Concurrent flooding and clone attack mitigation

Abstract

Systems and techniques for wireless communication are described. For example, a process can include obtaining a wireless communication message associated with a source identifier (ID), determining that the source ID is associated with a flooding attack. The process can include filtering the wireless communication message associated with the source ID based on determining that the source ID is associated with the flooding attack. Filtering the wireless communication message includes alternating between a first filtering state and a second filtering state. The first filtering state and the second filtering state are associated with different amounts of filtering.

Description

Technical Field

[0001] This disclosure relates in general to mitigation of attacks in wireless communications. For example, aspects of this disclosure relate to mitigation of concurrent flooding and cloning attacks. Background Technology

[0002] Wireless communication systems are widely deployed to provide a variety of telecommunications services, such as telephone, video, data, messaging, and broadcasting. Typical wireless communication systems employ multiple access technologies that enable communication with multiple users by sharing available system resources. Examples of such multiple access technologies include Code Division Multiple Access (CDMA) systems, Time Division Multiple Access (TDMA) systems, Frequency Division Multiple Access (FDMA) systems, Orthogonal Frequency Division Multiple Access (OFDMA) systems, Single Carrier Frequency Division Multiple Access (SC-FDMA) systems, and Time Division Synchronous Code Division Multiple Access (TD-SCDMA) systems.

[0003] These multiple access technologies have been adopted in various telecommunications standards to provide a common protocol that enables different wireless devices to communicate at the city, national, regional, and even global levels. An example telecommunications standard is 5G New Radio (NR). 5G NR is part of the Continuous Evolution of Mobile Broadband (CWB) program issued by the 3rd Generation Partnership Project (3GPP) to meet new requirements associated with latency, reliability, security, scalability (e.g., with the Internet of Things (IoT)), and other requirements. 5G NR includes services associated with enhanced mobile broadband (eMBB), massive machine-type communications (mMTC), and ultra-reliable low-latency communications (URLLC). Some aspects of 5G NR may be based on the 4G Long Term Evolution (LTE) standard. Various aspects of wireless communication may include direct communication between devices, such as in V2X, vehicle-to-vehicle (V2V), and / or device-to-device (D2D) communications. There is a need for further improvements to V2X, V2V, and / or D2D technologies. Furthermore, these improvements may also be applicable to other multiple access technologies and telecommunications standards that adopt them. Summary of the Invention

[0004] The following is a simplified summary of the invention relating to one or more aspects disclosed herein. Therefore, this summary should not be considered an exhaustive overview relating to all conceived aspects, nor should it be considered to identify key or decisive elements relating to all conceived aspects or to depict the scope associated with any particular aspect. Thus, the sole purpose of this summary is to present, in a concise form, certain concepts relating to one or more aspects involving the mechanisms disclosed herein, prior to the detailed description presented below.

[0005] Systems, apparatuses, methods, and computer-readable media for wireless communication are disclosed. According to at least one example, a method for wireless communication is provided. The method includes: obtaining a wireless communication message associated with a source identifier (ID); determining that the source ID is associated with a flooding attack; and filtering the wireless communication message associated with the source ID based on the determination that the source ID is associated with a flooding attack, wherein filtering the wireless communication message includes alternating between a first filtering state and a second filtering state, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

[0006] In another example, an apparatus for wireless communication is provided, the apparatus including at least one memory and at least one processor coupled to the at least one memory. The at least one processor is configured to: obtain a wireless communication message associated with a source identifier (ID); determine that the source ID is associated with a flooding attack; and filter the wireless communication message associated with the source ID based on the determination that the source ID is associated with a flooding attack, wherein filtering the wireless communication message includes alternating between a first filtering state and a second filtering state, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

[0007] In another example, a non-transitory computer-readable medium is provided having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to: obtain a wireless communication message associated with a source identifier (ID); determine that the source ID is associated with a flooding attack; and filter the wireless communication message associated with the source ID based on the determination that the source ID is associated with a flooding attack, wherein filtering the wireless communication message includes alternating between a first filtering state and a second filtering state, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

[0008] In another example, an apparatus for wireless communication is provided. The apparatus includes: components for obtaining wireless communication messages associated with a source identifier (ID); components for determining that the source ID is associated with a flooding attack; and components for filtering the wireless communication messages associated with the source ID based on the determination that the source ID is associated with a flooding attack, wherein filtering the wireless communication messages includes alternating between a first filtering state and a second filtering state, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

[0009] According to at least one additional example, a method for wireless communication is provided. The method includes: obtaining a wireless communication message associated with a source ID; determining a message load indicator indicating a filtering state transition, wherein the message load indicator is associated with the wireless communication message; and transitioning from a first filtering state to a second filtering state based on determining that the message load indicator indicates the filtering state transition, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

[0010] In another example, an apparatus for wireless communication is provided, the apparatus including at least one memory and at least one processor coupled to the at least one memory. The at least one processor is configured to: obtain a wireless communication message associated with a source ID; determine a message load indicator indicating a filter state transition, wherein the message load indicator is associated with the wireless communication message; and transition from a first filter state to a second filter state based on determining that the message load indicator indicates the filter state transition, wherein the first filter state and the second filter state are associated with different filter amounts.

[0011] In another example, a non-transitory computer-readable medium is provided having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to: obtain a wireless communication message associated with a source ID; determine a message load indicator indicating a filter state transition, wherein the message load indicator is associated with the wireless communication message; and transition from a first filter state to a second filter state based on determining that the message load indicator indicates the filter state transition, wherein the first filter state and the second filter state are associated with different filter amounts.

[0012] In another example, an apparatus for wireless communication is provided. The apparatus includes: components for obtaining a wireless communication message associated with a source ID; components for determining that a message load indicator indicates a filter state transition, wherein the message load indicator is associated with the wireless communication message; and components for transitioning from a first filter state to a second filter state based on determining that the message load indicator indicates the filter state transition, wherein the first filter state and the second filter state are associated with different filter amounts.

[0013] In some aspects, the device is a vehicle (e.g., an automobile, truck, etc., or a component or system of an automobile, truck, etc.), or equipment or components of a vehicle, a mobile device (e.g., a mobile phone or so-called "smartphone" or other mobile device), a wearable device, an extended reality device (e.g., a virtual reality (VR) device, an augmented reality (AR) device, or a mixed reality (MR) device), a personal computer, a laptop computer, a server computer, a robotic device, or other equipment, including or part of such equipment. In some aspects, the device includes radio detection and ranging (radar) for capturing radio frequency (RF) signals. In some aspects, the device includes one or more light detection and ranging (LIDAR) sensors, radar sensors, or other light-based sensors for capturing light-based (e.g., light frequency) signals. In some aspects, the device includes one or more cameras for capturing one or more images. In some aspects, the device also includes a display for displaying one or more images, notifications, and / or other displayable data. In some aspects, the device described above may include one or more sensors that can be used to determine the location of the device, the state of the device (e.g., temperature, humidity level, and / or other states), and / or for other purposes.

[0014] This summary is not intended to identify key or essential features of the claimed subject matter, nor is it intended to determine the scope of the claimed subject matter alone. This subject matter should be understood in conjunction with the appropriate portions of the entire specification of this patent, any or all of the accompanying drawings, and each claim.

[0015] Based on the accompanying drawings and detailed description, other objects and advantages associated with the aspects disclosed herein will be apparent to those skilled in the art. Attached Figure Description

[0016] The exemplary aspects of this application are described in detail below with reference to the following figures: Figure 1 This is an illustration of examples of various devices involved in wireless communication during an attacker's concurrent cloning and flooding attack, according to some aspects of this disclosure; Figure 2 This is a diagram illustrating an example wireless communication configuration of a device involved in wireless communication during concurrent cloning and flooding attacks, according to some aspects of this disclosure; Figure 3 These are diagrams illustrating example wireless communication systems according to some aspects of this disclosure; Figure 4 This is an illustration of an example of a decomposed base station architecture according to some aspects of this disclosure, which can be used by the disclosed system to mitigate concurrent cloning and flooding attacks. Figure 5 This is a block diagram illustrating an example of a computing system for a vehicle according to some aspects of this disclosure; Figure 6A This is a flowchart illustrating an example of a concurrent cloning and flood attack mitigation state machine according to some aspects of this disclosure; Figure 6B These are diagrams illustrating waveforms according to some aspects of this disclosure, as shown in Figure 6A Concurrent cloning and flooding attacks mitigate filtering activities during different states of the state machine; Figure 7 This is an example of some aspects of the present disclosure for use in Figure 6A A block diagram of a decision tree for mitigating state transitions between states in a state machine by concurrent cloning and flooding attacks; Figure 8 This is an example of some aspects of the present disclosure for use in Figure 6A Additional diagram of the decision tree for mitigating state transitions between states in a state machine by concurrent cloning and flooding attacks; Figure 9 This is a diagram illustrating examples of vehicle-based messages (shown as sensor-shared messages) according to some aspects of this disclosure; Figure 10 This is a flowchart illustrating an example process for wireless communication according to some aspects of this disclosure; Figure 11 Example computing systems based on various aspects of this disclosure are illustrated. Detailed Implementation

[0017] Certain aspects of this disclosure are provided below for illustrative purposes. Alternative aspects may be devised without departing from the scope of this disclosure. Additionally, well-known elements of this disclosure will not be described in detail or will be omitted so as not to obscure the relevant details of this disclosure. Some aspects described herein can be applied independently, and some of them can be combined, as will be apparent to those skilled in the art. In the following description, specific details are set forth for illustrative purposes to provide a thorough understanding of various aspects of this application. However, it will be apparent that various aspects can be practiced without these specific details. The figures and descriptions are not intended to be limiting.

[0018] The following description provides only exemplary aspects and is not intended to limit the scope, applicability, or configuration of this disclosure. Rather, the following description of the exemplary aspects will provide those skilled in the art with a description that can be used to implement the exemplary aspects. It should be understood that various changes may be made to the function and arrangement of the elements without departing from the spirit and scope of this application as set forth in the appended claims.

[0019] The terms “exemplary” and / or “example” are used herein to mean “serving as an example, instance, or illustration.” Any aspect described herein as “exemplary” and / or “example” is not necessarily to be construed as superior to or better than other aspects. Similarly, the term “aspects of this disclosure” does not require that all aspects of this disclosure include the features, advantages, or modes of operation discussed.

[0020] Wireless communication systems are deployed to provide a variety of telecommunications services, including telephone, video, data, messaging, and broadcasting. Wireless communication systems have undergone several generations of development. The fifth-generation (5G) mobile standard demands higher data transmission speeds, a greater number of connections, better coverage, and other improvements. According to the Next Generation Mobile Networks Alliance, the 5G standard (also known as "New Radio" or "NR") is designed to provide tens of megabits per second of data rate to each of tens of thousands of users.

[0021] Vehicles are examples of systems that may include wireless communication capabilities. For example, vehicles (e.g., motorized vehicles, autonomous vehicles, aircraft, ships, etc.) can communicate with other vehicles and / or other devices with wireless communication capabilities. Wireless vehicle communication systems include vehicle-to-vehicle (V2V), vehicle-to-infrastructure (V2I), vehicle-to-network (V2N), and vehicle-to-pedestrian (V2P) communications, collectively referred to as vehicle-to-everything (V2X) communications. V2X communications are vehicle communication systems that enable the wireless transmission of information from a vehicle to other entities within the transportation system that may affect that vehicle (e.g., other vehicles, pedestrians with smartphones, vulnerable road users (VRUs) equipped with devices such as cyclists, and / or other transportation infrastructure). The primary purpose of V2X technology is to improve road safety, fuel economy, and traffic efficiency.

[0022] The IEEE 802.11p standard supports (uses) the Dedicated Short Range Communication (DSRC) interface for V2X wireless communication. Features of the IEEE 802.11p-based DSRC interface include low latency and the use of the unlicensed 5.9 GHz band. C-V2X is adopted as an alternative to using the IEEE 802.11p-based DSRC interface for wireless communication. The 5G Automotive Association (5GAA) supports the use of C-V2X technology. In some cases, C-V2X technology uses Long Term Evolution (LTE) as the underlying technology, and C-V2X functionality is based on LTE technology. C-V2X includes multiple operating modes. One of these operating modes allows direct wireless communication between vehicles via the LTE sidelink PC5 interface. Similar to the IEEE 802.11p-based DSRC interface, the LTE C-V2X sidelink PC5 interface operates in the 5.9 GHz band. Vehicle-based messages (such as Basic Security Messages (BSM) and Collaborative Awareness Messages (CAM) as application-layer messages) are designed to be broadcast wirelessly over the 802.11p-based DSRC interface and the LTE C-V2X sidelink PC5 interface.

[0023] As used herein, the terms “User Equipment” (UE) and “Network Entity” are not intended to be specific to or otherwise limited to any particular Radio Access Technology (RAT) unless otherwise specified. In general, a UE can be any wireless communication device (e.g., mobile phone, router, tablet computer, laptop computer, and / or tracking device, etc.), wearable device (e.g., smartwatch, smart glasses, wearable ring, and / or extended reality (XR) device (such as virtual reality (VR) headset, augmented reality (AR) headset or glasses, or mixed reality (MR) headset)), vehicle (e.g., car, motorcycle, bicycle, etc.), and / or Internet of Things (IoT) device, etc., for a user to communicate over a wireless communication network. A UE can be mobile or can (e.g., at certain times) be stationary and can communicate with a Radio Access Network (RAN). As used herein, the term "UE" may be interchangeably referred to as "access terminal" or "AT," "client device," "wireless device," "subscriber device," "subscriber terminal," "subscriber station," "user terminal," or "UT," "mobile device," "mobile terminal," "mobile station," or variations thereof. Generally, a UE can communicate with the core network via the RAN, and through the core network, the UE can connect to external networks such as the Internet and to other UEs. Of course, other mechanisms for connecting to the core network and / or the Internet are also possible for the UE, such as through wired access networks, wireless local area network (WLAN) networks (e.g., based on the IEEE 802.11 communication standard), etc.

[0024] In some cases, network entities may be implemented in aggregated or monolithic base station or server architectures, or alternatively, in decomposed base station or server architectures, and may include one or more of a central unit (CU), distributed unit (DU), radio unit (RU), near real-time (near RT) RAN intelligent controller (RIC), or non-real-time (non-RT) RIC. In some cases, network entities may include server equipment, such as multi-access edge computing (MEC) equipment. A base station or server (e.g., having an aggregated / monolithic or decomposed base station architecture) may operate according to one of several RATs based on the network in which the base station or server is deployed to communicate with the UE, roadside unit (RSU), and / or other equipment, and may alternatively be referred to as an access point (AP), network node, node B (NB), evolved node B (eNB), next-generation eNB (ng-eNB), new radio (NR) node B (also referred to as gNB or gNodeB), etc. Base stations are primarily used to support the radio access of the UE, including supporting data, voice, and / or signaling connections for the supported UE. In some systems, the base station can provide edge node signaling functions, while in others, it can provide additional control and / or network management functions. The communication links through which the UE can transmit signals to the base station are called uplink (UL) channels (e.g., reverse traffic channel, reverse control channel, access channel, etc.). The communication links through which the base station can transmit signals to the UE are called downlink (DL) or forward link channels (e.g., paging channel, control channel, broadcast channel, or forward traffic channel, etc.). As used herein, the term traffic channel (TCH) can refer to uplink, reverse or downlink, and / or forward traffic channel.

[0025] The terms "network entity" or "base station" (e.g., having a converged / monolithic base station architecture or a disaggregated base station architecture) can refer to a single physical TRP or multiple physical TRPs that may or may not be co-located. For example, when the term "network entity" or "base station" refers to a single physical TRP, the physical TRP may be a base station antenna corresponding to a cell (or several cell sectors) of the base station. When the term "network entity" or "base station" refers to multiple co-located physical TRPs, these physical TRPs may be antenna arrays of the base station (e.g., as in a multiple-input multiple-output (MIMO) system or where the base station employs beamforming). When the term "base station" refers to multiple non-co-located physical TRPs, the physical TRPs may be a distributed antenna system (DAS) (a network of spatially separated antennas connected via a transmission medium to a common source) or a remote radio headend (RRH) (a remote base station connected to a serving base station). Alternatively, a non-co-located physical TRP may be a serving base station from which a measurement report is received from a UE and a neighboring base station from which the UE is measuring its reference radio frequency (RF) signal (or simply "reference signal"). As used in this article, a TRP is the point by which a base station transmits and receives wireless signals, so any mention of transmitting from or receiving at a base station should be understood as referring to a specific TRP of the base station.

[0026] In some specific implementations supporting UE positioning, network entities or base stations may not support the UE's radio access (e.g., may not support data, voice, and / or signaling connections regarding the UE), but may instead transmit reference signals to the UE for measurement, and / or receive and measure signals transmitted by the UE. Such a base station may be referred to as a positioning beacon (e.g., in the case of transmitting signals to the UE) and / or as a location measurement unit (e.g., in the case of receiving and measuring signals from the UE).

[0027] RSUs can be accessed via communication links or interfaces (e.g., cellular-based sidelinks or PC5 interfaces, 802.11-based or WiFi-based). ™ An RSU is a device that sends and receives messages to and from one or more UEs, other RSUs, and / or base stations via a Dedicated Short Range Communication (DSRC) interface and / or other interfaces. Examples of messages that can be sent and received by an RSU include Vehicle-to-Everything (V2X) messages, which are described in more detail below. An RSU may reside on various transportation infrastructure systems, including roads, bridges, parking lots, toll booths, and / or other infrastructure systems. In some examples, an RSU may facilitate communication between a UE (e.g., a vehicle, pedestrian user equipment, and / or other UE) and the transportation infrastructure system. In some implementations, an RSU may communicate with servers, base stations, and / or other systems that can perform centralized management functions.

[0028] The RSU can communicate with the UE's communication system. For example, the UE's (e.g., a vehicle and / or other UE) Intelligent Transport System (ITS) can be used to generate and sign messages for transmission to the RSU and to verify messages received from the RSU. The RSU can communicate (e.g., via a PC5 interface, DSRC interface, etc.) with vehicles traveling along roads, bridges, or other infrastructure systems to obtain traffic-related data (e.g., vehicle time, speed, location, etc.). In some cases, in response to obtaining traffic-related data, the RSU can determine or estimate traffic congestion information (e.g., the start of traffic congestion, the end of traffic congestion, etc.), travel time, and / or other information for a specific location. In some examples, the RSU can communicate with other RSUs (e.g., via a PC5 interface, DSRC interface, etc.) to determine traffic-related data. The RSU can send information (e.g., traffic congestion information, travel time information, and / or other information) to other vehicles, pedestrian UEs, and / or other UEs. For example, the RSU may broadcast or otherwise send information to any UE (e.g., vehicle, pedestrian UE, etc.) within the RSU's coverage area.

[0029] Radio frequency signals, or “RF signals,” comprise electromagnetic waves of a given frequency that transmit information across the space between a transmitter and a receiver. As used herein, a transmitter may send a single “RF signal” or multiple “RF signals” to a receiver. However, due to the propagation characteristics of RF signals through multipath channels, a receiver may receive multiple “RF signals” corresponding to each transmitted RF signal. The same transmitted RF signal on different paths between the transmitter and receiver may be referred to as a “multipath” RF signal. As used herein, where the context clearly indicates that the term “signal” refers to a wireless signal or RF signal, an RF signal may also be referred to as a “wireless signal” or simply a “signal.”

[0030] As previously mentioned, V2X technology includes V2V communication, which can also be referred to as peer-to-peer communication. V2V communication allows vehicles to communicate wirelessly directly with each other while on the road. Using V2V communication, vehicles can gain situational awareness by receiving information from other vehicles about impending road hazards, such as unforeseen oncoming traffic, accidents, and road conditions.

[0031] In a V2X communication system, information is transmitted from vehicle sensors (and other sources) via a wireless link to allow that information to be communicated to other vehicles, pedestrians, VRUs, and / or transportation infrastructure. This information can be transmitted using one or more vehicle-based messages, such as cellular vehicle-to-everything (C-V2X) messages, which may include Sensor Data Sharing Messages (SDSM), BSM, CAM, Collective Perception Messages (CPM), Distributed Environment Messages (DENM), and / or other types of vehicle-based messages.

[0032] In some cases, an attacker may attempt to disrupt communication in a V2X communication system by performing a flooding attack. In some situations, a UE may determine that a flooding attack is in progress when the total incoming message rate received by the UE and originating from one or more flooding source IDs (e.g., the UE's source ID) exceeds a cumulative message rate threshold for incoming messages to the UE. As used herein, a flooding source ID can be considered any source ID from which the message rate of incoming messages exceeds a source-specific message rate threshold. As used herein, a UE subjected to a flooding attack may be referred to as a flooding attack victim.

[0033] In some situations, attackers may attempt to avoid being identified as flood attackers. For example, an attacker might try to evade detection by cloning the source ID of an RSU and sending a flood message that falsely identifies its source as the cloned source ID. As used herein, an RSU (or UE) whose source ID is cloned by an attacker can be considered a cloning victim. As used herein, a flood attack performed by an attacker using a cloned source ID can be considered a concurrent cloning and flooding attack.

[0034] In some cases, flood victims can respond to flood attacks by temporarily filtering messages from one or more flood source IDs. However, if a legitimate message from a cloned victim arrives at the flood victim while the flood victim is filtering messages from the cloned source ID, the flood victim may miss critical information (e.g., sensor data) contained in the messages from the cloned victim.

[0035] Therefore, there is a need for systems and technologies to defend against flood attacks, and these systems and technologies also prevent flood victims from missing information contained in messages originating from cloned victims during concurrent floods and cloning attacks.

[0036] This article describes systems and techniques for mitigating concurrent cloning and flooding attacks. In some cases, these systems and techniques may include filtering flooded messages from one or more attacking user units (UEs).

[0037] In some cases, these systems and techniques may include alternating between intervals for ignoring messages from the one or more flooding source IDs and intervals for listening for messages from the one or more flooding source IDs. In some examples, different filtering states (e.g., state machine states) may include alternating between intervals for ignoring messages from the one or more flooding source IDs and intervals for listening for messages from the one or more flooding source IDs. In some aspects, different filtering states may have different duty cycles for ignoring messages from the one or more flooding source IDs and different intervals for listening for messages from the one or more flooding source IDs. In some cases, listening for messages from the one or more flooding source IDs during the listening message interval may allow the reception of legitimate messages from a victim UE with a cloned source ID.

[0038] In some specific implementations, the systems and techniques described herein may include determining whether a flooding attack is occurring based on the amount of communication received during a specific time interval.

[0039] In some cases, the systems and techniques described herein can determine whether a transition between filtering states is needed at the end of an evaluation interval. In some examples, determining which filtering state to enter after an evaluation interval may include determining whether a message load indicator exceeded one or more message load thresholds during the evaluation interval. In some cases, one or more message load indicators may be used to determine a threshold for whether a flooding attack is in progress. For example, message load indicators may include, but are not limited to, the total number of incoming messages, the number of incoming messages from various source IDs, the message verification rate, the utilization rate of available message verification capabilities, the operating temperature of the message processing component, etc. In some aspects, when the message load indicator indicates an increased rate of incoming messages, the systems and techniques described herein may increase the filtering duty cycle by ignoring incoming messages from one or more flooding source IDs.

[0040] In some cases, determining whether a message load indicator indicates increased message load may involve comparing the message load indicator to a message processing load threshold. For example, message load thresholds may include, but are not limited to, a threshold number of incoming messages, a threshold number of incoming messages from each source ID, a message verification rate threshold, a utilization threshold of available message verification capabilities, and an operating temperature threshold for the message processing component.

[0041] Figure 1 This is a diagram illustrating an example wireless communication configuration 100 of a device involved in wireless communication during a flooding attack, according to some examples of this disclosure. In some cases, wireless communication configuration 100 may utilize the systems and techniques described herein to prevent and / or reduce the likelihood that a flooding victim will miss legitimate messages from a cloned victim regarding the source ID of the cloned victim during concurrent cloning and flooding attacks. Figure 1 In this example, the wireless communication configuration 100 is shown to include multiple equipped (e.g., V2X-enabled) network devices. These equipped network devices include vehicles (e.g., cars) 110a, 110b and a roadside unit (RSU) 105. These equipped network devices may also include an attacker 115. In the illustrated example, the attacker is shown as a vehicle; however, attacker 115 may include different types of equipped network devices. Multiple unequipped network devices are also shown, including an unequipped vehicle 120, a pedestrian 130, and a VRU 140. Figure 1 Compared to the previous configuration, wireless communication configuration 100 may include more or fewer equipped network devices and / or more or fewer unequipped network devices. Furthermore, wireless communication configuration 100 may include... Figure 1 The example shows a comparison of more or fewer different types of equipped network devices (e.g., which may include equipped UEs) and / or more or fewer different types of unequipped network devices (e.g., which may include unequipped UEs). Furthermore, in one or more examples, the equipped network devices may be equipped with a wide variety of capabilities, including but not limited to C-V2X / DSRC capabilities, 4G / 5G cellular connectivity, GPS capabilities, camera capabilities, radar capabilities, and / or LIDAR capabilities.

[0042] Multiple equipped network devices may be capable of performing V2X communication. Furthermore, at least some of the equipped network devices are configured to transmit and receive sensing signals for radar (e.g., RF sensing signals) and / or LIDAR (e.g., optical sensing signals) to detect nearby vehicles and / or objects. Additionally or alternatively, in some cases, at least some of the equipped network devices may be configured to use one or more cameras to detect nearby vehicles and / or objects (e.g., by processing images captured by said one or more cameras to detect vehicles / objects).

[0043] In some examples, some of the network devices already equipped in the wireless communication configuration 100 may have more powerful sensors (e.g., GPS receivers, cameras, RF antennas, and / or optical lasers and / or optical sensors) compared to other network devices already equipped in the wireless communication configuration 100. For example, vehicle 110b may be a luxury vehicle and therefore has more expensive and more powerful sensors than other vehicles that are economy vehicles. In one exemplary example, vehicle 110b may have a more powerful camera (e.g., with higher resolution capabilities, higher frame rate capabilities, better lenses, etc.) compared to other network devices already equipped in the wireless communication configuration 100.

[0044] During operation of the wireless communication configuration 100, the equipped network device (e.g., RSU 105, and / or at least one of vehicles 110a, 110b) can transmit and / or receive sensing signals (e.g., RF and / or optical signals) to sense and detect vehicles (e.g., vehicles 110a, 110b, attacker 115) and / or objects (e.g., VRU 140 and pedestrian 130) located within and around the road. The equipped network device (e.g., RSU 105 and / or at least one of vehicles 110a, 110b) can then use the sensing signals to determine the characteristics of the detected vehicles and / or objects (e.g., movement, size, type, heading, and speed). The network equipment already in place (e.g., RSU 105, and / or at least one of vehicles 110a, 110b) can generate at least one vehicle-based message 125 (e.g., V2X message, such as SDSM, BSM, CAM, CPM, and / or other types of messages) that includes information related to the determined characteristics of the detected vehicle and / or object.

[0045] Vehicle-based messages 125 may include information related to the detected vehicle or object (e.g., the location of the vehicle or object, the accuracy of the location, the speed of the vehicle or object, the direction the vehicle or object is traveling, and / or other information related to the vehicle or object), traffic conditions (e.g., low-speed and / or dense traffic, high-speed traffic, accident-related information, etc.), weather conditions (e.g., rain, snow, etc.), message type (e.g., emergency message, non-emergency or "regular" message, etc.), road topology (line-of-sight (LOS) or non-LOS (NLOS), etc.), any combination thereof, and / or other information. In some examples, vehicle-based messages 125 may also include information about the preferences of the equipped network devices for receiving vehicle-based messages from certain other equipped network devices. In some cases, the vehicle-based message 125 may include the current capabilities of the equipped network equipment (e.g., vehicles 110a, 110b), such as the sensing capabilities (which may affect the accuracy with which the equipped network equipment senses vehicles and / or objects), processing capabilities, thermal status (which may affect the vehicle's ability to process data), and health status of the equipped network equipment.

[0046] In some aspects, the vehicle-based message 125 may include a dynamic neighbor list (also referred to as a local dynamic map (LDM) or dynamic surrounding map) for each of the equipped network devices (e.g., vehicles 110a, 110b, and RSU 105). For example, each dynamic neighbor list may include a list of all vehicles and / or objects located within a specific predetermined distance (or distance radius) from the corresponding equipped network device. In some cases, each dynamic neighbor list includes a mapping of all vehicles and / or objects located within a specific predetermined distance (or distance radius) from the corresponding equipped network device, which may include road and terrain topology. For example, the predetermined distance may include, but is not limited to, up to one hundred (100) yards, up to one thousand yards (1000), up to one mile, and / or any other predetermined distance. In an exemplary example, the distance (or distance radius) between the equipped network devices and / or objects may be determined based on the location information for the equipped network devices and / or objects included in the vehicle-based message 125 and the current location of the equipped network device that generated the dynamic neighbor list.

[0047] In some cases, messages transmitted during the operation of wireless communication configuration 100 may be critical to the security of vehicles 110a, 110b, pedestrians 130, and / or VRU 140. Therefore, maintaining the security of wireless communication configuration 100 to prevent interference with wireless communication is important. One security concern involves over-the-air (OTA) attacks, where an attacker 115 may attempt to send messages to attack equipped network devices (such as vehicles 110a, 110b). For example, attacker 115 may perform a flooding attack against one or more UEs (e.g., on-board units (OBUs) of vehicles 110a, 110b). In an exemplary example, an attacker may send a large number of messages to a UE to overwhelm its receiver. In some cases, filtering may be performed on sidelink media access control (L2) addresses that send messages to the UE at a rate exceeding a specific single-source threshold message rate. In some examples, to circumvent the single-source threshold message rate, attacker 115 may send messages to the UE that appear to originate from multiple different source L2 addresses. In some implementations, the UE can perform filtering when the total message rate from all L2 addresses exceeds a cumulative message threshold. In an exemplary example, any source L2 address exceeding a single source threshold message rate can be filtered by the UE when the total message rate exceeds the cumulative message threshold. In some cases, filtering source L2 addresses may include filtering incoming messages from filtered source L2 addresses at predetermined time intervals (e.g., nap intervals).

[0048] In some cases, attacker 115 can perform a cloning attack. For example, in a cloning attack, attacker 115 can clone the L2 address of a first victim UE (e.g., RSU 105) and use the cloned address to send messages that a second victim UE (e.g., the OBU of vehicles 110a, 110b) interprets as having arrived from the first victim UE. In some cases, attacker 115 can use the cloned L2 address of the first victim UE in the cloning attack to perform a concurrent flooding attack on the second victim UE. As noted above, in some implementations, flooding by attacker 115 from the cloned L2 address of the first victim UE may cause the second victim UE to filter messages from the cloned L2 address. In some cases, filtering the cloned L2 address may result in both flooded messages from attacker 115 and legitimate messages from the first victim (e.g., RSU 105) being filtered. In some aspects, legitimate messages from the first victim may include critical messages intended for use by the second victim.

[0049] Additional aspects of this disclosure are described in more detail below.

[0050] According to various aspects, Figure 2 An example wireless communication system 200 is illustrated. Wireless communication system 200 (also referred to as a wireless wide area network (WWAN)) may include individual base stations 202 and individual UEs 204. In some aspects, base station 202 may also be referred to as a “network entity” or a “network node.” One or more base stations in base station 202 may be implemented in an aggregated or monolithic base station architecture. Additionally or alternatively, one or more base stations in base station 202 may be implemented in a decomposed base station architecture and may include one or more of a central unit (CU), a distributed unit (DU), a radio unit (RU), a near real-time (near RT) RAN intelligent controller (RIC), or a non-real-time (non-RT) RIC. Base station 202 may include macro cell base stations (high-power cellular base stations) and / or small cell base stations (low-power cellular base stations). In one aspect, macro cell base stations may include eNBs and / or ng-eNBs (where wireless communication system 200 corresponds to a Long Term Evolution (LTE) network), or gNBs (where wireless communication system 200 corresponds to an NR network), or a combination of both, and small cell base stations may include femtocells, picocells, microcells, etc.

[0051] Base station 202 can collectively form a RAN and interface with core network 270 (e.g., evolved packet core (EPC) or 5G core (5GC)) via backhaul link 222, and interface with one or more location servers 272 (which may be part of core network 270 or external to core network 270) via core network 270. Among other functions, base station 202 can perform functions related to one or more of the following: transmitting user data, radio channel encryption and decryption, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection establishment and release, load balancing, distribution of non-access stratum (NAS) messages, NAS node selection, synchronization, RAN sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment tracking, RAN information management (RIM), paging, location, and delivery of warning messages. Base station 202 can communicate with each other directly or indirectly (e.g., via EPC or 5GC) via backhaul link 234 (which may be wired and / or wireless).

[0052] Base station 202 can wirelessly communicate with UE 204. Each base station in base station 202 can provide communication coverage for a corresponding geographical coverage area 210. In one aspect, base station 202 in each coverage area 210 can support one or more cells. A “cell” is a logical communication entity used to communicate with a base station (e.g., on a frequency resource, referred to as a carrier frequency, component carrier, carrier, frequency band, etc.) and can be associated with an identifier (e.g., Physical Cell Identifier (PCI), Virtual Cell Identifier (VCI), Cell Global Identifier (CGI)) to distinguish cells operating via the same or different carrier frequencies. In some cases, different cells can be configured according to different protocol types that can provide access for different types of UEs (e.g., Machine Type Communication (MTC), Narrowband IoT (NB-IoT), Enhanced Mobile Broadband (eMBB), or other protocol types). Because a cell is supported by a specific base station, the term “cell” can refer to either or both of the logical communication entity and the base station supporting the logical communication entity, depending on the context. Furthermore, since the TRP is typically the physical transmission point of the cell, the terms “cell” and “TRP” can be used interchangeably. In some cases, the term "cell" can also refer to the geographic coverage area of ​​a base station (e.g., a sector), as long as a carrier frequency can be detected and used for communication within a portion of the geographic coverage area 210.

[0053] While the geographic coverage areas 210 of adjacent macro cell base stations 202 may partially overlap (e.g., in a handover area), some geographic coverage areas 210 may substantially overlap with larger geographic coverage areas 210. For example, a small cell base station 202' may have a coverage area 210' that substantially overlaps with the coverage areas 210 of one or more macro cell base stations 202. A network that includes both small cell base stations and macro cell base stations may be referred to as a heterogeneous network. A heterogeneous network may also include a home eNB (HeNB) that can provide service to a restricted group referred to as a Closed Subscriber Group (CSG).

[0054] The communication link 220 between base station 202 and UE 204 may include uplink (also known as reverse link) transmission from UE 204 to base station 202 and / or downlink (also known as forward link) transmission from base station 202 to UE 204. Communication link 220 may use MIMO antenna techniques, including spatial multiplexing, beamforming, and / or transmit diversity. Communication link 220 may use one or more carrier frequencies. Carrier allocation may be asymmetric for downlink and uplink (e.g., more or fewer carriers may be allocated to the downlink compared to the uplink).

[0055] The wireless communication system 200 may also include a WLAN AP 250 that communicates with a WLAN station (STA) 252 via a communication link 254 in unlicensed spectrum (e.g., 5 GHz). When communicating in unlicensed spectrum, the WLAN STA 252 and / or WLAN AP 250 may perform a Free Channel Assessment (CCA) or Listen-After-Talk (LBT) process before communication to determine if the channel is available. In some examples, the wireless communication system 200 may include devices (e.g., UEs, etc.) that communicate with one or more UEs 204, base stations 202, APs 250, etc., using ultra-wideband (UWB) spectrum. The UWB spectrum may range from 3.1 GHz to 10.5 GHz.

[0056] Small cell base station 202' can operate in licensed and / or unlicensed spectrum. When operating in unlicensed spectrum, small cell base station 202' can employ LTE or NR technologies and use the same 5 GHz unlicensed spectrum as WLAN AP 250. Small cell base station 202' employing LTE and / or 5G in unlicensed spectrum can enhance coverage of the access network and / or increase the capacity of the access network. NR in unlicensed spectrum may be referred to as NR-U. LTE in unlicensed spectrum may be referred to as LTE-U, Licensed Assisted Access (LAA), or MulteFire.

[0057] The wireless communication system 200 may also include a millimeter-wave (mmW) base station 280, which can operate at mmW and / or near-mmW frequencies to communicate with the UE 282. The mmW base station 280 may be implemented in a converged or monolithic base station architecture, or alternatively, in a decomposed base station architecture (e.g., including one or more of a CU, DU, RU, near-RT RIC, or non-RT RIC). Extremely high frequency (EHF) is a portion of the electromagnetic spectrum that contains radio frequency (RF). EHF has a range of 30 GHz to 300 GHz, with wavelengths between 1 mm and 10 mm. Radio waves in this band are referred to as millimeter waves. Near-mmW extends down to frequencies of 3 GHz with wavelengths of 200 mm. Ultra-high frequency (SHF) bands extend between 3 GHz and 30 GHz, and are also referred to as centimeter waves. Communication using mmW and / or near-mmW radio bands has high path loss and relatively short range. mmW base station 280 and UE 282 can utilize beamforming (transmit and / or receive) on mmW communication link 284 to compensate for extremely high path loss and short range. Furthermore, it should be understood that in alternative configurations, one or more base stations 202 may also use mmW or near-mmW and beamforming for transmission. Therefore, it should be understood that the foregoing illustrations are merely examples and should not be construed as limiting the various aspects disclosed herein.

[0058] Transmit beamforming is a technique used to focus RF signals in a specific direction. Traditionally, when a network node or entity (e.g., a base station) broadcasts an RF signal, it broadcasts the signal in all directions (omnidirectionally). Using transmit beamforming, a network node determines where a given target device (e.g., a UE) is located (relative to the transmitting network node) and projects a stronger downlink RF signal in that specific direction, thus providing the receiving device with a faster and stronger RF signal (in terms of data rate). To change the directivity of the RF signal during transmission, the network node can control the phase and relative amplitude of the RF signal at each of one or more transmitters broadcasting the RF signal. For example, the network node can use an array of antennas (called a "phased array" or "antenna array") that forms an RF beam that can be "manipulated" to be pointed in different directions without actually moving the antennas. Specifically, RF currents from the transmitters are fed to the individual antennas with the correct phase relationship so that radio waves from the individual antennas add together in the desired direction to increase radiation, while canceling each other out in the undesired direction to suppress radiation.

[0059] Transmit beams can be quasi-co-located, meaning they have the same parameters for the receiver (e.g., UE), regardless of whether the transmit antennas of the network nodes are physically co-located. In NR, there are four types of quasi-co-located (QCL) relationships. Specifically, a given type of QCL relationship means that certain parameters of a second reference RF signal on a second beam can be derived from information about the source reference RF signal on the source beam. Therefore, if the source reference RF signal is QCL type A, the receiver can use the source reference RF signal to estimate the Doppler shift, Doppler spread, average delay, and delay spread of the second reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type B, the receiver can use the source reference RF signal to estimate the Doppler shift and Doppler spread of the second reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type C, the receiver can use the source reference RF signal to estimate the Doppler shift and average delay of the second reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type D, the receiver can use the source reference RF signal to estimate the spatial reception parameters of a second reference RF signal transmitted on the same channel.

[0060] In receive beamforming, a receiver uses a receive beam to amplify an RF signal detected on a given channel. For example, the receiver may increase the gain setting of an antenna array in a particular direction and / or adjust the phase setting of the antenna array in a particular direction to amplify the RF signal received from that direction (e.g., increase its gain level). Therefore, when a receiver is said to be beamforming in a certain direction, it means that the beam gain in that direction is higher than the beam gain along other directions, or that the beam gain in that direction is the highest compared to the beam gain of other beams available to the receiver. This results in a stronger received signal strength (e.g., reference signal received power (RSRP), reference signal received quality (RSRQ), signal-to-interference-plus-noise ratio (SINR), etc.) of the RF signal received from that direction.

[0061] The receive beam can be spatially dependent. Spatial dependency means that parameters for the transmit beam for the second reference signal can be derived based on information about the receive beam for the first reference signal. For example, a UE can use a specific receive beam to receive one or more reference downlink reference signals (e.g., Position Reference Signal (PRS), Tracking Reference Signal (TRS), Phase Tracking Reference Signal (PTRS), Cell Specific Reference Signal (CRS), Channel State Information Reference Signal (CSI-RS), Primary Synchronization Signal (PSS), Secondary Synchronization Signal (SSS), Synchronization Signal Block (SSB), etc.) from a network node or entity (e.g., a base station). The UE can then form a transmit beam based on the parameters of the receive beam to transmit one or more uplink reference signals (e.g., Uplink Position Reference Signal (UL-PRS), Sounding Reference Signal (SRS), Demodulation Reference Signal (DMRS), PTRS, etc.) to that network node or entity (e.g., a base station).

[0062] It should be noted that, depending on the entity forming the "downlink" beam, the beam can be either a transmit beam or a receive beam. For example, if a network node or entity (e.g., a base station) is forming a downlink beam to transmit a reference signal to the UE, then the downlink beam is a transmit beam. However, if the UE is forming a downlink beam, then the downlink beam is a receive beam for receiving downlink reference signals. Similarly, depending on the entity forming the "uplink" beam, the beam can be either a transmit beam or a receive beam. For example, if a network node or entity (e.g., a base station) is forming an uplink beam, then the uplink beam is an uplink receive beam, while if the UE is forming an uplink beam, then the uplink beam is an uplink transmit beam.

[0063] In 5G, the spectrum in which wireless network nodes or entities (e.g., base stations 202 / 280, UE 204 / 282) operate is divided into multiple frequency ranges: FR1 (from 450 MHz to 6000 MHz), FR2 (from 24250 MHz to 52600 MHz), FR3 (above 52600 MHz), and FR4 (between FR1 and FR2). In multi-carrier systems such as 5G, one of the carrier frequencies is called the “primary carrier” or “anchor carrier” or “primary serving cell” or “PCell,” and the remaining carrier frequencies are called the “secondary carrier” or “secondary serving cell” or “SCell.” In carrier aggregation, the anchor carrier is the carrier operating on the primary frequency (e.g., FR1) used by UE 204 / 282 and the cell, where UE 204 / 282 performs an initial radio resource control (RRC) connection establishment procedure or initiates an RRC connection re-establishment procedure. The primary carrier carries all common control channels as well as UE-specific control channels and can be a carrier on a licensed frequency (however, this is not always the case). The secondary carrier is a carrier operating on a second frequency (e.g., FR2) that can be configured and used to provide additional radio resources once an RRC connection is established between UE 204 and the anchor carrier. In some cases, the secondary carrier can be a carrier on an unlicensed frequency. The secondary carrier may contain only the necessary signaling information and signals; for example, since the primary uplink and primary downlink carriers are typically UE-specific, those UE-specific signaling information and signals may not be present in the secondary carrier. This means that different UEs 204 / 282 within a cell can have different downlink primary carriers. The same applies to the uplink primary carrier. The network can change the primary carrier of any UE 204 / 282 at any time. This is done, for example, to balance the load on different carriers. Since a “serving cell” (whether PCell or SCell) corresponds to a carrier frequency or component carrier that some base stations are using for communication, the terms “cell,” “serving cell,” “component carrier,” “carrier frequency,” etc., can be used interchangeably.

[0064] For example, still refer to Figure 2 One of the frequencies used by macro cell base station 202 can be an anchor carrier (or "PCell"), and the other frequencies used by macro cell base station 202 and / or mmW base station 280 can be secondary carriers ("SCell"). In carrier aggregation, base station 202 and / or UE 204 can use up to [number missing] frequencies per carrier. Y A spectrum with a bandwidth of MHz (e.g., 5MHz, 10MHz, 15MHz, 20MHz, 200MHz), having up to a total of in each direction. Yx MHz ( x(Multiple component carriers) are used for transmission. Component carriers may or may not be adjacent to each other in the spectrum. Carrier allocation may be asymmetric with respect to the downlink and uplink (e.g., more or fewer carriers may be allocated to the downlink compared to the uplink). Simultaneous transmission and / or reception on multiple carriers allows the UE 204 / 282 to significantly increase its data transmission and / or reception rates. For example, two aggregated 20MHz carriers in a multi-carrier system would theoretically double the data rate (i.e., 40MHz) compared to the data rate obtained by a single 20MHz carrier.

[0065] To operate on multiple carrier frequencies, base station 202 and / or UE 204 are equipped with multiple receivers and / or transmitters. For example, UE 204 may have two receivers, namely "Receiver 1" and "Receiver 2", where "Receiver 1" is a multi-band receiver that can be tuned to band "X" or band "Y", while "Receiver 2" is a single-band receiver that can be tuned to only band "Z". In this example, if UE 204 is being served in band "X", then band "X" will be referred to as PCell or active carrier frequency, and "Receiver 1" will need to tune from band "X" to band "Y" (SCell) to measure band "Y" (and vice versa). In contrast, regardless of whether UE 204 is being served in band "X" or band "Y", due to the separate "Receiver 2", UE 204 can measure band "Z" without interrupting service on band "X" or band "Y".

[0066] The wireless communication system 200 may also include a UE 264, which can communicate with the macro cell base station 202 via communication link 220 and / or with the mmW base station 280 via mmW communication link 284. For example, the macro cell base station 202 may support PCells and one or more SCells for the UE 264, and the mmW base station 280 may support one or more SCells for the UE 264.

[0067] The wireless communication system 200 may also include one or more UEs, such as UE 290, which are indirectly connected to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links (referred to as "side links"). Figure 2In the example, UE 290 has a D2D P2P link 292 with one of UEs 204 connected to one of the base stations in base station 202 (e.g., UE 290 can indirectly obtain cellular connectivity through this D2D P2P link), and has a D2D P2P link 294 with a WLAN STA 252 connected to WLAN AP 250 (UE 290 can indirectly obtain WLAN-based Internet connectivity through this D2D P2P link). In the example, D2D P2P links 292 and 294 can use any known D2D RAT (such as LTE Direct (LTE-D), Wi-Fi Direct (Wi-Fi-D), Bluetooth). ® (etc.) to support.

[0068] Figure 3 This is a diagram illustrating examples of decomposed base station architectures that can be formed by the disclosed systems for event-based networks and blockchains, based on some examples. The deployment of communication systems such as 5G NR systems can be arranged in a variety of ways using various components or constituent parts. In a 5G NR system or network, network nodes, network entities, network mobility elements, radio access network (RAN) nodes, core network nodes, network elements or network equipment (such as base stations (BS)), or one or more units (or components) performing base station functionality can be implemented in aggregated or decomposed architectures. For example, BSs (such as NodeBs (NBs), evolved NBs (eNBs), NR BSs, 5G NBs, APs, transmit / receive points (TRPs), or cells, etc.) can be implemented as aggregated base stations (also known as stand-alone BSs or monolithic BSs) or decomposed base stations.

[0069] Aggregated base stations can be configured to utilize a radio protocol stack that is physically or logically integrated within a single RAN node. Decomposed base stations can be configured to utilize a protocol stack that is physically or logically distributed across two or more units, such as one or more central or centralized units (CUs), one or more distributed units (DUs), or one or more radio units (RUs) (i.e., central or distributed units). In some respects, the CU may be implemented within a RAN node, and one or more DUs may co-located with the CU, or alternatively, may be geographically or virtually distributed across one or more other RAN nodes. DUs may be implemented to communicate with one or more RUs. Each of the CU, DU, and RU may also be implemented as a virtual unit, namely a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU).

[0070] Base station type operation or network design can take into account the aggregation characteristics of base station functionality. For example, decomposed base stations can be utilized in Integrated Access Backhaul (IAB) networks, Open Radio Access Networks (O-RAN (such as network configurations advocated by the O-RAN Alliance)), or Virtualized Radio Access Networks (vRAN, also known as Cloud Radio Access Networks (C-RAN)). Decomposition can include distributing functionality across two or more units in various physical locations, as well as virtually distributing the functionality of at least one unit, which enables flexibility in network design. The various units in a decomposed base station or decomposed RAN architecture can be configured for wired or wireless communication with at least one other unit.

[0071] As mentioned earlier, Figure 3 A diagram illustrating an example of a decomposed base station architecture 301 is shown. The decomposed base station architecture 301 may include one or more central units (CUs) 311, which may communicate directly with the core network 323 via a backhaul link, or indirectly with the core network 323 via one or more decomposed base station units, such as a near real-time (near-RT) RAN Intelligent Controller (RIC) 327 via an E2 link, or a non-real-time (non-RT) RIC 317 associated with a Service Management and Orchestration (SMO) framework 307, or both. CUs 311 may communicate with one or more distributed units (DUs) 331 via corresponding midhaul links (such as F1 interfaces). DUs 331 may communicate with one or more radio units (RUs) 341 via corresponding fronthaul links. RUs 341 may communicate with corresponding UEs 321 via one or more RF access links. In some implementations, a UE 321 may be served simultaneously by multiple RUs 341.

[0072] Each unit in the cells (i.e., CU 311, DU 331, RU 341, and near-RT RIC 327, non-RT RIC 317, and SMO frame 307) may include or be coupled to one or more interfaces configured to receive or transmit signals, data, or information (collectively, signals) via wired or wireless transmission media. Each unit in the cells, or an associated processor or controller providing instructions to the communication interfaces of these units, may be configured to communicate with one or more other units via transmission media. For example, these units may include wired interfaces configured to receive signals or transmit signals to one or more other units via wired transmission media. Additionally, the units may include wireless interfaces that may include receivers, transmitters, or transceivers (such as RF transceivers) configured to receive or transmit signals, or both, to one or more other units over a wireless transmission medium.

[0073] In some aspects, the CU 311 can host one or more higher-level control functions. Such control functions may include Radio Resource Control (RRC), Packet Data Convergence Protocol (PDCP), Serving Data Adaptation Protocol (SDAP), etc. Each control function can be implemented using an interface configured to signal to other control functions hosted by the CU 311. The CU 311 can be configured to handle user plane functionality (i.e., Central Unit-User Plane (CU-UP)), control plane functionality (i.e., Central Unit-Control Plane (CU-CP)), or a combination thereof. In some implementations, the CU 311 can be logically divided into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RAN configuration, the CU-UP units can communicate bidirectionally with the CU-CP units via an interface such as an E1 interface. The CU 311 can be implemented to communicate with the DU 331 for network control and signaling, as needed.

[0074] DU 331 may correspond to a logical unit comprising one or more base station functions for controlling the operation of one or more RU 341s. In some aspects, DU 331 may at least partially host one or more of the Radio Link Control (RLC) layer, Medium Access Control (MAC) layer, and one or more high physical (PHY) layers (such as modules for forward error correction (FEC) encoding and decoding, scrambling, modulation and demodulation, etc.) according to functional splits (such as those defined by the 3rd Generation Partnership Project (3GPP). In some aspects, DU 331 may further host one or more low PHY layers. Each layer (or module) may be implemented using an interface configured to communicate signaling with other layers (and modules) hosted by DU 331 or with control functions hosted by CU 311.

[0075] Lower-layer functionality can be implemented by one or more RU 341s. In some deployments, the RU341 controlled by the DU 331 may correspond to a logical node that is at least partially based on functional decomposition, such as lower-layer functional decomposition, to host RF processing functions or low-PHY layer functions (such as performing Fast Fourier Transform (FFT), Inverse FFT (iFFT), digital beamforming, Physical Random Access Channel (PRACH) extraction and filtering, or both). In such architectures, the RU 341 may be implemented to handle over-the-air (OTA) communications with one or more UE 321s. In some specific implementations, the real-time and non-real-time aspects of communication with the control plane and user plane of the RU 341 may be controlled by the corresponding DU 331. In some scenarios, this configuration allows the DU331 and CU 311 to be implemented in a cloud-based RAN architecture, such as a vRAN architecture.

[0076] SMO framework 307 can be configured to support RAN deployment and provisioning of both non-virtualized and virtualized network elements. For non-virtualized network elements, SMO framework 307 can be configured to support the deployment of dedicated physical resources for RAN coverage requirements, which can be managed via operation and maintenance interfaces such as the O1 interface. For virtualized network elements, SMO framework 307 can be configured to interact with a cloud computing platform such as Open Cloud (O-Cloud) 391 to perform network element lifecycle management (such as instantiating virtualized network elements) via a cloud computing platform interface such as the O2 interface. Such virtualized network elements may include, but are not limited to, CU 311, DU 331, RU 341, and near-RT RIC 327. In some implementations, SMO framework 307 can communicate with the hardware aspects of the 4G RAN (such as Open eNB (O-eNB) 313) via the O1 interface. Additionally, in some implementations, SMO framework 307 can communicate directly with one or more RU 341s via the O1 interface. SMO framework 307 may also include a non-RT RIC 317 configured to support the functionality of SMO framework 307.

[0077] The non-RT RIC 317 can be configured to include logical functions that enable non-real-time control and optimization of RAN elements and resources, including artificial intelligence / machine learning (AI / ML) workflows for model training and updates, or policy-based guidance for applications / features in the near-RT RIC 327. The non-RT RIC 317 can be coupled to or communicate with the near-RT RIC 327, such as via an A1 interface. The near-RT RIC 327 can be configured to include logical functions that enable near real-time control and optimization of RAN elements and resources via an interface, such as via an E2 interface, connecting one or more CUs 311, one or more DUs 331, or both, and an O-eNB 313 to the near-RT RIC 327.

[0078] In some implementations, to generate AI / ML models to be deployed in the near-RT RIC 327, the non-RT RIC 317 may receive parameters or external enrichment information from an external server. This information can be utilized by the near-RT RIC 327 and may be received from non-network data sources or network functions at the SMO framework 307 or the non-RT RIC 317. In some examples, the non-RT RIC 317 or near-RT RIC 327 may be configured to tune RAN behavior or performance. For example, the non-RT RIC 317 may monitor long-term trends and patterns in performance and perform corrective actions using the AI / ML model via the SMO framework 307 (such as reconfiguration via O1) or by creating RAN management policies (such as A1 policies).

[0079] Figure 4 Examples of different communication mechanisms used by various UEs are illustrated. In one example of sidelink communication, Figure 4 Examples illustrate vehicles 404, 405, and RSU 403 communicating with each other using PC5, DSRC, or other device-to-device direct signaling interfaces. Additionally, vehicles 404 and 405 can communicate with base station (BS) 402 using a network (Uu) interface. In some examples, BS 402 may include a gNB. Figure 4 User equipment 407, which communicates with BS 402 using a network (Uu) interface, is also illustrated. As described below, functionality can be transferred from a vehicle (e.g., vehicle 404) to the user equipment (e.g., user equipment 407) based on one or more characteristics or factors (e.g., temperature, humidity, etc.). In an illustrative example, V2X functionality can be transferred from vehicle 404 to user equipment 407, after which user equipment 407 can communicate with other vehicles (e.g., vehicle 405) via a PC5 interface (or other device-to-device direct interfaces, such as a DSRC interface), as... Figure 4 As shown.

[0080] Although Figure 4An example is illustrated of a specific number of vehicles (e.g., two vehicles 404 and 405) communicating with each other and / or with RSU 403, BS 402, and / or User Equipment 407, but this disclosure is not limited thereto. For example, dozens or hundreds of such vehicles may be communicating with each other and / or with RSU 403, BS 402, and / or User Equipment 407. At any given time, each such vehicle, RSU 403, BS 402, and / or User Equipment 407 may send various types of information as messages to other nearby vehicles, such that each vehicle (e.g., vehicle 404 and / or 405), RSU 403, BS 402, and / or User Equipment 407 receives hundreds or thousands of messages per second from other nearby vehicles, RSUs, base stations, and / or other UEs.

[0081] Although Figure 4 The PC5 interface is shown, but various UEs (e.g., vehicles, user equipment, etc.) and RSUs can use any suitable type of direct interface (such as 802.11 DSRC interface, Bluetooth, etc.). ™ Direct communication can be achieved through interfaces and / or other interfaces. For example, a vehicle can communicate with a user equipment (UE) via a direct communication interface (e.g., using PC5 and / or DSRC), a vehicle can communicate with another vehicle via a direct communication interface, a UE can communicate with another UE via a direct communication interface, a UE (e.g., a vehicle, UE, etc.) can communicate with an RSU via a direct communication interface, an RSU can communicate with another RSU via a direct communication interface, and so on.

[0082] Figure 5This is a block diagram illustrating an example of a vehicle computing system 550 for a vehicle 504. The vehicle 504 is an example of a UE that can communicate with a network (e.g., eNB, gNB, location beacon, location measurement unit, and / or other network entities) via a Uu interface and can communicate with other UEs using V2X communication via a PC5 interface, a C-V2X interface, or other device-to-device direct interfaces (such as a DSRC interface). As shown, the vehicle computing system 550 may include at least a power management system 551, a control system 552, an infotainment system 554, an intelligent transmission system (ITS) 555, one or more sensor systems 556, and a communication system 558. In some cases, the vehicle computing system 550 may include any type of processing device or system or may be implemented using any type of processing device or system, such as one or more central processing units (CPUs), digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), application processors (APs), graphics processing units (GPUs), vision processing units (VPUs), neural network signal processors (NSPs), microcontrollers, special-purpose hardware, any combination thereof, and / or other processing devices or systems.

[0083] Control system 552 may be configured to control the operation of one or more of the following systems of vehicle 504: power management system 551, computing system 550, infotainment system 554, ITS 555, and / or other systems of vehicle 504 (e.g., braking system, steering system, safety systems other than ITS 555, cockpit systems, and / or other systems). In some examples, control system 552 may include one or more electronic control units (ECUs). ECUs may control one or more of the electrical systems or subsystems in the vehicle. Examples of specific ECUs that may be included as part of control system 552 include engine control module (ECM), powertrain control module (PCM), transmission control module (TCM), brake control module (BCM), central control module (CCM), central timing module (CTM), etc. In some cases, control system 552 may receive sensor signals from one or more sensor systems 556 and may communicate with other systems of vehicle computing system 550 to operate vehicle 504.

[0084] The vehicle computing system 550 also includes a power management system 551. In some embodiments, the power management system 551 may include a power management integrated circuit (PMIC), a backup battery, and / or other components. In some cases, other systems of the vehicle computing system 550 may include one or more PMICs, batteries, and / or other components. The power management system 551 may perform power management functions of the vehicle 504, such as managing the power supply to the computing system 550 and / or other parts of the vehicle. For example, the power management system 551 may provide a stable power supply in response to power fluctuations, such as those based on starting the vehicle's engine. In another example, the power management system 551 may perform thermal monitoring operations, such as by checking the ambient and / or transistor junction temperatures. In another example, the power management system 551 may perform certain functions based on the detection of a certain temperature level, such as cooling certain components of the vehicle computing system 550 (e.g., control system 552, such as one or more ECUs) by a cooling system (e.g., one or more fans, air conditioning system, etc.), shutting down certain functions of the vehicle computing system 550 (e.g., limiting the infotainment system 554, such as by turning off one or more displays, disconnecting from the wireless network, etc.), and other functions.

[0085] The vehicle computing system 550 also includes a communication system 558. The communication system 558 may include communication methods for communicating with a network (e.g., via a Uu interface to a gNB or other network entity) and / or with other UEs (e.g., via a PC5 interface, a WiFi interface (e.g., DSRC), Bluetooth). ™ Both software and hardware components that transmit signals to and from another vehicle or UE via an interface and / or other wireless and / or wired interfaces, and receive signals from that network and / or from that other UE. For example, communication system 558 is configured to transmit signals via any suitable wireless network (e.g., 3G network, 4G network, 5G network, WiFi network, Bluetooth). ™ The communication system 558 wirelessly transmits and receives information via a network and / or other networks. The communication system 558 includes various components or devices for performing wireless communication functionality, including an Original Equipment Manufacturer (OEM) subscriber identity module (referred to as a SIM or SIM card) 560, a subscriber SIM 562, and a modem 564. Although the vehicle computing system 550 is shown as having two SIMs and one modem, in some specific implementations, the computing system 550 may have any number of SIMs (e.g., one SIM or more than two SIMs) and any number of modems (e.g., one modem, two modems, or more than two modems).

[0086] A SIM is a device (e.g., an integrated circuit) that securely stores a specific subscriber's or user's International Mobile Subscriber Identity (IMSI) number and associated keys (e.g., encryption-decryption keys). The IMSI and keys can be used to identify and authenticate subscribers on a specific UE. The OEM SIM 560 can be used by the communication system 558 to establish wireless connections for vehicle-based operations, such as for emergency call (eCall) functionality, communication with the vehicle manufacturer's communication systems (e.g., for software updates), and other operations. The OEM SIM 560 can be crucial for supporting key services such as eCalls for making emergency calls in the event of a car accident or other emergency. For example, eCalls could include automatically dialing emergency numbers (e.g., "9-1-1" in the US, "1-1-2" in Europe, etc.) in the event of a vehicle accident and relaying the vehicle's location to emergency services (such as police stations, fire departments, etc.).

[0087] The user SIM 562 can be used by the communication system 558 to perform wireless network access functions to support user data connections (e.g., for making telephone calls, sending and receiving messages, infotainment-related services, etc.). In some cases, the user's user equipment can access the network via an interface (e.g., via PC5, Bluetooth). ™ Wi-Fi ™ The user equipment (UE) can connect to the vehicle computing system 550 via a wireless network access function (e.g., DSRC, USB port, and / or other wireless or wired interface). Once connected, the UE can transfer wireless network access functionality from the UE to the vehicle's communication system 558, in which case the UE can stop the execution of the wireless network access function (e.g., during a cycle when the communication system 558 is performing the wireless access function). The communication system 558 can begin interacting with the base station to perform one or more wireless communication operations, such as facilitating telephone calls, sending and / or receiving data (e.g., message sending and receiving, video, audio, etc.), and other operations. In such cases, other components of the vehicle computing system 550 can be used to output the data received by the communication system 558. For example, the infotainment system 554 (described below) can display video received by the communication system 558 on one or more displays, and / or can use one or more speakers to output audio received by the communication system 558.

[0088] A modem is a device that modulates one or more carrier signals to encode digital information for transmission and demodulates the signals to decode the transmitted information. Modem 564 (and / or one or more other modems of communication system 558) can be used for data communication of OEM SIM 560 and / or user SIM 562. In some examples, modem 564 may include a 4G (or LTE) modem, and another modem (not shown) of communication system 558 may include a 5G (or NR) modem. In some examples, communication system 558 may include one or more Bluetooth devices. ™ Modem (e.g., for Bluetooth) ™ Bluetooth Low Energy (BLE) or other types of Bluetooth communication), or one or more WiFi networks. ™ Modems (e.g., for DSRC communication and / or other WiFi communication), broadband modems (e.g., ultra-wideband (UWB) modems), any combination thereof and / or other types of modems.

[0089] In some cases, modem 564 (and / or one or more other modems of communication system 558) may be used to perform V2X communications (e.g., V2V communications with other vehicles, D2D communications with other devices, V2I communications with infrastructure systems, V2P communications with pedestrian UEs, etc.). In some examples, communication system 558 may include a V2X modem for performing V2X communications (e.g., sidelink communications via PC5 interface or DSRC interface), in which case the V2X modem may be separate from one or more modems used for wireless network access functions (e.g., network communications via network / Uu interface and / or sidelink communications other than V2X communications).

[0090] In some implementations, the communication system 558 may include a message authentication module (MVM) 565. In some cases, the MVM can be used to authenticate devices communicated by one or more UEs (e.g., Figure 1 The incoming messages received by the vehicles 110a, 110b, RSU 105, and attacker 115 through the communication system 558.

[0091] In some cases, the MVM 565 maintains the equipped UE (e.g., UE) as a victim of a cloning attack (e.g., cloning the victim UE). Figure 1The database of the vehicles (110a, 110b, RSU 105). In some cases, filtering messages from the source ID of a UE under cloning attack may cause legitimate messages from the cloned victim UE to be missed. In some implementations, the database of the equipped UEs may be maintained locally by the MVM 565. In some examples, the MVM 565 may obtain crowdsourced information to include in the database of the equipped UEs. Table 1 below provides illustrative examples of entries that may be included in the database of the equipped UEs.

[0092]

[0093] Table 1

[0094] As illustrated in the example database of equipped UEs in Table 1, this database may include, but is not limited to, information about observed RSUs, information about the macroscopic locations of RSUs that have not yet been observed, and / or information about UEs equipped by the mobile network (e.g., Figure 1 The MVM 565 stores macroscopic location information for visits by vehicles 110a and 110b (OBUs). In some cases, if an RSU is observed, the MVM 565 may store the precise location, source ID, and provider service ID (PSID) in the database. In some aspects, the MVM 565 may optionally store visit counts (e.g., the number of times the RSU at the precise location has been visited) and / or observation counts (e.g., the number of times a cloning / flooding attack was detected during such visits). In some implementations, the RSU may have a static source ID (e.g., an L2 ID), and if an equipped UE experiences a flooding attack from the same source ID as an RSU stored in the database, the equipped UE may determine that the RSU is a victim of a cloning attack. In some cases, the equipped UE may stop filtering source IDs of RSUs near the stored precise locations to receive messages from the RSU, even when concurrent cloning and flooding attacks occur. In some cases, the source ID of the RSU may not be static, and including visit counts and observation counts may help verify the presence of a specific RSU at the precise location.

[0095] In some examples, if a macro location (e.g., an intersection) is visited and no RSUs are observed at the macro location, the MVM 565 may store the macro location and populate one or more fields in the database with values ​​to indicate that no RSUs were observed at the macro location. In an exemplary example, the source ID and visit count values ​​may be set to values ​​such as -1, null, false, etc. In some cases, the MVM 565 may optionally store the observation count for the macro location.

[0096] In some cases, information about the macroscopic location observed by a mobile-equipped UE (e.g., the OBU of vehicles 110a, 110b) may also be stored in a database. In one exemplary example, the macroscopic location, visit count, and observation count of the OBU may be stored in a database. In some implementations, the PSID may optionally be stored in a database. In some aspects, the approaching vehicle accessing the database (e.g., via crowdsourcing) can determine the likelihood of concurrent cloning and flooding attacks being observed at the macroscopic location. In some examples, the equipped UE may stop filtering the source ID of cloned victim UEs at the macroscopic location. In some cases, the MVM 565 may decide to disable filtering of the source ID of cloned victim UEs (e.g., RSUs) to allow the reception of critical messages from the mobile-equipped UE. In one exemplary example, the MVM 565 may disable filtering of the source ID of critical security messages (e.g., from the OBU of a vehicle).

[0097] In some cases, the MVM 565 can determine whether a flooding attack is in progress by determining that the cumulative incoming message rate of messages received by the MVM and originating from one or more flooding source IDs (e.g., the UE's source ID) exceeds a total incoming message rate threshold to the MVM.

[0098] In some cases, attackers may attempt to avoid being identified as flood attackers. For example, an attacker might try to evade detection by cloning the source ID of a UE (e.g., RSU) and sending a flood message that falsely identifies its source as the cloned source ID (e.g., the cloned victim).

[0099] In some examples, MVM 565 may have authentication capabilities (e.g., a maximum rate for authenticating incoming messages). In some cases, a large number of incoming messages to MVM 565 (e.g., from a flooding attack) can cause the MVM's message authentication rate to reach or approach its message authentication capability. As used herein, the MVM's message authentication capability may also be referred to as authentication capability, message authentication capability, or MVM authentication capability. As used herein, an indicator of the amount (e.g., percentage) of the MVM 565's message authentication capability for authenticating messages may be referred to as utilization, MVM utilization, or utilization of available message authentication capability. In some cases, MVM 565 may compare the MVM's utilization rate to a utilization threshold to determine whether the MVM's message authentication rate has reached or approached its message authentication capability.

[0100] In some examples, a large influx of messages to the MVM 565 (e.g., from a flooding attack) can cause the MVM's operating temperature (e.g., junction temperature) to rise. In some cases, if the operating temperature increases above an operating temperature threshold (also referred to herein as the MVM operating temperature threshold), the MVM 565 may be damaged and / or fail.

[0101] In some cases, the operating temperature of MVM 565 may exceed the operating temperature threshold even when the MVM utilization does not exceed the utilization threshold. Similarly, in some cases, the operating temperature of MVM 565 may remain below the operating temperature threshold even when the MVM message verification rate exceeds the utilization threshold. As used herein, the message load threshold of MVM 565 may refer to the utilization threshold, the operating temperature threshold, and / or any combination thereof.

[0102] In some implementations, MVM 565 may use the utilization of available message authentication capabilities, operating temperature, and / or any combination thereof as message load indicators to select between a non-filtered state (e.g., processing all incoming messages regardless of source ID) and one or more filtered states (e.g., ignoring incoming messages from a specific source ID during a specified filtering interval). In some cases, MVM 565 may transition between a non-filtered state and any of these one or more filtered states. In some cases, MVM 565 may generate, update, store, and / or access a filter list that includes the source IDs to be filtered during any of these one or more filtered states.

[0103] Figure 6A This is a diagram illustrating the concurrent cloning and flood attack mitigation state machine 600. Figure 6B This is a diagram illustrating waveform 650, shown in... Figure 6A The concurrent cloning and flooding attack mitigation state machine reduces filtering activities during different states. In some examples, the concurrent cloning and flooding attack mitigation state machine 600 can be... Figure 5 The MVM 565 implementation.

[0104] exist Figure 6A In the illustrated example, the concurrent cloning and flooding attack mitigation state machine 600 includes three states: state 0 602, state 1 604, and state 2 606. In some cases, the concurrent cloning and flooding attack mitigation state machine 600 may determine whether to transition to another state or remain in its current state.

[0105] For example, if the state machine determines to remain in the current state, it can take a path back to state 0 (612), state 1 (616), or state 2 (620). If the state machine determines to transition from state 0 to state 1, it can take path 613. If the state machine determines to transition from state 1 to state 0, it can take path 614. If the state machine determines to transition from state 1 to state 2, it can take path 617. If the state machine determines to transition from state 2 to state 1, it can take path 618. If the state machine determines to transition from state 0 to state 2, it can take path 621. If the state machine determines to transition from state 2 to state 0, it can take path 622.

[0106] exist Figure 6A In the illustrated example, state 0 602 could correspond to a non-filtered (e.g., filtering disabled) state. See reference. Figure 6B In some cases, the evaluation interval 660 may include multiple command intervals (CIs) 662. In the illustrated example, the evaluation interval 660 includes three CIs 662. Figure 6B As illustrated, waveform 652 in state 0 shows that the filter can be turned off during all three CIs 662 of the evaluation interval 660 in state 0 602.

[0107] although Figure 6A The example illustrations include a concurrent cloning and flood attack mitigation state machine 600 with three states, but state machines with more (three or more) or fewer (two) states may also be used without departing from the scope of this disclosure.

[0108] Figure 7 These are examples of aspects of this disclosure used to determine for Figure 6A Concurrent cloning and flooding attacks mitigate state machine 600 by transitioning it out of unfiltered states (e.g., Figure 6A The flowchart of the process 700, which is in state 0 (602) or in a non-filtered state.

[0109] At box 702, process 700 includes a non-filtered state during the evaluation interval (e.g., Figure 6A The process operates in state 0). In some specific implementations, process 700 may determine the minimum duration of the evaluation interval according to the following equation (1): (1) in (Positive integer) is to be included in the evaluation interval (e.g., Figure 6B CI in the evaluation interval 660 (e.g., Figure 6B The number of CI 662), It is an infrastructure-to-vehicle (I2V) message (e.g., from... Figure 1RSU 105 to Figure 1 The maximum periodicity of the messages from vehicles 110a and 110b, and It is the period of CI during the evaluation interval ( Figure 6B CI 662). In some cases, the minimum duration of the evaluation interval is set according to equation (1) to ensure that the evaluation interval is long enough to receive at least one message from the cloned UE (e.g., the victim of a cloning attack).

[0110] At box 704, process 700 may determine whether a flooding attack is occurring (e.g., the flooding attack occurs during the evaluation interval of box 702). As noted above, determining that a flooding attack is occurring may include determining that the cumulative message rate of incoming messages exceeds a cumulative message rate threshold. If process 700 determines that a flooding attack is occurring, process 700 may determine whether the message processing load exceeds or does not exceed the message processing threshold according to the following equation (2): (2) in It is MVM (e.g., Figure 5 The utilization indicator of MVM 565. It is the first MVM utilization threshold. This is the operating temperature of the MVM (e.g., the junction temperature of the MVM), and This is the first MVM operating temperature threshold. As used herein, junction temperature refers to the temperature experienced by the transistors of an electronic device during operation. In some specific implementations, it is used for comparison with one or more MVM operating temperature thresholds. The value can be the average operating temperature of the MVM during the evaluation interval.

[0111] Referring to equation (2), if the utilization rate Below the first MVM utilization threshold and operating temperature If the temperature is below a first MVM operating temperature threshold, process 700 can determine a flooding attack affecting the operation of the MVM. In some cases, based on the determination that no flooding attack has occurred, process 700 can select an unfiltered state (e.g., Figure 6A The state 0 is taken as the next state of the MVM and returns to box 702.

[0112] In some examples, if utilization Above the first MVM utilization threshold or operating temperature If the temperature exceeds the first MVM operating temperature threshold, process 700 can determine that the flooding attack is affecting the operation of the MVM, and process 700 can select a filtered state as the possible next state of the MVM based on the message processing load, as illustrated in the following equations (3) and (4): (3) in It is the second MVM utilization threshold, and It is the second operating temperature threshold.

[0113] (4)

[0114] Referring to equation (3), if the utilization rate Falling at the first utilization threshold With the second utilization threshold Between, or operating temperature Falling at the first operating temperature threshold With the second operating temperature threshold If the condition in equation (4) is not met, then process 700 may select the first filtering state (e.g., Figure 6A State 1 (604) is a possible next state of MVM.

[0115] Referring to equation (4), if the utilization rate Exceeding the second utilization threshold or operating temperature Exceeding the second operating temperature threshold Then process 700 can select a second filtering state (for example, Figure 6A State 2 (606) is a possible next state of MVM.

[0116] At box 706, procedure 700 may create a filter list. In some examples, a source ID may be added to the filter list based on whether its source-specific message sending / receiving rate exceeds a source-specific message sending / receiving rate threshold. For example, for each source ID that provides an incoming message to the MVM during the evaluation interval, procedure 700 may determine whether the corresponding source ID's source-specific message sending / receiving rate exceeds the source-specific message sending / receiving rate threshold. For each source ID that exceeds the source-specific message sending / receiving rate threshold, procedure 700 may add the source ID to the filter list.

[0117] In some cases, process 700 may consider additional information to determine whether a source ID should be added to the filter list. For example, information contained in the database of the equipped UE (e.g., as described above with respect to Table 1) may be used to determine whether a particular source ID should not be filtered. For example, if the database includes information indicating that a particular source ID belongs to a cloned victim during concurrent cloning and flooding attacks, process 700 may determine that the source ID of the cloned victim should not be filtered to ensure that important messages (e.g., from the RSU) are not missed.

[0118] At box 708, process 700 may determine whether the filter list is empty. For example, if no single source ID exceeds a source-specific message rate threshold, no source ID can be included in the filter list, even if the cumulative message rate exceeds the cumulative message rate threshold. In another illustrative example, if the only source ID exceeding the source-specific message rate threshold is also a source ID belonging to a cloned victim, the filter list may be empty. If the filter list is empty, process 700 may select a non-filtered state (e.g., Figure 6A The state 0 (602) is taken as the next state, and the process returns to box 702. If the filter list is not empty, process 700 can proceed to box 710.

[0119] At box 710, process 700 can determine which filtering state to use as the next state. For example, if the condition of equation (4) is met, the process can select state 2 as the next state and proceed to box 714. If the condition of equation (4) is not met but the condition of equation (3) is met, process 700 can select the first filtering state (e.g., Figure 6A State 1) becomes the next state, and proceeds to box 712.

[0120] return Figure 6B The example shows waveform 654 for state 1 and waveform 656 for state 2. For example... Figure 6B As shown, each CI 662 may have a filter on cycle and a filter off cycle. As used herein, the duty cycle of a state refers to the numerical correspondence (e.g., ratio) between the filter on cycle of a particular state and the cycle of the CI 662.

[0121] Referring to waveform 654, in the first CI 662 (e.g., CI During the period of = 0), filtering can be enabled from the start of CI until the start cycle. T ON As illustrated in the diagram, during the activation cycle... T ON Afterwards, filtering of the remaining portion of CI can be turned off until the shutdown period is reached. T OFF .

[0122] In the second CI 662 (e.g., CI = 1) During this period, the filter can be turned off from the start of CI until the displacement cycle. T SHIFT During the displacement period T SHIFT After that, the filter can be activated for the specified activation cycle. T ON During the activation cycle T ON Afterwards, filtering of the remaining portion of CI can be turned off. T OFF - T SHIFT The cycle.

[0123] In the third CI 662 (e.g., CI = 2) During this period, the filter can be turned off from the start of CI up to a second displacement period equal to twice the displacement period (e.g., 2). T SHIFT ). In the second displacement period 2 T SHIFT After that, the filter can be activated for the specified activation cycle. T ON During the activation cycle T ON Afterwards, filtering of the remaining portion of CI can be turned off. T OFF - 2 T SHIFT The cycle.

[0124] In some cases, the filtering on-time of different CI 662 is adjusted by evaluating interval 660. T ON Apply different displacements, and adjust the filter on / off cycle within each CI 662. T ON Compared to using static timing, it is more likely to receive messages from a cloned UE (e.g., a victim of a cloning attack).

[0125] Referring to waveform 656, in the first CI 662 (e.g., CI During the period of = 0), filtering can be enabled from the start of CI until the start cycle. T ON,2 As illustrated in the diagram, during the activation cycle... T ON,2 Afterwards, filtering of the remaining portion of CI can be turned off until the shutdown period is reached. T OFF,2 .

[0126] In the second CI 662 (e.g., CI = 1) During this period, the filter can be turned off from the start of CI until the displacement cycle. T SHIFT,2 During the displacement period T SHIFT,2 After that, the filter can be activated for the specified activation cycle. T ON,2 During the activation cycle T ON,2 Afterwards, filtering of the remaining portion of CI can be turned off. T OFF,2 - T SHIFT,2 The cycle.

[0127] In the third CI 662 (e.g., CI = 2) During this period, the filter can be turned off from the start of CI up to a second displacement period equal to twice the displacement period (e.g., 2). T SHIFT,2 ). In the second displacement period 2 T SHIFT,2 After that, the filter can be activated for the specified activation cycle. T ON,2 During the activation cycle T ON Afterwards, the remaining filtering for CI can be turned off. T OFF,2 - 2 T SHIFT,2 The cycle.

[0128] In some cases, the filtering on-time of different CI 662 is adjusted by evaluating interval 660. T ON,2 Apply different displacements, and adjust the filter on / off cycle within each CI 662. T ON,2 Compared to using static timing, it is likely more likely to receive messages from cloned UEs (e.g., victims of cloning attacks). Furthermore, when message processing load is high, a second filtering state (e.g., Figure 6A State 2 (606) can provide a larger filter-on duty cycle to further reduce the total load on the MVM.

[0129] Figure 8 This is a flowchart illustrating process 800 according to some aspects of this disclosure, the process being used for... Figure 6A Concurrent cloning and flooding attacks mitigate the state machine's determination of whether to remove a state from the first filtering state (e.g., Figure 6AState 1 (604) transitions to another filtering state (e.g., Figure 6A State 2 606), remain in the current filtering state, or transition from the current filtering state to a non-filtering state (e.g., Figure 6A State 0).

[0130] At box 802, process 800 includes filtering during the evaluation interval (e.g., Figure 6A The process operates in state 1 (604). In some specific implementations, process 800 may determine the minimum duration of the evaluation interval for the filtering state according to the following equation (5): (5) in (Positive integer) is to be included in the evaluation interval (e.g., Figure 6B CI in the evaluation interval 660 (e.g., Figure 6B The number of CI 662), It is an I2V message (e.g., from Figure 1 RSU 105 to Figure 1 The minimum periodicity of the messages from vehicles 110a and 110b, and It is the period of CI during the evaluation interval ( Figure 6B CI 662). In some cases, setting the maximum duration of the evaluation interval according to equation (5) can ensure that if T OFF If a message is received from a cloned UE (e.g., a victim of a cloning attack) during the period, no further messages will be received from the cloned UE during the evaluation interval.

[0131] At box 804, process 800 may determine whether there is a possibility of encountering a cloned UE (e.g., a clone victim). For example, this process may be based on navigation information (e.g., GNSS), a database of equipped UEs (e.g., as per Table 1 and...), and other relevant information. Figure 5 The process 800 uses data such as map information, speed, heading, historical information of concurrent cloning, and / or traffic messages to determine the high probability of encountering an RSU. For example, the probability of encountering an RSU may be high when a vehicle is approaching an intersection. In some cases, process 800 may also consider whether there are any data entries in the database of the equipped UEs indicating that no RSU was observed at a particular macroscopic location. In some aspects, if there are data entries in the database of the equipped UEs indicating previously observed cloned mobile UEs (e.g., ... Figure 1 If the data entries for the OBUs of vehicles 110a and 110b are not filtered, then process 800 may select an unfiltered state (e.g., Figure 6AThe state 0 (602) is taken as the next state, and the process moves to box 807. In some cases, once a message is received from the cloned UE, the process 800 may select an unfiltered state (e.g., Figure 6A The state 0 (602) becomes the next state, and the device moves to box 807.

[0132] At box 806, process 800 may determine whether a flooding attack is occurring (e.g., occurring during the most recent evaluation interval). As noted above, determining that a flooding attack is occurring may include determining that the cumulative message sending rate of incoming messages exceeds a cumulative message sending rate threshold. If process 800 determines that a flooding attack is occurring, process 800 may determine whether the message processing load exceeds the message processing threshold according to equation (2) above.

[0133] Referring to equation (2), if the utilization rate Below the first MVM utilization threshold and operating temperature If the temperature is below the first MVM operating temperature threshold, process 800 can determine that no flooding attack has occurred (e.g., no flooding attack occurred during the evaluation interval of block 802). In some cases, based on the determination that no flooding attack has occurred, process 800 can select an unfiltered state (e.g., Figure 6A State 0) becomes the next state of MVM and moves to box 807.

[0134] In some examples, if utilization Above the first MVM utilization threshold or operating temperature If the temperature exceeds the first MVM operating temperature threshold, process 800 can determine that a flooding attack may affect the operation of the MVM, and process 800 can select a filtered state as the next state of the MVM based on message processing load, as illustrated in equations (3) and (4) above.

[0135] (3)

[0136] in It is the second MVM utilization threshold, and It is the second operating temperature threshold.

[0137] (4)

[0138] Referring to equation (3), if the utilization rate Falling at the first utilization threshold With the second utilization threshold Between, or operating temperature Falling at the first operating temperature threshold With the second operating temperature threshold If the condition in equation (4) is not met, then process 800 may choose to return to the first filtering state (e.g., Figure 6A State 1 (604) is a possible next state of MVM.

[0139] Referring to equation (4), if the utilization rate Exceeding the second utilization threshold or operating temperature Exceeding the second operating temperature threshold Then process 700 can select a second filtering state (for example, Figure 6A State 2 (606) is a possible next state of MVM.

[0140] At box 808, procedure 800 may update the filter list. In some examples, a source ID may be added to the filter list based on whether its source-specific message sending / receiving rate exceeds a source-specific message sending / receiving rate threshold. For example, for each source ID that provides an incoming message to the MVM during the evaluation interval, procedure 800 may determine whether the corresponding source ID's source-specific message sending / receiving rate exceeds the source-specific message sending / receiving rate threshold. For each source ID that exceeds the source-specific message sending / receiving rate threshold, procedure 800 may add the source ID to the filter list.

[0141] In some cases, process 800 may consider additional information to determine whether a source ID should be added to the filter list. For example, information contained in the database of the equipped UE (e.g., as described above with respect to Table 1) may be used to determine whether a particular source ID should not be filtered. For example, if the database includes information indicating that a particular source ID belongs to a cloned victim during concurrent cloning and flooding attacks, process 800 may determine that the source ID of the cloned victim should not be filtered to ensure that important messages (e.g., from the RSU) are not missed.

[0142] At box 810, process 800 may determine whether the filter list is empty. For example, if no single source ID exceeds a source-specific message rate threshold, no source ID can be included in the filter list, even if the cumulative message rate exceeds the cumulative message rate threshold. In another illustrative example, if the only source ID exceeding the source-specific message rate threshold is also a source ID belonging to a cloned victim, the filter list may be empty. If the filter list is empty, process 800 may choose to move to a non-filtered state (e.g., Figure 6A The state 0 (602) is taken as the next state, and the process moves to box 807. If the filter list is not empty, process 800 can proceed to box 812.

[0143] At box 812, process 800 can determine which filtering state to use as the next state. For example, if the condition of equation (4) is met, the process can select state 2 as the next state and proceed to box 814. If the condition of equation (4) is not met but the condition of equation (3) is met, process 800 can choose to return to the first filtering state (e.g., Figure 6A State 1) becomes the next state, and returns to box 802.

[0144] like Figure 8 As illustrated by dashed line 816, in some specific implementations, process 800 may alternatively begin at block 814. At block 814, process 800 may include operating during an evaluation interval in a second filtering state (e.g., state 2) to determine whether to transition out of the second filtering state.

[0145] Return to Figure 5 The communication system 558 may be or may include a Telematics Control Unit (TCU). In some implementations, the TCU may include a Network Access Device (NAD) (also referred to in some cases as a Network Control Unit or NCU). The NAD may include a modem 564, Figure 5 This may include any other modems, OEM SIM 560, user SIM 562, and / or other components for wireless communication not shown. In some examples, the communication system 558 may include a Global Navigation Satellite System (GNSS). In some cases, GNSS may be part of one or more sensor systems 556, as described below. GNSS may provide the vehicle computing system 550 with the ability to perform one or more location services, navigation services, and / or other services that utilize GNSS functionality.

[0146] In some cases, the communication system 558 may also include one or more wireless interfaces for transmitting and receiving wireless communications (e.g., including one or more transceivers and one or more baseband processors for each wireless interface), one or more wired interfaces for performing communication via one or more hardwired connections (e.g., serial interfaces such as Universal Serial Bus (USB) inputs, lighting connectors and / or other wired interfaces), and / or other components that may allow the vehicle 504 to communicate with a network and / or other UEs.

[0147] The vehicle computing system 550 may also include an infotainment system 554 with controllable content and one or more output devices for outputting content from the vehicle 504. The infotainment system 554 may also be referred to as an in-vehicle infotainment (IVI) system or an in-vehicle entertainment (ICE) system. Content may include navigation content, media content (e.g., video content, music or other audio content, and / or other media content), and other content. One or more output devices may include one or more graphical user interfaces, one or more displays, one or more speakers, one or more extended reality devices (e.g., VR, AR, and / or MR headsets), one or more haptic feedback devices (e.g., one or more devices configured to vibrate the seat, steering wheel, and / or other parts of the vehicle 504), and / or other output devices.

[0148] In some examples, computing system 550 may include Intelligent Transport System (ITS) 555. In some examples, ITS 555 may be used to implement V2X communication. For example, the ITS stack of ITS 555 may generate V2X messages based on information from the application layer of the ITS. In some cases, the application layer may determine whether certain conditions have been met to generate messages for use by ITS 555 and / or generate messages to be transmitted to other vehicles (for V2V communication), pedestrian UEs (for V2P communication), and / or infrastructure systems (for V2I communication). In some cases, communication system 558 and / or ITS 555 may obtain Vehicle Access Network (CAN) information (e.g., from other components of the vehicle via the CAN bus). In some examples, communication system 558 (e.g., TCU NAD) may obtain CAN information via the CAN bus and may transmit the CAN information to the PHY / MAC layer of ITS 555. ITS 555 may provide CAN information to the ITS stack of ITS 555. CAN information may include vehicle-related information, such as the vehicle's heading, speed, braking information, and other information. CAN information may be provided to the ITS 555 continuously or periodically (e.g., every 1 millisecond (ms), every 10 ms, etc.).

[0149] The conditions used to determine whether to generate a message can be based on CAN information used by safety-related applications and / or other applications (including applications related to road safety, traffic efficiency, infotainment, business, and / or other applications). In an exemplary example, ITS 555 can perform lane change assistance or negotiation. For example, using CAN information, ITS 555 can determine that the driver of vehicle 504 is attempting to change lanes from the current lane to an adjacent lane (e.g., based on the activation of hazard lights, based on the user changing direction or turning into an adjacent lane, etc.). Based on determining that vehicle 504 is attempting to change lanes, ITS 555 can determine that lane change conditions have been met, associated with messages to be transmitted to other vehicles nearby in the adjacent lane. ITS 555 can trigger the ITS stack to generate one or more messages to be sent to other vehicles, which can be used to negotiate a lane change with other vehicles. Other examples of applications include forward collision warning, automatic emergency braking, lane departure warning, pedestrian avoidance or protection (e.g., when a pedestrian is detected near vehicle 504, such as through V2P communication with the user's UE), traffic sign recognition, and so on.

[0150] The ITS 555 can use any suitable protocol to generate messages (e.g., V2X messages). Examples of protocols that the ITS 555 can use include one or more Society of Automotive Engineers (SAE) standards (such as SAE J2735, SAE J2945, SAE J3161 and / or other standards), which are incorporated herein by reference in their entirety and used for all purposes.

[0151] The security layer of the ITS 555 can be used to securely sign messages from the ITS stack, which are then delivered to and verified by other UEs (such as other vehicles, pedestrian UEs, and / or infrastructure systems) configured for V2X communication. The security layer can also verify messages received from such other UEs. In some implementations, the signing and verification process may be based on the security context of the vehicle. In some examples, the security context may include one or more encryption-decryption algorithms, a public key and / or private key used to generate the signature using the encryption-decryption algorithms, and / or other information. For example, each ITS message generated by the ITS 555 can be signed by the security layer of the ITS 555. The signature can be derived using the public key and the encryption-decryption algorithm. The vehicle, pedestrian UE, and / or infrastructure system receiving the signed message can verify the signature to ensure that the message originates from an authorized vehicle. In some examples, one or more encryption-decryption algorithms may include one or more symmetric encryption algorithms (e.g., Advanced Encryption Standard (AES), Data Encryption Standard (DES), and / or other symmetric encryption algorithms), one or more asymmetric encryption algorithms using public and private keys (e.g., Levitt-Shamir-Adlerman (RSA) and / or other asymmetric encryption algorithms), and / or other encryption-decryption algorithms.

[0152] In some examples, ITS 555 may determine certain actions to be performed (e.g., V2X-based actions) based on messages received from other UEs. These actions may include safety-related and / or other operations, such as those for road safety, traffic efficiency, infotainment, business, and / or other applications. In some examples, these operations may include causing a vehicle (e.g., control system 552) to perform automatic functions, such as automatic braking, automatic steering (e.g., maintaining heading in a specific lane), automatic lane change negotiation with other vehicles, and other automatic functions. In one exemplary example, communication system 558 may receive a message from another vehicle (e.g., via a PC5 interface, DSRC interface, or other device-to-device direct interface) indicating that the other vehicle is about to stop suddenly. In response to receiving the message, the ITS stack may generate a message or instruction and may transmit the message or instruction to control system 552, which may cause control system 552 to automatically brake vehicle 504 to stop it before colliding with another vehicle. In other exemplary examples, these actions may include triggering a message to warn the driver that another vehicle is in the lane adjacent to the vehicle, a message to warn the driver to stop the vehicle, a message to warn the driver that a pedestrian is at an upcoming intersection, a message to warn the driver that a toll station is within a certain distance of the vehicle (e.g., within 1 mile), and so on.

[0153] In some examples, the ITS 555 may receive a large number of messages from other UEs (e.g., vehicles, RSUs, etc.). In such cases, the ITS 555 will authenticate (e.g., decode and decrypt) each message and / or determine which operations to perform. Such a large number of messages can result in a high computational load on the vehicle computing system 550. In some cases, this high computational load can cause the temperature of the computing system 550 to rise. A rise in the temperature of the components of the computing system 550 can adversely affect its ability to process a large number of incoming messages. One or more functionalities may be transferred from vehicle 504 to another device (e.g., user equipment, RSUs, etc.) based on the temperature of the vehicle computing system 550 (or its components) exceeding or approaching one or more thermal levels. Transferring one or more functionalities can reduce the computational load on vehicle 504 and help lower the temperature of the components. A thermal load balancer may be provided, which, depending on the temperature of the computing system 550 and the processing power of the vehicle computing system 550, enables the vehicle computing system 550 to perform thermal-based load balancing to control the processing load.

[0154] The computing system 550 also includes one or more sensor systems 556 (e.g., a first sensor system through an Nth sensor system, where N is a value equal to or greater than 0). When multiple sensor systems are included, sensor systems 556 may include different types of sensor systems that can be arranged on or within different parts of the vehicle 504. Sensor systems 556 may include one or more camera sensor systems, LIDAR sensor systems, RADAR sensor systems, EmDAR sensor systems, SONAR sensor systems, SODAR sensor systems, GNSS receiver systems (e.g., one or more GPS receiver systems), accelerometers, gyroscopes, inertial measurement units (IMUs), infrared sensor systems, laser rangefinder systems, ultrasonic sensor systems, infrasound sensor systems, microphones, any combination thereof, and / or other sensor systems. It should be understood that any number of sensors or sensor systems may be included as part of the computing system 550 of the vehicle 504.

[0155] In some embodiments, the vehicle computing system 550 may further include (e.g., as part of or separate from a control system 552, infotainment system 554, communication system 558, and / or sensor system 556) at least one processor 566 and at least one memory 568 having computer-executable instructions that are executed by said at least one processor. The at least one processor communicates with and / or is electrically connected to (referred to as “coupled to” or “communically coupled to”) the at least one memory. The at least one processor 566 may include, for example, one or more microcontrollers, one or more central processing units (CPUs), one or more field-programmable gate arrays (FPGAs), one or more graphics processing units (GPUs), one or more application processors (e.g., for running or executing one or more software applications), and / or other processors. The at least one memory may include, for example, read-only memory (ROM), random access memory (RAM) (e.g., static RAM (SRAM)), electrically erasable programmable read-only memory (EEPROM), flash memory, one or more buffers, one or more databases, and / or other memories. The computer-executable instructions stored in or on at least one memory may be executed to perform one or more of the functions or operations described herein. In some cases, the at least one processor 566 may be configured to perform one or more operations associated with wireless communication, which may include mitigating concurrent cloning and flooding attacks. In some examples, a vehicle computing system 550, a control system 552, a communication system 558, at least one processor 566, and / or any combination thereof may be configured to perform one or more operations associated with mitigating concurrent cloning and flooding attacks.

[0156] Although the vehicle computing system 550 is shown as including certain components and / or systems, those skilled in the art will understand that the vehicle computing system 550 may include more than Figure 5 The components shown may include more or fewer of those components. For example, the vehicle computing system 550 may also include one or more input devices and one or more output devices (not shown).

[0157] Figure 9 Figure 900 illustrates an example of a vehicle-based message (e.g., vehicle-based message 915). Vehicle-based message 915 is shown as a sensor-shared message (e.g., SDSM), but may include BSM, CAM, CPM, or other vehicle-based messages as indicated herein. Figure 9In the diagram, the vehicle-based message 915 is shown as including host data 920 and detected object data 910a, 910b. The host data 920 of the vehicle-based message 915 may include data from the transmitting device of the vehicle-based message 915 (e.g., a network entity equipped with the transmitting device, such as...). Figure 1 RSU 105 or OBU of vehicles, such as in Figure 1 Information related to vehicles 110a and 110b. For example, host data 920 may include host type (e.g., RSU and OBU of the vehicle), host characteristics (e.g., static or dynamic characteristics related to the detected vehicle or object, and / or other information related to the detected vehicle or object), and a count of detected objects. Detected object data 910a and 910b based on vehicle-based message 915 may include information related to the detected vehicle or object. Detected object data 910a and 910b may specifically include Detected Object CommonData, Detected Object VehicleData, Detected Object VRUData, Detected Obstacle Data, Detected Object ClonedForFloodingVehicleData, and Detected Object ClonedForFloodingRSUData.

[0158] In some cases, the detected objects ClonedForFloodingVehicleData and ClonedForFloodingRSUData can be used to track cloned vehicles and / or RSUs (and their corresponding source IDs) for performing concurrent cloning and flooding attacks.

[0159] These vehicle-based messages (915) are beneficial because they can be sent to already equipped network devices (e.g., Figure 1 The vehicle (110a, 110b, attacker 115) provides perception and understanding of impending potential road hazards (e.g., unforeseen oncoming vehicles, accidents, and road conditions).

[0160] Figure 10This is a flowchart illustrating an example of a wireless communication process 1000. Process 1000 and / or other processes described herein may be performed by a computing device (or apparatus) or a component of a computing device (e.g., chipset, codec, etc.). The computing device may be an extended reality (XR) device (e.g., a virtual reality (VR) device or an augmented reality (AR) device), a mobile device (e.g., a mobile phone), a network-connected wearable device such as a watch, a vehicle or a component or system of a vehicle, or other types of computing devices. In one example, process 1000 and / or other processes described herein may be performed by... Figure 5 The vehicle computing system 550 is used to execute this. In another example, one or more processes within the process can be performed by... Figure 11 The computing system 1100 shown is executed. For example, it has the following configuration: Figure 11 The computing device of the computing system 1100 may include components of the vehicle computing system 550 and can realize Figure 10 The operation of process 1000 and / or other processes described herein. The operation of process 1000 may be implemented in one or more processors (e.g., Figure 11 Software components executed and running on the processor 1110, processors such as DSPs, GPUs, NPUs, etc., or other processors. Furthermore, the transmission and reception of signals by the computing device in process 1000 may be achieved, for example, through one or more antennas, one or more transceivers (e.g., wireless transceivers) and / or other communication components of the computing device (e.g., [missing information]). Figure 11 It is implemented using the communication interface 1140.

[0161] At box 1002, the computing device (or a component thereof) may obtain a wireless communication message associated with a source identifier (ID) (e.g., the source ID of the UE, RSU, or an attacker).

[0162] At box 1004, the computing device (or a component thereof) can determine that the source ID is associated with a flooding attack. In some aspects, determining that a flooding attack is occurring includes determining that the cumulative message transmission rate of multiple wireless communication messages, including wireless communication messages, exceeds a cumulative message rate threshold.

[0163] At box 1006, the computing device (or a component thereof) may filter wireless communication messages associated with a source ID based on determining that the source ID is associated with a flooding attack. In some aspects, filtering wireless communication messages includes a first filtering state (e.g., Figure 6A and Figure 6B State 0 (602), State 1 (604), State 2 (606) and the second filtering state (e.g., Figure 6A and Figure 6BThe filtering state alternates between states 0602, 1604, and 2606. In some cases, the first and second filtering states are associated with different filtering quantities. In some examples, the computing device (or a component thereof) may generate a filter list including the source ID based on determining that the source-specific message rate associated with the source ID exceeds a source-specific message rate threshold.

[0164] In some aspects, a computing device (or a component thereof) may transition from a first filtering state to a second filtering state based on determining that a message load indicator associated with a flooding attack exceeds a message load threshold (e.g., a utilization threshold, an operating temperature threshold). In some cases, transitioning based on determining that a message load indicator associated with a flooding attack exceeds a message load threshold includes changing the operation of a message processing component from the first filtering state to the second filtering state. In some cases, determining that a message load indicator associated with a flooding attack exceeds a message load threshold includes determining that at least one of the following: the utilization of the message processing module exceeds a utilization threshold or the operating temperature of the message processing module exceeds an operating temperature threshold. In some aspects, the operating temperature of the message processing module includes the junction temperature of the message processing module. In some cases, the operating temperature threshold includes a predetermined junction temperature. In some examples, the utilization of the message processing module includes a numerical correspondence between the verification rate of the message processing module and the verification capability of the message processing module.

[0165] In some cases, the message load threshold is associated with a second filtering state. In some examples, the message load threshold is greater than an additional message load threshold associated with the first filtering state. In some cases, the first filtering state is associated with filtering being disabled (e.g., Figure 6A and Figure 6B State 0). In some cases, the second filter state is associated with the filter being enabled (e.g., Figure 6A and Figure 6B (State 1, State 2). In some specific implementations, the first filtering state is associated with a filter having a first duty cycle (e.g., Figure 6A and Figure 6B State 1), and the second filter state is associated with a filter having a second duty cycle greater than the first duty cycle (e.g., Figure 6A and Figure 6B State 2).

[0166] In some specific implementations, the utilization rate of the message processing module is during the period of listening for messages from the source ID (e.g., in...). Figure 6B of T OFF, 1 , T OFF,2 , T SHIFT,1 and / orT SHIFT,2 The utilization of the message processing module is evaluated during the evaluation period. In some cases, the computing device (or its components) may normalize the utilization of the message processing module to the value at the evaluation interval (e.g., during the evaluation period). Figure 6B The total duration for listening to messages from the source ID during the evaluation interval (660).

[0167] In some implementations, determining that a message load indicator associated with a flooding attack originating from one or more flooding source IDs of one or more flooding UEs exceeds a message load threshold includes evaluating the message load indicator within an evaluation interval. In some cases, the evaluation interval comprises multiple command intervals. In some aspects, alternating between intervals for ignoring messages from one or more flooding source IDs and intervals for listening for messages from one or more flooding source IDs includes applying different timing offsets to the intervals for ignoring messages from one or more flooding source IDs within the respective command intervals of the evaluation interval. In some examples, applying different timing offsets to the intervals for listening for messages from one or more flooding source IDs within the respective command intervals of the evaluation interval includes listening for messages from one or more flooding source IDs during different portions of the respective command intervals. In some implementations, applying different timing offsets to the intervals for ignoring messages from one or more flooding source IDs within the respective command intervals of the evaluation interval includes cumulatively listening for messages during each timing offset associated with the command interval of the evaluation interval.

[0168] In some cases, the first filtering state includes enabling a first portion of the filtering, disabling a second portion of the filtering, and enabling a third portion of the filtering. In some implementations, the second portion of the first filtering state occurs between the first portion and the third portion of the first filtering state.

[0169] In some examples, a computing device (or its components) may determine that a flooding attack is occurring based on determining that the cumulative message sending and receiving rate of multiple wireless communication messages, including wireless communication messages, exceeds a cumulative message rate threshold, before determining that the message load indicator associated with the flooding attack exceeds a message load threshold.

[0170] In some aspects, the computing device (or its components) may determine that the source ID includes the cloned source ID during the interval of listening for messages from the source ID. In some examples, the computing device (or its components) may remove a source ID from a filter list based on determining that the source ID includes the cloned source ID. In some implementations, determining that the source ID includes the cloned source ID includes identifying the cloned source ID associated with the UE based on one or more of historical data, location information, speed, heading, local database, or crowdsourced information.

[0171] In some examples, the processes described herein (e.g., process 1000 and / or any other processes described herein) may be computed by a computing device or apparatus (e.g., Figure 5 The process 1000 can be executed by a computing device having the computing system 1100 shown in Figure 1100. In another example, the process 1000 can be executed by a computing device having the computing system 1100 shown in Figure 1100.

[0172] Figure 11 This is a block diagram illustrating an example of a computing system 1100, which, according to some aspects of this disclosure, can be used by the disclosed system for the detection and warning of intelligent vehicle malfunctions and driver misconduct. Specifically, Figure 11 An example of computing system 1100 is illustrated. This computing system can be any computing device, such as constituting an internal computing system, a remote computing system, a camera, or any component thereof, wherein the components of the system communicate with each other using connection 1105. Connection 1105 can be a physical connection using a bus, or a direct connection to processor 1110, such as in a chipset architecture. Connection 1105 can also be a virtual connection, a networking connection, or a logical connection.

[0173] In some aspects, computing system 1100 is a distributed system in which the functions described herein can be distributed across a data center, multiple data centers, a peer-to-peer network, etc. In some aspects, one or more of the described system components represent a plurality of such components, each of which performs some or all of the functions described for that component. In some aspects, the components can be physical or virtual devices.

[0174] Example computing system 1100 includes at least one processing unit (CPU or processor) 1110 and a connection 1105 that communicatively couples various system components, including system memories 1115 such as read-only memory (ROM) 1120 and random access memory (RAM) 1125, to the processor 1110. Computing system 1100 may include a cache 1112 of high-speed memory that is directly connected to, closely proximate to, or integrated into the processor 1110.

[0175] Processor 1110 may include any general-purpose processor and hardware or software services (such as services 1132, 1134, and 1136 stored in storage device 1130 and configured to control processor 1110), as well as dedicated processors in which software instructions are incorporated into the actual processor design. Processor 1110 may be a substantially completely independent computing system containing multiple cores or processors, buses, memory controllers, caches, etc. Multi-core processors may be symmetric or asymmetric.

[0176] To enable user interaction, the computing system 1100 includes an input device 1145 that can represent any number of input mechanisms, such as a microphone for voice, a touch-sensitive screen for gesture or graphical input, a keyboard, a mouse, motion input, voice input, etc. The computing system 1100 may also include an output device 1135 that can be one or more of a plurality of output mechanisms. In some instances, a multimodal system allows a user to provide multiple types of input / output to communicate with the computing system 1100.

[0177] The computing system 1100 may include a communication interface 1140, which typically controls and manages user input and system output. The communication interface may perform or facilitate the receiving and / or transmitting of wired or wireless communications using wired and / or wireless transceivers, including utilizing audio jacks / plugs, microphone jacks / plugs, Universal Serial Bus (USB) ports / plugs, Apple... ™ Lightning ™ Ports / plugs, Ethernet ports / plugs, fiber optic ports / plugs, dedicated wired ports / plugs, 3G, 4G, 5G and / or other cellular data network wireless signal transmission, Bluetooth ™ Wireless signal transmission, Bluetooth ™ Low-power (BLE) wireless signal transmission, IBEACON ™ Wireless signal transmission, radio frequency identification (RFID) wireless signal transmission, near field communication (NFC) wireless signal transmission, dedicated short range communication (DSRC) wireless signal transmission, 802.11 Wi-Fi wireless signal transmission, wireless local area network (WLAN) signal transmission, visible light communication (VLC), microwave access global interoperability (WiMAX), infrared (IR) wireless signal transmission, public switched telephone network (PSTN) signal transmission, integrated services digital network (ISDN) signal transmission, self-organizing network signal transmission, radio wave signal transmission, microwave signal transmission, infrared signal transmission, visible light signal transmission, ultraviolet light signal transmission, wireless signal transmission along the electromagnetic spectrum, or those communications in some combination thereof.

[0178] The communication interface 1140 may also include one or more ranging sensors (e.g., LIDAR sensors, laser rangefinders, RF radars, ultrasonic sensors, and infrared (IR) sensors) configured to collect data and provide measurements to the processor 1110, thereby configuring the processor 1110 to perform determinations and calculations required to obtain various measurements from the one or more ranging sensors. In some examples, measurements may include time of flight, wavelength, azimuth, elevation, distance, linear velocity, and / or angular velocity, or any combination thereof. The communication interface 1140 may also include one or more Global Navigation Satellite System (GNSS) receivers or transceivers used to determine the location of the computing system 1100 based on one or more signals received from one or more satellites associated with one or more GNSS systems. GNSS systems include, but are not limited to, the U.S. GPS, the Russian GLONASS, the Chinese BeiDou Navigation Satellite System (BDS), and the European Galileo GNSS. There are no limitations on operation on any particular hardware arrangement, and therefore the basic features here can be easily replaced to obtain improved hardware or firmware arrangements as they are developed.

[0179] Storage device 1130 may be a non-volatile and / or non-transitory and / or computer-readable storage device, and may be a hard disk or other type of computer-readable medium capable of storing data accessible by a computer, such as magnetic tape, flash memory cards, solid-state storage devices, digital multifunction discs, cartridges, floppy disks, hard disks, magnetic tapes, magnetic stripes, any other magnetic storage media, flash memory, memristor memory, any other solid-state storage, CD-ROM, rewritable CD, digital video disc (DVD), Blu-ray Disc (BDD), holographic disc, another optical medium, secure digital card (SD card), micro secure digital card (microSD card), Memory Stick. ®Cards, smart card chips, EMV chips, Subscriber Identity Module (SIM) cards, mini / micro / nano / micro SIM cards, another integrated circuit (IC) chip / card, random access memory (RAM), static RAM (SRAM), dynamic RAM (DRAM), read-only memory (ROM), programmable read-only memory (PROM), erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), flash EPROM, cache memory (e.g., layer 1 (L1) cache, layer 2 (L2) cache, layer 3 (L3) cache, layer 4 (L4) cache, layer 5 (L5) cache, or other (L#) cache), resistive random access memory (RRAM / ReRAM), phase change memory (PCM), spin-transfer torque RAM (STT-RAM), another memory chip or cassette and / or combinations thereof.

[0180] Storage device 1130 may include software services, servers, services, etc., which enable the system to perform functions when the code defining such software is executed by processor 1110. In some aspects, hardware services performing specific functions may include software components for performing functions stored in a computer-readable medium connected to necessary hardware components such as processor 1110, connection 1105, output device 1135, etc. The term "computer-readable medium" includes, but is not limited to, portable or non-portable storage devices, optical storage devices, and various other media capable of storing, containing, or carrying instructions and / or data. Computer-readable media may include non-transitory media in which data can be stored and which does not include carrier waves and / or transient electronic signals propagating wirelessly or over a wired connection. Examples of non-transitory media may include, but are not limited to, magnetic disks or magnetic tapes, optical storage media such as compact discs (CDs) or digital versatile discs (DVDs), flash memory, memory, or memory devices. Computer-readable media may store code and / or machine-executable instructions thereon, which may represent procedures, functions, subroutines, programs, routines, subroutines, modules, software packages, classes, or any combination of instructions, data structures, or program statements. A code segment may be coupled to another code segment or hardware circuitry by passing and / or receiving information, data, arguments, parameters, or memory contents. Information, arguments, parameters, data, etc., may be passed, forwarded, or transmitted via any suitable means, including memory sharing, message passing, token passing, network transmission, etc.

[0181] Specific details have been provided in the foregoing description to offer a thorough understanding of the aspects and examples presented herein, but those skilled in the art will recognize that this application is not limited thereto. Therefore, although illustrative aspects of this application have been described in detail herein, it is to be understood that the various inventive concepts may be embodied and employed in various other ways, and the appended claims are not intended to be construed as including these variations unless limited by prior art. The various features and aspects of the applications described above may be used individually or in combination. Furthermore, without departing from the broader scope of this specification, aspects may be used in any number of environments and applications beyond those described herein. Therefore, the specification and drawings should be considered illustrative rather than restrictive. For illustrative purposes, the methods are described in a particular order. It should be understood that, in alternative aspects, the methods may be performed in a different order than described.

[0182] For clarity, in some instances, this technology may be presented as comprising various functional blocks, which include devices, device components, steps, or routines embodied in a method, either in software or a combination of hardware and software. Additional components may be used in addition to those shown in the figures and / or described herein. For example, circuits, systems, networks, processes, and other components may be shown as components in block diagram form to avoid obscuring these aspects in unnecessary detail. In other cases, well-known circuits, processes, algorithms, structures, and techniques may be shown without unnecessary detail to avoid obscuring the aspects.

[0183] Furthermore, those skilled in the art will understand that the various exemplary logic blocks, modules, circuits, and algorithm steps described in connection with the aspects disclosed herein can be implemented as electronic hardware, computer software, or a combination of both. To clearly illustrate this interchangeability between hardware and software, various exemplary components, blocks, modules, circuits, and steps have been described above in general terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in different ways for each specific application, but such specific implementation decisions should not be construed as departing from the scope of this disclosure.

[0184] Various aspects described above can be presented as processes or methods, depicted as flowcharts, diagrams, data flow graphs, structure diagrams, or block diagrams. Although flowcharts can describe operations as sequential processes, many operations within an operation can be executed in parallel or concurrently. Furthermore, the order of operations can be rearranged. A process terminates when its operations are completed, but a process may have additional steps not included in the accompanying diagrams. A process can correspond to a method, function, procedure, subroutine, subroutine, etc. When a process corresponds to a function, its termination may correspond to the function returning to the calling function or the main function.

[0185] The processes and methods described in the examples above can be implemented using stored computer-executable instructions or computer-executable instructions otherwise obtainable from a computer-readable medium. Such instructions may include, for example, instructions and data that configure, or otherwise configure, a general-purpose computer, special-purpose computer, or processing device to perform a function or group of functions. The portion may be accessible via a network of the computer resources used. The computer-executable instructions may be, for example, binary, intermediate format instructions such as assembly language, firmware, or source code. Examples of computer-readable media that can be used to store the instructions, the information used, and / or information created during the methods according to the described examples include disks or optical discs, flash memory, USB devices with non-volatile memory, networked storage devices, etc.

[0186] In some respects, computer-readable storage devices, media, and memories may include cables or wireless signals containing bit streams, etc. However, when referred to, non-transitory computer-readable storage media explicitly exclude media such as energy, carrier signals, electromagnetic waves, and the signals themselves.

[0187] Those skilled in the art will understand that information and signals can be represented using any of a variety of different techniques and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referred to throughout the above description may, in some cases, be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or light particles, or any combination thereof, depending in part on the specific application, in part on the desired design, in part on the corresponding technology, etc.

[0188] The various exemplary logic blocks, modules, and circuits described in conjunction with the aspects disclosed herein can be implemented or executed using hardware, software, firmware, middleware, microcode, hardware description languages, or any combination thereof, and can take any form factor of various form factors. When implemented in software, firmware, middleware, or microcode, program code or code segments (e.g., computer program products) for performing the necessary tasks can be stored in a computer-readable or machine-readable medium. A processor can perform the necessary tasks. Examples of form factors include: laptop computers, smartphones, mobile phones, tablet devices, or other small form factor personal computers, personal digital assistants, rack-mounted devices, self-contained devices, etc. The functionality described herein can also be embodied in peripheral devices or intercalation cards. By further example, such functionality can also be implemented on circuit boards of different chips or different processes executed on a single device.

[0189] Instructions, media for transmitting such instructions, computing resources for executing them, and other structures for supporting such computing resources are example components for providing the functionality described in this disclosure.

[0190] The techniques described herein can also be implemented in electronic hardware, computer software, firmware, or any combination thereof. Such techniques can be implemented in any of a variety of devices, such as general-purpose computers, wireless communication devices (mobile phones), or integrated circuit devices with multiple uses, including applications in wireless communication devices (mobile phones) and other devices. Any feature described as a module or component can be implemented together in an integrated logic device or separately as discrete but interoperable logic devices. If implemented in software, the techniques can be implemented at least in part by a computer-readable data storage medium comprising program code including instructions that, when executed, perform one or more of the methods, algorithms, and / or operations described above. The computer-readable data storage medium can form part of a computer program product, which may include packaging material. The computer-readable medium may include memory or data storage media, such as random access memory (RAM) (such as synchronous dynamic random access memory (SDRAM)), read-only memory (ROM), non-volatile random access memory (NVRAM), electrically erasable programmable read-only memory (EEPROM), flash memory, magnetic or optical data storage media, etc. Additionally or alternatively, the technology may be implemented at least in part by a computer-readable communication medium that carries or conveys program code in the form of instructions or data structures that can be accessed, read and / or executed by a computer, such as propagated signals or waves.

[0191] The program code can be executed by a processor, which may include one or more processors, such as one or more digital signal processors (DSPs), general-purpose microprocessors, application-specific integrated circuits (ASICs), field-programmable arrays (FPGAs), or other equivalent integrated or discrete logic circuits. Such processors can be configured to perform any of the techniques described in this disclosure. A general-purpose processor may be a microprocessor; however, in alternatives, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors combined with a DSP core, or any other such configuration. Therefore, as used herein, the term "processor" may refer to any of the foregoing structures, any combination of the foregoing structures, or any other structure or means suitable for implementing the techniques described herein.

[0192] Those skilled in the art will understand that, without departing from the scope of this description, the less than (“<”) and greater than (“>”) symbols or terms used herein may be replaced with less than or equal to (“>”) respectively. ") and greater than or equal to (" The symbol ) is used instead.

[0193] When a component is described as being “configured” to perform certain operations, such configuration can be achieved, for example, by designing electronic circuits or other hardware to perform the operations, by programming programmable electronic circuits (e.g., microprocessors or other suitable electronic circuits) to perform the operations, or any combination thereof.

[0194] The phrase “coupled to” or “communicatively coupled to” means that any component is physically connected directly or indirectly to another component, and / or that any component is in communication with another component directly or indirectly (e.g., connected to that other component via a wired or wireless connection and / or other suitable communication interface).

[0195] Claim language or other languages ​​that state "at least one of" and / or "one or more of" in a set indicate that one member of the set or multiple members of the set (in any combination) satisfy the claim. For example, claim language stating "at least one of A and B" or "at least one of A or B" means A, B, or A and B. In another example, claim language stating "at least one of A, B, and C" or "at least one of A, B, or C" means A, B, C, or A and B, or A and C, or B and C, A and B and C, or any repeating information or data (e.g., A and A, B and B, C and C, A and A and B, etc.), or any other ordering, repetition, or combination of A, B, and C. The language "at least one of" and / or "one or more of" in a set does not limit the set to the items listed in the set. For example, the language of a claim stating "at least one of A and B" or "at least one of A or B" may refer to A, B, or A and B, and may additionally include items not listed in the set of A and B. The phrases "at least one" and "one or more" are used interchangeably herein.

[0196] Claim language or other languages ​​that state "at least one processor, configured to," "at least one processor configured to," "one or more processors, configured to," etc., indicate that one or more processors (in any combination) can perform associated operations. For example, claim language stating "at least one processor, configured to: X, Y, and Z" means that a single processor can be used to perform operations X, Y, and Z; or that multiple processors are each assigned a specific subset of tasks of operations X, Y, and Z, such that the multiple processors together perform X, Y, and Z; or that a group of multiple processors work together to perform operations X, Y, and Z. In another example, claim language stating "at least one processor, configured to: X, Y, and Z" could mean that any single processor can perform only at least one subset of operations X, Y, and Z.

[0197] When referring to one or more elements that perform functions (e.g., steps of a method), one element may perform all functions, or more than one element may jointly perform these functions. When more than one element jointly performs these functions, each function does not need to be performed by every single element (e.g., different functions may be performed by different elements), and / or each function does not need to be performed by only one element as a whole (e.g., different elements may perform different sub-functions of a function). Similarly, when referring to one or more elements configured to cause another element (e.g., a device) to perform functions, one element may be configured to cause another element to perform all functions, or more than one element may be jointly configured to cause another element to perform these functions.

[0198] When referring to an entity that performs or is configured to perform functions (e.g., steps of a method) (e.g., any entity or device described herein), the entity may be configured to cause one or more elements (individually or collectively) to perform those functions. One or more components of the entity may include at least one memory, at least one processor, at least one communication interface, another component configured to perform one or more of those functions, and / or any combination thereof. When referring to an entity that performs functions, the entity may be configured to cause one component to perform all functions, or to cause more than one component to perform those functions collectively. When the entity is configured to cause more than one component to perform those functions collectively, each function does not need to be performed by every single component (e.g., different functions may be performed by different components), and / or each function does not need to be performed by only one component as a whole (e.g., different components may perform different sub-functions of a function).

[0199] The exemplary aspects of this disclosure include: Aspect 1. A method for wireless communication, the method comprising: obtaining a wireless communication message associated with a source identifier (ID); determining that the source ID is associated with a flooding attack; and filtering the wireless communication message associated with the source ID based on determining that the source ID is associated with a flooding attack, wherein filtering the wireless communication message includes alternating between a first filtering state and a second filtering state, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

[0200] Aspect 2. The method according to aspect 1, the method further comprising: transitioning from a first filtering state to a second filtering state based on determining that a message load indicator associated with the flooding attack exceeds a message load threshold.

[0201] Aspect 3. The method according to any one of Aspect 2, wherein the transition based on determining that the message load indicator associated with the flooding attack exceeds the message load threshold comprises: changing the operation of the message processing component from a first filtering state to a second filtering state.

[0202] Aspect 4. The method according to aspect 2 or 3, wherein the message load threshold is associated with the second filtering state, and wherein the message load threshold is greater than an additional message load threshold associated with the first filtering state.

[0203] Aspect 5. The method according to any one of Aspects 2 to 4, wherein the first filtering state is associated with filtering being disabled, and wherein the second filtering state is associated with filtering being enabled.

[0204] Aspect 6. The method according to any one of Aspects 2 to 5, wherein the first filtering state is associated with a filter having a first duty cycle, and the second filtering state is associated with a filter having a second duty cycle greater than the first duty cycle.

[0205] Aspect 7. The method according to any one of Aspects 2 to 6, wherein determining that the message load indicator associated with the flooding attack exceeds the message load threshold comprises determining at least one of the following: the utilization rate of the message processing module exceeds a utilization threshold or the operating temperature of the message processing module exceeds an operating temperature threshold.

[0206] Aspect 8. The method according to aspect 7, wherein the operating temperature of the message processing module includes the junction temperature of the message processing module, and wherein the operating temperature threshold includes a predetermined junction temperature.

[0207] Aspect 9. The method according to any one of Aspects 7 to 8, wherein the utilization rate of the message processing module includes a numerical correspondence between the verification rate of the message processing module and the verification capability of the message processing module.

[0208] Aspect 10. The method according to any one of Aspects 7 to 9, wherein the utilization of the message processing module is evaluated during listening for messages from the source ID.

[0209] Aspect 11. The method according to any one of Aspects 7 to 10, the method further comprising: normalizing the utilization of the message processing module to the total duration of listening for messages from the source ID during the evaluation interval.

[0210] Aspect 12. The method according to any one of Aspects 7 to 11, the method further comprising: determining that the flooding attack is occurring based on determining that the cumulative message transmission rate of a plurality of wireless communication messages including the wireless communication message exceeds a cumulative message rate threshold before determining that the message load indicator associated with the flooding attack exceeds the message load threshold.

[0211] Aspect 13. The method according to any one of Aspects 2 to 12, the method further comprising: generating a filter list including the source ID based on determining that a source-specific message rate associated with the source ID exceeds a source-specific message rate threshold.

[0212] Aspect 14. The method according to any one of Aspects 2 to 13, wherein determining that the message load indicator associated with the flooding attack originating from one or more flooding source IDs of one or more flooding UEs exceeds the message load threshold comprises: evaluating the message load indicator within an evaluation interval.

[0213] Aspect 15. The method according to aspect 14, wherein the evaluation interval includes a plurality of command intervals.

[0214] Aspect 16. The method according to aspect 15, wherein alternating between the interval for ignoring messages from the one or more flood source IDs and the interval for listening for messages from the one or more flood source IDs comprises: applying different timing offsets to the interval for ignoring messages from the one or more flood source IDs within each command interval of the evaluation interval.

[0215] Aspect 17. The method according to aspect 16, wherein applying different timing offsets to the interval for listening to messages from the one or more flooding source IDs within each command interval of the evaluation interval comprises: listening to messages from the one or more flooding source IDs during different portions of each command interval.

[0216] Aspect 18. The method according to aspect 17, wherein applying different timing offsets to the intervals in which messages from the one or more flooding source IDs are ignored within each command interval of the evaluation interval comprises: cumulatively listening for messages during each timing offset associated with a command interval in the evaluation interval.

[0217] Aspect 19. The method according to any one of Aspects 1 to 18, wherein the first filtering state includes enabling filtering of a first portion of the first filtering state, disabling filtering of a second portion of the first filtering state, and enabling filtering of a third portion of the first filtering state, wherein the second portion of the first filtering state occurs between the first portion of the first filtering state and the third portion of the first filtering state.

[0218] Aspect 20. The method according to any one of aspects 1 to 19, the method further comprising: determining, during an interval of listening for messages from the source ID, that the source ID includes a cloned source ID.

[0219] Aspect 21. The method according to aspect 20, the method further comprising: removing the source ID from the filter list based on determining that the source ID includes a cloned source ID.

[0220] Aspect 22. The method according to aspect 20, wherein determining the source ID, including the cloned source ID, includes: identifying the cloned source ID as associated with the UE based on one or more of historical data, location information, speed, heading, local database or crowdsourced information.

[0221] Aspect 23. A method for wireless communication, the method comprising: obtaining a wireless communication message associated with a source ID; determining a message load indicator indicating a filtering state transition, wherein the message load indicator is associated with the wireless communication message; and transitioning from a first filtering state to a second filtering state based on determining that the message load indicator indicates the filtering state transition, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

[0222] Aspect 24. The method according to aspect 23, wherein the first filtering state is associated with a first filtering duty cycle, and the second filtering state is associated with a second filtering duty cycle, the second filtering duty cycle being greater than the first filtering duty cycle.

[0223] Aspect 25. The method according to aspect 24, wherein the first filtering duty cycle includes disabling filtering of wireless communication messages during the first filtering state, and wherein the second filtering duty cycle includes alternating between filtering the source ID and disabling filtering.

[0224] Aspect 26. The method according to any one of Aspects 24 to 25, wherein the second filtering duty cycle includes disabling the filtering of wireless communication messages during the second filtering state, and wherein the first filtering state includes alternating between filtering the source ID and disabling filtering.

[0225] Aspect 27. The method according to any one of Aspects 24 to 26, wherein: the first filter duty cycle includes alternating between filtering one or more flooding source IDs of one or more flooding UEs and disabling filters having the first duty cycle; and the second filter duty cycle includes alternating between filtering one or more flooding source IDs of one or more flooding UEs and disabling filters having the second duty cycle.

[0226] Aspect 28. An apparatus for wireless communication, the apparatus comprising: a memory; and one or more processors coupled to the memory and configured to: obtain a wireless communication message associated with a source identifier (ID); determine that the source ID is associated with a flooding attack; and filter the wireless communication message associated with the source ID based on the determination that the source ID is associated with a flooding attack, wherein filtering the wireless communication message includes alternating between a first filtering state and a second filtering state, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

[0227] Aspect 29. The apparatus according to aspect 27, wherein the one or more processors are further configured to transition from a first filtering state to a second filtering state based on determining that a message load indicator associated with the flooding attack exceeds a message load threshold.

[0228] Aspect 30. The apparatus according to aspect 29, wherein, in order to change the operation of the message processing component from a first filtering state to a second filtering state based on determining that the message load indicator associated with the flooding attack exceeds the message load threshold.

[0229] Aspect 31. The apparatus according to any one of Aspects 29 to 30, wherein the first filtering state is associated with filtering being disabled, and wherein the second filtering state is associated with filtering being enabled.

[0230] Aspect 32. The apparatus according to any one of Aspects 29 to 31, wherein the first filtration state is associated with filtration having a first duty cycle, and the second filtration state is associated with filtration having a second duty cycle greater than the first duty cycle.

[0231] Aspect 33. The apparatus according to any one of Aspects 29 to 32, wherein the message load threshold is associated with the second filtering state, and wherein the message load threshold is greater than an additional message load threshold associated with the first filtering state.

[0232] Aspect 34. The apparatus according to any one of Aspects 29 to 33, wherein the one or more processors are further configured to: determine that the flooding attack is occurring based on determining that the cumulative message transmission rate of a plurality of wireless communication messages including the wireless communication message exceeds a cumulative message rate threshold before determining that the message load indicator associated with the flooding attack exceeds the message load threshold.

[0233] Aspect 35. The apparatus according to any one of Aspects 29 to 34, wherein the one or more processors are further configured to: generate a filter list including the source ID based on determining that a source-specific message rate associated with the source ID exceeds a source-specific message rate threshold.

[0234] Aspect 36. The apparatus according to any one of aspects 29 to 35, wherein determining that the message load indicator associated with the flooding attack originating from one or more flooding source IDs of one or more flooding UEs exceeds the message load threshold comprises: evaluating the message load indicator within an evaluation interval.

[0235] Aspect 37. The apparatus according to aspect 36, wherein the evaluation interval includes a plurality of command intervals.

[0236] Aspect 38. The apparatus according to aspect 37, wherein alternating between the interval for ignoring messages from the one or more flooding source IDs and the interval for listening for messages from the one or more flooding source IDs comprises: applying different timing offsets to the interval for ignoring messages from the one or more flooding source IDs within each command interval of the evaluation interval.

[0237] Aspect 39. The apparatus according to aspect 38, wherein applying different timing offsets to the interval for listening to messages from the one or more flooding source IDs within each command interval of the evaluation interval includes: listening to messages from the one or more flooding source IDs during different portions of each command interval.

[0238] Aspect 40. The apparatus according to aspect 39, wherein applying different timing offsets to the intervals in which messages from the one or more flooding source IDs are ignored within each command interval of the evaluation interval comprises: cumulatively listening for messages during each timing offset associated with a command interval in the evaluation interval.

[0239] Aspect 41. The apparatus according to any one of Aspects 28 to 40, wherein the first filtering state includes enabling filtering of a first portion of the first filtering state, disabling filtering of a second portion of the first filtering state, and enabling filtering of a third portion of the first filtering state, wherein the second portion of the first filtering state occurs between the first portion of the first filtering state and the third portion of the first filtering state.

[0240] Aspect 42. The apparatus according to any one of Aspects 28 to 41, wherein the one or more processors are further configured to determine at least one of the following: the utilization rate of the message processing module exceeds a utilization threshold or the operating temperature of the message processing module exceeds an operating temperature threshold.

[0241] Aspect 43. The apparatus according to aspect 42, wherein the operating temperature of the message processing module includes the junction temperature of the message processing module, and wherein the operating temperature threshold includes a predetermined junction temperature.

[0242] Aspect 44. The apparatus according to aspect 42, wherein the utilization rate of the message processing module includes a numerical correspondence between the verification rate of the message processing module and the verification capability of the message processing module.

[0243] Aspect 45. The apparatus according to aspect 42, wherein the utilization of the message processing module is evaluated during listening for messages from the source ID.

[0244] Aspect 46. The apparatus according to aspect 42, wherein the one or more processors are further configured to: normalize the utilization of the message processing module to the total duration for which messages from the source ID are listened during the evaluation interval.

[0245] Aspect 47. The apparatus according to any one of Aspects 28 to 46, wherein the one or more processors are further configured to: determine, during an interval of listening for messages from the source ID, that the source ID includes a cloned source ID.

[0246] Aspect 48. The apparatus according to aspect 47, wherein the one or more processors are further configured to remove the source ID from the filter list based on determining that the source ID includes a cloned source ID.

[0247] Aspect 49. The apparatus according to any one of Aspects 1 to 20, wherein determining that the source ID includes the cloned source ID comprises: identifying the cloned source ID associated with the UE based on one or more of historical data, location information, speed, heading, local database or crowdsourcing information.

[0248] Aspect 50. An apparatus for wireless communication, the apparatus comprising: a memory; and one or more processors coupled to the memory and configured to: obtain a wireless communication message associated with a source ID; determine a message load indicator indicating a filter state transition, wherein the message load indicator is associated with the wireless communication message; and transition from a first filter state to a second filter state based on determining that the message load indicator indicates the filter state transition, wherein the first filter state and the second filter state are associated with different filter amounts.

[0249] Aspect 51. The apparatus according to aspect 50, wherein the first filtration state is associated with a first filtration duty cycle, and the second filtration state is associated with a second filtration duty cycle, the second filtration duty cycle being greater than the first filtration duty cycle.

[0250] Aspect 52. The apparatus according to aspect 51, wherein the first filtering duty cycle includes disabling filtering of wireless communication messages during the first filtering state, and wherein the second filtering duty cycle includes alternating between filtering the source ID of one or more flooded UEs and disabling filtering.

[0251] Aspect 53. The apparatus according to aspect 51, wherein the second filtering duty cycle includes disabling filtering of wireless communication messages during the second filtering state, and wherein the first filtering state includes alternating between filtering the source ID and disabling filtering.

[0252] Aspect 54. The apparatus according to aspect 51, wherein: the first filter duty cycle includes alternating between filtering one or more flooding source IDs of one or more flooding UEs and disabling filters having the first duty cycle; and the second filter duty cycle includes alternating between filtering one or more flooding source IDs of one or more flooding UEs and disabling filters having the second duty cycle.

Claims

1. A method for wireless communication, the method comprising: Obtain the wireless communication message associated with the source identifier (ID); The source ID was determined to be associated with a flooding attack; as well as Filtering wireless communication messages associated with the source ID based on determining that the source ID is associated with a flooding attack, wherein filtering the wireless communication messages includes alternating between a first filtering state and a second filtering state, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

2. The method according to claim 1, further comprising: The system transitions from a first filtering state to a second filtering state based on determining that the message load indicator associated with the flooding attack exceeds a message load threshold.

3. The method of claim 2, wherein the transition based on determining that the message load indicator associated with the flooding attack exceeds the message load threshold comprises: Change the operation of the message processing component from the first filtering state to the second filtering state.

4. The method of claim 3, wherein the message load threshold is associated with the second filtering state, and wherein the message load threshold is greater than an additional message load threshold associated with the first filtering state.

5. The method of claim 2, wherein the first filtering state is associated with filtering being disabled, and wherein the second filtering state is associated with filtering being enabled.

6. The method of claim 2, wherein the first filtering state is associated with a filter having a first duty cycle, and the second filtering state is associated with a filter having a second duty cycle greater than the first duty cycle.

7. The method of claim 2, wherein determining that the message load indicator associated with the flooding attack exceeds the message load threshold comprises determining at least one of the following: the utilization rate of the message processing module exceeds a utilization threshold or the operating temperature of the message processing module exceeds an operating temperature threshold.

8. The method of claim 7, wherein the operating temperature of the message processing module includes the junction temperature of the message processing module, and wherein the operating temperature threshold includes a predetermined junction temperature.

9. The method according to claim 7, wherein the utilization rate of the message processing module includes a numerical correspondence between the verification rate of the message processing module and the verification capability of the message processing module.

10. The method of claim 7, wherein the utilization of the message processing module is evaluated during listening for messages from the source ID.

11. The method according to claim 7, further comprising: The utilization of the message processing module is normalized to the total duration of listening for messages from the source ID during the evaluation interval.

12. The method according to claim 2, further comprising: Before determining that the message load indicator associated with the flooding attack exceeds the message load threshold, the flooding attack is determined to be occurring based on determining that the cumulative message sending and receiving rate of multiple wireless communication messages including the wireless communication message exceeds the cumulative message rate threshold.

13. The method according to claim 2, further comprising: A filter list including the source ID is generated based on determining that the source-specific message rate associated with the source ID exceeds a source-specific message rate threshold.

14. The method of claim 2, wherein determining that the message load indicator associated with the flooding attack originating from one or more flooding source IDs of one or more flooding UEs exceeds the message load threshold comprises: The message load indicator is evaluated within the evaluation interval.

15. The method of claim 14, wherein the evaluation interval comprises a plurality of command intervals.

16. The method of claim 15, wherein alternating between intervals for ignoring messages from the one or more flooding source IDs and intervals for listening to messages from the one or more flooding source IDs comprises: Different timing offsets are applied to the intervals in the evaluation intervals for ignoring messages from the one or more flooding source IDs.

17. The method of claim 16, wherein applying different timing offsets to the interval for listening to messages from the one or more flooding source IDs within each command interval of the evaluation interval comprises: Listen for messages from the one or more flood source IDs during different portions of each command interval.

18. The method of claim 17, wherein applying different timing offsets to the intervals in which messages from the one or more flooding source IDs are ignored within each command interval of the evaluation interval comprises: Messages are listened for cumulatively during each timing offset associated with the command interval in the evaluation interval.

19. The method of claim 1, wherein the first filtering state includes enabling filtering of a first portion of the first filtering state, disabling filtering of a second portion of the first filtering state, and enabling filtering of a third portion of the first filtering state, wherein the second portion of the first filtering state occurs between the first portion of the first filtering state and the third portion of the first filtering state.

20. The method according to claim 1, further comprising: During the interval of listening for messages from the source ID, it is determined that the source ID includes the cloned source ID.

21. The method according to claim 20, further comprising: The source ID is removed from the filter list based on the determination that the source ID includes the cloned source ID.

22. The method of claim 20, wherein determining that the source ID includes the cloned source ID comprises: The cloned source ID is associated with the UE based on one or more of the following: historical data, location information, speed, heading, local database, or crowdsourced information.

23. An apparatus for wireless communication, the apparatus comprising: Memory; and One or more processors, said one or more processors being coupled to the memory and configured to: Obtain the wireless communication message associated with the source ID; The source ID was determined to be associated with a flooding attack; and Filtering wireless communication messages associated with the source ID based on determining that the source ID is associated with a flooding attack, wherein filtering the wireless communication messages includes alternating between a first filtering state and a second filtering state, wherein the first filtering state and the second filtering state are associated with different filtering amounts.

24. The apparatus of claim 23, wherein the one or more processors are further configured to: The system transitions from a first filtering state to a second filtering state based on determining that the message load indicator associated with the flooding attack exceeds a message load threshold.

25. The apparatus of claim 24, wherein the first filtering state is associated with filtering being disabled, and wherein the second filtering state is associated with filtering being enabled.

26. The apparatus of claim 24, wherein the first filtration state is associated with filtration having a first duty cycle, and the second filtration state is associated with filtration having a second duty cycle greater than the first duty cycle.

27. The apparatus of claim 24, wherein determining that the message load indicator associated with the flooding attack originating from one or more flooding source IDs of one or more flooding UEs exceeds the message load threshold comprises: The message load indicator is evaluated within the evaluation interval.

28. The apparatus of claim 27, wherein alternating between an interval for ignoring messages from the source ID and an interval for listening to messages from the one or more flooding source IDs comprises: Different timing offsets are applied to the intervals in the evaluation intervals for ignoring messages from the one or more flooding source IDs.

29. The apparatus of claim 28, wherein applying different timing offsets to the intervals in which messages from the one or more flooding source IDs are ignored within each command interval of the evaluation interval comprises: Messages are listened for cumulatively during each timing offset associated with the command interval in the evaluation interval.

30. The apparatus of claim 23, wherein the first filtering state includes enabling filtering of a first portion of the first filtering state, disabling filtering of a second portion of the first filtering state, and enabling filtering of a third portion of the first filtering state, wherein the second portion of the first filtering state occurs between the first portion of the first filtering state and the third portion of the first filtering state.

Images