A zero-signaling paging method and system compatible with 5G paging mechanism
By using shared keys and broadcast timing to generate paging pilots in 5G systems, the problems of high signaling overhead and low security are solved, realizing a low-power and high-security paging method suitable for rapid deployment of 5G base stations and terminals.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- SHANGHAI HUAPAITE TECHNOLOGY CO LTD
- Filing Date
- 2026-04-28
- Publication Date
- 2026-06-02
AI Technical Summary
The paging mechanism of existing 5G systems suffers from high signaling overhead, complex processes, and predictable vulnerability of pilot signals to attacks, especially at the terminal level where power and resources are consumed.
A shared key and broadcast timing are used to generate paging pilots, replacing traditional paging messages and signaling. The terminal generates paging pilots through cryptographic functions and performs matched filtering detection without changing the paging timing calculation. The base station does not send DCI and PDSCH messages.
It achieves zero signaling overhead, reduces terminal power consumption and enhances security, while being highly compatible with existing 5G networks and can be deployed quickly.
Abstract
Description
Technical Field
[0001] This invention belongs to the field of wireless communication technology, specifically relating to a method and system for generating paging pilots in a fifth-generation (5G) mobile communication system using shared keys and broadcast timing, replacing traditional paging messages and paging scheduling signaling. This invention can be integrated into existing 5G base stations and terminals with minimal modifications, reducing paging signaling overhead and terminal power consumption, and differs from existing paging schemes based on Protocol Secure State Machines (PSSM). Background Technology
[0002] In 5G systems, paging is a crucial means for the network to initiate connections to idle or inactive terminals. Existing paging mechanisms include: - The terminal calculates the paging occasion (PO) based on the DRX period and UE_ID, and determines the time to listen to the physical downlink control channel (PDCCH).
[0003] - At PO, the base station sends downlink control information (DCI format 1-0) scrambled by P-RNTI, indicating the resource location of the paging message on the Physical Downlink Shared Channel (PDSCH).
[0004] - After the terminal decodes the DCI, it further receives the paging message on the PDSCH, parses the UE identity list contained therein, and determines whether it has been paging.
[0005] This mechanism has the following shortcomings: 1. High signaling overhead: Even when not being called, the terminal still needs to periodically decode DCI and PDSCH, consuming power and air interface resources.
[0006] 2. Complex process: Paging involves multiple layers of protocol stack processing, and the latency is uncertain.
[0007] 3. Predictable pilot signals are vulnerable to attack: the scheduling information of paging messages exposes the terminal's activity patterns.
[0008] The inventors have previously submitted a paging scheme based on a Protocol Secure State Machine (PSSM), which achieves completely zero-signaling paging by generating paging timing and paging pilots through an independent paging PSSM. However, this scheme requires the introduction of new state machine logic, resulting in significant modifications to existing 5G networks. This invention focuses on minimizing these modifications: retaining the 5G standard paging timing calculation formula, and only replacing the pilot generated by the paging message key, thereby achieving a zero-signaling paging method that is highly compatible with existing networks and can be deployed quickly. Summary of the Invention
[0009] Core concept definition Concept 1: Shared Key During the initial registration or attachment process, the terminal negotiates a shared key `K_sec` with the core network / base station. This key is retained after the terminal enters the idle state and is not transmitted in plaintext over the air interface.
[0010] Concept 2: Broadcast Timing This refers to common time information such as the system frame number (SFN) and time slot number that the base station periodically broadcasts, which can be obtained independently by both the terminal and the base station.
[0011] Concept 3: Paging Timing This refers to the physical time point at which a terminal periodically wakes up, as defined by the 3GPP standard. It is typically determined by a formula calculated from parameters such as the DRX period and UE_ID, for example, `(SFN + PF_offset) mod T = (T div N)(UE_ID mod N)`. This invention uses this paging timing determination method without any changes.
[0012] Concept 4: Paging Pilot In this invention, the paging message is replaced by a pilot sequence generated by a cryptographic function, the calculation formula of which is: ```P_paging = HMAC-SHA256( K_sec, (SFN || Slot) || UE_ID )``` Where `SFN` and `Slot` are the system frame number and time slot number corresponding to the paging timing, and `UE_ID` is the temporary identity identifier of the target terminal (such as the low-order bits of 5G-S-TMSI). The pilot sequence can be further truncated to a suitable length (such as 32, 64, or 128 symbols).
[0013] Timing relationship description Paging pilots are always generated based on the broadcast timing (SFN, Slot) at the PO time. However, due to resource conflicts or two-step arbitration, the physical transmission time of the base station may not be at the PO time, but may be delayed to a time slot after the PO. Therefore, after waking up at the PO time, the terminal continuously listens within a continuous time window, the length of which can be pre-configured by the network or dynamically adjusted according to the paging resource pool size. Within this window, the terminal performs sliding correlation detection on the received signal and the locally generated pilot copy.
[0014] Technical solution A paging method in a wireless communication system includes the following steps: - Network side: - When the core network triggers paging of the target terminal, the base station calculates the system frame number (SFN) and time slot number corresponding to the paging opportunity (PO) according to the 3GPP standard formula based on the target terminal's DRX configuration and UE_ID.
[0015] - On the physical resources of the PO, the base station does not send PDCCH DCI and PDSCH paging messages, but instead sends a paging pilot P_paging generated based on the target terminal's shared key `K_sec`, the current broadcast timing `(SFN, Slot)`, and the target terminal identifier `UE_ID`.
[0016] - The formula for generating the paging pilot is: `P_paging = PRF( K_sec, (SFN || Slot) ||UE_ID )`, where `PRF` is a cryptographic pseudo-random function (such as HMAC-SHA256).
[0017] - Terminal side: - The terminal calculates the PO in idle state based on the same DRX configuration and UE_ID, and wakes up before that.
[0018] - After the terminal wakes up at the PO, it receives signals within a continuous time window (the window length can be pre-configured by the network or dynamically adjusted).
[0019] - The terminal independently generates the same paging pilot copy using the locally stored `K_sec`, the broadcast timing corresponding to the PO, and its own `UE_ID`.
[0020] - The terminal performs matched filtering (sliding correlation) on the received signal and the local pilot copy, and calculates the correlation peak.
[0021] - If the relevant peak value exceeds the preset threshold, it is determined that the pager is being paged, and then a random access or connection recovery process is initiated; otherwise, the idle state is maintained. Beneficial effects
[0022] 1. Zero signaling overhead: The base station does not need to send DCI and PDSCH paging messages, and the terminal does not need to decode higher-layer signaling, requiring only one matched filtering operation.
[0023] 2. Reduced power consumption: The power consumption of matched filtering operation is much lower than that of complete DCI decoding + PDSCH reception + message parsing, resulting in extended standby time.
[0024] 3. Enhanced security: Paging pilots are generated by keys and broadcast timing, making them unpredictable and preventing attackers from forging valid paging or tracking terminal activity patterns.
[0025] 4. Compatible with existing 5G networks: The paging timing calculation formula and frame structure remain unchanged, and deployment can be achieved with only software upgrades for base stations and terminals. Detailed Implementation
[0026] Example 1: Zero-signaling paging using DCI to indicate resource location Assume that a 5G base station and a terminal UE have negotiated and shared a key `K_sec` (256 bits), the terminal is in an idle state, the DRX period is 1.28 seconds, and the UE_ID is 0x3A7F.
[0027] When the core network needs to page a UE, the base station calculates the next PO (SFN=1024, timeslot=0). The base station decides to use method one (DCI indicating resource). First, the base station generates a paging pilot `P_paging = HMAC-SHA256(K_sec, (1024||0) || 0x3A7F)`, truncating 64 bits. Then, the base station indicates the resource location of the pilot (assumed to be PRB#10, symbols 2-5) using DCI format 1-0 scrambled with P-RNTI. When the base station is at that PO, it first sends the DCI, and then sends the paging pilot on the indicated resource.
[0028] When the terminal wakes up at the PO, it first decodes the DCI to obtain the resource location, and then performs matched filtering detection on the specified resource. If the correlation peak exceeds the threshold, it determines that it has been paged and initiates random access. Although DCI decoding is still required, there is no need to receive PDSCH paging messages, resulting in a significant reduction in power consumption compared to traditional solutions.
[0029] Example 2: Resource location calculation with zero signaling (including two-step arbitration) Similar to Example 1, the base station and terminal negotiate using Method 2. The base station does not send any DCI. Both parties first independently calculate the paging pilot: `P_paging = HMAC-SHA256(K_sec, (1024||0) || 0x3A7F)`, truncating to 64 bits. Simultaneously, both parties independently calculate the resource index: `Resource_idx = HMAC-SHA256(K_sec, (1024||0) || 0x3A7F || "RES") mod 100`. Assume the calculation result is resource index 27.
[0030] After the UE wakes up at PO, it performs a matched filter scan within a window size (e.g., two resources before and after, i.e., resources 25-29) centered on resource index 27. If a correlation peak exceeding the threshold is detected at resource 27, it is determined that it has been paged and initiates random access.
[0031] Industrial applicability This invention can be applied to 5G-Advanced and 6G base stations and terminal chips, can be quickly deployed as a software upgrade, significantly reduces paging signaling overhead and terminal power consumption, and complements existing paging schemes based on PSSM.
Claims
1. A zero-signaling paging method compatible with 5G paging mechanisms, characterized in that, include: The base station determines the paging opportunity (PO) of the target terminal according to the paging opportunity calculation formula defined in the 3GPP standard, and obtains the system frame number (SFN) and time slot number (Slot) corresponding to the PO. The base station generates a paging pilot, which is calculated using the formula P_paging = PRF( K_sec, (SFN ||Slot) || UE_ID ), where K_sec is the shared key, UE_ID is the target terminal identifier, and PRF is a cryptographic pseudo-random function; The base station sends the paging pilot signal; The terminal determines the PO according to the same paging timing calculation formula. When the PO wakes up, it receives the signal and uses the locally stored K_sec, the broadcast timing corresponding to the PO, and its own UE_ID to generate the same paging pilot copy. The terminal performs matched filtering detection on the received signal and the copy. If the relevant peak value exceeds the preset threshold, it is determined that it has been paging.
2. The method according to claim 1, characterized in that, The terminal receives signals within a time window that includes the PO moment, the length of which is pre-configured by the network or dynamically adjusted according to the resource pool size.
3. A wireless communication system, characterized in that, Includes a base station and a terminal for performing the method of claim 1 or 2.