Method and apparatus for maintaining transmission integrity and authenticity through channel measurements and reporting - Patents.com

Abstract

A connection between a user equipment (UE) and a base station may be authenticated at the physical layer, and the presence of an unauthorized intervening device may be identified based on predicted measurements of downlink reference signals and actual measurements of the current downlink reference signal. The predicted measurements are generated based on previous measurements of downlink reference signals known to be received from the base station, for example after a higher layer initial authentication. The predicted values ​​may be for positioning measurements, channel measurements, or speed or direction of movement measurements, or a combination thereof. A difference between the predicted and actual measurements indicates that the previously received and currently received reference signals are not from the same entity, and thus an intervening entity performing a man-in-the-middle or replay attack is likely to be present in the communication channel.

Description

[Technical field]

[0001]

[0001] This application claims the benefit of Greek Patent Application No. 20210100415, entitled "METHODS AND APPARATUS FOR MAINTAINING TRANSMISSION INTEGRITY AND AUTHENTICITY THROUGH CHANNEL MEASUREMENTS AND REPORTING," filed on June 23, 2021, which is assigned to the assignee of this application and is expressly incorporated by reference in its entirety into this specification. [Background technology]

[0002] Field

[0002] The present disclosure relates generally to the field of wireless communications, and more particularly to authenticating a channel connection between a user equipment (UE) and a base station and identifying the presence of an unauthorized intervening device.

[0003] information

[0003] Wireless communication systems have been widely deployed to provide various types of communication content, such as voice, video, packet data, messaging, broadcasts, and so on. These systems may be capable of supporting communication with multiple users by sharing available system resources (e.g., time, frequency, and power). Examples of such multiple-access systems include code division multiple access (CDMA) systems, time division multiple access (TDMA) systems, frequency division multiple access (FDMA) systems, and orthogonal frequency division multiple access (OFDMA) systems. A wireless multiple-access communication system may include several base stations, each simultaneously supporting communication for multiple communication devices, which may each be referred to as user equipment (UE).

[0004]

[0004] At times, wireless communication systems may be vulnerable to various insecurities. In some cases, especially when wireless information and / or location-based services are provided in public forums (e.g., shopping malls, office buildings, etc.), potential security risks may arise given the possibility that malicious entities may exploit the network to gain unauthorized access to sensitive information. Such security risks may include "man in the middle", "spoofing", and / or "phishing types of cyber-attacks". Such attacks may be based on malicious entities successfully impersonating legitimate entities by manipulating network protocols, forging authentication information, and / or compromising network integrity to deceive users and obtain illicit benefits. In addition, UEs may relay data to other UEs in sidelink channels and coverage extension applications, which increases the possibility of man-in-the-middle and replay attacks. Therefore, authentication of channel connections and identification of the presence of attacking devices are desirable. Summary of the Invention

[0005]

[0005] A connection between a user equipment (UE) and a base station may be authenticated, for example, at the physical layer, and the presence of an unauthorized intervening device between the UE and the base station may be identified based on predicted measurements of downlink reference signals and actual measurements of a current downlink reference signal. The predicted measurements are generated, for example, after a higher layer initial authentication, based on previous measurements of downlink reference signals known to be received from the base station. The predicted values ​​may relate to positioning measurements, channel measurements, or speed or direction measurements of movement, or a combination thereof. A difference between the predicted and actual measurements, for example a difference greater than a predefined threshold, indicates that the previous and current reference signals used to generate the predicted measurements are not from the same entity, and thus there is a high probability that an intervening entity performing a man-in-the-middle or replay attack is present in the communication channel.

[0006]

[0006] In one implementation, a method performed by a user equipment (UE) to authenticate a connection with a base station includes receiving one or more predicted values ​​for one or more measurements of a downlink positioning reference signal based on a previous measurement of a downlink positioning reference signal received from the base station, receiving a downlink positioning reference signal, performing one or more measurements of the received downlink positioning reference signal, and determining whether the received downlink positioning reference signal was transmitted by an attacking device based on the one or more predicted values ​​for the one or more measurements of the downlink positioning reference signal and the one or more measurements of a current downlink positioning reference signal.

[0007]

[0007] In one implementation, the user equipment (UE) comprises: a wireless transceiver configured to authenticate a connection with a base station, the wireless transceiver configured to communicate with other entities in the wireless network; at least one memory; and at least one processor coupled to the wireless transceiver and the at least one memory, the at least one processor configured to: receive, via the wireless transceiver, one or more predicted values ​​for one or more measurements of the downlink reference signal based on measurements of a previous downlink reference signal received from the base station; receive, via the wireless transceiver, a downlink reference signal, perform one or more measurements of the received downlink reference signal; and determine whether the received downlink reference signal was transmitted by an attacking device based on the one or more predicted values ​​for the one or more measurements of the downlink reference signal and the one or more measured values ​​of the current downlink reference signal.

[0008]

[0008] In one implementation, a user equipment (UE) configured to authenticate a connection with a base station comprises: means for receiving one or more predicted values ​​for one or more measurements of a downlink reference signal based on measurements of a previous downlink reference signal received from the base station; means for receiving a downlink reference signal; means for performing one or more measurements of the received downlink reference signal; and means for determining whether the received downlink reference signal was transmitted by an attacking device based on the one or more predicted values ​​for the one or more measurements of the downlink reference signal and the one or more measurements of a current downlink reference signal.

[0009]

[0009] In one implementation, a non-transitory storage medium having program code stored thereon, the program code operable to configure at least one processor in a user equipment (UE) to authenticate a connection with a base station, the program code including instructions for receiving one or more predicted values ​​for one or more measurements of a downlink reference signal based on measurements of a previous downlink reference signal received from the base station, receiving a downlink reference signal, performing one or more measurements of the received downlink reference signal, and determining whether the received downlink reference signal was transmitted by an attacking device based on the one or more predicted values ​​for the one or more measurements of the downlink reference signal and the one or more measurements of a current downlink reference signal.

[0010]

[0010] In one implementation, a method performed by a network entity to authenticate a connection between a user equipment (UE) and a base station includes obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from the base station, sending the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE, and receiving an indication of whether an attacking device is present in the connection between the UE and the base station based on the one or more measurements performed by the UE on a current downlink reference signal received by the UE and the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE.

[0011]

[0011] In one implementation, the network entity configured to authenticate a connection between a user equipment (UE) and a base station comprises: an external interface configured to communicate with other entities in a wireless network; at least one memory; and at least one processor coupled to the external interface and the at least one memory, configured to: obtain one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from a base station, send the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE via the external interface; and receive, via the external interface, an indication of whether an attacking device is present in the connection between the UE and the base station based on the one or more measurements performed by the UE on a current downlink reference signal received by the UE and the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE.

[0012]

[0012] In one implementation, a network entity configured to authenticate a connection between a user equipment (UE) and a base station, comprising: means for obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from the base station; means for sending one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE; and means for receiving an indication of whether an attacking device is present in the connection between the UE and the base station based on one or more measurements performed by the UE on a current downlink reference signal received by the UE and one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE.

[0013]

[0013] In one implementation, a non-transitory storage medium having program code stored thereon, the program code being operable to configure at least one processor in a network entity to authenticate a connection between a user equipment (UE) and a base station, the program code comprising instructions for obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from a base station, sending the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE, and receiving an indication of whether an attacking device is present in the connection between the UE and the base station based on the one or more measurements performed by the UE on a current downlink reference signal received by the UE and the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE. [Brief description of the drawings]

[0014]

[0014] The claimed subject matter is particularly pointed out and distinctly claimed in the concluding portion of this specification, however, both as to its features and / or advantages, and its method of organization and / or operation, may best be understood by reference to the following detailed description when read in conjunction with the accompanying drawings. [Figure 1]

[0015] FIG. 1 is a diagram of an example wireless communication system. [Diagram 2]

[0016] 1 illustrates an exemplary wireless network structure. [Diagram 3]

[0017] 2 illustrates another exemplary wireless network structure. [Figure 4]

[0018] 2 shows a block diagram of a design of a base station and a UE, which may be one of the base stations and one of the UEs in FIG. 1. [Diagram 5]

[0019] 1 illustrates the structure of an exemplary subframe sequence having positioning reference signal (PRS) positioning opportunities. [Figure 6]

[0020] 1 illustrates a simplified environment and an example technique for determining a UE's position using distances from multiple base stations. [Figure 7]

[0021] 1 illustrates a simplified environment and an exemplary technique for determining the location of a UE using a Time Difference of Arrival (TDOA) technique. [Figure 8A]

[0022] 1 illustrates a simplified environment and an example technique for determining a UE's position using the Angle of Arrival (AoA) or Angle of Departure (AoD). [Figure 8B]

[0023] 1 illustrates a simplified environment and another exemplary technique for determining a UE's position using AoA or AoD. [Figure 9A]

[0024] 1 illustrates an environment in which a replay attack or a man-in-the-middle attack may be performed by an attacking device between a UE and a base station, and identification of the attacking device. [Figure 9B]

[0025] 1 shows a graph illustrating several expected and current positioning measurements that may be compared to identify the presence of an attacking device. [Figure 10]

[0026] 4 shows an example of expected measurements received for positioning measurements and expected measurements for security. [Figure 11]

[0027] 6 is a message flow illustrating messaging in a wireless network to authenticate a connection between a UE and a base station and to identify the presence of an intervening device between the UE and the base station. [Figure 12]

[0028] FIG. 1 shows a schematic block diagram illustrating some example features of a UE configured to support authentication of a connection with a base station and identification of the presence of an intervening device between the UE and the base station. [Figure 13]

[0029] FIG. 1 illustrates a schematic block diagram illustrating certain example features of a network entity configured to support authentication of a connection between a UE and a base station and identification of the presence of an intervening device between the UE and the base station. [Figure 14]

[0030] 4 illustrates a flow diagram of an example method performed by a UE to authenticate a connection with a base station. [Figure 15]

[0031] 4 illustrates a flow diagram of an example method performed by a network entity to authenticate a connection between a UE and a base station.

[0015]

[0032] According to some exemplary implementations, like reference numbers in various figures refer to like elements. In addition, multiple instances of an element may be indicated by the first number of the element followed by a letter or a hyphen and a second number. For example, multiple instances of element 102 may be indicated as 102-1, 102-2, 102-3, etc., or as 102a, 102b, or 102c, etc. When referring to such an element using only the first number, any instance of that element should be understood (e.g., element 102 in the previous example refers to elements 102-1, 102-2, 102-3, or elements 102a, 102b, or 102c).

[0016]

[0033] It will be appreciated that the figures may not necessarily be drawn to scale, such as for brevity and / or clarity of illustration. For example, dimensions of some aspects may be exaggerated relative to others. Additionally, it should be understood that other embodiments may be utilized. Additionally, structural and / or other changes may be made without departing from the claimed subject matter. References throughout this specification to "claimed subject matter" refer to subject matter intended to be covered by one or more claims, or any portion thereof, and are not necessarily intended to refer to a complete set of claims, a particular combination of a set of claims (e.g., method claims, apparatus claims, etc.), or a particular claim. It should also be noted that directions and / or references such as, for example, top, bottom, upper, lower, etc., may be used to facilitate discussion of the drawings and are not intended to limit the application of the claimed subject matter. Thus, the following detailed description should not be taken as limiting the claimed subject matter and / or equivalents. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0017]

[0034] Those skilled in the art will appreciate that the information and signals described below may be represented using any of a variety of different technologies and techniques. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be referenced throughout the following description may be represented by voltages, currents, electromagnetic waves, magnetic fields or particles, optical fields or particles, or any combination thereof, depending in part on the particular application, desired design, corresponding technology, etc.

[0018]

[0035] Further, many aspects are described in terms of sequences of actions to be performed, for example, by elements of a computing device. It will be appreciated that various actions described herein may be performed by specific circuitry (e.g., an application specific integrated circuit (ASIC)), by program instructions executed by one or more processors, or a combination of both. In addition, a sequence of actions described herein may be considered to be fully embodied in any form of non-transitory computer-readable storage medium storing a corresponding set of computer instructions that, when executed, cause or instruct an associated processor of a device to perform the functions described herein. Thus, various aspects of the present disclosure may be embodied in a number of different forms, all of which are contemplated to be within the scope of the claimed subject matter. In addition, for each of the aspects described herein, the corresponding form of any such aspect may be described herein, for example, as "one or more processors configured to perform" the described actions.

[0019]

[0036] The terms "user equipment (UE)" and "base station" as used herein are not intended to be specific or otherwise limited to any particular Radio Access Technology (RAT) unless otherwise specified. In general, a UE may be any wireless communication device (e.g., a mobile phone, a router, a tablet computer, a laptop computer, a computer tracking device for tracking computer goods, packages, assets, or entities such as individuals or pets, a wearable (e.g., a smart watch, glasses, augmented reality (AR) / virtual reality (VR) headsets, etc.), a vehicle (e.g., a car, a motorcycle, a bicycle, etc.), an Internet of Things (IoT) device, etc.) used by a user to communicate over a wireless communication network. A UE may be mobile or may be stationary (e.g., at some time) and may communicate with a Radio Access Network (RAN). As used herein, the term "UE" may be referred to interchangeably as an "access terminal" or "AT", "client device", "wireless device", "subscriber device", "subscriber terminal", "subscriber station", "user terminal" or "UT", "mobile terminal", "mobile station", "mobile device", or variations thereof. In general, a UE may communicate with a core network via a RAN, through which the UE may be connected to external networks, such as the Internet, and to other UEs. Of course, other mechanisms for connecting to the core network and / or the Internet are also possible for a UE, such as via a wired access network, a wireless local area network (WLAN) network (e.g., based on IEEE 802.11, etc.), etc.

[0020]

[0037] A base station may operate according to one of several RATs in communication with a UE depending on the network in which the base station is deployed and may alternatively be referred to as an access point (AP), network node, Node B, evolved Node B (eNB), New Radio (NR) Node B (also referred to as gNB), etc. Additionally, in some systems, the base station may simply provide edge node signaling functionality, while in other systems, the base station may provide additional control and / or network management functionality. A communication link through which a UE may send signals to a base station is referred to as an uplink (UL) channel (e.g., reverse traffic channel, reverse control channel, access channel, etc.). A communication link through which a base station may send signals to a UE is referred to as a downlink (DL) channel or a forward link channel (e.g., paging channel, control channel, broadcast channel, forward traffic channel, etc.). A communication link through which a UE may send signals to other UEs is referred to as a sidelink (SL) channel. As used herein, the term traffic channel (TCH) can refer to either a UL / reverse traffic channel or a DL / forward traffic channel.

[0021]

[0038] The term "base station" may refer to a single physical transmission-reception point (TRP) or multiple physical TRPs that may or may not be collocated. For example, when the term "base station" refers to a single physical TRP, the physical TRP may be an antenna of the base station corresponding to the cell of the base station. When the term "base station" refers to multiple collocated physical TRPs, the physical TRP may be an array of antennas of the base station (e.g., as in the case of a multiple-input multiple-output (MIMO) system or when the base station employs beamforming). When the term "base station" refers to multiple non-collocated physical TRPs, the physical TRP may be a distributed antenna system (DAS) (a network of spatially separated antennas connected to a common source via a transport medium) or a remote radio head (RRH) (a remote base station connected to a serving base station). Alternatively, the non-collocated physical TRP may be a serving base station that receives measurement reports from the UE and a neighboring base station whose reference RF signal the UE is measuring.

[0022]

[0039] To support UE positioning, two broad classifications of positioning solutions have been defined: control plane and user plane. In control plane (CP) positioning, signaling related to positioning and its support may be carried over existing network (and UE) interfaces and using existing protocols dedicated to the transport of signaling. In user plane (UP) positioning, signaling related to positioning and its support may be carried as part of other data, using protocols such as Internet Protocol (IP), Transmission Control Protocol (TCP), and User Datagram Protocol (UDP).

[0023]

[0040] The Third Generation Partnership Project (3GPP®) has defined control plane positioning strategies for UEs using radio access according to Global System for Mobile communications (GSM®) (2G), Universal Mobile Telecommunications System (UMTS) (3G), LTE® (4G), and New Radio (NR) for the Fifth Generation (5G). These strategies are defined in 3GPP Technical specifications (TS) 23.271 and 23.273 (common part), 43.059 (GSM access), 25.305 (UMTS access), 36.305 (LTE access), and 38.305 (NR access). The Open Mobile Alliance (OMA) has also defined a UP location solution known as Secure User Plane Location (SUPL), which may be used to locate UEs accessing any of several radio interfaces supporting IP packet access, such as General Packet Radio Service (GPRS) with GSM, GPRS with UMTS, or IP access with LTE or NR.

[0024]

[0041] Both the CP and UP positioning solutions may utilize a location server (LS) to support positioning. The location server may be part of or accessible from the serving or home network for the UE, or may simply be accessible via the Internet or via a local intranet. When positioning of the UE is required, the location server may initiate a session with the UE (e.g., a location session or a SUPL session) to coordinate position measurements by the UE and the determination of the UE's estimated location. During a location session, the location server may request positioning capabilities of the UE (or the UE may provide them to the location server without a request) and may provide assistance data to the UE (e.g., if requested by the UE or not), e.g., requesting location estimates or measurements from the UE for Global Navigation Satellite System (GNSS), Time Difference of Arrival (TDOA), Angle of Departure (AOD), Angle of Arrival (AoA), Round-Trip Time (RTT) and Multi-Cell RTT (Multi-RTT), and / or Enhanced Cell ID (ECID) position methods. The assistance data may be used by the UE to acquire and measure reference signals such as GNSS and / or Positioning Reference Signal (PRS) signals (e.g., by providing expected characteristics of these signals such as frequency, expected time of arrival, signal coding, signal Doppler, etc.).

[0025]

[0042] In UE-based operating modes, assistance data may additionally or instead be used by the UE to help determine a position estimate from obtained position measurements (e.g. where the assistance data provides satellite ephemeris data in case of GNSS positioning or other base station characteristics such as base station position and PRS timing in case of terrestrial positioning using TDOA, AoD, multi-RTT, etc.).

[0026]

[0043] In a UE assisted mode of operation, the UE may return position measurements to the location server, which may determine an estimated location of the UE based on these measurements and possibly also other known or configured data (e.g. satellite ephemeris data for GNSS positioning, or base station characteristics including base station location and possibly PRS timing in case of terrestrial positioning using, e.g., TDOA, AoD, multi-RTT, etc.).

[0027]

[0044] In another standalone mode of operation, the UE may perform location-related measurements without using any positioning assistance data from a location server, and may further calculate a location or a change in location without using any positioning assistance data from a location server. Position methods that may be used in the standalone mode include GPS and GNSS (e.g., where the UE obtains satellite orbit data from data broadcast by the GPS and GNSS satellites themselves) and sensors.

[0028]

[0045] For 3GPP CP location, the location server can be an enhanced serving mobile location center (E-SMLC) for LTE access, a standalone SMLC (SAS) for UMTS access, a serving mobile location center (SMLC) for GSM access, or a Location Management Function (LMF) for 5G NR access. In the case of OMA SUPL Location, the location server may be a SUPL Location Platform (SLP), which may act as either: (i) a home SLP (H-SLP) if it is in or associated with the UE's home network or provides the UE with a persistent subscription for location services; (ii) a discovered SLP (D-SLP) if it is in or associated with some other (non-home) network or not associated with any network; (iii) an Emergency SLP (E-SLP) if it supports location for emergency calls initiated by the UE; or (iv) a visited SLP (V-SLP) if it is in or associated with the serving network or current local area for the UE.

[0029]

[0046] Radio access networks may employ reconfigurable intelligent surfaces (sometimes referred to as reconfigurable intelligent surfaces (RIS)) to increase the communication range of devices while minimizing the increase in the amount of power consumed by the radio access network. The reconfigurable surface may include an array of reflective elements that can be semi-statically configured to change the reflective angle of the reconfigurable surface, for example, by adjusting the reflection coefficient of the reflective elements.

[0030]

[0047] Wireless communication systems may be vulnerable to a variety of insecurities. In some cases, especially when wireless information and / or location-based services are provided in public forums (e.g., shopping malls, office buildings, etc.), potential security risks may arise given the possibility that malicious entities may exploit the network to gain unauthorized access to sensitive information. Such security risks may include "man-in-the-middle," "spoofing," and / or "phishing" type cyber attacks. Such attacks may be based on a malicious entity successfully impersonating a legitimate entity by manipulating network protocols, forging credentials, and / or compromising network integrity to deceive users and obtain fraudulent benefits.

[0031]

[0048] For example, a UE may relay data to other UEs in sidelink channels and coverage extension applications. Relaying data between UEs raises concerns about man-in-the-middle and replay attacks. Such attacks may occur, for example, when the physical layer is used for authentication of transmissions. For example, for positioning measurements performed using downlink reference signals, such as positioning reference signals, and / or channel parameters, using channel characteristics and prediction techniques, the UE may determine whether a received downlink transmission is most likely from an authentic transmitter.

[0032]

[0049] In one implementation, the UE may authenticate a connection with a base station, such as a gNB, in the physical layer based on predicted values ​​for one or more measurements of a downlink reference signal based on one or more previous measurements of the downlink reference signal received from the base station and identify the presence of an unauthorized intervening device between the UE and the base station. The UE may receive predicted values ​​for one or more measurements, for example, from the base station or a location server. The measurements may be positioning measurements, such as, for example, Reference Signal Received Power (RSRP) values, Reference Signal Time Difference (RSTD) values ​​and / or uncertainties, Angle of Arrival (AoA) values ​​and / or uncertainties, Angle of Departure values ​​and / or uncertainties, Round Trip Time (RTT), etc. The measurements may further include predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports, and / or a predicted moving speed and / or moving direction of the UE. When a new downlink reference signal is received, the UE may determine whether it is from a genuine transmitter or an attacking device by performing one or more measurements on the downlink reference signal and comparing the measurement for the current reference signal to a predicted value based on previous measurements. If the current measurement does not match the predicted measurement within a threshold, e.g., an acceptable error or uncertainty, the UE may determine that the current downlink reference signal is not from the same base station that transmitted the previous downlink reference signal used to generate the predicted measurement, and therefore, an unauthorized intervening device is likely to be present. The UE may report the detected presence of the intervening device to the serving base station or a location server as an active attack.

[0033]

[0050] 1 illustrates an example wireless communication system 100 in which a UE 104 may authenticate a connection with a base station 102 at the physical layer and identify the presence of unauthorized intervening devices, as described herein. The wireless communication system 100 (sometimes referred to as a wireless wide area network (WWAN)) may include various base stations 102, sometimes referred to herein as TRPs 102, and various UEs 104. The base stations 102 may include macrocell base stations (high-power cellular base stations) and / or small cell base stations (low-power cellular base stations). In an aspect, the macrocell base stations may include eNBs, if the wireless communication system 100 corresponds to an LTE network, or gNBs, if the wireless communication system 100 corresponds to a 5G network, or a combination of both, and the small cell base stations may include femtocells, picocells, microcells, etc.

[0034]

[0051] The base stations 102 may collectively form a RAN and may interface with a core network 170 (e.g., evolved packet core (EPC) or next generation core (NGC)) through backhaul links 122 and with one or more location servers 172 through the core network 170. In addition to other functions, the base stations 102 may perform functions related to one or more of forwarding user data, radio channel encryption and decryption, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection setup and release, load balancing, distribution for non-access stratum (NAS) messages, NAS node selection, synchronization, RAN sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment tracing, RAN information management (RIM), paging, positioning, and delivery of alert messages. The base stations 102 may communicate with one another directly or indirectly (eg, through EPC / NGC) over backhaul links 134, which may be wired or wireless.

[0035]

[0052] The base stations 102 may wirelessly communicate with the UEs 104. Each of the base stations 102 may provide communication coverage to a respective geographic coverage area 110. In an aspect, one or more cells may be supported by the base stations 102 in each coverage area 110. A "cell" is a logical communication entity used for communication with a base station (e.g., over some frequency resources called a carrier frequency, component carrier, carrier, band, etc.) and may be associated with an identifier (e.g., physical cell identifier (PCID), virtual cell identifier (VCID)) to distinguish cells operating over the same or different carrier frequencies. In some cases, different cells may be configured according to different protocol types (e.g., machine-type communication (MTC), narrowband IoT (NB-IoT), enhanced mobile broadband (eMBB), or others) that may provide access for different types of UEs. In some cases, the term "cell" may refer to the geographic coverage area (e.g., a sector) of a base station, so long as the carrier frequency can be detected and used for communication within a portion of the geographic coverage area 110.

[0036]

[0053] The geographic coverage areas 110 of neighboring macrocell base stations 102 may overlap partially (e.g., in handover regions), but some of the geographic coverage areas 110 may be substantially overlapped by larger geographic coverage areas 110. For example, a small cell base station 102' may have a coverage area 110' that significantly overlaps with the coverage area 110 of one or more macrocell base stations 102. A network that includes both small cell base stations and macrocell base stations may be known as a heterogeneous network. A heterogeneous network may also include home eNBs (HeNBs), which may serve closed groups known as closed subscriber groups (CSGs).

[0037]

[0054] The communication link 120 between the base station 102 and the UE 104 may include UL (also called reverse link) transmissions from the UE 104 to the base station 102, and / or downlink (DL) (also called forward link) transmissions from the base station 102 to the UE 104. The communication link 120 may use MIMO antenna techniques, including spatial multiplexing, beamforming, and / or transmit diversity. The communication link 120 may be through one or more carrier frequencies. The allocation of carriers may be asymmetric for DL ​​and UL (e.g., more or fewer carriers may be allocated for DL ​​than for UL).

[0038]

[0055] The wireless communication system 100 may further include a wireless local area network (WLAN) access point (AP) 150 in communication with a WLAN station (STA) 152 over a communication link 154 in an unlicensed frequency spectrum (e.g., 5 GHz). When communicating in the unlicensed frequency spectrum, the WLAN STA 152 and / or the WLAN AP 150 may perform a clear channel assessment (CCA) prior to communication to determine if a channel is available.

[0039]

[0056] The small cell base station 102' may operate in a licensed and / or unlicensed frequency spectrum. When operating in an unlicensed frequency spectrum, the small cell base station 102' may employ LTE or 5G technology and use the same 5 GHz unlicensed frequency spectrum used by the WLAN AP 150. A small cell base station 102' employing LTE / 5G in an unlicensed frequency spectrum may extend coverage to and / or increase capacity of an access network. LTE in an unlicensed spectrum may be referred to as LTE-unlicensed (LTE-U), licensed assisted access (LAA), or MulteFire.

[0040]

[0057] The wireless communication system 100 may further include a millimeter wave (mmW) base station 180 that may operate in mmW and / or sub-mmW frequencies in communication with the UE 182. Extremely high frequency (EHF) is a part of RF in the electromagnetic spectrum. EHF ranges from 30 GHz to 300 GHz and has a wavelength between 1 and 10 millimeters. Radio waves in this band may be referred to as millimeter waves. Sub-mmW may extend down to frequencies of 3 GHz with wavelengths of 100 millimeters. The super high frequency (SHF) band extends between 3 GHz and 30 GHz and is also referred to as centimeter waves. Communications using the mmW / sub-mmW radio frequency bands have high path losses and relatively short distances. The mmW base station 180 and the UE 182 may utilize beamforming (transmit and / or receive) over the mmW communication link 184 to compensate for the extremely large path losses and short distances. It will be further appreciated that in alternative configurations, one or more base stations 102 may also transmit using mmW or quasi-mmW and beamforming. Thus, it will be appreciated that the above illustrations are merely examples and should not be construed as limiting various aspects disclosed herein.

[0041]

[0058] Transmit beamforming is a technique for focusing an RF signal in a particular direction. Traditionally, when a network node (e.g., a base station) broadcasts an RF signal, it broadcasts the signal in all directions (omnidirectionally). With transmit beamforming, the network node determines where a given target device (e.g., UE) is located (relative to the transmitting network node) and projects a stronger downlink RF signal in that particular direction, thereby providing a faster and more powerful RF signal (in terms of data rate) to the receiving device. To vary the directionality of the RF signal when transmitting, the network node can control the phase and relative amplitude of the RF signal at each of one or more transmitters broadcasting the RF signal. For example, the network node can use an array of antennas (also called a "phased array" or "antenna array") that creates beams of RF waves that can be "steered" to point in different directions without actually moving the antennas. In particular, RF current from a transmitter is fed to each antenna with the correct phase relationship so that the radio waves from the separate antennas combine together to enhance radiation in desired directions while canceling out radiation in undesired directions.

[0042]

[0059] In receive beamforming, a receiver uses a receive beam to amplify RF signals detected on a given channel. For example, the receiver can increase the gain setting and / or adjust the phase setting of an array of antennas in a particular direction to amplify (e.g., increase the gain level) RF signals received from that direction. Thus, when a receiver is said to beamform in a certain direction, it means that the beam gain in that direction is higher than the beam gains along other directions, or that the beam gain in that direction is the highest compared to the beam gains in that direction of all other receive beams available to the receiver. This results in a stronger received signal strength (e.g., reference signal received power (RSRP), reference signal received quality (RSRQ), signal-to-interference-plus-noise ratio (SINR), etc.) of RF signals received from that direction.

[0043]

[0060] In 5G, the frequency spectrum in which wireless nodes (e.g., base stations 102 / 180, UEs 104 / 182) operate is divided into multiple frequency ranges: FR1 (450 MHz to 6000 MHz), FR2 (24250 MHz to 52600 MHz), FR3 (above 52600 MHz), and FR4 (between FR1 and FR2). In a multi-carrier system such as 5G, one of the carrier frequencies is called the "primary carrier" or "anchor carrier" or "primary serving cell" or "PCell" and the remaining carrier frequencies are called the "secondary carrier" or "secondary serving cell" or "SCell". In carrier aggregation, the anchor carrier is the carrier operating on the primary frequency (e.g., FR1) utilized by the UE 104 / 182 and on the cell in which the UE 104 / 182 either performs an initial radio resource control (RRC) connection establishment procedure or initiates an RRC connection re-establishment procedure. The primary carrier carries all common control channels and UE-specific control channels. The secondary carrier is the carrier operating on a second frequency (e.g., FR2) that may be configured once an RRC connection is established between the UE 104 and the anchor carrier and may be used to provide additional radio resources. Since both the primary uplink carrier and the primary downlink carrier are typically UE-specific, the secondary carrier may include only the necessary signaling information and signals, e.g., signaling information and signals that are UE-specific may not be present in the secondary carrier. This means that different UEs 104 / 182 in a cell may have different downlink primary carriers. The same applies to the uplink primary carrier. The network can change the primary carrier of any UE 104 / 182 at any time, for example, to distribute the load on different carriers.Since a "serving cell" (whether a PCell or an SCell) corresponds to a carrier frequency / component carrier over which several base stations are communicating, terms such as "cell", "serving cell", "component carrier", "carrier frequency", etc. may be used interchangeably.

[0044]

[0061] For example, still referring to FIG. 1, one of the frequencies utilized by the macrocell base station 102 may be an anchor carrier (or "PCell"), and the other frequencies utilized by the macrocell base station 102 and / or the mmW base station 180 may be secondary carriers ("SCells"). Simultaneous transmission and / or reception of multiple carriers allows the UE 104 / 182 to significantly increase its data transmission and / or data reception rates. For example, two aggregated 20 MHz carriers in a multi-carrier system would theoretically lead to a two-fold increase in data rate (i.e., 40 MHz) compared to the data rate achieved by a single 20 MHz carrier.

[0045]

[0062] The wireless communication system 100 may further include one or more UEs, such as a UE 190, that indirectly connect to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links. In the example of FIG. 1, the UE 190 has a D2D P2P link 192 (e.g., through which the UE 190 may indirectly obtain cellular connectivity) with one of the UEs 104 connected to one of the base stations 102, and a D2D P2P link 194 (through which the UE 190 may indirectly obtain WLAN-based Internet connectivity) with a WLAN STA 152 connected to a WLAN AP 150. In one example, the D2D P2P links 192 and 194 may be supported using any well-known D2D RAT, such as LTE Direct (LTE-D), WiFi Direct (WiFi-D), Bluetooth, etc.

[0046]

[0063] The wireless communications system 100 may further include a UE 164, which may communicate with the macrocell base station 102 via communications link 120 and / or with the mmW base station 180 via an mmW communications link 184. For example, the macrocell base station 102 may support a PCell and one or more SCells for the UE 164, and the mmW base station 180 may support one or more SCells for the UE 164.

[0047]

[0064] The attacking device 112 may be performing a man-in-the-middle or relay attack. For example, the attacking device 112 may receive signals from one or more base stations 102 and relay the signals to the UE 104 via signals 114. Through interception and relaying of signals 120 to the UE 104, the attacking device 112 may gain unauthorized access to sensitive information without the knowledge of the UE 104 or the base station 102. Therefore, detection of the presence of the attacking device 112 by the UE 104 and / or the base station 102 is desirable so that corrective action can be taken.

[0048]

[0065] 2 illustrates an exemplary wireless network structure 200. For example, the NGC 210 (also referred to as "5GC") may be viewed functionally as a control plane function 214 (e.g., UE registration, authentication, network access, gateway selection, etc.) and a user plane function 212 (e.g., UE gateway function, access to data network, IP routing, etc.) that work cooperatively to form a core network. A user plane interface (NG-U) 213 and a control plane interface (NG-C) 215 connect the gNB 222 to the NGC 210, specifically to the control plane function 214 and the user plane function 212. In an additional configuration, the eNB 224 may also be connected to the NGC 210 via the NG-C 215 to the control plane function 214 and the NG-U 213 to the user plane function 212. Additionally, the eNB 224 may communicate directly with the gNB 222 via a backhaul connection 223. In some configurations, the new RAN 220 may have only one or more gNBs 222, while other configurations include one or more of both the eNBs 224 and the gNBs 222. Either the gNBs 222 or the eNBs 224 may be in communication with the UEs 204 (e.g., any of the UEs shown in FIG. 1). Another optional aspect may include one or more location servers 230a, 230b (which may be collectively referred to as location servers 230) (which may correspond to location server 172), which may be in communication with the control plane function 214 and the user plane function 212 in the NGC 210, respectively, to provide position location assistance for the UEs 204. The location servers 230 may be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules spread across multiple physical servers, etc.), or may alternatively each correspond to a single server. The location server 230 may be configured to support one or more positioning services for UEs 204 that may connect to the location server 230 via a core network, NGC 210, and / or the Internet (not shown).Furthermore, the location server 230 may be integrated into a component of the core network, or alternatively, may be outside the core network, for example in the new RAN 220.

[0049]

[0066] 3 illustrates another exemplary wireless network structure 350. For example, the NGC 360 (also referred to as "5GC") may be viewed functionally as a control plane function provided by an access and mobility management function (AMF) 364, a user plane function (UPF) 362, a session management function (SMF) 366, an SLP 368, and an LMF 370, which operate cooperatively to form a core network (i.e., NGC 360). A user plane interface 363 and a control plane interface 365 connect the ng-eNB 324 to the NGC 360, specifically to the UPF 362 and the AMF 364, respectively. In an additional configuration, the gNB 322 may also be connected to the NGC 360 via a control plane interface 365 to the AMF 364 and a user plane interface 363 to the UPF 362. Additionally, the eNB 324 may communicate directly with the gNB 322 via a backhaul connection 323, with or without a gNB direct connection to the NGC 360. In some configurations, the new RAN 320 may have only one or more gNBs 322, while other configurations include one or more of both the ng-eNB 324 and the gNB 322. Either the gNB 322 or the eNB 324 may communicate with the UE 304 (e.g., any of the UEs shown in FIG. 1). The base stations of the new RAN 320 communicate with the AMF 364 via an N2 interface and with the UPF 362 via an N3 interface.

[0050]

[0067] The functions of the AMF include registration management, connection management, reachability management, mobility management, lawful interception, transport of session management (SM) messages between the UE 304 and the SMF 366, transparent proxy services for routing SM messages, access authentication and access authorization, transport of short message service (SMS) messages between the UE 304 and a short message service function (SMSF) (not shown), and security anchor functionality (SEAF). The AMF also interacts with an authentication server function (AUSF) (not shown) and the UE 304, and receives intermediate keys established as a result of the UE 304 authentication process. In case of authentication based on a universal mobile telecommunications system (UMTS) subscriber identity module (USIM), the AMF retrieves security material from the AUSF. The functions of the AMF also include security context management (SCM). The SCM receives keys from the SEAF that the SCM uses to derive access network specific keys. The functions of the AMF also include location service management for barred services, transport of location service messages between the UE 304 and a location management function (LMF) 370 (which may correspond to the location server 172) and between the new RAN 220 and the LMF 370, EPS bearer identifier allocation for interworking with an evolved packet system (EPS), and UE 304 mobility event notification. In addition, the AMF also supports functionality for non-3rd Generation Partnership Project (3GPP) access networks.

[0051]

[0068] The functions of the UPF include acting as an anchor point for intra / inter-RAT mobility (when applicable), acting as an external protocol data unit (PDU) session point for interconnection to a data network (not shown), packet routing and forwarding, packet inspection, user plane policy rule enforcement (e.g., gating, redirection, traffic steering), lawful interception (user plane collection), traffic usage reporting, quality of service (QoS) processing for the user plane (e.g., UL / DL rate enforcement, reflective QoS marking in the DL), UL traffic validation (service data flow (SDF) to QoS flow mapping), transport level packet marking in the UL and DL, DL packet buffering and DL data notification triggering, as well as sending and forwarding one or more "end markers" to the source RAN node.

[0052]

[0069] The functions of the SMF 366 include session management, allocation and management of UE Internet Protocol (IP) addresses, selection and control of user plane functions, configuration of traffic steering in the UPF to route traffic to the appropriate destination, control of policy enforcement and part of QoS, and downlink data notification. The interface through which the SMF 366 communicates with the AMF 364 is called the N11 interface.

[0053]

[0070] Another optional aspect may include an LMF 370, which may be in communication with the NGC 360 to provide location assistance for the UE 304. The LMF 370 may be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules across multiple physical servers, etc.), or alternatively, each may represent a single server. The LMF 370 may be configured to support one or more location services for UEs 304 that may connect to the LMF 370 via a core network, the NGC 360, and / or via the Internet (not shown).

[0054]

[0071] 4 shows a block diagram of a design 400 of a base station 102 and a UE 104, which may be one of the base stations and one of the UEs in FIG. 1. Base station 102 may be equipped with T antennas 434a through 434t, and UE 104 may be equipped with R antennas 452a through 452r, where in general T≧1 and R≧1.

[0055]

[0072] At the base station 102, the transmit processor 420 may receive data for one or more UEs from a data source 412, select one or more modulation and coding schemes (MCS) for each UE based at least in part on channel quality indicators (CQI) received from the UE, process (e.g., code and modulate) the data for each UE based at least in part on the MCS selected for the UE, and provide data symbols to all UEs. The transmit processor 420 may also process system information (e.g., for semi-static resource partitioning information (SRPI), etc.) and control information (e.g., CQI requests, grants, higher layer signaling, etc.) and provide overhead and control symbols. The transmit processor 420 may also generate reference symbols for reference signals (e.g., a cell-specific reference signal (CRS)) and synchronization signals (e.g., a primary synchronization signal (PSS) and a secondary synchronization signal (SSS)). A transmit (TX) multiple-input multiple-output (MIMO) processor 430 may perform spatial processing (e.g., precoding) on ​​the data symbols, control symbols, overhead symbols, and / or reference symbols, if applicable, and may provide T output symbol streams to T modulators (MOD) 432a through 432t. Each modulator 432 may process a respective output symbol stream (e.g., for OFDM, etc.) to obtain an output sample stream. Each modulator 432 may further process (e.g., convert to analog, amplify, filter, and upconvert) the output sample stream to obtain a downlink signal. The T downlink signals from modulators 432a through 432t may be transmitted via T antennas 434a through 434t, respectively.According to various aspects described in more detail below, a synchronization signal may be generated using position encoding to convey additional information.

[0056]

[0073] At the UE 104, the antennas 452a through 452r may receive downlink signals from the base station 102 and / or other base stations, respectively, and may provide received signals to demodulators (DEMODs) 454a through 454r. Each demodulator 454 may condition (e.g., filter, amplify, downconvert, and digitize) the received signal to obtain input samples. Each demodulator 454 may further process the input samples (e.g., for OFDM, etc.) to obtain received symbols. A MIMO detector 456 may obtain the received symbols from all R demodulators 454a through 454r, perform MIMO detection on the received symbols, if applicable, and provide detected symbols. A receive processor 458 may process (e.g., demodulate and decode) the detected symbols and provide decoded data for the UE 104 to a data sink 460 and provide decoded control and system information to the controller / processor 480. The channel processor may determine a reference signal received power (RSRP), a received signal strength indicator (RSSI), a reference signal received quality (RSRQ), a channel quality indicator (CQI), etc. In some aspects, one or more components of the UE 104 may be included in a housing.

[0057]

[0074] On the uplink, at the UE 104, a transmit processor 464 may receive and process data from a data source 462 and control information (e.g., for reports comprising RSRP, RSSI, RSRQ, CQI, etc.) from the controller / processor 480. The transmit processor 464 may also generate reference symbols for one or more reference signals. The symbols from the transmit processor 464 may be precoded by a TX MIMO processor 466 if applicable, further processed by modulators 454a-454r (e.g., for DFT-s-OFDM, CP-OFDM, etc.), and transmitted to the base station 102. At the base station 102, uplink signals from the UE 104 and other UEs may be received by antennas 434, processed by a demodulator 432, detected by a MIMO detector 436 if applicable, and further processed by a receive processor 438 to obtain decoded data and control information sent by the UE 104. The receive processor 438 may provide the decoded data to a data sink 439 and the decoded control information to the controller / processor 440. The base station 102 may include a communication unit 444 and may communicate with a network controller 489 via the communication unit 444. The network controller 489 may include a communication unit 494, a controller / processor 490, and a memory 492.

[0058]

[0075] The controller / processor 440 of the base station 102 and the controller / processor 480 of the UE 104 and / or any other components of FIG. 4 may perform one or more techniques related to authenticating a connection between the UE 104 and the base station 102 at the physical layer and identifying the presence of unauthorized intervening devices, as described in more detail elsewhere herein. For example, the controller / processor 440 of the base station 102, the controller / processor 480 of the UE 104, and / or any other components of FIG. 4 may perform or direct the operation of, for example, processes 1400 and 1500 of FIG. 14 and FIG. 15, and / or other processes and algorithms as described herein. The memories 442 and 482 may store data and program codes for the base station 102 and the UE 104, respectively. In some aspects, the memory 442 and / or the memory 482 and / or the memory 392 may comprise a non-transitory computer-readable medium that stores one or more instructions for wireless communication. For example, the one or more instructions, when executed by one or more processors of the base station 102 and / or the UE 104, may perform or direct the operation of, for example, processes 1400 and 1500 of FIGS. 14 and 15, and / or other processes as described herein.

[0059]

[0076] As noted above, Figure 4 is provided as an example. Other examples may differ from those described with respect to Figure 4.

[0060]

[0077] In 5G NR, supported positioning techniques include downlink-based positioning, DL-based positioning including DL-TDOA (using DL received signal time difference (RSTD) measurements) and DL-AoD (using Reference Signal Received Power (RSRP) measurements), uplink-based positioning including UL-TDOA (using UL Relative Time of Arrival (RTOA) measurements) and UL-AoA (using RSRP measurements), and a combination of downlink-based and uplink-based positioning including RTT (multi-RTT) with one or more neighboring base stations (using RSRP measurements or Rx-Tx time difference measurements). In addition, E-CID based on radio resource management (RRM) measurements is supported in 5G NR (using RSRP measurements or Reference Signal Received Quality (RSRQ) measurements).

[0061]

[0078] During positioning using signaling in LTE and 5G NR, the UE typically acquires dedicated positioning signals transmitted by base stations, called Positioning Reference Signals (PRS), that are used to generate the desired measurements for the supported positioning techniques. Positioning Reference Signals (PRS) are defined for 5G NR positioning to enable the UE to detect and measure more neighboring base stations or Transmit Reception Points (TRPs). Other types of signals, i.e., signals that are not dedicated to positioning, may be used by the UE for positioning. Several configurations are supported to enable different deployments (indoor, outdoor, sub-6, mmW). Beam sweeping is further supported for the PRS to support PRS beam operation. Table 1 below shows the 3GPP release numbers (e.g., Rel. 16 or Rel. 15) that define specific reference signals for different UE measurements and associated positioning techniques.

[0062] [Table 1]

[0063]

[0079] During positioning, the UL positioning reference signal transmitted by the UE and received by one or more base stations is based on the Release 15 (Rel-15) Sounding Reference Signal (SRS) with extensions / adjustments for positioning purposes. The UL-PRS is sometimes referred to as "SRS for positioning". A new Information Element (IE) is configured for SRS for positioning in RRC signaling. Table 2 below shows 3 GPP Release 16 measurement and positioning techniques that may use SRS for positioning.

[0064] [Table 2]

[0065]

[0080] Angle measurements such as AoA(φ) and zenith angle of arrival (ZoA(θ)) define an estimated angle of the UE relative to a reference direction that may be determined at the TRP antenna for a UL channel corresponding to the UE. The reference direction may be defined, for example, according to a Global Coordinate System (GCS) or a Local Coordinate System (LCS). LTE supports AoA using the GCS, while 5G NR supports both AoA and ZoA, and both GCS and LCS. Angle of arrival (AoA), as sometimes used herein, may refer to the azimuth angle of arrival, the zenith angle of arrival, or both the azimuth angle of arrival and the zenith angle of arrival.

[0066]

[0081] FIG. 5 illustrates a structure of an example subframe sequence 500 having a positioning reference signal (PRS) positioning opportunity according to an aspect of the disclosure. The subframe sequence 500 may be applicable for broadcasting a PRS signal from a base station (e.g., any of the base stations described herein) or other network node. The subframe sequence 500 may be used in an LTE system, and the same or similar subframe sequence may be used in other communication technologies / protocols, such as 5G and NR. In FIG. 5, time is represented horizontally (e.g., on the X-axis) with time progressing from left to right, and frequency is represented vertically (e.g., on the Y-axis) with frequency increasing (or decreasing) from bottom to top. As illustrated in FIG. 5, the downlink and uplink radio frames 510 may each be 10 milliseconds (ms) in length. For a downlink frequency division duplex (FDD) mode, the radio frame 510 is organized into 10 subframes 512, each 1 ms in length, in the illustrated example. Each subframe 512 comprises two slots 514, each of length 0.5 ms, for example.

[0067]

[0082] In the frequency domain, the available bandwidth may be divided into evenly spaced orthogonal subcarriers 516 (also called "tones" or "bins"). For example, with a regular length cyclic prefix (CP) using 15 kHz spacing, the subcarriers 516 may be grouped into groups of 12 subcarriers. A resource of one OFDM symbol length in the time domain and one subcarrier in the frequency domain (represented as a block of subframes 512) is called a resource element (RE). Each grouping of 12 subcarriers 516 and 14 OFDM symbols is called a resource block (RB), and in the above example, the number of subcarriers in a resource block is

[0068]

number

[0069] For a given channel bandwidth, the number of resource blocks available on each channel 522, also referred to as the transmission bandwidth configuration 522, may be written as:

[0070]

number

[0071] For example, for a channel bandwidth of 3 MHz in the above example, the number of resource blocks available on each channel 522 is

[0072]

number

[0073] It should be noted that a frequency component of a resource block (eg, 12 subcarriers) is called a physical resource block (PRB).

[0074]

[0083] A base station may transmit radio frames (e.g., radio frame 510), or other physical layer signaling sequences, supporting PRS signals (i.e., downlink (DL) PRS) according to a frame structure that is either similar or the same as the frame structure shown in Figure 5, and the PRS signals may be measured and used for location estimation of a UE (e.g., any of the UEs described herein). Other types of wireless nodes in a wireless communications network (e.g., distributed antenna systems (DAS), remote radio heads (RRH), UEs, APs, etc.) may also be configured to transmit PRS signals configured in a similar (or the same) manner as shown in Figure 5.

[0075]

[0084] A set of resource elements used for transmission of a PRS signal is called a "PRS resource." The set of resource elements may span multiple PRBs in the frequency domain and N (e.g., one or more) consecutive symbols in a slot 514 in the time domain. For example, the cross-hatched resource elements in the slot 514 may be examples of two PRS resources. A "PRS resource set" is a set of PRS resources used for transmission of a PRS signal, where each PRS resource has a PRS resource identifier (ID). In addition, the PRS resources in a PRS resource set are associated with the same transmit reception point (TRP). A PRS resource ID in a PRS resource set is associated with a single beam transmitted from a single TRP (a TRP may transmit one or more beams). Note that this does not imply anything about whether the TRPs and beams from which signals are transmitted are known to the UE.

[0076]

[0085] The PRS may be transmitted in special positioning subframes that are grouped into positioning occasions. A PRS occasion is one instance of a periodically repeating time window (e.g., consecutive slots) in which a PRS is expected to be transmitted. Each periodically repeating time window may contain a group of one or more consecutive PRS opportunities. Each PRS opportunity may be N PRS A PRS positioning occasion for a cell supported by a base station may comprise a number of milliseconds or subframes T PRS As an example, FIG. 5 shows a PRS is equal to 4(518)T PRS In some embodiments, T PRS may be measured in terms of the number of subframes between the starts of successive positioning occasions. Multiple PRS opportunities may be associated with the same PRS resource configuration, in which case each such opportunity may be referred to as a "PRS resource opportunity," etc.

[0077]

[0086] A location server, e.g., location server 172, and base station 102 (e.g., an eNodeB (eNB) for LTE access or an NR NodeB (gNB) for NR access) may exchange messages to enable the location server to (i) obtain location measurements of a particular UE from the base station, or (ii) obtain location information from the base station that is not related to a particular UE, such as antenna position coordinates for the base station, cells (e.g., cell identity information) supported by the base station, cell timing for the base station, and / or parameters for signals transmitted by the base station, such as PRS signals. In the case of LTE access, the LPP A (LPPa) protocol may be used to transfer such messages between a base station that is an eNodeB and a location server that is an E-SMLC. In the case of NR access, the New Radio Location Protocol A (sometimes referred to as NPPa or NRPPa) protocol may be used to transfer such messages between a base station that is a gNodeB and a location server that is an LMF.

[0078]

[0087] The PRS may be transmitted at a constant power. The PRS may also be transmitted with zero power (i.e., muted). Muting, which turns off periodically scheduled PRS transmissions, may be useful when PRS signals between different cells overlap by occurring at or near the same time. In this case, PRS signals from some cells may be muted while PRS signals from other cells are transmitted (e.g., at a constant power). Muting may aid the UE in signal acquisition and time of arrival (TOA) and reference signal time difference (RSTD) measurements of unmuted PRS signals (by avoiding interference from muted PRS signals). Muting may be viewed as non-transmission of the PRS for a given positioning occasion for a particular cell. The muting pattern (also called a muting sequence) may be signaled to the UE using a bit string (e.g., using the LTE positioning protocol (LPP)). For example, if a bit in position j is set to '0' in a bit string signaled to indicate a muting pattern, the UE may infer that the PRS is muted for the jth positioning occasion.

[0079]

[0088] To further improve the audibility of the PRS, the positioning subframes may be low-interference subframes transmitted without a user data channel. As a result, in an ideally synchronized network, the PRS may be interfered with by PRSs of other cells with the same PRS pattern index (i.e., same frequency shift), but not with data transmission. The frequency shift is a function of the PRS ID for the cell or other transmission point (TP) (

[0080]

number

[0081] ) or, if no PRS ID is assigned, the physical cell identifier (PCI) (

[0082]

number

[0083] ) which results in an effective frequency reuse factor of six.

[0084]

[0089] To further enhance PRS audibility (e.g., when the PRS bandwidth is limited, e.g., there are only six resource blocks corresponding to a 1.4 MHz bandwidth), the frequency band for successive PRS positioning occasions (or successive PRS subframes) may be changed in a known and predictable manner via frequency hopping. In addition, a cell supported by a base station may support more than one PRS configuration, where each PRS configuration may support a different frequency offset (vshift), a different carrier frequency, a different bandwidth, a different code sequence, and / or a certain number of subframes per positioning occasion (N PRS ) and a specific period (T PRS In some implementations, one or more of the PRS configurations supported in a cell may be for directional PRS and may then have unique additional characteristics, such as a unique transmission direction, a unique horizontal angular range, and / or a unique vertical angular range.

[0085]

[0090] The PRS configuration, including the PRS transmission / muting schedule as described above, is signaled to the UE to enable the UE to perform PRS positioning measurements. The UE is not expected to blindly perform PRS configuration detection.

[0086]

[0091] It should be noted that the terms "positioning reference signal" and "PRS" sometimes refer to specific reference signals used for positioning in LTE / NR systems. However, as used herein, unless otherwise indicated, the terms "positioning reference signal" and "PRS" refer to any type of reference signal for positioning purposes. Downlink (DL) or sidelink (SL) signals whose primary purpose is not related to positioning, such as control or communication, are referred to herein as non-position reference signals (non-PRS). Examples of non-PRS include, but are not limited to, PHY channels such as SSB, TRS, CSI-RS, PDSCH, DM-RS, PDCCH, PSSCH, and PSCCH. As described herein, non-PRS signals that are typically transmitted for purposes not related to positioning may also be used by the UE for positioning purposes, e.g., in hybrid positioning measurements. Similar to the DL PRS transmitted by the base station, as described above, the UE may transmit a UL PRS for positioning, as well as a UL non-PRS or a SL non-PRS that may be used for positioning. The UL PRS may be, for example, a Sounding Reference Signal (SRS) for positioning.

[0087]

[0092] Using received DL PRS or non-PRS from the base station or SL signaling from other UEs, and / or UL PRS or non-PRS transmitted to the base station or SL to other UEs, the UE may perform various positioning measurements, such as Reference Signal Time Difference (RSTD) measurements for Time Difference of Arrival (TDOA) positioning techniques, Reference Signal Received Power (RSRP) measurements for TDOA, Angle of Departure (AoD), Angle of Arrival (AoA), and Round Trip Time (RTT) or multi-cell RTT (multi-RTT) positioning techniques, the time difference between reception and transmission of a signal (Rx-Tx) for multi-RTT positioning techniques.

[0088]

[0093] Various positioning techniques rely on DL, UL, or SL PRS, which may also use DL, UL, or SL non-PRS. For example, positioning techniques using reference signals include downlink-based positioning, uplink-based positioning, and combined downlink- and uplink-based positioning. For example, downlink-based positioning includes positioning methods such as DL-TDOA and DL-AoD. Uplink-based positioning includes positioning methods such as UL-TDOA and UL-AoA. Downlink- and uplink-based positioning includes positioning methods such as RTT with one or more neighboring base stations (multi-RTT). Other positioning methods exist, including methods that do not rely on PRS. For example, Enhanced Cell-ID (E-CID) is based on Radio Resource Management (RRM) measurements.

[0089]

[0094] Currently, positioning assistance data for PRS beams includes azimuth and elevation angles of each DL-PRS resource (beam), but does not provide any beamwidth information. Knowledge of the PRS beamwidth (as well as any other beam pattern information, such as sidelobe or backlobe information) may be used to assist in receiving DL PRS beams and may be used to enable the UE Rx antenna to adapt for UE power saving purposes. For example, if the PRS beam is a wide-angle beam, a UE receiver with a single antenna is more likely to achieve high quality positioning related measurements. Therefore, the UE may configure its receiver with a single Rx antenna (or fewer Rx antennas) to reduce power consumption.

[0090]

[0095] As explained above, several positioning approaches are supported in 3GPP. In Release 16, assistance data from the network, e.g., location server 172, to the UE 104 is provided within the NR Positioning Protocol (NRPP) in 3GPP 38.455 or the LTE Positioning Protocol (LPP) in 3GPP 37.355. There are several gNB-side angle estimation approaches for positioning. Downlink (DL) AoD based approaches use, for example, knowledge of the beam shapes of Positioning Reference Symbol (PRS) beams transmitted by different gNBs, together with knowledge of the received RSRP for these PRS at the UE to estimate the DL AoD. This estimation can be done on the network side, e.g., at the location server 172 in "UE-assisted" mode where the UE reports the measured RSRP. Alternatively, in a "UE-based" mode, the estimation may occur at the UE 104 being informed of the beam shape, including the AoD used with the PRS, e.g., in the assistance data, and the UE 104 determines the identity of the received DL beam from which the DL AoD can be determined and a position estimate may be generated. Currently, only the boresight direction of the beam is indicated in the assistance data.

[0091]

[0096] As another example, an uplink (UL) AoA based approach estimates the location of a UE 104 by a gNB or network, e.g., a location server 172, based on measurements of the UE's uplink transmissions (e.g., SRS) at the base station 102. The base station reports its estimated AoA to the location server 172, which may be reported in a global coordinate system (GCS) or a local coordinate system (LCS). Reporting may be different for azimuth and elevation angles.

[0092]

[0097] 6 illustrates a simplified environment 600 and an example technique for determining a position of a UE 104 using distances from multiple base stations 102-1, 102-2, 102-3 (which may be collectively referred to as base stations 102), for example. Although three base stations are shown in FIG. 6, aspects may utilize additional gNBs. The distances between the UE 104 and each of the base stations 102 may be determined using, for example, RSRP, RTT, or other suitable methods.

[0093]

[0098] An RTT measurement may be obtained, for example, by a first entity, e.g., either the UE 104 or the base station 102, sending an RTT measurement signal (or message) at time t0, which is received by another entity, e.g., either the base station 102 or the UE 104, at time t1. The time it takes for the RTT measurement signal from the first entity to reach the second entity is a propagation delay due to the distance between the entities. After some time (processing delay), the second entity sends an RTT response signal (or message) at time t2, which is received by the first entity at time t3. The time it takes for the RTT response signal from the second entity to reach the first entity is another propagation delay due to the distance between the entities. Ignoring factors such as timing advance (TA) that compensates for misalignment between transmit and receive timing, the RTT may be calculated as RTT=[t3-t0]-[t2-t1], which is approximately equal to twice the distance D between the entities divided by the signal propagation speed (speed of light). Thus, distances D1, D2, and D3 between the UE 104 and each of the base stations 102-1, 102-2, and 103-3, respectively, may be determined.

[0094]

[0099] The network geometry, e.g., the known geographic location of each of the base stations 102 in a reference coordinate system, may be used to determine the position of the UE 104. For a UE-based positioning procedure, the network geometry may be provided to the UE 104 in any manner, such as, for example, providing information in a beacon signal, providing information using a server, e.g., in positioning assistance data, providing information using a uniform resource identifier, etc.

[0095]

[0100] With the distances D1, D2, and D3 between the UE 104 and each respective gNB base station 102-1, 102-2, 102-3 determined using multi-RTT and the known base station positions, the position of the UE 104 can be resolved using various known geometric techniques, such as, for example, trilateration. For example, from FIG. 6, it can be seen that circles 651, 652, and 653 centered on the respective gNBs 102-1, 102-2, 102-3 have radii equal to the distances D1, D2, and D3. The position of the UE 104 is ideally at the common intersection of all of the circles 651, 652, and 653. Uncertainty in the base station 102 coordinates or distance measurements directly impacts the accuracy of the UE location estimate.

[0096]

[0101] 7, for example, illustrates another simplified environment 700 and an example technique for determining a position of a UE 104 using time difference of arrival (TDOA) techniques from multiple base stations 102-1, 102-2, 102-3 (which may be collectively referred to as base stations 102). Although three base stations are shown in FIG. 7, aspects may utilize additional gNBs.

[0097]

[0102] In the example of FIG. 7, the UE 104 may determine an estimate of the UE 104's location or may assist another entity (e.g., a base station or core network component, another UE, a location server, a third party application, etc.) to determine an estimate of the UE 104's location. The UE 104 may wirelessly communicate with multiple base stations 102-1, 102-2, and 102-3 (collectively, base stations 102), which may correspond to any combination of the base stations 102 in FIG. 1, using RF signals and standardized protocols for modulation of the RF signals and exchange of information packets. By extracting different types of information from the exchanged RF signals and utilizing the layout of the wireless communication system 700 (i.e., base station locations, geometry, etc.), the UE 104 may determine or assist in determining its location in a predefined reference coordinate system. In one aspect, the UE 104 may specify its location using a two-dimensional coordinate system. However, the aspects disclosed herein are not so limited and may also be applicable to determining a location using a three-dimensional coordinate system if additional dimensions are desired. Additionally, although FIG. 7 shows one UE 104 and three base stations 102, it will be appreciated that there may be many more UEs 104 and many or few base stations 102.

[0098]

[0103] To support position estimation, the base station 102 may be configured to broadcast reference RF signals (e.g., PRS, CRS, CSI-RS, synchronization signals, etc.) to the UE 104 within the coverage area of ​​the base station 102 to enable the UE 104 to measure characteristics of such reference RF signals. For example, the UE 104 may use a TDOA positioning method, which is a multilateration method, such that the UE measures in a conventional manner the time of arrival (TOA) of a particular reference RF signal (e.g., PRS, CRS, CSI-RS, etc.) transmitted by different pairs of network nodes (e.g., base station 102, antennas of base station 102, etc.). The TOAs from several neighboring base stations may be subtracted from the TOA from a reference base station to determine the RSTD for the base station pair.

[0099]

[0104] Generally, RSTD is measured between a reference network node and one or more neighboring network nodes. In the example shown in FIG. 7, base station 102-1 may be the serving base station of UE 104 and may also be the reference base station, while base stations 102-2 and 102-3 are neighboring base stations. The reference network node remains the same for all RSTDs measured by UE 104 for any single positioning application of TDOA, and typically corresponds to the serving cell for UE 104 or another nearby cell with good signal strength at UE 104. In an aspect, if the measured network node is a cell supported by a base station, the neighboring network node is typically a cell supported by a different base station than the base station for the reference cell, and the signal strength at UE 104 may be good or bad. RSTD may be the relative timing difference between two cells, for example, between a reference cell and a neighboring cell, which is determined based on the minimum time difference between two subframe boundaries from two different cells.

[0100]

[0105] RSTD is the time difference between a neighbor base station 102-i and a reference base station 102-1 as measured at the UE 104. The RSTD measurement may be defined as the time difference between the two base stations, modulo 1 subframe (1 ms), and therefore corresponds to the distance difference between the neighbor base station 102-i and the reference base station 102-1. At least two neighbor base station measurements i are required, but three or more are desirable, and the simultaneous equations can be solved with least squares or weighted least squares. The transmission time offset (Ti-T1) from the transmitting base station should be zero (ideally) in a synchronous network, or should be accounted for in an asynchronous network, so that RSTD defines the time difference of arrival (TDOA). Geometrically, each TDOA defines a hyperbola 702 and 704, and the width of the hyperbola is determined by the TDOA error (ni-n1) or uncertainty, as shown by the dotted lines in FIG. 7. The position of the UE 104 can be determined if the coordinates of the base station 102 are known and the transmission time offset (Ti-T1) is known at the location server 172 (e.g., LMF 270) or at the UE 104. Uncertainties in the coordinates of the base station 102 or in the TDOA measurements directly impact the accuracy of the UE location estimate.

[0101]

[0106] FIG. 8A illustrates another simplified environment 800 and an example technique for determining the position of a UE 104 using a DL AoA or DL ​​AoD of a beam 802. FIG. 8A illustrates an AoA or AoD measurement of a signal 402 as including an uncertainty 803. In the example of FIG. 8A, a base station 102 (e.g., any of the base stations described herein) transmits a DL reference signal, such as a PRS, to a UE 104. The base station 102 transmits the signal on several transmit beams using a directional antenna, and the signal is received by the UE 104. The UE 104 may measure the angle of arrival AoA of the signal 82 using a directional antenna, which may generate several receive beams. For example, each of the receive beams will result in a different received signal strength (e.g., RSRP, RSRQ, SINR, etc.) of one or more reference signals at the UE 104. Furthermore, the channel impulse response of one or more reference signals will be smaller for receive beams that are farther from the actual LOS path between the base station 102 and the UE 104 than for receive beams that are closer to the LOS path. Similarly, the received signal strength will be lower for a receive beam farther from the LOS path than for a receive beam closer to the LOS path. Thus, the UE 104 identifies the receive beam that results in the highest received signal strength and strongest channel impulse response, and estimates the angle from itself to the base station 102 as the AoA of that receive beam 802. For example, a receive antenna in the UE 104 has a known relationship to a coordinate system of the UE 104, and the UE 104 can use sensors such as magnetometers, accelerometers, gyroscopes, cameras, etc. to measure its relationship to a coordinate system, e.g., a global coordinate system (GCS) or a local coordinate system (LCS), so that the angle of arrival for the receive antenna in the UE 104 can be converted to the GCS or LCS.

[0102]

[0107] Additionally or alternatively, the AoD may be determined by the UE 104 identifying the transmit beam received with the highest received signal strength and strongest channel impulse response. The AoD of each transmit beam from the base station 102 for the GCS or LCS is known and may be provided to the UE 104, for example, in assistance data for UE-based positioning or to a location server for UE-assisted positioning. Thus, the AoD of the reference signal received by the UE 104 may be determined.

[0103]

[0108] The UE 104 may also estimate the distance D between itself and the base station 102, for example, by performing an RTT positioning procedure or RSRP with the base station 102, or a timing advance measurement. The timing advance is typically the RTT between the base station and the UE, or twice the propagation time in one direction, and therefore may be used to estimate the distance between the base station 802 and the UE 804, just like in a real RTT procedure.

[0104]

[0109] Based on the angle between the base station 102 and the UE 104 (based on AoA or AoD), knowledge of the distance D from the UE 104 to the base station 102, and the known geographic location of the base station 102, the location of the UE 104 can be estimated.

[0105]

[0110] 8B illustrates another simplified environment 850 and base stations 102-1 and 102-2 performing AoA or AoD position determination. The AoA or AoD of each signal 851 and 852 may be determined as described in FIG. 8A. As shown, the AoA measurements 851 or AoD measurements 852 determined by each UE 104 intersect at the location of the UE 104. Thus, the location of the UE 104 may be determined based on the AoA or AoD measurements without the need for distance measurements.

[0106]

[0111] Generally, wireless communication systems are vulnerable to various threats. In some cases, especially when wireless information and / or location-based services are provided in public forums (e.g., shopping malls, office buildings, etc.), potential security risks may arise given the possibility that malicious entities may exploit the network to gain unauthorized access to sensitive information. Such security risks may include "man-in-the-middle," "spoofing," and / or "phishing" type cyber attacks. Such attacks may be based on malicious entities successfully impersonating legitimate entities by manipulating network protocols, forging authentication information, and / or compromising network integrity to deceive users and obtain fraudulent benefits.

[0107]

[0112] UEs may be used, for example, to relay data to other UEs in sidelink channels and for coverage extension applications. However, relaying data between UEs raises concerns about man-in-the-middle and replay attacks. Such attacks may occur, for example, when the physical layer is used for authentication of transmissions. For example, for measurements of downlink reference signals over time, such as positioning measurements or channel parameter measurements, using channel characteristics and prediction techniques, the UE may use the physical layer to determine whether a received downlink transmission is most likely from a genuine transmitter.

[0108]

[0113] 9A illustrates an environment 900 in which, for example, a replay attack or a man-in-the-middle attack may be performed by an attacking device 912. As shown, a base station 102 and a UE 104 may be engaged in wireless communications in which a DL signal 902 is transmitted by the base station 102 and received by the UE 104. The UE 104 may respond to the base station 102 with a UL signal 904.

[0109]

[0114] At some time during the wireless communication, the attacking device 912 may receive DL signals 914 from the base station 102 and may relay these signals 914 to the UE 104. The attacking device 912 may, for example, relay the DL signals 914 in a manner such that the UE 104 is unaware that the DL signals 914 are being relayed from the attacking device 912 and not directly from the base station 102. The attacking device 912 may decode the intercepted DL signals 914. As a result, the DL signals 914 destined for the UE 104 are intercepted by the attacking device 912 and relayed to the UE 104 such that neither the base station 102 nor the UE 104 is aware that the attacking device 912 is intercepting wireless communications destined for the UE 104.

[0110]

[0115] In one implementation, the integrity and authentication of the connection between the UE 104 and the base station 102 may be maintained based on a comparison of predicted values ​​for one or more physical layer measurements with actual values ​​of one or more physical layer measurements, from which the presence of an unauthorized intervening entity may be detected. For example, the physical layer measurements may be positioning measurements of a downlink reference signal, such as RSRP, Rx-Tx, TOA, RTT, AoD, AoA, etc., as well as speed, direction of movement, or channel parameters. The predicted values ​​of one or more positioning measurements of the downlink reference signal may be based, for example, on one or more previous positioning measurements of the downlink reference signal received from the base station 102 to which the UE 104 is connected. By comparing the predicted positioning measurements based on previous measurements with the current positioning measurements, it is possible to determine whether transmissions originate from the same base station over time. The UE 104 may report to the base station or server when the UE 104 determines that an intervening entity may be present in the communication channel, or may provide periodic reports, for example, indicating whether an intervening entity has been detected.

[0111]

[0116] FIG. 9B is a graph 950 showing, as an example, several expected positioning measurements 960 and current positioning measurements 970 that may be compared to identify the presence of the attacking device 912 in FIG. 9A. The expected positioning measurements 960 are generated based on several previous positioning measurements provided by the base station 102 or the location server 172 and performed by the UE 104. The expected positioning measurements are periodically sent to the UE 104 as shown in FIG. 9B by expected positioning measurements sent at times t2, t3, t4, t5. The downlink reference signal measured by the UE 104 and compared to the expected positioning measurements is sent by the base station within a limited period of time from the transmission of the expected positioning measurements so that the expected and actual positioning measurements are correlated. For example, immediately after the expected positioning measurements are sent at time t2, the base station 102 should transmit a downlink reference signal measured by the UE 104 and perform a positioning measurement, which is shown in FIG. 9B as being aligned with time t2.

[0112]

[0117] For the comparison to be valid, the downlink reference signal measured by the UE 104 should be transmitted close in time to the transmission of the expected positioning measurement. The longer the period between the expected positioning measurement and the transmission of the downlink reference signal, the larger the error that may occur between the expected positioning measurement and the actual positioning measurement. In some implementations, the allowable error may be provided along with the expected positioning measurement. In some implementations, the allowable error may be dynamic and may change based on the amount of time between the receipt (or transmission) of the expected positioning measurement and the receipt (or transmission) of the downlink reference signal that is measured for the actual positioning measurement, e.g., an increase in the amount of time corresponds to an increase in the allowable error.

[0113]

[0118] 9B, the predicted positioning measurements 960 and the actual positioning measurements 970, shown simply as bars, may be for RSRP values, RSTD values ​​and / or uncertainties, AoA values ​​and / or uncertainties, AoD values ​​and / or uncertainties, RTTs, etc. Each predicted positioning measurement 960 may be generated based on multiple previous positioning measurements, e.g., three or more, reported by the UE 104, e.g., after using higher layer initial authentication to authenticate a connection between the UE 104 and the base station 102. For example, as shown by the dots, the UE 104 may obtain positioning measurements 970 over a period of time (including time t1), which may be provided to the base station 102 or the location server 172. The base station 102 or the location server 172 may use the previous positioning measurements to generate a predicted positioning measurement for a future time, e.g., time t2. The predicted positioning measurement may be determined as an average (or other statistical combination) of the previous positioning measurements. In some implementations, a weighted average may be used, for example with more recent measurements having a greater weight than less recent measurements.

[0114]

[0119] As shown in FIG 9B, the expected positioning measurements 960 at times t2 and t3 are approximate to the actual positioning measurements 970 at the corresponding times. For example, referring to FIG 9A, since the expected positioning measurements 960 at times t2 and t3 are approximate to the actual positioning measurements 970 at the corresponding times, it may be determined that the UE 104 received a downlink reference signal directly from the base station 102, e.g., from the DL signal 902, at times t2 and t3. For example, if the UE 104 is moving, there may be changes in the relative position between the UE 104 and the base station 102, but by using multiple previous positioning measurements from the UE 104 to generate the expected positioning measurements 960 at each time t1, t2, and t3, the change in position over time may be included in the expected positioning measurements 960.

[0115]

[0120] 9B, the expected positioning measurement 960 at time t4 is approximately the same as the expected positioning measurement 960 at time t3, but the actual positioning measurement 970 has increased significantly. The difference between the expected positioning measurement 960 at time t4 and the actual positioning measurement 970 at time t4 may be greater than a predetermined threshold, e.g., an acceptable error provided with the expected positioning measurement 960 and / or an acceptable error determined by the UE 104 based on the amount of time between receipt of the expected positioning measurement 960 and receipt of the downlink reference signal. Thus, a comparison of the expected positioning measurement 960 at time t4 and the actual positioning measurement 970 for the corresponding time may indicate that the downlink reference signal transmitted at (or shortly thereafter) time t4 is not from the same entity that transmitted the downlink reference signal at an earlier time, e.g., time t1, t2, or t3. For example, referring again to FIG. 9A , a discrepancy between the expected positioning measurement 960 at time t4 and the actual positioning measurement 970 for the corresponding time may indicate that the actual positioning measurement 970 was measured from a reference signal from the attacking device 912, e.g., signal 914 from the attacking device 912.

[0116]

[0121] If the actual positioning measurements are outside of expected values, e.g., by more than an acceptable error, the UE 104 may report an indication that an attacking device may be present in the communication channel between the UE 104 and the base station 102. For example, the UE 104 may report a "warning flag" indicating that an intervening entity may be present. Additionally or alternatively, the UE 104 may report actual positioning measurements that the base station 102 or the location server 172 may use to determine or verify that an attacking device is present. The UE 104 may report actual positioning measurements, for example, even if the UE 104 is performing UE-based positioning measurements.

[0117]

[0122] Thus, in some implementations, referring to FIG. 9A , one or more predicted values ​​of the DL PRS RSRP (e.g., predicted RSRP) may be provided to the UE 104 to determine whether a new measurement of the resource RSRP is within an acceptable error, indicate whether the DL transmission is from an authenticated base station 102, and indicate that the DL transmission is from an attacking device 912.

[0118]

[0123] In some implementations, a set of expected RSTD values ​​and / or expected RSTD uncertainties may be provided to the UE 104, i.e., in addition to the expected RSTD values ​​and uncertainties provided in the positioning assistance data as an RSTD search window during a positioning session. In some implementations, an extended RSTD search window may be provided to the UE 104, such that when the UE 104 measures RSTD, if the measurement value is outside the extension of the RSTD search window or outside the expected RSTD value and uncertainty, the UE 104 may determine that an attacking device is present and may send a corresponding report indicating the presence of the attacking device, e.g., as a "warning flag" or a measured RSTD value, even if the UE 104 is in a UE-based positioning mode.

[0119]

[0124] In some implementations, the expected AoD and / or the expected AoD uncertainty for the zenith or azimuth angles, along with a margin of error in some implementations, may be provided (e.g., as assistance data) to the UE 104. If the measured AoD is outside these bounds, the UE 104 may determine that an attacking device is present and may send a corresponding report indicating the presence of the attacking device to the base station 102 or the location server 172, e.g., as a "warning flag."

[0120]

[0125] In some implementations, the expected TOA and / or RTT values, in some implementations along with a margin of error, may be provided to the UE 104. If the measured TOA or RTT values ​​are outside these ranges, the UE 104 may determine that an attacking device is present and may send a corresponding report indicating the presence of the attacking device to the base station 102 or the location server 172, for example as a "warning flag."

[0121]

[0126] Further, in some implementations, expected or predicted speed, direction, and / or channel parameters may be provided to the UE 104. The channel parameters may be used to predict certain channel coefficients that may be used to indicate, for example, whether the current channel after a time offset from a previous transmission corresponds to the channel estimated from the previous transmission. A mismatch between the predicted and measured channel coefficients may be used to indicate the presence of an attacking device. Similarly, a mismatch in the predicted and actual speed or direction of movement of the UE 104 may be used to indicate the presence of an attacking device, which may then be reported.

[0122]

[0127] FIG. 10 shows an example 1000 of predicted measurements received for positioning measurements and predicted measurements for security, as an example. The predicted measurements for positioning measurements are shown as expected RSTD search windows 1002 that may be received in the positioning assistance data, and the predicted measurements for security are shown as security RSTD search windows 1004. The UE 104 may receive a security RSTD search window 1004 in addition to the positioning RSTD search window 1002. An additional security RSTD search window 1004 may be defined for the positioning RSTD search window 1002 for each PRS pair. The security RSTD search window 1004 may be larger than the positioning RSTD search window 1002, for example, extending 1 μs from either side. The security RSTD search window 1004 may be defined based on the center of the positioning RSTD search window 1002 or as an extension 1006 that defines the security RSTD search window 1004 when combined with the positioning RSTD search window 1002. Similar windows may be used for TOA, AOD, and velocity measurements.

[0123]

[0128] Similarly, the location server 172 may provide the base station 102 (e.g., serving base station and / or neighboring base station) through NRPPa signaling with expected or predicted physical layer measurements (e.g., UL-AoA, RTOA) that the base station is performing. If the base station 102 performs measurements that are outside of a configured window, the base station 102 may provide an indication to the location server 172 and / or the UE 104, such as a "warning" message or report of the measurements.

[0124]

[0129] The number of predictions for the positioning measurements may be an LPP / RRC / MAC-CE / DCI configuration parameter that is configured as part of the reporting configuration. Additionally, a timestamp, or simply the time used for the prediction given the current measurement, may be provided to the UE 104 through LPP / RRC / MAC-CE signaling and may be used by the UE 104 to determine if the predicted positioning measurements correlate well with the current positioning measurements and / or to adjust the allowable error for comparison of the predicted positioning measurements with the actual positioning measurements.

[0125]

[0130] 11 is a message flow 1100 illustrating messaging in a wireless network to authenticate a connection between a UE and a base station and to identify the presence of an intervening device between the UE and the base station that may be conducting an active attack, such as a man-in-the-middle or replay attack. The message flow 1100 illustrates signaling between, for example, a UE 104, a base station 102, and a location server 172 as described herein. Although messages related to detecting an attacking device 912 are shown, it should be understood that additional messages, including conventional messages, may be used in the message flow 1100.

[0126]

[0131] In stage 1102, the base station 102 may send a reference signal, such as a PRS signal, to the UE 104 after higher layer initial authentication is performed. It should be understood that the reference signal is not limited to a PRS, but may be other types of reference signals, such as a CRS, a PSS, a SSS, etc.

[0127]

[0132] At stage 1103, the UE 104 may perform one or more measurements on the received reference signals, such as RSRP, RSTD, TOA, AoA, RTT, etc. Other measurements may include speed, direction of movement, or channel parameters. It should be understood that some measurements may require additional signaling not shown in FIG. 11, such as a PRS signal sent from the second base station for RSTD measurements, or a UL signal sent from the UE 104 to the base station 102 for RTT measurements.

[0128]

[0133] At stage 1104, the measurements generated at stage 1103 may be sent to the base station 102, which in some implementations may send the measurements to the location server 172.

[0129]

[0134] As indicated by steps 1106, 1107, and 1108, the process of receiving a reference signal, performing one or more positioning measurements on the reference signal, and sending the measurements to base station 102 and / or location server 172 may be performed multiple times.

[0130]

[0135] In step 1110, the location server 172 may generate a predicted measurement for the UE 104 for a reference signal transmitted by the base station 102, for example, based on multiple measurements received from the UE 104 in steps 1104 and 1108. The predicted measurement may be generated based on multiple previous positioning measurements, for example, based on an average (or other statistical combination) of the previous positioning measurements. In some implementations, a weighted average may be used, for example, with more recent measurements having a greater weight than less recent measurements. In some implementations, the predicted measurement 1110 may be generated at the base station 102 instead of the location server 172. The predicted measurement may include an uncertainty or a tolerable error.

[0131]

[0136] At stage 1112, the location server 172 (or base station 102) may send the predicted measurements to the UE 104. A timestamp may be provided along with the predicted measurements. It should be appreciated that the predicted measurements sent to the UE 104 are for security purposes as opposed to positioning measurements, and therefore may be sent in addition to predicted values ​​sent in positioning assistance data during a positioning session, as described in FIG.

[0132]

[0137] At stage 1114, the base station 102 may send another reference signal, such as, for example, a PRS signal, to the UE 104. The reference signal sent at stage 1114 should be transmitted close in time to the predicted measurements received at stage 1112, for example, so that the predicted measurements correlate to measurements performed on the reference signal at stage 1114.

[0133]

[0138] In step 1115, the UE 104 may perform one or more measurements on the received reference signal, such as RSRP, RSTD, TOA, AoA, RTT, speed, direction of movement, channel parameters, etc., similar to step 1103.

[0134]

[0139] In stage 1116, the UE 104 may compare the predicted measurement to the actual measurement obtained in stage 1115. For example, the UE 104 may compare the predicted measurement to the actual measurement and determine whether the actual measurement is within a predetermined threshold relative to the predicted measurement. The predetermined threshold may be, for example, an uncertainty or a tolerable error that may be received with the predicted measurement in stage 1116. In some implementations, the tolerable error may be based at least in part on the time elapsed between the predicted measurement (e.g., a timestamp included in the predicted measurement) and receipt of the reference signal in stage 114. Assuming the predicted measurement and the actual measurement match within the predetermined threshold, the reference signal transmitted in stage 1114 may be authenticated and considered to be from the base station 102.

[0135]

[0140] At stage 1118, the measurements generated at stage 1115 may be sent to the base station 102, which in some implementations may send the measurements to the location server 172.

[0136]

[0141] In stage 1120, the location server 172 may generate a predicted measurement value for the UE 104 for a reference signal transmitted by the base station 102, similar to stage 1110, for example, based on multiple measurement values ​​received from the UE 104 in stages 1104, 1108, and 1118.

[0137]

[0142] At stage 1122, the location server 172 (or base station 102) may send the predicted measurements to the UE 104. A timestamp may be provided along with the predicted measurements.

[0138]

[0143] At stage 1124, a reference signal, such as, for example, a PRS signal, is sent by the aggressor device 912 to the UE 104. The reference signal may be received, for example, by the aggressor device 912 from the base station 102 and forwarded to the UE 104.

[0139]

[0144] In step 1125, the UE 104 may perform one or more measurements on the received reference signals, such as RSRP, RSTD, TOA, AoA, RTT, etc., similar to step 1103.

[0140]

[0145] In step 1126, the UE 104 may compare the predicted measurements with the actual measurements obtained in step 1125, similar to step 1116. Because the reference signal received in step 1124 is from an entity different from the base station 102, the predicted measurements received in step 1122 (based on measurements of the reference signal from the base station 102) will not approximate the actual measurements of the reference signal received from the attacking device 912 in step 1124. For example, the attacking device 912 is not located at exactly the same location as the base station 102, and thus the positioning measurements for the signal sent by the attacking device 912 will differ from the predicted positioning measurements for the signal transmitted by the base station 102. Furthermore, the difference in location between the attacking device 912 and the base station 102 will be perceived by the UE 104 as a sudden change in speed (e.g., the UE 104 will appear to move an increased distance over time), and the direction of movement may be different, and thus the speed or direction of movement will differ from the predicted speed or direction of movement. Furthermore, because the aggressor device 912 is different, the channel parameters, such as the channel coefficients, for the aggressor device 912 will differ from those predicted for the base station 102. Thus, a comparison of the predicted measurements and the actual measurements will not match within a predefined threshold, indicating that the reference signal received in stage 1124 is not from the base station 102 and therefore cannot be authenticated.

[0141]

[0146] At stage 1128, the UE 104 may transmit an indication of the detected attack, such as a warning flag and / or measurements, to the base station 102 and / or the location server 172.

[0142]

[0147] FIG. 12 illustrates a schematic block diagram illustrating some example features of a UE 1200, which may be the UE 104 of FIG. 1 and configured to support authentication of a connection with a base station and identification of the presence of an intervening device between the UE and the base station as described herein. The UE 1200 may execute the message flow illustrated in FIG. 11 and the process flow 1400 illustrated in FIG. 14 and supporting algorithms described herein. The UE 1200 may include one or more processors 1202, memory 1204, an external interface such as at least one wireless transceiver (e.g., wireless network interface), illustrated as a WWAN transceiver 1210 and a WLAN transceiver 1212, a satellite positioning system (SPS) receiver 1215, and one or more sensors 1213, which may be operatively coupled to a non-transitory computer-readable medium 1220 and memory 1204 with one or more connections 1206 (e.g., buses, wires, fibers, links, etc.). The SPS receiver 1215 may receive and process SPS signals, for example, from a satellite vehicle (SV). The one or more sensors 1213 may be, for example, an inertial measurement unit (IMU), which may include one or more accelerometers, one or more gyroscopes, magnetometers, etc. The UE 1200 may further include additional items not shown, such as a user interface, which may include a display, a keypad, or other input devices, such as a virtual keypad on a display, through which a user may interface with the UE. In some example implementations, all or a portion of the UE 1200 may be in the form of a chipset or the like.

[0143]

[0148] The UE 1200 may include at least one transceiver, such as a transceiver 1210 for a WWAN communication system and a transceiver 1212 for a WLAN communication system, or a combined transceiver for both WWAN and WLAN. The WWAN transceiver 1210 may include a transmitter 1210t and a receiver 1210r coupled to one or more antennas 1211 to transmit (e.g., on one or more uplink channels and / or one or more sidelink channels) and / or receive (e.g., on one or more downlink channels and / or one or more sidelink channels) wireless signals and convert signals from wireless signals to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to wireless signals. The WLAN transceiver 1212 may include a transmitter 1212t and a receiver 1212r coupled to one or more antennas 1211 or separate antennas to transmit (e.g., on one or more uplink channels and / or one or more sidelink channels) and / or receive (e.g., on one or more downlink channels and / or one or more sidelink channels) wireless signals and convert signals from wireless to wired (e.g., electrical and / or optical) signals and from wired (e.g., electrical and / or optical) signals to wireless signals. The transmitters 1210t and 1212t may include multiple transmitters, which may be separate components or combined / integrated components, and / or the receivers 1210r and 1212r may include multiple receivers, which may be separate components or combined / integrated components. The WWAN transceiver 1210 may be configured to communicate signals (e.g., with base stations and / or one or more other devices) in accordance with various radio access technologies (RATs), such as 12G New Radio (NR), Global System for Mobile (GSM), Universal Mobile Telecommunications System (UMTS), Advanced Mobile Phone System (AMPS), Code Division Multiple Access (CDMA), WCDMA (Wideband CDMA), Long Term Evolution (LTE), LTE Direct (LTE-D), 3GPP LTE-V2X (PC5), and the like.New Radio (NR) may use mm-wave and / or sub-6 GHz frequencies. The WLAN transceiver 1212 may be configured to communicate signals (e.g., with an access point and / or one or more other devices) according to various radio access technologies (RATs), such as 3GPP LTE-V2X (PC5), IEEE 1202.11 (including IEEE 1202.11p), WiFi, WiFi Direct (WiFi-D), Bluetooth, Zigbee, etc. The transceivers 1210 and 1212 may be communicatively coupled to a transceiver interface, e.g., by optical and / or electrical connections, which may be at least partially integrated with the transceivers 1210 and 1212.

[0144]

[0149] In some embodiments, the UE 1200 may include an antenna 1211, which may be an internal or external antenna. The UE antenna 1211 may be used to transmit and / or receive signals processed by the wireless transceivers 1210 and 1212. The antenna 1211 may include an antenna array that may be capable of receiving beamforming, for example, by increasing the gain setting and / or adjusting the phase setting of the array of antennas in a particular direction to amplify (e.g., increase the gain level of) the RF signal received from that direction. The antenna 1211 may further include multiple antenna panels, each capable of beamforming. The antenna 1211 may be capable of adapting, e.g., selecting, one or more antennas to control the reception of a transmitted beam from a base station. For example, to reduce power consumption, for example, fewer beams or a single beam may be selected for reception of a wide angle beam, while a larger number of antennas in the antenna array may be selected when the transmit beam is relatively narrow. In some embodiments, the UE antenna 1211 may be coupled to the wireless transceivers 1210 and 1212. In some embodiments, measurements of signals received (transmitted) by the UE 1200 may be performed at the connection point between the UE antenna 1211 and the wireless transceivers 1210 and 1212. For example, the reference measurement points for received (transmitted) RF signal measurements may be the input (output) terminal of the receiver 1210r (transmitter 1210t) and the output (input) terminal of the UE antenna 1211. In a UE 1200 with multiple UE antennas 1211 or antenna arrays, the antenna connectors may be viewed as being virtual points representing the aggregate outputs (inputs) of the multiple UE antennas. In some embodiments, the UE 1200 may measure received signals including signal strength and TOA measurements, and the angle-related measurements and raw measurements of the DL PRS and / or SL PRS may be processed by one or more processors 1202.

[0145]

[0150] The one or more processors 1202 may be implemented using a combination of hardware, firmware, and software. For example, the one or more processors 1202 may be configured to perform functions described herein by implementing one or more instructions or program code 1208 on a non-transitory computer-readable medium, such as the medium 1220 and / or the memory 1204. In some embodiments, the one or more processors 1202 may represent one or more circuits configurable to perform at least a portion of a data signal computation procedure or process associated with the operation of the UE 1200.

[0146]

[0151] The medium 1220 and / or memory 1204 may store instructions or program code 1208 including executable code or software instructions that, when executed by the one or more processors 1202, cause the one or more processors 1202 to operate as a special purpose computer programmed to perform the techniques described herein. As shown in the UE 1200, the medium 1220 and / or memory 1204 may include one or more components or modules that may be implemented by the one or more processors 1202 to perform the methods described herein. Although the components or modules are shown as software in the medium 1220 executable by the one or more processors 1202, it should be understood that the components or modules may be stored in the memory 1204 or may be dedicated hardware either within the one or more processors 1202 or external to the processor.

[0147]

[0152] A number of software modules and data tables may be present in the medium 1220 and / or memory 1204 and utilized by the one or more processors 1202 to manage both the communications and functionality described herein. It should be appreciated that the organization of the contents of the medium 1220 and / or memory 1204 as shown in the UE 1200 is merely exemplary, and that the functionality of the modules and / or data structures may be combined, separated, and / or structured in various ways depending on the implementation of the UE 1200.

[0148]

[0153] The medium 1220 and / or the memory 1204 may include a predictor module 1222 that, when implemented by the one or more processors 1202, configures the one or more processors 1202 to receive, via the wireless transceiver 1210, one or more predicted values ​​for one or more measurements of a downlink reference signal based on a measurement of a previous downlink reference signal received from a base station. The predicted values ​​for the one or more measurements may include, for example, a security set of predicted values ​​for the one or more measurements for determining whether an attacking device transmitted the received downlink reference signal, and an assistance data set of predicted values ​​for the one or more measurements for determining, used to perform the one or more measurements of the received downlink reference signal. The predicted values ​​may be predicted positioning measurements, such as one or more predicted RSRP values, RSTD values, predicted RSTD uncertainty, or combinations thereof, predicted AoA values, predicted AoA uncertainty, or combinations thereof, predicted RTT values, etc. The predicted values ​​may be at least one of one or more predicted channel coefficients, speeds, directions, or combinations thereof for a pair of Tx-Rx antennas or Tx-Rx antenna ports. The one or more processors 1202 may be further configured to receive, via the wireless transceiver 1210, one or more timestamps associated with predicted values ​​for the one or more measurements of the downlink reference signal.

[0149]

[0154] The medium 1220 and / or the memory 1204 may include a reference signal module 1224 that, when implemented by the one or more processors 1202, configures the one or more processors 1202 to receive a downlink reference signal, such as a PRS, via the wireless transceiver 1210. The downlink reference signal may be received from an authorized base station, such as base station 102, or may be received from an intervening device, such as the aggressor device 912.

[0150]

[0155] The medium 1220 and / or the memory 1204 may include a measurement module 1226 that, when implemented by the one or more processors 1202, configures the one or more processors 1202 to measure received downlink reference signals. For example, the one or more processors 1202 may be configured to perform measurements of positioning measurements RSRP, RSTD, AOA, RTT, etc., as well as channel coefficients, velocity, direction of movement, or combinations thereof.

[0151]

[0156] The medium 1220 and / or the memory 1204 may include a comparison module 1228 that, when implemented by the one or more processors 1202, configures the one or more processors 1202 to determine whether an aggressor device transmitted a received downlink reference signal based on one or more predicted values ​​for one or more measurements of the downlink reference signal and one or more measurements of the current downlink reference signal, for example, by comparing a measurement value for a current downlink reference signal with a predicted value for the downlink reference signal. The one or more processors 1202 may be configured to determine whether a difference between the predicted measurement value and the actual measurement value is within an acceptable error, which may be provided to the UE along with the predicted value or may be determined by the one or more processors 1202 based on a timestamp associated with the predicted value and a time of receiving the current downlink reference signal. The one or more processors 1202 may be configured to compare predicted values ​​and actual values ​​for positioning measurements, such as RSRP, RSTD, AOA, RTT, etc., as well as channel coefficients, speed, direction of movement, or a combination thereof.

[0152]

[0157] The medium 1220 and / or the memory 1204 may include a reporting module 1230 that, when implemented by the one or more processors 1202, configures the one or more processors 1202 to send a report indicating the presence of the aggressor device in a connection between the UE and the base station via the transceiver 1210 to the base station if the received downlink reference signal is determined to be transmitted by an aggressor device. The UE may send the report to one of the base station or a location server, for example.

[0153]

[0158] The methods described herein may be performed by various means depending on the application. For example, the methods may be performed in hardware, firmware, software, or any combination thereof. In a hardware implementation, the one or more processors 1202 may be implemented with one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, electronic devices, other electronic units designed to perform the functions described herein, or combinations thereof.

[0154]

[0159] For a firmware and / or software implementation, the methods may be implemented with modules (e.g., procedures, functions, and so on) that perform the functions described herein. Any machine-readable medium tangibly embodying instructions may be used in implementing the methods described herein. For example, software code may be stored in non-transitory computer-readable medium 1220 or memory 1204 coupled to and executed by one or more processors 1202. The memory may be implemented within the one or more processors or external to the one or more processors. The term "memory" as used herein refers to any type of long-term memory, short-term memory, volatile memory, non-volatile memory, or other memory, and should not be limited to any particular type of memory or any particular number of memories, nor should it be limited to any particular type of medium on which the memory is stored.

[0155]

[0160] If implemented in firmware and / or software, the functions may be stored as one or more instructions or program code 1208 on a non-transitory computer readable medium, such as the medium 1220 and / or the memory 1204. Examples include computer readable media encoded with data structures and computer readable media encoded with a computer program 1208. For example, a non-transitory computer readable medium having stored thereon program code 1208 may include program code 1208 for supporting authentication of a connection between a UE and a base station and identification of the presence of an intervening device between the UE and the base station, as described herein in a manner consistent with the disclosed embodiments. The non-transitory computer readable medium 1220 includes physical computer storage media. A storage medium may be any available medium that can be accessed by a computer. By way of example and not limitation, such non-transitory computer readable media may include RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired program code 1208 in the form of instructions or data structures and that can be accessed by a computer. As used herein, disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and blue-ray disc, where disks typically reproduce data magnetically and discs reproduce data optically using lasers. Combinations of the above should also be included within the scope of computer readable media.

[0156]

[0161] In addition to being stored on the computer-readable medium 1220, the instructions and / or data may be provided as signals on a transmission medium contained within a communications device. For example, a communications device may include a wireless transceiver 1210 having signals indicative of the instructions and data. The instructions and data are configured to cause one or more processors to implement the functions outlined in the claims. That is, the communications device includes a transmission medium with signals indicative of information to perform the disclosed functions.

[0157]

[0162] Memory 1204 may represent any data storage mechanism. Memory 1204 may include, for example, primary memory and / or secondary memory. Primary memory may include, for example, random access memory, read-only memory, etc. Although shown in this example as separate from one or more processors 1202, it should be understood that all or a portion of the primary memory may be provided within one or more processors 1202 or may be otherwise co-located / coupled thereto. Secondary memory may include, for example, the same or similar type of memory as the primary memory, and / or one or more data storage devices or systems, such as, for example, disk drives, optical disk drives, tape drives, solid-state memory drives, etc.

[0158]

[0163] In some implementations, the secondary memory may operatively receive or otherwise be configurable to couple to the non-transitory computer readable medium 1220. Thus, in some example implementations, the methods and / or apparatuses presented herein may take the form, in whole or in part, of a computer readable medium 1220 on which computer implementable code 1208 may be stored, which when executed by one or more processors 1202 may be effectively enabled to perform all or a portion of the example operations as described herein. The computer readable medium 1220 may be part of the memory 1204.

[0159]

[0164] Figure 13 illustrates a schematic block diagram illustrating some example features of a network entity 1300, e.g., base station 102 or location server 172, shown in Figure 1, configured to support authentication of a connection between a UE and a base station and identification of the presence of an intervening device between the UE and the base station, e.g., as described herein. Network entity 1300 may perform the signaling flow shown in Figure 11, the process flow 1500 shown in Figure 15, and algorithms described herein. The network entity 1300 may include, for example, one or more processors 1302, a memory 1304, and an external interface 1310 (e.g., a wireline or wireless network interface to a base station and / or entities in the core network if the network entity 1300 is a location server or wireless transceiver for communication to UEs, and a wireline or wireless network interface to a location server and / or other entities in the core network if the network entity 1300 is a base station) that may be operatively coupled to a non-transitory computer-readable medium 1320 and one or more connections 1306 (e.g., a bus, a line, a fiber, a link, etc.) to the memory 1304. In some example implementations, all or a portion of the network entity 1300 may take the form of a chipset or the like.

[0160]

[0165] The one or more processors 1302 may be implemented using a combination of hardware, firmware, and software. For example, the one or more processors 1302 may be configured to perform functions described herein by implementing one or more instructions or program code 1308 on a non-transitory computer-readable medium, such as the medium 1320 and / or the memory 1304. In some embodiments, the one or more processors 1302 may represent one or more circuits configurable to perform at least a portion of a data signal computation procedure or process related to the operation of the network entity 1300.

[0161]

[0166] The medium 1320 and / or memory 1304 may store instructions or program code 1308 including executable code or software instructions that, when executed by the one or more processors 1302, cause the one or more processors 1302 to operate as a special purpose computer programmed to perform the techniques disclosed herein. As shown in the network entity 1300, the medium 1320 and / or memory 1304 may include one or more components or modules that may be implemented by the one or more processors 1302 to perform the methods described herein. Although the components or modules are shown as software in the medium 1320 executable by the one or more processors 1302, it should be understood that the components or modules may be stored in the memory 1304 or may be dedicated hardware either within the one or more processors 1302 or external to the processor.

[0162]

[0167] A number of software modules and data tables may be present in the medium 1320 and / or memory 1304 and utilized by the one or more processors 1302 to manage both the communications and functions described herein. It should be appreciated that the organization of the contents of the medium 1320 and / or memory 1304 as shown in the network entity 1300 is only an example, and thus the functionality of the modules and / or data structures may be combined, separated, and / or structured in different ways depending on the implementation of the network entity 1300.

[0163]

[0168] The medium 1320 and / or the memory 1304 may include a predictor module 1322 that, when implemented by the one or more processors 1302, configures the one or more processors 1302 to obtain one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from a base station. For example, the one or more predicted values ​​may include a security set of predicted values ​​for the one or more measurements for determining whether an aggressor device transmitted the received downlink reference signal and an assistance data set of predicted values ​​for the one or more measurements for determining used to perform the one or more measurements of the received downlink reference signal. The one or more processors 1302 may be configured to generate the one or more predicted values ​​based on a plurality of measurements received from the UE, for example, based on an average, weighted average, or other statistical combination of the measurements. In other implementations, the one or more processors 1302 may be configured to receive the predicted values ​​from another entity, such as a location server, when the network entity 1300 is a base station. The one or more processors 1302 may be configured to send one or more predicted values ​​for one or more measurements of the downlink reference signal to the UE via the external interface. The one or more processors 1302 may be configured to update the one or more predicted values ​​based on additional measurements received from the UE. The predicted values ​​may be predicted positioning measurements, such as one or more predicted RSRP values, RSTD values, predicted RSTD uncertainty, or combinations thereof, predicted AoA values, predicted AoA uncertainty, or combinations thereof, predicted RTT values, etc. The predicted values ​​may be at least one of one or more predicted channel coefficients, speeds, directions, or combinations thereof for a pair of Tx-Rx antennas or Tx-Rx antenna ports.

[0164]

[0169] The medium 1320 and / or the memory 1304 may include a reporting module 1324 that, when implemented by the one or more processors 1302, configures the one or more processors 1302 to receive, via the external interface 1310, an indication of whether an attacking device is present in a connection between the UE and the base station based on one or more measurements performed by the UE on a current downlink reference signal received by the UE and one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE. The indication may be, for example, a report providing one or more measurements performed by the UE on a current downlink reference signal received by the UE, which may be used by the one or more processors 1302 to determine or verify that an attacking device is present. In another example, the indication may be a warning flag indicating the presence of an attacking device.

[0165]

[0170] The medium 1320 and / or the memory 1304 may include a measurement module 1326 that, when implemented by the one or more processors 1302, configures the one or more processors 1302 to receive, via the external interface 1310, a plurality of one or more measurements performed by the UE of a downlink reference signal transmitted by the base station, and the measurements may be used, for example, to update a predicted value of the measurement if it is determined that no aggressor device is present.

[0166]

[0171] The methods described herein may be implemented by various means depending on the application. For example, the methods may be implemented in hardware, firmware, software, or any combination thereof. In a hardware implementation, the one or more processors 1302 may be implemented in one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs), processors, controllers, microcontrollers, microprocessors, electronic devices, other electronic units designed to perform the functions described herein, or combinations thereof.

[0167]

[0172] For a firmware and / or software implementation, the methods may be implemented with modules (e.g., procedures, functions, and so on) that perform the functions described herein. Any machine-readable medium tangibly embodying instructions may be used in implementing the methods described herein. For example, software code may be stored in a non-transitory computer-readable medium 1320 or memory 1304 coupled to and executed by one or more processors 1302. The memory may be implemented within the one or more processors or external to the one or more processors. The term "memory" as used herein refers to any type of long-term memory, short-term memory, volatile memory, non-volatile memory, or other memory, and should not be limited to any particular type of memory or any particular number of memories, nor should it be limited to any particular type of medium on which the memory is stored.

[0168]

[0173] If implemented in firmware and / or software, the functions may be stored as one or more instructions or program code 1308 on a non-transitory computer readable medium, such as the medium 1320 and / or the memory 1304. Examples include computer readable media encoded with data structures and computer readable media encoded with a computer program 1308. For example, a non-transitory computer readable medium having stored thereon program code 1308 may include program code 1308 for supporting authentication of a connection between a UE and a base station and identification of the presence of an intervening device between the UE and the base station in a manner consistent with the disclosed embodiments. The non-transitory computer readable medium 1320 includes physical computer storage media. A storage medium may be any available medium that can be accessed by a computer. By way of example and not limitation, such non-transitory computer readable media may comprise RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium that can be used to store desired program code 1308 in the form of instructions or data structures and that can be accessed by a computer. As used herein, disk and disc include compact discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks and blue-ray discs, where disks typically reproduce data magnetically and discs reproduce data optically using lasers. Combinations of the above should also be included within the scope of computer readable media.

[0169]

[0174] In addition to being stored on the computer-readable medium 1320, the instructions and / or data may be provided as signals on a transmission medium contained within the communications device. For example, the communications device may include an external interface 1310 having signals indicative of instructions and data. The instructions and data are configured to cause one or more processors to implement the functions outlined in the claims. That is, the communications device includes a transmission medium with signals indicative of information to perform the disclosed functions.

[0170]

[0175] Memory 1304 may represent any data storage mechanism. Memory 1304 may include, for example, primary memory and / or secondary memory. Primary memory may include, for example, random access memory, read-only memory, etc. Although shown in this example as separate from one or more processors 1302, it should be understood that all or a portion of the primary memory may be provided within one or more processors 1302 or may be otherwise co-located / coupled therewith. Secondary memory may include, for example, the same or similar type of memory as the primary memory, and / or one or more data storage devices or systems, such as, for example, disk drives, optical disk drives, tape drives, solid-state memory drives, etc.

[0171]

[0176] In some implementations, the secondary memory may operatively receive or otherwise be configurable to couple to a non-transitory computer readable medium 1320. Thus, in some example implementations, the methods and / or apparatuses presented herein may take the form, in whole or in part, of a computer readable medium 1320 on which computer implementable code 1308 may be stored, which when executed by one or more processors 1302 may be effectively enabled to perform all or a portion of the example operations as described herein. The computer readable medium 1320 may be part of the memory 1304.

[0172]

[0177] 14 shows a flow diagram for an example method 1400 performed by a UE to authenticate a connection with a base station. The UE may be, for example, a UE 104 or a UE 1200, and the base station may be, for example, a base station 102 or a network entity 1300.

[0173]

[0178] In block 1402, the UE receives one or more predicted values ​​for one or more measurements of a downlink reference signal based on measurements of a previous downlink reference signal received from a base station, e.g., as described in steps 1112 and 1122 of FIG. 11. The downlink reference signal may be, for example, a Positioning Reference Signal (PRS). In some implementations, the one or more predicted values ​​for the one or more measurements comprise a security set of predicted values ​​for the one or more measurements for determining whether an aggressor device transmitted the received downlink reference signal, e.g., as described in steps 1112 and 1122 of FIG. 11, and an assistance data set of predicted values ​​for the one or more measurements for performing the one or more measurements of the received downlink reference signal. The means for receiving one or more prediction values ​​for one or more measurements of a downlink reference signal based on previous measurements of the downlink reference signal received from a base station may include, for example, a wireless transceiver 1210 and one or more processors 1202 having dedicated hardware or implementing executable code or software instructions in a medium 1220, such as a memory 1204 in the UE 1200 and / or a prediction value module 1222, as shown in FIG. 12 .

[0174]

[0179] In block 1404, the UE receives a downlink reference signal, e.g., as described in steps 1114 and 1124 of Figure 11. The means for receiving a downlink reference signal may include, for example, a wireless transceiver 1210 and one or more processors 1202 with dedicated hardware or implementing executable code or software instructions in a medium 1220, such as a memory 1204 and / or a reference signal module 1224 in the UE 1200 shown in Figure 12.

[0175]

[0180] In block 1406, the UE performs one or more measurements of the received downlink reference signal, e.g., as described in steps 1115 and 1125 of Figure 11. Means for performing one or more measurements of the received downlink reference signal may include, for example, one or more processors 1202 with dedicated hardware or implementing executable code or software instructions in a medium 1220, such as memory 1204 and / or measurement module 1226 in the UE 1200, as shown in Figure 12.

[0176]

[0181] In block 1408, the UE determines whether an aggressor device transmitted the received downlink reference signal based on one or more prediction values ​​for one or more measurements of the downlink reference signal and one or more measurements of the current downlink reference signal, e.g., as described in steps 1116 and 1126 of Figure 11. Means for determining whether an aggressor device transmitted the received downlink reference signal based on one or more prediction values ​​for one or more measurements of the downlink reference signal and one or more measurements of the current downlink reference signal may include, for example, one or more processors 1202 with dedicated hardware or implementing executable code or software instructions in a medium 1220, such as memory 1204 and / or comparison module 1228 in UE 1200 shown in Figure 12.

[0177]

[0182] In some implementations, the UE may send a report to a network entity, which may be, for example, one of the base station or a location server, in response to determining that the received downlink reference signal was transmitted by an attacking device, indicating the presence of the attacking device in the connection between the UE and the base station, as described in step 1128 of FIG. 11. The UE may send the report to the network entity, which may be, for example, one of the base station or a location server. Means for sending a report to a network entity, which may be, for example, one of the base station or a location server, in response to determining that the received downlink reference signal was transmitted by an attacking device, may include, for example, a wireless transceiver 1210 and one or more processors 1202 with dedicated hardware or implementing executable code or software instructions in a medium 1220, such as a memory 1204 and / or a reporting module 1230 in the UE 1200, as shown in FIG.

[0178]

[0183] In some implementations, the one or more predicted values ​​for one or more measurements of the downlink reference signal may be predicted positioning measurements. For example, the one or more predicted values ​​for one or more measurements of the downlink reference signal may comprise one or more predicted reference signal received power (RSRP) values ​​for the downlink reference signal, e.g., as described in steps 1110 and 1112 of FIG. 11. In another example, the one or more predicted values ​​for one or more measurements of the downlink reference signal may comprise at least one of one or more predicted reference signal time difference (RSTD) values, one or more predicted RSTD uncertainties, or a combination thereof, for a downlink reference signal received from a base station relative to a downlink reference signal received from one or more other base stations, e.g., as described in steps 1110 and 1112 of FIG. 11. In another example, the one or more predicted values ​​for one or more measurements of the downlink reference signal may comprise one or more predicted angle of arrival (AoA) values, one or more predicted AoA uncertainties, or a combination thereof, for a downlink reference signal, e.g., as described in steps 1110 and 1112 of FIG. 11. In another example, the one or more predicted values ​​for one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station, e.g., as described in steps 1110 and 1112 of FIG. 11.

[0179]

[0184] In some implementations, the UE may further receive one or more predicted channel coefficients for a Tx-Rx antenna or Tx-Rx antenna port pair based on measurements of a previous downlink reference signal received from a base station, e.g., as described in steps 1110 and 1112 of Figure 11, and may determine current channel coefficients from the received downlink reference signal, e.g., as described in steps 1115 and 1125 of Figure 11. The UE may determine whether the received downlink reference signal was transmitted by an aggressor device further based on the predicted channel coefficients and the current channel coefficients, as described in steps 1116 and 1126 of Figure 11. Means for receiving one or more predicted channel coefficients for a Tx-Rx antenna or Tx-Rx antenna port pair based on measurements of a previous downlink reference signal received from a base station may include, for example, a wireless transceiver 1210 and one or more processors 1202 having dedicated hardware or implementing executable code or software instructions in a medium 1220 such as a memory 1204 and / or a prediction module 1222 in the UE 1200 shown in FIG. 12. Means for determining current channel coefficients from a received downlink reference signal may include, for example, one or more processors 1202 having dedicated hardware or implementing executable code or software instructions in a medium 1220 such as a memory 1204 and / or a measurement module 1226 in the UE 1200 shown in FIG. 12.

[0180]

[0185] In some implementations, the UE may further receive at least one of a speed, a direction, or a combination thereof based on measurements of a previous downlink reference signal received from the base station, e.g., as described in steps 1110 and 1112 of Figure 11, and may determine at least one of a current speed, a current direction, or a combination thereof from the received downlink reference signal, e.g., as described in steps 1115 and 1125 of Figure 11. The UE may determine whether the aggressor device that transmitted the received downlink reference signal is further based on the predicted at least one of a speed, a direction, or a combination thereof and the current speed, the current direction, or a combination thereof, e.g., as described in steps 1116 and 1126 of Figure 11. The means for receiving at least one of a speed, a direction, or a combination thereof based on measurements of a previous downlink reference signal received from a base station may include, for example, a wireless transceiver 1210 and one or more processors 1202 having dedicated hardware or implementing executable code or software instructions in a medium 1220 such as a memory 1204 and / or a predictor module 1222 in the UE 1200 shown in FIG. 12. The means for determining at least one of a current speed, a current direction, or a combination thereof from a received downlink reference signal may include, for example, one or more processors 1202 having dedicated hardware or implementing executable code or software instructions in a medium 1220 such as a memory 1204 and / or a measurement module 1226 in the UE 1200 shown in FIG. 12.

[0181]

[0186] In some implementations, the UE may further receive one or more timestamps associated with predicted values ​​for one or more measurements of the downlink reference signal, e.g., as described in stages 1110 and 1112. Means for receiving one or more timestamps associated with predicted values ​​for one or more measurements of the downlink reference signal may include, for example, a wireless transceiver 1210 and one or more processors 1202 with dedicated hardware or implementing executable code or software instructions in a medium 1220, such as a memory 1204 and / or a predictor module 1222 in the UE 1200 shown in FIG.

[0182]

[0187] 15 shows a flow diagram for an example method 1500 performed by a network entity to authenticate a connection between a UE and a base station. The network entity may be, for example, a base station 102, a location server 172, or a network entity 1300, and the UE may be a UE 104 or a UE 1200.

[0183]

[0188] In block 1502, the network entity obtains one or more prediction values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from a base station, e.g., as described in steps 1104, 1108, and 1118 of FIG. 11. The downlink reference signal may be, for example, a Positioning Reference Signal (PRS). In some implementations, the one or more prediction values ​​for the one or more measurements comprise a security set of prediction values ​​for the one or more measurements for determining whether an aggressor device transmitted the received downlink reference signal, and an assistance data set of prediction values ​​for the one or more measurements for performing the one or more measurements of the received downlink reference signal, e.g., as described in steps 1112 and 1122 of FIG. 11. The means for obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from a base station may include, for example, an external interface 1310 and one or more processors 1302 having dedicated hardware or implementing executable code or software instructions in a medium 1320, such as a memory 1304 and / or a predicted value module 1322 in the network entity 1300 shown in FIG. 13 .

[0184]

[0189] In block 1504, the network entity sends one or more predictions for one or more measurements of the downlink reference signal to the UE, e.g., as described in steps 1112 and 1122 of Figure 11. The means for sending one or more predictions for one or more measurements of the downlink reference signal to the UE may include, for example, an external interface 1310 and one or more processors 1302 with dedicated hardware or implementing executable code or software instructions in a medium 1320, such as a memory 1304 and / or a prediction module 1322 in the network entity 1300 shown in Figure 13.

[0185]

[0190] In block 1506, the network entity receives an indication of whether an attacking device is present in a connection between the UE and the base station based on one or more measurements performed by the UE on a current downlink reference signal received by the UE and one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE, e.g., as described in steps 1118 and 1128 of Figure 11. Means for receiving an indication of whether an attacking device is present in a connection between the UE and the base station based on one or more measurements performed by the UE on a current downlink reference signal received by the UE and one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE may include, for example, an external interface 1310 and one or more processors 1302 with dedicated hardware or implementing executable code or software instructions in a medium 1320, such as a memory 1304 and / or a reporting module 1324 in the network entity 1300 shown in Figure 13.

[0186]

[0191] In one implementation, the network entity may obtain one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE, e.g., by receiving a plurality of one or more measurements performed by the UE of a downlink reference signal transmitted by a base station, e.g., as described in steps 1108 and 1118 of FIG. 11, and generating one or more predicted values ​​for the one or more measurements of the downlink reference signal based on the received plurality of one or more measurements performed by the UE, e.g., as described in steps 1110 and 1120 of FIG. 11. The means for receiving a plurality of one or more measurements performed by the UE of a downlink reference signal transmitted by a base station may include, e.g., an external interface 1310 and one or more processors 1302 with dedicated hardware or implementing executable code or software instructions in a medium 1320, such as a memory 1304 and / or a measurement module 1326 in the network entity 1300 shown in FIG. 13. The means for generating one or more prediction values ​​for one or more measurements of the downlink reference signal based on a plurality of received one or more measurements performed by the UE may include, for example, one or more processors 1302 having dedicated hardware or implementing executable code or software instructions in a medium 1320, such as a memory 1304 and / or a prediction value module 1322 in the network entity 1300 shown in FIG. 13 .

[0187]

[0192] In one implementation, the network entity may obtain one or more prediction values ​​for one or more measurements of a downlink reference signal to be performed by the UE, for example, by receiving one or more prediction values ​​from a location server, as described in steps 1110 and 1120 of Figure 11. The means for receiving one or more prediction values ​​from a location server may include, for example, an external interface 1310 and one or more processors 1302 with dedicated hardware or implementing executable code or software instructions in a medium 1320, such as a memory 1304 and / or a prediction value module 1322 in the network entity 1300 shown in Figure 13.

[0188]

[0193] In one implementation, the indication of whether an attacking device is present may comprise a report indicating that an attacking device has been detected by the UE, as described in step 1128 of Figure 11. In one implementation, the indication of whether an attacking device is present may comprise a report providing one or more measurements performed by the UE on a current downlink reference signal received by the UE, for example, as described in step 1118 or step 1128 of Figure 11. The network entity may update one or more predictions for one or more measurements of the downlink reference signal to be performed by the UE based on the one or more measurements performed by the UE on the current downlink reference signal, for example, as described in steps 1120 and 1122 of Figure 11. The means for updating one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on one or more measurements performed by the UE on a current downlink reference signal may include, for example, an external interface 1310 and one or more processors 1302 having dedicated hardware or implementing executable code or software instructions in a medium 1320, such as a memory 1304 and / or a predicted value module 1322 in the network entity 1300 shown in FIG. 13 .

[0189]

[0194] In some implementations, the one or more predicted values ​​for one or more measurements of the downlink reference signal may be predicted positioning measurements. For example, the one or more predicted values ​​for one or more measurements of the downlink reference signal may comprise one or more predicted reference signal received power (RSRP) values ​​for the downlink reference signal, e.g., as described in steps 1110 and 1112 of FIG. 11. In another example, the one or more predicted values ​​for one or more measurements of the downlink reference signal may comprise at least one of one or more predicted reference signal time difference (RSTD) values, one or more predicted RSTD uncertainties, or a combination thereof, for a downlink reference signal from a base station relative to downlink reference signals from one or more other base stations, e.g., as described in steps 1110 and 1112 of FIG. 11. In another example, the one or more predicted values ​​for one or more measurements of the downlink reference signal may comprise one or more predicted angle of arrival (AoA) values, one or more predicted AoA uncertainties, or a combination thereof, for a downlink reference signal, e.g., as described in steps 1110 and 1112 of FIG. 11. In another example, the one or more predicted values ​​for one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station, e.g., as described in steps 1110 and 1112 of FIG. 11.

[0190]

[0195] In some implementations, the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise predicted channel coefficients for a Tx-Rx antenna or a Tx-Rx antenna port pair, e.g., as described in steps 1110 and 1112 of Figure 11. In some implementations, the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of a UE velocity, a UE movement direction, or a combination thereof, e.g., as described in steps 1110 and 1112 of Figure 11.

[0191]

[0196] It will be apparent to those skilled in the art that substantial modifications may be made according to particular requirements. For example, customized hardware may also be used and / or particular elements may be implemented in hardware, software (including portable software such as applets), or both. Furthermore, connection to other computing devices, such as network input / output devices, may be employed.

[0192]

[0197] With reference to the accompanying figures, components that may include memory may include non-transitory machine-readable media. As used herein, the terms "machine-readable medium" and "computer-readable medium" refer to any storage medium that participates in providing data that causes a machine to operate in a specific manner. In the embodiments provided above, various machine-readable media may participate in providing instructions / code to a processing unit and / or other devices for execution. Additionally or alternatively, machine-readable media may be used to store and / or transport such instructions / code. In many implementations, computer-readable media are physical and / or tangible storage media. Such media may take many forms, including but not limited to non-volatile media and volatile media. Common forms of computer readable media include, for example, magnetic and / or optical media, any other physical medium having a pattern of holes, RAM, programmable ROM (PROM), erasable PROM (EPROM), FLASH®-EPROM, any other memory chip or cartridge, or any other medium from which a computer can read instructions and / or code.

[0193]

[0198] The methods, systems, and devices described herein are examples. Various embodiments may omit, substitute, or add various procedures or components, as appropriate. For example, features described with respect to some embodiments may be combined in various other embodiments. Different aspects and elements of the embodiments may be combined in a similar manner. Various components of the diagrams provided herein may be embodied in hardware and / or software. Also, technology evolves, and thus many of the elements are examples that do not limit the scope of the disclosure to those specific examples.

[0194]

[0199] It has proven convenient at times, primarily for reasons of common usage, to refer to such signals as bits, information, values, elements, symbols, characters, variables, terms, numbers, numeric values, or the like. It should be understood, however, that all of these or similar terms are to be associated with the appropriate physical quantities and are merely convenient labels. Unless otherwise indicated, and as is apparent from the above description, throughout this specification, descriptions utilizing terms such as "processing," "calculating," "calculating," "determining," "ascertaining," "identifying," "associating," "measuring," "performing," and the like, will be appreciated to refer to actions or processes of a particular apparatus, such as a special purpose computer or similar special purpose electronic computing device. Thus, in the context of this specification, a special purpose computer or similar special purpose electronic computing device is capable of manipulating or transforming signals that are generally represented as electronic, electrical, or magnetic physical quantities in the memories, registers, or other information storage, transmission, or display devices of the special purpose computer or similar special purpose electronic computing device.

[0195]

[0200] The terms "and" and "or" as used herein may include various meanings that are expected to depend at least in part on the context in which such terms are used. Typically, "or," when used to link a list such as A, B, or C, is intended to mean A, B, and C, which are used herein in an inclusive sense, as well as A, B, or C, which are used herein in an exclusive sense. Additionally, the term "one or more" as used herein may be used to represent any feature, structure, or characteristic in the singular, or may be used to represent any combination of features, structures, or characteristics. However, it should be noted that this is merely an illustrative example, and claimed subject matter is not limited to this example. Furthermore, the term "at least one of," when used to link a list such as A, B, or C, may be interpreted to mean any combination of A, B, and / or C, such as A, AB, AA, AAB, AABBCCC, etc.

[0196]

[0201] Although several embodiments have been described, various modifications, alternative configurations, and equivalents may be used without departing from the spirit of the present disclosure. For example, the above elements may only be components of a larger system, and other rules may take precedence over or otherwise modify the application of the various embodiments. Also, some steps may be undertaken before, during, or after the above elements are considered. Thus, the above description does not limit the scope of the present disclosure.

[0197]

[0202] In view of this description, embodiments may include various combinations of features. Example implementations are described in the following numbered clauses.

[0203] Clause 1. A method performed by a user equipment (UE) for authenticating a connection with a base station, the method comprising: receiving one or more predicted values ​​for one or more measurements of a downlink reference signal based on measurements of a previous downlink reference signal received from the base station, receiving a downlink reference signal, performing one or more measurements of the received downlink reference signal, and determining whether an aggressor device transmitted the received downlink reference signal based on the one or more predicted values ​​for the one or more measurements of the downlink reference signal and the one or more measurements of a current downlink reference signal.

[0198]

[0204] Clause 2. The method of clause 1, wherein the downlink reference signal is a downlink positioning reference signal.

[0199]

[0205] Clause 3. The method of any of clauses 1 or 2, further comprising, in response to determining that the received downlink reference signal was transmitted by the attacking device, sending a report to a network entity indicating a presence of the attacking device in a connection between the UE and the base station.

[0200]

[0206] Clause 4. The method of clause 3, wherein the network entity is a base station or a location server.

[0201]

[0207] Clause 5. The method of any of clauses 1 to 4, wherein the one or more predicted values ​​for the one or more measurements comprise: a security set of predicted values ​​for the one or more measurements for determining whether an attacking device has transmitted the received downlink reference signal; and an assistance data set of predicted values ​​for the one or more measurements for performing the one or more measurements of the received downlink reference signal.

[0202]

[0208] Clause 6. The method of any of clauses 1 to 5, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

[0203]

[0209] Clause 7. The method of any of clauses 1 to 6, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of one or more expected reference signal time difference (RSTD) values ​​for a downlink reference signal received from the base station relative to downlink reference signals received from one or more other base stations, one or more expected RSTD uncertainties, or a combination thereof.

[0204]

[0210] Clause 8. The method of any of clauses 1 to 7, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected Angle of Arrival (AoA) values ​​for the downlink reference signal, one or more expected AoA uncertainties, or a combination thereof.

[0205]

[0211] Clause 9. The method of any of clauses 1 to 8, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal include one or more expected round trip time (RTT) values ​​for the base station.

[0206]

[0212] Clause 10. The method of any of clauses 1-9, further comprising receiving one or more predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports based on measurements of a previous downlink reference signal received from a base station, and determining current channel coefficients from the received downlink reference signal, wherein determining whether the received downlink reference signal was transmitted by an aggressor device is further based on the predicted channel coefficients and the current channel coefficients.

[0207]

[0213] Clause 11. The method of any of clauses 1-10, further comprising receiving at least one of a speed, a direction, or a combination thereof based on a measurement of a previous downlink reference signal received from the base station, and determining at least one of a current speed, a current direction, or a combination thereof from the received downlink reference signal, wherein determining whether the received downlink reference signal was transmitted by an aggressor device is further based on the predicted at least one of a speed, a direction, or a combination thereof and the current speed, the current direction, or at least one of a combination thereof.

[0208]

[0214] Clause 12. The method of any of clauses 1-11, further comprising receiving one or more timestamps associated with predicted values ​​for one or more measurements of a downlink reference signal.

[0209]

[0215] Clause 13. A user equipment (UE) configured to authenticate a connection with a base station, the user equipment (UE) comprising: a wireless transceiver configured to communicate with other entities in a wireless network; at least one memory; and at least one processor coupled to the wireless transceiver and the at least one memory, the at least one processor configured to: receive, via the wireless transceiver, one or more predicted values ​​for one or more measurements of a downlink reference signal based on measurements of a previous downlink reference signal received from a base station; receive, via the wireless transceiver, a downlink reference signal; perform one or more measurements of the received downlink reference signal; and determine whether an aggressor device transmitted the received downlink reference signal based on the one or more predicted values ​​for the one or more measurements of the downlink reference signal and the one or more measurements of a current downlink reference signal.

[0210]

[0216] Clause 14. The UE of clause 13, wherein the downlink reference signal is a downlink positioning reference signal.

[0211]

[0217] Clause 15. The UE of clause 13 or 14, wherein the at least one processor is configured to, in response to determining that the received downlink reference signal was transmitted by the aggressor device, send a report, via the wireless transceiver, to a network entity indicating a presence of the aggressor device in a connection between the UE and the base station.

[0212]

[0218] Clause 16. The UE of clause 15, wherein the network entity is a base station or a location server.

[0213]

[0219] Clause 17. The UE of any of clauses 13 to 16, wherein the one or more predicted values ​​for the one or more measurements comprise: a security set of predicted values ​​for the one or more measurements for determining whether an aggressor device has transmitted a received downlink reference signal; and an assistance data set of predicted values ​​for the one or more measurements for performing one or more measurements of the received downlink reference signal.

[0214]

[0220] Clause 18. The UE of any of clauses 13 to 17, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

[0215]

[0221] Clause 19. The UE of any of clauses 13 to 18, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of: one or more predicted reference signal time difference (RSTD) values ​​for a downlink reference signal received from the base station relative to downlink reference signals received from one or more other base stations, one or more predicted RSTD uncertainties, or a combination thereof.

[0216]

[0222] Clause 20. The UE of any of clauses 13 to 19, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected Angle of Arrival (AoA) values ​​for the downlink reference signal, one or more expected AoA uncertainties, or a combination thereof.

[0217]

[0223] Clause 21. The UE of any of clauses 13 to 20, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station.

[0218]

[0224] Clause 22. The UE of any of clauses 13-21, wherein the at least one processor is further configured to receive, via the wireless transceiver, one or more predicted channel coefficients for the Tx-Rx antenna or Tx-Rx antenna port pair based on measurements of a previous downlink reference signal received from the base station, and determine current channel coefficients from the received downlink reference signal, wherein the at least one processor is further configured to determine whether the received downlink reference signal was transmitted by an aggressor device based on the predicted channel coefficients and the current channel coefficients.

[0219]

[0225] Clause 23. The UE of any of clauses 13 to 22, wherein the at least one processor is further configured to receive, via the wireless transceiver, at least one of a speed, a direction, or a combination thereof based on a measurement of a previous downlink reference signal received from the base station, and determine a current speed, a current direction, or at least one combination thereof from the received downlink reference signal, and the at least one processor is configured to determine whether the received downlink reference signal was transmitted by an aggressor device based further on the predicted at least one of a speed, a direction, or a combination thereof and the current speed, the current direction, or at least one combination thereof.

[0220]

[0226] Clause 24. The UE of any of clauses 13-23, wherein the at least one processor is further configured to receive one or more timestamps associated with predicted values ​​for one or more measurements of a downlink reference signal.

[0221]

[0227] Clause 25. A user equipment (UE) configured to authenticate a connection with a base station, comprising: means for receiving one or more predicted values ​​for one or more measurements of a downlink reference signal based on measurements of a previous downlink reference signal received from the base station; means for receiving the downlink reference signal; means for performing one or more measurements of the received downlink reference signal; and means for determining whether an aggressor device transmitted the received downlink reference signal based on the one or more predicted values ​​for the one or more measurements of the downlink reference signal and the one or more measurements of the current downlink reference signal.

[0222]

[0228] Clause 26. The UE of clause 25, wherein the downlink reference signal is a downlink positioning reference signal.

[0223]

[0229] Clause 27. The UE of any of clauses 25 or 26, further comprising means for sending a report to a network entity indicating a presence of the aggressor device in a connection between the UE and the base station in response to determining that the received downlink reference signal was transmitted by an aggressor device.

[0224]

[0230] Clause 28. The UE of clause 27, wherein the network entity is a base station or a location server.

[0225]

[0231] Clause 29. The UE of any of clauses 25 to 28, wherein the one or more predicted values ​​for the one or more measurements comprises: a security set of one or more predicted values ​​for the measurements for determining whether an aggressor device has transmitted the received downlink reference signal; and an assistance data set of one or more predicted values ​​for the measurements for performing the one or more measurements of the received downlink reference signal.

[0226]

[0232] Clause 30. The UE of any of clauses 25 to 29, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

[0227]

[0233] Clause 31. The UE of any of clauses 25 to 30, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of: one or more predicted reference signal time difference (RSTD) values ​​for a downlink reference signal received from the base station relative to downlink reference signals received from one or more other base stations, one or more predicted RSTD uncertainties, or a combination thereof.

[0228]

[0234] Clause 32. The UE of any of clauses 25 to 31, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected Angle of Arrival (AoA) values ​​for the downlink reference signal, one or more expected AoA uncertainties, or a combination thereof.

[0229]

[0235] Clause 33. The UE of any of clauses 25 to 32, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station.

[0230]

[0236] Clause 34. The UE of any of clauses 25 to 33, further comprising: means for receiving one or more predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports based on measurements of a previous downlink reference signal received from a base station; and means for determining current channel coefficients from the received downlink reference signal, wherein the means for determining whether the received downlink reference signal was transmitted by an aggressor device further uses the predicted channel coefficients and the current channel coefficients.

[0231]

[0237] Clause 35. The UE of any of clauses 25 to 34, further comprising: means for receiving at least one of a speed, a direction, or a combination thereof based on a measurement of a previous downlink reference signal received from a base station; and means for determining at least one of a current speed, a current direction, or a combination thereof from the received downlink reference signal, wherein the means for determining whether the received downlink reference signal was transmitted by an aggressor device further uses a predicted at least one of a speed, a direction, or a combination thereof and at least one of a current speed, a current direction, or a combination thereof.

[0232]

[0238] Clause 36. The UE of any of clauses 25 to 35, further comprising means for receiving one or more timestamps associated with predicted values ​​for one or more measurements of a downlink reference signal.

[0233]

[0239] Clause 37. A non-transitory storage medium having program code stored thereon, the program code operable to configure at least one processor in a user equipment (UE) to authenticate a connection with a base station, the program code including instructions for: receiving one or more predicted values ​​for one or more measurements of a downlink reference signal based on measurements of a previous downlink reference signal received from the base station, receiving a downlink reference signal, performing one or more measurements of the received downlink reference signal, and determining whether an aggressor device transmitted the received downlink reference signal based on the one or more predicted values ​​for the one or more measurements of the downlink reference signal and the one or more measurements of a current downlink reference signal.

[0234]

[0240] Clause 38. The non-transitory storage medium of clause 37, wherein the downlink reference signal is a downlink positioning reference signal.

[0235]

[0241] Clause 39. The non-transitory storage medium of any of clauses 37 or 38, wherein the program code further comprises instructions for sending a report to a network entity indicating a presence of the aggressor device in a connection between the UE and the base station in response to determining that the received downlink reference signal was transmitted by an aggressor device.

[0236]

[0242] Clause 40. The non-transitory computer-readable medium of clause 39, wherein the network entity is a base station or a location server.

[0237]

[0243] Clause 41. The non-transitory storage medium of any of clauses 37 to 40, wherein the one or more predicted values ​​for the one or more measurements comprise: a security set of predicted values ​​for the one or more measurements for determining whether an attacking device has transmitted the received downlink reference signal; and an assistance data set of predicted values ​​for the one or more measurements for performing the one or more measurements of the received downlink reference signal.

[0238]

[0244] Clause 42. The non-transitory storage medium of any of clauses 37 to 41, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

[0239]

[0245] Clause 43. The non-transitory storage medium of any of clauses 37 to 42, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of: one or more predicted reference signal time difference (RSTD) values ​​for a downlink reference signal received from a base station relative to downlink reference signals received from one or more other base stations, one or more predicted RSTD uncertainties, or a combination thereof.

[0240]

[0246] Clause 44. The non-transitory storage medium of any of clauses 37 to 43, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected Angle of Arrival (AoA) values ​​for the downlink reference signal, one or more expected AoA uncertainties, or a combination thereof.

[0241]

[0247] Clause 45. The non-transitory storage medium of any of clauses 37 to 44, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station.

[0242]

[0248] Clause 46. The non-transitory storage medium of any of clauses 37 to 45, wherein the program code further comprises instructions for receiving one or more predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports based on measurements of a previous downlink reference signal received from a base station, and determining current channel coefficients from the received downlink reference signal, wherein the instructions for determining whether the aggressor device transmitted the received downlink reference signal further use the predicted channel coefficients and the current channel coefficients.

[0243]

[0249] Clause 47. The method of any of clauses 37 to 46, wherein the program code further includes instructions for receiving at least one of a speed, a direction, or a combination thereof based on a measurement of a previous downlink reference signal received from the base station, and determining at least one of a current speed, a current direction, or a combination thereof from the received downlink reference signal, wherein the instructions for determining whether the received downlink reference signal was transmitted by an aggressor device further use the predicted at least one of a speed, a direction, or a combination thereof and the current speed, the current direction, or at least one of a combination thereof.

[0244]

[0250] Clause 48. The non-transitory storage medium of any one of clauses 37 to 47, wherein the program code further comprises instructions for receiving one or more timestamps associated with predicted values ​​for one or more measurements of a downlink reference signal.

[0245]

[0251] Clause 49. A method performed by a network entity for authenticating a connection between a user equipment (UE) and a base station, the method comprising: obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from a base station, sending the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE, and receiving an indication of whether an attacking device is present in the connection between the UE and the base station based on the one or more measurements performed by the UE of a current downlink reference signal received by the UE and the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE.

[0246]

[0252] Clause 50. The method of clause 49, wherein the downlink reference signal is a downlink positioning reference signal.

[0247]

[0253] Clause 51. The method of any of clauses 49 or 50, wherein obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE comprises receiving a plurality of one or more measurements performed by the UE of a downlink reference signal transmitted by a base station, and generating one or more predicted values ​​for the one or more measurements of the downlink reference signal based on the received plurality of one or more measurements performed by the UE.

[0248]

[0254] Clause 52. The method of any of clauses 49 or 50, wherein obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE comprises receiving the one or more predicted values ​​from a location server.

[0249]

[0255] Clause 53. The method of any of clauses 49 to 52, wherein the indication of whether the attacking device is present comprises a report indicating that the attacking device has been detected by the UE.

[0250]

[0256] Clause 54. The method of any of clauses 49 to 52, wherein the indication of whether an attacking device is present comprises a report providing one or more measurements performed by the UE on a current downlink reference signal received by the UE.

[0251]

[0257] Clause 55. The method of clause 54, further comprising updating one or more predictions for one or more measurements of the downlink reference signal to be performed by the UE based on one or more measurements performed by the UE on a current downlink reference signal.

[0252]

[0258] Clause 56. The method of any of clauses 49 to 55, wherein the network entity is one of a base station or a location server.

[0253]

[0259] Clause 57. The method of any of clauses 49 to 56, wherein the one or more predicted values ​​for the one or more measurements comprise: a security set of predicted values ​​for the one or more measurements for determining whether the received downlink reference signal was transmitted by an aggressor device; and an assistance data set of predicted values ​​for the one or more measurements for performing the one or more measurements of the received downlink reference signal.

[0254]

[0260] Clause 58. The method of any of clauses 49 to 57, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

[0255]

[0261] Clause 59. The method of any of clauses 49 to 58, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of one or more expected reference signal time difference (RSTD) values ​​for a downlink reference signal from the base station relative to downlink reference signals from one or more other base stations, one or more expected RSTD uncertainties, or a combination thereof.

[0256]

[0262] Clause 60. The method of any of clauses 49 to 59, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected Angle of Arrival (AoA) values ​​for the downlink reference signal, one or more expected AoA uncertainties, or a combination thereof.

[0257]

[0263] Clause 61. The method of any of clauses 49 to 60, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station.

[0258]

[0264] Clause 62. The method of any of clauses 49 to 61, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports.

[0259]

[0265] Clause 63. The method of any of clauses 49 to 62, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of a velocity of the UE, a direction of movement of the UE, or a combination thereof.

[0260]

[0266] Clause 64. The method of any of clauses 49-63, further comprising sending, to the UE, one or more timestamps associated with predicted values ​​for the one or more measurements of the downlink reference signal.

[0261]

[0267] Clause 65. A network entity configured to authenticate a connection between a user equipment (UE) and a base station, the network entity comprising: an external interface configured to communicate with other entities in a wireless network; at least one memory; and at least one processor coupled to the external interface and the at least one memory, configured to: obtain one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from a base station, send the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE via the external interface; and receive, via the external interface, an indication of whether an attacking device is present in the connection between the UE and the base station based on the one or more measurements performed by the UE of a current downlink reference signal received by the UE and the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE.

[0262]

[0268] Clause 66. The network entity of clause 65, wherein the downlink reference signal is a downlink positioning reference signal.

[0263]

[0269] Clause 67. The network entity according to any of clauses 65 or 66, wherein the at least one processor is configured to receive, via an external interface, a plurality of one or more measurements performed by the UE of a downlink reference signal transmitted by a base station, and generate, based on the received plurality of one or more measurements performed by the UE, one or more predicted values ​​for the one or more measurements of the downlink reference signal, thereby obtaining one or more predicted values ​​for the one or more measurements of the downlink reference signal to be performed by the UE.

[0264]

[0270] Clause 68. The network entity of any of clauses 65 or 66, wherein the at least one processor is configured to receive one or more predictions from a location server, thereby obtaining one or more predictions for one or more measurements of a downlink reference signal to be performed by the UE.

[0265]

[0271] Clause 69. The network entity of any of clauses 65 to 68, wherein the indication of whether the attacking device is present comprises a report indicating that the attacking device has been detected by the UE.

[0266]

[0272] Clause 70. The network entity of any of clauses 65 to 68, wherein the indication of whether an attacking device is present comprises a report providing one or more measurements performed by the UE on a current downlink reference signal received by the UE.

[0267]

[0273] Clause 71. The network entity of clause 70, wherein the at least one processor is further configured to update one or more predictions for one or more measurements of the downlink reference signal to be performed by the UE based on one or more measurements performed by the UE on a current downlink reference signal.

[0268]

[0274] Clause 72. The network entity according to any of clauses 65 to 71, wherein the network entity is one of a base station or a location server.

[0269]

[0275] Clause 73. The network entity of any of clauses 65 to 72, wherein the one or more predicted values ​​for the one or more measurements comprises: a security set of one or more predicted values ​​for the measurements for determining whether the received downlink reference signal was transmitted by an aggressor device; and an assistance data set of one or more predicted values ​​for the measurements for performing the one or more measurements of the received downlink reference signal.

[0270]

[0276] Clause 74. The network entity of any of clauses 65 to 73, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

[0271]

[0277] Clause 75. The network entity of any of clauses 65 to 74, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of: one or more predicted reference signal time difference (RSTD) values ​​for a downlink reference signal from the base station relative to downlink reference signals from one or more other base stations, one or more predicted RSTD uncertainties, or a combination thereof.

[0272]

[0278] Clause 76. The network entity of any of clauses 65 to 75, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more predicted Angle of Arrival (AoA) values ​​for the downlink reference signal, one or more predicted AoA uncertainties, or a combination thereof.

[0273]

[0279] Clause 77. The network entity of any of clauses 65 to 76, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station.

[0274]

[0280] Clause 78. The network entity of any of clauses 65 to 77, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports.

[0275]

[0281] Clause 79. The network entity of any of clauses 65 to 78, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of a velocity of the UE, a direction of movement of the UE, or a combination thereof.

[0276]

[0282] Clause 80. The network entity of any of clauses 65-79, wherein the at least one processor is further configured to transmit to the UE one or more timestamps associated with predicted values ​​for the one or more measurements of the downlink reference signal.

[0277]

[0283] Clause 81. A network entity configured to authenticate a connection between a user equipment (UE) and a base station, comprising: means for obtaining one or more predicted values ​​for one or more measurements of downlink reference signals to be performed by the UE based on previous measurements performed by the UE of downlink reference signals received by the UE from the base station, means for sending the one or more predicted values ​​for the one or more measurements of the downlink reference signals to the UE, and means for receiving an indication of whether an attacking device is present in the connection between the UE and the base station based on the one or more measurements performed by the UE on a current downlink reference signal received by the UE and the one or more predicted values ​​for the one or more measurements of the downlink reference signals to the UE.

[0278]

[0284] Clause 82. The network entity of clause 81, wherein the downlink reference signal is a downlink positioning reference signal.

[0279]

[0285] Clause 83. The network entity according to any of clauses 81 or 82, wherein the means for obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE comprises: means for receiving a plurality of one or more measurements performed by the UE of a downlink reference signal transmitted by a base station; and means for generating one or more predicted values ​​for the one or more measurements of the downlink reference signal based on the received plurality of one or more measurements performed by the UE.

[0280]

[0286] Clause 84. The network entity according to any of clauses 81 or 82, wherein the means for obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE comprises means for receiving the one or more predicted values ​​from a location server.

[0281]

[0287] Clause 85. The network entity of any of clauses 81 to 84, wherein the indication of whether the attacking device is present comprises a report indicating that the attacking device has been detected by the UE.

[0282]

[0288] Clause 86. The network entity of any of clauses 81 to 84, wherein the indication of whether an attacking device is present comprises a report providing one or more measurements performed by the UE on a current downlink reference signal received by the UE.

[0283]

[0289] Clause 87. The network entity of clause 86, further comprising means for updating one or more predictions for one or more measurements of a downlink reference signal to be performed by the UE based on one or more measurements performed by the UE on a current downlink reference signal.

[0284]

[0290] Clause 88. The network entity according to any of clauses 81 to 87, wherein the network entity is one of a base station or a location server.

[0285]

[0291] Clause 89. The network entity of any of clauses 81 to 88, wherein the one or more predicted values ​​for the one or more measurements comprise: a security set of predicted values ​​for the one or more measurements for determining whether an attacking device has transmitted a received downlink reference signal; and an assistance data set of predicted values ​​for the one or more measurements for performing one or more measurements of the received downlink reference signal.

[0286]

[0292] Clause 90. The network entity of any of clauses 81 to 89, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

[0287]

[0293] Clause 91. The network entity of any of clauses 81 to 90, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of: one or more predicted reference signal time difference (RSTD) values ​​for a downlink reference signal from the base station relative to downlink reference signals from one or more other base stations, one or more predicted RSTD uncertainties, or a combination thereof.

[0288]

[0294] Clause 92. The network entity of any of clauses 81 to 91, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more predicted Angle of Arrival (AoA) values ​​for the downlink reference signal, one or more predicted AoA uncertainties, or a combination thereof.

[0289]

[0295] Clause 93. The network entity of any of clauses 81 to 92, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station.

[0290]

[0296] Clause 94. The network entity of any of clauses 81 to 93, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports.

[0291]

[0297] Clause 95. The network entity of any of clauses 81 to 94, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of a velocity of the UE, a direction of movement of the UE, or a combination thereof.

[0292]

[0298] Clause 96. The network entity of any of clauses 81 to 95, further comprising means for sending to the UE one or more timestamps associated with predicted values ​​for one or more measurements of the downlink reference signal.

[0293]

[0299] Clause 97. A non-transitory storage medium having stored thereon program code operable to configure at least one processor in a network entity to authenticate a connection between a user equipment (UE) and a base station, the program code comprising instructions for: obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on previous measurements performed by the UE of a downlink reference signal received by the UE from a base station, sending the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE, and receiving an indication of whether an attacking device is present in the connection between the UE and the base station based on the one or more measurements performed by the UE of a current downlink reference signal received by the UE and the one or more predicted values ​​for the one or more measurements of the downlink reference signal to the UE.

[0294]

[0300] Clause 98. The non-transitory storage medium of clause 97, wherein the downlink reference signal is a downlink positioning reference signal.

[0295]

[0301] Clause 99. The non-transitory storage medium of any of clauses 97 or 98, wherein the instructions for obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE comprise instructions for receiving a plurality of one or more measurements performed by the UE of a downlink reference signal transmitted by a base station, and generating one or more predicted values ​​for the one or more measurements of the downlink reference signal based on the received plurality of one or more measurements performed by the UE.

[0296]

[0302] Clause 100. The non-transitory storage medium of any of clauses 97 or 98, wherein the instructions for obtaining one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE comprise instructions for receiving the one or more predicted values ​​from a location server.

[0297]

[0303] Clause 101. The non-transitory storage medium of any one of clauses 97 to 100, wherein the indication of whether an attacking device is present comprises a report indicating that the attacking device has been detected by the UE.

[0298]

[0304] Clause 102. The non-transitory storage medium of any of clauses 97 to 100, wherein the indication of whether an attacking device is present comprises a report providing one or more measurements performed by the UE on a current downlink reference signal received by the UE.

[0299]

[0305] Clause 103. The non-transitory storage medium of clause 102, the program code further comprising instructions for updating one or more predicted values ​​for one or more measurements of a downlink reference signal to be performed by the UE based on one or more measurements performed by the UE on a current downlink reference signal.

[0300]

[0306] Clause 104. The non-transitory storage medium of any of clauses 97 to 103, wherein the network entity is one of a base station or a location server.

[0301]

[0307] Clause 105. The non-transitory storage medium of any of clauses 97 to 104, comprising: a security set of predicted values ​​for the one or more measurements for determining whether an attacking device has transmitted a received downlink reference signal; and an assistance data set of predicted values ​​for the one or more measurements for performing one or more measurements of the received downlink reference signal.

[0302]

[0308] Clause 106. The non-transitory storage medium of any of clauses 97 to 105, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

[0303]

[0309] Clause 107. The non-transitory storage medium of any of clauses 97 to 106, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of one or more predicted reference signal time difference (RSTD) values ​​for a downlink reference signal from a base station relative to downlink reference signals from one or more other base stations, one or more predicted RSTD uncertainties, or a combination thereof.

[0304]

[0310] Clause 108. The non-transitory storage medium of any of clauses 97 to 107, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more predicted angle-of-arrival (AoA) values ​​for the downlink reference signal, one or more predicted AoA uncertainties, or a combination thereof.

[0305]

[0311] Clause 109. The non-transitory storage medium of any of clauses 97 to 108, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station.

[0306]

[0312] Clause 110. The non-transitory storage medium of any of clauses 97 to 109, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal include predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports.

[0307]

[0313] Clause 111. The non-transitory storage medium of any of clauses 97 to 110, wherein the one or more predicted values ​​for the one or more measurements of the downlink reference signal comprise at least one of a velocity of the UE, a direction of movement of the UE, or a combination thereof.

[0308]

[0314] Clause 112. The non-transitory storage medium of any of clauses 97 to 111, the program code further comprising instructions for sending to the UE one or more timestamps associated with predicted values ​​for one or more measurements of a downlink reference signal.

[0309]

[0315] It is intended therefore that the claimed subject matter not be limited to the particular examples disclosed, but that such claimed subject matter may include all embodiments falling within the scope of the appended claims and equivalents thereof.

Claims

1. 1. A method performed by a user equipment (UE) for authenticating a connection with a base station, comprising: receiving one or more predictions for one or more measurements of a downlink reference signal based on previous measurements of a downlink reference signal received from the base station; receiving a downlink reference signal; performing one or more measurements of the received downlink reference signal; determining whether the received downlink reference signal was transmitted by an aggressor device based on the one or more predictions for one or more measurements of a downlink reference signal and the one or more measurements of a current downlink reference signal; A method comprising:

2. The one or more predicted values ​​comprise a predicted velocity of the UE based on measurements of a previous downlink reference signal received from the base station; performing the one or more measurements comprises determining a current velocity of the UE based on the received downlink reference signal; determining whether the received downlink reference signal is transmitted by an aggressor device comprises comparing the predicted speed with the determined current speed. The method of claim 1.

3. The method of claim 2, further comprising receiving one or more timestamps associated with the predicted values ​​for the one or more measurements of a downlink reference signal; determining whether the received downlink reference signal was transmitted by an aggressor device comprises determining whether a difference between the predicted speed and the determined current speed is within a threshold; the threshold is based at least in part on a time elapsed between a timestamp associated with the predicted value and a time of receipt of the downlink reference signal. The method of claim 1.

4. The method of claim 1 , wherein the downlink reference signal is a downlink positioning reference signal.

5. 2. The method of claim 1, further comprising: in response to determining that the received downlink reference signal was transmitted by the attacking device, sending a report to a network entity indicating a presence of the attacking device in the connection between the UE and the base station, the network entity being the base station or a location server.

6. 2. The method of claim 1 , wherein the one or more predicted values ​​for the one or more measurements comprise: a security set of predicted values ​​for the one or more measurements for determining whether the received downlink reference signal was transmitted by the attacking device; and an assistance data set of predicted values ​​for the one or more measurements for performing the one or more measurements of the received downlink reference signal.

7. 2. The method of claim 1, wherein the one or more predicted values ​​for one or more measurements of a downlink reference signal comprise one or more expected reference signal received power (RSRP) values ​​for the downlink reference signal.

8. 2. The method of claim 1 , wherein the one or more predicted values ​​for one or more measurements of a downlink reference signal comprise at least one of: one or more predicted reference signal time difference (RSTD) values ​​for the downlink reference signal received from the base station relative to downlink reference signals received from one or more other base stations, one or more predicted RSTD uncertainties, or a combination thereof.

9. 2. The method of claim 1 , wherein the one or more predicted values ​​for one or more measurements of a downlink reference signal comprise one or more expected Angle of Arrival (AoA) values, one or more expected AoA uncertainties, or a combination thereof for the downlink reference signal.

10. 2. The method of claim 1, wherein the one or more predicted values ​​for one or more measurements of a downlink reference signal comprise one or more expected round trip time (RTT) values ​​for the base station.

11. receiving one or more predicted channel coefficients for a Tx-Rx antenna or a Tx-Rx antenna port pair based on measurements of a previous downlink reference signal received from the base station; determining current channel coefficients from the received downlink reference signal; 10. The method of claim 1, further comprising: determining whether the received downlink reference signal was transmitted by the aggressor device is further based on the predicted channel coefficients and the current channel coefficients. The method of claim 1.

12. receiving a predicted direction of the UE based on measurements of previous downlink reference signals received from the base station; determining a current direction of the UE from the received downlink reference signal; 10. The method of claim 1, further comprising: determining whether the received downlink reference signal was transmitted by the aggressor device is further based on the predicted direction of the UE and a current direction of the UE. The method of claim 1.

13. A user equipment (UE) configured to authenticate a connection with a base station, the UE comprising: a wireless transceiver configured to communicate with other entities in a wireless network; At least one memory; at least one processor coupled to the wireless transceiver and the at least one memory, receiving, via the wireless transceiver, one or more predictions for one or more measurements of a downlink reference signal based on previous measurements of a downlink reference signal received from the base station; receiving a downlink reference signal via the wireless transceiver; performing one or more measurements of the received downlink reference signal; at least one processor configured to determine whether the received downlink reference signal was transmitted by an aggressor device based on the one or more predicted values ​​for one or more measurements of a downlink reference signal and the one or more measurements of a current downlink reference signal; A user equipment (UE) comprising:

14. The at least one processor receiving, via the wireless transceiver, one or more predicted channel coefficients for a Tx-Rx antenna or a pair of Tx-Rx antenna ports based on measurements of a previous downlink reference signal received from the base station; determining current channel coefficients from the received downlink reference signal; the at least one processor is configured to determine whether the received downlink reference signal was transmitted by the aggressor device further based on the predicted channel coefficients and the current channel coefficients. The UE of claim 13.

15. The one or more predicted values ​​comprise a predicted velocity of the UE based on measurements of a previous downlink reference signal received from the base station; performing the one or more measurements comprises determining a current velocity of the UE based on the received downlink reference signal; determining whether the received downlink reference signal is transmitted by an aggressor device comprises comparing the predicted speed with the determined current speed. The UE of claim 13.

16. the at least one processor is further configured to receive one or more timestamps associated with the predicted values ​​for the one or more measurements of a downlink reference signal; determining whether the received downlink reference signal was transmitted by an aggressor device comprises determining whether a difference between the predicted speed and the determined current speed is within a threshold; the threshold is based at least in part on a time elapsed between a timestamp associated with the predicted value and a time of receipt of the downlink reference signal. The UE of claim 15.

Images