Passive Digital Key Systems

Abstract

Techniques are provided for validating a mobile device in a passive digital key system. An exemplary method for validating a mobile device includes determining a positioning result of the mobile device relative to a reference point, obtaining a measured distance with at least a first transceiver, obtaining a calibration distance based at least in part on the positioning result of the mobile device, calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance, and validating the mobile device based at least in part on a comparison of the validation distance to a threshold.

Description

[Technical field]

[0001] The present invention relates to passive digital key systems. [Background technology]

[0002] The use of wireless devices for many everyday activities is becoming more common. Modern wireless devices may utilize one or more wireless communication technologies. For example, wireless devices may communicate using short-range communication technologies, such as Bluetooth technology, UWB technology, mmWave technology, and the like. The use of short-range communication technologies, such as Bluetooth, in wireless devices has become much more common over the past few years and is routinely used in retail stores, offices, homes, cars, and public gathering places. As the use of short-range communication increases, so does the need to protect short-range communication between wireless devices from third-party attacks. For example, Bluetooth communication between wireless devices is susceptible to certain third-party attacks, such as relay in the middle (RITM) attacks. A RITM attack is an attack that occurs when a third-party attacker intercepts packets transmitted between Bluetooth wireless devices and subsequently relays those packets to one of the wireless devices to gain access. An example includes a third-party attacker relaying packets from a key fob to an automobile to unlock the automobile door. A successful RITM attacker can gain access in a fully undetectable manner, so a RITM attack can create significant risks to critical data and real assets. Existing solutions to RITM attacks have certain limitations that may not adequately protect users of wireless devices. Summary of the Invention [Means for solving the problem]

[0003] An exemplary method for validating a mobile device according to the present disclosure includes determining a positioning result of the mobile device relative to a reference point, obtaining a measured distance using at least a first transceiver, obtaining a calibration distance based at least in part on the positioning result of the mobile device, calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance, and validating the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0004] Implementations of such a method may include one or more of the following features: The reference point and the first transceiver may be in a vehicle. The reference point and the first transceiver may be in a fixed structure. The positioning result may indicate an angle relative to the mobile device. Determining the angle relative to the mobile device may include determining an angle of arrival of a signal transmitted by the mobile device. The signal transmitted by the mobile device may be received by the first transceiver. Determining the angle relative to the mobile device may include determining that the mobile device is close to a second transceiver, whereby the second transceiver is disposed at a known position relative to the reference point. The method may include determining a received signal strength of one or more signals transmitted by the mobile device and received by the second transceiver. The second transceiver may be configured to utilize a smaller bandwidth than the first transceiver. Obtaining the calibrated distance may include querying a data structure based on the angle. Obtaining the measured distance to the mobile device may include determining a time of flight of a signal transmitted between the mobile device and the first transceiver. The positioning result may indicate a distance to the mobile device as measured by the at least one second transceiver. The distance to the mobile device may be based on at least one of a received signal strength indication measurement or a time-of-flight measurement. Obtaining the calibration distance may include querying a data structure based on an identification value associated with the at least one second transceiver. The method may include determining a condition associated with the mobile device and determining a threshold value based on the condition.

[0005] An exemplary method for validating a mobile device according to the present disclosure includes determining an angle to the mobile device relative to a reference point using a first wireless transceiver, obtaining a measured range to the mobile device using at least a second wireless transceiver, obtaining a calibration range based at least in part on the angle to the mobile device, calculating a validation range based at least in part on a difference between the measured range and the calibration range, and validating the mobile device based at least in part on a comparison of the validation range to a threshold.

[0006] Implementations of such methods may include one or more of the following features: Determining the angle relative to the mobile device may include determining that the mobile device is located within a predetermined angle interval. The second wireless transceiver may be configured to utilize a wider bandwidth than the first wireless transceiver. Obtaining the calibration distance may include obtaining the calibration distance from a data structure based at least in part on the angle relative to the mobile device. The first wireless transceiver and the second wireless transceiver may be disposed in a vehicle, and the calibration distance may be based on a distance between the second wireless transceiver and an edge of the vehicle. The first wireless transceiver and the second wireless transceiver may be disposed in a vehicle, and the calibration distance may be based on a distance between a reference point and an edge of the vehicle. The first wireless transceiver and the second wireless transceiver may be disposed in a vehicle, and the threshold value may be based on a condition of the vehicle. The first wireless transceiver may be near an entrance of a fixed structure, and the second wireless transceiver may be a wireless access point within the fixed structure. Obtaining the distance measurements may include determining a round trip time between the second wireless transceiver and the mobile device.

[0007] An example apparatus according to the present disclosure includes a memory, at least one transceiver, and at least one processor communicatively coupled to the memory and the at least one transceiver, where the at least one processor is configured to determine a positioning result of a mobile device relative to a reference point, obtain a measured distance using at least a first transceiver, obtain a calibration distance based at least in part on the positioning result of the mobile device, calculate a validation distance based at least in part on a difference between the measured distance and the calibration distance, and validate the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0008] Implementations of such an apparatus may include one or more of the following features: The reference point and the first transceiver may be in a vehicle. The reference point and the first transceiver may be in a fixed structure. The positioning result may indicate an angle relative to the mobile device. The at least one processor may be further configured to determine an angle of arrival of a signal transmitted by the mobile device. The signal transmitted by the mobile device may be received by the first transceiver. The at least one processor may be further configured to determine that the mobile device is proximate to the second transceiver, since the second transceiver may be disposed at a known position relative to the reference point. The at least one processor may be further configured to determine a received signal strength of one or more signals transmitted by the mobile device and received by the second transceiver. The second transceiver may be configured to utilize a smaller bandwidth than the first transceiver. The at least one processor may be further configured to query a data structure stored in the memory based on the angle. The at least one processor may be further configured to determine a time of flight of a signal transmitted between the mobile device and the first transceiver. The positioning result may indicate a distance to the mobile device as measured by the at least one second transceiver. The at least one processor may be further configured to calculate a distance to the mobile device based on at least one of the received signal strength indication measurements or the time-of-flight measurements. The at least one processor may be further configured to query a data structure stored in the memory based on an identification value associated with the at least one second transceiver. The at least one processor may be further configured to determine a condition associated with the mobile device and determine a threshold value based on the condition.

[0009] An example apparatus according to the present disclosure includes a memory, at least one transceiver, and at least one processor communicatively coupled to the memory and the at least one transceiver, where the at least one processor is configured to determine an angle to a mobile device relative to a reference point using at least a first wireless transceiver, obtain a measured range to the mobile device using the at least a second wireless transceiver, obtain a calibration distance based at least in part on the angle to the mobile device, calculate a validation distance based at least in part on a difference between the measured distance and the calibration distance, and validate the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0010] Implementations of such an apparatus may include one or more of the following features: The at least one processor may be further configured to determine that the mobile device is located within a predetermined angular segment. The second wireless transceiver may be configured to utilize a wider bandwidth than the first wireless transceiver. The at least one processor may be further configured to obtain a calibration distance from a data structure stored in the memory based at least in part on the angle relative to the mobile device. The first wireless transceiver and the second wireless transceiver may be disposed in a vehicle, and the calibration distance may be based on a distance between the second wireless transceiver and an edge of the vehicle. The first wireless transceiver and the second wireless transceiver may be disposed in a vehicle, and the calibration distance may be based on a distance between a reference point and an edge of the vehicle. The first wireless transceiver and the second wireless transceiver may be disposed in a vehicle, and the threshold value may be based on a condition of the vehicle. The first wireless transceiver may be near an entrance of a fixed structure, and the second wireless transceiver may be a wireless access point within the fixed structure. The at least one processor may be further configured to determine a round trip time between the second wireless transceiver and the mobile device.

[0011] The items and / or techniques described herein may provide one or more of the following capabilities, as well as other capabilities not mentioned: A vehicle, or other structure, may utilize a digital key system. A mobile device, such as a smartphone, smartwatch, or key fob, may allow a user to enter the vehicle or other structure. The digital key system may utilize a first radio access technology to determine a first distance to the mobile device. A second radio access technology may be used to determine a second distance to the mobile device. Antennas and transceivers for the first radio access technology and the second radio access technology may be in different locations. The digital key system may utilize one or more data structures to store offset bias values ​​based on the different antenna locations. The mobile device may be validated by the digital key system based on the first distance, the second distance, and one or more bias values. The combination of the first radio access technology and the second radio access technology may reduce threats associated with RITM attacks. Other capabilities may be provided, and not every implementation according to the present disclosure must provide any, much less all, of the capabilities discussed. [Brief description of the drawings]

[0012] [Figure 1] 1 is a schematic diagram of an example wireless communication system. [Diagram 2] FIG. 2 is a block diagram of components of an exemplary user equipment. [Diagram 3] FIG. 2 is a block diagram of components of an exemplary transmitting / receiving point. [Figure 4] FIG. 2 is a block diagram of components of an example server. [Figure 5A] FIG. 13 illustrates an example message flow for a round trip time measurement session. [Figure 5B] FIG. 1 is a diagram of an example Wi-Fi wireless communication system. [Figure 6]FIG. 13 is a diagram of an example message flow for passive positioning of a user equipment. [Figure 7] FIG. 1 is a diagram of an exemplary relay attack in a wireless digital key system. [Figure 8] 1 is a diagram of an exemplary vehicle with multiple wireless transceivers. [Figure 9] FIG. 1 is a diagram of a first example of a passive digital key system in a vehicle. [Figure 10] FIG. 2 is a diagram of a second example of a passive digital key system in a vehicle. [Figure 11] FIG. 1 is a diagram of an exemplary passive digital key system in a fixed structure. [Figure 12] FIG. 1 is a diagram of an exemplary data structure for a passive digital key system. [Figure 13] FIG. 2 is a process flow diagram for a method of validating a mobile device with a first exemplary passive digital key system. [Figure 14] FIG. 11 is a process flow diagram for a method of validating a mobile device with a second exemplary passive digital key system. [Figure 15] FIG. 11 is a process flow diagram for a method of validating a mobile device with a third exemplary passive digital key system. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0013] Techniques for validating a mobile device in a passive digital key system are discussed herein. In a digital key vehicle system, short-range communication technologies such as Bluetooth Low Energy (BLE), UWB, or mmWave technologies may be used to validate a mobile device such as a key fob. Current BLE-based digital key systems may utilize multiple BLE transceivers disposed in a vehicle to obtain a distance estimate to a digital key in any orientation relative to the vehicle. In addition to the BLE transceivers, the vehicle may also include one or more Wi-Fi-based transceivers. The passive digital key system provided herein utilizes a Wi-Fi ranging system assisted by short-range communication to reduce vulnerability to RITM-type attacks. In one example, short-range communication (e.g., BLE) ranging results, such as received signal strength (RSSI) measurements, may be used to indicate the relative direction of a mobile device (e.g., digital key) with respect to the vehicle. To minimize bias in various directions around the vehicle, the distance between the Wi-Fi radio installed in the vehicle and the vehicle perimeter area where the mobile device is detected by the short-range communication system may be subtracted from the measured distance using Wi-Fi. Other distance estimation methods (e.g., Ultra-Wide Band (UWB) based schemes), which may also be subject to biases related to the position of the transceiver and / or antenna module relative to the frame of the vehicle, may also benefit from the proposed assistance from the short-range transceiver. For example, an automobile manufacturer may install UWB radios for digital key applications, but due to cost constraints, there may only be a limited number of UWB radios (e.g., four UWB radios) for such applications. The techniques provided herein may be used for UWB based security schemes, since the position of the UWB radios and corresponding antenna modules may cause bias errors relative to the vehicle perimeter and short-range transceivers. Other combinations of wireless technologies may also be used.For example, combinations of WiFi and BLE, WiFi and UWB, UWB and BLE, and other long-range or medium-range technologies with short-range technologies may be used. These techniques and configurations are examples, and other techniques and configurations may be used.

[0014] Referring to FIG. 1, an example of a communication system 100 includes a UE 105, a radio access network (RAN) 135, here a fifth generation (5G) next generation (NG) RAN (NG-RAN), and a 5G core network (5GC) 140. The UE 105 may be, for example, an IoT device, a location tracking device, a mobile phone, or other device. The 5G network may be referred to as a New Radio (NR) network, the NG-RAN 135 may be referred to as a 5G RAN or an NR RAN, and the 5GC 140 may be referred to as an NG Core Network (NGC). Standardization of the NG-RAN and 5GC is underway in the 3rd Generation Partnership Project (3GPP). Thus, the NG-RAN 135 and the 5GC 140 may comply with current and future standards for 5G support from the 3GPP. The RAN 135 may be another type of RAN, for example, a 3G RAN, a 4G Long Term Evolution (LTE) RAN, etc. The communication system 100 may utilize information from a constellation 185 of satellite vehicles (SVs) 190, 191, 192, 193 for a satellite positioning system (SPS) (e.g., Global Navigation Satellite System (GNSS)), such as Global Positioning System (GPS), Global Navigation Satellite System (GLONASS), Galileo, or Beidou, or some other local or regional SPS, such as Indian Regional Navigation Satellite System (IRNSS), European Geostationary Satellite Navigation Overlay Service (EGNOS), or Wide Area Augmentation System (WAAS). Additional components of the communication system 100 are described below. The communication system 100 may include additional or alternative components.

[0015] 1, the NG-RAN 135 includes NR nodeBs (gNBs) 110a, 110b, and next generation eNodeBs (ng-eNBs) 114, and the 5GC 140 includes an access and mobility management function (AMF) 115, a session management function (SMF) 117, a location management function (LMF) 120, and a gateway mobile location center (GMLC) 125. The gNBs 110a, 110b, and the ng-eNB 114 are communicatively coupled to one another and each configured to wirelessly communicate bidirectionally with the UE 105, and each communicatively coupled to the AMF 115 and configured to communicate bidirectionally with the AMF 115. The AMF 115, the SMF 117, the LMF 120, and the GMLC 125 are communicatively coupled to one another, and the GMLC is communicatively coupled to an external client 130. The SMF 117 may act as the initial point of contact for a Service Control Function (SCF) (not shown) to create, control, and delete media sessions.

[0016] FIG. 1 provides a generalized illustration of various components, any or all of which may be utilized as appropriate, and each of which may be duplicated or omitted as necessary. Specifically, while one UE 105 is illustrated, many UEs (e.g., hundreds, thousands, millions, etc.) may be utilized in the communication system 100. Similarly, the communication system 100 may include more (or fewer) SVs (i.e., more or fewer than the four SVs 190-193 illustrated), gNBs 110a, 110b, ng-eNB 114, AMF 115, external client 130, and / or other components. The illustrated connections connecting the various components in the communication system 100 include data and signaling connections, which may include additional (intermediate) components, direct or indirect physical and / or wireless connections, and / or additional networks. Additionally, the components may be rearranged, combined, separated, substituted, and / or omitted depending on the desired functionality.

[0017] 1 illustrates a 5G-based network, similar network implementations and configurations may be used for other communication technologies, such as 3G, Long Term Evolution (LTE), etc. Implementations described herein (whether for 5G technology and / or for one or more other communication technologies and / or protocols) may be used to transmit (or broadcast) directional synchronization signals, receive and measure directional signals at a UE (e.g., the UE 105), and / or provide location assistance to the UE 105 (via the GMLC 125 or other location server), and / or calculate a location of the UE 105 at a location-identifiable device, such as the UE 105, gNBs 110a, 110b, or LMF 120, based on measurements received at the UE 105 for such directional transmitted signals. The Gateway Mobile Location Center (GMLC) 125, Location Management Function (LMF) 120, Access and Mobility Management Function (AMF) 115, SMF 117, ng-eNB (eNodeB) 114, and gNB (gNodeB) 110a, 110b are examples and may each be replaced by or include various other location server functions and / or base station functions in various embodiments.

[0018] The UE 105 may comprise and / or be referred to as a device, a mobile device, a wireless device, a mobile terminal, a terminal, a mobile station (MS), a secure user plane location (SUPL) enabled terminal (SET), or some other name. Additionally, the UE 105 may correspond to a mobile phone, a smartphone, a laptop, a tablet, a PDA, a tracking device, a navigation device, an Internet of Things (IoT) device, an asset tracker, a health monitor, a security system, a smart city sensor, a smart meter, a wearable tracker, or some other portable or movable device. Typically, but not necessarily, the UE 105 may support wireless communications using one or more radio access technologies (RATs), such as Global System for Mobile communication (GSM), Code Division Multiple Access (CDMA), Wideband CDMA (WCDMA), LTE, High Rate Packet Data (HRPD), IEEE 802.11 WiFi (also referred to as Wi-Fi), Bluetooth (BT), Worldwide Interoperability for Microwave Access (WiMAX), 5G new radio (NR) (e.g., using NG-RAN 135 and 5GC 140), etc. The UE 105 may support wireless communications using a wireless local area network (WLAN), which may connect to other networks (e.g., the Internet) using, for example, a digital subscriber line (DSL) or packet cable. Use of one or more of these RATs may enable the UE 105 to communicate with an external client 130 (e.g., via elements of the 5GC 140 not shown in FIG. 1 or possibly via the GMLC 125) and / or enable the external client 130 to receive location information regarding the UE 105 (e.g., via the GMLC 125).

[0019] The UE 105 may comprise a single entity or may comprise multiple entities, such as in a personal area network where the user may utilize audio, video and / or data I / O (input / output) devices and / or body sensors, as well as a separate wired or wireless modem. An estimate of the UE 105's location may be referred to as a position, location estimate, position fix, fix, location, location estimate, or location fix, and provides location coordinates (e.g., latitude and longitude) of the UE 105 that may or may not include an altitude component (e.g., elevation, height or depth above ground, floor, or basement). Alternatively, the UE 105's location may be represented as a civic location (e.g., as an address or designation of some point or small area in a building, such as a particular room or floor). The UE 105's location may be represented as an area or volume (defined either geographically or in a civic format) within which the UE 105 is expected to be located with some probability or confidence level (e.g., 67%, 95%, etc.). The location of the UE 105 may be expressed as a relative location, e.g., comprising a distance and a direction from a known location. The relative location may be expressed as relative coordinates (e.g., X, Y (and Z) coordinates) defined relative to some origin in a known location, which may be defined, e.g., geographically, civic-wise, or by reference to a point, area, or volume shown, e.g., on a map, floor plan, or building plan. In the description contained herein, use of the term location may comprise any of these variations unless otherwise specified. When calculating the location of a UE, it is common to solve for local x, y, and possibly z coordinates and then convert the local coordinates to absolute coordinates (e.g., for latitude, longitude, and altitude above or below mean sea level) if desired.

[0020] The UE 105 may be configured to communicate with other entities using one or more of a variety of technologies. The UE 105 may be configured to indirectly connect to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links. The D2D P2P links may be supported with any suitable D2D radio access technology (RAT), such as LTE Direct (LTE-D), WiFi Direct (WiFi-D), Bluetooth, 5G CV2X Sidelink, 5G ProSe, etc. One or more of the groups of UEs utilizing D2D communication may be within a geographic coverage area of ​​a transmission / reception point (TRP), such as one or more of the gNBs 110a, 110b, and / or ng-eNB 114. Other UEs in such a group may be outside such geographic coverage area or may not otherwise be able to receive transmissions from the base station. A group of UEs communicating via D2D communication may utilize a one-to-many (1:M) system where each UE may transmit to other UEs in the group. A TRP may facilitate scheduling of resources for D2D communication. In other cases, D2D communication may be performed between UEs without the involvement of a TRP.

[0021] The base stations (BSs) in the NG-RAN 135 shown in FIG. 1 include NR NodeBs referred to as gNBs 110a and 110b. The pair of gNBs 110a, 110b in the NG-RAN 135 may be connected to each other via one or more other gNBs. Access to the 5G network is provided to the UE 105 via wireless communication between the UE 105 and one or more of the gNBs 110a, 110b, which may provide wireless communication access to the 5G C140 on behalf of the UE 105 using 5G. In FIG. 1, the serving gNB for the UE 105 is assumed to be gNB 110a, but another gNB (e.g., gNB 110b) may function as a serving gNB if the UE 105 moves to another location, or may function as a secondary gNB to provide additional throughput and bandwidth to the UE 105.

[0022] 1 may include the ng-eNB 114, also referred to as a next generation evolved Node B. The ng-eNB 114 may be connected to one or more of the gNBs 110a, 110b in the NG-RAN 135, possibly via one or more other gNBs and / or one or more other ng-eNBs. The ng-eNB 114 may provide LTE wireless access and / or evolved LTE (eLTE) wireless access to the UE 105. One or more of the gNBs 110a, 110b, and / or the ng-eNB 114 may be configured to function as a positioning dedicated beacon, which may transmit signals to assist in determining the location of the UE 105, but may not receive signals from the UE 105 or other UEs.

[0023] Each of the BSs 110a, 110b, 114 may comprise one or more TRPs. For example, each sector in a cell of the BS may comprise a TRP, but the multiple TRPs may share one or more components (e.g., may share a processor but have separate antennas). The system 100 may include a macro TRP, or the system 100 may have different types of TRPs, such as macro TRPs, pico TRPs, and / or femto TRPs. A macro TRP may cover a relatively large geographic area (e.g., a radius of several kilometers) and may allow unrestricted access by terminals subscribing to the service. A pico TRP may cover a relatively small geographic area (e.g., a pico cell) and may allow unrestricted access by terminals subscribing to the service. A femto TRP or home TRP may cover a relatively small geographic area (e.g., a femto cell) and may allow restricted access by terminals having an association with a femto cell (e.g., a terminal for a user in a home).

[0024] As mentioned, while FIG. 1 illustrates nodes configured to communicate according to a 5G communication protocol, nodes configured to communicate according to other communication protocols, such as, for example, an LTE protocol or an IEEE 802.11x protocol, may be used. For example, in an Evolved Packet System (EPS) that provides LTE wireless access to the UE 105, the RAN may comprise an Evolved Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (E-UTRAN), which may comprise base stations comprising evolved Node Bs (eNBs). The core network for the EPS may comprise an Evolved Packet Core (EPC). The EPS may comprise an E-UTRAN plus an EPC, where in FIG. 1, the E-UTRAN corresponds to the NG-RAN 135 and the EPC corresponds to the 5GC 140.

[0025] The gNBs 110a, 110b, and ng-eNBs 114 may communicate with the AMF 115, which in turn communicates with the LMF 120 for positioning functions. The AMF 115 may support mobility of the UE 105, including cell changes and handovers, and may participate in supporting signaling connections to the UE 105, and possibly data and voice bearers for the UE 105. The LMF 120 may communicate directly with the UE 105, for example, through wireless communication. The LMF 120 may support positioning of the UE 105 when the UE 105 accesses the NG-RAN 135 and may support positioning procedures / methods such as Assisted GNSS (A-GNSS), Observed Time Difference of Arrival (OTDOA), Real Time Kinematics (RTK), High Precision Point Positioning (PPP), Differential GNSS (DGNSS), Enhanced Cell ID (E-CID), Angle of Arrival (AOA), Angle of Departure (AOD), and / or other positioning methods. The LMF 120 may process location service requests for the UE 105, for example, received from the AMF 115 or from the GMLC 125. The LMF 120 may be connected to the AMF 115 and / or to the GMLC 125. The LMF 120 may be referred to by other names, such as a Location Manager (LM), a Location Function (LF), a Commercial LMF (CLMF), or a Value Added LMF (VLMF). A node / system implementing the LMF 120 may additionally or alternatively implement other types of location support modules, such as an Enhanced Serving Mobile Location Center (E-SMLC) or a Secure User Plane Location (SUPL) Location Platform (SLP). At least a portion of the positioning function (including derivation of the position of the UE 105) may be performed in the UE 105 (e.g., using signal measurements obtained by the UE 105 on signals transmitted by wireless nodes such as the gNBs 110a, 110b, and / or ng-eNB 114, and / or assistance data provided to the UE 105 by, for example, the LMF 120).

[0026] The GMLC 125 may support location requests for the UE 105 received from the external client 130 and may forward such location requests to the AMF 115 for forwarding by the AMF 115 to the LMF 120, or may forward the location requests directly to the LMF 120. A location response (e.g., including a position estimate for the UE 105) from the LMF 120 may be returned to the GMLC 125 either directly or via the AMF 115, which may then return a location response (e.g., including a position estimate) to the external client 130. Although the GMLC 125 is illustrated as connected to both the AMF 115 and the LMF 120, one of these connections may be supported by the 5GC 140 in some implementations.

[0027] 1, the LMF 120 may communicate with the gNBs 110a, 110b, and / or the ng-eNB 114 using a New Radio Positioning Protocol A (NPPa or NRPPa), which may be defined in 3GPP Technical Specification (TS) 38.455. NRPPa may be the same as, similar to, or an extension of the LTE Positioning Protocol A (LPPa), which may be defined in 3GPP TS 36.455, and NRPPa messages are transferred between the gNB 110a (or gNB 110b) and the LMF 120 and / or between the ng-eNB 114 and the LMF 120 via the AMF 115. As further shown in FIG. 1, the LMF 120 and the UE 105 may communicate using the LTE Positioning Protocol (LPP), which may be defined in 3GPP TS 36.355. Additionally or alternatively, the LMF 120 and the UE 105 may communicate using a New Radio Positioning Protocol (sometimes referred to as NPP or NRPP), which may be the same as, similar to, or an extension of the LPP. Here, the LPP and / or NPP messages may be transferred between the UE 105 and the LMF 120 via the serving gNB 110a, 110b or the serving ng-eNB 114 for the AMF 115 and the UE 105. For example, the LPP and / or NPP messages may be transferred between the LMF 120 and the AMF 115 using a 5G Location Services Application Protocol (LCS AP), and between the AMF 115 and the UE 105 using a 5G Non-Access Stratum (NAS) protocol. The LPP and / or NPP protocols may be used to support positioning of the UE 105 using UE-assisted and / or UE-based positioning methods, such as A-GNSS, RTK, OTDOA, and / or E-CID.The NRPPa protocol may be used to support positioning of the UE 105 using network-based positioning methods such as E-CID (e.g., when used in conjunction with measurement results obtained by a gNB 110a, 110b, or ng-eNB 114) and / or may be used by the LMF 120 to obtain location-related information from the gNBs 110a, 110b, and / or ng-eNB 114, such as parameters defining directional SS transmissions from the gNBs 110a, 110b, and / or ng-eNB 114.

[0028] With the UE-assisted positioning method, the UE 105 may obtain position measurements and may transmit the measurements to a location server (e.g., the LMF 120) for computation of a position estimate for the UE 105. For example, the position measurements may include one or more of a received signal strength indication (RSSI), a round trip signal propagation time (RTT), a reference signal time difference (RSTD), a reference signal received power (RSRP), and / or a reference signal received quality (RSRQ) for the gNB 110a, 110b, the ng-eNB 114, and / or the WLAN APs. Additionally or alternatively, the position measurements may include GNSS pseudorange, code phase, and / or carrier phase measurements for the SV 190-193.

[0029] Using the UE-based positioning method, the UE 105 may obtain position measurements (e.g., which may be the same as or similar to the position measurements for the UE-assisted positioning method) and may calculate the position of the UE 105 (e.g., with the help of assistance data received from a location server such as the LMF 120 or broadcast by the gNB 110a, 110b, ng-eNB 114, or other base station or AP).

[0030] With a network-based positioning method, one or more base stations (e.g., gNBs 110a, 110b, and / or ng-eNB 114) or APs may obtain position measurements (e.g., RSSI, RTT, RSRP, RSRQ, or time of arrival (TOA) measurements of signals transmitted by the UE 105) and / or receive measurements obtained by the UE 105. The one or more base stations or APs may transmit the measurements to a location server (e.g., LMF 120) for calculation of a position estimate for the UE 105.

[0031] The information provided to the LMF 120 by the gNBs 110a, 110b, and / or ng-eNB 114 using the NRPPa may include timing and configuration information for directional SS transmissions, as well as location coordinates. The LMF 120 may provide some or all of this information to the UE 105 as assistance data in LPP and / or NPP messages via the NG-RAN 135 and the 5GC 140.

[0032] An LPP or NPP message transmitted from the LMF 120 to the UE 105 may instruct the UE 105 to do any of a variety of things depending on the desired functionality. For example, the LPP or NPP message may include instructions for the UE 105 to obtain measurements for GNSS (or A-GNSS), WLAN, E-CID, and / or OTDOA (or some other positioning method). In the case of E-CID, the LPP or NPP message may instruct the UE 105 to obtain one or more measurements (e.g., beam ID, beam width, average angle, RSRP, RSRQ measurements) of directional signals transmitted within a particular cell supported by one or more of the gNBs 110a, 110b, and / or ng-eNB 114 (or supported by some other type of base station such as an eNB or WiFi AP). The UE 105 may return the measurement quantities to the LMF 120 in an LPP or NPP message (e.g., inside a 5G NAS message) via the serving gNB 110a (or serving ng-eNB 114) and the AMF 115.

[0033] As mentioned, the communication system 100 is described with respect to 5G technology, however, the communication system 100 may be implemented to support other communication technologies (e.g., to implement voice, data, positioning, and other functions), such as GSM, WCDMA, LTE, etc., used to support and interact with mobile devices, such as the UE 105. In some such embodiments, the 5GC 140 may be configured to control different air interfaces. For example, the 5GC 140 may be connected to a WLAN using a Non-3GPP InterWorking Function (N3IWF, not shown in FIG. 1) in the 5GC 150. For example, the WLAN may support IEEE 802.11 WiFi access for the UE 105 and may comprise one or more WiFi APs. Here, the N3IWF may connect to the WLAN and to other elements in the 5GC 140, such as the AMF 115. In some embodiments, both the NG-RAN 135 and the 5GC 140 may be replaced by one or more other RANs and one or more other core networks. For example, in an EPS, the NG-RAN 135 may be replaced by an E-UTRAN including eNBs, and the 5GC 140 may be replaced by an EPC including a mobility management entity (MME) instead of the AMF 115, an E-SMLC instead of the LMF 120, and a GMLC that may be similar to the GMLC 125. In such an EPS, the E-SMLC may use LPPa instead of NRPPa to transmit and receive location information to and from the eNBs in the E-UTRAN, and may use LPP to support positioning of the UE 105. In these other embodiments, positioning of the UE 105 using directional PRS may be supported in a similar manner as described herein for 5G networks, with the difference being that the functions and procedures described herein for the gNBs 110a, 110b, ng-eNB 114, AMF 115, and LMF 120 may instead apply to other network elements, such as eNBs, WiFi APs, MMEs, and E-SMLCs, as the case may be.

[0034] As mentioned, in some embodiments, the positioning functionality may be implemented, at least in part, using directional SS beams transmitted by base stations (such as gNBs 110a, 110b, and / or ng-eNB 114) that are within range of the UE (e.g., UE 105 of FIG. 1) whose location is to be determined. The UE may, in some instances, use directional SS beams from multiple base stations (such as gNBs 110a, 110b, ng-eNB 114) to calculate the UE's location.

[0035] 2, UE 200 is an example of UE 105 and comprises a computing platform including a processor 210, memory 211 including software (SW) 212, one or more sensors 213, a transceiver interface 214 for a transceiver 215, a user interface 216, a satellite positioning system (SPS) receiver 217, a camera 218, and a location (motion) device 219. The processor 210, memory 211, sensors 213, transceiver interface 214, user interface 216, SPS receiver 217, camera 218, and location (motion) device 219 may be communicatively coupled to one another by a bus 220 (which may be configured for optical and / or electrical communication, for example). One or more of the depicted devices (e.g., one or more of camera 218, location (motion) device 219, and / or sensor 213, etc.) may be omitted from UE 200. The processor 210 may include one or more intelligent hardware devices, e.g., a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 210 may comprise multiple processors, including a general purpose / application processor 230, a digital signal processor (DSP) 231, a modem processor 232, a video processor 233, and / or a sensor processor 234. One or more of the processors 230-234 may comprise multiple devices (e.g., multiple processors). For example, the sensor processor 234 may comprise a processor, e.g., for radar, ultrasonic, and / or lidar, etc. The modem processor 232 may support dual SIM / dual connectivity (or possibly more SIMs). For example, one SIM (Subscriber Identity Module or Subscriber Identity Module) may be used by an original equipment manufacturer (OEM) and another SIM may be used by an end user of the UE 200 for connectivity. The memory 211 is a non-transitory storage medium that may include random access memory (RAM), flash memory, disk memory, and / or read-only memory (ROM), etc.The memory 211 stores the software 212, which may be processor-readable, processor-executable software code including instructions that, when executed, are configured to cause the processor 210 to perform various functions described herein. Alternatively, the software 212 may not be directly executable by the processor 210, but may be configured, for example, when compiled and executed, to cause the processor 210 to perform functions. The description may refer to the processor 210 performing functions, which includes other implementations, such as when the processor 210 executes software and / or firmware. The description may refer to the processor 210 performing functions as shorthand for one or more of the processors 230-234 performing functions. The description may refer to the UE 200 performing functions as shorthand for one or more suitable components of the UE 200 performing functions. The processor 210 may include a memory in addition to and / or in place of the memory 211 in which instructions are stored. The functionality of processor 210 is discussed more fully below.

[0036] The configuration of UE 200 shown in FIG. 2 is an example of the present disclosure, including the claims, and is not limiting, and other configurations may be used. For example, an exemplary configuration of a UE includes one or more of processors 230-234 of processor 210, memory 211, and wireless transceiver 240. Other exemplary configurations include processors 230-234 of processor 210, memory 211, one or more of wireless transceiver 240, one or more of sensors 213, user interface 216, SPS receiver 217, camera 218, PMD 219, and / or wired transceiver 250.

[0037] The UE 200 may include a modem processor 232 that may be capable of performing baseband processing of signals received and downconverted by the transceiver 215 and / or the SPS receiver 217. The modem processor 232 may perform baseband processing of signals to be upconverted for transmission by the transceiver 215. Additionally or alternatively, the baseband processing may be performed by the processor 230 and / or the DSP 231. However, other configurations may be used to perform the baseband processing.

[0038] The UE 200 may include sensors 213, which may include, for example, an inertial measurement unit (IMU) 270, one or more magnetometers 271, and / or one or more environmental sensors 272. The IMU 270 may comprise one or more inertial sensors, for example, one or more accelerometers 273 (e.g., collectively responsive to acceleration of the UE 200 in three dimensions) and / or one or more gyroscopes 274. The magnetometers may provide measurements for determining an orientation (e.g., relative to magnetic north and / or true north), which may be used for any of a variety of purposes, for example, to support one or more compass applications. The environmental sensors 272 may comprise, for example, one or more temperature sensors, one or more barometric pressure sensors, one or more ambient light sensors, one or more camera imagers, and / or one or more microphones, etc. The sensors 213 may generate analog and / or digital signals, and indicia of the signals may be stored in memory 211 and processed by the DSP 231 and / or processor 230 in support of one or more applications, such as, for example, applications directed to positioning and / or navigation operations. The sensor processing subsystem may be embedded in a low power core that facilitates continuous recording and derivation of sensor parameters required for higher level functionality, such as temperature sensing, assisted localization, or autonomous navigation.

[0039] The sensors 213 may be used in relative position measurement, relative position determination, motion determination, etc. Information detected by the sensors 213 may be used for motion detection, relative displacement, autonomous navigation, sensor-based position determination, and / or sensor-assisted position determination. The sensors 213 may be useful in determining whether the UE 200 is fixed (stationary) or mobile and / or whether any useful information regarding the mobility of the UE 200 should be reported to the LMF 120. For example, based on the information acquired / measured by the sensors 213, the UE 200 may notify / report to the LMF 120 that the UE 200 has detected movement or that the UE 200 has moved, and may report a relative displacement / distance (e.g., via autonomous navigation or sensor-based position determination or sensor-assisted position determination enabled by the sensors 213). In another example, for relative positioning information, the sensors / IMU may be used to determine the angle and / or orientation of other devices relative to the UE 200, etc.

[0040] The IMU 270 may be configured to provide measurements on the direction and / or speed of movement of the UE 200, which may be used in relative position determination. For example, one or more accelerometers 273 and / or one or more gyroscopes 274 of the IMU 270 may detect the linear acceleration and rotational velocity of the UE 200, respectively. The linear acceleration and rotational velocity measurements of the UE 200 may be integrated over time to determine an instantaneous direction and displacement of the UE 200's movement. The instantaneous direction and displacement of the movement may be integrated to track the position of the UE 200. For example, a reference position of the UE 200 may be determined for a certain instant, for example, using the SPS receiver 217 (and / or by some other means), and measurements from the accelerometers 273 and gyroscopes 274 obtained after this instant may be used in autonomous navigation to determine the current position of the UE 200 based on the movement (direction and distance) of the UE 200 compared to the reference position.

[0041] The magnetometer 271 may determine magnetic field strength in different directions, which may be used to determine an orientation of the UE 200. For example, the orientation may be used to provide the UE 200 with a digital compass. The magnetometer 271 may include a two-dimensional magnetometer configured to detect and provide an indication of the magnetic field strength in two orthogonal dimensions. Additionally or alternatively, the magnetometer 271 may include a three-dimensional magnetometer configured to detect and provide an indication of the magnetic field strength in three orthogonal dimensions. The magnetometer 271 may provide a means for sensing the magnetic field and providing an indication of the magnetic field, for example, to the processor 210.

[0042] The transceiver 215 may include a wireless transceiver 240 and a wired transceiver 250 configured to communicate with other devices over wireless and wired connections, respectively. For example, the wireless transceiver 240 may include a transmitter 242 and a receiver 244 coupled to one or more antennas 246 to transmit (e.g., on one or more uplink channels and / or one or more sidelink channels) and / or receive (e.g., on one or more downlink channels and / or one or more sidelink channels) wireless signals 248 and convert signals from the wireless signals 248 to wired (e.g., electrical and / or optical) signals and from the wired (e.g., electrical and / or optical) signals to the wireless signals 248. Thus, the transmitter 242 may include multiple transmitters, which may be separate or combined / integrated components, and / or the receiver 244 may include multiple receivers, which may be separate or combined / integrated components. The wireless transceiver 240 may be configured to communicate signals (e.g., with the TRP and / or one or more other devices) according to various radio access technologies (RATs), such as 5G New Radio (NR), Global System for Mobiles (GSM), Universal Mobile Telecommunications System (UMTS), Advanced Mobile Phone System (AMPS), Code Division Multiple Access (CDMA), Wideband CDMA (WCDMA), Long-Term Evolution (LTE), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), V2C (Uu), IEEE 802.11 (including IEEE 802.11p), WiFi, WiFi Direct (WiFi-D), Bluetooth, Zigbee, 5G Sidelink (CV2X), 5G ProSe, etc. The New Radio may use mm-wave and / or sub-6 GHz frequencies.The wired transceiver 250 may include a transmitter 252 and a receiver 254 configured for wired communication, for example, with the network 135, for transmitting communications to and receiving communications from the gNB 110a. The transmitter 252 may include multiple transmitters, which may be separate components or combined / integrated components, and / or the receiver 254 may include multiple receivers, which may be separate components or combined / integrated components. The wired transceiver 250 may be configured for optical and / or electrical communication, for example. The transceiver 215 may be communicatively coupled to the transceiver interface 214, for example, by an optical and / or electrical connection. The transceiver interface 214 may be at least partially integrated with the transceiver 215.

[0043] The user interface 216 may comprise one or more of several devices, such as, for example, a speaker, a microphone, a display device, a vibrating device, a keyboard, a touch screen, etc. The user interface 216 may include two or more of any of these devices. The user interface 216 may be configured to allow a user to interact with one or more applications hosted by the UE 200. For example, the user interface 216 may store in the memory 211 an indication of analog and / or digital signals to be processed by the DSP 231 and / or the general purpose processor 230 in response to an action from the user. Similarly, the applications hosted on the UE 200 may store in the memory 211 an indication of analog and / or digital signals to present output signals to the user. The user interface 216 may include audio input / output (I / O) devices, including, for example, a speaker, a microphone, digital-to-analog circuitry, analog-to-digital circuitry, amplifiers, and / or gain control circuits (including any two or more of these devices). Other configurations of audio I / O devices may be used. Additionally or alternatively, the user interface 216 may include one or more touch sensors that respond to contact and / or pressure, for example, on a keyboard and / or touch screen of the user interface 216 .

[0044] The SPS receiver 217 (e.g., a Global Positioning System (GPS) receiver) may be capable of receiving and acquiring the SPS signals 260 via the SPS antenna 262. The antenna 262 is configured to convert the wireless signals 260 into wired signals, e.g., electrical or optical signals, and may be integrated with the antenna 246. The SPS receiver 217 may be configured to process the acquired SPS signals 260, in whole or in part, to estimate the position of the UE 200. For example, the SPS receiver 217 may be configured to determine the position of the UE 200 by trilateration using the SPS signals 260. The general-purpose processor 230, the memory 211, the DSP 231, and / or one or more specialized processors (not shown) may be utilized in conjunction with the SPS receiver 217 to process the acquired SPS signals, in whole or in part, and / or to calculate an estimated position of the UE 200. Memory 211 may store indications (e.g., measurements) of SPS signals 260 and / or other signals (e.g., signals acquired from wireless transceiver 240) for use in performing positioning operations. General purpose processor 230, DSP 231, and / or one or more specialized processors, and / or memory 211 may provide or support a position location engine for use in processing the measurements to estimate the position of UE 200.

[0045] The UE 200 may include a camera 218 for capturing still or moving images. The camera 218 may comprise, for example, an imaging sensor (e.g., a charge-coupled device or CMOS imager), a lens, analog-to-digital circuitry, a frame buffer, etc. Additional processing, conditioning, encoding, and / or compression of signals representing the captured images may be performed by the general-purpose processor 230 and / or the DSP 231. Additionally or alternatively, a video processor 233 may perform conditioning, encoding, compression, and / or manipulation of signals representing the captured images. The video processor 233 may decode / decompress stored image data, for example, for presentation on a display device (not shown) of the user interface 216.

[0046] A location (motion) device (PMD) 219 may be configured to determine the location and possibly the movement of UE 200. For example, PMD 219 may be in communication with and / or include some or all of SPS receiver 217. PMD 219 may also or alternatively be configured to determine the location of UE 200 using ground-based signals (e.g., at least some of signals 248) to assist in acquiring and using SPS signals 260 for trilateration, or both. PMD 219 may be configured to use one or more other techniques for determining the location of UE 200 (e.g., relying on a self-reported location of the UE (e.g., part of a location beacon of the UE)) or may use a combination of techniques (e.g., SPS signals and terrestrial positioning signals) to determine the location of UE 200. The PMD 219 may include one or more of the sensors 213 (e.g., gyroscopes, accelerometers, magnetometers, etc.) that may sense an orientation and / or movement of the UE 200 and provide an indication that the processor 210 (e.g., processor 230 and / or DSP 231) may be configured to use to determine the movement (e.g., velocity vector and / or acceleration vector) of the UE 200. The PMD 219 may be configured to provide an indication of uncertainty and / or error in the determined location and / or movement.

[0047] 3, an example of a TRP 300 of the BS 110a, 110b, 114 comprises a computing platform including a processor 310, a memory 311 including software (SW) 312, a transceiver 315, and (optionally) an SPS receiver 317. The processor 310, the memory 311, the transceiver 315, and the SPS receiver 317 may be communicatively coupled to each other by a bus 320 (e.g., may be configured for optical and / or electrical communication). One or more of the devices shown (e.g., the wireless interface and / or the SPS receiver 317) may be omitted from the TRP 300. The SPS receiver 317 may be configured similarly to the SPS receiver 217 to be able to receive and acquire the SPS signal 360 via the SPS antenna 362. The processor 310 may include one or more intelligent hardware devices, e.g., a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 310 may comprise multiple processors (e.g., including a general-purpose / application processor, a DSP, a modem processor, a video processor, and / or a sensor processor, as shown in FIG. 2). The memory 311 is a non-transitory storage medium and may include random access memory (RAM), flash memory, disk memory, and / or read-only memory (ROM), etc. The memory 311 stores the software 312, which may be processor-readable processor-executable software code including instructions that, when executed, are configured to cause the processor 310 to perform various functions described herein. Alternatively, the software 312 may not be directly executable by the processor 310, but may be configured, for example, when compiled and executed, to cause the processor 310 to perform functions. Although the description may refer to the processor 310 performing functions, this includes other implementations, such as when the processor 310 executes software and / or firmware.The description may refer to the processor 310 performing a function as shorthand for one or more of the processors included in the processor 310 performing the function. The description may refer to the TRP 300 performing a function as shorthand for one or more suitable components of the TRP 300 (and thus one of the BSs 110a, 110b, 114) performing the function. The processor 310 may include a memory in addition to and / or in place of the memory 311 in which instructions are stored. The functionality of the processor 310 is discussed more fully below.

[0048] The transceiver 315 may include a wireless transceiver 340 and a wired transceiver 350 configured to communicate with other devices over wireless and wired connections, respectively. For example, the wireless transceiver 340 may include a transmitter 342 and a receiver 344 coupled to one or more antennas 346 to transmit (e.g., on one or more uplink channels) and / or receive (e.g., on one or more downlink channels) wireless signals 348 and convert signals from the wireless signals 348 to wired (e.g., electrical and / or optical) signals and from the wired (e.g., electrical and / or optical) signals to the wireless signals 348. Thus, the transmitter 342 may include multiple transmitters, which may be separate or combined / integrated components, and / or the receiver 344 may include multiple receivers, which may be separate or combined / integrated components. The wireless transceiver 340 may be configured to communicate signals (e.g., with the UE 200, one or more other UEs, and / or one or more other devices) according to a variety of radio access technologies (RATs), such as 5G New Radio (NR), Global System for Mobiles (GSM), Universal Mobile Telecommunications System (UMTS), Advanced Mobile Phone System (AMPS), Code Division Multiple Access (CDMA), Wideband CDMA (WCDMA), Long-Term Evolution (LTE), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), WiFi, WiFi Direct (WiFi-D), 802.15, Bluetooth, Zigbee, UWB, mmWave, etc. Wired transceiver 350 may include a transmitter 352 and a receiver 354 configured for wired communication with network 140, for example, to send communications to and receive communications from LMF 120 or other network servers.The transmitter 352 may include multiple transmitters, which may be separate components or combined / integrated components, and / or the receiver 354 may include multiple receivers, which may be separate components or combined / integrated components. The wired transceiver 350 may be configured for optical and / or electrical communications, for example.

[0049] 3 is an example, not a limitation, of the present disclosure, including the claims, and other configurations may be used. For example, the description herein discusses the TRP 300 being configured to perform or performing certain functions, but one or more of these functions may be performed by the LMF 120 and / or the UE 200 (i.e., the LMF 120 and / or the UE 200 may be configured to perform one or more of these functions).

[0050] 4, an exemplary server such as the LMF 120 comprises a computing platform including a processor 410, a memory 411 including software (SW) 412, and a transceiver 415. The processor 410, the memory 411, and the transceiver 415 may be communicatively coupled to one another by a bus 420 (which may be configured for optical and / or electrical communication, for example). One or more of the depicted devices (e.g., a wireless interface) may be omitted from the server 400. The processor 410 may include one or more intelligent hardware devices, such as a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 410 may comprise multiple processors (e.g., including a general purpose / application processor, a DSP, a modem processor, a video processor, and / or a sensor processor, as shown in FIG. 2). The memory 411 is a non-transitory storage medium and may include a random access memory (RAM), a flash memory, a disk memory, and / or a read only memory (ROM), etc. The memory 411 stores the software 412, which may be processor-readable, processor-executable software code including instructions that, when executed, are configured to cause the processor 410 to perform various functions described herein. Alternatively, the software 412 may not be directly executable by the processor 410, but may be configured, for example, when compiled and executed, to cause the processor 410 to perform functions. The description may refer to the processor 410 performing functions, which includes other implementations, such as when the processor 410 executes software and / or firmware. The description may refer to the processor 410 performing functions as shorthand for one or more of the processors included in the processor 410 performing the functions. The description may refer to the server 400 (or the LMF 120) performing functions as shorthand for one or more suitable components of the server 400 performing the functions.The processor 410 may include memory in which instructions are stored in addition to and / or in place of the memory 411. The functionality of the processor 410 is discussed more fully below.

[0051] The transceiver 415 may include a wireless transceiver 440 and a wired transceiver 450 configured to communicate with other devices over wireless and wired connections, respectively. For example, the wireless transceiver 440 may include a transmitter 442 and a receiver 444 coupled to one or more antennas 446 to transmit (e.g., on one or more downlink channels) and / or receive (e.g., on one or more uplink channels) wireless signals 448 and convert signals from the wireless signals 448 to wired (e.g., electrical and / or optical) signals and from the wired (e.g., electrical and / or optical) signals to the wireless signals 448. Thus, the transmitter 442 may include multiple transmitters, which may be separate or combined / integrated components, and / or the receiver 444 may include multiple receivers, which may be separate or combined / integrated components. The wireless transceiver 440 may be configured to communicate signals (e.g., with the UE 200, one or more other UEs, and / or one or more other devices) according to various radio access technologies (RATs), such as 5G New Radio (NR), Global System for Mobiles (GSM), Universal Mobile Telecommunications System (UMTS), Advanced Mobile Phone System (AMPS), Code Division Multiple Access (CDMA), Wideband CDMA (WCDMA), Long-Term Evolution (LTE), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.11p), WiFi, WiFi Direct (WiFi-D), Bluetooth, BLE, Zigbee, etc. The wired transceiver 450 may include a transmitter 452 and a receiver 454 configured for wired communication, e.g., with the network 135, e.g., for transmitting communications to and receiving communications from the TRP 300.The transmitter 452 may include multiple transmitters, which may be separate components or combined / integrated components, and / or the receiver 454 may include multiple receivers, which may be separate components or combined / integrated components. The wired transceiver 450 may be configured for optical and / or electrical communications, for example.

[0052] The configuration of the server 400 shown in FIG. 4 is an example and not a limitation of the present disclosure, including the claims, and other configurations may be used. For example, the wireless transceiver 440 may be omitted. Additionally or alternatively, although the description herein discusses the server 400 being configured to perform or performing certain functions, one or more of these functions may be performed by the TRP 300 and / or the UE 200 (i.e., the TRP 300 and / or the UE 200 may be configured to perform one or more of these functions).

[0053] Referring to FIG. 5A, an example of a conceptual diagram of a round trip time measurement session 500 is shown. A general approach includes a responding station 502 and an initiating station 504. The responding station 502 and the initiating station 504 may be UEs, such as the UE 200, or other wireless mobile devices configured to participate in time-of-flight based positioning. In an example, but not limited to, the RTT measurement session 500 may be based on Fine Timing Measurement messages exchanged between the responding station 502 and the initiating station 504. Other messages and signals, such as a positioning reference signal (PRS), a sounding reference signal (SRS), an infrared camera signal, or other reference signals, may be used to determine time-of-flight information between the two UEs. The RTT session 500 may utilize an FTM protocol (e.g., 802.11mc D4.3 section 10.24.6) to enable the two stations to exchange round trip measurement frames (e.g., FTM frames). The initiating station 504 may calculate the round trip time by recording the TOA of the FTM frame from the responding station 502 (i.e., t2) and recording the TOD of the acknowledgement frame (ACK) of the FTM frame (i.e., t3). The responding station 502 may record the TOD of the FTM frame (i.e., t1) and the TOA of the ACK received from the initiating station 504 (i.e., t4). A change in message format may allow timing values ​​to be transferred between the responding station 502 and the initiating station 504. Thus, the RTT is calculated as follows: RTT = [(t4-t1)-(t3-t2)] (1)

[0054] The RTT session 500 may enable the initiating station 504 to obtain the distance between the responding station 502. The FTM session is an example of a ranging technique between the responding station 502 and the initiating station 504. Other ranging techniques such as TDOA, TOA / TOF, etc. may also be used to determine the relative location of the two stations. Other signaling may also be used to enable the negotiation process, measurement result exchange, and termination process. For example, Wi-Fi 802.11az ranging null data packet (NDP) and trigger-based (TB) ranging NDP sessions may also be used.

[0055] Referring to FIG. 5B, an exemplary Wi-Fi wireless communication network 550 according to an aspect of the present disclosure is illustrated. In the example of FIG. 5B, a location server 552 (which may correspond to any of the servers described herein) is configured to calculate or assist another entity (e.g., an AP, a UE 554, another UE, a location server, a third-party application, etc.) to calculate a location estimate for the UE 554. The UE 554 may wirelessly communicate with multiple Wi-Fi access points 556-1, 556-2, and 556-3 (which may correspond to any of the TRPs 300 described herein) using RF signals and a standardized protocol for modulation of the RF signals and exchange of information packets. By extracting different types of information from the exchanged RF signals and utilizing the layout of the Wi-Fi wireless network 550 (i.e., AP positions, geometric positions, etc.), the location server 552 may determine or assist in determining the location of the UE 554 in a predefined reference coordinate system. In some aspects, the location server 552 may specify its location using a two-dimensional coordinate system, although the aspects disclosed herein are not so limited and may be applicable to determining location using a three-dimensional coordinate system if additional dimensions are desired. In addition, while FIG. 5B shows one UE 554 and three APs 556-1, 556-2, 556-3, it will be understood that there may be more UEs 554 and more base stations.

[0056] To support location estimation, the APs 556-1, 556-2, 556-3 may be configured to broadcast reference RF signals to UEs within their coverage areas to allow the UE 554 to measure characteristics of such reference RF signals. For example, the UE 554 may measure the ToAs and / or RSSIs of specific reference RF signals transmitted by at least three different APs and may use an RTT positioning method to report these ToAs (and additional information) to the location server 552 (e.g., via the serving AP). To determine the location (x,y) of the UE 554, the entity that determines the location of the UE 554 needs to know the positions of the APs 556-1, 556-2, 556-3, which are defined in the reference coordinate system as (x,y). k ,y k ), where k=1, 2, 3 in the example of FIG. 5B. When one of the APs 556-2 (e.g., the serving AP) or the UE 554 determines the location of the UE 554, the positions of the involved APs 556-1, 556-3 may be provided to the serving AP 556-2 or the UE 554 by the location server 552 (which has information of the network geometry). Alternatively, the location server 552 may determine the location of the UE 554 using the known network geometry.

[0057] Either the UE 554 or each of the APs 556-1, 556-2, and 556-3 determines the distance (d k , where k=1, 2, 3). In an aspect, determining the RTT 558-1, 558-2, 558-3 of signals exchanged between the UE 554 and any AP 556-1, 556-2, 556-3 may be performed to determine the distance (d k) RTT techniques can measure the time between sending a signaling message (e.g., a reference RF signal) and receiving a response. The FTM procedure of FIG. 5A is an example of an RTT technique. These methods may utilize calibration to remove any processing and hardware delays. In some environments, the processing delays of the UE 554 and the APs 556-1, 556-2, 556-3 may be assumed to be the same.

[0058] each distance d k Once x,y is determined, the UE 554, the APs 556-1, 556-2, 556-3, or the location server 552 can solve for the location (x,y) of the UE 554, for example, by using various known geometric techniques such as trilateration. From FIG. 5B, it can be seen that the location of the UE 554 is ideally at the common intersection of three semicircles, each of which has a radius d k and center(x k ,y k ) where k=1, 2, 3.

[0059] In some instances, additional information may be obtained in the form of angles of arrival (AoA) or angles of departure (AoD), which define a range of linear directions (e.g., which may be in a horizontal plane or in three dimensions) or, possibly, directions (e.g., of the UE 554 from the positions of the APs 556-1, 556-2, 556-3). The intersection of the two directions at or near a point (x,y) can provide another estimate of the position of the UE 554. In one example, a single distance and AoA to one of the APs may be used to determine an estimated location of the UE 554.

[0060] Referring to FIG. 6 with further reference to FIG. 5B, an example message flow 600 for passive positioning with multiple APs is shown. The message flow 600 includes a first AP 556-1, a second AP 556-2, and a UE 554. In the message flow 600, the AP network 550 provides passive positioning services by exchanging NDP sounding packets between the APs, and the client UE listens to those packets. The location of the UE may be estimated based on the received sounding packets. For example, the AP network 550 may utilize passive positioning techniques described in 802.11az. In one example, the location of the AP may be broadcast to the UE. In a digital key application, the UE 554 may be configured to feed back measurement information to a controller (not shown in FIG. 6). In one example, the message flow 600 includes sending an I2R NDP message 602 with the first AP 556-1 at time T1, which is received by the second AP 556-2 at time T2. The UE 554 is in a position to receive the I2R NDP 602 at time T5. The second AP 556-2 may transmit an acknowledgement message, such as an NDPA message 604. The second AP 556-2 is configured to transmit an R2I NDP message 606 at time T3, which is received by the first AP 556-1 at time T4. The UE 554 is in a position to receive the R2I NDP 606 at time T6. The first AP 556-1 and / or the second AP 556-2 may be configured to indicate (e.g., via broadcast or other signaling) a turnaround time (i.e., T3-T2), a time of flight (i.e., T2-T1), and other assistance data (e.g., the location of the APs 556-1, 556-2). In an example, the first AP 556-1 may indicate the time of flight and the second AP 556-2 may indicate the turnaround time. In an embodiment, the UE 554 is configured to perform RSTD measurements based on the arrival times T5 and T6.In an embodiment, the UE 554 may be configured to store the respective ToAs (T5, T6) along with station ID information (e.g., the MAC ID of each of the first AP 556-1 and second AP 556-2) in a local data structure and then provide the data to the digital key system controller.

[0061] Referring to FIG. 7, a diagram 700 of a relay attack in a wireless digital key system is shown. Generally, traditional mechanical keys are replaced by electronic keys known as key fobs or remotes. Some remote keyless systems (RKS) may use wireless technologies such as BLE, and a mobile device such as a smartphone, smart watch, or other mobile transceiver may be used as a key. For example, a mobile device 702 (e.g., a smart watch) may be worn by a user 702a, and a vehicle 704 configured with an RKS may automatically unlock or lock based on the proximity of the mobile device 702. In an example, an engine ignition system may also utilize the RKS to enable the engine starting process. The mobile device 702 may be configured to listen for signals broadcast from the vehicle 704 and respond by sending an encrypted code. In a relay station attack (RSA), a thief may forge signals transmitted between the mobile device 702 and the vehicle 704. For example, assuming that a user 702a walks away from the vehicle 704 and is out of communication range, a first thief 710a may use a first wireless device 710 to transmit a general RKS signal to the vehicle 704. The vehicle 704 may respond with an authentication request 707, which the first wireless device 710 may transmit to a second wireless device 706 under the control of a second thief 706a using a device-to-device (D2D) link 708. The second thief 706a may follow the user 702a (e.g., sit close to the user in a restaurant, walk behind the user in a crowd, etc.). The second wireless device 706 may relay the authentication request 707 to the mobile device 702, which may respond with a certificate 709. The second wireless device 706 relays the certificate to the first wireless device 710 via link 708. The first wireless device 710 transmits the certificate 709 to unlock the vehicle 704. The relay attack of Figure 7 is an example, and the signals and procedures may be used in various relay attack schemes.However, such relay attacks typically occur when the vehicle owner or the corresponding fob / mobile device is away from the vehicle.

[0062] Referring to FIG. 8, a diagram 800 of an example vehicle 804 with multiple wireless transceivers is shown. For example, the vehicle 804 includes multiple short-range transceivers and at least one long-range or medium-range transceiver (i.e., longer range than the short-range transceivers). The short-range transceivers in the diagram 800 are illustrated as BLE transceivers (i.e., BLE1 to BLE14), although other short-range communication technologies may be used. The long-range or medium-range transceiver in the diagram is a Wi-Fi transceiver 806 that may include some or all of the components of the TRP 300, which may be an example of a Wi-Fi 806. The BLE transceiver and the Wi-Fi transceiver 806 may be communicatively coupled to a controller (not shown in FIG. 8). The BLE transceiver may be a system-on-chip configuration or other commercially available BLE circuitry (e.g., TI CC2540 / 41, Nordic nRF51822, Cypress Semi PSoC4 BLE, etc.) configured to measure signal strength. Multiple BLE transceivers may be installed on the periphery of the vehicle 804 and configured to detect nearby mobile devices. In an embodiment, the BLE transceivers may be configured to obtain ranging / positioning results (e.g., RSSI) from nearby mobile devices. For example, a first mobile device 802a may be approaching the left side of the vehicle 804, and the first BLE transceiver BLE1 and the second BLE transceiver BLE2 may provide an indication of their respective RSSI measurements to the controller. Other signals and measurements may also be used to indicate detection of the mobile device by one or more BLE transceivers. The controller may be configured to determine a relative location of the first mobile device 802a based on the RSSI measurements (e.g., between BLE1 and BLE2). Similarly, a second mobile device 802b may be approaching the vehicle 804 from behind (e.g., to open the trunk), and the sixth BLE transceiver BLE6 and the seventh BLE transceiver BLE7 may provide respective detection indications and / or RSSI measurements to the controller.Other BLE transceivers may also provide detection indications and / or RSSI measurements to the controller. Because the BLE transceivers are disposed on the periphery of the vehicle 804, the relative distances of each of the mobile devices 802a, 802b to the vehicle may be approximately equal since they are based on distances measured from the periphery of the vehicle.

[0063] The Wi-Fi transceiver 806 may be configured to determine the distance to the mobile devices 802a, 802b based on, for example, an RTT exchange as described in FIG. 5A. Because the antenna module for the Wi-Fi transceiver 806 may be located at the center of the vehicle 804, the measured distance to each mobile device 802a, 802b may differ based on the relative location of the Wi-Fi transceiver 806 with respect to the perimeter of the vehicle 804. For example, a first distance D between the Wi-Fi transceiver 806 and the first mobile device 802a may be determined based on the relative location of the Wi-Fi transceiver 806 with respect to the perimeter of the vehicle 804. 1 is a second distance D between the Wi-Fi transceiver 806 and the second mobile device 802b. 2 The passive digital key system described herein may utilize detection information obtained from the BLE transceivers (e.g., BLE1...BLE14) and distance measurements obtained from the Wi-Fi transceiver 806 to validate the location of the mobile device and reduce the likelihood of relay attacks as illustrated in FIG.

[0064] Referring to FIG. 9, a diagram 900 of a first exemplary passive digital key system in a vehicle 904 is shown. The vehicle 904 includes multiple short-range transceivers (i.e., BLE1...BLE14) and at least one medium / long-range transceiver (i.e., Wi-Fi transceiver 906). Other short-range and medium / long-range communication technologies may also be used. The Wi-Fi transceiver 906 may include some or all of the components of the TRP 300, which may be an example of the Wi-Fi transceiver 906. The BLE transceiver and the Wi-Fi transceiver 906 may be communicatively coupled to a controller 910. The controller 910 may include some or all of the components of the server 400, which may be an example of the controller 910. The controller 910 may be configured to execute a digital key unlocking system (DKUS) for the vehicle 904. The BLE transceiver may be installed on the perimeter of the vehicle 904 and configured to obtain ranging / positioning results (e.g., RSSI) from approaching mobile devices as described in FIG. 8. In an embodiment, the BLE transceiver and controller 910 may be configured to obtain RSSI measurements 905 and detect when the mobile device 902 is near the vehicle 904. When the RSSI-based distance estimate 908 is within a threshold (e.g., 0.5 m, 1 m, 2 m, etc.), the execution of DKUS on the controller 910 may be configured to activate the Wi-Fi transceiver 906 and obtain one or more Wi-Fi signals 906a. Based on the position of the Wi-Fi antenna module relative to the perimeter of the vehicle 904, the Wi-Fi distance estimate 914 may be greater than the true distance between the mobile device 902 and the perimeter of the vehicle. For example, the bias value 912 may be based on the distance between the Wi-Fi transceiver 906 and the vehicle perimeter near the mobile device 902 (e.g., based on the RSSI measurements). In one embodiment, the DKUS may include a vehicle perimeter calibration database, or other data structure, that stores a number of vehicle perimeter calibration values. For each Wi-Fi transceiver j, j=1, 2,...,N, the DKUS stores M vehicle perimeter calibration values ​​Dij , i=1,2,...,M, where D ij is the distance from Wi-Fi transceiver j to the vehicle periphery closest to BLE transceiver i. As illustrated in diagram 900, there are 14 BLE transceivers and one Wi-Fi transceiver. Thus, 14 vehicle periphery calibration values ​​may be stored in the database. For example, the vehicle periphery calibration value may be based on the BLE transceiver that reports the strongest RSSI (e.g., BLE2 in FIG. 9). DKUS stores the vehicle periphery calibration value D associated with the appropriate BLE transceiver and Wi-Fi transceiver combination. ij The Wi-Fi measurement based distance estimate may then be the Wi-Fi distance estimate 914 minus an appropriate vehicle perimeter calibration value (e.g., bias value 912 associated with BLE2). In one example, an interpolation technique may be used to determine the calibration value when the mobile device 902 is located between the BLE transceivers.

[0065] In an embodiment, the BLE transceiver may be used to detect the presence of the mobile device 902 without determining the distance. For example, a transmission from the mobile device 902 may be received by one or more BLE transceivers, such as a first BLE transceiver BLE1, a second BLE transceiver BLE2, and a third BLE transceiver BLE3. Detection of the mobile device 902 by the one or more BLE transceivers may be used as a trigger to activate the Wi-Fi transceiver 906. The Wi-Fi transceivers may be configured to obtain a distance estimate 914, and the controller 910 may apply a bias estimate 912 based on the BLE transceiver (e.g., BLE2) whose signal is strongest. In an example, the Wi-Fi transceiver 906 may determine an angle of arrival (AoA) of a signal transmitted by the mobile device 902, and the controller 910 may obtain the bias estimate 912 based on the AoA.

[0066] 10, a diagram 1000 of a second exemplary passive digital key system in a vehicle 1004 is shown. The vehicle 1004 includes multiple short-range transceivers (i.e., BLE1...BLE14) and at least one medium / long-range transceiver (i.e., Wi-Fi transceiver 1008). The Wi-Fi transceiver 1008 may include some or all of the components of the TRP 300, which may be an example of the Wi-Fi 1008. The BLE transceiver and the Wi-Fi transceiver 1008 may be communicatively coupled to a controller 1010. The controller 1010 may include some or all of the components of the server 400, which may be an example of the controller 1010. The controller 1010 may be configured to execute a digital key unlocking system (DKUS) for the vehicle 1004. The BLE transceiver may be disposed at a known location relative to a reference point. For example, the BLE transceiver may be installed on the periphery of the vehicle 1004 and configured to detect signals and / or obtain ranging results (e.g., RSSI) from approaching mobile devices as described in FIG. 8. In an embodiment, the vehicle periphery calibration database may be defined by an angle with respect to a reference point, such as the center of the vehicle 1004, the location of the Wi-Fi transceiver 1008, or another predefined reference point. For each Wi-Fi transceiver j, j=1,2,...,N, DKUS is expressed as L=360 / A step Vehicle circumference calibration value D ij , i=1,2,...,L. D ij The value of angle A=iA step is the distance from the Wi-Fi transceiver j to the edge of the vehicle at step is the angular calibration resolution. For example, diagram 1000 shows 16 angular segments 1006a...1006p (i.e., A, B, C, D, E, F) based on a reference point 1020 (e.g., the center of the vehicle). step= 22.5 degrees). Thus, 16 vehicle perimeter calibration values ​​are stored in the database for each Wi-Fi transceiver. For example, distance value 1012 is the vehicle perimeter calibration value for Wi-Fi transceiver 1008 that corresponds to the fourth angle interval 1006d. Controller 1010 may be configured to determine a Wi-Fi based distance to an approaching mobile device and to modify the distance calculation based on one or more vehicle perimeter calibration values ​​associated with the angle of approach.

[0067] In operation, one or more of the BLE transceivers BLE1...BLE14 may report an indication of the detection signals 1014 to the controller 1010 to estimate the angle of the mobile device 1002 relative to the vehicle 1004. The controller 1010 may be configured to return a vehicle perimeter calibration value at an angle closest to the estimated angle. One or more signals 1018 received by the Wi-Fi transceiver 1008 may be used to determine the distance to the mobile device 1002. The Wi-Fi distance estimate may be adjusted based on the selected vehicle perimeter calibration value (e.g., based on the fourth angle interval 1006d). In one example, the estimation algorithm may be a weighted average, with a greater weight for BLE transceivers with stronger RSSI measurements. For example, referring to FIG. 10, BLE10 may have the highest weighting since its RSSI measurement 1014 is the strongest, BLE9 may have the second highest weighting since its RSSI measurement 1016 is the second strongest, and BLE5 may have a weighting of 0 since its RSSI measurement (not shown in FIG. 10) is below a threshold. In an embodiment, the Wi-Fi transceiver 1008 may be configured to determine an angle of arrival (AoA) of a signal 1018 received from the mobile device 1002 to estimate an angle relative to the mobile device 1002. The controller 1010 may be configured to utilize the Wi-Fi AoA measurements and the BLE RSSI measurements to improve the angle estimation.

[0068] Referring to FIG. 11, a diagram 1100 of an exemplary passive digital key system in a fixed structure is shown. The structure in FIG. 1100 is an example and not a limitation, as other security implementations may utilize other physical and electronic structures configured to restrict entry to physical and virtual areas prior to a validation process. The diagram 1100 includes a mobile device 1102 under the control of a user 1102a. The mobile device 1102 may include some or all of the components of a UE 200, and the UE 200 may be an example of a mobile device 1102. A short-range transceiver 1106 may be disposed in a barrier, such as a wall 1108, and configured as a digital key entry system to allow entry through a door 1110. A wireless network including a first AP 1104 may be disposed near the door 1110 and configured to obtain distance and / or angle information for devices near the short-range transceiver 1106. In an example, the first AP 1104 may be configured to exchange Wi-Fi ranging results 1104a with the mobile device 1102. In an example, the first AP 1104 may be configured to determine an AoA 1104b of a signal transmitted from the mobile device 1102 based on a reference orientation 1103 (e.g., 0 degrees, north, etc.). The short-range transceiver 1106 may detect the presence of the mobile device 1102 via one or more sensing signals 1106a. The short-range transceiver 1106 may be communicatively coupled to a controller 1116 via a wired or wireless connection. The controller 1116 may be a network server and / or may be included in the first AP 1104. Once the mobile device 1102 is detected, the controller 1116 may configure the first AP 1104 to determine distance and / or angle measurements for the mobile device 1102. The controller 1116 may also determine distance and / or calibration values ​​(e.g., d cal) may be obtained. The controller 1116 may utilize a comparison of the distance measurement 1104a and the distance calibration value to validate that the mobile device 1102 is in the vicinity of the short-range transceiver 1106. The angle calibration value may also be compared to the AoA 1104b to validate the location of the mobile device 1102. For example, the mobile device 1102 may be validated when the comparison of the distance measurement 1104a and the distance calibration value is within a predetermined threshold (e.g., 0.5m, 1m, 2m, etc.). Similarly, the mobile device 1102 may be validated when the measured AoA 1104b and the angle calibration value are within a threshold (e.g., 1, 2, 5, 10 degrees). A combination of distance and angle thresholds may also be used to validate the mobile device 1102.

[0069] In an embodiment, ranging results from other stations in the network may be used to validate the location of the mobile device 1102. For example, the second AP 1112 may be configured to obtain the distance and / or AoA based on signals transmitted from the mobile device 1102. In an example, the first AP 1104 and the second AP 1112 may be configured to exchange ranging signals 1114 in a passive positioning manner as illustrated in FIG. 6. The mobile device 1102 may be configured to determine RSTD values ​​associated with one or more stations and report corresponding measurements to the network (e.g., to the controller 1116 via the first AP 1104). The RSTD measurements may be used to validate the location of the mobile device 1102. In an example, the short-range transceiver 1106 may be configured to provide encrypted assistance data to the mobile device 1102 to enable the mobile device 1102 to communicate with a Wi-Fi network.

[0070] Referring to FIG. 12, an exemplary data structure 1200 of a passive digital key system is shown. For example, the data structure may correspond to a perimeter calibration database, such as the vehicle perimeter calibration database as previously described. One or more objects of the data structure 1200 may persist on the controller 910 or another networked server 400. The data structure 1200 may be disposed on a memory device 1202, such as a solid-state hard drive or a mechanical hard drive, and may include multiple data records stored in a relational database application (e.g., Amazon Aurora, Oracle Database, Microsoft SQL Server, MySQL, DB2, etc.) or stored in one or more flat-layer files (e.g., JSON, XML, CSV, etc.). The table structure and fields of the data structure 1200 are examples and not limitations, as other data fields, tables, stored procedures, and indexing schemas may be used to construct the data structure 1200. In one example, a site table 1204 may be configured with records related to various locations, vehicles, or other entities configured to utilize the passive digital key system. For example, a siteDesc field may be used to describe the site, such as a building name or vehicle identification number. A siteLoc field may be used to indicate the location of the site, such as a street address or geographic coordinates (e.g., latitude / longitude / altitude). A siteGroup field may be a nexus field to associate a site with a larger group, such as a corporate campus or a fleet of vehicles. The group structure may be used to disseminate standard parameters to associated sites. One or more security fields may be used to validate or authenticate a station in a passive digital key system. Other fields may also be associated with sites, vehicles, or entities utilizing a passive digital key system.

[0071] The Wi-Fi station table 1206 may include a wifiIndex field to uniquely identify a Wi-Fi station within a site. A siteID field may be used to link the Wi-Fi station record with the site table 1204. A radioID field may be used to identify characteristics of the Wi-Fi radio, such as the identification value transmitted. An antennaLoc field may indicate the location of the antenna within the site. Other fields may also be used to characterize the characteristics of the Wi-Fi station.

[0072] One or more calibration tables, such as a distance calibration table 1208 and an angle calibration table 1210, may be associated with the Wi-Fi station. The distance calibration table 1208 may include fields indicating calibration distances (e.g., perimeter values) for each of the short-range transmitters in the digital key system. For example, the ble1cal field may indicate a perimeter distance for BLE1 based on the location and / or antenna position of the associated Wi-Fi station. Similarly, other BLE calibration fields (e.g., ble2cal, ble3cal, ble4cal, etc.) may store perimeter distances for associated BLE transmitters (e.g., BLE2, BLE3, BLE4, etc.) based on location information in the associated Wi-Fi station's record. The angle calibration table 1210 may include fields indicating perimeter distance values ​​for various angle values ​​around the station. For example, the ang1cal field may indicate a perimeter distance associated with the first angle interval 1006a. Similarly, other angle-based calibration fields (e.g., ang2cal, ang3cal, ang4cal, etc.) may store perimeter distances for associated angle segments (e.g., 1006b, 1006c, 1006d, etc.) based on the associated Wi-Fi station record (e.g., wifiID field). Other fields may also be included in the distance calibration table and angle calibration table records. For example, the locations of Wi-Fi and BLE transceivers at a site may be stored.

[0073] Referring to Figure 13 with further reference to Figures 1-12, a first exemplary method 1300 for validating a mobile device with a passive digital key system includes the steps shown. However, method 1300 is by way of example and not by way of limitation. Method 1300 may be modified, for example, by adding, removing, reordering, combining, performing simultaneously steps, and / or splitting a single step into multiple steps.

[0074] In stage 1302, the method includes measuring a first distance between the mobile device and a first point using a first transceiver. One of the controllers 910, 1010, 1116 including the processor 410 and the wireless transceiver 440 may be a means for measuring the first distance. To reduce power consumption, the first transceiver may be a short-range wireless access technology configured for low transmission power. In an embodiment, the wireless transceiver may include one or more BLE transmitters, such as BLE transmitters BLE1...BLE14 of FIG. 9, configured to obtain distance information related to the mobile device. For example, the mobile device 902 may be a user equipment, such as a smartphone, a smart watch, a fitness band, a fob, a key fob, or other device, configured to transmit and receive signals using two or more wireless access technologies. The distance between the mobile device 902 and the first point (e.g., with the first transceiver BLE2) may be based on an RSSI measurement result obtained at the first transceiver. RSSI measurements may be obtained by other transceivers, such as nearby BLE transceivers BLE1, BLE3, or other transceivers in the vehicle 904.

[0075] At stage 1304, the method includes measuring a second distance between the mobile device and the second point using a second transceiver. One of the controllers 910, 1010, 1116 including the processor 410 and the wireless transceiver 440 may be a means for measuring the second distance. The second transceiver may be a medium-range wireless access technology and may have a higher transmission power than the first transceiver. The second transceiver may have a longer communication range than the first transceiver. In an embodiment, the wireless transceiver 440 may include one or more Wi-Fi transceivers, such as the Wi-Fi transceiver 906 of FIG. 9, configured to obtain distance information related to the mobile device 902. In an example, the second transceiver may be configured to utilize a wider bandwidth than the first transceiver. For example, the second transceiver may be a UWB radio communicatively coupled to the controller 910. The second distance may be based on Wi-Fi ranging techniques such as RSSI and RTT. For example, the Wi-Fi distance estimate 914 may indicate a distance between the Wi-Fi transceiver 906 (e.g., an antenna associated with the Wi-Fi transceiver) and the mobile device 902. The second distance may be based on the distance between the Wi-Fi transceiver 1008 and the mobile device 1002 or the distance between the AP 1104 and the mobile device 1102.

[0076] At stage 1306, the method includes obtaining a validation distance based at least in part on the first point and the second point. One of the controllers 910, 1010, 1116 including the processor 410 may be a means for obtaining the validation distance. In an embodiment, the controller 910 may include a peripheral calibration database such as the data structure 1200. The data structure may be queried based on the identification information of the first transceiver and the second transceiver. For example, the Wi-Fi transceiver 906 may be associated with several calibration values ​​(e.g., ble1cal, ble2cal, etc.), and the calibration value for the particular BLE transceiver may be used as the validation distance. In an example, more than one BLE transceiver may be identified, and an interpolation technique may be used on the corresponding calibration values ​​to obtain the validation distance. The validation distance may correspond to a bias value 912 indicating the distance from the Wi-Fi transceiver 906 to the edge of the vehicle 904 close to the mobile device 902, or from the Wi-Fi transceiver 1008 to the edge of the vehicle 1004 close to the mobile device 1002, or from the AP 1104 to the short-range transceiver 1106.

[0077] At stage 1308, the method includes validating the mobile device based at least in part on a comparison of the first distance, the second distance, and the validation distance. One of the controllers 910, 1010, 1116 including the processor 410 may be a means for validating the mobile device. In an example, the comparison may include subtracting the validation distance obtained at stage 1306 from the second distance obtained at stage 1304, and then comparing the remainder to the first distance obtained at stage 1302. For example, referring to FIG. 9, the difference between the Wi-Fi distance estimate 914 and the bias value 912 should be approximately equal to the RSSI distance estimate 908. If the value is approximately equal to or within a predetermined threshold (e.g., 0.5 m, 1 m, 2 m, etc.), the mobile device may be validated. Once the mobile device is validated, the DKUS executing on the controller 910 may be configured to unlock the vehicle, enable the ignition system, or perform other security-related procedures.

[0078] 9 utilizes BLE and Wi-Fi wireless access technologies, method 1300 is not so limited as other short-range, medium-range, and long-range, active and / or passive wireless access technologies may also be used. For example, the first transceiver and the second transceiver may be based on D2D, P2P, 5G NR sidelink, UWB radio, RFID systems, Wi-Fi, BLE, and other wireless access technologies configured for RF ranging applications.

[0079] Referring to Figure 14 with further reference to Figures 1-12, a second exemplary method 1400 for validating a mobile device with a passive digital key system includes the steps shown. However, method 1400 is by way of example and not by way of limitation. Method 1400 may be modified, for example, by adding, removing, reordering, combining, performing simultaneously steps, and / or splitting a single step into multiple steps.

[0080] In stage 1402, the method includes determining an angle to the mobile device relative to a reference point using at least a first wireless transceiver. One of the controllers 910, 1010, 1116, including the processor 410 and the wireless transceiver 440, may be a means for determining the angle. To reduce power consumption, the first wireless transceiver may be a short-range wireless access technology configured for low transmission power. In an embodiment, the wireless transceiver may include one or more BLE transmitters, such as BLE transmitters BLE1...BLE14 of FIG. 10, configured to obtain signals from the mobile device. For example, the mobile device 1002 may be a user equipment, such as a smartphone, a smart watch, a fitness band, a key fob, or other device, configured to transmit and receive signals using two or more wireless access technologies. In an example, the angle to the mobile device 1002 may be based at least in part on RSSI measurements obtained by one or more of the BLE transceivers BLE1...BLE14. For example, the RSSI measurement 1014 obtained by the tenth BLE transceiver BLE10 may be used to determine that the mobile device 1002 is close to the fourth angle segment 1006d. In one example, the estimation algorithm may be a weighted average, with a greater weight for BLE transceivers with stronger RSSI measurements. For example, with reference to FIG. 10, BLE10 may be weighted the most because its RSSI measurement 1014 is the strongest, BLE9 may be weighted the second most because its RSSI measurement 1016 is the second strongest, and the other BLE transceivers may be weighted accordingly based on a relative comparison of their respective RSSI measurements. The weighted average of the RSSI measurements may be used to determine in which angle segment the mobile device is located. In one embodiment, the Wi-Fi transceiver may be configured to determine the AoA of a signal transmitted by the mobile device, and the AoA may be used to determine an angle relative to a reference point. In one example, the reference point may be the location of the Wi-Fi antenna module.

[0081] At stage 1404, the method includes acquiring a distance measurement to the mobile device using at least a second wireless transceiver. One of the controllers 910, 1010, 1116 including the processor 410 and the wireless transceiver 440 may be a means for acquiring the distance measurement. The second wireless transceiver may be a medium-range wireless access technology and may have a higher transmission power than the first wireless transceiver. In an embodiment, the wireless transceiver may include one or more Wi-Fi transceivers, such as the Wi-Fi transceiver 1008 of FIG. 10, configured to acquire distance information related to the mobile device 1002. In an example, the second wireless transceiver may be configured to utilize a wider bandwidth than the first wireless transceiver. For example, the second wireless transceiver may be a UWB radio communicatively coupled to the controller 1010. The second distance may be based on Wi-Fi ranging techniques such as RSSI and RTT. For example, the Wi-Fi distance estimate may be based on a signal 1018 received from the mobile device 1002. Other radio access technologies and ranging techniques may also be used.

[0082] At stage 1406, the method includes obtaining a calibration distance based at least in part on the angle relative to the mobile device. One of the controllers 910, 1010, 1116 including the processor 410 may be a means for obtaining the calibration distance. In an embodiment, the controller 1010 may include a peripheral calibration database such as the data structure 1200. The data structure may be queried based on the angle determined at stage 1402. For example, a signal obtained by the BLE transceiver may be used to select one of the angle segments 1006a-1006p based on the location of the mobile device 1002. The Wi-Fi transceiver 1008 may be associated with several angle-based calibration values ​​(e.g., ang1cal, ang2cal, etc.), and the calibration values ​​for one or more of the angle segments 1006a-1006p may be used as the calibration distance. In an example, more than one angle segment may be selected, and an interpolation technique may be used on the corresponding calibration values ​​to obtain the calibration distance. The calibration distance may correspond to a distance value 1012 indicating a distance from the Wi-Fi transceiver 1008 to the edge of the vehicle 1004 in an angular segment (e.g., the fourth angular segment 1006d). In an embodiment, the calibration value may be based on a distance measured from a reference point, such as reference point 1020 at the center of the vehicle. Other reference points may also be used.

[0083] In step 1408, the method includes calculating a validation distance based at least in part on the difference between the measured distance and the calibration distance. One of the controllers 910, 1010, 1116 including the processor 410 may be a means for calculating the validation distance. The measured distance obtained in step 1404 may be based on a distance between the position of the antenna of the second wireless transceiver and the mobile device 1002. The position of the antenna may be physically offset from the periphery of the vehicle 1004. The calibration distance may be used as a bias value to compensate for the physical displacement of the antenna with respect to various points of the periphery of the vehicle 1004. Other arithmetic and trigonometric functions may be used to calculate the validation distance. For example, the position of the antenna and the mobile device with respect to a reference point may be included in the calculation of the validation distance.

[0084] At stage 1410, the method includes validating the mobile device based at least in part on a comparison of the validation distance to a threshold value. One of the controllers 910, 1010, 1116 including the processor 410 may be a means for validating the mobile device. In an example, the comparison may include determining whether the validation distance is less than or equal to a predetermined threshold value (e.g., 0.5m, 1m, 2m, etc.). In an embodiment, the threshold value may be based on context information associated with the mobile device, such as location (e.g., at home, at a mall, in a city), departure time (e.g., short departure time, larger threshold value), density of nearby vehicles (e.g., a smaller threshold distance may be used in a crowded parking lot), and time of day (e.g., a smaller threshold distance at night). Other mobile device conditions, environmental condition values, and vehicle condition values ​​may be used to determine the context and / or to set the threshold value. In an example, one or more lookup tables may be used to associate the threshold value with one or more context parameters. Once the mobile device is validated, the DKUS running on the controller 1010 may be configured to unlock the vehicle, enable the ignition system, or perform other security related procedures.

[0085] 10 utilizes BLE and Wi-Fi wireless access technologies, but method 1400 is not so limited as other active and passive wireless access technologies may also be used. For example, the first and second wireless transceivers may be based on D2D, P2P, 5G NR sidelink, UWB radio, RFID systems, Wi-Fi, BLE, and other wireless access technologies configured for RF ranging applications.

[0086] Referring to Figure 15 with further reference to Figures 1-12, a third exemplary method 1500 for validating a mobile device with a passive digital key system includes the steps shown. However, method 1500 is by way of example and not by way of limitation. Method 1500 may be modified, for example, by adding, removing, reordering, combining, performing simultaneously steps, and / or splitting a single step into multiple steps.

[0087] At stage 1502, the method includes determining a positioning result of the mobile device relative to a reference point. One of the controllers 910, 1010, 1116 including the processor 410 and the wireless transceiver 440 may be a means for determining the positioning result. The positioning result may be a distance, an angle, or a combination of both. In an embodiment, the wireless transceiver may include one or more low power transceivers and / or bandwidth constrained transceivers, such as a BLE-based transceiver disposed at a known location relative to the reference point. Determining the positioning result may include determining an angle to the mobile device by detecting the mobile device with the transceiver and using an angle of the transceiver's position relative to the reference point as an angle to the mobile device. In an embodiment, the transceiver may be configured to determine an angle of arrival (AoA) of a signal transmitted by the mobile device. The AoA may be used to determine the angle relative to the reference point. In an example, the reference point may be the location of the transceiver. In an embodiment, determining the positioning result may include determining a distance to the mobile device. For example, one or more BLE-based transceivers may be configured to obtain RSSI measurements from a mobile device to determine distance. Other wireless ranging techniques, such as time-of-flight measurements, may also be used.

[0088] At stage 1504, the method includes acquiring a distance measurement to the mobile device using at least a first transceiver. One of the controllers 910, 1010, 1116 including the processor 410 and the wireless transceiver 440 may be a means for acquiring the distance measurement. The first transceiver may be configured to acquire distance information related to the mobile device. The distance measurement may be based on radio frequency ranging techniques such as RSSI and time of flight measurements such as those used in the RTT procedure. In an embodiment, additional wireless transceivers may be used and the distance measurement may be based on ranging techniques such as multi-RTT, AoA, TDOA, etc. Other radio access technologies and ranging techniques may also be used.

[0089] At stage 1506, the method includes obtaining a calibration distance based at least in part on the positioning result of the mobile device. One of the controllers 910, 1010, 1116 including the processor 410 may be a means for obtaining the calibration distance. In an embodiment, the data structure may be queried based on an angle relative to the mobile device. The data structure may include a distance and / or angle calibration value associated with the first wireless receiver. For example, when the positioning result obtained at stage 1502 is a distance, the calibration distance may be based on an identification value (e.g., ble1cal, ble2cal, etc.) associated with the BLE transceiver reporting the positioning result. When the positioning result obtained at stage 1502 is an angle, the calibration distance may be based on an angle (e.g., ang1cal, ang2cal, etc.). The calibration distance may be obtained based on one or more lookup tables including the distance and / or angle and the associated calibration distance. In one example, an interpolation function may be used to obtain calibration distances for distances and / or angle values ​​between (ie, angle values ​​between angle values ​​in the lookup table).

[0090] At stage 1508, the method includes calculating a validation distance based at least in part on the difference between the measured distance and the calibrated distance. One of the controllers 910, 1010, 1116 including the processor 410 may be a means for calculating the validation distance. In an embodiment, the processor 410 may be configured to subtract the calibrated distance from the measured distance, with the remainder being the validation distance. Other arithmetic and trigonometric operations may also be used based on the angles, the reference points, the measured distance, the calibrated distance, and the associated transceiver / antenna positions.

[0091] At stage 1510, the method includes validating the mobile device based at least in part on a comparison of the validation distance to a threshold value. One of the controllers 910, 1010, 1116 including the processor 410 may be a means for validating the mobile device. In an example, the comparison may include determining whether the validation distance is less than or equal to a predetermined threshold value (e.g., 0.5m, 1m, 2m, etc.). In an embodiment, the threshold value may be based on situational information such as location (e.g., at home, at a mall, in a city), departure time (e.g., short departure time, larger threshold value), density of nearby vehicles (e.g., a smaller threshold distance may be used in a crowded parking lot), and time of day (e.g., a smaller threshold distance at night). Other environmental and vehicle conditions may be used to set the threshold value.

[0092] Other examples and implementations are within the scope of this disclosure and the appended claims. For example, due to the nature of software and computers, the functions described above may be implemented using software executed by a processor, hardware, firmware, hardwiring, or any combination of these. Features implementing the functions may also be physically located in various locations, including being distributed such that parts of the functions are implemented in various physical locations. For example, one or more functions, or one or more parts thereof, discussed above as being performed in a location server may be performed outside the location by an AP, etc.

[0093] As used herein, the singular forms "a," "an," and "the" include the plural unless the context clearly indicates otherwise. For example, "a processor" may include one processor or multiple processors. As used herein, the terms "comprises," "comprising," "including," and / or "comprising" specify the presence of stated features, integers, steps, operations, elements, and / or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and / or groups thereof.

[0094] Also, as used herein, "or" when used in a list of items modified by "at least one of" or "one or more of" indicates a disjunctive list, such as a list of "at least one of A, B, or C" or a list of "one or more of A, B, or C" meaning A, or B, or C, or AB, or AC, or BC, or ABC (i.e., A and B and C), or a combination of two or more features (e.g., AA, AAB, ABBC, etc.).

[0095] Considerable variation may be made according to specific requirements. For example, customized hardware may also be used and / or particular elements may be implemented in hardware, software executed by a processor (including portable software such as applets), or both. Further, connection to other computing devices, such as network input / output devices, may be utilized.

[0096] The systems and devices discussed above are examples. Various configurations may omit, substitute, or add various procedures or components, as appropriate. For example, features described with respect to some configurations may be combined in various other configurations. Different aspects and elements of the configurations may be combined as well. Also, technology evolves, and thus many of the elements are examples and do not limit the scope of the disclosure or claims.

[0097] A wireless communication system is a communication system in which communications are conveyed wirelessly, i.e., by electromagnetic and / or acoustic waves propagating through atmospheric space rather than through wires or other physical connections. A wireless communication network is configured to cause at least some, but not all, communications to be transmitted wirelessly. Furthermore, the term "wireless communication device" or similar terms does not require that the function of the device be exclusively or even primarily for communication or that the device be a mobile device, but indicates that the device includes wireless communication capabilities (unidirectional or bidirectional), e.g., at least one radio for wireless communication (each radio being part of a transmitter, receiver, or transceiver).

[0098] Specific details are given in the description to provide a thorough understanding of the example configurations (including implementations). However, the configurations may be practiced without these specific details. For example, well-known circuits, processes, algorithms, structures, and techniques are shown without unnecessary details to avoid obscuring the configurations. This description provides an example configuration and does not limit the scope, applicability, or configuration of the claims. Rather, the foregoing description of the configurations provides a description for implementing the described techniques. Various changes may be made in the function and arrangement of elements without departing from the scope of the present disclosure.

[0099] As used herein, the terms "processor-readable medium," "machine-readable medium," and "computer-readable medium" refer to any medium that participates in providing data that causes a machine to operate in a specific manner. When using a computing platform, various processor-readable media may be involved in providing instructions / code to the processor for execution and / or may be used to store and / or carry such instructions / code (e.g., signals). In many implementations, the processor-readable medium is a physical and / or tangible storage medium. Such media may take many forms, including, but not limited to, non-volatile media and volatile media. Non-volatile media include, for example, optical and / or magnetic disks. Volatile media include, but are not limited to, dynamic memory.

[0100] A statement that a value exceeds (i.e., is greater than or exceeds) a first threshold is equivalent to a statement that the value meets or exceeds a second threshold that is slightly greater than the first threshold, e.g., the second threshold is a value higher than the first threshold at the resolution of the computing system. A statement that a value is less than (i.e., is within or below) a first threshold is equivalent to a statement that the value is less than or equal to a second threshold that is slightly less than the first threshold, e.g., the second threshold is a value lower than the first threshold at the resolution of the computing system.

[0101] Example implementations are described in the following numbered clauses.

[0102] 1. A method for validating a mobile device, comprising: determining a positioning result of the mobile device relative to a reference point; obtaining distance measurements using at least a first transceiver; obtaining a calibration distance based at least in part on the positioning results of the mobile device; calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; and validating the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0103] 2. The method of clause 1, wherein the reference point and the first transceiver are located within a vehicle.

[0104] 3. The method of clause 1, wherein the reference point and the first transceiver are within a fixed structure.

[0105] 4. The method of clause 1, wherein the positioning result indicates an angle relative to the mobile device.

[0106] 5. The method of clause 4, wherein determining the angle relative to the mobile device includes determining an angle of arrival of a signal transmitted by the mobile device.

[0107] 6. The method of clause 5, wherein the signal transmitted by the mobile device is received by the first transceiver.

[0108] 7. The method of clause 4, wherein determining the angle relative to the mobile device includes determining that the mobile device is proximate to a second transceiver, the second transceiver being disposed at a known position relative to a reference point.

[0109] 8. The method of clause 7, further comprising determining a received signal strength of one or more signals transmitted by the mobile device and received by the second transceiver.

[0110] 9. The method of clause 8, wherein the second transceiver is configured to utilize a smaller bandwidth than the first transceiver.

[0111] 10. The method of clause 4, wherein obtaining the calibration distance comprises interrogating a data structure based on the angle.

[0112] 11. The method of clause 1, wherein obtaining a distance measurement to the mobile device includes determining a time of flight of a signal transmitted between the mobile device and the first transceiver.

[0113] 12. The method of clause 1, wherein the positioning result indicates a distance to the mobile device as measured by at least one second transceiver.

[0114] 13. The method of clause 12, wherein the distance to the mobile device is based on at least one of a received signal strength indication measurement or a time-of-flight measurement.

[0115] 14. The method of clause 12, wherein obtaining the calibration distance comprises interrogating a data structure based on an identification value associated with the at least one second transceiver.

[0116] 15. determining a situation associated with the mobile device; and determining a threshold value based on the situation.

[0117] 16. A method for validating a mobile device, comprising: determining an angle for the mobile device relative to a reference point using at least a first wireless transceiver; obtaining a range measurement to the mobile device using at least a second wireless transceiver; obtaining a calibration distance based at least in part on an angle relative to the mobile device; calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; and validating the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0118] 17. The method of clause 16, wherein determining the angle relative to the mobile device includes determining that the mobile device is located within a predetermined angular interval.

[0119] 18. The method of clause 16, wherein the second wireless transceiver is configured to utilize a wider bandwidth than the first wireless transceiver.

[0120] 19. The method of clause 16, wherein obtaining the calibration distance includes obtaining the calibration distance from a data structure based at least in part on an angle relative to the mobile device.

[0121] 20. The method of clause 16, wherein the first wireless transceiver and the second wireless transceiver are disposed in a vehicle, and the calibration distance is based on a distance between the second wireless transceiver and a perimeter of the vehicle.

[0122] 21. The method of clause 16, wherein the first wireless transceiver and the second wireless transceiver are disposed in a vehicle, and the calibration distance is based on a distance between a reference point and a perimeter of the vehicle.

[0123] 22. The method of clause 16, wherein the first wireless transceiver and the second wireless transceiver are disposed in a vehicle, and the threshold is based on a condition of the vehicle.

[0124] 23. The method of clause 16, wherein the first wireless transceiver is located near an entrance to the fixed structure and the second wireless transceiver is a wireless access point within the fixed structure.

[0125] 24. The method of clause 16, wherein obtaining distance measurements includes determining a round trip time between the second wireless transceiver and the mobile device.

[0126] 25. Memory and At least one transceiver; and at least one processor communicatively coupled to the memory and to the at least one transceiver, the at least one processor comprising: determining a positioning result of the mobile device relative to a reference point; obtaining distance measurements using at least a first transceiver; Obtaining a calibration distance based at least in part on the positioning results of the mobile device; Calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; The apparatus is configured to validate the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0127] 26. The apparatus of clause 25, wherein the reference point and the first transceiver are located within a vehicle.

[0128] 27. An apparatus according to clause 25, wherein the reference point and the first transceiver are within a fixed structure.

[0129] 28. The apparatus of clause 25, wherein the positioning result indicates an angle relative to the mobile device.

[0130] 29. The apparatus of clause 28, wherein the at least one processor is further configured to determine an angle of arrival of a signal transmitted by the mobile device.

[0131] 30. The apparatus of clause 29, wherein a signal transmitted by the mobile device is received by the first transceiver.

[0132] 31. The apparatus of clause 29, further comprising a second transceiver disposed at a known location relative to the reference point, the at least one processor further configured to determine that the mobile device is proximate to the second transceiver.

[0133] 32. The apparatus of clause 31, wherein the at least one processor is further configured to determine a received signal strength of one or more signals transmitted by the mobile device and received by the second transceiver.

[0134] 33. The apparatus of clause 32, wherein the second transceiver is configured to utilize a smaller bandwidth than the first transceiver.

[0135] 34. The apparatus of clause 28, wherein the at least one processor is further configured to query a data structure stored in the memory based on the angle.

[0136] 35. The apparatus of clause 25, wherein the at least one processor is further configured to determine a time of flight of a signal transmitted between the mobile device and the first transceiver.

[0137] 36. The apparatus of clause 25, wherein the positioning result indicates a distance to the mobile device as measured by the at least one second transceiver.

[0138] 37. The apparatus of clause 36, wherein the at least one processor is further configured to calculate a distance to the mobile device based on at least one of the received signal strength indication measurements or the time-of-flight measurements.

[0139] 38. The apparatus of clause 36, wherein the at least one processor is further configured to query a data structure stored in the memory based on an identification value associated with the at least one second transceiver.

[0140] 39. At least one processor further comprises: Determine a situation related to the mobile device; The apparatus of clause 25 configured to determine the threshold value based on the situation.

[0141] 40. Memory and At least one transceiver; and at least one processor communicatively coupled to the memory and to the at least one transceiver, the at least one processor comprising: determining an angle for the mobile device relative to a reference point using at least a first wireless transceiver; obtaining distance measurements to the mobile device using at least a second wireless transceiver; Obtaining a calibrated distance based at least in part on an angle relative to the mobile device; Calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; The apparatus is configured to validate the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0142] 41. The apparatus of clause 40, wherein the at least one processor is further configured to determine that the mobile device is located within a predetermined angular interval.

[0143] 42. The apparatus of clause 40, wherein the second wireless transceiver is configured to utilize a wider bandwidth than the first wireless transceiver.

[0144] 43. The apparatus of clause 40, wherein the at least one processor is further configured to obtain a calibration distance from a data structure stored in the memory based at least in part on the angle relative to the mobile device.

[0145] 44. The apparatus of clause 40, wherein the first radio transceiver and the second radio transceiver are disposed in a vehicle, and the calibration distance is based on a distance between the second radio transceiver and a perimeter of the vehicle.

[0146] 45. The apparatus of clause 40, wherein the first radio transceiver and the second radio transceiver are disposed on a vehicle, and the calibration distance is based on a distance between a reference point and a perimeter of the vehicle.

[0147] 46. ​​The apparatus of clause 40, wherein the first wireless transceiver and the second wireless transceiver are disposed in a vehicle, and the threshold is based on a condition of the vehicle.

[0148] 47. The apparatus of clause 40, wherein the first wireless transceiver is located near an entrance to the fixed structure and the second wireless transceiver is a wireless access point within the fixed structure.

[0149] 48. The apparatus of clause 40, wherein the at least one processor is further configured to determine a round trip time between the second wireless transceiver and the mobile device.

[0150] 49. An apparatus for validating a mobile device, comprising: means for determining a positioning result of a mobile device relative to a reference point; means for obtaining distance measurements using at least a first transceiver; means for obtaining a calibration distance based at least in part on a positioning result of the mobile device; means for calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; and means for validating the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0151] 50. An apparatus for validating a mobile device, comprising: means for determining an angle for the mobile device relative to a reference point using at least a first wireless transceiver; means for obtaining a range measurement to the mobile device using at least a second wireless transceiver; means for obtaining a calibration distance based at least in part on an angle relative to the mobile device; means for calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; and means for validating the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0152] 51. A non-transitory processor-readable storage medium comprising processor-readable instructions configured to cause one or more processors to validate a mobile device, comprising: code for determining a positioning result of the mobile device relative to a reference point; code for obtaining distance measurements using at least a first transceiver; code for obtaining a calibration distance based at least in part on a positioning result of the mobile device; code for calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; and code for validating the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0153] 52. A non-transitory processor-readable storage medium comprising processor-readable instructions configured to cause one or more processors to validate a mobile device, comprising: code for determining an angle for the mobile device relative to a reference point using at least a first wireless transceiver; code for obtaining a range measurement to the mobile device using at least a second wireless transceiver; code for obtaining a calibrated distance based at least in part on an angle relative to the mobile device; code for calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; and code for validating the mobile device based at least in part on a comparison of the validation distance to a threshold.

[0154] 53. A method for validating a mobile device, comprising: measuring a first distance between the mobile device and a first point using a first transceiver; measuring a second distance between the mobile device and a second point using a second transceiver; obtaining a validation distance based at least in part on the first point and the second point; and validating the mobile device based at least in part on a comparison of the first distance, the second distance, and the validation distance.

[0155] 54. The method of clause 53, wherein the first point is an antenna operably coupled to a first transceiver and the second point is an antenna operably coupled to a second transceiver.

[0156] 55. The method of clause 53, wherein the second transceiver has a longer communication range than the first transceiver.

[0157] 56. The method of clause 53, wherein the second transceiver is configured to utilize a wider bandwidth than the first transceiver.

[0158] 57. The method of clause 53, wherein obtaining a validation distance includes obtaining the validation distance from a data structure based at least in part on the first point and the second point.

[0159] 58. The method of clause 53, wherein the validation distance is based on the distance between the second point and the perimeter of the vehicle.

[0160] 59. The method of clause 53, wherein the validation distance is based on a distance between the first point and the second point.

[0161] 60. The method of clause 53, wherein the first point is proximate to an entrance of the building and the second point is the location of a wireless access point within the building.

[0162] 61. Measuring an angle of arrival of a signal transmitted by the mobile device using a second transceiver; and obtaining a validation distance based at least in part on the angle of arrival.

[0163] 62. The method of clause 53, wherein measuring the second distance includes determining a round trip time between the second transceiver and the mobile device.

[0164] 63. Memory and At least two transceivers; and at least one processor communicatively coupled to the memory and to the at least two transceivers, the at least one processor comprising: measuring a first distance between the mobile device and a first point using a first transceiver; measuring a second distance between the mobile device and a second point using a second transceiver; obtaining a validation distance based at least in part on the first point and the second point; The apparatus is configured to validate the mobile device based at least in part on a comparison of the first distance, the second distance, and the validation distance.

[0165] 64. The apparatus of clause 63, wherein the first point is an antenna operably coupled to a first transceiver and the second point is an antenna operably coupled to a second transceiver.

[0166] 65. The apparatus of clause 63, wherein the second transceiver has a longer communication range than the first transceiver.

[0167] 66. The apparatus of clause 63, wherein the second transceiver is configured to utilize a wider bandwidth than the first transceiver.

[0168] 67. The apparatus of clause 63, wherein the at least one processor is further configured to obtain a validation distance from the data structure based at least in part on the first point and the second point.

[0169] 68. A device according to clause 63, wherein the validation distance is based on the distance between the second point and the periphery of the vehicle.

[0170] 69. The apparatus of clause 63, wherein the validation distance is based on a distance between the first point and the second point.

[0171] 70. A device according to clause 63, wherein the first point is proximate to an entrance of a building and the second point is the location of a wireless access point within the building.

[0172] 71. At least one processor further comprises: measuring an angle of arrival of a signal transmitted by the mobile device using a second transceiver; 64. The apparatus of clause 63, configured to obtain a validation distance based at least in part on the angle of arrival.

[0173] 72. The apparatus of clause 63, wherein the at least one processor is further configured to determine a round trip time between the second transceiver and the mobile device.

[0174] 73. An apparatus for validating a mobile device, comprising: means for measuring a first distance between the mobile device and a first point using a first transceiver; means for measuring a second distance between the mobile device and a second point using a second transceiver; means for obtaining a validation distance based at least in part on the first point and the second point; and means for validating the mobile device based at least in part on a comparison of the first distance, the second distance, and the validation distance.

[0175] 74. A non-transitory processor-readable storage medium comprising processor-readable instructions configured to cause one or more processors to validate a mobile device, comprising: code for measuring a first distance between the mobile device and a first point using a first transceiver; code for measuring a second distance between the mobile device and a second point using a second transceiver; and code for obtaining a validation distance based at least in part on the first point and the second point; and code for validating the mobile device based at least in part on a comparison of the first distance, the second distance, and the validation distance. [Explanation of symbols]

[0176] 105 User Equipment 110 gNB 114 ng-eNB 115 AMF 117 SMF 120 LMF 125 GMLC 130 External Clients 135 NG-RAN 140 5G cores 185 Constellation 190 Satellite Vehicle 191 Satellite Vehicle 192 Satellite Vehicle 193 Satellite Vehicle 200 User Devices 210 Processor 211 Memory 212 Software 213 Sensor 214 Transceiver Interface 215 Transceiver 216 User Interface 217 SPS Receiver 218 Camera 219 Location Device 220 Bus 230 General Purpose / Application Processor 232 Modem Processor 233 Video Processor 234 Sensor Processor 240 Wireless Transceiver 242 Transmitter 244 Receiver 246 Antenna 248 Wireless Signal 250 Wired Transceiver 252 Transmitter 254 Receiver 260 SPS signal 262 Antenna 270 IMU 271 Magnetometer 272 Environmental Sensors 273 Accelerometer 274 Gyroscope 300 Send / Receive Points 310 Processor 311 Memory 312 Software 315 Transceiver 317 SPS Receiver 320 Bus 340 Wireless Transceiver 342 Transmitter 344 Receiver 346 Antenna 348 Wireless Signal 350 Wired Transceiver 352 Transmitter 354 Receiver 360 SPS signal 362 SPS Antenna 400 Servers 410 Processor 411 Memory 412 Software 415 Transceiver 420 Bus 440 Wireless Transceiver 442 Transmitter 444 Receiver 446 Antenna 448 Wireless Signal 450 Wired Transceiver 452 Transmitter 454 Receiver 502 Answering Station 504 Starting station 552 Location Server 554 UE 556 AP 558 RTT 602 I2R NDP Message 604 NDPA Message 606 R2I NDP Message 702 Mobile Devices 704 vehicles 706 Wireless Devices 707 Authentication Request 708 D2D Link 709 Certificate 710 Wireless Devices 802 Mobile Devices 806 Wi-Fi Transceiver 902 Mobile Devices 905 RSSI measurement results 906 Wi-Fi Transceiver 908 Distance Estimation 910 Controller 912 Bias Value 914 Wi-Fi Distance Estimation 1006 Angle classification 1008 Wi-Fi Transceiver 1010 Controller 1012 Distance Value 1014 Detection signal 1016 RSSI measurement results 1020 Reference point 1102 Mobile Devices 1103 Reference direction 1104 First AP 1106 Short Range Transceiver 1108 Wall 1110 Door 1112 2nd AP 1114 Ranging signal 1116 Controller 1202 Limb Calibration Database 1204 Site Table 1206 Wi-Fi station table 1208 Distance Calibration Table 1210 Angle Calibration Table

Claims

1. 1. A method for validating a mobile device, comprising: determining a positioning result of the mobile device relative to a reference point; obtaining distance measurements using at least a first transceiver; obtaining a calibration distance based at least in part on the positioning result of the mobile device; calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; validating the mobile device based at least in part on a comparison of the validation distance to a threshold. A method comprising:

2. The method of claim 1 , wherein the reference point and the first transceiver are in a vehicle or a fixed structure.

3. The method of claim 1 , wherein the positioning result indicates an angle relative to the mobile device.

4. 4. The method of claim 3, wherein determining the angle relative to the mobile device includes determining an angle of arrival of a signal transmitted by the mobile device, optionally the signal transmitted by the mobile device being received by the first transceiver.

5. 4. The method of claim 3, wherein determining the angle relative to the mobile device includes determining that the mobile device is proximate to a second transceiver, the second transceiver being disposed at a known position relative to the reference point, and optionally further comprising determining a received signal strength of one or more signals transmitted by the mobile device and received by the second transceiver, and further optionally, the second transceiver being configured to utilize a smaller bandwidth than the first transceiver.

6. The method of claim 3 , wherein obtaining the calibration distance comprises querying a data structure based on the angle.

7. The method of claim 1 , wherein obtaining the distance measurement to the mobile device comprises determining a time of flight of a signal transmitted between the mobile device and the first transceiver.

8. 2. The method of claim 1, wherein the positioning result indicates a distance to the mobile device measured by at least one second transceiver, and optionally the distance to the mobile device is based on at least one of a received signal strength indication measurement or a time-of-flight measurement, or wherein obtaining the calibration distance comprises querying a data structure based on an identification value associated with the at least one second transceiver.

9. determining a situation associated with the mobile device; determining the threshold value based on the condition; The method of claim 1 , further comprising:

10. 1. A method for validating a mobile device, comprising: determining an angle for the mobile device relative to a reference point using at least a first wireless transceiver; obtaining a range measurement to the mobile device using at least a second wireless transceiver; obtaining a calibration distance based at least in part on the angle relative to the mobile device; calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; validating the mobile device based at least in part on a comparison of the validation distance to a threshold. A method comprising:

11. determining the angle relative to the mobile device includes determining that the mobile device is located within a predetermined angular interval; or the second wireless transceiver is configured to utilize a wider bandwidth than the first wireless transceiver; or obtaining the calibration distance includes obtaining the calibration distance from a data structure based at least in part on the angle relative to the mobile device; or the first radio transceiver and the second radio transceiver are disposed in a vehicle, and the calibration distance is based on a distance between the second radio transceiver or the reference point and an edge of the vehicle; or the first wireless transceiver and the second wireless transceiver are disposed in a vehicle, and the threshold is based on a condition of the vehicle; or the first wireless transceiver is located near an entrance of a fixed structure and the second wireless transceiver is a wireless access point within the fixed structure; or The method of claim 10 , wherein obtaining the distance measurements includes determining a round trip time between the second wireless transceiver and the mobile device.

12. Memory, at least one transceiver; at least one processor communicatively coupled to the memory and the at least one transceiver, determining a positioning result of the mobile device relative to a reference point; obtaining distance measurements using at least a first transceiver; obtaining a calibration distance based at least in part on the positioning result of the mobile device; calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; Validating the mobile device based at least in part on a comparison of the validation distance to a threshold. At least one processor configured to: An apparatus comprising:

13. The apparatus of claim 12, wherein the at least one processor is further configured to perform a method according to any one of claims 2 to 9.

14. Memory, at least one transceiver; at least one processor communicatively coupled to the memory and the at least one transceiver, determining an angle for the mobile device relative to a reference point using at least a first wireless transceiver; obtaining distance measurements to the mobile device using at least a second wireless transceiver; obtaining a calibration distance based at least in part on the angle relative to the mobile device; calculating a validation distance based at least in part on a difference between the measured distance and the calibration distance; Validating the mobile device based at least in part on a comparison of the validation distance to a threshold. At least one processor configured to: An apparatus comprising:

15. The apparatus of claim 14 , wherein the at least one processor is further configured to perform the method of claim 11 .

16. A non-transitory processor-readable storage medium comprising processor-readable instructions configured to cause one or more processors to perform the method of any one of claims 1 to 11.

Images