304 before the genuine packet was transmitted at time 1302.

[0149] Figure 14 This is an example of being configured to detect and prevent wireless location security vulnerabilities (e.g., Figure 12 and Figure 13 The connection flow diagram 1400 illustrates an example of UE 1402 and UE 1404 (illustrated by the SA manipulation vulnerability). UE 1402 may send a ranging message 1406 to UE 1404. UE 1404 may receive the ranging message 1406 from UE 1402. The ranging message 1406 may be, for example, a RIM or RRM. In other words, UE 1402 may be the initiator sending a RIM to UE 1404 as the responder, or UE 1402 may be the responder sending an RRM in response to receiving a RIM from UE 1404. In some aspects, UE 1404 may be a controller that sends an RCM or RCUM to UE 1402 to configure or modify the ranging between UE 1402 and UE 1404. UE 1402 may be a controller that receives configuration messages from UE 1404. In other aspects, UE 1402 may be a controller that sends RCM or RCUM to UE 1404 to configure or modify the ranging between UE 1402 and UE 1404. UE 1404 may be a controlled device that receives configuration messages from UE 1402. However, UE 1404 may be configured to transmit an RRM with a payload via RCM or RCUM from UE 1402, which instructs UE 1402 to modify its upcoming transmission, as further described below. In some aspects, ranging message 1406 may include NB signals, such as Figure 12 NB packet 1204 in the middle. In some aspects, ranging message 1406 may include UWB signals, such as Figure 12 SYNC group 1206 or Figure 12 The SYNC / STS group in the middle is 1208.

[0150] UE 1404 can be accessed from other devices (e.g., similar to...) Figure 12 The impersonating device (i.e., the impersonating party 1212) receives at least one other ranging message (such as ranging message 1408). Ranging message 1408 may be a replay of ranging message 1406 from UE 1402 with altered attributes (e.g., increased transmit power and / or altered carrier frequency). If UE 1404 bases its ranging on ranging message 1408 instead of ranging message 1406, this could cause UE 1404 to incorrectly calculate its range relative to UE 1402. Since ranging message 1408 can be transmitted with a higher transmit power than ranging message 1406, ranging message 1408 may interfere with UE 1404's reception of ranging message 1406, thus negatively impacting UE 1404's ability to measure ranging message 1406. In some aspects, ranging message 1408 may be transmitted before ranging message 1406 is transmitted (e.g., during an SA manipulation attack).

[0151] At 1410, UE 1404 can calculate the CFO of the received ranging messages. UE 1404 can compare the calculated CFO with a threshold (e.g., T1). The threshold can be based on a standard or a configuration threshold received from a network device, or it can be calculated based on previous ranging messages received from UE 1402. In some aspects, if the calculated CFO is greater than or equal to the threshold, then at 1412, UE 1404 can configure control information for UE 1402. In other aspects, if the number of times the calculated CFO is greater than or equal to the threshold (e.g., T1) is greater than or equal to a second threshold (e.g., T2), then at 1412, UE 1404 can configure control information for UE 1402. In other words, received ranging messages may have an abnormally large CFO due to normal instability of UE 1402. However, if the instability persists over time (e.g., beyond two or four ranging cycles), UE 1404 can determine that the impersonator is repeatedly sending ranging messages with an inappropriately large CFO. UE 1404 can process ranging messages with a calculated CFO less than or equal to a threshold (e.g., CFO < 0.05). T1 or CFO < T1), and ranging messages with a calculated CFO greater than or equal to the threshold can be ignored / skipped / avoided (e.g., CFO). T1 or CFO > T1).

[0152] UE 1404 may send a response message 1414 to UE 1402. Response message 1414 may be an RCUM or RRM. Response message 1414 may include control information configured at 1412. Response message 1414 may include an indicator for UE 1402 to modify its upcoming ranging message in response to UE 1404 detecting a potential security vulnerability. Response message 1414 may be an RCUM or RRM with additional control information for UE 1402 to modify its upcoming transmission. Response message 1414 may be encoded using STS and a payload.

[0153] Control information may include an indicator for UE 1402 to transmit ranging message set 1418 based on a code index set. The indicator may be, for example, an index to the code index set indicated in the RCM / RCUM transmitted by UE 1402 to UE 1404 (e.g., if UE 1402 is a controller) or by UE 1404 to UE 1402 (e.g., if UE 1404 is a controller). In some aspects, each code index in the code index set may be associated with a preamble symbol set (e.g., a SYNC symbol set or an STS symbol set). In some aspects, each code index in the code index set may be drawn from a pseudo-random sequence, such as each preamble symbol in ranging message set 1418 being transmitted using a different known code index. In some aspects, code index information may be represented by the code indexes. For example, referring to Table 2, the code index may refer to code index 4, which generates the codeword "0000+-00-00-++++0+-+000+0-0++0-". In some respects, code index information can be derived from tuples ( ) indicates that, among them Symbol indices within a range can use codewords identified by c. For example, referring to Table 2, the code index set may include three tuples defined by [(0, 8, 1) (9, 25, 2), (26, 30, 3)], which define the first part of the codeword with code index 1 defined by the range (0, 8) as "-0000+0-0", the second part of the codeword with code index 2 defined by the range (9, 25) as "000-++0-+---00+00", and the third part of the codeword with code index 3 defined by the range (26, 30) as "-0+0-", thus obtaining the symbol codeword "-0000+0-0000-++0-+---00+00"-0+0-.

[0154] In one aspect, at 1416, UE 1402 may modify the ranging message set 1418 based on the code index set. In some aspects, the code index set may include a single code index, such that UE 1402 transmits each ranging message in the ranging message set based on that single code index. In other aspects, the code index set may be drawn from a pseudo-random sequence, such that UE 1402 transmits each ranging message in the ranging message set based on discrete but known code indices. For example, each ranging message in the ranging message set 1418 may be transmitted based on a code index indicated by response message 1414. In another example, the ranging message set 1418 may each be transmitted based on discrete code indices in the code index set. UE 1404 may receive the ranging message set 1418. At 1422, UE 1404 may process the ranging message set 1418 based on control information, for example, by decoding and measuring messages encoded based on the indicated code index set, and by ignoring messages not encoded based on the indicated code index set. Therefore, if UE 1404 receives other ranging messages (e.g., ranging message set 1420) from a spoofing device, UE 1404 can ignore / skip such messages. In some aspects, UE 1404 can filter ranging message set 1420 based on error indicators of the code index. For example, ranging message 1406 may include an NB signal with an indication of a code index broadcast in an NB packet. UE 1404 can look for ranging messages encoded with error-indicated code indices, thereby allowing UE 1404 to easily identify and filter noise introduced by spoofed ranging message sets that may interfere with the reception of ranging message set 1418.

[0155] On the other hand, at 1416, UE 1402 may encode a portion of the preamble symbols (e.g., each symbol of the SYNC or STS preamble) of each ranging message in the ranging message set 1418 based on a set of code indices. In other words, response message 1414 may indicate multiple code indices using tuples indicating the range of each preamble symbol, where each range is associated with a discrete code index. UE 1402 may transmit each set of preamble symbols for each ranging message in the ranging message set 1418 based on discrete, known code indices drawn from a pseudo-random sequence. For example, each set of preamble symbols in the ranging message set 1418, identified by the tuples in response message 1414, may be encoded using discrete code indices. UE 1404 may receive the ranging message set 1418. At 1422, UE 1404 can process ranging message set 1418 based on control information, for example, by decoding and measuring portions of the preamble of ranging message set 1418 based on a set of tuples associated with the code index set, and by ignoring portions of the preamble of ranging message set 1418 that are not encoded using the set of tuples associated with the code index set. In other words, UE 1404 can perform cross-correlation of the symbol groups in the preamble as indicated by the code index information. Therefore, if UE 1404 receives other ranging messages (e.g., ranging message set 1420) from a spoofing device, UE 1404 can ignore / skip portions of such messages that are not encoded based on the code index set. In some aspects, UE 1404 can identify spoofed ToA (e.g., by performing cross-correlation with the entire preamble block). Figure 13 In UE 1404 can identify sequences transmitted by UE 1402 based on error indicators of previously transmitted code indices. Given a true ToA estimate and prior knowledge of the start of the ranging slot configured for the upcoming ranging message, UE 1404 can ignore / skip spoofings as noise until the expected start of the ranging slot plus the calculated true ToA. UE 1404 can be configured to listen to the channel until the calculated start to save power, or it can discard received samples before the cross-correlation begins. In other respects, UE 1404 can discard / ignore advanced spoofings based on the estimated spoof ToA calculated by UE 1404.

[0156] Figure 15 This is an example of being configured to detect and prevent wireless location security vulnerabilities (e.g., Figure 12 and Figure 13The connection flow diagram 1500 illustrates an example of UE 1502 and UE 1504 (illustrated by the SA manipulation vulnerability). UE 1502 may send a ranging message 1506 to UE 1504. UE 1504 may receive the ranging message 1506 from UE 1502. The ranging message 1506 may be, for example, a RIM or RRM. In other words, UE 1502 may be the initiator sending a RIM to UE 1504 as the responder, or UE 1502 may be the responder sending an RRM in response to receiving a RIM from UE 1504. In some aspects, UE 1504 may be a controller that sends an RCM or RCUM to UE 1502 to configure or modify the ranging between UE 1502 and UE 1504. UE 1502 may be a controller that receives configuration messages from UE 1504. In other aspects, UE 1502 may be a controller that sends RCM or RCUM to UE 1504 to configure or modify ranging between UE 1502 and UE 1504. UE 1504 may be a controlled device that receives configuration messages from UE 1502. However, UE 1504 may be configured to send an RRM with a payload via RCM or RCUM from UE 1502, which instructs UE 1502 to modify its upcoming transmission, as further described below. In some aspects, ranging message 1506 may include NB signals, such as Figure 12 NB packet 1204 in the middle. In some aspects, ranging message 1506 may include UWB signals, such as Figure 12 SYNC group 1206 or Figure 12 The SYNC / STS group in the middle is 1208.

[0157] UE 1504 can be obtained from other devices (e.g., similar to...) Figure 12 The impersonating device (i.e., the impersonator 1212) receives at least one other ranging message (such as ranging message 1508). Ranging message 1508 may be a replay of ranging message 1506 from UE 1502 with altered attributes (e.g., increased transmit power and / or altered carrier frequency). If UE 1504 bases its ranging on ranging message 1508 instead of ranging message 1506, this could cause UE 1504 to incorrectly calculate its range relative to UE 1502. Since ranging message 1508 can be transmitted with a higher transmit power than ranging message 1506, ranging message 1508 may interfere with UE 1504's reception of ranging message 1506, thus negatively impacting UE 1504's ability to measure ranging message 1506. In some aspects, ranging message 1508 may be transmitted before ranging message 1506 is transmitted (e.g., during an SA manipulation attack).

[0158] At 1510, UE 1504 can calculate the CFO of the received ranging messages. UE 1504 can compare the calculated CFO with a threshold (e.g., T1). The threshold can be based on a standard or a configuration threshold received from a network device, or it can be calculated based on previous ranging messages received from UE 1502. In some aspects, if the calculated CFO is greater than or equal to the threshold, then at 1512, UE 1504 can configure control information for UE 1502. In other aspects, if the number of times the calculated CFO is greater than or equal to the threshold (e.g., T1) is greater than or equal to a second threshold (e.g., T2), then at 1512, UE 1504 can configure control information for UE 1502. In other words, received ranging messages may have an abnormally large CFO due to normal unstable behavior of UE 1502. However, if the unstable behavior persists over time (e.g., beyond two or four ranging cycles), UE 1504 can determine that the impersonator is repeatedly sending ranging messages with an inappropriately large CFO. UE 1504 can process ranging messages with a calculated CFO less than or equal to a threshold (e.g., CFO < 0.05). T1 or CFO < T1), and ranging messages with a calculated CFO greater than or equal to the threshold can be ignored / skipped / avoided (e.g., CFO). T1 or CFO > T1).

[0159] UE 1504 may send a response message 1514 to UE 1502. Response message 1514 may be an RCUM or RRM. Response message 1514 may include control information configured at 1512. Response message 1514 may include an indicator for UE 1502 to modify its upcoming ranging messages in response to UE 1504 detecting a potential security vulnerability. Response message 1514 may include an indicator for UE 1502 to configure control information in response to UE 1504 detecting a potential security vulnerability. Response message 1514 may be an RCUM or RRM with additional control information for UE 1502 to modify its upcoming transmissions. Response message 1514 may be encoded using STS and a payload.

[0160] At 1515, UE 1502 may configure control information for UE 1504 in response to receiving an indication that UE 1504 has detected a potential security vulnerability. In other words, UE 1504 may instruct UE 1504 to generate control information for its use based on UE 1502's determination of a potential security vulnerability. UE 1502 may send ranging message 1517 to UE 1504. UE 1504 may receive ranging message 1517 from UE 1502. Ranging message 1517 may include the control information configured at 1515.

[0161] Control information may include an indicator for UE 1504 to send a set of response messages 1518 based on a set of code indices. The indicator may be, for example, an index to the set of code indices indicated in an RCM / RCUM sent by UE 1504 to UE 1502 (e.g., if UE 1504 is a controller) or by UE 1502 to UE 1504 (e.g., if UE 1502 is a controller). In some aspects, each code index in the set of code indices may be associated with a set of preamble symbols (e.g., a set of SYNC symbols or a set of STS symbols). In some aspects, each code index in the set of code indices may be drawn from a pseudo-random sequence, such as each preamble symbol in the set of response messages 1518 being sent using a different known code index. In some aspects, code index information may be represented by the code index. For example, referring to Table 2, a code index may refer to code index 4, which generates the codeword "0000+-00-00-++++0+-+000+0-0++0-". In some respects, code index information can be obtained from tuples ( ) indicates that, among them Symbol indices within a range can use codewords identified by c. For example, referring to Table 2, the code index set may include three tuples defined by [(0, 8, 1), (9, 25, 2), (26, 30, 3)], which define the first part of the codeword with code index 1 defined by the range (0, 8) as "-0000+0-0", the second part of the codeword with code index 2 defined by the range (9, 25) as "000-++0-+---00+00", and the third part of the codeword with code index 3 defined by the range (26, 30) as "-0+0-", thus obtaining the symbol codeword "-0000+0-0000-++0-+---00+00"-0+0-.

[0162] In one aspect, at 1516, UE 1504 may modify the response message set 1518 based on the code index set. In some aspects, the code index set may include a single code index, such that UE 1504 sends each response message in the response message set based on that single code index. In other aspects, the code index set may be drawn from a pseudo-random sequence, such that UE 1504 sends each response message in the response message set based on discrete but known code indices. For example, each response message in the response message set 1518 may be sent based on the code index indicated by the ranging message 1517. In another example, the response message set 1518 may each be sent based on discrete code indices in the code index set. UE 1504 may receive the response message set 1518. At 1522, UE 1502 may process the response message set 1518 based on control information configured at 1515, for example by decoding and measuring messages encoded based on the indicated code index set, and by ignoring messages not encoded based on the indicated code index set. Therefore, if UE 1502 receives other response messages (e.g., response message set 1520) from a spoofing device, UE 1502 can ignore / skip such messages. In some aspects, UE 1502 can filter out response message set 1520 based on error indicators of the code index. For example, response message 1514 may include an NB signal with an indication of a code index broadcast in an NB packet. UE 1502 can look for ranging messages encoded with error-indicated code indexes, thereby allowing UE 1502 to easily identify and filter out noise introduced by the spoofed ranging message set that may interfere with the reception of response message set 1518.

[0163] On the other hand, at 1516, UE 1504 may encode a portion of the preamble symbols (e.g., each symbol of the SYNC or STS preamble) of each response message in the response message set 1518 based on a set of code indices. In other words, ranging message 1517 may indicate multiple code indices using tuples indicating the range of each preamble symbol, where each range is associated with a discrete code index. UE 1504 may transmit each set of preamble symbols for each response message in the response message set 1518 based on discrete, known code indices drawn from a pseudo-random sequence. For example, each set of preamble symbols in the response message set 1518, identified by tuples in ranging message 1517, may be encoded using discrete code indices. UE 1502 may receive the response message set 1518. At 1522, UE 1502 can process response message set 1518 based on control information, such as by decoding and measuring portions of the preamble of response message set 1518 based on a set of tuples associated with the code index set, and by ignoring portions of the preamble of response message set 1518 that are not encoded using the set of tuples associated with the code index set. In other words, UE 1502 can perform cross-correlation on the groups of symbols in the preamble as indicated by the code index information. Therefore, if UE 1502 receives other response messages from a spoofing device (e.g., response message set 1520), UE 1502 can ignore / skip portions of such messages that are not encoded based on the code index set. In some aspects, UE 1502 can identify spoofed ToA (e.g., by performing cross-correlation with the entire preamble group). Figure 13 In UE 1502 can identify sequences transmitted by UE 1504 based on error indicators of previously transmitted code indices. Given a true ToA estimate and prior knowledge of the start of the ranging slot configured for the upcoming ranging message, UE 1502 can ignore / skip spoofings as noise until the expected start of the ranging slot plus the calculated true ToA. UE 1502 can be configured to listen to the channel until the calculated start to save power, or it can discard received samples before the cross-correlation begins. In other respects, UE 1502 can discard / ignore advanced spoofings based on the estimated spoofing ToA calculated by UE 1502.

[0164] Figure 16 This is a flowchart 1600 of a wireless communication method. This method can be performed by a UE (e.g., UE 104, UE 310, UE 350, UE 502, UE 504, UE 552, UE 554, UE 1004, UE 1404; wireless device 404; initiator 906; device 2204). At 1602, the UE can receive ranging messages. For example, 1602 can be performed by... Figure 14 UE 1404 performs this function, and this UE can receive ranging message 1406 from UE 1402. Furthermore, 1602 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0165] In some respects, the UE may send a first RIM to initiate a positioning session. The first ranging message may include an RRM. Reception of the RRM may be in response to the transmission of the RIM. For example, Figure 14 UE 1404 can send a first RIM to UE 1402 to initiate a positioning session. The ranging message 1406 can be an RRM sent by UE 1402 in response to UE 1402 receiving a RIM from UE 1402.

[0166] In some respects, ranging messages may include RIM or RRM. For example, ranging message 1406 may be RIM or RRM.

[0167] At point 1604, the UE can calculate the CFO based on the ranging message. For example, point 1604 can be calculated by... Figure 14 UE 1404 performs this function, which can calculate the CFO at 1410 based on ranging message 1406. Furthermore, 1604 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0168] At 1606, the UE may send a response message including control information for modifying the transmission protocol. The transmission of the response message may be in response to the calculated CFO being greater than or equal to a threshold. The transmission of the response message may also be in response to the calculated CFO being greater than or equal to a second threshold number of times. The response message may be RCUM or RRM. For example, 1606 may be... Figure 14 UE 1404 performs the action, and this UE can send a response message 1414 to UE 1402. Response message 1414 may include control information for UE 1402 to modify the transmission protocol used for ranging message set 1418. The transmission of response message 1414 may be in response to a CFO calculated at 1410 being greater than or equal to a threshold (e.g., T1). Response message 1414 may be RCUM or RRM. Furthermore, 1606 may be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0169] Figure 17This is a flowchart 1700 of a wireless communication method. This method can be performed by a UE (e.g., UE 104, UE 310, UE 350, UE 502, UE 504, UE 552, UE 554, UE 1004, UE 1004; wireless device 404; initiator 906; device 2204). At 1702, the UE can receive ranging messages. For example, 1702 can be performed by... Figure 10 UE 1004 performs this function, and this UE can receive ranging message 1006 from UE 1002. Furthermore, 1702 can be performed by... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0170] At 1704, the UE can calculate the CFO based on the ranging message. For example, 1704 can be calculated by... Figure 10 UE 1004 performs this function, which can calculate the CFO at 1010 based on ranging message 1006. Furthermore, 1704 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0171] At 1705, the UE can calculate the frequency offset set based on a pseudo-random number generator. For example, 1705 can be calculated by... Figure 10 UE 1004 in the example can perform this operation, which allows the frequency offset set to be calculated at position 1012 based on a pseudo-random number generator. Furthermore, position 1705 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0172] At 1706, the UE may send a response message including control information for modifying the transmission protocol. The control information may include the frequency offset set calculated at 1705. The transmission of the response message may be in response to the calculated CFO being greater than or equal to a threshold. For example, 1706 may be... Figure 10 UE 1004 performs the action, and this UE may send a response message 1014 to UE 1002. Response message 1014 may include control information for UE 1002 to modify the transmission protocol for the ranging message set 1018. The control information may include a frequency offset set calculated at 1705. The transmission of response message 1014 may be in response to a CFO calculated at 1010 being greater than or equal to a threshold (e.g., T1). Furthermore, 1706 may be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0173] At 1708, the UE can receive a second ranging message based on a frequency offset set. The second ranging message may include multiple preamble symbols. Each of the multiple preamble symbols may correspond to a different frequency offset in the frequency offset set. For example, 1708 may be derived from... Figure 10 The UE 1004 executes this, and the UE can receive the ranging message set 1018 based on the frequency offset set in the response message 1014. The second ranging message may include multiple preamble symbols. Each of the multiple preamble symbols may correspond to a different frequency offset in the frequency offset set. In other words, each preamble symbol may be transmitted by UE 1002 with a different frequency offset in the frequency offset set. Furthermore, 1708 may be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0174] At 1710, the UE can calculate the CFO set based on the ranging message and the frequency offset set. For example, 1710 can be derived from... Figure 10 UE 1004 executes this, and at 1022, the UE can calculate the CFO set based on the ranging message set 1018 and the frequency offset set in response message 1014. Furthermore, 1710 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0175] At 1712, the UE can process a first subset of multiple preamble symbols corresponding to a first calculated CFO less than or equal to a threshold. For example, 1712 can be... Figure 10 UE 1004 performs the following operation: at 1022, the UE can process a first subset of multiple preamble symbols from each ranging message in the ranging message set 1018, the ranging message set being compared with a first calculated CFO less than or equal to a threshold (e.g., CFO < x or CFO < x). (x) corresponds to this. Furthermore, 1712 can be derived from... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0176] At 1714, the UE can skip or avoid processing a second subset of multiple preamble symbols corresponding to a second calculated CFO greater than or equal to a threshold. For example, 1714 can be... Figure 10 UE 1004 performs the following operation: at 1022, the UE can skip or avoid processing a second subset of multiple preamble symbols from each ranging message in the ranging message set 1018, which is related to a second calculated CFO greater than or equal to a threshold (e.g., CFO > x or CFO 1004). (x) corresponds to this. Furthermore, 1714 can be derived from... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0177] At 1716, the UE can receive the second ranging message based on a frequency offset set by further receiving the second ranging message based on a protection period set. Control information may include an indicator of the protection period set. For example, 1716 may be... Figure 10 UE 1004 performs this action, and the UE can further receive ranging message set 1018 based on the protection period set. The control information included in response message 1014 may include an indicator of the protection period set. In other words, UE 1002 can fill the preamble symbols of at least one ranging message in ranging message set 1018 with the protection period set for carrier handover. Furthermore, 1716 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0178] Figure 18 This is a flowchart 1800 of a wireless communication method. This method can be performed by a UE (e.g., UE 104, UE 310, UE 350, UE 502, UE 504, UE 552, UE 554, UE 1004, UE 1404; wireless device 404; initiator 906; device 2204). At 1802, the UE can receive ranging messages. For example, 1802 can be performed by... Figure 14 UE 1404 performs this function, and this UE can receive ranging message 1406 from UE 1402. Furthermore, 1802 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0179] At position 1804, the UE can calculate the CFO based on the ranging message. For example, position 1804 can be calculated by... Figure 14 UE 1404 performs this function, which can calculate the CFO at 1410 based on ranging message 1406. Furthermore, 1804 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0180] At point 1805, the UE can compute the code index set based on a pseudo-random number generator. For example, point 1805 can be generated by... Figure 14 UE 1404 executes this, and the UE can compute the code index set based on a pseudo-random number generator at 1412. Furthermore, 1805 can be... Figure 1 , Figure 3 or Figure 22Component 198 is executed.

[0181] At 1806, the UE may send a response message including control information for modifying the transmission protocol. The control information may include the code index set calculated at 1805. The transmission of the response message may be in response to the calculated CFO being greater than or equal to a threshold. For example, 1806 may be... Figure 14 UE 1404 performs the action, and this UE may send a response message 1414 to UE 1402. Response message 1414 may include control information for UE 1402 to modify the transmission protocol for ranging message set 1418. The control information may include a set of code indices calculated at 1805. The transmission of response message 1414 may be in response to a CFO calculated at 1410 being greater than or equal to a threshold (e.g., T1). Furthermore, 1806 may be performed by... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0182] At 1808, the UE may receive a second ranging message based on a set of code indices. The second ranging message may include multiple sets of preamble symbols. Each of the multiple sets of preamble symbols may correspond to a different code index in the code index set. Each code index in the code index set may include a tuple comprising (a) a first indicator of the start of the index, (b) a second indicator of the end of the index, or (c) a third indicator of the code used between the start and end of the index. For example, 1808 may be... Figure 14 UE 1404 performs the function, which can receive ranging message set 1418 based on a code index set. One ranging message in ranging message set 1418 may include multiple preamble symbol sets. Each of the multiple preamble symbol sets may correspond to a different code index in the code index set. Each code index in the code index set may include a tuple comprising (a) a first indicator of the start of the index, (b) a second indicator of the end of the index, or (c) a third indicator of the code used between the start and end of the index (e.g., ...). Furthermore, 1808 could be derived from... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0183] At point 1810, the UE may ignore at least one of the ranging messages or the second ranging message that is not based on the code index set. For example, point 1810 may be determined by... Figure 14 UE 1404 executes this, which can ignore at least one ranging message in ranging message set 1418 that is not based on the code index set at 1422. Furthermore, 1810 can be performed by... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0184] Figure 19 This is a flowchart 1900 of a wireless communication method. This method can be performed by a UE (e.g., UE 104, UE 310, UE 350, UE 502, UE 504, UE 552, UE 554, UE 1004, UE 1504; wireless device 404; initiator 906; device 2204). At 1902, the UE can receive ranging messages. For example, 1902 can be performed by... Figure 15 UE 1504 performs this function, and this UE can receive ranging message 1506 from UE 1502. Furthermore, 1902 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0185] At point 1904, the UE can calculate the CFO based on the ranging message. For example, point 1904 can be calculated by... Figure 15 UE 1504 executes this, and the UE can calculate the CFO at 1510 based on ranging message 1506. Furthermore, 1904 can be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0186] At point 1906, the UE may send a response message including control information for modifying the transmission protocol. The control information may include an indicator for modifying the transmission protocol. The transmission of the response message may be in response to a calculated CFO being greater than or equal to a threshold. For example, point 1906 may be... Figure 15 UE 1504 performs the action, and this UE may send a response message 1514 to UE 1502. Response message 1514 may include control information for UE 1502 to modify the transmission protocol used for response message set 1518. The control information may include an indicator for UE 1502 to modify the transmission protocol. The transmission of response message 1514 may be in response to a CFO calculated at 1510 being greater than or equal to a threshold (e.g., T1). Furthermore, 1906 may be... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0187] At point 1908, the UE may receive a second ranging message including second control information. The second control information may include a set of code indexes. For example, point 1908 may be derived from... Figure 15 UE 1504 executes this, and the UE can receive ranging message 1517 from UE 1502, which includes another set of control information. The other set of control information may include a code index set. Furthermore, 1908 can be executed by... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0188] At point 1910, the UE may send a second response message based on a set of code indices for the second control information. Each code index in the code index set may include a tuple comprising (a) a first indicator of the start of the index, (b) a second indicator of the end of the index, and (c) a third indicator of the code. For example, at point 1910, the UE may be able to send a second response message based on a set of code indices for the second control information. Figure 15 UE 1504 performs this action, and the UE can send a set of response messages 1518 based on the set of code indices indicated in ranging message 1517. Furthermore, 1910 can be performed by... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0189] At point 1912, the UE can send a second response message by sending each of the multiple preamble symbol sets based on different code indices in the code index set. For example, point 1912 can be... Figure 15 UE 1504 executes this, which can send each of the multiple preamble symbol sets based on different code indices in the code index set for each response message in the response message set 1518. Furthermore, 1912 can be executed by... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0190] At 1914, the UE can transmit each of the multiple preamble symbol sets between the beginning and end of the index by transmitting each preamble symbol set based on a code. For example, 1914 can be... Figure 15 UE 1504 executes this, and the UE can send each of the multiple preamble symbol sets in the response message set 1518 between the beginning and end of the index based on codes. Furthermore, 1914 can be executed by... Figure 1 , Figure 3 or Figure 22 Component 198 is executed.

[0191] Figure 20 This is a flowchart 2000 of a wireless communication method. This method can be performed by a UE (e.g., UE 104, UE 310, UE 350, UE 502, UE 504, UE 552, UE 554, UE 1002, UE 1402; wireless device 404; responder 902; device 2204). At 2002, the UE can send a first ranging message. For example, 2002 can be performed by… Figure 14UE 1402 executes this function, and this UE can send ranging message 1406 to UE 1404. Furthermore, 2002 can be executed by... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0192] At point 2004, the UE can receive a response message including control information for modifying the transmission protocol. For example, point 2004 can be... Figure 14 UE 1402 executes this, and the UE can receive response message 1414 from UE 1404. Response message 1414 may include control information for modifying the transmission protocol of ranging message set 1418. Furthermore, 2004 may be executed by... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0193] At point 2006, the UE can send a second ranging message based on control information. For example, at point 2006, it can be... Figure 14 UE1402 executes this, and the UE can send ranging message set 1418 based on the control information in response message 1414. Furthermore, 2006 can be executed by... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0194] Figure 21 This is a flowchart 2100 of a wireless communication method. This method can be performed by a UE (e.g., UE 104, UE 310, UE 350, UE 502, UE 504, UE 552, UE 554, UE 1002, UE 1402; wireless device 404; responder 902; device 2204). At 2102, the UE can send a first ranging message. For example, 2102 can be performed by... Figure 14 UE 1402 executes this, and this UE can send ranging message 1406 to UE 1404. Furthermore, 2102 can be... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0195] At 2104, the UE can receive a response message including control information for modifying the transmission protocol. For example, 2104 can be... Figure 14 UE 1402 performs this action, and the UE can receive a response message 1414 from UE 1404. The response message 1414 may include control information for modifying the transmission protocol of the ranging message set 1418. Furthermore, 2104 may be... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0196] At 2105, the UE can populate each of the multiple preamble symbols in the second ranging message based on the protection period set. The second ranging message may include multiple preamble symbols. Control information may include an indicator of the protection period set. For example, 2105 may be... Figure 14 UE 1402 performs this action, and at 1416, the UE can populate each preamble symbol in the multiple preamble symbols of the ranging message set 1418 based on the protection period set. The ranging message set 1418 may include multiple preamble symbols. The control information in the response message 1414 may include an indicator of the protection period set. Furthermore, 2105 may be performed by... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0197] At point 2106, the UE can send a second ranging message based on control information. For example, point 2106 can be... Figure 14 UE1402 executes this, and the UE can send ranging message set 1418 based on the control information in response message 1414. Furthermore, 2106 can be... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0198] At point 2108, the UE can compute the code index set based on a pseudo-random number generator. For example, 2108 can be calculated by... Figure 15 UE 1502 executes this, and the UE can compute the code index set based on a pseudo-random number generator at 1515. Furthermore, 2108 can be... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0199] At 2110, the UE can transmit a second ranging message based on control information by transmitting a second ranging message including a set of code indices in response to the reception of an indicator for modifying the transmission protocol. The control information may include an indicator for modifying the transmission protocol. For example, 2110 may be... Figure 15 UE 1502 performs this action, and the UE may send a ranging message 1517 including a set of code indices in response to the receipt of an indicator for modifying the transmission protocol. The response message 1514 may include an indicator for modifying the transmission protocol. Furthermore, 2110 may be... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0200] At 2112, the UE may receive a second response message based on a set of code indices. The second response message may include multiple sets of preamble symbols. Each of the multiple sets of preamble symbols may correspond to a different code index in the code index set. Each code index in the code index set may include a tuple comprising (a) a first indicator of the start of the index, (b) a second indicator of the end of the index, and (c) a third indicator of the code used between the start and end of the index. For example, 2112 may be... Figure 15 UE 1502 performs this action, and the UE can receive a response message set 1518 based on a code index set. The response message set 1518 may include multiple preamble symbol sets. Each of the multiple preamble symbol sets may correspond to a different code index in the code index set. Furthermore, 2112 may be... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0201] At point 2114, the UE can send a second ranging message based on control information by sending a second ranging message based on a frequency offset set. The control information may include the frequency offset set. For example, 2114 may be generated by... Figure 14 UE 1402 executes this, and the UE can send ranging message set 1418 based on a frequency offset set. The control information indicated in response message 1414 may include an indicator of the frequency offset set. Furthermore, 2114 can be... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0202] At 2116, the UE can transmit the second ranging message based on the frequency offset set by transmitting each of the preamble symbols of the second ranging message based on different frequency offsets in the frequency offset set. For example, 2116 can be transmitted by... Figure 14 UE 1402 performs this function, which can transmit each preamble symbol in the multiple preamble symbols of the ranging message set 1418 based on different frequency offsets in the frequency offset set. Furthermore, 2116 can be performed by... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0203] At point 2118, the UE can send a second ranging message based on control information by sending a second ranging message based on a code index set. The control information may include an indicator of the code index set. For example, 2118 may be sent by... Figure 14UE 1402 executes this, and the UE can send a second ranging message based on a code index set. The control information in response message 1414 may include an indicator of the code index set. Furthermore, 2118 may be executed by... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0204] At 2120, the UE can send the second ranging message based on the code index set by sending each of the multiple preamble symbol sets based on different code indices in the code index set. For example, 2120 can be... Figure 14 UE 1402 executes this, and the UE can send each of the multiple preamble symbol sets in the ranging message set 1418 based on different code indices in the code index set. Furthermore, 2120 can be... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0205] At 2122, the UE can transmit each of the multiple preamble symbol sets of the second ranging message by sending each of the multiple preamble symbol sets between the beginning and end of the index based on a code. For example, 2122 can be... Figure 14 UE 1402 executes this, which can send each of the multiple preamble symbol sets of the ranging message set 1418 between the beginning and end of the index based on codes. Furthermore, 2122 can be executed by... Figure 1 , Figure 3 or Figure 22 Component 199 is executed.

[0206] Figure 22Figure 2200 illustrates an example of a hardware implementation for device 2204. Device 2204 may be a UE, a component of a UE, or implement UE functionality. In some aspects, device 2204 may include at least one cellular baseband processor 2224 (also referred to as a modem) coupled to one or more transceivers 2222 (e.g., cellular RF transceivers). Cellular baseband processor 2224 may include at least one on-chip memory 2224'. In some aspects, device 2204 may also include one or more Subscriber Identity Module (SIM) cards 2220 and at least one application processor 2206 coupled to a Secure Digital Card (SD) card 2208 and a screen 2210. Application processor 2206 may include on-chip memory 2206'. In some aspects, device 2204 may also include a Bluetooth module 2212, a WLAN module 2214, an SPS module 2216 (e.g., a GNSS module), one or more sensor modules 2218 (e.g., a barometric pressure sensor / altimeter; motion sensors such as an inertial measurement unit (IMU), a gyroscope, and / or an accelerometer; light detection and ranging (LIDAR), radio-assisted detection and ranging (RADAR), sound navigation and ranging (SONAR), a magnetometer, audio, and / or other technologies for positioning), an additional memory module 2226, a power supply 2230, and / or a camera 2232. Bluetooth module 2212, WLAN module 2214, and SPS module 2216 may include an on-chip transceiver (TRX) (or in some cases, only a receiver (RX)). Bluetooth module 2212, WLAN module 2214, and SPS module 2216 may include their own dedicated antennas and / or communicate using antenna 2280. Cellular baseband processor 2224 communicates with UE 104 and / or RU associated with network entity 2202 via transceiver 2222 through one or more antennas 2280. Cellular baseband processor 2224 and application processor 2206 may each include computer-readable media / memory 2224', 2206' respectively. Additional memory module 2226 may also be considered as computer-readable media / memory. Each computer-readable media / memory 2224', 2206', 2226 may be non-transitory. Cellular baseband processor 2224 and application processor 2206 are each responsible for general processing, including the execution of software stored on the computer-readable media / memory. When executed by cellular baseband processor 2224 / application processor 2206, the software causes cellular baseband processor 2224 / application processor 2206 to perform the various functions described above. Cellular baseband processor 2224 and application processor 2206 are configured to perform the various functions described above based at least in part on information stored in memory.In other words, the cellular baseband processor 2224 and application processor 2206 can be configured to perform a first subset of the various functions described above without information stored in memory, and can be configured to perform a second subset of the various functions described above based on information stored in memory. The computer-readable medium / memory can also be used to store data manipulated by the cellular baseband processor 2224 / application processor 2206 during software execution. The cellular baseband processor 2224 / application processor 2206 can be a component of the UE 350 and can include at least one memory 360 and / or at least one of a TX processor 368, an RX processor 356, and a controller / processor 359. In one configuration, the device 2204 can be at least one processor chip (modem and / or application) and includes only the cellular baseband processor 2224 and / or application processor 2206, while in another configuration, the device 2204 can be the entire UE (e.g., see [link]). Figure 3 The UE350 includes an additional module of the device 2204.

[0207] As discussed above, component 198 can be configured to receive ranging messages. Component 198 can be configured to calculate the CFO based on the ranging messages. Component 198 can be configured to send a response message including control information for modifying the transmission protocol. The transmission of the response message may be in response to the calculated CFO being greater than or equal to a threshold. Component 198 may be located within cellular baseband processor 2224, application processor 2206, or both cellular baseband processor 2224 and application processor 2206. Component 198 may be one or more hardware components specifically configured to perform the stated process / algorithm, implemented by one or more processors configured to execute the stated process / algorithm, stored in a computer-readable medium for implementation by one or more processors, or some combination thereof. When multiple processors are implemented, the multiple processors may execute the stated process / algorithm individually or in combination. As shown, device 2204 may include a variety of components configured for various functions. In one configuration, device 2204 (and particularly cellular baseband processor 2224 and / or application processor 2206) may include components for receiving ranging messages. Device 2204 may include components for calculating the CFO based on the ranging messages. Device 2204 may include components for sending a response message including control information for modifying the transmission protocol. The transmission of the response message may be in response to the calculated CFO being greater than or equal to a threshold. The control information may include a set of frequency offsets. Device 2204 may include components for calculating the set of frequency offsets based on a pseudo-random number generator. Device 2204 may include components for receiving a second ranging message based on the set of frequency offsets. The second ranging message may include a plurality of preamble symbols. Each of the plurality of preamble symbols may correspond to a different frequency offset in the set of frequency offsets. The control information may include an indicator of a set of guard periods. Device 2204 may include components for receiving the second ranging message by further receiving the second ranging message based on the set of guard periods. Apparatus 2204 may include components for calculating a set of CFOs based on a second ranging message and a frequency offset set. Each CFO in the CFO set may correspond to one of a plurality of preamble symbols. Apparatus 2204 may include components for processing a first subset of the plurality of preamble symbols corresponding to a first calculated CFO less than or equal to a threshold. Apparatus 2204 may include components for skipping or avoiding processing a second subset of the plurality of preamble symbols corresponding to a second calculated CFO greater than or equal to a threshold. Control information may include a set of code indices. Apparatus 2204 may include components for calculating the set of code indices based on a pseudo-random number generator. Apparatus 2204 may include components for receiving a second ranging message based on the set of code indices. Apparatus 2204 may include components for ignoring ranging messages not based on the set of code indices. The second ranging message may include a plurality of preamble symbol sets.Each of the multiple sets of preamble symbols may correspond to a different code index in the code index set. Each code index in the code index set may include a tuple comprising (a) a first indicator of the start of the index, (b) a second indicator of the end of the index, and (c) a third indicator of the code used between the start and end of the index. Control information may include indicators for modifying the transmission protocol. Apparatus 2204 may include components for receiving a second ranging message including second control information. The second control information may include the code index set. Apparatus 2204 may include components for transmitting a second response message based on the code index set. The second response message may include multiple sets of preamble symbols. Apparatus 2204 may include components for transmitting the second response message based on the code index set by transmitting each of the multiple sets of preamble symbols based on a different code index in the code index set. Each code index in the code index set may include a tuple comprising (a) a first indicator of the start of the index, (b) a second indicator of the end of the index, and (c) a third indicator of the code. Apparatus 2204 may include components for sending each of a plurality of preamble symbol sets based on different code indices in a code index set by sending each of a plurality of preamble symbol sets between the start and end of an index based on a code. Apparatus 2204 may include components for further sending a response message in response to a calculated CFO being greater than or equal to a second threshold number of times. Apparatus 2204 may include components for sending a first RIM to initiate a positioning session. The ranging message may include an RRM. Apparatus 2204 may include components for receiving an RRM in response to sending a RIM. The ranging message may include at least one of a RIM or an RRM. The response message may include at least one of an RCUM or an RRM. The component may be component 198 of apparatus 2204 configured to perform the functions described therein. As described above, apparatus 2204 may include a TX processor 368, an RX processor 356, and a controller / processor 359. Therefore, in one configuration, the component may be a TX processor 368, an RX processor 356, and / or a controller / processor 359 configured to perform the functions described therein.

[0208] As discussed above, component 199 can be configured to transmit a first ranging message. Component 199 can be configured to receive a response message including control information for modifying the transmission protocol after the transmission of the first ranging message. Component 199 can be configured to transmit a second ranging message based on the control information. Component 199 may reside within cellular baseband processor 2224, application processor 2206, or both cellular baseband processor 2224 and application processor 2206. Component 199 may be one or more hardware components specifically configured to perform the stated process / algorithm, implemented by one or more processors configured to execute the stated process / algorithm, stored in a computer-readable medium for implementation by one or more processors, or some combination thereof. When multiple processors are implemented, the multiple processors may execute the stated process / algorithm individually or in combination. As shown, device 2204 may include various components configured for various functions. In one configuration, device 2204 (and particularly cellular baseband processor 2224 and / or application processor 2206) may include components for transmitting the first ranging message. Apparatus 2204 may include components for receiving a response message including control information for modifying a transmission protocol after the transmission of a first ranging message. Apparatus 2204 may include components for transmitting a second ranging message based on the control information. The control information may include a frequency offset set. Apparatus 2204 may include components for transmitting the second ranging message based on the control information by transmitting the second ranging message based on the frequency offset set. The second ranging message may include a plurality of preamble symbols. Apparatus 2204 may include components for transmitting the second ranging message based on a frequency offset set by transmitting each of the plurality of preamble symbols based on different frequency offsets in the frequency offset set. The second ranging message may include a plurality of preamble symbols. The control information may include an indicator of a protection period set. Apparatus 2204 may include components for transmitting the second ranging message based on the control information by filling each of the plurality of preamble symbols based on the protection period set. The control information may include a code index set. Apparatus 2204 may include components for transmitting the second ranging message based on the control information by transmitting the second ranging message based on the code index set. The second ranging message may include multiple sets of preamble symbols. The apparatus 2204 may include components for sending the second ranging message based on a code index set by sending each of the multiple preamble symbol sets based on different code indices in the code index set. Each code index in the code index set may include a tuple comprising (a) a first indicator of the start of the index, (b) a second indicator of the end of the index, and (c) a third indicator of the code.Apparatus 2204 may include components for transmitting each of a plurality of preamble symbol sets based on different code indices in a code index set, by transmitting each of a plurality of preamble symbol sets between the start and end of an index based on a code. Control information may include an indicator for modifying the transmission protocol. Apparatus 2204 may include components for transmitting a second ranging message based on the control information by transmitting a second ranging message including the code index set in response to receiving the indicator for modifying the transmission protocol. Apparatus 2204 may include components for calculating the code index set based on a pseudo-random number generator. Apparatus 2204 may include components for receiving a second response message based on the code index set. The second response message may include a plurality of preamble symbol sets. Each of the plurality of preamble symbol sets may correspond to a different code index in the code index set. Each code index in the code index set may include a tuple comprising (a) a first indicator of the start of the index, (b) a second indicator of the end of the index, and (c) a third indicator of the code used between the start and end of the index. The first ranging message may include RIM. The response message may include RRM. The first ranging message may include at least one of RIM or RRM. The response message may include at least one of RCUM or RRM. The component may be a component 199 of device 2204 configured to perform the functions described therein. As described above, device 2204 may include a TX processor 368, an RX processor 356, and a controller / processor 359. Therefore, in one configuration, the component may be a TX processor 368, an RX processor 356, and / or a controller / processor 359 configured to perform the functions described therein.

[0209] It should be understood that the specific order or hierarchy of the boxes in the disclosed process / flowcharts is merely an example of the exemplary method. It should be understood that the specific order or hierarchy of the boxes in the process / flowcharts may be rearranged based on design preferences. Furthermore, some boxes may be combined or omitted. The appended method claims present the elements of various boxes in a sample order, but are not limited to the given specific order or hierarchy.

[0210] The foregoing description is provided to enable any person skilled in the art to practice the various aspects described herein. Various modifications to these aspects will be apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects. Therefore, the claims are not limited to the aspects described herein but should be given the full scope consistent with the language of the claims. Unless specifically stated otherwise, references to elements in the singular form do not mean “one and only one” but rather “one or more.” Terms such as “if,” “when,” and “simultaneously” do not imply a direct temporal relationship or reaction. That is, these phrases, such as “when,” do not imply an immediate action in response to the occurrence of an action or during the occurrence of an action, but simply suggest that if a condition is met, then the action will occur, without requiring a specific or immediate time limit for the occurrence of the action. The word “exemplary” is used herein to mean “serving as an example, instance, or illustration.” Any aspect described herein as “exemplary” is not necessarily to be construed as preferred or superior to other aspects. Unless specifically stated otherwise, the term “some” refers to one or more. Combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B, and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" include any combination of A, B, and / or C, and may include multiple A, multiple B, or multiple C. Specifically, combinations such as "at least one of A, B, or C", "one or more of A, B, or C", "at least one of A, B, and C", "one or more of A, B, and C", and "A, B, C, or any combination thereof" may be only A, only B, only C, A and B, A and C, B and C, or A and B and C, wherein any such combination may contain one or more members of A, B, or C. A set should be interpreted as a collection of elements in which the number of elements is one or more. Therefore, for a set of X, X will include one or more elements. When at least one processor is configured to execute a set of functions, the at least one processor is configured to execute the set of functions individually or in any combination. Therefore, each of the at least one processor can be configured to perform a specific subset of the set of functions, wherein the subset is the complete set, a suitable subset of the set, or an empty subset of the set. If the first device receives data from or sends data to the second device, data can be received / sent directly between the first and second devices, or indirectly between the first and second devices through a set of devices. A device configured to “output” data (such as transmission, signal, or message) can, for example, transmit the data using a transceiver, or can transmit the data to a component of the device that sent the data.A device configured to "acquire" data (such as, transmit, signal, or message) may receive the data, for example, using a transceiver, or may obtain the data from a component of the device receiving the data. Information stored in memory includes instructions and / or data. All structural and functional equivalents of the elements throughout the various aspects described herein that are known to those skilled in the art or will later be known are expressly incorporated herein by reference and are covered by the claims. Furthermore, nothing disclosed herein is intended to be offered to the public, whether or not such disclosure is explicitly recited in the claims. The words "module," "mechanism," "element," "device," etc., cannot replace the word "component." Therefore, no claim element will be construed as a functional component unless the element is explicitly recited using the phrase "component for..."

[0211] As used in this article, the phrase “based on” should not be interpreted as referring to a closed set of information, one or more conditions, one or more factors, etc. In other words, the phrase “based on A” (where “A” can be information, conditions, factors, etc.) should be interpreted as “based on at least A”, unless otherwise stated otherwise.

[0212] The following aspects are merely illustrative and may be combined with other aspects or teachings described herein without limitation.

[0213] Aspect 1 is a method for wireless communication at a user equipment (UE), the method comprising: receiving a ranging message; calculating a carrier frequency offset (CFO) based on the ranging message; and transmitting a response message including control information for modifying a transmission protocol, wherein the transmission of the response message is in response to the calculated CFO being greater than or equal to a threshold.

[0214] Aspect 2 is the method according to aspect 1, wherein the control information includes a frequency offset set.

[0215] Aspect 3 is the method according to aspect 2, the method further comprising calculating the frequency offset set based on a pseudo-random number generator.

[0216] Aspect 4 is the method according to any one of Aspect 2 or 3, the method further comprising receiving a second ranging message based on the frequency offset set.

[0217] Aspect 5 is the method according to aspect 4, wherein the second ranging message includes a plurality of preamble symbols, wherein each of the plurality of preamble symbols corresponds to a different frequency offset in the frequency offset set.

[0218] Aspect 6 is the method according to aspect 5, wherein the control information includes an indicator of a protection cycle set, and receiving the second ranging message includes further receiving the second ranging message based on the protection cycle set.

[0219] Aspect 7 is a method according to any one of Aspects 5 or 6, the method further comprising: calculating a CFO set based on the second ranging message and the frequency offset set, wherein each CFO in the CFO set corresponds to one of the plurality of preamble symbols; processing a first subset of the plurality of preamble symbols corresponding to a first calculated CFO less than or equal to the threshold; and skipping or avoiding processing a second subset of the plurality of preamble symbols corresponding to a second calculated CFO greater than or equal to the threshold.

[0220] Aspect 8 is the method according to any one of aspects 1 to 7, wherein the control information includes a set of code indexes.

[0221] Aspect 9 is the method according to aspect 8, the method further comprising calculating the code index set based on a pseudo-random number generator.

[0222] Aspect 10 is the method according to any one of Aspects 8 or 9, the method further comprising: receiving a second ranging message based on the code index set; and ignoring ranging messages not based on the code index set.

[0223] Aspect 11 is the method according to aspect 10, wherein the second ranging message includes a plurality of preamble symbol sets, wherein each of the plurality of preamble symbol sets corresponds to a different code index in the code index set.

[0224] Aspect 12 is a method according to any one of aspects 8 to 11, wherein each code index in the set of code indexes comprises a tuple comprising: a first indicator of the start of the index; a second indicator of the end of the index; and a third indicator of the code used between the start and the end of the index.

[0225] Aspect 13 is a method according to any one of Aspects 1 to 12, wherein the control information includes an indicator for modifying the transmission protocol, the method further comprising: receiving a second ranging message including second control information, wherein the second control information includes a set of code indexes; and sending a second response message based on the set of code indexes.

[0226] Aspect 14 is the method according to aspect 13, wherein the second response message comprises a plurality of preamble symbol sets, wherein sending the second response message based on the code index set comprises sending each of the plurality of preamble symbol sets based on different code indices in the code index set.

[0227] Aspect 15 is the method according to aspect 14, wherein each code index in the code index set comprises a tuple, the tuple comprising: a first indicator of the start of the index; a second indicator of the end of the index; and a third indicator of the code, wherein sending each of the plurality of preamble symbol sets based on the different code indexes in the code index set comprises sending each of the plurality of preamble symbol sets based on the code between the start and the end of the index.

[0228] Aspect 16 is the method according to any one of aspects 1 to 15, wherein the sending of the response message is further in response to the calculated CFO being greater than or equal to the second threshold number of times.

[0229] Aspect 17 is a method according to any one of aspects 1 to 16, the method further comprising: sending a first ranging initiation message (RIM) to initiate a positioning session, wherein the ranging message includes a ranging response message (RRM), wherein the reception of the RRM is in response to the sending of the RIM.

[0230] Aspect 18 is the method according to any one of aspects 1 to 17, wherein the ranging message includes at least one of a ranging initiation message (RIM) or a ranging response message (RRM).

[0231] Aspect 19 is the method according to any one of aspects 1 to 18, wherein the response message includes at least one of a ranging control update message (RCUM) or a ranging response message (RRM).

[0232] Aspect 20 is a method for wireless communication at a user equipment (UE), the method comprising: transmitting a first ranging message; receiving a response message including control information for modifying a transmission protocol after the transmission of the first ranging message; and transmitting a second ranging message based on the control information.

[0233] Aspect 21 is the method according to aspect 20, wherein the control information includes a frequency offset set, and sending the second ranging message based on the control information includes sending the second ranging message based on the frequency offset set.

[0234] Aspect 22 is the method according to aspect 21, wherein the second ranging message includes a plurality of preamble symbols, wherein sending the second ranging message based on the frequency offset set includes sending each of the plurality of preamble symbols based on different frequency offsets in the frequency offset set.

[0235] Aspect 23 is a method according to any one of aspects 20 to 22, wherein the second ranging message includes a plurality of preamble symbols, wherein the control information includes an indicator of a set of protection periods, wherein sending the second ranging message based on the control information further includes filling each of the plurality of preamble symbols based on the set of protection periods.

[0236] Aspect 24 is a method according to any one of aspects 20 to 23, wherein the control information includes a set of code indexes, and sending the second ranging message based on the control information includes sending the second ranging message based on the set of code indexes.

[0237] Aspect 25 is the method according to aspect 24, wherein the second ranging message comprises a plurality of preamble symbol sets, wherein sending the second ranging message based on the code index set comprises sending each of the plurality of preamble symbol sets based on different code indices in the code index set.

[0238] Aspect 26 is the method according to aspect 25, wherein each code index in the code index set comprises a tuple, the tuple comprising: a first indicator of the start of the index; a second indicator of the end of the index; and a third indicator of the code, wherein sending each of the plurality of preamble symbol sets based on the different code in the code index set comprises sending each of the plurality of preamble symbol sets based on the code between the start and the end of the index.

[0239] Aspect 27 is a method according to any one of aspects 20 to 26, wherein the control information includes an indicator for modifying the transmission protocol, wherein transmitting the second ranging message based on the control information includes transmitting the second ranging message including a set of code indices in response to receiving the indicator for modifying the transmission protocol.

[0240] Aspect 28 is the method according to aspect 27, the method further comprising calculating the code index set based on a pseudo-random number generator.

[0241] Aspect 29 is the method according to aspect 28, the method further comprising receiving a second response message based on the code index set.

[0242] Aspect 30 is the method according to aspect 29, wherein the second response message includes a plurality of preamble symbol sets, wherein each of the plurality of preamble symbol sets corresponds to a different code index in the code index set.

[0243] Aspect 31 is a method according to any one of aspects 27 to 30, wherein each code index in the set of code indexes comprises a tuple comprising: a first indicator of the start of the index; a second indicator of the end of the index; and a third indicator of the code used between the start and the end of the index.

[0244] Aspect 32 is the method according to any one of aspects 20 to 31, wherein the first ranging message includes a ranging initiation message (RIM), and wherein the response message includes a ranging response message (RRM).

[0245] Aspect 33 is the method according to any one of aspects 20 to 32, wherein the first ranging message includes at least one of a ranging initiation message (RIM) or a ranging response message (RRM).

[0246] Aspect 34 is the method according to any one of aspects 20 to 33, wherein the response message includes at least one of a ranging control update message (RCUM) or a ranging response message (RRM).

[0247] Aspect 35 is a wireless device comprising: at least one memory; and at least one processor coupled to the at least one memory and based at least in part on information stored in the at least one memory, the at least one processor being configured individually or in any combination to perform the method according to any one of aspects 1 to 34.

[0248] Aspect 36 is a wireless device comprising components for performing each step of the method according to any one of aspects 1 to 34.

[0249] Aspect 37 is an apparatus according to any one of aspects 1 to 34, the apparatus further comprising a transceiver (e.g., a transceiver coupled to at least one processor in aspect 35), the transceiver being configured to receive or transmit in association with the method according to any one of aspects 1 to 34.

[0250] Aspect 38 is a computer-readable medium (e.g., a non-transitory computer-readable medium) storing computer-executable code that, when executed by at least one processor, causes the at least one processor to perform the method according to any one of aspects 1 to 34.

Claims

1. An apparatus for wireless communication at a user equipment (UE), the apparatus comprising: At least one memory; and At least one processor, coupled to the at least one memory, and configured individually or in any combination, based at least in part on information stored in the at least one memory, to: Receive ranging messages; Calculate the carrier frequency offset (CFO) based on the ranging message; and Send a response message including control information for modifying the transmission protocol, wherein the transmission response of the response message is in response to a calculated CFO greater than or equal to a threshold.

2. The apparatus of claim 1, wherein the control information includes a frequency offset set.

3. The apparatus of claim 2, wherein the at least one processor is further configured, alone or in any combination, to: The frequency offset set is calculated based on a pseudo-random number generator.

4. The apparatus of claim 2, wherein the at least one processor is further configured, alone or in any combination, to: The second ranging message is received based on the frequency offset set.

5. The apparatus of claim 4, wherein the second ranging message comprises a plurality of preamble symbols, wherein each of the plurality of preamble symbols corresponds to a different frequency offset in the frequency offset set.

6. The apparatus according to claim 5, wherein the control information includes an indicator of a protection cycle set, wherein, In order to receive the second ranging message, the at least one processor is configured individually or in any combination to: The second ranging message is further received based on the protection period set.

7. The apparatus of claim 5, wherein the at least one processor is further configured, alone or in any combination, to: The CFO set is calculated based on the second ranging message and the frequency offset set, wherein each CFO in the CFO set corresponds to one of the plurality of preamble symbols; Process a first subset of the plurality of preamble symbols corresponding to a first calculated CFO that is less than or equal to the threshold; as well as Avoid processing a second subset of the multiple preamble symbols corresponding to a second calculated CFO that is greater than or equal to the threshold.

8. The apparatus of claim 1, wherein the control information includes a code index set.

9. The apparatus of claim 8, wherein the at least one processor is further configured, alone or in any combination, to: The code index set is calculated using a pseudo-random number generator.

10. The apparatus of claim 8, wherein the at least one processor is further configured, alone or in any combination, to: The second ranging message is received based on the code index set; and Ignore at least one of the ranging messages or the second ranging message that is not based on the set of code indices.

11. The apparatus of claim 10, wherein the second ranging message comprises a plurality of preamble symbol sets, wherein each of the plurality of preamble symbol sets corresponds to a different code index in the code index set.

12. The apparatus of claim 8, wherein each code index in the code index set comprises a tuple, the tuple comprising: The first indicator of the start of the index; The second indicator of the end of the index; and The third indicator of the code used between the beginning and the end of the index.

13. The apparatus of claim 1, wherein the control information includes an indicator for modifying the transmission protocol, and wherein the at least one processor is further configured, individually or in any combination, to: Receive a second ranging message including second control information, wherein the second control information includes a code index set; and The second response message is sent based on the set of code indexes.

14. The apparatus of claim 13, wherein the second response message comprises a plurality of preamble symbol sets, wherein, In order to send the second response message based on the code index set, the at least one processor is configured individually or in any combination to: Each of the plurality of preamble symbol sets is sent based on a different code index in the code index set.

15. The apparatus of claim 14, wherein each code index in the code index set comprises a tuple, the tuple comprising: The first indicator of the start of the index; The second indicator of the end of the index; and The third indicator of the code, wherein, in order to send each of the plurality of preamble symbol sets based on the different code indices in the code index set, the at least one processor is configured individually or in any combination to: Based on the code, each of the plurality of preamble symbol sets is sent between the start and the end of the index.

16. The apparatus of claim 1, wherein the transmission of the response message further responds to the calculated CFO being greater than or equal to the threshold second threshold number of times.

17. The apparatus of claim 1, further comprising a transceiver coupled to the at least one processor, wherein the at least one processor is configured individually or in any combination to: A first ranging initiation message (RIM) is sent via the transceiver to initiate a positioning session, wherein the ranging message includes a ranging response message (RRM), wherein the reception of the RRM is in response to the sending of the RIM.

18. The apparatus of claim 1, wherein the ranging message includes at least one of a ranging initiation message (RIM) or a ranging response message (RRM).

19. The apparatus of claim 1, wherein the response message includes at least one of a ranging control update message (RCUM) or a ranging response message (RRM).

20. An apparatus for wireless communication at a user equipment (UE), the apparatus comprising: At least one memory; and At least one processor, coupled to the at least one memory, and configured individually or in any combination, based at least in part on information stored in the at least one memory, to: Send the first ranging message; After the transmission of the first ranging message, a response message including control information for modifying the transmission protocol is received; and The second ranging message is sent based on the control information.

21. The apparatus of claim 20, wherein the control information includes a frequency offset set, and wherein the second ranging message includes a plurality of preamble symbols, wherein, In order to send the second ranging message based on the control information, the at least one processor is configured individually or in any combination to: Each of the plurality of preamble symbols is transmitted based on different frequency offsets in the set of frequency offsets.

22. The apparatus of claim 20, wherein the second ranging message comprises a plurality of preamble symbols, and wherein the control information comprises an indicator of a protection period set, wherein, In order to send the second ranging message based on the control information, the at least one processor is configured individually or in any combination to: Each of the plurality of preamble symbols is filled based on the protection period set.

23. The apparatus of claim 20, wherein the control information includes a code index set, wherein, In order to send the second ranging message based on the control information, the at least one processor is configured individually or in any combination to: The second ranging message is sent based on the set of code indexes.

24. The apparatus of claim 23, wherein the second ranging message comprises a plurality of preamble symbol sets, wherein, In order to send the second ranging message based on the code index set, the at least one processor is configured individually or in any combination to: Each of the plurality of preamble symbol sets is sent based on a different code index in the code index set.

25. The apparatus of claim 24, further comprising a transceiver coupled to the at least one processor, wherein each code index in the code index set comprises a tuple, the tuple comprising: The first indicator of the start of the index; The second indicator of the end of the index; and The third indicator of the code, wherein, in order to send each of the plurality of preamble symbol sets based on the different code indices in the code index set, the at least one processor is configured individually or in any combination to: Based on the code, each of the plurality of preamble symbol sets is transmitted via the transceiver between the start and the end of the index.

26. The apparatus of claim 20, wherein the control information includes an indicator for modifying the transmission protocol, wherein, In order to send the second ranging message based on the control information, the at least one processor is configured individually or in any combination to: In response to the receipt of the indicator for modifying the transmission protocol, a second ranging message including a set of code indices is transmitted, wherein the at least one processor is further configured, individually or in any combination, to: The code index set is calculated based on a pseudo-random number generator; and The second response message is received based on the code index set.

27. The apparatus of claim 26, wherein the second response message comprises a plurality of preamble symbol sets, wherein each of the plurality of preamble symbol sets corresponds to a different code index in the code index set.

28. The apparatus of claim 26, wherein each code index in the code index set comprises a tuple, the tuple comprising: The first indicator of the start of the index; The second indicator of the end of the index; and The third indicator of the code used between the beginning and the end of the index.

29. A method for conducting wireless communication at a user equipment (UE), the method comprising: Receive ranging messages; The carrier frequency offset (CFO) is calculated based on the ranging message. as well as Send a response message including control information for modifying the transmission protocol, wherein the transmission response of the response message is in response to a calculated CFO greater than or equal to a threshold.

30. A method for conducting wireless communication at a user equipment (UE), the method comprising: Send the first ranging message; After the first ranging message is sent, a response message including control information for modifying the transmission protocol is received; as well as The second ranging message is sent based on the control information.

Images