Hybrid security framework for radio frequency and vision-based positioning systems

Abstract

A technique for communication is disclosed. In one embodiment, a network entity receives radio frequency (RF) based information obtained by a target network node from a target network node, obtains visual channel status information (vCSI) associated with the target network node from one or more network nodes, and determines whether the RF based information has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI.

Description

Technical Field

[0001] 1. Field of Disclosure

[0001] Aspects of the present disclosure generally relate to wireless communication.

[0002] 2. Description of Related Art

[0002] Wireless communication systems have evolved through various generations, including first-generation (1G) analog wireless telephone services, second-generation (2G) digital wireless telephone services (including interim 2.5G and 2.75G networks), third-generation (3G) high-speed data, Internet-capable wireless services, and fourth-generation (4G) services (such as Long Term Evolution (LTE) or WiMax). Currently, many different types of wireless communication systems are in use, including cellular systems and personal communications service (PCS) systems. Examples of known cellular systems include the cellular analog advanced mobile phone system (AMPS), and digital cellular systems based on code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), Global System for Mobile communications (GSM) for mobile communications, and the like.

[0003]

[0003] The fifth-generation (5G) wireless standard, known as New Radio (NR), enables higher data transfer speeds, more connections, and better coverage, among other improvements. According to the Next Generation Mobile Network Alliance, the 5G standard is designed to provide higher data rates, more accurate positioning (based on reference signals for positioning, RS-P, such as downlink, uplink, or sidelink positioning reference signals, PRS), and other technological enhancements compared to previous standards. These enhancements enable highly accurate 5G-based positioning, as well as the use of higher frequency bands, advances in PRS processes and technology, and high-density deployment for 5G. [Overview of the project]

[0004]

[0004] The following provides a simplified overview of one or more embodiments disclosed herein. Therefore, the following overview should not be considered a broad overview of all intended embodiments, nor should it be considered to identify the main or important elements of all intended embodiments, or to define the scope associated with any particular embodiment. Accordingly, the sole purpose of the following overview is to provide, in a simplified form, certain concepts relating to one or more embodiments of the mechanisms disclosed herein, prior to the detailed descriptions presented below.

[0005]

[0005] In one embodiment, a method of wireless communication performed by a network entity includes receiving radio frequency (RF) based information obtained by a target network node from a target network node; obtaining visual channel status information (vCSI) associated with the target network node from one or more network nodes; and determining whether the RF based information has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI.

[0006]

[0006] In one embodiment, a method of wireless communication performed by a network entity includes receiving visual channel state information (vCSI) obtained by a target network node from a target network node; obtaining radio frequency (RF) based information associated with the target network node from one or more network nodes; and determining whether the vCSI has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information.

[0007]

[0007] In one embodiment, the network entity includes one or more memories, one or more transceivers, and one or more processors communicably coupled to one or more memories and one or more transceivers, wherein one or more processors, either alone or in combination, receive radio frequency (RF) based information from a target network node via one or more transceivers, receive visual channel state information (vCSI) associated with the target network node from one or more network nodes, and determine whether the RF based information has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI.

[0008]

[0008] In one embodiment, the network entity includes one or more memories, one or more transceivers, and one or more processors communicably coupled to one or more memories and one or more transceivers, wherein one or more processors, either alone or in combination, receive visual channel status information (vCSI) obtained by a target network node from one or more network nodes via one or more transceivers, obtain radio frequency (RF) based information associated with the target network node from one or more network nodes, and determine whether the vCSI has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information.

[0009]

[0009] In one embodiment, the network entity includes means for receiving radio frequency (RF) based information obtained by a target network node from a target network node; means for obtaining visual channel status information (vCSI) associated with a target network node from one or more network nodes; and means for determining whether the RF based information has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI.

[0010]

[0010] In one embodiment, the network entity includes means for receiving visual channel state information (vCSI) obtained by a target network node from a target network node; means for obtaining radio frequency (RF) based information associated with a target network node from one or more network nodes; and means for determining whether the vCSI has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information.

[0011]

[0011] In one embodiment, a non-temporary computer-readable medium stores computer-executable instructions that, when executed by a network entity, cause the network entity to receive radio frequency (RF) based information from a target network node and obtained by the target network node; to obtain visual channel state information (vCSI) associated with the target network node from one or more network nodes; and to determine whether the RF-based information has been tampered with, based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the RF-based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI.

[0012]

[0012] In one embodiment, a non-temporary computer-readable medium stores computer-executable instructions that, when executed by a network entity, cause the network entity to receive visual channel state information (vCSI) obtained by a target network node from a target network node, to obtain radio frequency (RF) based information associated with the target network node from one or more network nodes, and to determine whether the vCSI has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the RF-based information.

[0013]

[0013] Other purposes and advantages associated with the embodiments disclosed herein will become apparent to those skilled in the art based on the accompanying drawings and detailed description. [Brief explanation of the drawing]

[0014]

[0014] The accompanying drawings are provided to aid in describing various aspects of the present disclosure and are provided for illustrative purposes only, and not to limit those aspects. [Figure 1]

[0015] An exemplary wireless communication system according to the embodiments of this disclosure is shown. [Figure 2A]

[0016] An exemplary wireless network structure according to an aspect of this disclosure is shown. [Figure 2B] An exemplary wireless network structure according to an aspect of this disclosure is shown. [Figure 2C] An exemplary wireless network structure according to an aspect of this disclosure is shown. [Figure 3A]

[0017] This is a simplified block diagram of some exemplary embodiments of components that may be used in user equipment (UE) and configured to support the communications taught herein. [Figure 3B] This is a simplified block diagram of some exemplary embodiments of components that may be employed in a base station and configured to support the communications taught herein. [Figure 3C] This is a simplified block diagram of some exemplary embodiments of components that may be employed in a network entity and configured to support the communications taught herein. [Figure 4]

[0018] Examples of various positioning methods supported in New Radio (NR) according to the aspects of this disclosure are shown. [Figure 5]

[0019] This disclosure illustrates an exemplary hybrid radio frequency (RF) and vision-based positioning system. [Figure 6]

[0020] This disclosure illustrates a signaling call flow for a visual channel state information (vCSI)-assisted security framework for RF-based information integrity. [Figure 7]

[0021] This disclosure illustrates the signaling call flow for an RF device-assisted security framework for vCSI integrity. [Figure 8]

[0022] An exemplary method of communication according to an aspect of the present disclosure is shown. [Figure 9] An exemplary method of communication according to an aspect of the present disclosure is shown.

Best Mode for Carrying Out the Invention

[0015]

[0023] Aspects of the present disclosure are provided in the following description and related drawings directed to various examples provided for illustrative purposes. Alternative aspects may be devised without departing from the scope of the present disclosure. In addition, well-known elements of the present disclosure are not described in detail or are omitted so as not to obscure the relevant details of the present disclosure.

[0016]

[0024] Various aspects generally relate to hybrid radio frequency (RF) and vision-based positioning systems. Some aspects more particularly relate to determining the integrity of RF-based information and visual channel state information (vCSI) in a hybrid RF and vision-based positioning system. In some examples, a network entity (e.g., a location server) receives RF-based information obtained by a target network node from the target network node. The network entity then obtains vCSI associated with the target network node from one or more network nodes. The network entity can then determine whether the RF-based information has been tampered with based on a comparison between a first set of values of a set of characteristics of the environment of the target network node determined based on the RF-based information and a second set of values of a set of characteristics of the environment of the target network node determined based on the vCSI.

[0017]

[0025] In some examples, a network entity (e.g., a location server) receives, from a target network node, vCSI obtained by the target network node. The network entity then obtains, from one or more network nodes, radio frequency (RF)-based information associated with the target network node. The network entity can then determine whether the vCSI has been tampered with based on a comparison between a first set of values of a set of characteristics of the environment of the target network node determined based on the vCSI and a second set of values of the set of characteristics of the environment of the target network node determined based on the RF-based information.

[0018]

[0026] Certain aspects of the subject matter described in this disclosure can be implemented to realize one or more of the following potential advantages. In some examples, by determining whether RF-based information has been tampered with or whether vCSI has been tampered with, the techniques described can be used to improve security and reliability in hybrid RF and vision-based positioning systems.

[0019]

[0027] As used herein, the terms “exemplary” and / or “example” are used to mean “serving as an example, instance, or illustration.” No aspect described herein as “exemplary” and / or “example” should necessarily be construed as preferred or advantageous over other aspects. Similarly, the term “aspect of the disclosure” does not necessarily require that all aspects of the disclosure include the discussed feature, advantage, or mode of operation.

[0020]

[0028] Those skilled in the art will understand that the information and signals described below may be represented using any of a variety of different techniques and methods. For example, the data, instructions, commands, information, signals, bits, symbols, and chips that may be mentioned throughout the following description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, optical fields or optical particles, or any combination thereof, depending in part on the specific application, desired design, corresponding technique, etc.

[0021]

[0029] Furthermore, many embodiments are described, for example, in terms of sequences of actions to be performed by elements of a computing device. It will be recognized that the various actions described herein can be performed by specific circuits (e.g., application-specific integrated circuits, ASICs), by program instructions executed by one or more processors, or a combination of both. In addition, the sequence(s) of actions described herein, when executed, can be considered to be fully embodied in any form of non-temporary computer-readable storage medium that stores a corresponding set of computer instructions that cause or instruct the relevant processors of the device to perform the functions described herein. Thus, the various embodiments of this disclosure can be embodied in several different forms, all of which are intended to fall within the scope of the claimed subject matter. In addition, for each of the embodiments described herein, any corresponding form of such embodiment may be described herein, for example, as “logic configured to perform” the described actions.

[0022]

[0030] As used herein, the terms “User Equipment” (UE) and “Base Station” are not intended to be specific to or otherwise limited to any particular radio access technology (RAT), unless otherwise noted. Generally, a UE may be any wireless communication device used by a user to communicate over a wireless communication network (e.g., mobile phones, routers, tablet computers, laptop computers, consumer location devices, wearables (e.g., smartwatches, glasses, augmented reality (AR) / virtual reality (VR) headsets, etc.), vehicles (e.g., cars, motorcycles, bicycles, etc.), Internet of Things (IoT) devices, etc.). A UE may be mobile or (e.g., stationary at a given time) and may communicate with a radio access network (RAN). As used herein, the term “UE” may be interchangeably referred to as “Access Terminal” or “AT,” “Client Device,” “Wireless Device,” “Subscriber Device,” “Subscriber Terminal,” “Subscriber Station,” “User Terminal” or “UT,” “Mobile Device,” “Mobile Terminal,” “Mobile Station,” or variations thereof. Generally, a UE can communicate with the core network via the RAN, and through the core network, a UE may be connected to external networks such as the Internet and to other UEs. Of course, other mechanisms for connecting to the core network and / or the Internet are also possible for a UE, such as via a wired access network, a wireless local area network (WLAN) network (for example, based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 specification, etc.).

[0023]

[0031] A base station may operate according to one of several RATs that communicate with the UE, depending on the network in which the base station is deployed, and may also be called an access point (AP), network node, node B, evolved node B (eNB), next generation eNB (ng-eNB), or New Radio (NR) node B (also called gNB or g-node B). Base stations may be primarily used to support wireless access by UEs, including supporting data, voice, and / or signaling connectivity for supported UEs. In some systems, base stations may simply provide edge node signaling functionality, while in others, base stations may provide additional control and / or network management functionality. The communication link through which a UE can send signals to a base station is called an uplink (UL) channel (e.g., reverse traffic channel, reverse control channel, access channel, etc.). A communication link from which a base station can send signals to a UE is called a downlink (DL) channel or a forward link channel (e.g., a paging channel, control channel, broadcast channel, or forward traffic channel). As used herein, the term traffic channel (TCH) may refer to either an uplink / reverse traffic channel or a downlink / forward traffic channel.

[0024]

[0032] The term "base station" can refer to a single physical transmission-reception point (TRP), or to multiple physical TRPs, which may or may not be co-located. For example, when the term "base station" refers to a single physical TRP, that TRP could be the base station's antennas corresponding to a base station cell (or several cell sectors). When the term "base station" refers to multiple co-located physical TRPs, those TRPs could be an array of antennas for the base station (for example, in a multiple-input multiple-output (MIMO) system, or when the base station employs beamforming). When the term "base station" refers to multiple unco-located physical TRPs, those TRPs could be a distributed antenna system (DAS) (a network of spatially separated antennas connected to a common source via a transport medium), or a remote radio head (RRH) (a remote base station connected to a serving base station). Instead, uncollocated physical TRPs may be serving base stations that receive measurement reports from UEs, and neighboring base stations whose reference radio frequency (RF) signals the UE is measuring. Since a TRP is the point at which a base station transmits and receives wireless signals, as used herein, references to transmission from or reception at a base station should be understood to refer to the specific TRP of that base station.

[0025]

[0033] In some implementations that support UE positioning, the base station may not support wireless access by the UE (for example, it may not support data, voice, and / or signaling connections to the UE), but instead it can transmit a reference signal to the UE that will be measured by the UE, and / or it can also receive and measure signals transmitted by the UE. Such a base station may be called a positioning beacon (for example, when transmitting signals to the UE) and / or a location measurement unit (for example, when receiving and measuring signals from the UE).

[0026]

[0034] An "RF signal" includes electromagnetic waves of a given frequency that transport information through the space between a transmitter and a receiver. A transmitter used herein may transmit a single "RF signal" or multiple "RF signals" to a receiver. However, a receiver may receive multiple "RF signals" corresponding to each transmitted RF signal due to the propagation characteristics of RF signals through multipath channels. The same RF signal transmitted through different paths between a transmitter and a receiver may be called a "multipath" RF signal. As used herein, an RF signal may also be called a "wireless signal" or simply a "signal" where it is clear from the context that the term "signal" refers to a wireless signal or an RF signal.

[0027]

[0035] Figure 1 shows an exemplary wireless communication system 100 according to an aspect of the present disclosure. The wireless communication system 100 (sometimes referred to as a wireless wide area network, WWAN) may include various base stations 102 (labeled "BS") and various UEs 104. The base stations 102 may include macrocell base stations (high-power cellular base stations) and / or small cell base stations (low-power cellular base stations). In one aspect, the macrocell base station may include an eNB and / or ng-eNB on which the wireless communication system 100 is compatible with an LTE network, or a gNB on which the wireless communication system 100 is compatible with an NR network, or a combination of both, and the small cell base station may include femtocells, picocells, microcells, etc.

[0028]

[0036] Base station 102 may collectively form a RAN and interface with a core network 170 (e.g., an evolved packet core (EPC) or a 5G core (5GC)) via a backhaul link 122, and with one or more location servers 172 (e.g., a location management function (LMF) or a secure user plane location (SUPL) location platform (SLP)) via the core network 170. The location server(s) 172 may be part of the core network 170 or may be outside of the core network 170. The location server(s) 172 may be integrated with base station 102. UE(s) 104 may communicate with the location server(s) 172 directly or indirectly. For example, UE(s) 104 may communicate with the location server(s) 172 via the base station(s) 102 currently serving it. UE104 may also communicate with location server 172 via other routes, such as via an application server (not shown), via a wireless local area network (WLAN) access point (AP) (e.g., AP150 described below), or via another network. For signaling purposes, communication between UE104 and location server 172 may be represented as an indirect connection (e.g., via core network 170) or a direct connection (e.g., as illustrated via direct connection 128), and intervening nodes (if any) are omitted from the signaling diagram for clarity.

[0029]

[0037] In addition to other functions, base stations 102 may perform functions related to one or more of the following: transferring user data, wireless channel encryption and decryption, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection setup and release, load balancing, non-access stratum (NAS) message delivery, NAS node selection, synchronization, RAN sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment tracing, RAN information management (RIM), paging, positioning, and warning message delivery. Base stations 102 may communicate with each other directly or indirectly (e.g., via EPC / 5GC) via backhaul links 134, which may be wired or wireless.

[0030]

[0038] Base station 102 can communicate wirelessly with UE 104. Each base station 102 can provide communication coverage for its respective geographical coverage area 110. In one embodiment, one or more cells may be supported by base stations 102 within each geographical coverage area 110. A “cell” is a logical communication entity used for communication with a base station (over several frequency resources, e.g., carrier frequency, component carrier, carrier, band, etc.) and may be associated with an identifier (e.g., physical cell identifier (PCI), enhanced cell identifier (ECI), virtual cell identifier (VCI), cell global identifier (CGI), etc.) to distinguish cells operating over the same or different carrier frequencies. In some cases, different cells may be configured according to different protocol types that can provide access to different types of UEs (e.g., machine-type communication (MTC), narrowband IoT (NB-IoT), enhanced mobile broadband (eMBB), or others). Since a cell is supported by a particular base station, the term "cell" may, depending on the context, refer to either or both of the logical communication entity and the base station that supports the cell. In addition, since a TRP is typically the physical transmission point of a cell, the terms "cell" and "TRP" may be used interchangeably. In some cases, the term "cell" may also refer to the geographical coverage area (e.g., a sector) of a base station, insofar as the carrier frequency can be detected and used for communication within a portion of the geographical coverage area 110.

[0031]

[0039] The geographical coverage areas 110 of neighboring macrocell base stations 102 may partially overlap (for example, in handover areas), and some of the geographical coverage areas 110 may be significantly overlapped by larger geographical coverage areas 110. For example, a small cell base station 102' (labeled "SC" for "small cell") may have a geographical coverage area 110' that significantly overlaps with the geographical coverage areas 110 of one or more macrocell base stations 102. A network containing both small cell base stations and macrocell base stations may be known as a heterogeneous network. A heterogeneous network may also include home eNBs (HeNBs) that may serve a limited group known as a closed subscriber group (CSG).

[0032]

[0040] The communication link 120 between base station 102 and UE 104 may include uplink (also called reverse link) transmission from UE 104 to base station 102, and / or downlink (DL) (also called forward link) transmission from base station 102 to UE 104. The communication link 120 may utilize MIMO antenna technology, including spatial multiplexing, beamforming, and / or transmit diversity. The communication link 120 may consist of one or more carrier frequencies. Carrier allocation may be asymmetric with respect to the downlink and uplink (for example, more or fewer carriers may be allocated to the downlink than to the uplink).

[0033]

[0041] The wireless communication system 100 may further include a WLAN access point (AP) 150 communicating with wireless local area network (WLAN) stations (STAs) 152 via a communication link 154 in an unlicensed frequency spectrum (e.g., 5 GHz). When communicating in an unlicensed frequency spectrum, the WLAN STA 152 and / or WLAN AP 150 may perform a clear channel assessment (CCA) or listen before talk (LBT) procedure before communication to determine whether the channel is available.

[0034]

[0042] Small cell base station 102' may operate in the licensed frequency spectrum and / or the unlicensed frequency spectrum. When operating in the unlicensed frequency spectrum, small cell base station 102' may employ LTE or NR technology and use the same 5GHz unlicensed frequency spectrum used by WLAN AP150. Small cell base station 102' employing LTE / 5G in the unlicensed frequency spectrum may extend coverage to the access network and / or increase the capacity of the access network. NR in the unlicensed spectrum may be called NR-U. LTE in the unlicensed spectrum may be called LTE-U, licensed assisted access (LAA), or MULTEFIRE®.

[0035]

[0043] The wireless communication system 100 may further include a millimeter wave (mmW) base station 180 that can operate at millimeter wave (mmW) frequencies and / or quasi-mmW frequencies while communicating with the UE 182. Extremely high frequency (EHF) is a part of RF in the electromagnetic spectrum. EHF has a range of 30 GHz to 300 GHz and wavelengths of 1 mm to 10 mm. Radio waves in this band may be called millimeter waves. Quasi-mmW may extend up to a frequency of 3 GHz with a wavelength of 100 mm. The super high frequency (SHF) band extends from 3 GHz to 30 GHz and is also called centimeter waves. Communication using the mmW / quasi-mmW radio frequency band has high path loss and relatively short distances. The mmW base station 180 and UE 182 may utilize beamforming (transmit and / or receive) via the mmW communication link 184 to compensate for the extremely high path loss and short distances. Furthermore, in alternative configurations, it will be understood that one or more base stations 102 may also transmit using mmW or quasi-mmW and beamforming. Accordingly, it will be understood that the above examples are merely illustrative and should not be construed as limiting the various aspects of the disclosure herein.

[0036]

[0044] Transmit beamforming is a technique for concentrating RF signals in a specific direction. Traditionally, when a network node (e.g., a base station) broadcasts an RF signal, it broadcasts that signal in all directions (omnidirectionally). Using transmit beamforming, a network node can determine where a given target device (e.g., a UE) is located (relative to the transmitting network node) and emit a stronger downlink RF signal in that specific direction, thereby providing a faster and more powerful RF signal (in terms of data rate) to one or more receiving devices. To change the directivity of an RF signal when transmitting, a network node can control the phase and relative amplitude of the RF signal at each of the one or more transmitters broadcasting the RF signal. For example, a network node may use an array of antennas (also called a "phased array" or "antenna array") that creates a beam of RF waves that can be "steered" to point in different directions without actually moving the antennas. Specifically, the RF current from the transmitter is supplied to each antenna in the correct phase relationship so that the radio waves from separate antennas combine to cancel out and suppress radiation in undesirable directions, while simultaneously increasing radiation in desired directions.

[0037]

[0045] Transmit beams can be quasi-co-located, meaning that to a receiver (e.g., a UE), the transmit beam appears to have the same parameters regardless of whether the network node's transmit antenna itself is physically co-located. In NR, there are four types of quasi-co-location (QCL) relationships. Specifically, a given type of QCL relationship means that certain parameters for a second reference RF signal on a second beam can be derived from information about the source reference RF signal on the source beam. Thus, if the source reference RF signal is QCL type A, the receiver can use the source reference RF signal to estimate the Doppler shift, Doppler spread, mean delay, and delay spread of a second reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type B, the receiver can use the source reference RF signal to estimate the Doppler shift and Doppler spread of a second reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type C, the receiver can use the source reference RF signal to estimate the Doppler shift and mean delay of a second reference RF signal transmitted on the same channel. If the source reference RF signal is QCL type D, the receiver can use the source reference RF signal to estimate the spatial reception parameters of a second reference RF signal transmitted on the same channel.

[0038]

[0046] In receive beamforming, a receiver uses a received beam to amplify an RF signal detected on a given channel. For example, a receiver can increase the gain setting of an antenna array in a particular direction and / or adjust the phase setting to amplify an RF signal received from that direction (e.g., increase its gain level). Therefore, when a receiver is said to beamform in a particular direction, it means that the beam gain in that direction is higher than the beam gain along other directions, or that the beam gain in that direction is the highest compared to the beam gain of all other receive beams available to the receiver in that direction. This results in a stronger received signal intensity (e.g., reference signal received power (RSRP), reference signal received quality (RSRQ), signal-to-interference-plus-noise ratio (SINR)) of the RF signal received from that direction.

[0039]

[0047] Transmit and receive beams may be spatially related. Spatial relationship means that parameters for a second beam (e.g., a transmit or receive beam) for a second reference signal can be derived from information about a first beam (e.g., a receive or transmit beam) for a first reference signal. For example, a UE might use a specific receive beam to receive a reference downlink reference signal (e.g., a synchronization signal block, SSB) from a base station. The UE can then use the parameters of the receive beam to form a transmit beam for sending an uplink reference signal (e.g., a sounding reference signal, SRS) to that base station.

[0040]

[0048] It should be noted that a “downlink” beam can be either a transmit beam or a receive beam, depending on the entity forming it. For example, if a base station forms a downlink beam to transmit a reference signal to a UE, then the downlink beam is a transmit beam. However, if a UE forms a downlink beam, then it is a receive beam for receiving a downlink reference signal. Similarly, an “uplink” beam can be either a transmit beam or a receive beam, depending on the entity forming it. For example, if a base station forms an uplink beam, then it is an uplink receive beam, and if a UE forms an uplink beam, then it is an uplink transmit beam.

[0041]

[0049] The electromagnetic spectrum is often subdivided into various classes, bands, and channels based on frequency / wavelength. In 5G NR, two initial operating bands are identified as frequency range designations FR1 (410 MHz to 7.125 GHz) and FR2 (24.25 GHz to 52.6 GHz). It should be understood that while a portion of FR1 is above 6 GHz, FR1 is often referred to (interchangeably) as the "sub-6 GHz" band in various documents and papers. A similar nomenclature issue arises with FR2, which is often referred to (interchangeably) as the "millimeter wave" band in documents and papers, even though it is different from the extremely high frequency (EHF) band (30 GHz to 300 GHz) designated as the "millimeter wave" band by the International Telecommunication Union (INTERNATIONAL TELECOMMUNICATION UNION®).

[0042]

[0050] The frequencies between FR1 and FR2 are often referred to as intermediate band frequencies. Recent 5G NR research defines the operating band for these intermediate band frequencies as the frequency range designation FR3 (7.125 GHz to 24.25 GHz). The frequency bands included within FR3 may inherit the FR1 and / or FR2 characteristics, and thus, in effect, the features of FR1 and / or FR2 can be extended to the intermediate band frequencies. In addition, higher frequency bands are currently being considered to extend 5G NR operation beyond 52.6 GHz. For example, three higher operating bands have been defined as the frequency range designations FR4a or FR4-1 (52.6 GHz to 71 GHz), FR4 (52.6 GHz to 114.25 GHz), and FR5 (114.25 GHz to 300 GHz). Each of these higher frequency bands falls within the EHF band.

[0043]

[0051] With the above aspects in mind, unless otherwise specified, terms such as "sub-6GHz" may broadly refer to frequencies that may be below 6GHz, frequencies that may be within FR1, or frequencies that may include intermediate band frequencies, as used herein. Furthermore, unless otherwise specified, terms such as "millimeter wave" may broadly refer to frequencies that may include intermediate band frequencies, frequencies that may be within FR2, FR4, FR4-a or FR4-1, and / or FR5, or frequencies that may be within the EHF band, as used herein.

[0044]

[0052] In multi-carrier systems such as 5G, one of the carrier frequencies is called the "primary carrier," "anchor carrier," or "primary serving cell" (PCell), while the remaining carrier frequencies are called "secondary carriers," "secondary serving cells" (SCell). In carrier aggregation, the anchor carrier is the carrier operating on the primary frequency (e.g., FR1) utilized by UE104 / 182, and is the cell from which UE104 / 182 either performs the initial radio resource control (RRC) connection establishment procedure or initiates the RRC connection re-establishment procedure. The primary carrier carries all common control channels and UE-specific control channels and may (but not always) be a carrier on licensed frequencies. The secondary carrier is a carrier operating on a second frequency (e.g., FR2) that may be configured once an RRC connection is established between UE104 and the anchor carrier and may be used to provide additional radio resources. In some cases, the secondary carrier may be a carrier on unlicensed frequencies. Since both the primary uplink carrier and primary downlink carrier are typically UE-specific, secondary carriers should contain only the necessary signaling information and signals, and may not contain UE-specific signaling information and signals, for example. This means that different UE104 / 182s within a cell can have different downlink primary carriers. The same applies to uplink primary carriers. The network can change the primary carrier of any UE104 / 182 at any time. This is done, for example, to balance the load on different carriers.Since a "serving cell" (whether PCell or SCell) corresponds to the carrier frequency / component carrier through which several base stations communicate, terms such as "cell," "serving cell," "component carrier," and "carrier frequency" can be used interchangeably.

[0045]

[0053] For example, referring further to Figure 1, one of the frequencies used by the macrocell base station 102 may be the anchor carrier (or "PCell"), and the other frequencies used by the macrocell base station 102 and / or the mmW base station 180 may be secondary carriers ("SCell"). Simultaneous transmission and / or reception of multiple carriers allows UE 104 / 182 to significantly increase its data transmission rate and / or data reception rate. For example, two 20MHz carriers bundled together in a multicarrier system would theoretically result in a data rate increase of twice as much (i.e., 40MHz) compared to the data rate achieved by a single 20MHz carrier.

[0046]

[0054] The wireless communication system 100 may further include a UE 164 capable of communicating with a macrocell base station 102 via a communication link 120 and / or with an mmW base station 180 via an mmW communication link 184. For example, the macrocell base station 102 may support PCell and one or more SCells to the UE 164, and the mmW base station 180 may support one or more SCells to the UE 164.

[0047]

[0055] In some cases, UE164 and UE182 may be capable of sidelink communication. Sidelink-capable UEs (SL-UEs) may communicate with base station 102 via communication link 120 using the Uu interface (i.e., the air interface between the UE and the base station). SL-UEs (e.g., UE164, UE182) may also communicate directly with each other via wireless sidelink 160 using the PC5 interface (i.e., the air interface between sidelink-capable UEs). Wireless sidelink (or simply “sidelink”) is an adaptation of core-cellular (e.g., LTE, NR) standards that enables direct communication between two or more UEs without the need for communication to go through a base station. Sidelink communication can be unicast or multicast and may be used for device-to-device (D2D) medium sharing, vehicle-to-vehicle (V2V) communication, vehicle-to-everything (V2X) communication (e.g., cellular V2X (cV2X) communication, enhanced V2X (eV2X) communication, etc.), emergency rescue applications, etc. One or more of the groups of SL-UEs utilizing sidelink communication may be within the geographical coverage area 110 of base station 102. Other SL-UEs in such a group may be outside the geographical coverage area 110 of base station 102 or otherwise unable to receive transmissions from base station 102. In some cases, a group of SL-UEs communicating via sidelink communication may utilize a one-to-many (1:M) system, where each SL-UE transmits to all other SL-UEs in the group. In some cases, base station 102 facilitates the scheduling of resources for sidelink communication. In other cases, sidelink communication is performed between SL-UEs without the involvement of base station 102.

[0048]

[0056] In one embodiment, the sidelink 160 may operate on a wireless communication medium of interest, which may be shared with other vehicles and / or infrastructure access points, as well as with other wireless communications between other RATs. The “medium” may consist of one or more time, frequency, and / or spatial communication resources (including, for example, one or more channels across one or more carriers) associated with wireless communications between one or more transmitter / receiver pairs. In one embodiment, the medium of interest may correspond to at least a portion of an unlicensed frequency band shared among various RATs. Different licensed frequency bands are reserved for certain communications systems (for example, by government agencies such as the Federal Communications Commission, FCC in the United States), but these systems, particularly those employing small cell access points, have recently extended their operation to unlicensed frequency bands such as the Unlicensed National Information Infrastructure (U-NII) band, used by wireless local area network (WLAN) technology, most notably IEEE 802.11x WLAN technology commonly known as “Wi-Fi”. Examples of this type of system include various variations such as CDMA systems, TDMA systems, FDMA systems, orthogonal FDMA (OFDMA) systems, and single-carrier FDMA (SC-FDMA) systems.

[0049]

[0057] Figure 1 shows only two of the UEs as SL-UEs (i.e., UE164 and UE182), but note that any of the shown UEs could be an SL-UE. Furthermore, although it was stated that only UE182 is beamforming, any of the shown UEs, including UE164, could be beamforming. If SL-UEs are beamforming, they can beamform toward each other (i.e., toward other SL-UEs), toward other UEs (e.g., UE104), toward base stations (e.g., base stations 102, 180, small cell 102', access point 150), and so on. Therefore, in some cases, UE164 and UE182 can utilize beamforming via sidelink 160.

[0050]

[0058] In the example shown in Figure 1, any of the UEs shown (shown in Figure 1 as a single UE104 for simplicity) may receive signals 124 from one or more Earth-orbiting space vehicles (SVs) 112 (e.g., satellites). In one embodiment, the SV112 may be part of a satellite positioning system that the UE104 can use as an independent source of location information. The satellite positioning system typically includes a system of transmitters (e.g., the SV112), which is arranged to allow a receiver (e.g., the UE104) to determine the location of the receiver on or above Earth, at least in part, based on positioning signals (e.g., signals 124) received from the transmitters. Such transmitters typically transmit signals marked with a set number of repeating pseudo-random noise (PN) codes. The transmitters are typically located within the SV112, but may in some cases be located on ground-based control stations, base stations 102, and / or other UE104. UE104 may include one or more dedicated receivers specifically designed to receive signals 124 for deriving geolocation information from SV112.

[0051]

[0059] In satellite positioning systems, the use of signal 124 may be associated with, or enabled for, use with, one or more global navigation satellite systems and / or regional navigation satellite systems, and may be augmented by various satellite-based augmentation systems (SBAS). For example, an SBAS may include one or more augmentation systems that provide integrity information, error correction, etc., such as the Wide Area Augmentation System (WAAS), the European Geostationary Navigation Overlay Service (EGNOS), the Multi-functional Satellite Augmentation System (MSAS), the Global Positioning System (GPS)-assisted Geo-Augmentation System, or the GPS and Geo-Augmented Navigation system (GAGAN). Accordingly, the satellite positioning systems used herein may include any combination of one or more global navigation satellites and / or regional navigation satellites associated with one or more such satellite positioning systems.

[0052]

[0060] In one embodiment, SV112 may, additionally or alternatively, be part of one or more non-terrestrial networks (NTNs). In an NTN, SV112 is connected to an earth station (also called a ground station, NTN gateway, or gateway), which is then connected to an element in the 5G network, such as a modified base station 102 (without a terrestrial antenna) or a network node in 5GC. This element then provides access to other elements in the 5G network, and ultimately to entities outside the 5G network, such as internet web servers and other user devices. In this way, UE104 may receive communication signals (e.g., signal 124) from SV112 in place of, or in addition to, communication signals from the ground base station 102.

[0053]

[0061] The wireless communication system 100 may further include one or more UEs, such as UE190, which are indirectly connected to one or more communication networks via one or more D2D peer-to-peer (P2P) links (referred to as “sidelinks”). In the example in Figure 1, UE190 has a D2D P2P link 192 with one of the UEs 104 connected to one of the base stations 102 (for example, through which UE190 may indirectly obtain cellular connectivity), and a D2D P2P link 194 with a WLAN STA 152 connected to a WLAN AP 150 (through which UE190 may indirectly obtain WLAN-based internet connectivity). In one example, D2D P2P links 192 and 194 may be supported using any well-known D2D RAT, such as LTE Direct (LTE-D), WI-FI DIRECT®, or BLUETOOTH®.

[0054]

[0062] Figure 2A shows an exemplary wireless network structure 200. For example, 5GC210 (also called Next Generation Core (NGC)) can be functionally considered to have control plane (C-plane) functions 214 (e.g., UE registration, authentication, network access, gateway selection, etc.) and user plane (U-plane) functions 212 (e.g., UE gateway functions, access to data networks, IP routing, etc.) working together to form the core network. User plane interface (NG-U) 213 and control plane interface (NG-C) 215 connect gNB222 to 5GC210, specifically to user plane functions 212 and control plane functions 214, respectively. In an additional configuration, ng-eNB224 may also be connected to 5GC210 via NG-C215 to control plane functions 214 and NG-U213 to user plane functions 212. Furthermore, the ng-eNB224 may communicate directly with the gNB222 via the backhaul connection 223. In some configurations, the Next Generation RAN (NG-RAN) 220 may have one or more gNB222s, while other configurations may include one or more of both the ng-eNB224 and the gNB222. Either (or both) of the gNB222 or the ng-eNB224 may communicate with one or more UEs 204 (for example, any of the UEs described herein).

[0055]

[0063] Another optional configuration may include a location server 230, which may communicate with the 5GC210 to provide location assistance to one or more UEs 204. The location server 230 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules across multiple physical servers, etc.), or alternatively, each may correspond to a single server. The location server 230 may be configured to support one or more location services for UEs 204 that can connect to the location server 230 via the core network, the 5GC210, and / or the internet (not shown). Furthermore, the location server 230 may be integrated into the core network components, or alternatively, be located outside the core network (e.g., a third-party server, such as an original equipment manufacturer (OEM) server or service server).

[0056]

[0064] Figure 2B shows another exemplary wireless network structure 240. 5GC260 (which may correspond to 5GC210 in Figure 2A) can be functionally considered as a control plane function provided by an access and mobility management function (AMF) 264, and a user plane function provided by a user plane function (UPF) 262, working collaboratively to form the core network (i.e., 5GC260). The functions of AMF264 include registration management, connection management, reachability management, mobility management, lawful interception, transport for session management (SM) messages between one or more UE204 (e.g., any of the UEs described herein) and session management function (SMF)266, transparent proxy service for routing SM messages, access authentication and access permission, transport for short message service (SMS) messages between UE204 and short message service function (SMSF) (not shown), and security anchor functionality (SEAF). AMF264 also interacts with authentication server function (AUSF) (not shown) and UE204 and receives intermediate keys established as a result of the UE204 authentication process. In the case of authentication based on UMTS (Universal Mobile Telecommunications System) subscriber identity module (USIM), AMF264 retrieves security material from AUSF. The AMF264's functionality also includes security context management (SCM).The SCM receives keys from the SEAF that the SCM uses to derive access network-specific keys. The AMF264's functions also include location service management for regulatory services, transport for location service messages between the UE204 and the Location Management Function (LMF) 270 (acting as the location server 230), transport for location service messages between the NG-RAN 220 and the LMF270, EPS bearer identifier assignment for interacting with the evolved packet system (EPS), and UE204 mobility event notification. In addition, the AMF264 also supports functions for non-3GPP® (Third Generation Partnership Project) access networks.

[0057]

[0065] The functions of UPF262 include (when applicable) acting as an anchor point for intra-RAT / inter-RAT mobility, acting as an external protocol data unit (PDU) session point for interconnection to a data network (not shown), routing and forwarding packets, packet inspection, user plane policy rule enforcement (e.g., gating, redirection, traffic steering), lawful interception (user plane collection), traffic usage reporting, quality of service (QoS) processing for the user plane (e.g., uplink / downlink rate enforcement, reflective QoS marking on the downlink), uplink traffic verification (mapping service data flow (SDF) to QoS flow), transport-level packet marking on the uplink and downlink, providing downlink packet buffering and downlink data notification triggering, and sending and forwarding one or more “end markers” to the source RAN node. UPF262 may also support the forwarding of location service messages on the user plane between UE204 and location servers such as SLP272.

[0058]

[0066] The functions of the SMF266 ​​include session management, UE Internet Protocol (IP) address assignment and management, selection and control of user plane functions, configuration of traffic steering in the UPF262 for routing traffic to appropriate destinations, some control over policy enforcement and QoS, and downlink data notification. The interface through which the SMF266 ​​communicates with the AMF264 is called the N11 interface.

[0059]

[0067] Another optional embodiment may include an LMF270 that may communicate with the 5GC260 to provide location assistance to the UE204. The LMF270 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules across multiple physical servers, etc.), or alternatively, each may correspond to a single server. The LMF270 can be configured to support one or more location services for the UE204, which can connect to the LMF270 via the core network, the 5GC260, and / or via the internet (not shown). The SLP272 may support similar functionality to the LMF270, while the LMF270 can communicate with the AMF264, NG-RAN220, and UE204 via the control plane (e.g., using interfaces and protocols intended to transmit signaling messages rather than voice or data), while the SLP272 can communicate with the UE204 and external clients (e.g., third-party server 274) via the user plane (e.g., using the transmission control protocol (TCP) and / or protocols intended to carry voice and / or data, such as IP).

[0060]

[0068] Another optional aspect may include a third-party server 274 that may communicate with the LMF270, SLP272, 5GC260 (e.g., via the AMF264 and / or UPF262), NG-RAN220, and / or UE204 to obtain location information about the UE204 (e.g., location estimates). Thus, in some cases, the third-party server 274 may be referred to as a location service (LCS) client or external client. The third-party server 274 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules across multiple physical servers, etc.), or alternatively, each may correspond to a single server.

[0061]

[0069] The user plane interface 263 and the control plane interface 265 connect the 5GC260, specifically the UPF262 and AMF264, to one or more gNB222 and / or ng-eNB224 in the NG-RAN220, respectively. The interface between the gNB(single or multiple)222 and / or ng-eNB(single or multiple)224 and the AMF264 is called the "N2" interface, and the interface between the gNB(single or multiple)222 and / or ng-eNB(single or multiple)224 and the UPF262 is called the "N3" interface. The gNB(single or multiple)222 and / or ng-eNB(single or multiple)224 in the NG-RAN220 can communicate directly with each other via a backhaul connection 223 called the "Xn-C" interface. One or more of the gNB222 and / or ng-eNB224 may communicate with one or more UE204s via a wireless interface called the "Uu" interface.

[0062]

[0070] The functions of gNB222 can be divided among a gNB central unit (gNB-CU) 226, one or more gNB distributed units (gNB-DUs) 228, and one or more gNB radio units (gNB-RUs) 229. The gNB-CU 226 is a logical node that includes base station functions such as forwarding user data, mobility control, radio access network sharing, positioning, and session management, except for those functions which are exclusively assigned to the gNB-DU(s) 228. More specifically, the gNB-CU 226 generally hosts the radio resource control (RRC), service data adaptation protocol (SDAP), and packet data convergence protocol (PDCP) protocols of gNB222. The gNB-DU228 is a logical node that generally hosts the radio link control (RLC) and medium access control (MAC) layers of the gNB222. Its operation is controlled by the gNB-CU226. A single gNB-DU228 can support one or more cells, and one cell is supported by only one gNB-DU228. The interface 232 between the gNB-CU226 and one or more gNB-DU228s is called the "F1" interface. The physical (PHY) layer functions of the gNB222 are generally hosted by one or more standalone gNB-RU229s that perform functions such as power amplification and signal transmission / reception. The interface between the gNB-DU228 and the gNB-RU229 is called the "Fx" interface. Therefore, UE204 communicates with gNB-CU226 via the RRC, SDAP, and PDCP layers, with gNB-DU228 via the RLC and MAC layers, and with gNB-RU229 via the PHY layer.

[0063]

[0071] The deployment of communication systems such as 5G NR systems can be arranged in multiple ways using various components or parts. In a 5G NR system or network, network nodes, network entities, network mobility elements, RAN nodes, core network nodes, network elements, or network equipment, such as base stations or one or more units (or one or more components) that perform base station functions, can be implemented in an aggregated or unaggregated architecture. For example, a base station (Node B (NB), advanced NB (eNB), NR base station, 5G NB, access point (AP), transceiver point (TRP), or cell, etc.) can be implemented as an aggregated base station (also known as a standalone base station or a monolithic base station) or an unaggregated base station.

[0064]

[0072] Aggregated base stations may be configured to utilize a radio protocol stack that is physically or logically integrated within a single RAN node. Non-aggregated base stations may be configured to utilize a protocol stack that is physically or logically distributed among two or more units (such as one or more centralized units (CUs), one or more distributed units (DUs), or one or more radio units (RUs)). In some embodiments, CUs may be implemented within a RAN node, and one or more DUs may be co-located with CUs or, alternatively, geographically or virtually distributed across one or more other RAN nodes. DUs may be implemented to communicate with one or more RUs. Each of CUs, DUs, and RUs may also be implemented as a virtual unit, i.e., a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU).

[0065]

[0073] The operation or network design of a base station type may take into account the aggregation characteristics of the base station functionality. For example, non-aggregated base stations can be used in integrated access backhaul (IAB) networks, open radio access networks (O-RAN (such as network configurations supported by the O-RAN ALLIANCE®)), or virtualized radio access networks (vRAN, also known as cloud radio access networks (C-RAN)). Non-aggregated configurations may include distributing functionality across two or more units in various physical locations, and virtually distributing the functionality of at least one unit, which can allow for flexibility in network design. Various units of a non-aggregated base station, or a non-aggregated RAN architecture, can be configured for wired or wireless communication with at least one other unit.

[0066]

[0074] Figure 2C shows an exemplary unaggregated base station architecture 250 according to an aspect of the present disclosure. The unaggregated base station architecture 250 may include one or more central units (CUs) 280 (e.g., gNB-CU226) that can communicate directly with the core network 267 (e.g., 5GC210, 5GC260) via backhaul links, or indirectly with the core network 267 through one or more unaggregated base station units (e.g., a Near-Real Time (Near-RT) RAN Intelligent Controller (RIC) 259 via an E2 link, or a Non-Real Time (Non-RT) RIC 257 associated with a Service Management and Orchestration (SMO) framework 255, or both). The CU 280 may communicate with one or more DU 285 (e.g., gNB-DU228) via their respective midhaul links, such as an F1 interface. The DU285 may communicate with one or more radio units (RUs) 287 (e.g., gNB-RU229) via their respective fronthaul links. The RU287 may communicate with their respective UE204s via one or more radio frequency (RF) access links. In some implementations, the UE204 may be serviced simultaneously by multiple RU287s.

[0067]

[0075] Each of the units, namely CU280, DU285, RU287, and the quasi-RT RIC259, non-RT RIC257, and SMO framework 255, may include, or be coupled to, one or more interfaces configured to receive or transmit signals, data, or information (collectively, signals) via a wired or wireless transmission medium. Each of the units, or an associated processor or controller providing instructions to the unit's communication interface, may be configured to communicate with one or more other units via a transmission medium. For example, a unit may include a wired interface configured to receive signals from or transmit signals to one or more other units via a wired transmission medium. In addition, a unit may include a wireless interface which may include a receiver, transmitter, or transceiver (such as an RF transceiver) configured to receive signals from or transmit signals to one or more other units, or both, via a wireless transmission medium.

[0068]

[0076] In some embodiments, the CU280 may host one or more higher-layer control functions. Such control functions may include RRC, PDCP, Service Data Adaptive Protocol (SDAP), etc. Each control function may be implemented using an interface configured to communicate signals with other control functions hosted by the CU280. The CU280 may be configured to handle user plane functions (i.e., Central Unit-User Plane (CU-UP)), control plane functions (i.e., Central Unit-Control Plane (CU-CP)), or a combination thereof. In some implementations, the CU280 may be logically divided into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RAN configuration, the CU-UP units may communicate bidirectionally with the CU-CP units via an interface such as the E1 interface. The CU280 may be implemented to communicate with the DU285 as needed for network control and signaling.

[0069]

[0077] The DU285 may correspond to a logic unit containing one or more base station functions for controlling the operation of one or more RU287s. In some embodiments, the DU285 may host one or more of the RLC layer, MAC layer, and one or more upper PHY layers (such as modules related to forward error correction (FEC) coding and decoding, scrambling, modulation and demodulation, etc.), at least in part according to a functional decomposition such as that defined by the 3rd Generation Partnership Project (3GPP®). In some embodiments, the DU285 may further host one or more lower PHY layers. Each layer (or module) may be implemented using an interface configured to communicate signals with other layers (and modules) hosted by the DU285, or with control functions hosted by the CU280.

[0070]

[0078] Lower-layer functions can be implemented by one or more RU287s. In some deployments, RU287s controlled by DU285s may correspond to logical nodes hosting RF processing functions, or lower PHY layer functions (such as performing fast Fourier transform (FFT), inverse FFT (iFFT), digital beamforming, physical random access channel (PRACH) extraction and filtering, etc.), or both, at least partially based on functional decomposition such as lower-layer functional decomposition. In such architectures, RU(s)287s can be implemented to handle over-the-air (OTA) communication with one or more UE204s. In some implementations, real-time and non-real-time modes of control plane communication and user plane communication with RU(s)287s can be controlled by the corresponding DU285s. In some scenarios, this configuration can enable the DU(singular or plural)285 and CU280 to be implemented in cloud-based RAN architectures such as vRAN architectures.

[0071]

[0079] The SMO framework 255 may be configured to support RAN deployment and provisioning of non-virtualized and virtualized network elements. For non-virtualized network elements, the SMO framework 255 may be configured to support the deployment of dedicated physical resources for RAN coverage requirements, which can be managed via operational and maintenance interfaces (such as the O1 interface). For virtualized network elements, the SMO framework 255 may be configured to interact with a cloud computing platform (such as the Open Cloud (O-Cloud) 269) to perform network element lifecycle management (such as instantiating virtualized network elements) via a cloud computing platform interface (such as the O2 interface). Such virtualized network elements may include, but are not limited to, the CU280, DU285, RU287, and quasi-RT RIC259. In some implementations, the SMO framework 255 can communicate with hardware embodiments of the 4G RAN, such as the Open eNB (O-eNB) 261, via the O1 interface. In addition, in some implementations, the SMO framework 255 can communicate directly with one or more RU287s via the O1 interface. The SMO framework 255 may also include non-RT RIC257s configured to support the functionality of the SMO framework 255.

[0072]

[0080] Non-RT RIC257 may be configured to include logical functions that enable non-real-time control and optimization of RAN elements and resources, including artificial intelligence / machine learning (AI / ML) workflows, model training and updating, or policy-based guidance for applications / features in quasi-RT RIC259. Non-RT RIC257 may be coupled to or communicate with quasi-RT RIC259 (e.g., via the A1 interface). Quasi-RT RIC259 may be configured to include logical functions that enable quasi-real-time control and optimization of RAN elements and resources via data acquisition and actions through an interface connecting to quasi-RT RIC259 (e.g., via the E2 interface), including one or more CU280s, one or more DU285s, or both, and an O-eNB, via an interface connecting to quasi-RT RIC259 (e.g., via the E2 interface).

[0073]

[0081] In some implementations, non-RT RIC257 may receive parameters or external enrichment information from an external server to generate AI / ML models deployed in quasi-RT RIC259. Such information may be utilized by quasi-RT RIC259 and may be received from non-network data sources or network functions in the SMO framework 255 or non-RT RIC257. In some examples, non-RT RIC257 or quasi-RT RIC259 may be configured to tune RAN behavior or performance. For example, non-RT RIC257 may monitor long-term trends and patterns in performance and employ AI / ML models to take corrective action through the SMO framework 255 (e.g., reconfiguration via O1) or through the creation of RAN management policies (e.g., A1 policies).

[0074]

[0082] Figures 3A, 3B, and 3C show several exemplary components (represented by corresponding blocks) that may be incorporated into UE302 (which may correspond to any of the UEs described herein), base station 304 (which may correspond to any of the base stations described herein), and network entity 306 (which may correspond to or embody any of the network functions described herein, including location server 230 and LMF270, or alternatively, may be independent of the NG-RAN220 and / or 5GC210 / 260 infrastructure depicted in Figures 2A and 2B, such as a private network) to support the operations described herein. It will be understood that these components may be implemented in different types of devices in different implementation forms (e.g., within an ASIC, within a system-on-chip (SoC), etc.). The components shown may also be incorporated into other devices in the communication system. For example, other devices in the system may include components similar to those described to provide similar functionality. Also, a given device may include one or more of the components. For example, the device may include multiple transceiver components that enable the device to operate on multiple carriers and / or communicate via different technologies.

[0075]

[0083] UE 302 and base station 304 each include one or more wireless wide area network (WWAN) transceivers 310 and 350, respectively, providing means (e.g., means for transmitting, means for receiving, means for measuring, means for tuning, means for refraining from transmitting, etc.) for communicating over one or more wireless communication networks (not shown), such as NR networks, LTE networks, and GSM networks. WWAN transceivers 310 and 350 may each be connected to one or more antennas 316 and 356, respectively, for communicating with other network nodes, such as other UEs, access points, and base stations (e.g., eNBs, gNBs), over at least one designated RAT (e.g., NR, LTE, GSM, etc.) over a target wireless communication medium (e.g., some set of time / frequency resources in a particular frequency spectrum). The WWAN transceivers 310 and 350 can be configured in various ways to transmit and encode signals 318 and 358 (e.g., messages, instructions, information, etc.), respectively, and conversely, to receive and decode signals 318 and 358 (e.g., messages, indications, information, pilots, etc.), respectively, according to a specified RAT. Specifically, the WWAN transceivers 310 and 350 include one or more transmitters 314 and 354, respectively, for transmitting and encoding signals 318 and 358, respectively, and one or more receivers 312 and 352, respectively, for receiving and decoding signals 318 and 358, respectively.

[0076]

[0084] Each UE 302 and base station 304 also includes, in at least some cases, one or more short-range wireless transceivers 320 and 360, respectively. The short-range wireless transceivers 320 and 360 may be connected to one or more antennas 326 and 366, respectively, and may provide means for communicating with other network nodes such as other UEs, access points, and base stations via at least one designated RAT (e.g., Wi-Fi, LTE-Direct, BLUETOOTH®, ZIGBEE®, Z-WAVE®, PC5, dedicated short-range communications (DSRC), wireless access for vehicular environments (WAVE), near-field communication (NFC), ultra-wideband (UWB), etc.) via the wireless communication medium of interest (e.g., means for transmitting, means for receiving, means for measuring, means for tuning, means for refraining from transmitting, etc.). The short-range wireless transceivers 320 and 360 can be configured in various ways to transmit and encode signals 328 and 368 (e.g., messages, instructions, information, etc.), respectively, according to a specified RAT, and conversely, to receive and decode signals 328 and 368 (e.g., messages, indications, information, pilots, etc.), respectively. Specifically, the short-range wireless transceivers 320 and 360 include one or more transmitters 324 and 364, respectively, for transmitting and encoding signals 328 and 368, respectively, and one or more receivers 322 and 362, respectively, for receiving and decoding signals 328 and 368, respectively. For example, the short-range wireless transceivers 320 and 360 may be Wi-Fi transceivers, BLUETOOTH® transceivers, ZIGBEE® and / or Z-WAVE® transceivers, NFC transceivers, UWB transceivers, or vehicle-to-vehicle (V2V) and / or vehicle-to-everything (V2X) transceivers.

[0077]

[0085] UE302 and base station 304 also include, in at least some cases, satellite signal receivers 330 and 370. Satellite signal receivers 330 and 370 may be connected to one or more antennas 336 and 376, respectively, and may provide means for receiving and / or measuring satellite positioning / communication signals 338 and 378, respectively. If satellite signal receivers 330 and 370 are satellite positioning system receivers, the satellite positioning / communication signals 338 and 378 may be Global Positioning System (GPS) signals, Global Navigation Satellite System (GLONASS®) signals, Galileo signals, Beidou signals, Indian Regional Navigation Satellite System (NAVIC), Quasi-Zenith Satellite System (QZSS), etc. If satellite signal receivers 330 and 370 are non-terrestrial network (NTN) receivers, satellite positioning / communication signals 338 and 378 may be communication signals originating from the 5G network (e.g., carrying control and / or user data). Satellite signal receivers 330 and 370 may include any suitable hardware and / or software for receiving and processing satellite positioning / communication signals 338 and 378, respectively. Satellite signal receivers 330 and 370 may, as necessary, request information and actions from other systems and, in at least some cases, perform calculations using acquired measurements to determine the locations of UE 302 and base station 304, respectively, using any suitable satellite positioning system algorithm.

[0078]

[0086] Each base station 304 and network entity 306 each include one or more network transceivers 380 and 390, respectively, which provide means (e.g., means for transmitting, means for receiving, etc.) for communicating with other network entities (e.g., other base stations 304, other network entities 306). For example, base station 304 may employ one or more network transceivers 380 for communicating with other base stations 304 or network entities 306 via one or more wired or wireless backhaul links. As another example, network entity 306 may employ one or more network transceivers 390 for communicating with one or more base stations 304 via one or more wired or wireless backhaul links, or with other network entities 306 via one or more wired or wireless core network interfaces.

[0079]

[0087] Transceivers may be configured to communicate via a wired or wireless link. A transceiver (whether wired or wireless) includes a transmitter circuit configuration (e.g., transmitters 314, 324, 354, 364) and a receiver circuit configuration (e.g., receivers 312, 322, 352, 362). In some implementations, a transceiver may be an integrated device (e.g., embodying the transmitter and receiver circuit configurations within a single device), in some implementations it may have separate transmitter and receiver circuit configurations, or in other implementations it may be embodied in other ways. The transmitter and receiver circuit configurations of a wired transceiver (e.g., network transceivers 380 and 390 in some implementations) may be coupled to one or more wired network interface ports. A wireless transmitter circuit configuration (e.g., transmitters 314, 324, 354, 364) may include, or be coupled to, multiple antennas (e.g., antennas 316, 326, 356, 366), such as an antenna array, enabling each device (e.g., UE 302, base station 304) to perform transmit beamforming. Similarly, a wireless receiver circuit configuration (e.g., receivers 312, 322, 352, 362) may include, or be coupled to, multiple antennas (e.g., antennas 316, 326, 356, 366), such as an antenna array, enabling each device (e.g., UE 302, base station 304) to perform receive beamforming. In one embodiment, the transmitter and receiver circuit configurations may share multiple identical antennas (e.g., antennas 316, 326, 356, 366), such that each device can either receive or transmit only at a given time, but not both at the same time. Wireless transceivers (e.g., WWAN transceivers 310 and 350, short-range wireless transceivers 320 and 360) may also include network listen modules (NLMs) for performing various measurements.

[0080]

[0088] The various wireless transceivers used herein (e.g., transceivers 310, 320, 350, and 360 in some implementations, and network transceivers 380 and 390) and wired transceivers (e.g., network transceivers 380 and 390 in some implementations) may generally be characterized as “transceivers,” “at least one transceiver,” or “one or more transceivers.” Thus, whether a particular transceiver is a wired transceiver or a wireless transceiver can be inferred from the type of communication being performed. For example, backhaul communication between network devices or servers generally involves signaling via wired transceivers, while wireless communication between a UE (e.g., UE 302) and a base station (e.g., base station 304) generally involves signaling via wireless transceivers.

[0081]

[0089] UE302, base station 304, and network entity 306 also include other components that may be used in conjunction with the operations disclosed herein. UE302, base station 304, and network entity 306 each include one or more processors 332, 384, and 394, for example, to provide functions related to wireless communication and other processing functions. Thus, processors 332, 384, and 394 may provide processing means such as means for determining, means for calculating, means for receiving, means for transmitting, and means for directing. In one embodiment, processors 332, 384, and 394 may include, for example, one or more general-purpose processors, multicore processors, central processing units (CPUs), ASICs, digital signal processors (DSPs), field programmable gate arrays (FPGAs), other programmable logic devices or processing circuits, or various combinations thereof.

[0082]

[0090] The UE302, base station 304, and network entity 306 include memory circuit configurations that implement memories 340, 386, and 396, respectively (for example, each including a memory device), to maintain information (for example, information indicating reserved resources, thresholds, parameters, etc.). Thus, memories 340, 386, and 396 may provide means for storing, retrieving, maintaining, etc. In some cases, the UE302, base station 304, and network entity 306 may include security components 342, 388, and 398, respectively. The security components 342, 388, and 398 may be part of or coupled to the processors 332, 384, and 394, respectively, and the hardware circuits, when executed, cause the UE302, base station 304, and network entity 306 to perform the functions described herein. In other embodiments, security components 342, 388, and 398 may be external to processors 332, 384, and 394 (e.g., being part of a modem processing system, or integrated with another processing system). Alternatively, security components 342, 388, and 398 may be memory modules stored in memory 340, 386, and 396, respectively, which, when executed by processors 332, 384, and 394 (or a modem processing system, another processing system, etc.), cause the UE 302, base station 304, and network entity 306 to perform the functions described herein. Figure 3A shows possible locations for security component 342, which may be part of, for example, one or more WWAN transceivers 310, memory 340, one or more processors 332, or any combination thereof, or may be a standalone component. Figure 3B shows possible locations for the security component 388, which may be part of, for example, one or more WWAN transceivers 350, memory 386, one or more processors 384, or any combination thereof, or may be a standalone component.Figure 3C shows possible locations for the security component 398, which may be part of, for example, one or more network transceivers 390, memory 396, one or more processors 394, or any combination thereof, or it may be a standalone component.

[0083]

[0091] UE302 may include one or more sensors 344 coupled to one or more processors 332 to provide means for sensing or detecting motion and / or orientation information that is independent of motion data derived from signals received by one or more WWAN transceivers 310, one or more short-range wireless transceivers 320, and / or satellite signal receivers 330. For example, one or more sensors 344 may include accelerometers (e.g., micro-electrical mechanical systems, MEMS devices), gyroscopes, geomagnetic sensors (e.g., compasses), altimeters (e.g., barometric altimeters), and / or any other type of motion-sensing sensor. Furthermore, one or more sensors 344 may include multiple different types of devices, and their outputs may be combined to provide motion information. For example, a sensor(s) 344 may use a combination of a multi-axis accelerometer and an orientation sensor to provide the ability to calculate position in a two-dimensional (2D) and / or three-dimensional (3D) coordinate system.

[0084]

[0092] In addition, UE302 includes a user interface 346 that provides means for providing instructions to the user (e.g., audible and / or visual instructions) and / or for receiving user input (e.g., when a user activates a sensing device such as a keypad, touchscreen, or microphone). Although not shown, the base station 304 and the network entity 306 may also include user interfaces.

[0085]

[0093] Referring more specifically to one or more processors 384, in the downlink, IP packets from network entity 306 may be provided to processor 384. One or more processors 384 may implement functions for the RRC layer, Packet Data Convergence Protocol (PDCP) layer, Radio Link Control (RLC) layer, and Medium Access Control (MAC) layer. One or more processors 384 may provide RRC layer functions associated with broadcasting system information (e.g., master information blocks (MIBs), system information blocks (SIBs)), RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection correction, and RRC connection release), inter-RAT mobility, and measurement configuration for UE measurement reporting; PDCP layer functions associated with header compression / decompression, security (encryption, decryption, integrity protection, integrity verification), and handover support functions; RLC layer functions associated with forwarding upper layer PDUs, error correction by automatic repeat request (ARQ), concatenation, segmentation, and reassembly of RLC service data units (SDUs), resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functions associated with mapping between logical channels and transport channels, scheduling information reporting, error correction, priority processing, and logical channel prioritization.

[0086]

[0094] The transmitter 354 and receiver 352 may implement Layer-1 (L1) functions associated with various signal processing functions. Layer 1, including the physical (PHY) layer, may include error detection on the transport channel, forward error correction (FEC) coding / decoding of the transport channel, interleaving, rate matching, mapping to the physical channel, modulation / demodulation of the physical channel, and MIMO antenna processing. The transmitter 354 handles mapping to signal constellations based on various modulation schemes (e.g., binary phase-shift keying (BPSK), quadrature phase-shift keying (QPSK), M-phase-shift keying (M-PSK), M-quadrature amplitude modulation (M-QAM)). The coded and modulated symbols can then be divided into parallel streams. Each stream can then be mapped to an orthogonal frequency division multiplexing (OFDM) subcarrier, multiplexed with a reference signal (e.g., a pilot) in the time and / or frequency domain, and then synthesized together using an inverse fast Fourier transform (IFFT) to generate a physical channel that carries a time-domain OFDM symbol stream. The OFDM symbol stream is spatially precoded to generate multiple spatial streams. Channel estimates from a channel estimator can be used to determine the coding and modulation scheme, as well as for spatial processing. Channel estimates can be derived from the reference signal and / or channel state feedback transmitted by UE302. Each spatial stream can then be supplied to one or more different antennas 356. Transmitter 354 can modulate RF carriers using each spatial stream for transmission.

[0087]

[0095] In UE302, receiver 312 receives signals through its respective antenna(s) 316. Receiver 312 reconstructs the information modulated on the RF carrier and provides this information to one or more processors 332. Transmitter 314 and receiver 312 implement Layer 1 functions associated with various signal processing functions. Receiver 312 may perform spatial processing on the information to reconstruct any spatial stream directed to UE302. If multiple spatial streams are directed to UE302, they can be combined into a single OFDM symbol stream by receiver 312. Receiver 312 then uses a Fast Fourier Transform (FFT) to convert the OFDM symbol stream from the time domain to the frequency domain. The frequency domain signal contains a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols on each subcarrier, and the reference signal, are reconstructed and demodulated by determining the most likely signal constellation point transmitted by base station 304. These soft decisions may be based on channel estimates calculated by a channel estimator. Next, the soft decision is decoded and deinterleaved to recover the data and control signals initially transmitted by the base station 304 on the physical channel. The data and control signals are then provided to one or more processors 332 implementing Layer 3 (L3) and Layer 2 (L2) functions.

[0088]

[0096] In the downlink, one or more processors 332 provide demultiplexing between transport and logical channels, packet reassembly, decoding, header decompression, and control signal processing to reconstruct IP packets from the core network. One or more processors 332 are also responsible for error detection.

[0089]

[0097] Similar to the functions described in relation to downlink transmission by base station 304, one or more processors 332 provide RRC layer functions associated with system information (e.g., MIB, SIB) acquisition, RRC connection, and measurement reporting; PDCP layer functions associated with header compression / decompression and security (encryption, decryption, integrity protection, integrity verification); RLC layer functions associated with forwarding upper layer PDUs, error correction by ARQ, concatenation, segmentation, and reassembly of RLC SDUs, resegmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functions associated with mapping between logical channels and transport channels, multiplexing MAC SDUs onto transport blocks (TBs), demultiplexing MAC SDUs from TBs, scheduling information reporting, error correction by hybrid automatic repeat request (HARQ), priority processing, and logical channel prioritization.

[0090]

[0098] The channel estimate derived by the channel estimator from the reference signal or feedback transmitted by the base station 304 may be used by the transmitter 314 to select an appropriate coding and modulation scheme and to facilitate spatial processing. The spatial streams generated by the transmitter 314 may be supplied to different antennas 316. The transmitter 314 may modulate the RF carrier using each spatial stream for transmission.

[0091]

[0099] Uplink transmissions are processed at base station 304 in a manner similar to that described in relation to the receiver function in UE302. Receiver 352 receives the signal through its respective antenna(s) 356. Receiver 352 reconstructs the information modulated on the RF carrier and provides this information to one or more processors 384.

[0092]

[0100] In the uplink, one or more processors 384 provide demultiplexing between transport and logical channels, packet reassembly, decoding, header decompression, and control signal processing to reconstruct IP packets from the UE302. IP packets from one or more processors 384 can then be supplied to the core network. One or more processors 384 are also responsible for error detection.

[0093]

[0101] For convenience, the UE302, base station 304, and / or network entity 306 are shown in Figures 3A, 3B, and 3C as including various components that may be configured according to the various examples described herein. However, it should be understood that the components shown may have different functions in different designs. In detail, the various components in Figures 3A–3C are optional in alternative configurations, and the various embodiments include configurations that may vary due to design choices, cost, device usage, or other considerations. For example, in Figure 3A, a particular implementation of UE302 may omit the WWAN transceiver(s) 310 (for example, a wearable device, tablet computer, personal computer (PC), or laptop may have Wi-Fi and / or Bluetooth® capabilities without cellular capabilities), or the short-range wireless transceiver(s) 320 (for example, cellular only), or the satellite signal receiver(s) 330, or the sensor(s) 344, etc. Another example is in Figure 3B, where a particular implementation of base station(s) 304 may omit the WWAN transceiver(s) 350 (for example, a Wi-Fi "hotspot" access point without cellular capabilities), or the short-range wireless transceiver(s) 360 (for example, cellular only), or the satellite signal receiver(s) 370, etc. For the sake of brevity, examples of various alternative configurations are not provided herein, but they should be readily apparent to those skilled in the art.

[0094]

[0102] Various components of UE302, base station 304, and network entity 306 can be coupled to communicate with one another via data buses 334, 382, ​​and 392, respectively. In one embodiment, data buses 334, 382, ​​and 392 may form or be part of the communication interfaces of UE302, base station 304, and network entity 306, respectively. For example, if different logical entities are embodied within the same device (e.g., gNB and location server functions are integrated within the same base station 304), data buses 334, 382, ​​and 392 may provide communication between them.

[0095]

[0103] The components in Figures 3A, 3B, and 3C can be implemented in various ways. In some implementations, the components in Figures 3A, 3B, and 3C can be implemented in one or more circuits, such as one or more processors and / or one or more ASICs (which may include one or more processors). Here, each circuit may use and / or incorporate at least one memory component for storing information or executable code used by the circuit to provide this functionality. For example, some or all of the functionality represented by blocks 310-346 may be implemented by the processor and memory components (one or more) of UE302 (for example, by the execution of appropriate code and / or by the appropriate configuration of the processor components). Similarly, some or all of the functionality represented by blocks 350-388 may be implemented by the processor and memory components (one or more) of base station 304 (for example, by the execution of appropriate code and / or by the appropriate configuration of the processor components). Furthermore, some or all of the functions represented by blocks 390-398 may be implemented by the processor and memory components (one or more) of the network entity 306 (for example, by the execution of appropriate code and / or by the appropriate configuration of processor components). For simplicity, various operations, actions, and / or functions are described herein as being performed “by the UE,” “by the base station,” “by the network entity,” etc. However, as should be understood, such operations, actions, and / or functions may actually be performed by specific components or combinations of components such as the UE 302, base station 304, and network entity 306, including processors 332, 384, 394, transceivers 310, 320, 350, and 360, memories 340, 386, and 396, security components 342, 388, and 398.

[0096]

[0104] In some designs, network entity 306 may be implemented as a core network component. In other designs, network entity 306 may be separate from the network operator or operation of the cellular network infrastructure (e.g., NG RAN220 and / or 5GC210 / 260). For example, network entity 306 may be a component of a private network that communicates with UE302 via base station 304, or it may be configured independently of base station 304 (e.g., via a non-cellular communication link such as Wi-Fi).

[0097]

[0105] NR supports several cellular network-based positioning techniques, including downlink-based positioning methods, uplink-based positioning methods, and downlink and uplink-based positioning methods. Downlink-based positioning methods include observed time difference of arrival (OTDOA) in LTE, downlink time difference of arrival (DL-TDOA) in NR, and downlink angle-of-departure (DL-AoD) in NR. Figure 4 shows examples of various positioning methods according to aspects of this disclosure. In the OTDOA or DL-TDOA positioning procedure shown by Scenario 410, the UE measures the difference between times of arrival (ToAs) of a reference signal (e.g., positioning reference signal (PRS)) received from a pair of base stations, called reference signal time difference (RSTD) measurements or time difference of arrival (TDOA) measurements, and reports them to the positioning entity. More specifically, the UE receives identifiers (IDs) of a reference base station (e.g., a serving base station) and several non-reference base stations in the support data. The UE then measures the RSTD between each of the reference base station and the non-reference base stations. Based on the known locations of the involved base stations and the RSTD measurements, a positioning entity (e.g., the UE in the case of UE-based positioning, or a location server in the case of UE-assisted positioning) can estimate the location of the UE.

[0098]

[0106] In DL-AoD positioning as shown in Scenario 420, the positioning entity uses measurement reports from the UE of received signal intensity measurements of multiple downlink transmit beams to determine the angle(s) between the UE and the transmitting base station(s). The positioning entity can then estimate the location of the UE based on the determined angle(s) and the known location(s) of the transmitting base station(s).

[0099]

[0107] Uplink-based positioning methods include uplink time difference of arrival (UL-TDOA) and uplink angle-of-arrival (UL-AoA). UL-TDOA is similar to DL-TDOA but is based on uplink reference signals (e.g., sounding reference signals (SRS)) transmitted by the UE to multiple base stations. Specifically, the UE transmits one or more uplink reference signals measured by a reference base station and multiple non-reference base stations. Each base station then reports the reception time of the reference signal(s) (called relative time of arrival, RTOA) to a positioning entity (e.g., a location server) that knows the locations and relative timings of the involved base stations. Based on the reception-to-reception (Rx-Rx) time difference between the reference base station's reported RTOA and each non-reference base station's reported RTOA, the known locations of the base stations, and their known timing offsets, the positioning entity can use TDOA to estimate the UE's location.

[0100]

[0108] In UL-AoA positioning, one or more base stations measure the received signal strength of one or more uplink reference signals (e.g., SRS) received from the UE on one or more uplink receive beams. The positioning entity uses the signal strength measurements and the angles(single or multiple) of the received beams(single or multiple) to determine the angles(single or multiple) between the UE and the base station(s). Based on the determined angles(single or multiple) and the known locations(single or multiple) of the base stations(s), the positioning entity can then estimate the location of the UE.

[0101]

[0109] Downlink and uplink-based positioning methods include enhanced cell-ID (E-CID) positioning and multi-round-trip-time (RTT) positioning (also known as "multi-cell RTT" and "multi-RTT"). In the RTT procedure, a first entity (e.g., a base station or UE) transmits a first RTT-related signal (e.g., a PRS or SRS) to a second entity (e.g., a UE or base station), and the second entity transmits a second RTT-related signal (e.g., a SRS or PRS) back to the first entity. Each entity measures the time difference between the time to arrival (ToA) of the received RTT-related signal and the transmission time of the transmitted RTT-related signal. This time difference is called the reception-to-transmission (Rx-Tx) time difference. The Rx-Tx time difference measurement may be made to include only the time difference between the nearest slot boundaries for the received and transmitted signals, or it may be adjusted accordingly. Next, both entities may send their Rx-Tx time difference measurements to a location server (e.g., LMF270), which calculates the round-trip propagation time (i.e., RTT) between the two entities from the two Rx-Tx time difference measurements (e.g., as the sum of the two Rx-Tx time difference measurements). Alternatively, one entity may send its Rx-Tx time difference measurement to the other entity, which then calculates the RTT. The distance between the two entities can be determined from the RTT and a known signal speed (e.g., the speed of light). In the case of multi-RTT positioning as shown in Scenario 430, the first entity (e.g., a UE or base station) performs RTT positioning procedures with multiple second entities (e.g., multiple base stations or UEs) to enable the location of the first entity to be determined (e.g., using multilateration) based on the distance to the second entity and the known location of the second entity.As shown in Scenario 440, RTT and multi-RTT methods can be combined with other positioning techniques such as UL-AoA and DL-AoD to improve location accuracy.

[0102]

[0110] The E-CID positioning method is based on radio resource management (RRM) measurements. In E-CID, the UE reports the serving cell ID, timing advance (TA), and the identifier, estimated timing, and signal strength of the detected nearby base station. The UE's location is then estimated based on this information and the known locations of the base station(s).

[0103]

[0111] To support positioning operations, location servers (e.g., location servers 230, LMF270, SLP272) may provide support data to the UE. For example, the support data may include the identifier of the base station (or base station cell / TRP) from which the reference signal will be measured, reference signal configuration parameters (e.g., the number of consecutive slots containing the PRS, the period of the consecutive slots containing the PRS, the muting sequence, the frequency hopping sequence, the reference signal identifier, the reference signal bandwidth, etc.), and / or other parameters applicable to a particular positioning method. Alternatively, the support data may be obtained directly from the base station itself (e.g., in periodically broadcast overhead messages). In some cases, the UE may be able to discover the neighboring network node itself without using support data.

[0104]

[0112] In the case of OTDOA or DL-TDOA positioning procedures, the supporting data may further include the expected RSTD value and the uncertainty associated with the expected RSTD before and after, or the search window. In some cases, the expected RSTD value range may be + / - 500 microseconds (μs). In some cases, when any of the resources used for positioning measurements are in FR1, the value range for the uncertainty of the expected RSTD may be + / - 32 μs. In other cases, when all of the resources used for positioning measurements (one or more) are in FR2, the value range for the uncertainty of the expected RSTD may be + / - 8 μs.

[0105]

[0113] Location estimates may be referred to by other names such as position estimate, location, position, position fix, or fix. Location estimates may be geodetic and include coordinates (e.g., latitude, longitude, and possibly altitude), or urban and include an address, postal address, or some other linguistic description of the location. Location estimates may further be defined for some other known locations, or they may be defined absolutely (e.g., using latitude, longitude, and possibly altitude). Location estimates may include expected errors or uncertainties (e.g., by including an area or volume in which the location is expected to be contained with some specified or default level of confidence).

[0106]

[0114] Hybrid RF and vision-based positioning systems can generate highly reliable location estimates for wireless devices and / or other target objects that can be used by a variety of applications. Furthermore, the visual channel status information (vCSI) available in vision-based positioning systems can be used for various other purposes besides positioning, such as wireless channel prediction.

[0107]

[0115] Figure 5 shows an exemplary hybrid RF and vision-based positioning system 500 according to an aspect of the present disclosure. In the example of Figure 5, the environment includes a plurality of RF devices 504 (labeled "A" through "G") that are within the field of view of a plurality of cameras 506 and within the wireless communication range of a plurality of access points 502. The RF devices 504 may be UEs (e.g., UE104, 204), IoT devices, industrial IoT (IIoT) devices, etc. The RF devices 504 may be attached to or otherwise coupled to other objects (e.g., as in the case of an asset tracker) or standalone devices (e.g., as in the case of a handheld "smartphone"). The cameras 506 may be security cameras and / or cameras of other RF devices such as RF devices 504 and / or access points 502. The access points 502 may be cellular access points such as base station 102 (e.g., ng-eNB, gNB, etc.), Wi-Fi access points such as WLAN AP 150, BLUETOOTH® beacons, etc.

[0108]

[0116] In the hybrid RF and vision-based positioning system 500, the fusion engine 570 (implemented in a location server such as the location server 230 or LMF270) distinguishes three main functional blocks, each providing a different processing function. The first functional block is a vCSI processing block called the vCSI positioning engine 510. The vCSI positioning engine 510 receives and processes vCSI 515, which may include images captured by the camera 506, camera calibration parameters for the camera 506, the location of the camera 506, and so on. The vCSI positioning engine 510 may implement several vision-related processing functions, such as object detection, camera calibration, and target matching.

[0109]

[0117] The second functional block is an RF processing block called the RF positioning engine 520. The RF positioning engine 520 receives RF-based information 525 and can implement functions such as RF-based positioning (an example of which will be explained with reference to Figure 4) and channel estimation.

[0110]

[0118] The third functional block is a hybrid RF and vision block called the hybrid RF / vision positioning engine 530. The hybrid RF / vision positioning engine 530 receives vCSI 515 and RF-based information 525 and / or processed information from the vCSI positioning engine 510 and RF positioning engine 520. The hybrid RF / vision positioning engine 530 manages all functions that require hybrid fusion (hybrid positioning, camera calibration, target matching, etc.). Note that the implementation and function assignment of the blocks may change to adapt to the validity of the new solution.

[0111]

[0119] The promising gains of hybridizing RF and vision for positioning depend on various factors, including information integrity. While many common attacks against RF systems are well known and robustly addressed, the security risks to hybrid RF and vision-based systems are less understood.

[0112]

[0120] More specifically, the integration of vCSI (i.e., acquired from cameras and associated infrastructure) into RF-based systems such as cellular systems (e.g., LTE, NR) and Wi-Fi systems creates several vectors and opportunities for attackers that need to be addressed. In hybrid positioning systems, as illustrated with reference to Figure 5, RF and vCSI complement each other, and information is fused together for various purposes, so an attack on one of the systems can propagate to the other and ultimately jeopardize the operation of the entire hybrid system.

[0113]

[0121] The two main objectives for protecting hybrid RF and vision-based systems are: (1) to identify a set of common security risks and potential attacks that could compromise the information integrity of hybrid interfaces in RF and vision-based positioning systems; and (2) to determine techniques for effectively addressing security risks and potential attacks in hybrid RF and vision-based positioning systems.

[0114]

[0122] Since cameras and vCSI are relatively new additions to positioning fusion efforts, it is important to consider key functions related to the processing of visual information in order to better understand the security implications of such hybridization. Most of the visual processing functions can be classified into the following main functions: (1) image processing, (2) camera calibration, and (3) target association / matching.

[0115]

[0123] Regarding image processing, this is a general umbrella function that encompasses all aspects of image processing, including object detection (e.g., generation of regions of interest, ROIs) and feature extraction. There are two types of implementations: legacy implementations and privacy-protected implementations. In legacy implementations, the camera (e.g., camera 506) sends virtually unchanged images to the fusion center (e.g., fusion engine 570), which then implements all remaining image processing tasks. In privacy-protected implementations, the majority of image processing tasks are performed in the camera, which sends only the necessary information (e.g., bounding boxes associated with detected objects) to the fusion center to protect privacy.

[0116]

[0124] Regarding camera calibration, this function deals with estimating a projection transformation / camera matrix, which is a critical enabler for visual positioning that estimates the world coordinates of a target object (e.g., RF device 504) from the pixel locations on an image (one or more). This function utilizes a set of target objects that are visible within the camera field of view (FoV) and have known world coordinates.

[0117]

[0125] Regarding target association / matching, there are two types of association: image-to-image association and RF device association. Image-to-image association deals with identifying the same target object (indicated by an ROI such as a bounding box) across multiple images. Conventional solutions rely on matching visual features across images. RF device association determines which RF device(s) are included in a given ROI within an image. Typically, RF-based positional features are used to determine the RF device(s).

[0118]

[0126] Both RF and vision-based functional blocks (e.g., the vCSI positioning engine 510 and the RF positioning engine 520) are vulnerable to malicious attacks that could compromise the performance of certain functions. At a high level, this disclosure provides techniques for leveraging the hybrid nature of hybrid RF and vision-based systems to address security threats and attacks by utilizing / exchanging information between different functional blocks. In other words, the proposed techniques rely on information from the vCSI block (e.g., the vCSI positioning engine 510) to determine whether an RF block (e.g., the RF positioning engine 520) has been tampered with, and vice versa.

[0119]

[0127] Accordingly, this disclosure provides two different security frameworks for hybrid RF and vision-based positioning systems. The first framework described herein is a vCSI-assisted security framework for RF-based information integrity. Under this framework, vision information from vCSI is used to determine whether RF-based information, including RF measurements, RF-based side / assistance information (e.g., positioning assistance data for an RF-based positioning session), and RF-based position estimates, has been tampered with. The second framework described herein is an RF device-assisted security framework for vCSI integrity. Under this framework, RF device-based information, including both RF information and vision information from the RF device's camera (if available), is used to determine whether the vCSI processing block (e.g., vCSI positioning engine 510) and associated functions have been tampered with.

[0120]

[0128] Referring to the vCSI-assisted security framework for RF-based information integrity, this framework considers the possibility that RF-based information may be tampered with (e.g., become inaccurate or altered) by various means by a malicious entity / attacker, such as impersonation or man-in-the-middle attacks. Any of the RF-based information, including RF measurements, RF-based side / supporting information (e.g., locations of involved APs(s), base stations(s), anchor nodes(s), etc.), and / or RF-based position estimates of RF devices(s). If RF measurements are tampered with, estimates of distance and / or direction between the RF device and the involved APs(s), base stations(s), anchor nodes(s), etc., may be tampered with. RF-based position estimates may be tampered with directly or through tampered RF measurements and / or tampered side / supporting information.

[0121]

[0129] The classification of possible attack vectors includes tampering with RF measurements, tampering with RF-based side / supporting data, and tampering with RF-based location information (e.g., RF-based location estimates). Regarding tampering with RF measurements, this attack may significantly alter RF measurement values ​​to the point of generating misleading RF-based location estimates. To counter this attack, images from surveillance cameras (one or more) (e.g., camera 506), as well as side / supporting information, can be used to determine margins for RF measurement variation. Any RF measurement outside these margins by a predetermined threshold is declared to be tampered with.

[0122]

[0130] Regarding the tampering of RF-based support data, here, the known locations of the involved APs (one or more), base stations (one or more), and / or anchor nodes (one or more) (e.g., UEs and / or other mobile devices with known locations) necessary for RF-based positioning are tampered with and altered. Again, using vCSI (e.g., images from one or more cameras), each AP (one or more), base station (one or more), and / or anchor node (one or more) can be detected and visually positioned (e.g., based on object detection and determining the relative position of detected objects (one or more) in the images (one or more)). If the RF-based support data does not match the vCSI, the received information is determined to be tampered with.

[0123]

[0131] Regarding the tampering of RF-based location information, the first type of attack involves altering the global location estimate from a first point (indicated as "A") to a second point (indicated as "B"), thereby causing point B to appear significantly different from point A in the same environment. The second type of attack involves altering the location estimate so that the target RF device appears to be in different environments, such as indoor versus outdoor. The third type of attack involves altering the relative location estimate to another device, and / or tampering with distance and / or angle estimates. In all of these cases, vCSI (e.g., images from ambient cameras) may be used to determine integrity by corroborating the RF-based location information.

[0124]

[0132] Therefore, in order to address each of the attacks described above, a network entity (for example, a location server implementing Fusion Engine 570) may receive RF-based information acquired by a target network node (for example, an RF device, a cellular base station, or a WLAN access point to be positioned). The RF-based information may include one or more RF channel estimates acquired by the target network node, one or more RF positioning measurements acquired by the target network node, one or more signal strength measurements acquired by the target network node, RF positioning assistance data configured for the target network node, global navigation satellite system (GNSS) position estimates for the target network node, or any combination thereof.

[0125]

[0133] In response to the reception of RF-based information, a network entity obtains a vCSI associated with a target network node from one or more network nodes (e.g., an anchor node, a cellular base station, a WLAN access point, a target network node, or any combination thereof). In some cases, in response to the reception of RF-based information, a network entity may send a request for a vCSI to one or more network nodes and receive a vCSI in response to the request. The vCSI may include any image data captured by one or more network nodes, or only image data captured by one or more network nodes of the target network node, camera calibration data for cameras on one or more network nodes, object detection data based on image data captured by one or more network nodes, or any combination thereof.

[0126]

[0134] The network entity can then determine whether the RF-based information has been tampered with by comparing a first set of values ​​of a set of environmental characteristics of the target network node determined based on RF-based information with a second set of values ​​of a set of environmental characteristics of the target network node determined based on vCSI. The set of characteristics may include the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the locations of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifiers of one or more anchor network nodes, the types of one or more anchor network nodes, the type of environment of the target network node, or any combination thereof. One or more anchor nodes may be cellular base stations, WLAN access points, side-link anchor nodes, roadside units (RSUs), one or more network nodes, or any combination thereof. Therefore, for example, if the environmental characteristic is the location of a target network node relative to the location of one or more anchor nodes, the RF-based information may be determined to be tampered with (e.g., inaccurate) if the location of the target network node determined from RF-based information (e.g., a first value) is greater than a different threshold than the location of the target network node determined from vCSI (e.g., a second value).

[0127]

[0135] In one embodiment, determining whether RF-based information has been tampered with may include a network entity determining an acceptable variation of a first set of values ​​from a second set of values ​​in a set of characteristics, and determining whether any value in the first set of values ​​lies outside a threshold of acceptable variation from the corresponding value in the second set of values.

[0128]

[0136] In one embodiment, determining whether RF-based information has been tampered with may include the network entity determining information about a set of anchor nodes from the perspective of a target network node, based on vCSI, and determining whether the RF-based information is inconsistent with the information about the set of anchor nodes from the perspective of a target network node. Determining a set of anchor nodes with respect to a target network node may include the network entity determining the relative location of the set of anchor nodes to the target network node, based on vCSI. Determining whether RF-based information is inconsistent with the set of anchor nodes may include the network entity determining whether the RF-based information is inconsistent with the relative location of the set of anchor nodes.

[0129]

[0137] In one embodiment, determining whether RF-based information has been tampered with may involve a network entity determining whether the change in RF-based information from previous RF-based information obtained from the target network node is inconsistent with the environment of the target network node as determined based on vCSI.

[0130]

[0138] In one embodiment, determining whether RF-based information has been tampered with may include determining whether the type of environment of the target network node determined based on RF-based information (e.g., indoor, outdoor, warehouse, grocery store, home, etc.) is inconsistent with the type of environment of the target network node determined based on vCSI.

[0131]

[0139] In one embodiment, determining whether RF-based information has been tampered with may include a network entity determining whether the location of a target network node relative to an anchor node determined based on RF-based information (e.g., range, angle) is inconsistent with the location of the target network node relative to an anchor node determined based on vCSI.

[0132]

[0140] In some cases, a network entity may determine that a subset of RF-based information (e.g., one or more RF channel estimates obtained by the target network node, one or more RF positioning measurements obtained by the target network node, one or more signal strength measurements obtained by the target network node, RF positioning assistance data configured for the target network node, GNSS position estimates for the target network node, or any combination thereof) has been tampered with, based on a comparison between a first set of values ​​and a second set of values ​​of a set of environmental characteristics of the target network node. In such situations, the network entity can determine the location of the target network node based only on the remaining subset of untampered RF-based information. The network entity may also send requests for additional vCSIs to one or more network nodes, receive additional vCSIs from one or more network nodes in response to the requests, and determine whether the location of the target network node matches the additional vCSIs.

[0133]

[0141] Figure 6 shows a signaling call flow 600 for a vCSI-assisted security framework for RF-based information integrity according to aspects of the present disclosure. In step 605, server 670 (e.g., a location server implementing fusion engine 570) receives RF measurements from one or more RF devices, WLAN access points, cellular base stations, and / or anchor node 602. In step 610, server 670 receives side / assistance information from one or more RF devices, WLAN access points, cellular base stations, and / or anchor node 602.

[0134]

[0142] In step 615, based on the identifiers (IDs) of one or more RF devices, WLAN access points, cellular base stations, and / or anchor nodes 602, the server 670 requests vCSI (e.g., images) from one or more surveillance cameras 606 (e.g., camera 506) located within the field of view of one or more RF devices, WLAN access points, cellular base stations, and / or anchor nodes 602. In step 620, the server 670 receives images from camera 606.

[0135]

[0143] In step 625, the server 670 checks the integrity of the RF measurements and RF side / support information using various techniques and algorithms as described above. For example, the server 670 may determine whether the location of a target RF device (e.g., one or more RF devices, WLAN access points, cellular base stations, and / or one of the anchor nodes 602) relative to an anchor node (e.g., one or more RF devices, WLAN access points, cellular base stations, and / or another of the anchor nodes 602) determined based on RF-based information is inconsistent with the location of the target RF device relative to the anchor node determined based on vCSI. In step 630, the server 670 removes any tampered information and proceeds to perform RF-based positioning to determine the location estimates of one or more target RF devices.

[0136]

[0144] For an additional layer of protection against missed detections, in step 635, the server 670 optionally requests additional vCSIs (e.g., images) from camera 606(one or more) to support the RF-based position estimates. In step 640, the server 670 receives the requested vCSIs and, in step 645, performs an integrity check of the RF-based position estimates(one or more).

[0137]

[0145] Referring here to the RF Device-Assisted Security Framework for vCSI Integrity, determining when vCSI has been tampered with can be achieved by various means. Either scene information (e.g., lighting conditions, field of view, target / object) or images (including visual features extracted from images) may be tampered with. Classification of possible attack vectors includes scene tampering, as well as tampering with images used for association / matching and camera calibration.

[0138]

[0146] Referring to scene tampering, the first type of attack includes tampering with the camera's (e.g., camera 506) line of sight and / or field of view. For example, a large object / partition resembling the surrounding environment may be introduced into the scene for the purpose of obstructing the camera's visual line of sight and / or field of view. The second type of attack includes tampering with the lighting conditions, for example, by targeting the camera with a light source. The third type of attack includes tampering with targets / objects within the camera's line of sight and / or field of view. This includes their displacement in scenarios that rely on specific cues for their positions to perform accurate visual positioning (e.g., in a warehouse with objects placed on shelves according to predefined characteristics), or introducing clone objects that have the same visual appearance as the original target / object.

[0139]

[0147] Regarding the manipulation of images used for association / matching and camera calibration, this includes manipulation by inserting false images with modified visual features with the aim of increasing mismatches and / or resulting in completely different camera calibrations.

[0140]

[0148] To counter any of the attacks described above, trusted and secure RF nodes (e.g., cellular base stations, WLAN access points, anchor nodes, etc.) and / or RF devices (e.g., UEs, IoT devices, etc.), collectively known as “trusted devices,” may be designated by the fusion center (e.g., fusion engine 570). Trusted devices(s) may be dynamically changed through negotiation with a server. The server then instructs the trusted devices(s) to acquire and report RF measurements (e.g., RSRP) to determine whether interference has been introduced into the camera environment. If a trusted device is mobile and has one or more cameras available, the server may instruct the trusted devices to use local cameras(s) to collect vCSI and send reports on changes in the environment (e.g., changes in lighting).

[0141]

[0149] A trusted device(s) can also be used for camera calibration. When images are received, the trusted device(s) will report their true locations, and if these locations do not match those obtained from vCSI, vCSI is determined to have been tampered with.

[0142]

[0150] To add security and counter corrupted / unreliable trusted devices, the server may complement its procedures with a random sample consensus (RANSAC) procedure to detect outliers and potentially tampered nodes / cameras.

[0143]

[0151] More specifically, a network entity (for example, a location server implementing the fusion engine 570) may receive vCSI acquired by a target network node (for example, an RF device, a cellular base station, or a WLAN access point to be positioned). The vCSI may include image data captured by the target network node, camera calibration data for the target network node's camera, object detection data based on the image data captured by the target network node, or any combination thereof.

[0144]

[0152] Accordingly, the network entity obtains RF-based information associated with the target network node from one or more network nodes (e.g., an anchor node, a cellular base station, a WLAN access point, a target network node, or any combination thereof). The RF-based information may include one or more RF channel estimates obtained by one or more network nodes, one or more RF positioning measurements obtained by one or more network nodes, one or more signal strength measurements obtained by one or more network nodes, RF positioning support data configured for the target network node, GNSS position estimates for the target network node, or any combination thereof.

[0145]

[0153] In some cases, based on the reception of vCSI, a network entity may send a request for RF-based information to one or more network nodes. In this case, the RF-based information is received upon request.

[0146]

[0154] The network entity can then determine whether the vCSI has been tampered with by comparing a first set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI with a second set of values ​​of a set of environmental characteristics of the target network node determined based on RF-based information. The set of characteristics may include the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the locations of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifiers of one or more anchor network nodes, the types of one or more anchor network nodes, the type of environment of the target network node, or any combination thereof. One or more anchor nodes may be cellular base stations, WLAN access points, sidelink anchor nodes, RSUs, one or more network nodes, or any combination thereof.

[0147]

[0155] In one embodiment, determining whether vCSI has been tampered with may include a network entity determining whether the view of the environment of a target network node determined from the vCSI has been tampered with based on RF-based information. The view of the environment may be determined to have been tampered with based on the following: that the line-of-sight path between the target network node and an anchor node determined from RF-based information is blocked based on the vCSI; that the field of view of the target network node determined from RF-based information contradicts the field of view of the target network node determined from the vCSI; that the type of one or more objects determined from RF-based information contradicts the type of one or more objects determined from vCSI; that the location of one or more objects determined from RF-based information contradicts the location of one or more objects determined from vCSI; or any combination thereof.

[0148]

[0156] In one embodiment, determining whether a vCSI has been tampered with may be a preliminary integrity check of the vCSI. In this case, the network entity may send a request for a second vCSI obtained by one or more network nodes. Accordingly, the network entity may receive the second vCSI from one or more network nodes. The network entity may further perform a final integrity check of the vCSI, at least in part, based on the second vCSI. The network entity may also determine the estimated location of a target network node, at least in part, based on the vCSI, the second vCSI, RF-based information, or any combination thereof.

[0149]

[0157] Figure 7 shows a signaling call flow 700 for an RF device-assisted security framework for vCSI integrity according to an aspect of the present disclosure. In step 705, a server 770 (e.g., a location server implementing a fusion engine 570) receives vCSI (e.g., images) from one or more surveillance cameras 706 (e.g., camera 506). In step 710, the server 770 requests specific RF measurements and side / assistance information from all involved trusted RF devices, WLAN access points, cellular base stations, and / or anchor nodes 702. In step 715, the server 770 receives the requested RF measurements and side / assistance information from the involved trusted RF devices, WLAN access points, cellular base stations, and / or anchor nodes 702.

[0150]

[0158] In step 720, the server 770 performs a preliminary assessment of the completeness of the vCSI (for example, of the scene captured by camera(s) 706). Depending on the results, in step 725, the server 770 instructs a designated RF device with available cameras to collect the vCSI and send an additional report. In step 730, the server 770 receives the requested vCSI from the designated RF device.

[0151]

[0159] In stage 735, server 770 uses these reports and fuses them with RF-based information from trusted devices to perform a final integrity check. If the vCSI passes the integrity check, in stages 740, 745, and 750, server 770 optionally performs target association / matching, camera calibration, and / or visual positioning based on the inspected vCSI, respectively.

[0152]

[0160] Figure 8 shows an exemplary method 800 of communication according to an aspect of the present disclosure. In one aspect, method 800 may be performed by a network entity (for example, a location server or another network server implementing the fusion engine 570).

[0153]

[0161] In 810, the network entity receives RF-based information from the target network node and acquired by the target network node. In one embodiment, operation 810 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and / or security components 398 (e.g., fusion engine 570), any or all of which may be considered means for performing this operation.

[0154]

[0162] In 820, a network entity obtains a vCSI associated with a target network node from one or more network nodes. In one embodiment, operation 820 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and / or security components 398 (e.g., fusion engine 570), any or all of which may be considered means for performing this operation.

[0155]

[0163] In 830, the network entity determines whether the RF-based information has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on RF-based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on vCSI. In one embodiment, operation 830 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and / or security components 398 (e.g., fusion engine 570), any or all of which may be considered means for performing this operation.

[0156]

[0164] As can be understood, the technical advantage of Method 800 is to determine whether RF-based information has been tampered with. Method 800 can also be used for other purposes, such as outlier detection in applications that are not necessarily security-oriented.

[0157]

[0165] Figure 9 shows an exemplary method 900 of communication according to an aspect of the present disclosure. In one aspect, method 900 may be performed by a network entity (for example, a location server or another network server implementing the fusion engine 570).

[0158]

[0166] In operation 910, the network entity receives a vCSI from the target network node, which has been acquired by the target network node. In one embodiment, operation 910 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and / or security components 398 (e.g., fusion engine 570), any or all of which may be considered means for performing this operation.

[0159]

[0167] In 920, a network entity obtains RF-based information associated with a target network node from one or more network nodes. In one embodiment, operation 920 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and / or security components 398 (e.g., fusion engine 570), any or all of which may be considered means for performing this operation.

[0160]

[0168] In 930, the network entity determines whether the vCSI has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined based on RF-based information. In one embodiment, operation 930 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and / or security components 398 (e.g., fusion engine 570), any or all of which may be considered means for performing this operation.

[0161]

[0169] As can be understood, the technical advantage of Method 900 is to determine whether vCSI has been tampered with. Method 900 can also be used for other purposes, such as outlier detection in applications that are not necessarily security-oriented.

[0162]

[0170] In the detailed explanation above, it will be seen that in the examples, different features are grouped together. This form of disclosure should not be understood as an intention that the exemplary clauses have more features than are explicitly stated within each clause. Rather, the various aspects of this disclosure may contain fewer features than all the features of the individual exemplary clauses disclosed. Accordingly, the following clauses should be considered incorporated into the explanation, and each clause may be valid on its own as a separate example. Each dependent clause may refer within itself to a particular combination with one of the other clauses, but the aspects (singular or plural) of that dependent clause are not limited to that particular combination. It will be understood that other exemplary clauses may also include combinations of aspects (singular or plural) of dependent clauses with the subject matter of any other dependent or independent clause, or any combination of features with other dependent and independent clauses. The various aspects disclosed herein explicitly include certain combinations (for example, contradictory aspects such as defining an element as both an electrical insulator and an electrical conductor) unless it is explicitly stated or easily inferred that such combinations are not intended. Furthermore, even if a clause is not directly subordinate to an independent clause, it is intended that the nature of the clause may be included in any other independent clause.

[0163]

[0171] Implementation examples are described in the following numbered clauses.

[0164]

[0172] Clause 1. A method of communication performed by a network entity, comprising: receiving radio frequency (RF) based information obtained by a target network node from a target network node; obtaining visual channel status information (vCSI) associated with a target network node from one or more network nodes; and determining whether the RF-based information has been tampered with, based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined on the RF-based information and a second set of values ​​of a set of environmental characteristics of the target network node determined on the vCSI.

[0165]

[0173] Clause 2. The method according to Clause 1, wherein the set of characteristics includes the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the location of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifier of one or more anchor nodes, the type of one or more anchor nodes, the type of environment of the target network node, or any combination thereof.

[0166]

[0174] Clause 3. The method described in Clause 2, wherein one or more anchor nodes include one or more cellular base stations, one or more wireless local area network (WLAN) access points, one or more sidelink anchor nodes, one or more roadside units (RSUs), one or more network nodes, or any combination thereof.

[0167]

[0175] Clause 4. Determining whether RF-based information has been tampered with is the method of any one of Clauses 1 to 3, which includes determining the permissible variation of a first set of values ​​from a second set of values ​​in a set of characteristics, and determining whether any value in the first set of values ​​lies outside the threshold of permissible variation from the corresponding value in the second set of values.

[0168]

[0176] Clause 5. Determining whether RF-based information has been tampered with is the method of any one of Clauses 1 to 4, which includes determining, based on vCSI, information about a set of anchor nodes from the perspective of a target network node, and determining whether the RF-based information is inconsistent with the information about a set of anchor nodes from the perspective of a target network node.

[0169]

[0177] Clause 6. The method of Clause 5, wherein determining a set of anchor nodes from the perspective of a target network node includes determining the relative location of the set of anchor nodes to the target network node based on vCSI, and determining whether RF-based information is inconsistent with the set of anchor nodes includes determining whether RF-based information is inconsistent with the relative location of the set of anchor nodes.

[0170]

[0178] Clause 7. Determining whether RF-based information has been tampered with is the method of any of Clauses 1 to 6, which includes determining whether the changes in RF-based information from previous RF-based information obtained from the target network node are inconsistent with the environment of the target network node as determined on vCSI.

[0171]

[0179] Clause 8. Determining whether RF-based information has been tampered with is the method of any of Clauses 1 to 7, which includes determining whether the type of environment of the target network node determined based on RF-based information is inconsistent with the type of environment of the target network node determined based on vCSI.

[0172]

[0180] Clause 9. Determining whether RF-based information has been tampered with is the method of any one of Clauses 1 to 8, which includes determining whether the location of the target network node relative to the anchor node determined on the RF-based information is inconsistent with the location of the target network node relative to the anchor node determined on the vCSI.

[0173]

[0181] Clause 10. The method of any one of Clauses 1 to 9, further comprising sending a request to one or more network nodes for a vCSI based on the reception of RF-based information, wherein the vCSI is received in response to the request.

[0174]

[0182] Clause 11. The method of any one of Clauses 1 to 10, further comprising determining that a subset of RF-based information has been tampered with based on a comparison between a first set of values ​​and a second set of values ​​of a set of environmental characteristics of a target network node.

[0175]

[0183] Clause 12. The method of Clause 11, further comprising determining the location of a target network node based on the remaining subset of untampered RF-based information.

[0176]

[0184] The method of Clause 12, further comprising sending a request for additional vCSIs to one or more network nodes, receiving additional vCSIs from one or more network nodes in response to the request, and determining whether the location of a target network node matches the additional vCSIs.

[0177]

[0185] Clause 14.vCSI is a method of any of Clauses 1 to 13, including image data captured by one or more network nodes, image data captured by one or more network nodes of the target network node, camera calibration data for cameras of one or more network nodes, object detection data based on image data captured by one or more network nodes, or any combination thereof.

[0178]

[0186] Clause 15. RF-based information includes, but is not limited to, one or more RF channel estimates obtained by the target network node, one or more RF positioning measurements obtained by the target network node, one or more signal strength measurements obtained by the target network node, RF positioning assistance data configured for the target network node, Global Navigation Satellite System (GNSS) position estimates of the target network node, or any combination thereof, as described in any of Clauses 1 to 14.

[0179]

[0187] Clause 16. The target network node is a user equipment (UE), a cellular base station, or a WLAN access point, as described in any of Clauses 1 to 15.

[0180]

[0188] Clause 17. The network entity is a location server, as described in any of Clauses 1 through 16.

[0181]

[0189] Clause 18. One or more network nodes include one or more anchor UEs, one or more cellular base stations, one or more WLAN access points, target network nodes, or any combination thereof, as described in any of Clauses 1 to 17.

[0182]

[0190] Clause 19. A method of wireless communication performed by a network entity, comprising: receiving visual channel state information (vCSI) obtained by a target network node from a target network node; obtaining radio frequency (RF) based information associated with a target network node from one or more network nodes; and determining whether the vCSI has been tampered with, based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined on the RF based information.

[0183]

[0191] Clause 20. The method according to Clause 19, wherein the set of characteristics includes the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the location of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifier of one or more anchor nodes, the type of one or more anchor nodes, the type of environment of the target network node, or any combination thereof.

[0184]

[0192] Clause 21. The method described in Clause 20, wherein one or more anchor nodes include one or more cellular base stations, one or more wireless local area network (WLAN) access points, one or more sidelink anchor nodes, one or more roadside units (RSUs), one or more network nodes, or any combination thereof.

[0185]

[0193] Clause 22. Determining whether a vCSI has been tampered with is to be done in any way described in any of Clauses 19-21, including determining whether the view of the target network node environment determined from the vCSI has been tampered with based on RF-based information.

[0186]

[0194] The method described in Clause 22, wherein the view of the environment is determined to have been tampered with based on the following: the line of sight (LOS) path between the target network node and the anchor node determined from RF-based information is determined to be blocked based on vCSI; the field of view of the target network node determined from RF-based information is inconsistent with the field of view of the target network node determined from vCSI; the type of one or more objects determined from RF-based information is inconsistent with the type of one or more objects determined from vCSI; the location of one or more objects determined from RF-based information is inconsistent with the location of one or more objects determined from vCSI; or any combination thereof.

[0187]

[0195] The method described in any of the clauses 19-23, further comprising sending a request to one or more network nodes for RF-based information based on the reception of a vCSI, the RF-based information being received upon request.

[0188]

[0196] Clause 25. Determining whether a vCSI has been tampered with is to perform a preliminary integrity check of the vCSI, using any method described in Clauses 19-24.

[0189]

[0197] The method of Clause 25, further comprising sending a request to one or more network nodes for a second vCSI obtained by one or more network nodes, and receiving a second vCSI from one or more network nodes.

[0190]

[0198] Clause 27. The method of Clause 26, further comprising performing a further integrity check of the vCSI based at least in part on the second vCSI.

[0191]

[0199] The method of Clause 27, further comprising determining the estimated location of a target network node based at least in part on vCSI, a second vCSI, RF-based information, or any combination thereof.

[0192]

[0200] Clause 29.vCSI is a method of any of Clauses 19 to 28, which includes image data captured by the target network node, camera calibration data for one or more cameras of the target network node, object detection data based on image data captured by the target network node, or any combination thereof.

[0193]

[0201] Clause 30. RF-based information includes, but is not limited to, one or more RF channel estimates obtained by one or more network nodes, one or more RF positioning measurements obtained by one or more network nodes, one or more signal strength measurements obtained by one or more network nodes, RF positioning assistance data configured for a target network node, Global Navigation Satellite System (GNSS) position estimates for a target network node, or any combination thereof, as described in any of Clauses 19 to 29.

[0194]

[0202] Clause 31. The target network node is a user equipment (UE), a cellular base station, or a WLAN access point, as described in any of Clauses 19 to 30.

[0195]

[0203] Clause 32. The network entity is a location server, as described in any of Clauses 19-31.

[0196]

[0204] Clause 33. One or more network nodes include one or more anchor UEs, one or more cellular base stations, one or more WLAN access points, target network nodes, or any combination thereof, as described in any of Clauses 19 to 32.

[0197]

[0205] Clause 34. A network entity comprising one or more memories, one or more transceivers, and one or more processors communically coupled to one or more memories and one or more transceivers, wherein one or more processors are configured to receive, either alone or in combination, radio frequency (RF) based information from a target network node via one or more transceivers, obtained by the target network node, receive visual channel status information (vCSI) associated with the target network node from one or more network nodes, and determine whether the RF based information has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI.

[0198]

[0206] Clause 35. A set of characteristics of a network entity as described in Clause 34, including the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the location of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifier of one or more anchor nodes, the type of one or more anchor nodes, the type of environment of the target network node, or any combination thereof.

[0199]

[0207] Clause 36. One or more anchor nodes are network entities as described in Clause 35, including one or more cellular base stations, one or more wireless local area network (WLAN) access points, one or more sidelink anchor nodes, one or more roadside units (RSUs), one or more network nodes, or any combination thereof.

[0200]

[0208] A network entity as described in any of Clauses 34 to 36, comprising one or more processors configured to determine whether RF-based information has been tampered with, either alone or in combination, which are configured to determine the permissible variation of a first set of values ​​from a second set of values ​​in a set of characteristics, and whether any value in the first set of values ​​is outside a threshold of permissible variation from the corresponding value in the second set of values.

[0201]

[0209] A network entity as described in any of Clauses 34-37, which includes one or more processors configured to determine whether RF-based information has been tampered with, either alone or in combination, to determine information about a set of anchor nodes from the perspective of a target network node based on vCSI, and to determine whether RF-based information is inconsistent with information about a set of anchor nodes from the perspective of a target network node.

[0202]

[0210] Clause 39. One or more processors configured to determine a set of anchor nodes from the perspective of a target network node, including one or more processors configured to determine the relative location of the set of anchor nodes to the target network node based on vCSI, and one or more processors configured to determine whether RF-based information is inconsistent with the set of anchor nodes, including one or more processors configured to determine whether RF-based information is inconsistent with the relative location of the set of anchor nodes, as described in Clause 38.

[0203]

[0211] Clause 40. One or more processors configured to determine whether RF-based information has been tampered with, including one or more processors configured, either alone or in combination, to determine whether a change in RF-based information from previous RF-based information obtained from a target network node is inconsistent with the environment of the target network node as determined on vCSI, as described in any of Clauses 34 to 39.

[0204]

[0212] Clause 41. One or more processors configured to determine whether RF-based information has been tampered with are included in any of the network entities described in Clauses 34-40, which include one or more processors configured, either alone or in combination, to determine whether the type of environment of a target network node determined on RF-based information is inconsistent with the type of environment of a target network node determined on vCSI.

[0205]

[0213] Clause 42. One or more processors configured to determine whether RF-based information has been tampered with are included in any of the network entities described in Clauses 34 to 41, one or more processors configured to determine whether the location of a target network node relative to an anchor node determined on RF-based information is inconsistent with the location of a target network node relative to an anchor node determined on vCSI.

[0206]

[0214] Clause 43. One or more processors are further configured to send requests for vCSI to one or more network nodes based on the reception of RF-based information via one or more transceivers, and the vCSI is received upon request by any of the network entities described in Clauses 34 to 42.

[0207]

[0215] Clause 44. One or more processors are further configured to determine that a subset of RF-based information has been tampered with, based on a comparison between a first set of values ​​and a second set of values ​​of a set of characteristics of the environment of a target network node, as described in any of Clauses 34 to 43 of the network entity.

[0208]

[0216] Clause 45. One or more processors of the network entity described in Clause 44 are further configured to determine the location of a target network node based on the remaining subset of tamper-evident RF-based information.

[0209]

[0217] Clause 46. One or more processors are further configured to send requests for additional vCSIs to one or more network nodes via one or more transceivers, receive additional vCSIs from one or more network nodes upon request via one or more transceivers, and determine whether the location of a target network node matches the additional vCSI, as described in Clause 45.

[0210]

[0218] Clause 47.vCSI is a network entity as described in any of Clauses 34 to 46, including image data captured by one or more network nodes, image data captured by one or more network nodes of a target network node, camera calibration data for cameras of one or more network nodes, object detection data based on image data captured by one or more network nodes, or any combination thereof.

[0211]

[0219] Clause 48. RF-based information includes one or more RF channel estimates obtained by the target network node, one or more RF positioning measurements obtained by the target network node, one or more signal strength measurements obtained by the target network node, RF positioning assistance data configured for the target network node, Global Navigation Satellite System (GNSS) position estimates of the target network node, or any combination thereof, as described in any of Clauses 34 to 47 of the network entity.

[0212]

[0220] Clause 49. The target network node is a network entity as described in any of Clauses 34-48, which is a user equipment (UE), a cellular base station, or a WLAN access point.

[0213]

[0221] Clause 50. The network entity is a location server, one of the network entities described in any of Clauses 34-49.

[0214]

[0222] Clause 51. One or more network nodes are network entities as defined in any of Clauses 34 to 50, including one or more anchor UEs, one or more cellular base stations, one or more WLAN access points, target network nodes, or any combination thereof.

[0215]

[0223] Clause 52. A network entity comprising one or more memories, one or more transceivers, and one or more processors communicatively coupled to one or more memories and one or more transceivers, wherein one or more processors are configured to receive visual channel status information (vCSI) obtained by a target network node from one or more transceivers, either alone or in combination, from one or more network nodes, radio frequency (RF) based information associated with the target network node, and to determine whether the vCSI has been tampered with based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information.

[0216]

[0224] Clause 53. A set of characteristics of a network entity as described in Clause 52, including the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the location of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifier of one or more anchor nodes, the type of one or more anchor nodes, the type of environment of the target network node, or any combination thereof.

[0217]

[0225] Clause 54. One or more anchor nodes are network entities as described in Clause 53, including one or more cellular base stations, one or more wireless local area network (WLAN) access points, one or more sidelink anchor nodes, one or more roadside units (RSUs), one or more network nodes, or any combination thereof.

[0218]

[0226] Clause 55. One or more processors configured to determine whether a vCSI has been tampered with, including one or more processors configured, either alone or in combination, to determine whether the view of the target network node environment determined from the vCSI has been tampered with based on RF-based information, as described in any of Clauses 52 to 54 of the network entity.

[0219]

[0227] Clause 56. Network entities described in Clause 55 whose views of the environment are determined to have been tampered with based on the following: the line of sight (LOS) path between the target network node and the anchor node determined from RF-based information is determined to be blocked based on vCSI; the field of view of the target network node determined from RF-based information is inconsistent with the field of view of the target network node determined from vCSI; the type of one or more objects determined from RF-based information is inconsistent with the type of one or more objects determined from vCSI; the location of one or more objects determined from RF-based information is inconsistent with the location of one or more objects determined from vCSI; or any combination thereof.

[0220]

[0228] Clause 57. One or more processors are further configured to transmit requests for RF-based information to one or more network nodes via one or more transceivers based on the reception of vCSI, and the RF-based information is received upon request by any of the network entities described in Clauses 52 to 56.

[0221]

[0229] Clause 58. Determining whether a vCSI has been tampered with is a preliminary integrity check of the vCSI, performed by any network entity described in any of Clauses 52-57.

[0222]

[0230] Clause 59. One or more processors are further configured to send requests to one or more network nodes via one or more transceivers for a second vCSI obtained by one or more network nodes, and to receive a second vCSI from one or more network nodes via one or more transceivers, as described in Clause 58.

[0223]

[0231] Clause 60. One or more processors of the network entity described in Clause 59 are further configured to perform further integrity checks of the vCSI, at least in part, based on the second vCSI.

[0224]

[0232] Clause 61. One or more processors of the network entity described in Clause 60 are further configured to determine the estimated location of a target network node based at least in part on vCSI, a second vCSI, RF-based information, or any combination thereof.

[0225]

[0233] Clause 62.vCSI is a network entity as described in any of Clauses 52 to 61, including image data captured by the target network node, camera calibration data for one or more cameras of the target network node, object detection data based on image data captured by the target network node, or any combination thereof.

[0226]

[0234] Clause 63. RF-based information includes one or more RF channel estimates obtained by one or more network nodes, one or more RF positioning measurements obtained by one or more network nodes, one or more signal strength measurements obtained by one or more network nodes, RF positioning assistance data configured for a target network node, Global Navigation Satellite System (GNSS) position estimates for a target network node, or any combination thereof, as described in any of Clauses 52 to 62 of the network entities.

[0227]

[0235] Clause 64. The target network node is a network entity as described in any of Clauses 52-63, which is a user equipment (UE), a cellular base station, or a WLAN access point.

[0228]

[0236] Clause 65. The network entity is a location server, one of the network entities described in any of Clauses 52-64.

[0229]

[0237] Clause 66. One or more network nodes are network entities as defined in any of Clauses 52 to 65, including one or more anchor UEs, one or more cellular base stations, one or more WLAN access points, target network nodes, or any combination thereof.

[0230]

[0238] Clause 67. A network entity comprising means for receiving radio frequency (RF) based information obtained by a target network node from a target network node; means for obtaining visual channel status information (vCSI) associated with a target network node from one or more network nodes; and means for determining whether the RF based information has been tampered with, based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the RF based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI.

[0231]

[0239] Clause 68. A set of characteristics of a network entity as described in Clause 67, including the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the location of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifier of one or more anchor nodes, the type of one or more anchor nodes, the type of environment of the target network node, or any combination thereof.

[0232]

[0240] Clause 69. One or more anchor nodes are network entities as described in Clause 68, including one or more cellular base stations, one or more wireless local area network (WLAN) access points, one or more sidelink anchor nodes, one or more roadside units (RSUs), one or more network nodes, or any combination thereof.

[0233]

[0241] A network entity as described in any of Clauses 67-69, wherein the means for determining whether RF-based information has been tampered with includes means for determining an acceptable variation of a first set of values ​​from a second set of values ​​of a set of characteristics, and means for determining whether any value in the first set of values ​​is outside a threshold of acceptable variation from the corresponding value in the second set of values.

[0234]

[0242] Clause 71. A network entity as described in any of Clauses 67-70, whose means for determining whether RF-based information has been tampered with includes, based on vCSI, means for determining information about a set of anchor nodes from the perspective of a target network node, and means for determining whether RF-based information is inconsistent with information about a set of anchor nodes from the perspective of a target network node.

[0235]

[0243] Clause 72. The network entity described in Clause 71, wherein the means for determining a set of anchor nodes from the perspective of a target network node includes means for determining the relative location of the set of anchor nodes to the target network node based on vCSI, and the means for determining whether RF-based information is inconsistent with the set of anchor nodes includes means for determining whether RF-based information is inconsistent with the relative location of the set of anchor nodes.

[0236]

[0244] Clause 73. Means for determining whether RF-based information has been tampered with include means for determining whether changes in RF-based information from previous RF-based information obtained from the target network node are inconsistent with the environment of the target network node as determined on vCSI, as described in any of Clauses 67 to 72.

[0237]

[0245] Clause 74. Means for determining whether RF-based information has been tampered with include means for determining whether the type of environment of a target network node determined on the basis of RF-based information is inconsistent with the type of environment of a target network node determined on the basis of vCSI, as described in any of Clauses 67 to 73.

[0238]

[0246] Clause 75. A network entity as described in any of Clauses 67-74, whose means for determining whether RF-based information has been tampered with includes means for determining whether the location of a target network node relative to an anchor node determined on RF-based information is inconsistent with the location of a target network node relative to an anchor node determined on vCSI.

[0239]

[0247] Clause 76. The network entity described in any of Clauses 67-75 further comprises means for sending a request for a vCSI to one or more network nodes based on the reception of RF-based information, wherein the vCSI is received upon request.

[0240]

[0248] Clause 77. A network entity as described in any of Clauses 67-76, further comprising means for determining that a subset of RF-based information has been tampered with, based on a comparison between a first set of values ​​and a second set of values ​​of a set of environmental characteristics of a target network node.

[0241]

[0249] Clause 78. The network entity described in Clause 77, further comprising means for determining the location of a target network node based on the remaining subset of unaltered RF-based information.

[0242]

[0250] Clause 79. The network entity described in Clause 78, further comprising means for sending a request for additional vCSIs to one or more network nodes, means for receiving additional vCSIs from one or more network nodes in response to the request, and means for determining whether the location of a target network node matches an additional vCSI.

[0243]

[0251] Clause 80.vCSI includes a network entity as described in any of Clauses 67 to 79, which includes means of image data captured by one or more network nodes, means of image data captured by one or more network nodes of a target network node, camera calibration data of cameras on one or more network nodes, means of object detection data based on image data captured by one or more network nodes, or any combination thereof.

[0244]

[0252] Clause 81. RF-based information includes one or more RF channel estimates obtained by the target network node, one or more RF positioning measurements obtained by the target network node, one or more signal strength measurements obtained by the target network node, RF positioning assistance data configured for the target network node, Global Navigation Satellite System (GNSS) position estimates of the target network node, or any combination thereof, as described in any of Clauses 67 to 80 of the network entity.

[0245]

[0253] Clause 82. The target network node is a network entity as described in any of Clauses 67-81, which is a user equipment (UE), a cellular base station, or a WLAN access point.

[0246]

[0254] Clause 83. A network entity is a location server, one of the network entities described in any of Clauses 67-82.

[0247]

[0255] Clause 84. One or more network nodes are network entities as defined in any of Clauses 67 to 83, including one or more anchor UEs, one or more cellular base stations, one or more WLAN access points, target network nodes, or any combination thereof.

[0248]

[0256] Clause 85. A network entity comprising means for receiving visual channel state information (vCSI) obtained by a target network node from a target network node; means for obtaining radio frequency (RF) based information associated with a target network node from one or more network nodes; and means for determining whether the vCSI has been tampered with, based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined on the RF based information.

[0249]

[0257] Clause 86. A set of characteristics of a network entity as described in Clause 85, including the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the location of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifier of one or more anchor nodes, the type of one or more anchor nodes, the type of environment of the target network node, or any combination thereof.

[0250]

[0258] Clause 87. One or more anchor nodes are network entities as described in Clause 86, including one or more cellular base stations, one or more wireless local area network (WLAN) access points, one or more sidelink anchor nodes, one or more roadside units (RSUs), one or more network nodes, or any combination thereof.

[0251]

[0259] The means for determining whether a vCSI has been tampered with, as described in any of the clauses 85-87, include means for determining whether the view of the environment of the target network node determined from the vCSI has been tampered with based on RF-based information.

[0252]

[0260] Clause 89. Network entities described in Clause 88 whose views of the environment are determined to have been tampered with based on the following: the line of sight (LOS) path between the target network node and the anchor node determined from RF-based information is determined to be blocked based on vCSI; the field of view of the target network node determined from RF-based information is inconsistent with the field of view of the target network node determined from vCSI; the type of one or more objects determined from RF-based information is inconsistent with the type of one or more objects determined from vCSI; the location of one or more objects determined from RF-based information is inconsistent with the location of one or more objects determined from vCSI; or any combination thereof.

[0253]

[0261] The network entity described in any of the clauses 85-89 further comprises means for transmitting a request for RF-based information to one or more network nodes based on the reception of clause 90.vCSI, the RF-based information being received upon request.

[0254]

[0262] Clause 91. Determining whether a vCSI has been tampered with is a preliminary integrity check of the vCSI for any network entity described in any of Clauses 85-90.

[0255]

[0263] The network entity described in Clause 91, further comprising means for sending a request to one or more network nodes for a second vCSI obtained by one or more network nodes, and means for receiving a second vCSI from one or more network nodes.

[0256]

[0264] Clause 93. The network entity described in Clause 92, further including means for performing further integrity checks of the vCSI, at least in part, based on the second vCSI.

[0257]

[0265] The network entity described in Clause 93 further comprises means for determining the estimated location of a target network node based at least in part on vCSI, a second vCSI, RF-based information, or any combination thereof.

[0258]

[0266] Clause 95.vCSI is a network entity as described in any of Clauses 85 to 94, including means of image data captured by a target network node, camera calibration data for one or more cameras of a target network node, means of object detection data based on image data captured by a target network node, or any combination thereof.

[0259]

[0267] Clause 96. RF-based information includes one or more RF channel estimates obtained by one or more network nodes, one or more RF positioning measurements obtained by one or more network nodes, one or more signal strength measurements obtained by one or more network nodes, RF positioning assistance data configured for a target network node, Global Navigation Satellite System (GNSS) position estimates for a target network node, or any combination thereof, as described in any of Clauses 85 to 95 of the network entity.

[0260]

[0268] Clause 97. A target network node is a network entity as described in any of Clauses 85-96, which is a user equipment (UE), a cellular base station, or a WLAN access point.

[0261]

[0269] Clause 98. A network entity is a location server, as defined in any of Clauses 85-97.

[0262]

[0270] Clause 99. One or more network nodes are network entities as defined in any of Clauses 85-98, including one or more anchor UEs, one or more cellular base stations, one or more WLAN access points, target network nodes, or any combination thereof.

[0263]

[0271] Clause 100. A non-temporary computer-readable medium storing computer-executable instructions, wherein, when executed by a network entity, the computer-executable instructions cause the network entity to receive radio frequency (RF)-based information from a target network node and obtained by the target network node; to obtain visual channel status information (vCSI) associated with the target network node from one or more network nodes; and to determine whether the RF-based information has been tampered with, based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the RF-based information and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI.

[0264]

[0272] Clause 101. A set of characteristics, including the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the location of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifier of one or more anchor nodes, the type of one or more anchor nodes, the type of environment of the target network node, or any combination thereof, as described in Clause 100 of the non-temporary computer-readable media.

[0265]

[0273] Clause 102. One or more anchor nodes include one or more cellular base stations, one or more wireless local area network (WLAN) access points, one or more sidelink anchor nodes, one or more roadside units (RSUs), one or more network nodes, or any combination thereof, as described in Clause 101, on a non-transient computer-readable medium.

[0266]

[0274] Clause 103. A non-temporary computer-readable medium as described in any of Clauses 100 to 102, which includes a computer-executable instruction that, when executed by a network entity, causes the network entity to determine whether RF-based information has been tampered with, and which causes the network entity to determine, when executed by the network entity, the permissible variation of a first set of values ​​from a second set of values ​​of a set of characteristics, and whether any value in the first set of values ​​is outside a threshold of permissible variation from the corresponding value in the second set of values.

[0267]

[0275] Clause 104. A non-temporary computer-readable medium as described in any of Clauses 100 to 103, which includes a computer-executable instruction that, when executed by a network entity, causes the network entity to determine whether RF-based information has been tampered with, and causes the network entity to determine, based on vCSI, information about a set of anchor nodes from the perspective of a target network node, and whether RF-based information is inconsistent with information about a set of anchor nodes from the perspective of a target network node.

[0268]

[0276] Clause 105. A non-temporary computer-readable medium as described in Clause 104, wherein a computer-executable instruction, when executed by a network entity, causes the network entity to determine a set of anchor nodes in relation to a target network node, includes a computer-executable instruction, when executed by a network entity, causing the network entity to determine the relative location of the set of anchor nodes to a target network node based on vCSI, and a computer-executable instruction, when executed by a network entity, causes the network entity to determine whether RF-based information is inconsistent with the set of anchor nodes, includes a computer-executable instruction, when executed by a network entity, causing the network entity to determine whether RF-based information is inconsistent with the relative location of the set of anchor nodes.

[0269]

[0277] Clause 106. A non-temporary computer-readable medium as described in any of Clauses 100 to 105, which includes a computer-executable instruction that, when executed by a network entity, causes the network entity to determine whether RF-based information has been tampered with, and which, when executed by the network entity, causes the network entity to determine whether a change in RF-based information from previous RF-based information obtained from a target network node is inconsistent with the environment of the target network node as determined on vCSI.

[0270]

[0278] Clause 107. A non-temporary computer-readable medium as described in any of Clauses 100 to 106, which includes a computer-executable instruction that, when executed by a network entity, causes the network entity to determine whether RF-based information has been tampered with, and which includes a computer-executable instruction that, when executed by the network entity, causes the network entity to determine whether the type of environment of a target network node determined on the basis of RF-based information is inconsistent with the type of environment of a target network node determined on the basis of vCSI.

[0271]

[0279] Clause 108. A non-temporary computer-readable medium as described in any of Clauses 100 to 107, which includes a computer-executable instruction that, when executed by a network entity, causes the network entity to determine whether RF-based information has been tampered with, and which includes a computer-executable instruction that, when executed by the network entity, causes the network entity to determine whether the location of a target network node relative to an anchor node determined on RF-based information is inconsistent with the location of a target network node relative to an anchor node determined on vCSI.

[0272]

[0280] Clause 109. The code further comprises a computer-executable instruction, when executed by a network entity, causing the network entity to send a request to one or more network nodes for a vCSI based on the reception of RF-based information, the vCSI being received in a non-temporary computer-readable medium as described in any of Clauses 100 to 108.

[0273]

[0281] Clause 110. A non-temporary computer-readable medium as described in any of Clauses 100 to 109, further comprising a computer-executable instruction that, when executed by a network entity, causes the network entity to determine that a subset of RF-based information has been tampered with, based on a comparison between a first set of values ​​and a second set of values ​​of a set of environmental characteristics of a target network node.

[0274]

[0282] Clause 111. A non-temporary computer-readable medium as described in Clause 110, further comprising computer-executable instructions that, when executed by a network entity, cause the network entity to determine the location of a target network node based on the remaining subset of unaltered RF-based information.

[0275]

[0283] Clause 112. A non-temporary computer-readable medium as described in Clause 111, further comprising computer-executable instructions that, when executed by a network entity, cause the network entity to send a request to one or more network nodes for additional vCSIs, receive additional vCSIs from one or more network nodes in response to the request, and determine whether the location of a target network node matches the additional vCSIs.

[0276]

[0284] Clause 113.vCSI is a non-temporary computer-readable medium as described in any of Clauses 100 to 112, including image data captured by one or more network nodes, image data captured by one or more network nodes of the target network node, camera calibration data for cameras of one or more network nodes, object detection data based on image data captured by one or more network nodes, or any combination thereof.

[0277]

[0285] Clause 114. RF-based information includes one or more RF channel estimates obtained by the target network node, one or more RF positioning measurements obtained by the target network node, one or more signal strength measurements obtained by the target network node, RF positioning assistance data configured for the target network node, Global Navigation Satellite System (GNSS) position estimates of the target network node, or any combination thereof, in a non-temporary computer-readable medium as described in any of Clauses 100 to 113.

[0278]

[0286] Clause 115. The target network node is a user equipment (UE), or a cellular base station, or a WLAN access point, on a non-temporary computer-readable medium as described in any of Clauses 100 to 114.

[0279]

[0287] Clause 116. The network entity is a location server, a non-temporary computer-readable medium as described in any of Clauses 100-115.

[0280]

[0288] Clause 117. One or more network nodes include one or more anchor UEs, one or more cellular base stations, one or more WLAN access points, target network nodes, or any combination thereof, in a non-temporary computer-readable medium as described in any of Clauses 100 to 116.

[0281]

[0289] Clause 118. A non-temporary computer-readable medium storing computer-executable instructions, wherein, when executed by a network entity, the computer-executable instructions cause the network entity to receive visual channel state information (vCSI) obtained by a target network node from a target network node, to obtain radio frequency (RF)-based information associated with a target network node from one or more network nodes, and to determine whether the vCSI has been tampered with, based on a comparison between a first set of values ​​of a set of environmental characteristics of the target network node determined based on the vCSI and a second set of values ​​of a set of environmental characteristics of the target network node determined based on the RF-based information.

[0282]

[0290] Clause 119. A set of characteristics, including the presence of one or more anchor nodes in the environment of the target network node, the location of the target network node relative to the location of one or more anchor nodes, the distance of the target network node from one or more anchor nodes, the angle of the target network node relative to one or more anchor nodes, the identifier of one or more anchor nodes, the type of one or more anchor nodes, the type of environment of the target network node, or any combination thereof, as described in Clause 118 of the non-temporary computer-readable media.

[0283]

[0291] Clause 120. One or more anchor nodes include one or more cellular base stations, one or more wireless local area network (WLAN) access points, one or more sidelink anchor nodes, one or more roadside units (RSUs), one or more network nodes, or any combination thereof, as described in Clause 119, on a non-transient computer-readable medium.

[0284]

[0292] Clause 121. A non - transient computer - readable medium according to any of Clauses 118 - 120, which, when executed by a network entity, causes the network entity to determine whether the vCSI has been tampered with, includes computer - executable instructions that, when executed by the network entity, cause the network entity to determine whether a view of the environment of a target network node determined from the vCSI has been tampered with based on RF - based information.

[0285]

[0293] Clause 122. The view of the environment is determined to be tampered with based on that the line - of - sight (LOS) path between the target network node and the anchor node determined from RF - based information is blocked based on the vCSI, that the view of the target network node determined from the RF - based information conflicts with the view of the target network node determined from the vCSI, that the type of one or more objects determined based on the RF - based information conflicts with the type of one or more objects determined based on the vCSI, that the location of one or more objects determined based on the RF - based information conflicts with the location of one or more objects determined based on the vCSI, or any combination thereof, in the non - transient computer - readable medium according to Clause 121.

[0286]

[0294] Clause 123. A non - transient computer - readable medium according to any of Clauses 118 - 122, which, when executed by a network entity, further includes computer - executable instructions that cause the network entity to send a request for RF - based information to one or more network nodes based on the reception of the vCSI, and the RF - based information is received in response to the request.

[0287]

[0295] Clause 124. Determining whether the vCSI has been tampered with is a preliminary integrity check of the vCSI, in the non - transient computer - readable medium according to any of Clauses 118 - 123.

[0288]

[0296] Clause 125. The non - transient computer - readable medium according to Clause 124, further comprising computer - executable instructions that, when executed by a network entity, cause the network entity to send a request to one or more network nodes to obtain a second vCSI acquired by one or more network nodes and to receive the second vCSI from one or more network nodes.

[0289]

[0297] Clause 126. The non - transient computer - readable medium according to Clause 125, further comprising computer - executable instructions that, when executed by a network entity, cause the network entity to perform a further integrity check of the vCSI based at least in part on the second vCSI.

[0290]

[0298] Clause 127. The non - transient computer - readable medium according to Clause 126, further comprising computer - executable instructions that, when executed by a network entity, cause the network entity to determine an estimated location of a target network node based at least in part on the vCSI, the second vCSI, RF - based information, or any combination thereof.

[0291]

[0299] Clause 128. The vCSI includes image data captured by a target network node, camera calibration data of one or more cameras of the target network node, object detection data based on the image data captured by the target network node, or any combination thereof, in the non - transient computer - readable medium according to any of Clauses 118 - 127.

[0292]

[0300] Clause 129. RF-based information includes one or more RF channel estimates obtained by one or more network nodes, one or more RF positioning measurements obtained by one or more network nodes, one or more signal strength measurements obtained by one or more network nodes, RF positioning assistance data configured for a target network node, Global Navigation Satellite System (GNSS) position estimates for a target network node, or any combination thereof, in a non-temporary computer-readable medium as described in any of Clauses 118 to 128.

[0293]

[0301] Clause 130. The target network node is a user equipment (UE), or a cellular base station, or a WLAN access point, and is a non-temporary computer-readable medium as described in any of Clauses 118-129.

[0294]

[0302] Clause 131. The network entity is a location server, a non-temporary computer-readable medium as described in any of Clauses 118-130.

[0295]

[0303] Clause 132. One or more network nodes include one or more anchor UEs, one or more cellular base stations, one or more WLAN access points, target network nodes, or any combination thereof, in a non-temporary computer-readable medium as described in any of Clauses 118 to 131.

[0296]

[0304] Those skilled in the art will understand that information and signals can be represented using any of a variety of different techniques and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be mentioned throughout the above description may be represented by voltage, electric current, electromagnetic waves, magnetic fields or magnetic particles, light fields or optical particles, or any combination thereof.

[0297]

[0305] Furthermore, those skilled in the art will understand that various exemplary logic blocks, modules, circuits, and algorithmic steps described in relation to the embodiments disclosed herein may be implemented as electronic hardware, computer software, or a combination of both. To clearly demonstrate this hardware-software compatibility, various exemplary components, blocks, modules, circuits, and steps have been outlined above in relation to their functions. Whether such functions are implemented as hardware or executed as software depends on the specific application and the design constraints imposed on the overall system. Those skilled in the art may implement the described functionality in various ways for specific applications, but such implementation decisions should not be construed as causing a departure from the scope of this disclosure.

[0298]

[0306] Various exemplary logic blocks, modules, and circuits described in relation to the embodiments disclosed herein may be implemented or run using general-purpose processors, digital signal processors (DSPs), ASICs, field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general-purpose processor may be a microprocessor, but alternatively, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, multiple microprocessors, one or more microprocessors working with a DSP core, or any other such configuration.

[0299]

[0307] The methods, sequences, and / or algorithms described in relation to the embodiments disclosed herein may be embodied in hardware directly, in software modules executed by a processor, or in a combination of the two. The software modules may reside in random access memory (RAM), flash memory, read-only memory (ROM), erasable programmable ROM (EPROM), electrically erasable programmable ROM (EEPROM), registers, hard disks, removable disks, CD-ROMs, or any other form of storage medium known in the art. An exemplary storage medium is coupled to the processor so that the processor can read information from and write information to the storage medium. Alternatively, the storage medium may be integrated with the processor. The processor and storage medium may reside within an ASIC. The ASIC may reside within a user terminal (e.g., a UE). Alternatively, the processor and storage medium may reside within the user terminal as separate components.

[0300]

[0308] In one or more exemplary embodiments, the functions described may be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions may be stored on or transmitted via computer-readable media as one or more instructions or codes. Computer-readable media include both computer storage media and communication media, including any media that facilitate the transfer of computer programs from one location to another. Storage media may be any available media accessible by a computer. Such computer-readable media may include, but are not limited to, RAM, ROM, EEPROM, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other media accessible by a computer that can be used to carry or store desired program code in the form of instructions or data structures. Furthermore, any connection may be appropriately referred to as computer-readable media. For example, if software is transmitted from a website, server, or other remote source using coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwave, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of a medium. As used herein, disks and discs include compact discs (CDs), laser discs, optical discs, digital versatile discs (DVDs), floppy disks, and Blu-ray discs, where a disk typically reproduces data magnetically, and a disc optically reproduces data using a laser. Combinations of the above should also be included within the scope of computer-readable media.

[0301]

[0309] While the above disclosures represent exemplary aspects of the Disclosure, it should be noted that various changes and modifications can be made to this Specified without departing from the scope of the Disclosure as defined by the appended claims. The functions, steps, and / or actions of the method claims in the aspects of the Disclosure described herein do not need to be performed in any particular order. Furthermore, elements of the Disclosure may be described or claimed in the singular, but the plural is intended unless a limitation to the singular is explicitly stated.

Claims

1. A method of communication performed by a network entity, Receiving radio frequency (RF) based information acquired by the target network node from the target network node, Obtaining visual channel state information (vCSI) associated with the target network node from one or more network nodes, The determination of whether the RF-based information has been tampered with is made based on a comparison between a first set of values ​​for the set of environmental characteristics of the target network node determined based on the RF-based information and a second set of values ​​for the set of environmental characteristics of the target network node determined based on the vCSI. A method that includes [a certain feature].

2. A method of wireless communication performed by a network entity, Receiving visual channel state information (vCSI) acquired by the target network node from the target network node, Obtaining radio frequency (RF) based information associated with the target network node from one or more network nodes, The determination of whether the vCSI has been tampered with is made based on a comparison between a first set of values ​​for the set of environmental characteristics of the target network node determined based on the vCSI and a second set of values ​​for the set of environmental characteristics of the target network node determined based on the RF-based information. A method that includes [a certain feature].

3. One or more memory devices, One or more transceivers, One or more processors communicatively coupled to the one or more memory and the one or more transceivers, wherein the one or more processors operate individually or in combination. The transceiver receives radio frequency (RF) based information acquired by the target network node from the target network node via the one or more transceivers. Obtain visual channel state information (vCSI) associated with the target network node from one or more network nodes, A network entity comprising one or more processors configured to determine whether the RF-based information has been tampered with, based on a comparison between a first set of values ​​of a set of characteristics of the environment of the target network node determined based on the RF-based information and a second set of values ​​of a set of characteristics of the environment of the target network node determined based on the vCSI.

4. The set of the aforementioned characteristics is The presence of one or more anchor nodes in the environment of the target network node, The location of the target network node relative to the location of one or more of the anchor nodes, The distance from one or more anchor nodes to the target network node, The angle of the target network node with respect to one or more of the aforementioned anchor nodes, Identifiers of one or more anchor nodes, The type of one or more anchor nodes, The type of environment of the target network node, or The network entity according to claim 3, comprising any combination thereof.

5. The one or more anchor nodes mentioned above, One or more cellular base stations, One or more wireless local area network (WLAN) access points, One or more side link anchor nodes, One or more roadside units (RSUs), The aforementioned one or more network nodes, or The network entity according to claim 4, comprising any combination thereof.

6. The one or more processors configured to determine whether the RF-based information has been tampered with are, one or more processors, either individually or in combination Determine the allowable variation of the set of first values ​​from the second set of values ​​of the set of characteristics. The network entity according to claim 3, comprising one or more processors configured to determine whether any value in the first set of values ​​is outside the threshold of the allowable variation from the corresponding value in the second set of values.

7. The one or more processors configured to determine whether the RF-based information has been tampered with are, one or more processors, either individually or in combination Based on the vCSI, information about the set of anchor nodes is determined from the perspective of the target network node. The network entity according to claim 3, comprising one or more processors configured to determine whether the RF-based information is inconsistent with the information about the set of anchor nodes from the perspective of the target network node.

8. The one or more processors configured to determine the set of anchor nodes from the perspective of the target network node comprises the one or more processors configured to determine the relative location of the set of anchor nodes with respect to the target network node based on the vCSI, The network entity according to claim 7, wherein the one or more processors configured to determine whether the RF-based information is inconsistent with the set of anchor nodes comprises the one or more processors configured to determine whether the RF-based information is inconsistent with the relative locations of the set of anchor nodes.

9. The one or more processors configured to determine whether the RF-based information has been tampered with are, one or more processors, either individually or in combination The network entity according to claim 3, comprising one or more processors configured to determine whether a change in RF-based information from previous RF-based information obtained from the target network node is inconsistent with the environment of the target network node determined based on the vCSI.

10. The one or more processors configured to determine whether the RF-based information has been tampered with are, one or more processors, either individually or in combination The network entity according to claim 3, comprising one or more processors configured to determine whether the type of environment of the target network node determined based on the RF-based information is inconsistent with the type of environment of the target network node determined based on the vCSI.

11. The one or more processors configured to determine whether the RF-based information has been tampered with are, one or more processors, either individually or in combination The network entity according to claim 3, comprising one or more processors configured to determine whether the location of the target network node relative to the anchor node determined based on the RF-based information is inconsistent with the location of the target network node relative to the anchor node determined based on the vCSI.

12. The aforementioned one or more processors The network entity according to claim 3, further configured to transmit a request to one or more network nodes for the vCSI based on the reception of the RF-based information via one or more transceivers, wherein the vCSI is received in response to the request.

13. The aforementioned one or more processors The network entity according to claim 3, further configured to determine that a subset of the RF-based information has been tampered with based on the comparison between a first set of values ​​and a second set of values ​​of the set of characteristics of the environment of the target network node.

14. The aforementioned one or more processors The network entity according to claim 13, further configured to determine the location of the target network node based on the remaining subset of the unaltered RF-based information.

15. The aforementioned one or more processors A request for additional vCSI is sent to one or more network nodes via the one or more transceivers. The additional vCSI is received from the one or more network nodes via the one or more transceivers in response to the request. The network entity according to claim 14, further configured to determine whether the location of the target network node matches the additional vCSI.

16. The aforementioned vCSI, Image data captured by one or more of the aforementioned network nodes, Image data captured by one or more network nodes of the target network node, Camera calibration data of the cameras of one or more network nodes, Object detection data based on the image data captured by one or more network nodes, or The network entity according to claim 3, comprising any combination thereof.

17. The RF-based information mentioned above One or more RF channel estimates obtained by the target network node, One or more RF positioning measurements obtained by the target network node, One or more signal intensity measurements obtained by the target network node, RF positioning support data configured for the aforementioned target network node, The estimated global navigation satellite system (GNSS) position of the target network node, or The network entity according to claim 3, comprising any combination thereof.

18. The aforementioned target network node, User equipment (UE), or Cellular base station, or WLAN access point The network entity according to claim 3.

19. The network entity according to claim 3, wherein the network entity is a location server.

20. The aforementioned one or more network nodes One or more anchor UEs, One or more cellular base stations, One or more WLAN access points, The aforementioned target network node, or The network entity according to claim 3, comprising any combination thereof.

21. One or more memory devices, One or more transceivers, One or more processors communicatively coupled to the one or more memory and the one or more transceivers, wherein the one or more processors operate individually or in combination. The transceiver receives visual channel state information (vCSI) acquired by the target network node via the one or more transceivers. Obtain radio frequency (RF) based information associated with the target network node from one or more network nodes, A network entity comprising one or more processors configured to determine whether the vCSI has been tampered with, based on a comparison between a first set of values ​​of a set of characteristics of the environment of the target network node determined based on the vCSI and a second set of values ​​of a set of characteristics of the environment of the target network node determined based on RF-based information.

22. The set of the aforementioned characteristics is The presence of one or more anchor nodes in the environment of the target network node, The location of the target network node relative to the location of one or more of the anchor nodes, The distance from one or more anchor nodes to the target network node, The angle of the target network node with respect to one or more of the aforementioned anchor nodes, Identifiers of one or more anchor nodes, The type of one or more anchor nodes, The type of environment of the target network node, or The network entity according to claim 21, comprising any combination thereof.

23. The one or more anchor nodes mentioned above, One or more cellular base stations, One or more wireless local area network (WLAN) access points, One or more side link anchor nodes, One or more roadside units (RSUs), The aforementioned one or more network nodes, or The network entity according to claim 22, comprising any combination thereof.

24. The one or more processors configured to determine whether the vCSI has been tampered with are, one or more processors, either individually or in combination The network entity according to claim 21, comprising one or more processors configured to determine whether the view of the environment of the target network node determined from the vCSI has been tampered with based on the RF-based information.

25. The view of the aforementioned environment is Line of Sight (LOS) paths between the target network node and the anchor node, determined from the RF-based information which is determined to be blocked based on the vCSI, The field of view of the target network node determined from the RF-based information contradicts the field of view of the target network node determined from the vCSI. The type of one or more objects determined based on the RF-based information contradicts the type of one or more objects determined based on the vCSI. The location of one or more objects determined based on the RF-based information contradicts the location of one or more objects determined based on the vCSI, or The network entity according to claim 24, which is determined to have been tampered with based on any combination thereof.

26. The aforementioned one or more processors The network entity according to claim 21, further configured to transmit a request to one or more network nodes for the RF-based information based on the reception of the vCSI via one or more transceivers, the RF-based information being received in response to the request.

27. The network entity according to claim 21, wherein determining whether the vCSI has been tampered with is a preliminary integrity check of the vCSI.

28. The aforementioned one or more processors A request is sent to the one or more network nodes via the one or more transceivers to obtain the second vCSI acquired by the one or more network nodes. The network entity according to claim 27, further configured to receive the second vCSI from the one or more network nodes via the one or more transceivers.

29. The aforementioned one or more processors The network entity according to claim 28, further configured to perform a further integrity check of the vCSI based at least in part on the second vCSI.

30. The aforementioned one or more processors The network entity according to claim 29, further configured to determine the estimated location of the target network node based at least partially on the vCSI, the second vCSI, the RF-based information, or any combination thereof.

Images