Detecting position spoofing

Abstract

An example method performed by a base station to authenticate position determination can include transmitting to a UE, at a first instance, a signal comprising a pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; receiving, from the UE, a response indicating a detected cyclic shift detected by the UE in the first PN sequence; determining a difference between the detected cyclic shift and the first cyclic shift; and authenticating a position determination operation based on the difference. In an example scenario, the PN sequence accommodates cyclic shifting and the response received from the UE can be a valid response that includes an accurate detected cyclic shift. In another example scenario, the response received from the UE can be a part of a position spoofing operation performed by the UE. In this case, the detected cyclic shift received from the UE may be false (or falsified).

Description

Qualcomm Ref. No. 2403838WO -1-DETECTING POSITION SPOOFINGRELATED APPLICATIONS

[0001] This application claims the benefit of Indian Application No. 202421059874, filed August 8, 2024, entitled “DETECTING POSITION SPOOFING,” which is assigned to the assignee hereof, and incorporated herein in its entirety by reference.BACKGROUND Field of Disclosure

[0002] The present disclosure relates generally to the field of positioning determination and more specifically pertains to detecting position spoofing. Description of Related Art

[0003] A position of a user equipment (UE) such as, for example, a mobile phone, can be identified in an example procedure based on a signal propagation delay measurement made by the mobile phone. However, in some cases, a falsified measurement may be transmitted by the mobile phone - either intentionally in order to spoof a location of the mobile phone or unintentionally due to other reasons. Position spoofing can be undesirable in various situations. For example, position spoofing may lead to an autonomous vehicle obtaining improper guidance from a centralized server which may be controlling the autonomous vehicle. As another example, position spoofing may lead to a delivery of an item, such as, for example, a human organ intended for a transplant operation, to the wrong address. As yet another example, position spoofing may be used by a hacker to obtain access to private information or a bank account, for example. Traditional practice fails to provide a foolproof method to detect position spoofing in various such scenarios.BRIEF SUMMARY

[0004] Embodiments described herein pertain to positioning determination and more specifically pertains to a base station assisting position determination by a user equipment (UE) and / or detecting position spoofing performed by the user equipment.

[0005] An example method performed by a base station to authenticate position determination, can include transmitting, to a first UE, at a first instance, a first signalWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -2- comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; receiving, from the first UE, a first response indicating a first detected cyclic shift detected by the first UE in the first PN sequence; determining a first difference between the first detected cyclic shift and the first cyclic shift; and authenticating a position determination operation based on the first difference.

[0006] An example method performed by a UE to assist a base station to authenticate position determination, can include receiving, from the base station, at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; evaluating the first PN sequence to identify the first cyclic shift; and transmitting, to the base station, a first response indicating the identified first cyclic shift, wherein the identified first cyclic shift is useable by the base station to authenticate a position determination operation based, at least in part, on a first difference between the identified first cyclic shift and the first cyclic shift.

[0007] An example base station can include at least one transceiver, at least one memory, and one or more processors communicatively coupled with the at least one memory. The one or more processors can be configured to transmit via the at least one transceiver, to a first user equipment (UE), at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; receive via the at least one transceiver, from the first UE, a first response indicating a first detected cyclic shift detected by the first UE in the first PN sequence; determine a first difference between the first detected cyclic shift and the first cyclic shift; and authenticate a position determination operation based at least in part on the first difference.

[0008] An example user equipment can include at least one transceiver, at least one memory, and one or more processors communicatively coupled with the at least one memory. The one or more processors can be configured to receive via the at least one transceiver, from a base station, at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; evaluate the first PN sequence to identify the first cyclic shift; and transmit via the at least one transceiver, to the base station, a first response indicating the identified first cyclic shift, wherein the identified first cyclic shift is useable by the base station toWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -3- authenticate a position determination operation that is based at least in part, on a first difference between the identified first cyclic shift and the first cyclic shift.

[0009] This summary is neither intended to identify key or essential features of the claimed subject matter, nor is it intended to be used in isolation to determine the scope of the claimed subject matter. The subject matter should be understood by reference to appropriate portions of the entire specification of this disclosure, any or all drawings, and each claim. The foregoing, together with other features and examples, will be described in more detail below in the following specification, claims, and accompanying drawings.BRIEF DESCRIPTION OF THE DRAWINGS

[0010] The detailed description below pertains to a few example embodiments that are illustrated in the accompanying drawings. However, it must be understood that the description is equally relevant to various other variations of the embodiments described herein. Such embodiments may utilize objects and / or components other than those illustrated in the drawings. It must also be understood that like reference numerals used in the various figures indicate similar or identical objects.

[0011] FIG. 1 is a simplified illustration of a positioning system, according to an embodiment.

[0012] FIG. 2 is a diagram of a 5th Generation (5G) New Radio (NR) positioning system, illustrating an embodiment of a positioning system (e.g., the positioning system of FIG. 1) implemented within a 5G NR communication system.

[0013] FIG. 3 is a diagram showing an example of a frame structure for NR and associated terminology.

[0014] FIG. 4 is a diagram showing an example of a radio frame sequence with Positioning Reference Signal (PRS) positioning occasions.

[0015] FIGs. 5 A-C illustrate example scenarios where a UE such as, for example, a mobile device, performs various types of position spoofing operations.

[0016] FIGs. 6A-D illustrate cyclic shift operations performed upon a pseudorandom number (PN) sequence that can be used by a base station in accordance with the disclosure to detect position spoofing performed by a user equipment.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -4-

[0017] FIGs. 7A-C illustrate some example position spoofing detection operations that may be performed in accordance with the disclosure.

[0018] FIG. 8 shows a flowchart of an example method performed by a base station to detect a position spoofing detection operation in accordance with the disclosure.

[0019] FIG. 9 shows a flowchart of an example method performed by a UE to assist a base station authenticate a position determination operation performed by the UE.

[0020] FIG. 10 is a diagram showing some example functional elements of a user equipment according to an embodiment.

[0021] FIG. 11 is a diagram showing some example functional elements of a base station according to an embodiment.DETAILED DESCRIPTION

[0022] Several illustrative examples will now be described with respect to the accompanying drawings, which form a part hereof. While particular examples, in which one or more aspects of the disclosure may be implemented, are described below, other examples may be used, and various modifications may be made without departing from the scope of the disclosure or the spirit of the appended claims.

[0023] Reference throughout this specification to “one example” or “an example” means that a particular feature, structure, or characteristic described in connection with the example is included in at least one example of claimed subject matter. Thus, the appearances of the phrase “in one example” or “an example” in various places throughout this specification are not necessarily all referring to the same example. Furthermore, particular features, structures, or characteristics described herein may be combined in one or more examples.

[0024] The methodologies described herein may be implemented by various means depending upon applications according to particular examples. For example, such methodologies may be implemented in hardware, firmware, software, and / or combinations thereof. In a hardware implementation, for example, a processing unit may be implemented within one or more application specific integrated circuits (ASICs), digital signal processors (DSPs), digital signal processing devices (DSPDs), programmable logic devices (PLDs), field programmable gate arrays (FPGAs),WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -5- processors, controllers, micro-controllers, microprocessors, electronic devices, other devices units designed to perform the functions described herein, and / or combinations thereof.

[0025] Various aspects described herein generally relate to systems and methods for a base station to detect position spoofing performed by one or more UEs. One traditional approach to detecting a position / location of a UE involves a base station receiving what is known as a downlink (DL) location measurement from the UE and evaluating a delay parameter in order to determine a position of the UE. This approach works effectively when the UE provides a valid location measurement that can be used to accurately determine a position of the UE. However, in some scenarios, a UE may provide a false or misleading location measurement. The false or misleading information may be either provided intentionally in order to spoof the location of the UE or unintentionally due to other reasons. Currently, there is no effective solution in place to detect such spoofing.

[0026] The various example embodiments disclosed herein generally pertain to the use of a specific type of pseudo-random number (PN) sequence for detecting position spoofing. More particularly, in an example embodiment, a base station may transmit, to the UE, a PN sequence having a cyclic shift. The UE is configured to detect the cyclic shift and provide a response that indicates the cyclic shift detected by the UE. The base station may then determine a difference between the transmitted cyclic shift and the reported cyclic shift. Position spoofing may be detected based on detecting that the difference violates a threshold parameter that may be set relative to the first cyclic shift. The threshold parameter can be set to operate as an upper threshold parameter, a lower threshold parameter, or a combination of both. As used herein, violating a threshold parameter can involve exceeding the upper threshold parameter, being below the lower threshold parameter, or a combination of both.

[0027] Accordingly, particular aspects of the subject matter described in this disclosure can be implemented to realize one or more of the potential advantages described below.

[0028] An example advantage associated with detecting position spoofing in the manner described herein pertains to obtaining, verifying, and providing accurate position information to various types of UEs. The various types of UEs may be used byWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -6- various entities for various purposes. For example, obtaining accurate position information of a UE (such as, for example, a smartphone or a navigation aid) with a high level of confidence in the accuracy of the obtained position information, may enable an emergency services provider to quickly reach an address where an emergency has been reported, or may enable an autonomous vehicle to move in a safe and accurate manner.

[0029] FIG. 1 is a simplified illustration of a positioning / sensing system 100, which may be implemented in conjunction with and / or as part of a wireless communication system (e.g., cellular communication network) which includes a mobile device 105, location / sensing server 160, and / or other components of the positioning / sensing system 100 can use the techniques provided herein for authenticating a position determination operation performed by the mobile device 105 and / or for detecting position spoofing performed by the mobile device 105. The techniques described herein may be implemented by one or more components of the positioning / sensing system 100, however the techniques described herein are not limited to such components and may be implemented in other types of systems (not shown). The positioning / sensing system 100 can include: the mobile device 105 (which is one example of an UE); one or more satellites 110 (also referred to as space vehicles (SVs)) for a Global Navigation Satellite System (GNSS) (such as the Global Positioning System (GPS), GLONASS, Galileo or Beidou) and / or Non-Terrestrial Network (NTN) functionality; base stations 120; access points (APs) 130; location / sensing server 160; network 170; and external client 180. Generally put, the positioning / sensing system 100 can estimate a location of the mobile device 105 based on RF signals received by and / or sent from the mobile device 105 and known locations of other components (e.g., GNSS satellites 110, base stations 120, APs 130) transmitting and / or receiving the RF signals. Additionally or alternatively, wireless devices such as the mobile device 105, base stations 120, and satellites 110 (and / or other NTN platforms) can be utilized to perform positioning (e.g., of one or more wireless devices) and / or to perform RF sensing (e.g., of one or more objects by using RF signals transmitted by one or more wireless devices).

[0030] It should be noted that FIG. 1 provides only a generalized illustration of various components, any or all of which may be utilized as appropriate, and each of which may be duplicated, as necessary. Specifically, although only one mobile device 105 is illustrated, it will be understood that many UEs (e.g., hundreds, thousands,WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -7- millions, etc.) may utilize the positioning / sensing system 100. Similarly, the positioning / sensing system 100 may include a larger or smaller number of base stations 120 and / or APs 130 than illustrated in FIG. 1. The illustrated connections that connect the various components in the positioning / sensing system 100 comprise data and signaling connections which may include additional (intermediary) components, direct or indirect physical and / or wireless connections, and / or additional networks. Furthermore, components may be rearranged, combined, separated, substituted, and / or omitted, depending on desired functionality. In some embodiments, for example, the external client 180 may be directly connected to location / sensing server 160. A person of ordinary skill in the art will recognize many modifications to the components illustrated.

[0031] Depending on desired functionality, the network 170 may comprise any of a variety of wireless and / or wireline networks. The network 170 can, for example, comprise any combination of public and / or private networks, local and / or wide-area networks, and the like. Furthermore, the network 170 may utilize one or more wired and / or wireless communication technologies. In some embodiments, the network 170 may comprise a cellular or other mobile network, a wireless local area network (WLAN), a wireless wide-area network (WWAN), and / or the Internet, for example. Examples of network 170 include a Long-Term Evolution (LTE) wireless network, a Fifth Generation (5G) wireless network (also referred to as New Radio (NR) wireless network or 5G NR wireless network), a Wi-Fi WLAN, and the Internet. LTE, 5G, and NR are wireless technologies defined, or being defined, by the 3rd Generation Partnership Project (3GPP). In an LTE, 5G, or other cellular network, mobile device 105 may be referred to as a user equipment (UE). Network 170 may also include more than one network and / or more than one type of network.

[0032] The base stations 120 and access points (APs) 130 may be communicatively coupled to the network 170. In some embodiments, the base stations 120 may be owned, maintained, and / or operated by a cellular network provider, and may employ any of a variety of wireless technologies, as described herein below. Depending on the technology of the network 170, a base station 120 may comprise a node B, an Evolved Node B (eNodeB or eNB), a base transceiver station (BTS), a radio base station (RBS), a New Radio (NR) NodeB, a Next Generation Node B (gNB), a Next Generation eNB (ng-eNB), or the like. A base station 120 that is a gNB or ng-eNB may be part of aWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -8-Next Generation Radio Access Network (NG-RAN) which may connect to a 5G Core Network (5GC) in the case that Network 170 is a 5G network. The functionality performed by a base station 120 in earlier-generation networks (e.g., 3G and 4G) may be separated into different functional components (e.g., radio units (RUs), distributed units (DUs), and central units (CUs)) and layers (e.g., L1 / L2 / L3) in view Open Radio Access Networks (O-RAN) and / or Virtualized Radio Access Network (V-RAN or vRAN) in 5G or later networks, which may be executed on different devices at different locations connected, for example, via fronthaul, midhaul, and backhaul connections. As referred to herein, a “base station” (or ng-eNB, gNB, etc.) may include any or all of these functional components.

[0033] An AP 130 may comprise a Wi-Fi AP or a Bluetooth® AP or an AP having cellular capabilities (e.g., 4G LTE and / or 5GNR), for example. Thus, mobile device 105 can send and receive information with network-connected devices, such as location / sensing server 160, by accessing the network 170 via a base station 120 using a first communication link 133. Additionally or alternatively, because APs 130 also may be communicatively coupled with the network 170, mobile device 105 may communicate with network-connected and Internet-connected devices, including location / sensing server 160, using a second communication link 135, or via one or more other mobile devices 145. As used herein, the term “base station” may generically refer to a single physical transmission point, or multiple co-located physical transmission points, which may be located at a base station 120. A Transmission Reception Point (TRP) (also known as transmit / receive point) corresponds to this type of transmission point, and the term “TRP” may be used interchangeably herein with the terms “gNB,” “ng-eNB,” and “base station.” In some cases, a base station 120 may comprise multiple TRPs - e.g. with each TRP associated with a different antenna or a different antenna array for the base station 120. As used herein, the transmission functionality of a TRP may be performed with a transmission point (TP) and / or the reception functionality of a TRP may be performed by a reception point (RP), which may be physically separate or distinct from a TP. That said, a TRP may comprise both a TP and an RP. Physical transmission points may comprise an array of antennas of a base station 120 (e.g., as in a Multiple Input-Multiple Output (MIMO) system and / or where the base station employs beamforming). According to aspects of applicable 5G cellular standards, a base station 120 (e.g., gNB) may be capable of transmitting different “beams” in differentWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -9- directions and performing “beam sweeping” in which a signal is transmitted in different beams, along different directions (e.g., one after the other). The term “base station” used herein may additionally refer to multiple non-co-located physical transmission points, the physical transmission points may be a Distributed Antenna System (DAS) (a network of spatially separated antennas connected to a common source via a transport medium) or a Remote Radio Head (RRH) (a remote base station connected to a serving base station).

[0034] As noted, satellites 110 may be used to implement NTN functionality, extending communication, positioning, and potentially other functionality (e.g., RF sensing) of a terrestrial network. As such, one or more satellites may be communicatively linked to one or more NTN gateways 150 (also known as “gateways,” “earth stations,” or “ground stations”). The NTN gateways 150 may be communicatively linked with base stations 120 via link 155. In some embodiments, NTN gateways 150 may function as DUs of a base station 120, as described previously. Not only can this enable the mobile device 105 to communicate with the network 170 via satellites 110, but this can also enable network-based positioning, RF sensing, etc.

[0035] Satellites 110 may be utilized in one or more way. For example, satellites 110 (also referred to as space vehicles (SVs)) may be part of a Global Navigation Satellite System (GNSS) such as the Global Positioning System (GPS), GLONASS, Galileo or Beidou. Positioning using RF signals from GNSS satellites may comprise measuring multiple GNSS signals at a GNSS receiver of the mobile device 105 to perform code-based and / or carrier-based positioning, which can be highly accurate. Additionally or alternatively, satellites 110 may be utilized for NTN-based positioning, in which satellites 110 may functionally operate as TRPs (or TPs) of a network (e.g., LTE and / or NR network) and may be communicatively coupled with network 170. In particular, reference signals (e.g., PRS) transmitted by satellites 110 NTN-based positioning may be similar to those transmitted by base stations 120 and may be coordinated by a network function server that may operate as a location server. In some embodiments, satellites 110 used for NTN-based positioning may be different than those used for GNSS-based positioning. In some embodiments NTN nodes may include non-terrestrial vehicles, which may be in addition or as an alternative to NTN satellites. NTN satellites 110 and / or other NTN platforms may be further leveraged to perform RF sensing. As described in more detail hereafter, satellites may use a JCS symbol in anWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -10-Orthogonal Frequency-Division Multiplexing (OFDM) waveform to allow both RF sensing and / or positioning, and communication.

[0036] As used herein, the term “cell” may generically refer to a logical communication entity used for communication with a base station 120 and may be associated with an identifier for distinguishing neighboring cells (e.g., a Physical Cell Identifier (PCID), a Virtual Cell Identifier (VCID)) operating via the same or a different carrier. In some examples, a carrier may support multiple cells, and different cells may be configured according to different protocol types (e.g., Machine-Type Communication (MTC), Narrowband Internet-of-Things (NB-IoT), Enhanced Mobile Broadband (eMBB), or others) that may provide access for different types of devices. In some cases, the term “cell” may refer to a portion of a geographic coverage area (e.g., a sector) over which the logical entity operates.

[0037] The location / sensing server 160 may comprise a server and / or other computing device configured to determine an estimated location of mobile device 105 and / or provide data (e.g., “assistance data”) to mobile device 105 to facilitate location measurement and / or location determination by mobile device 105. According to some embodiments, location / sensing server 160 may comprise a Home Secure User Plane Location (SUPL) Location Platform (H-SLP), which may support the SUPL user plane (UP) location solution defined by the Open Mobile Alliance (OMA) and may support location services for mobile device 105 based on subscription information for mobile device 105 stored in location / sensing server 160. In some embodiments, the location / sensing server 160 may comprise, a Discovered SLP (D-SLP) or an Emergency SLP (E-SLP). The location / sensing server 160 may also comprise an Enhanced Serving Mobile Location Center (E-SMLC) that supports location of mobile device 105 using a control plane (CP) location solution for LTE radio access by mobile device 105. The location / sensing server 160 may further comprise a Location Management Function (LMF) that supports location of mobile device 105 using a control plane (CP) location solution for NR or LTE radio access by mobile device 105.

[0038] In a CP location solution, signaling to control and manage the location of mobile device 105 may be exchanged between elements of network 170 and with mobile device 105 using existing network interfaces and protocols and as signaling from the perspective of network 170. In a UP location solution, signaling to control andWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -11- manage the location of mobile device 105 may be exchanged between location / sensing server 160 and mobile device 105 as data (e.g. data transported using the Internet Protocol (IP) and / or Transmission Control Protocol (TCP)) from the perspective of network 170.

[0039] As previously noted (and discussed in more detail below), the estimated location of mobile device 105 may be based on measurements of RF signals sent from and / or received by the mobile device 105. In particular, these measurements can provide information regarding the relative distance and / or angle of the mobile device 105 from one or more components in the positioning / sensing system 100 (e.g., satellites 110, APs 130, base stations 120). The estimated location of the mobile device 105 can be estimated geometrically (e.g., using multi angulation and / or multilateration), based on the distance (range) and / or angle measurements, along with known position of the one or more components.

[0040] Additionally or alternatively, the location / sensing server 160, may function as a sensing server. A sensing server can be used to coordinate and / or assist in the coordination of sensing of one or more objects (also referred to herein as “targets”) by one or more wireless devices in the positioning / sensing system 100. This can include the mobile device 105, base stations 120, APs 130, other mobile devices 145, satellites 110, or any combination thereof. Wireless devices capable of performing RF sensing may be referred to herein as “sensing nodes.” To perform RF sensing, a sensing server may coordinate sensing sessions in which one or more RF sensing nodes may perform RF sensing by transmitting RF signals (e.g., reference signals (RSs)), and measuring reflected signals, or “echoes,” comprising reflections of the transmitted RF signals off of one or more objects / targets. Reflected signals and object / target detection may be determined, for example, from channel state information (CSI) received at a receiving device. Sensing may comprise (i) monostatic sensing using a single device as a transmitter (of RF signals) and receiver (of reflected signals); (ii) bistatic sensing using a first device as a transmitter and a second device as a receiver; or (iii) multi-static sensing using a plurality of transmitters and / or a plurality of receivers. To facilitate sensing (e.g., in a sensing session among one or more sensing nodes), a sensing server may provide data (e.g., “assistance data”) to the sensing nodes to facilitate RS transmission and / or measurement, object / target detection, or any combination thereof. Such data may include an RS configuration indicating which resources (e.g., time and / orWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -12- frequency resources) may be used (e.g., in a sensing session) to transmit RS for RF sensing. According to some embodiments, a sensing server may comprise a Sensing Management Function (SMF or SnMF).

[0041] Although terrestrial components such as APs 130 and base stations 120 may be fixed, embodiments are not so limited. Mobile components may be used. For example, in some embodiments, a location of the mobile device 105 may be estimated at least in part based on measurements of RF signals 140 communicated between the mobile device 105 and one or more other mobile devices 145, which may be mobile or fixed. As illustrated, other mobile devices may include, for example, a mobile phone 145-1, vehicle 145-2, static communication / positioning device 145-3, or other static and / or mobile device capable of providing wireless signals used for positioning the mobile device 105, or a combination thereof. Wireless signals from mobile devices 145 used for positioning of the mobile device 105 may comprise RF signals using, for example, Bluetooth® (including Bluetooth Low Energy (BLE)), IEEE 802.1 lx (e.g., Wi-Fi®), Ultra-Wideband (UWB), IEEE 802.15x, or a combination thereof. Mobile devices 145 may additionally or alternatively use non-RF wireless signals for positioning of the mobile device 105, such as infrared signals or other optical technologies.

[0042] Mobile devices 145 may comprise other UEs communicatively coupled with a cellular or other mobile network (e.g., network 170). When one or more other mobile devices 145 comprising UEs are used in the position determination of a particular mobile device 105, the mobile device 105 for which the position is to be determined may be referred to as the “target UE,” and each of the other mobile devices 145 used may be referred to as an “anchor UE.” For position determination of a target UE, the respective positions of the one or more anchor UEs may be known and / or jointly determined with the target UE. Direct communication between the one or more other mobile devices 145 and mobile device 105 may comprise sidelink and / or similar Device-to-Device (D2D) communication technologies. Sidelink, which is defined by 3GPP, is a form of D2D communication under the cellular-based LTE and NR standards.

[0043] According to some embodiments, such as when the mobile device 105 comprises and / or is incorporated into a vehicle, a form of D2D communication used byWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -13- the mobile device 105 may comprise vehicle-to-everything (V2X) communication. V2X is a communication standard for vehicles and related entities to exchange information regarding a traffic environment. V2X can include vehicle-to-vehicle (V2V) communication between V2X-capable vehicles, vehicle-to-infrastructure (V2I) communication between the vehicle and infrastructure-based devices (commonly termed roadside units (RSUs)), vehicle-to-person (V2P) communication between vehicles and nearby people (pedestrians, cyclists, and other road users), and the like. Further, V2X can use any of a variety of wireless RF communication technologies. Cellular V2X (CV2X), for example, is a form of V2X that uses cellular-based communication such as LTE (4G), NR (5G) and / or other cellular technologies in a direct-communication mode as defined by 3 GPP. The mobile device 105 illustrated in FIG. 1 may correspond to a component or device on a vehicle, RSU, or other V2X entity that is used to communicate V2X messages. In embodiments in which V2X is used, the static communication / positioning device 145-3 (which may correspond with an RSU) and / or the vehicle 145-2, therefore, may communicate with the mobile device 105 and may be used to determine the position of the mobile device 105 using techniques similar to those used by base stations 120 and / or APs 130 (e.g., using multi angulation and / or multilateration). It can be further noted that mobile devices 145 (which may include V2X devices), base stations 120, and / or APs 130 may be used together (e.g., in a WWAN positioning solution) to determine the position of the mobile device 105, according to some embodiments.

[0044] An estimated location of mobile device 105 can be used in a variety of applications - e.g. to assist direction finding or navigation for a user of mobile device 105 or to assist another user (e.g. associated with external client 180) to locate mobile device 105. A “location” is also referred to herein as a “location estimate,” “estimated location,” “location,” “position,” “position estimate,” “position fix,” “estimated position,” “location fix” or “fix.” The process of determining a location may be referred to as “positioning,” “position determination,” “location determination,” or the like. A location of mobile device 105 may comprise an absolute location of mobile device 105 (e.g. a latitude and longitude and possibly altitude) or a relative location of mobile device 105 (e.g. a location expressed as distances north or south, east or west and possibly above or below some other known fixed location (including, e.g., the location of a base station 120 or AP 130) or some other location such as a location for mobileWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -14- device 105 at some known previous time, or a location of a mobile device 145 (e.g., another UE) at some known previous time). A location may be specified as a geodetic location comprising coordinates which may be absolute (e.g. latitude, longitude and optionally altitude), relative (e.g. relative to some known absolute location) or local (e.g. X, Y and optionally Z coordinates according to a coordinate system defined relative to a local area such a factory, warehouse, college campus, shopping mall, sports stadium or convention center). A location may instead be a civic location and may then comprise one or more of a street address (e.g. including names or labels for a country, state, county, city, road and / or street, and / or a road or street number), and / or a label or name for a place, building, portion of a building, floor of a building, and / or room inside a building etc. A location may further include an uncertainty or error indication, such as a horizontal and possibly vertical distance by which the location is expected to be in error or an indication of an area or volume (e.g. a circle or ellipse) within which mobile device 105 is expected to be located with some level of confidence (e.g. 95% confidence).

[0045] The external client 180 may be a web server or remote application that may have some association with mobile device 105 (e.g. may be accessed by a user of mobile device 105) or may be a server, application, or computer system providing a location service to some other user or users which may include obtaining and providing the location of mobile device 105 (e.g. to enable a service such as friend or relative finder, or child or pet location). Additionally or alternatively, the external client 180 may obtain and provide the location of mobile device 105 to an emergency services provider, government agency, etc.

[0046] As previously noted, the example positioning / sensing system 100 can be implemented using a wireless communication network, such as an LTE-based or 5G NR-based network, or a future 6G network.

[0047] FIG. 2 shows a diagram of a 5G NR positioning system 200, illustrating an embodiment of a positioning system (e.g., positioning system 100) implementing 5G NR. The 5GNR positioning system 200 may be configured to determine the location of a UE, such as, for example, the mobile device 105, by using access nodes, which may include NR NodeB (gNB) 210-1 and 210-2 (collectively and generically referred to herein as gNBs 210), ng-eNB 214, and / or WLAN 216 to implement one or moreWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -15- positioning methods. The gNBs 210 and / or the ng-eNB 214 may correspond with base stations 120 of FIG. 1, and the WLAN 216 may correspond with one or more access points 130 of FIG. 1. Optionally, the 5G NR positioning system 200 additionally may be configured to determine the location of a UE 205 (such as, for example, the mobile device 105 shown in FIG. 1) by using an LMF 220 (which may correspond with location server 160) to implement the one or more positioning methods. Here, the 5G NR positioning system 200 comprises the UE 205, and components of a 5G NR network comprising a Next Generation (NG) Radio Access Network (RAN) (NG-RAN) 235 and a 5G Core Network (5G CN) 240. A 5G network may also be referred to as an NR network; NG-RAN 235 may be referred to as a 5G RAN or as an NR RAN; and 5G CN 240 may be referred to as an NG Core network. The 5G NR positioning system 200 may further utilize information from GNSS satellites 110 from a GNSS system like Global Positioning System (GPS) or similar system (e.g. GLONASS, Galileo, Beidou, Indian Regional Navigational Satellite System (IRNSS)). Additional components of the 5G NR positioning system 200 are described below. The 5G NR positioning system 200 may include additional or alternative components.

[0048] It should be noted that FIG. 2 provides only a generalized illustration of various components, any or all of which may be utilized as appropriate, and each of which may be duplicated or omitted as necessary. Specifically, although only one UE 205 is illustrated, it will be understood that many UEs (e.g., hundreds, thousands, millions, etc.) may utilize the 5G NR positioning system 200. Similarly, the 5GNR positioning system 200 may include a larger (or smaller) number of GNSS satellites 110, gNBs 210, ng-eNBs 214, Wireless Local Area Networks (WLANs) 216, Access and mobility Management Functions (AMF)s 215, external client 230, and / or other components. The illustrated connections that connect the various components in the 5G NR positioning system 200 include data and signaling connections which may include additional (intermediary) components, direct or indirect physical and / or wireless connections, and / or additional networks. Furthermore, components may be rearranged, combined, separated, substituted, and / or omitted, depending on desired functionality.

[0049] The UE 205 may comprise and / or be referred to as a device, a mobile device, a wireless device, a mobile terminal, a terminal, a mobile station (MS), a Secure User Plane Location (SUPL)-Enabled Terminal (SET), or by some other name. Moreover, UE 205 may correspond to a cellphone, smartphone, laptop, tablet, personal dataWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -16- assistant (PDA), navigation device, Internet of Things (loT) device, or some other portable or moveable device. Typically, though not necessarily, the UE 205 may support wireless communication using one or more Radio Access Technologies (RATs) such as using GSM, CDMA, W-CDMA, LTE, High Rate Packet Data (HRPD), IEEE 802.11 Wi-Fi®, Bluetooth, Worldwide Interoperability for Microwave Access (WiMAX™), 5G NR (e.g., using the NG-RAN 235 and 5G CN 240), etc. The UE 205 may also support wireless communication using a WLAN 216 which (like the one or more RATs, and as previously noted with respect to FIG. 1) may connect to other networks, such as the Internet. The use of one or more of these RATs may allow the UE 205 to communicate with an external client 230 (e.g., via elements of 5G CN 240 not shown in FIG. 2, or possibly via a Gateway Mobile Location Center (GMLC) 225) and / or allow the external client 230 to receive location information regarding the UE 205 (e.g., via the GMLC 225). The external client 230 of FIG. 2 may correspond to external client 180 of FIG. 1, as implemented in or communicatively coupled with a 5G NR network.

[0050] The UE 205 may include a single entity or may include multiple entities, such as in a personal area network where a user may employ audio, video and / or data I / O devices, and / or body sensors and a separate wireline or wireless modem. An estimate of a location of the UE 205 may be referred to as a location, location estimate, location fix, fix, position, position estimate, or position fix, and may be geodetic, thus providing location coordinates for the UE 205 (e.g., latitude and longitude), which may or may not include an altitude component (e.g., height above sea level, height above or depth below ground level, floor level or basement level). Alternatively, a location of the UE 205 may be expressed as a civic location (e.g., as a postal address or the designation of some point or small area in a building such as a particular room or floor). A location of the UE 205 may also be expressed as an area or volume (defined either geodetically or in civic form) within which the UE 205 is expected to be located with some probability or confidence level (e.g., 67%, 95%, etc.). A location of the UE 205 may further be a relative location comprising, for example, a distance and direction or relative X, Y (and Z) coordinates defined relative to some origin at a known location which may be defined geodetically, in civic terms, or by reference to a point, area, or volume indicated on a map, floor plan or building plan. In the description contained herein, the use of the term location may comprise any of these variants unless indicated otherwise. When computing the location of a UE, it is common to solve for local X, Y,WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -17- and possibly Z coordinates and then, if needed, convert the local coordinates into absolute ones (e.g. for latitude, longitude and altitude above or below mean sea level).

[0051] Base stations in the NG-RAN 235 shown in FIG. 2 may correspond to base stations 120 in FIG. 1 and may include gNBs 210. Pairs of gNBs 210 in NG-RAN 235 may be connected to one another (e.g., directly as shown in FIG. 2 or indirectly via other gNBs 210). The communication interface between base stations (gNBs 210 and / or ng-eNB 214) may be referred to as an Xn interface 237. Access to the 5G network is provided to UE 205 via wireless communication between the UE 205 and one or more of the gNBs 210, which may provide wireless communications access to the 5G CN 240 on behalf of the UE 205 using 5G NR. The wireless interface between base stations (gNBs 210 and / or ng-eNB 214) and the UE 205 may be referred to as a Uu interface 239. 5G NR radio access may also be referred to as NR radio access or as 5G radio access. In FIG. 2, the serving gNB for UE 205 is assumed to be gNB 210-1, although other gNBs (e.g. gNB 210-2) may act as a serving gNB if UE 205 moves to another location or may act as a secondary gNB to provide additional throughput and bandwidth to UE 205.

[0052] Base stations in the NG-RAN 235 shown in FIG. 2 may also or instead include a next generation evolved Node B, also referred to as an ng-eNB, 214. Ng-eNB 214 may be connected to one or more gNBs 210 in NG-RAN 235-e.g. directly or indirectly via other gNBs 210 and / or other ng-eNBs. An ng-eNB 214 may provide LTE wireless access and / or evolved LTE (eLTE) wireless access to UE 205. Some gNBs 210 (e.g. gNB 210-2) and / or ng-eNB 214 in FIG. 2 may be configured to function as positioning-only beacons which may transmit signals (e.g., Positioning Reference Signal (PRS)) and / or may broadcast assistance data to assist positioning of UE 205 but may not receive signals from UE 205 or from other UEs. Some gNBs 210 (e.g., gNB 210-2 and / or another gNB not shown) and / or ng-eNB 214 may be configured to function as detecting-only nodes may scan for signals containing, e.g., PRS data, assistance data, or other location data. Such detecting-only nodes may not transmit signals or data to UEs but may transmit signals or data (relating to, e.g., PRS, assistance data, or other location data) to other network entities (e.g., one or more components of 5G CN 240, external client 230, or a controller) which may receive and store or use the data for positioning of at least UE 205. It is noted that while only one ng-eNB 214 is shown in FIG. 2, some embodiments may include multiple ng-eNBs 214. Base stationsWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -18-(e.g., gNBs 210 and / or ng-eNB 214) may communicate directly with one another via an Xn communication interface. Additionally or alternatively, base stations may communicate directly or indirectly with other components of the 5GNR positioning system 200, such as the LMF 220 and AMF 215.

[0053] 5G NR positioning system 200 may also include one or more WLANs 216 which may connect to a Non-3GPP InterWorking Function (N3IWF) 250 in the 5G CN 240 (e.g., in the case of an untrusted WLAN 216). For example, the WLAN 216 may support IEEE 802.11 Wi-Fi access for UE 205 and may comprise one or more Wi-Fi APs (e.g., APs 130 of FIG. 1). Here, the N3IWF 250 may connect to other elements in the 5G CN 240 such as AMF 215. In some embodiments, WLAN 216 may support another RAT such as Bluetooth. The N3IWF 250 may provide support for secure access by UE 205 to other elements in 5G CN 240 and / or may support interworking of one or more protocols used by WLAN 216 and UE 205 to one or more protocols used by other elements of 5G CN 240 such as AMF 215. For example, N3IWF 250 may support IPSec tunnel establishment with UE 205, termination of IKEv2 / IPSec protocols with UE 205, termination of N2 and N3 interfaces to 5G CN 240 for control plane and user plane, respectively, relaying of uplink (UL) and downlink (DL) control plane Non- Access Stratum (NAS) signaling between UE 205 and AMF 215 across an N1 interface. In some other embodiments, WLAN 216 may connect directly to elements in 5G CN 240 (e.g. AMF 215 as shown by the dashed line in FIG. 2) and not via N3IWF 250. For example, direct connection of WLAN 216 to 5GCN 240 may occur if WLAN 216 is a trusted WLAN for 5GCN 240 and may be enabled using a Trusted WLAN Interworking Function (TWIF) (not shown in FIG. 2) which may be an element inside WLAN 216. It is noted that while only one WLAN 216 is shown in FIG. 2, some embodiments may include multiple WLANs 216.

[0054] Access nodes may comprise any of a variety of network entities enabling communication between the UE 205 and the AMF 215. As noted, this can include gNBs 210, ng-eNB 214, WLAN 216, and / or other types of cellular base stations. However, access nodes providing the functionality described herein may additionally or alternatively include entities enabling communications to any of a variety of RATs not illustrated in FIG. 2, which may include non-cellular technologies. Thus, the term “access node,” as used in the embodiments described herein below, may include but is not necessarily limited to a gNB 210, ng-eNB 214 or WLAN 216.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -19-

[0055] In some embodiments, an access node, such as a gNB 210, ng-eNB 214, and / or WLAN 216 (alone or in combination with other components of the 5G NR positioning system 200), may be configured to, in response to receiving a request for location information from the LMF 220, obtain location measurements of uplink (UL) signals received from the UE 205) and / or obtain downlink (DL) location measurements from the UE 205 that were obtained by UE 205 for DL signals received by UE 205 from one or more access nodes. As noted, while FIG. 2 depicts access nodes (gNB 210, ng- eNB 214, and WLAN 216) configured to communicate according to 5G NR, LTE, and Wi-Fi communication protocols, respectively, access nodes configured to communicate according to other communication protocols may be used, such as, for example, a Node B using a Wideband Code Division Multiple Access (WCDMA) protocol for a Universal Mobile Telecommunications Service (UMTS) Terrestrial Radio Access Network (UTRAN), an eNB using an LTE protocol for an Evolved UTRAN (E- UTRAN), or a Bluetooth® beacon using a Bluetooth protocol for a WLAN. For example, in a 4G Evolved Packet System (EPS) providing LTE wireless access to UE 205, a RAN may comprise an E-UTRAN, which may comprise base stations comprising eNBs supporting LTE wireless access. A core network for EPS may comprise an Evolved Packet Core (EPC). An EPS may then comprise an E-UTRAN plus an EPC, where the E-UTRAN corresponds to NG-RAN 235 and the EPC corresponds to 5GCN 240 in FIG. 2. The methods and techniques described herein for obtaining a civic location for UE 205 may be applicable to such other networks.

[0056] The gNBs 210 and ng-eNB 214 can communicate with an AMF 215, which, for positioning functionality, communicates with an LMF 220. The AMF 215 may support mobility of the UE 205, including cell change and handover of UE 205 from an access node (e.g., gNB 210, ng-eNB 214, or WLAN 216)of a first RAT to an access node of a second RAT. The AMF 215 may also participate in supporting a signaling connection to the UE 205 and possibly data and voice bearers for the UE 205. The LMF 220 may support positioning of the UE 205 using a CP location solution when UE 205 accesses the NG-RAN 235 or WLAN 216 and may support position procedures and methods, including UE assisted / UE based and / or network based procedures / methods, such as Assisted GNSS (A-GNSS), Observed Time Difference Of Arrival (OTDOA) (which may be referred to in NR as Time Difference Of Arrival (TDOA)), Real Time Kinematic (RTK), Precise Point Positioning (PPP), Differential GNSS (DGNSS),WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -20-Enhance Cell ID (ECID), angle of arrival (AO A), angle of departure (AoD), WLAN positioning, round trip signal propagation delay (RTT), multi-cell RTT, and / or other positioning procedures and methods. The LMF 220 may also process location service requests for the UE 205, e.g., received from the AMF 215 or from the GMLC 225. The LMF 220 may be connected to AMF 215 and / or to GMLC 225. In some embodiments, a network such as 5GCN 240 may additionally or alternatively implement other types of location-support modules, such as an Evolved Serving Mobile Location Center (E- SMLC) or a SUPL Location Platform (SLP). It is noted that in some embodiments, at least part of the positioning functionality (including determination of a UE 205 ’s location) may be performed at the UE 205 (e.g., by measuring downlink PRS (DL-PRS) signals transmitted by wireless nodes such as gNBs 210, ng-eNB 214 and / or WLAN 216, and / or using assistance data provided to the UE 205, e.g., by LMF 220).

[0057] The Gateway Mobile Location Center (GMLC) 225 may support a location request for the UE 205 received from an external client 230 and may forward such a location request to the AMF 215 for forwarding by the AMF 215 to the LMF 220. A location response from the LMF 220 (e.g., containing a location estimate for the UE 205) may be similarly returned to the GMLC 225 either directly or via the AMF 215, and the GMLC 225 may then return the location response (e.g., containing the location estimate) to the external client 230.

[0058] A Network Exposure Function (NEF) 245 may be included in 5GCN 240. The NEF 245 may support secure exposure of capabilities and events concerning 5GCN 240 and UE 205 to the external client 230, which may then be referred to as an Access Function (AF) and may enable secure provision of information from external client 230 to 5GCN 240. NEF 245 may be connected to AMF 215 and / or to GMLC 225 for the purposes of obtaining a location (e.g. a civic location) of UE 205 and providing the location to external client 230.

[0059] As further illustrated in FIG. 2, the LMF 220 may communicate with the gNBs 210 and / or with the ng-eNB 214 using an NR Positioning Protocol annex (NRPPa) as defined in 3GPP Technical Specification (TS) 38.455. NRPPa messages may be transferred between a gNB 210 and the LMF 220, and / or between an ng-eNB 214 and the LMF 220, via the AMF 215. As further illustrated in FIG. 2, LMF 220 and UE 205 may communicate using an LTE Positioning Protocol (LPP) as defined in 3 GPPWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -21-TS 37.355. Here, LPP messages may be transferred between the UE 205 and the LMF 220 via the AMF 215 and a serving gNB 210-1 or serving ng-eNB 214 for UE 205. For example, LPP messages may be transferred between the LMF 220 and the AMF 215 using messages for service-based operations (e.g., based on the Hypertext Transfer Protocol (HTTP)) and may be transferred between the AMF 215 and the UE 205 using a 5G NAS protocol. The LPP protocol may be used to support positioning of UE 205 using UE assisted and / or UE based position methods such as A-GNSS, RTK, TDOA, multi-cell RTT, AoD, and / or ECID. The NRPPa protocol may be used to support positioning of UE 205 using network based position methods such as ECID, AO A, uplink TDOA (UL-TDOA) and / or may be used by LMF 220 to obtain location related information from gNBs 210 and / or ng-eNB 214, such as parameters defining DL-PRS transmission from gNBs 210 and / or ng-eNB 214.

[0060] In the case of UE 205 access to WLAN 216, LMF 220 may use NRPPa and / or LPP to obtain a location of UE 205 in a similar manner to that just described for UE 205 access to a gNB 210 or ng-eNB 214. Thus, NRPPa messages may be transferred between a WLAN 216 and the LMF 220, via the AMF 215 and N3IWF 250 to support network-based positioning of UE 205 and / or transfer of other location information from WLAN 216 to LMF 220. Alternatively, NRPPa messages may be transferred between N3IWF 250 and the LMF 220, via the AMF 215, to support network-based positioning of UE 205 based on location related information and / or location measurements known to or accessible to N3IWF 250 and transferred from N3IWF 250 to LMF 220 using NRPPa. Similarly, LPP and / or LPP messages may be transferred between the UE 205 and the LMF 220 via the AMF 215, N3IWF 250, and serving WLAN 216 for UE 205 to support UE assisted or UE based positioning of UE 205 by LMF 220.

[0061] In a 5GNR positioning system 200, positioning methods can be categorized as being “UE assisted” or “UE based.” This may depend on where the request for determining the position of the UE 205 originated. If, for example, the request originated at the UE (e.g., from an application, or “app,” executed by the UE), the positioning method may be categorized as being UE based. If, on the other hand, the request originates from an external client or AF 230, LMF 220, or other device or service within the 5G network, the positioning method may be categorized as being UE assisted (or “network-based”).WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -22-

[0062] With a UE-assisted position method, UE 205 may obtain location measurements and send the measurements to a location server (e.g., LMF 220) for computation of a location estimate for UE 205. For RAT-dependent position methods location measurements may include one or more of a Received Signal Strength Indicator (RSSI), Round Trip signal propagation Time (RTT), Reference Signal Received Power (RSRP), Reference Signal Received Quality (RSRQ), Reference Signal Time Difference (RSTD), Time of Arrival (TOA), AO A, Receive Time-Transmission Time Difference (Rx-Tx), Differential AOA (DAO A), AOD, or Timing Advance (TA) for gNBs 210, ng-eNB 214, and / or one or more access points for WLAN 216. Additionally or alternatively, similar measurements may be made of sidelink signals transmitted by other UEs, which may serve as anchor points for positioning of the UE 205 if the positions of the other UEs are known. The location measurements may also or instead include measurements for RAT -independent positioning methods such as GNSS (e.g., GNSS pseudorange, GNSS code phase, and / or GNSS carrier phase for GNSS satellites 110), WLAN, etc.

[0063] With a UE-based position method, UE 205 may obtain location measurements (e.g., which may be the same as or similar to location measurements for a UE assisted position method) and may further compute a location of UE 205 (e.g., with the help of assistance data received from a location server such as LMF 220, an SLP, or broadcast by gNBs 210, ng-eNB 214, or WLAN 216).

[0064] With a network based position method, one or more base stations (e.g., gNBs 210 and / or ng-eNB 214), one or more APs (e.g., in WLAN 216), or N3IWF 250 may obtain location measurements (e.g., measurements of RSSI, RTT, RSRP, RSRQ, AOA, or TOA) for signals transmitted by UE 205, and / or may receive measurements obtained by UE 205 or by an AP in WLAN 216 in the case of N3IWF 250, and may send the measurements to a location server (e.g., LMF 220) for computation of a location estimate for UE 205.

[0065] Positioning of the UE 205 also may be categorized as UL, DL, or DL-UL based, depending on the types of signals used for positioning. If, for example, positioning is based solely on signals received at the UE 205 (e.g., from a base station or other UE), the positioning may be categorized as DL based. On the other hand, if positioning is based solely on signals transmitted by the UE 205 (which may beWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -23- received by a base station or other UE, for example), the positioning may be categorized as UL based. Positioning that is DL-UL based includes positioning, such as RTT-based positioning, that is based on signals that are both transmitted and received by the UE 205. Sidelink (SL)-assisted positioning comprises signals communicated between the UE 205 and one or more other UEs. According to some embodiments, UL, DL, or DL- UL positioning as described herein may be capable of using SL signaling as a complement or replacement of SL, DL, or DL-UL signaling.

[0066] Depending on the type of positioning (e.g., UL, DL, or DL-UL based) the types of reference signals used can vary. For DL-based positioning, for example, these signals may comprise PRS (e.g., DL-PRS transmitted by base stations or SL-PRS transmitted by other UEs), which can be used for TDOA, AoD, and RTT measurements. Other reference signals that can be used for positioning (UL, DL, or DL-UL) may include Sounding Reference Signal (SRS), Channel State Information Reference Signal (CSI-RS), synchronization signals (e.g., synchronization signal block (SSB) Synchronizations Signal (SS)), Physical Uplink Control Channel (PUCCH), Physical Uplink Shared Channel (PUSCH), Physical Sidelink Shared Channel (PSSCH), Demodulation Reference Signal (DMRS), etc. Moreover, reference signals may be transmitted in a Tx beam and / or received in an Rx beam (e.g., using beamforming techniques), which may impact angular measurements, such as AOD or AO A.

[0067] FIG. 3 is a diagram showing an example of a frame structure for NR and associated terminology, which can serve as the basis for physical layer communication between the UE 205 and base stations / TRPs, such as serving gNB 210-1. The transmission timeline for each of the downlink and uplink may be partitioned into units of radio frames. Each radio frame may have a predetermined duration (e.g., 10 ms) and may be partitioned into 10 subframes, each of 1 ms, with indices of 0 through 9. Each subframe may include a variable number of slots depending on the subcarrier spacing. Each slot may include a variable number of symbol periods (e.g., 7 or 14 symbols) depending on the subcarrier spacing. The symbol periods in each slot may be assigned indices. A mini slot may comprise a sub slot structure (e.g., 2, 3, or 4 symbols). Additionally shown in FIG. 3 is the complete Orthogonal Frequency-Division Multiplexing (OFDM) of a subframe, showing how a subframe can be divided across both time and frequency into a plurality of Resource Blocks (RBs). A single RB can comprise a grid of Resource Elements (REs) spanning 14 symbols and 12 subcarriers.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -24-

[0068] Each symbol in a slot may indicate a link direction (e.g., downlink (DL), uplink (UL), or flexible) or data transmission and the link direction for each subframe may be dynamically switched. The link directions may be based on the slot format. Each slot may include DL / UL data as well as DL / UL control information. In NR, a synchronization signal (SS) block is transmitted. The SS block includes a primary SS (PSS), a secondary SS (SSS), and a two symbol Physical Broadcast Channel (PBCH). The SS block can be transmitted in a fixed slot location, such as the symbols 0-3 as shown in FIG. 3. The PSS and SSS may be used by UEs for cell search and acquisition. The PSS may provide half-frame timing, the SS may provide the cyclic prefix (CP) length and frame timing. The PSS and SSS may provide the cell identity. The PBCH carries some basic system information, such as downlink system bandwidth, timing information within radio frame, SS burst set periodicity, system frame number, etc.

[0069] FIG. 4 is a diagram showing an example of a radio frame sequence 400 with PRS positioning occasions. A “PRS instance” or “PRS occasion” is one instance of a periodically repeated time window (e.g., a group of one or more consecutive slots) where PRS are expected to be transmitted. A PRS occasion may also be referred to as a “PRS positioning occasion,” a “PRS positioning instance, a “positioning occasion,” “a positioning instance,” or simply an “occasion” or “instance.” Radio frame sequence 400 may be applicable to broadcast of PRS signals (DL-PRS signals) from base stations 120 in positioning system 100. The radio frame sequence 400 may be used in 5G NR (e.g., in 5G NR positioning system 200) and / or in LTE. Similar to FIG. 3, time is represented horizontally (e.g., on an X axis) in FIG. 4, with time increasing from left to right. Frequency is represented vertically (e.g., on a Y axis) with frequency increasing (or decreasing) from bottom to top.

[0070] FIG. 4 shows how PRS positioning occasions 410-1, 410-2, and 410-3 (collectively and generically referred to herein as positioning occasions 410) are determined by a System Frame Number (SFN), a cell-specific subframe offset (APRS) 415, a length (or span) of LPRS subframes, and the PRS Periodicity (TPRS) 420. The cell-specific PRS subframe configuration may be defined by a “PRS Configuration Index,” IPRS, included in assistance data (e.g., TDOA assistance data), which may be defined by governing 3 GPP standards. The cell-specific subframe offset (APRS) 415 may be defined in terms of the number of subframes transmitted starting from System Frame Number (SFN) 0 to the start of the first (subsequent) PRS positioning occasion.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -25-

[0071] A PRS may be transmitted by wireless nodes (e.g., base stations 120 or other UEs) after appropriate configuration (e.g., by an Operations and Maintenance (O&M) server). A PRS may be transmitted in special positioning subframes or slots that are grouped into positioning occasions 410. For example, a PRS positioning occasion 410- 1 can comprise a number NPRS of consecutive positioning subframes where the number NPRS may be between 1 and 160 (e.g., may include the values 1, 2, 4 and 6 as well as other values). PRS occasions 410 may be grouped into one or more PRS occasion groups. As noted, PRS positioning occasions 410 may occur periodically at intervals, denoted by a number TPRS, of millisecond (or subframe) intervals where TPRS may equal 5, 10, 20, 40, 80, 160, 320, 640, or 1280 (or any other appropriate value). In some aspects, TPRS may be measured in terms of the number of subframes between the start of consecutive positioning occasions.

[0072] In some aspects, when a UE 205 receives a PRS configuration index IPRS in the assistance data for a particular cell (e.g., base station), the UE 205 may determine the PRS periodicity TPRS 420 and cell-specific subframe offset (APRS) 415 using stored indexed data. The UE 205 may then determine the radio frame, subframe, and slot when a PRS is scheduled in the cell. The assistance data may be determined by, for example, a location server (e.g., location server 160 in FIG. 1 and / or LMF 220 in FIG. 2), and includes assistance data for a reference cell, and a number of neighbor cells supported by various wireless nodes.

[0073] Typically, PRS occasions from all cells in a network that use the same frequency are aligned in time and may have a fixed known time offset (e.g., cell-specific subframe offset (APRS) 415) relative to other cells in the network that use a different frequency. In SFN-synchronous networks all wireless nodes (e.g., base stations 120) may be aligned on both frame boundary and system frame number. Therefore, in SFN- synchronous networks all cells supported by the various wireless nodes may use the same PRS configuration index for any particular frequency of PRS transmission. On the other hand, in SFN-asynchronous networks, the various wireless nodes may be aligned on a frame boundary, but not system frame number. Thus, in SFN- asynchronous networks the PRS configuration index for each cell may be configured separately by the network so that PRS occasions align in time. A UE 205 may determine the timing of the PRS occasions 410 of the reference and neighbor cells for TDOA positioning, if the UE 205 can obtain the cell timing (e.g., SFN or Frame Number) of atWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -26- least one of the cells, e.g., the reference cell or a serving cell. The timing of the other cells may then be derived by the UE 205 based, for example, on the assumption that PRS occasions from different cells overlap.

[0074] With reference to the frame structure in FIG. 3, a collection of resource elements (REs) that are used for transmission of PRS is referred to as a “PRS resource.” The collection of resource elements can span multiple RBs in the frequency domain and one or more consecutive symbols within a slot in the time domain, inside which pseudorandom Quadrature Phase Shift Keying (QPSK) sequences are transmitted from an antenna port of a TRP. In a given OFDM symbol in the time domain, a PRS resource occupies consecutive RBs in the frequency domain. The transmission of a PRS resource within a given RB has a particular combination, or “comb,” size. (Comb size also may be referred to as the “comb density ”) A comb size “N” represents the subcarrier spacing (or frequency / tone spacing) within each symbol of a PRS resource configuration, where the configuration uses every Nth subcarrier of certain symbols of an RB. For example, for comb-4, for each of the four symbols of the PRS resource configuration, REs corresponding to every fourth subcarrier (e.g., subcarriers 0, 4, 8) are used to transmit PRS of the PRS resource. Comb sizes of comb-2, comb-4, comb-6, and comb- 12, for example, may be used in PRS.

[0075] A “PRS resource set” comprises a group of PRS resources used for the transmission of PRS signals, where each PRS resource has a PRS resource ID. In addition, the PRS resources in a PRS resource set are associated with the same TRP. A PRS resource set is identified by a PRS resource set ID and is associated with a particular TRP (identified by a cell ID). A “PRS resource repetition” is a repetition of a PRS resource during a PRS occasion / instance. The number of repetitions of a PRS resource may be defined by a “repetition factor” for the PRS resource. In addition, the PRS resources in a PRS resource set may have the same periodicity, a common muting pattern configuration, and the same repetition factor across slots. The periodicity may have a length selected from 2m- {4, 5, 8, 10, 16, 20, 32, 40, 64, 80, 160, 320, 640, 1280, 2560, 5120, 10240} slots, with p = 0, 1, 2, 3. The repetition factor may have a length selected from { 1, 2, 4, 6, 8, 16, 32} slots.

[0076] A PRS resource ID in a PRS resource set may be associated with a single beam (and / or beam ID) transmitted from a single TRP (where a TRP may transmit oneWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -27- or more beams). That is, each PRS resource of a PRS resource set may be transmitted on a different beam, and as such, a PRS resource (or simply “resource”) can also be referred to as a “beam.” Note that this does not have any implications on whether the TRPs and the beams on which PRS are transmitted are known to the UE.

[0077] In the 5GNR positioning system 200 illustrated in FIG. 2, a TRP (gNB 210, ng-eNB 214, and / or WLAN 216) may transmit frames, or other physical layer signaling sequences, supporting PRS signals (i.e. a DL-PRS) according to frame configurations as previously described, which may be measured and used for position determination of the UE 205. As noted, other types of wireless network nodes, including other UEs, may also be configured to transmit PRS signals configured in a manner similar to (or the same as) that described above. Because transmission of a PRS by a wireless network node may be directed to all UEs within radio range, the wireless network node may be considered to transmit (or broadcast) a PRS.

[0078] FIG. 5 A illustrates a first scenario where a UE such as, for example, a mobile device 105-1, performs a first example position spoofing operation. As indicated above, some positioning operations can be categorized as being “UE assisted” or “UE based.” This may depend on where the request for determining the position of a UE originated. If, for example, the request originated at the UE (e.g., from an application, or “app,” executed by the UE), the positioning method may be categorized as being UE based. If, on the other hand, the request originates from an external client such as, for example, external client 230 shown in FIG. 2 or another device or service within a 5G network, such as, for example, the LMF 220 shown in FIG. 2, the positioning method may be categorized as being UE assisted (or “network-based”).

[0079] With a UE-assisted position method, the mobile device 105-1 may obtain location measurements and send the measurements to a location server (e.g., LMF 220) for computation of a location estimate for the mobile device 105-1. For RAT-dependent position methods location measurements may include one or more of a Received Signal Strength Indicator (RSSI), Round Trip signal propagation Time (RTT), Reference Signal Received Power (RSRP), Reference Signal Received Quality (RSRQ), Reference Signal Time Difference (RSTD), Time of Arrival (TOA), AO A, Receive Time- Transmission Time Difference (Rx-Tx), Differential AOA (DAO A), AOD, or Timing Advance (TA) for some elements shown in FIG. 2 such as gNBs 210, ng-eNB 214,WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -28- and / or one or more access points for WLAN 216. Additionally or alternatively, similar measurements may be made of sidelink signals transmitted by other UEs, which may serve as anchor points for positioning of the mobile device 105-1 if the positions of the other UEs are known. The location measurements may also or instead include measurements for RAT-independent positioning methods such as GNSS (e.g., GNSS pseudorange, GNSS code phase, and / or GNSS carrier phase for GNSS satellites 110), WLAN, etc.

[0080] With a UE-based position method, the mobile device 105-1 may obtain location measurements (e.g., which may be the same as or similar to location measurements for a UE assisted position method) and may further compute a location of mobile device 105-1 (e.g., with the help of assistance data received from a location server such as LMF 220, an SLP, or broadcast by gNBs 210, ng-eNB 214, or WLAN 216).

[0081] With a network based position method, one or more base stations (e.g., gNBs 210 and / or ng-eNB 214), one or more APs (e.g., in WLAN 216), or N3IWF 250 may obtain location measurements (e.g., measurements of RSSI, RTT, RSRP, RSRQ, AOA, or TOA) for signals transmitted by the mobile device 105-1, and / or may receive measurements obtained by mobile device 105-1, and may send the measurements to a location server (e.g., LMF 220) for computation of a location estimate for the mobile device 105-1.

[0082] Referring to FIG. 5A, a normal scenario wherein the mobile device 105-1 is stationarily located at a first location 510 (and is not performing a spoofing operation) involves the mobile device 105-1 providing to the base station 105-1, location measurements obtained by the mobile device 105-1 at the first location 510. This action is indicated by an arrow 516. In a first example position spoofing operation, the mobile device 105-1 may move from the first location 510 to a second location 515. Upon reaching the second location 515, the mobile device 105-1 may transmit to a base station 120, (indicated by dashed arrow 517), location measurements obtained by the mobile device 105-1 at the first location 510, so as to spoof the base station 120 into concluding that the mobile device 105-1 is located at the first location 510. A method by which the base station 120 detects this type of position spoofing by the mobile device 105-1 is described below using other figures.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -29-

[0083] FIG. 5B illustrates a second scenario where the mobile device 105-1 performs a second example position spoofing operation. In this second scenario, the mobile device 105-1 remains at the first location 510 and transmits to the base station 120, location measurements corresponding to the second location 515, in order to spoof the base station 120 into concluding that the mobile device 105-1 is located at the second location 515. Transmission of the spoofed location is indicated by dashed arrow 518. A method by which the base station 120 detects this type of position spoofing performed by the mobile device 105-1 is described below using other figures.

[0084] FIG. 5C illustrates a third scenario where the mobile device 105-1 performs a third example position spoofing operation. In this third scenario, the mobile device 105-1 remains at the first location 510 and seeks the assistance of another mobile device 105-2 to perform a position spoofing operation. More particularly, the mobile device 105-1 communicates with the mobile device 105-2 (using communication formats such as, for example, WiFi, sidelink, Bluetooth, etc.) to enable the mobile device 105-2 to transmit to the base station 120, location measurements performed by the mobile device 105-1 at the first location 510, in order to spoof the base station 120 into concluding that the mobile device 105-1 is located at the second location 515. The spoofing message transmitted by the mobile device 105-2 on behalf of the mobile device 105-1 is indicated by a dashed arrow 519. A method by which the base station 120 detects this type of position spoofing performed by the mobile device 105-1 is described below using other figures.

[0085] FIG. 6 A illustrates an example pseudo-random number (PN) sequence 600-1 that may be used as a positioning reference signal in accordance with the disclosure. As described above with reference to FIG. 4, a positioning reference signal (PRS) may be transmitted by wireless nodes (e.g., a base station 120) after appropriate configuration by an Operations and Maintenance (O&M) server, for example. As described above with reference to FIG. 4, a PRS may be transmitted in special positioning subframes or slots that are grouped into positioning occasions 510. For example, a PRS positioning occasion 510-1 can comprise a number NPRS of consecutive positioning subframes (also referred to herein as sequence members), where the number NPRS may be between 1 and 160 (e.g., may include the values 1, 2, 4 and 6 as well as other values). The special positioning subframes are illustrated in FIGs. 6A-D in a binary format for purposes of describing cyclic shifting operations that may be performed in accordanceWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -30- with the disclosure. However, in various implementations, a non-binary sequence such as, for example, a low peak-to-average power ratio (PAPR) sequence may be used instead. Some details pertaining to a low-PAPR sequence are provided below. PRS occasions 510 may be grouped into one or more PRS occasion groups. As noted, PRS positioning occasions 510 may occur periodically at intervals, denoted by a number TPRS, of millisecond (or subframe) intervals where TPRS may equal 5, 10, 20, 40, 80, 160, 320, 640, or 1280 (or any other appropriate value). In some aspects, TPRS may be measured in terms of the number of subframes between the start of consecutive positioning occasions.

[0086] A PRS that is used in traditional practice, such as, for example, in 3GPP practice, corresponds to a Gold sequence. The Gold sequence may be transmitted by a base station (such as, the base station 120) and may be used by a UE (such as the mobile device 105-1) to measure a propagation delay that is based upon a separation distance between the UE and the base station. As described above, in an example position location scenario, the base station may obtain from the UE, the measured propagation delay, and use the information to determine a position of the UE. The accuracy and validity of the position determination by the base station is based on the accuracy of the information provided by the UE to the base station. In some cases, such as described above with reference to FIGs 5 A-C, the UE may perform a spoofing operation.

[0087] In an example embodiment, the base station may detect the spoofing operation based on applying a cyclic shift to any of various types of PN sequences transmitted by the base station to one or more UEs. More particularly, in an example implementation, the PN sequence 600-1 is a low peak-to-average power ratio (PAPR) sequence that accommodates cyclic shifting. PAPR can be generally defined as a peak power within a discrete Fourier transform (DFT) block (one OFDM symbol) normalized by an average signal power. PAPR is typically measured for a transmitted signal in an OFDM system wherein an OFDM waveform is created by the sum of multiple sinusoidal signals that can exhibit constructive and / or destructive behavior. A signal with high PAPR may cause a power amplifier (PA) to undesirably operate in its nonlinear region. Consequently, it is desirable to use the low PAPR sequence, which can provide an additional advantage in terms of enabling a cyclic shift.

[0088] In a first example implementation, wherein sequence members are indicatedWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -31- by Is and Os, a fixed number of sequence members can be cyclically shifted on each PRS positioning occasion in accordance with the disclosure. The fixed number of sequence members that are shifted on each PRS positioning occasion can correspond to “n” (n > l).

[0089] In a second example implementation, a variable number of sequence members can be cyclically shifted on each PRS positioning occasion in accordance with the disclosure. The variable number of sequence members that are shifted can correspond to various values of “n” (n > 1). In an example embodiment, “n” may be randomized over a number of PRS positioning occasions. Thus, for example, a first cyclic shift can involve a cyclic shift of three sequence members on a first PRS positioning occasion, followed by a second cyclic shift involving two sequence members on a second PRS positioning occasion, and a third shift involving four sequence members on a third PRS positioning occasions, and so on in a random manner.

[0090] PN sequence 600-1 illustrates a first example PAPR sequence that can be transmitted by a base station to a UE during a first PRS occasion. PN sequence 600-2 (shown in FIG. 6B) illustrates a second example PAPR sequence that can be transmitted by the base station during a second PRS occasion after application of a cyclic shift 605 to the PN sequence 600-1 (shown in FIG. 6 A). The cyclic shift 605 involves moving three sequence members from a first position (dashed box 615) to a second position (dashed box 620) prior to transmission of the second example PAPR sequence 600-2 on the second PRS occasion. The cyclic shift 605 in this example is shown to be made in a clockwise direction. In another implementation, the cyclic shift 605 can be made in a counter-clockwise direction.

[0091] In the first example implementation indicated above wherein a fixed number of sequence members are cyclically shifted, a cyclic shift of three sequence members may be applied to the PN sequence 600-2 (shown in FIG. 6B) and transmitted by the base station during a third PRS occasion, followed by cyclical shifting of three sequence members in each subsequent PN sequence that is transmitted by the base station on subsequent PRS occasions. In an example embodiment, the PN sequences created by the fixed cyclic shift of three sequence members each time, may be transmitted by the base station to different UEs.

[0092] In the second example implementation indicated above wherein a variableWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -32- number of sequence members are cyclically shifted, the PN sequence 600-2 (sequence of FIG. 6B shown in replicated form in FIG. 6C) may be followed by a PN sequence 600-3 (shown in FIG. 6D) which is produced based on a cyclic shift 625 of two sequence members in the PN sequence 600-2. The cyclic shift 625 of the two sequence members is made from a third position (dashed box 630) to a fourth position (dashed box 635). The PN sequence 600-3 is transmitted by the base station to the UE during the third PRS occasion, followed by cyclical shifting of a random number of sequence members in each subsequent PN sequence that is transmitted by the base station to the UE on subsequent PRS occasions.

[0093] In an example embodiment, the cyclical shifting of a random number of sequence members in each PN sequence of multiple PN sequences may be carried out upon each of different signal beams (DL beams, for example) directed to several UEs (either concurrently or at different times). In an example embodiment, a first signal beam directed at a first UE may include PN sequences containing random cyclic shifts that are different than cyclic random cyclic shifts contained in a second signal beam directed at a second UE, in order to prevent spoofing by one or both of the first UE and the second UE.

[0094] FIG. 7A illustrates some example actions that may be carried out in accordance with the disclosure for detecting the position spoofing operation described above with reference to FIG. 5A, and / or for authenticating a position determination operation performed by the mobile device 105-1. In this illustrated scenario, the base station transmits to the mobile device 105-1, at a first PRS occasion, a PN sequence having a first cyclic shift, such as, for example, the PN sequence 600-2 described above. Transmitting of this PN sequence is indicated by an arrow 716.

[0095] In a first scenario wherein the mobile device 105-1 is stationarily located at the first location 510 and is not performing a spoofing operation, the mobile device 105-1 detects the first cyclic shift and provides to the base station 120, a response that provides an indication of the first cyclic shift detected by the mobile device 105-1 (response indicated by arrow 516). The base station 120 may verify the indication of the first cyclic shift that is provided by the mobile device 105-1, in order to authenticate the provided response.

[0096] In an example embodiment, the verification may be performed by comparingWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -33- the first cyclic shift that is detected and reported by the mobile device 105-1 with a threshold parameter that is dependent on the first cyclic shift in the PN sequence transmitted by the base station 120 to the mobile device 105-1. The threshold parameter can, for example, be an amount of time delay that is expected to occur during detection of the PN sequence by the mobile device 105-1 as a result of the introduction of the first cyclic shift in the PN sequence transmitted by the base station 120. In one implementation, the base station 120 may determine the threshold parameter for purposes of the performing the verification.

[0097] If the verification indicates an authentic response (i.e., time delay matches the threshold parameter) the base station 120 can, in as example embodiment, determine a location of the mobile device 105-1 based on determining a propagation delay between the first cyclic shift in the PN sequence transmitted to the mobile device 105-1 and the cyclic shift reported to the base station 120 by the mobile device 105-1 (arrow 516). Conversely, position spoofing may be detected based on detecting that the time delay is different than the threshold parameter.

[0098] At a subsequent PRS occasion, the base station transmits to the mobile device 105-1 a PN sequence having a second cyclic shift, such as, for example, the PN sequence 600-3. The mobile device 105-1 detects the second cyclic shift and provides to the base station 105-1, a response that provides an indication of the second cyclic shift detected by the mobile device 105-1 (response indicated by arrow 516). The base station 120 may verify the indication of the second cyclic shift that is provided by the mobile device 105-1 in order to authenticate the provided response. If the verification indicates an authentic response, the base station 120 can confirm the location of the mobile device 105-1 based on determining a propagation delay between the second cyclic shift in the PN sequence transmitted to the mobile device 105-1 and the cyclic shift reported to the base station 120 by the mobile device 105-1 (arrow 516).

[0099] The procedure described above can be repeated at subsequent PRS occasions using PN sequences having a random cyclic shift at each PRS occasion.

[0100] In the case of the first example position spoofing operation described above, the mobile device 105-1 may move from the first location 510 to the second location 515 and transmit to the base station 120 (transmission indicated by arrow 517), location measurements obtained by the mobile device 105-1 at the first location 510, so as toWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -34- spoof the base station 120 into concluding that the mobile device 105-1 is located at the first location 510. In this scenario, the response provided by the mobile device 105-1 indicating the detected first cyclic shift, the detected second cyclic shift, and other detected cyclic shifts will result in the base station 120 detecting a spoofing operation based on detecting a mismatch between the transmitted cyclic shifts and the detected cyclic shifts reported by the mobile device 105-1 to the base station 120. The mismatch may be detected based on a difference between a propagation delay expected from the mobile device 105-1 if the mobile device 105-1 was located at the second location 515 and the propagation delay obtained as a result of evaluating the spoofed location measurements transmitted by the mobile device 105-1 (transmission indicated by arrow 517). The expected propagation delay can be based on various factors such as, for example, based on a size of coverage area of the base station 120, a speed of motion of the mobile device 105-1, and / or characteristics of a set of sequential cyclic shifts reported by the mobile device 105-1 (monotonicity, mismatches, etc.).

[0101] In an example variant of the scenario described above, the mobile device 105-1 may move from the first location 510 to the second location 515 and transmit to the base station 120 (transmission indicated by arrow 517), location measurements obtained by the mobile device 105-1 at the first location 510. The transmission of the location measurements in this case may be unintentional and not intended to spoof the base station 120 into concluding that the mobile device 105-1 is located at the first location 510. For example, the mobile device 105-1 may, after having moved to the second location 515, fail to evaluate the PN sequence transmitted by the base station 120, and may unintentionally transmit the location measurements made at the first location 510 instead.

[0102] FIG. 7B illustrates some example actions that may be carried out in accordance with the disclosure for detecting the position spoofing operation described above with reference to FIG. 5B. In this illustrated scenario, the base station transmits to the mobile device 105-1, at a first PRS occasion, a PN sequence having a first cyclic shift, such as, for example, the PN sequence 600-2 described above, and PN sequences having other cyclic shifts on subsequent PRS occasions. Transmitting of these PN sequences is indicated here again by the arrow 716. In this example scenario, the mobile device 105-1 may perform a position spoofing operation by remaining at the first location 510 and transmitting to the base station 120, location measurementsWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -35- corresponding to the second location 515, in order to spoof the base station 120 into concluding that the mobile device 105-1 is located at the second location 515. Transmission of the spoofed location is indicated by arrow 518.

[0103] In this scenario, the responses provided by the mobile device 105-1 indicating the detected first cyclic shift, the detected second cyclic shift, and other detected cyclic shifts will result in the base station 120 detecting a spoofing operation based on detecting a mismatch between the transmitted cyclic shifts and the detected cyclic shifts reported by the mobile device 105-1 to the base station 120. The mismatch may be detected based on a difference between a propagation delay expected from the mobile device 105-1 if the mobile device 105-1 was located at the second location 515 and the propagation delay obtained as a result of evaluating the spoofed location measurements transmitted by the mobile device 105-1 from the first location 510 (transmission indicated by arrow 518). The expected propagation delay can be based on various factors such as, for example, based on a size of coverage area of the base station 120, a speed of motion of the mobile device 105-1, and / or characteristics of a set of sequential cyclic shifts reported by the mobile device 105-1 (monotonicity, mismatches, etc.).

[0104] FIG. 7C illustrates some example actions that may be carried out in accordance with the disclosure for detecting the position spoofing operation described above with reference to FIG. 5C. As described above, in this scenario, the mobile device 105-1 remains at the first location 510 and seeks the assistance of another mobile device 105-2 to perform a position spoofing operation. More particularly, the mobile device 105-1 communicates with the mobile device 105-2 (using communication formats such as, for example, WiFi, sidelink, Bluetooth, etc.) to enable the mobile device 105-2 to transmit to the base station 120, location measurements performed by the mobile device 105-1 at the first location 510, in order to spoof the base station 120 into concluding that the mobile device 105-1 is located at the second location 515. The spoofing message transmitted by the mobile device 105-2 on behalf of the mobile device 105-1 is indicated by an arrow 519.

[0105] In this scenario, the responses provided by the mobile device 105-2 indicating the detected first cyclic shift, the detected second cyclic shift, and other detected cyclic shifts will result in the base station 120 detecting a spoofing operationWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -36- based on detecting a mismatch between a propagation delay expected from the mobile device 105-1 when located at the second location 515 and the propagation delay measured by the base station 120 based on the response provided by the mobile device 105-2 (arrow 519). The expected propagation delay can be based on various factors such as, for example, based on a size of coverage area of the base station 120, a speed of motion of the mobile device 105-1, and / or characteristics of a set of sequential cyclic shifts reported by the mobile device 105-1 (monotonicity, mismatches, etc.).

[0106] In one implementation variation, the base station 120 may apply randomized cyclic shifting to PN sequences transmitted to one or more UEs in the manner described above with reference to FIGs. 6A-D, and may inform the one or more UEs of a transmitted cyclic shift. For example, the base station 120 may apply a first cyclic shift to a first PN sequence transmitted to the mobile device 105 and may inform the mobile device 105 of a first transmitted cyclic shift that is different than the first cyclic shift actually applied to the first PN sequence. The mobile device 105 may respond by transmitting a report to the base station 120 containing information about a relative difference between the first cyclic shift and the first transmitted cyclic shift that is determined by the mobile device 105. The base station 120 may then apply a second cyclic shift to a second PN sequence transmitted to the mobile device 105 and may inform the mobile device 105 of a second transmitted cyclic shift that is different than the second cyclic shift actually applied to the second PN sequence. The mobile device 105 responds by transmitting a report to the base station 120 containing information about a relative difference between the second cyclic shift and the second transmitted cyclic shift that is determined by the mobile device 105. This procedure is repeated for each subsequent PN sequence containing randomized cyclic shifts. The base station 120 may detect a spoofing operation based on the responses provided by the mobile device 105. The evaluating can involve comparing each of the responses provided by the mobile device 105 to a respective transmitted cyclic shift indicated by the base station 120.

[0107] FIG. 8 is a flowchart 800 of a method performed by a base station to detect position spoofing by one or more UEs. Means for performing the functionality illustrated in one or more of the blocks of the flowchart 800 may be performed by hardware and / or software components of a base station such as described herein with reference to the base station 120.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -37-

[0108] At block 805, the functionality can include transmitting, to a first user equipment (UE), at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift. Some details pertaining to this functionality are provided herein, for example, with reference to FIGs. 6A-D that illustrate cyclic shift operations performed upon a PN sequence. The PN sequence having the cyclic shift can be used by the base station to detect position spoofing performed by the first UE. In one embodiment, the first PN sequence is a PAPR sequence that accommodates cyclic shifting, such as, for example, a low-power PAPR sequence that accommodates cyclic shifting. Means and / or structure for performing the functionality at block 805 may comprise one or more components of a base station, such as, for example, the base station 120. The first UE can be, for example, the UE 205 shown in FIG. 2 and described herein.

[0109] As described above with reference to FIG. 1, the base station 120 may, depending on the technology of the network 170, include one or more of a node B, an Evolved Node B (eNodeB or eNB), a base transceiver station (BTS), a radio base station (RBS), a New Radio (NR) NodeB, a Next Generation Node B (gNB), a Next Generation eNB (ng-eNB), or the like. A base station 120 that is a gNB or ng-eNB may be part of a Next Generation Radio Access Network (NG-RAN) which may connect to a 5G Core Network (5GC) in the case that Network 170 is a 5G network. The functionality performed by a base station 120 in earlier-generation networks (e.g., 3G and 4G) may be separated into different functional components (e.g., radio units (RUs), distributed units (DUs), and central units (CUs)) and layers (e.g., L1 / L2 / L3) in view Open Radio Access Networks (O-RAN) and / or Virtualized Radio Access Network (V- RAN or vRAN) in 5G or later networks, which may be executed on different devices at different locations connected, for example, via fronthaul, midhaul, and backhaul connections. As referred to herein, a “base station” (or ng-eNB, gNB, etc.) may include any or all of these functional components.

[0110] At block 810, the functionality can include receiving, from the first UE, a first response indicating a first detected cyclic shift detected by the first UE in the first PN sequence. Some details pertaining to this functionality are provided herein, for example, with reference to FIGs. 7A-C that illustrate various types of responses received by a base station. Means and / or structure for performing the functionality at block 810 may comprise one or more components of a base station, such as, forWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -38- example, the base station 120 described herein.[OHl] At block 815, the functionality can include determining a first difference between the first detected cyclic shift and the first cyclic shift. In an example scenario, the first response received from the first UE can be a valid response that includes an accurate detected cyclic shift. In another example scenario, the first response received from the first UE can be a part of a position spoofing operation performed by the first UE. In this case, the detected cyclic shift received from the first UE may be false (or falsified). Means and / or structure for performing the functionality at block 815 may comprise one or more components of a base station, such as, for example, the base station 120 described herein.

[0112] At block 820, the functionality can include authenticating a position determination operation performed by the first UE, based on the first difference. More particularly, the base station may authenticate the position determination operation performed by the first UE, based on determining that the first difference between the first detected cyclic shift and the first cyclic shift is accurate. Means and / or structure for performing the functionality at block 820 may comprise one or more components of a base station, such as, for example, the base station 120 described herein.

[0113] In an example embodiment, evaluating the first difference may involve the base station setting a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the PN sequence comprising the first cyclic shift. Position spoofing may be detected based, at least in part, on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter.

[0114] In an example embodiment, the base station may transmit, to the first UE, at a second instance, a second PN sequence comprising a second cyclic shift that is different than the first cyclic shift. The base station may receive, from the first UE, a second response indicating a second detected cyclic shift that is detected by the first UE in the second PN sequence, and may determine a second difference between the second detected cyclic shift and the second cyclic shift. The base station may further set a second threshold parameter based on the second detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the second PN sequence containing the second cyclic shift. Position spoofing may be detected based onWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -39- determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter and that the second difference between the second detected cyclic shift and the second cyclic shift violates the second threshold parameter.

[0115] In an example scenario, the first response and / or the second response referred to above in connection with position spoofing, may be transmitted by a second UE that performs position spoofing on behalf of the first UE.

[0116] In an example embodiment, the base station may authenticate a position determination operation performed by the first UE, based on determining that the first detected cyclic shift has a monotonic relationship with respect to the second detected cyclic shift. Conversely, the base station may detect position spoofing based on determining that the first detected cyclic shift has a non-monotonic relationship with respect to the second detected cyclic shift.

[0117] In an example embodiment, the first cyclic shift referred to above, can be a random cyclic shift that is set by the base station. In this case, the base station may set a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the first PN sequence comprising the random cyclic shift. Position spoofing may be detected based, at least in part, on determining that the first difference between the first detected cyclic shift and the random cyclic shift violates the first threshold parameter.

[0118] In an example embodiment, the base station may transmit to the first UE, a second signal containing an indication of a verification cyclic shift that is different than the first cyclic shift. The base station may then receive from the first UE, a second response in lieu of, or in addition to, the first response. The second response may include an indication of a second detected cyclic shift detected by the first UE based on the verification cyclic shift. The base station determines a second difference between the second detected cyclic shift and the verification cyclic shift and authenticate the position determination operation based on the second difference.

[0119] FIG. 9 is a flowchart 900 of a method performed by a first UE to assist a base station authenticate a position determination operation performed by the first UE. Means for performing the functionality illustrated in one or more of the blocks of the flowchart 900 may be performed by hardware and / or software components of a UE suchWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -40- as, for example, described herein with reference to the UE 205.

[0120] At block 905, the functionality can include receiving, from the base station, at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift. Some details pertaining to this functionality are provided above, for example, with reference to FIGs. 6A-D that illustrate cyclic shift operations performed upon a PN sequence. Means and / or structure for performing the functionality at block 905 may comprise one or more components of a UE, such as, for example, the UE 205 described herein. The base station in this example can be the base station 120 described herein.

[0121] As described above with reference to FIG. 2, the UE 205 may include and / or be referred to as a device, a mobile device, a wireless device, a mobile terminal, a terminal, a mobile station (MS), a Secure User Plane Location (SUPL)-Enabled Terminal (SET), or by some other name. Moreover, UE 205 may correspond to a cellphone, smartphone, laptop, tablet, personal data assistant (PDA), navigation device, Internet of Things (loT) device, or some other portable or moveable device.

[0122] At block 910, the functionality can include evaluating the first PN sequence to identify the first cyclic shift. Particulars pertaining to the evaluation, such as, for example, the use of a threshold parameter, are described above. Means and / or structure for performing the functionality at block 905 may comprise one or more components of a UE, such as, for example, the UE 205 described herein.

[0123] At block 915, the functionality can include transmitting, to the base station, a first response indicating the identified first cyclic shift, wherein the identified first cyclic shift is useable by the base station to authenticate a position determination operation performed by the first UE, based at least in part, on a first difference between the identified first cyclic shift and the first cyclic shift. Means and / or structure for performing the functionality at block 905 may comprise one or more components of a UE, such as, for example, the UE 205 described herein.

[0124] In an example scenario, the identified first cyclic shift is a false cyclic shift that may be transmitted to the base station by the first UE as a part of a position spoofing operation or transmitted to the base station by a second UE on behalf of the first UE as a part of a position spoofing operation.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -41-

[0125] In an example scenario, the first cyclic shift may be identified by the first UE at a first location and transmitted to the base station by the first UE from a second location. Transmitting of the identified first cyclic shift by the UE from the second location may be either a part of a position spoofing operation or may be unintentional.

[0126] FIG. 10 illustrates an embodiment of a UE such as, for example, the mobile device 105, which can be utilized as described herein with reference to FIGS. 1- 8 for example. It should be noted that FIG. 10 is meant only to provide a generalized illustration of various components, any or all of which may be utilized as appropriate. It can be noted that, in some instances, components illustrated by FIG. 10 can be localized to a single physical device and / or distributed among various networked devices, which may be disposed at different physical locations. Furthermore, as previously noted, the functionality of the UE discussed in the previously described embodiments may be executed by one or more of the hardware and / or software components illustrated in FIG. 10.

[0127] The mobile device 105 is shown comprising hardware elements that can be electrically coupled via a bus 1005 (or may otherwise be in communication, as appropriate). The hardware elements may include a processing unit(s) 1010 which can include without limitation one or more general-purpose processors, one or more specialpurpose processors (such as DSP chips, graphics acceleration processors, application specific integrated circuits (ASICs), and / or the like), and / or other processing structures or means. As shown in FIG. 10, some embodiments may have a separate DSP 1020, depending on desired functionality. Location determination authentication, spoofing detection, and / or other operations that may be based on wireless communication can be provided in the processing unit(s) 1010 and / or wireless communication interface 1030 (discussed below). The mobile device 105 can also include one or more input devices 1070, which can include without limitation one or more keyboards, touch screens, touch pads, microphones, buttons, dials, switches, and / or the like; and one or more output devices 1015, which can include without limitation one or more displays (e.g., touch screens), light emitting diodes (LEDs), speakers, and / or the like.

[0128] The mobile device 105 may also include a wireless communication interface 1030, which may comprise without limitation a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as aWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -42-Bluetooth® device, an IEEE 802.11 device, an IEEE 802.15.4 device, a Wi-Fi device, a WiMAX device, a WAN device, and / or various cellular devices, etc.), and / or the like, which may enable the mobile device 105 to communicate with other devices such as, for example, the mobile device 105-2 and the base stations 120 described in the embodiments above. The wireless communication interface 1030 may permit data and signaling to be communicated (e.g., transmitted and received) with TRPs of a network, for example, via eNBs, gNBs, ng-eNBs, access points, various base stations and / or other access node types, and / or other network components, computer systems, and / or any other electronic devices communicatively coupled with TRPs, as described herein. The communication can be carried out via one or more wireless communication antenna(s) 1032 that send and / or receive wireless signals 1034. According to some embodiments, the wireless communication antenna(s) 1032 may comprise a plurality of discrete antennas, antenna arrays, or a combination thereof.

[0129] Depending on desired functionality, the wireless communication interface 1030 may comprise a separate receiver and transmitter, or a combination of transceivers, transmitters, and / or receivers to communicate with base stations (e.g., ng- eNBs and gNBs) and other terrestrial transceivers, such as wireless devices and access points. The mobile device 105 may communicate with different data networks that may comprise various network types. For example, a Wireless Wide Area Network (WWAN) may be a CDMA network, a Time Division Multiple Access (TDMA) network, a Frequency Division Multiple Access (FDMA) network, an Orthogonal Frequency Division Multiple Access (OFDMA) network, a Single-Carrier Frequency Division Multiple Access (SC-FDMA) network, a WiMAX (IEEE 802.16) network, and so on. A CDMA network may implement one or more RATs such as CDMA2000, WCDMA, and so on. CDMA2000 includes IS-95, IS-2000 and / or IS-856 standards. A TDMA network may implement GSM, Digital Advanced Mobile Phone System (D- AMPS), or some other RAT. An OFDMA network may employ LTE, LTE Advanced, 5G NR, and so on. 5G NR, LTE, LTE Advanced, GSM, and WCDMA are described in documents from 3GPP. Cdma2000 is described in documents from a consortium named “3rd Generation Partnership Project 3” (3GPP2). 3GPP and 3GPP2 documents are publicly available. A WLAN may also be an IEEE 802.1 lx network, and a wireless personal area network (WPAN) may be a Bluetooth network, an IEEE 802.15x, or some other type of network. The techniques described herein may also be used for aWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -43- combination of WWAN, WLAN and / or WP AN.

[0130] The mobile device 105 can further include sensor(s) 1040. Sensors 1040 may comprise, without limitation, one or more inertial sensors and / or other sensors (e.g., accelerometer(s), gyroscope(s), camera(s), magnetometer(s), altimeter(s), microphone(s), proximity sensor(s), light sensor(s), barometer(s), and the like), some of which may be used to authenticate location determination and to detect position spoofing, for example.

[0131] Embodiments of the mobile device 105 may also include a Global Navigation Satellite System (GNSS) receiver 1080 capable of receiving signals 1084 from one or more GNSS satellites using an antenna 1082 (which could be the same as antenna 1032). Positioning based on GNSS signal measurement can be utilized to complement and / or incorporate the techniques described herein. The GNSS receiver 1080 can extract a position of the mobile device 105, using conventional techniques, from GNSS satellites 110 of a GNSS system, such as Global Positioning System (GPS), Galileo, GLONASS, Quasi-Zenith Satellite System (QZSS) over Japan, Indian Regional Navigational Satellite System (IRNSS) over India, BeiDou Navigation Satellite System (BDS) over China, and / or the like. Moreover, the GNSS receiver 1080 can be used with various augmentation systems (e.g., a Satellite Based Augmentation System (SB AS)) that may be associated with or otherwise enabled for use with one or more global and / or regional navigation satellite systems, such as, e.g., Wide Area Augmentation System (WAAS), European Geostationary Navigation Overlay Service (EGNOS), Multifunctional Satellite Augmentation System (MSAS), and Geo Augmented Navigation system (GAGAN), and / or the like.

[0132] It can be noted that, although GNSS receiver 1080 is illustrated in FIG. 10 as a distinct component, embodiments are not so limited. As used herein, the term “GNSS receiver” may comprise hardware and / or software components configured to obtain GNSS measurements (measurements from GNSS satellites). In some embodiments, therefore, the GNSS receiver may comprise a measurement engine executed (as software) by one or more processing units, such as processing unit(s) 1010, DSP 1020, and / or a processing unit within the wireless communication interface 1030 (e.g., in a modem). A GNSS receiver may optionally also include a positioning engine, which can use GNSS measurements from the measurement engine to determine a position of theWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -44-GNSS receiver using an Extended Kalman Filter (EKF), Weighted Least Squares (WLS), a hatch filter, particle filter, or the like. The positioning engine may also be executed by one or more processing units, such as processing unit(s) 1010 or DSP 1020.

[0133] The mobile device 105 may further include and / or be in communication with a memory 1060. The memory 1060 can include, without limitation, local and / or network accessible storage, a disk drive, a drive array, an optical storage device, a solid- state storage device, such as a random access memory (RAM), and / or a read-only memory (ROM), which can be programmable, flash-updateable, and / or the like. Such storage devices may be configured to implement any appropriate data stores, including without limitation, various file systems, database structures, and / or the like.

[0134] The memory 1060 of the mobile device 105 also can comprise software elements (not shown in FIG. 10), including an operating system, device drivers, executable libraries, and / or other code, such as one or more application programs, which may comprise computer programs provided by various embodiments, and / or may be designed to implement methods, and / or configure systems, provided by other embodiments, as described herein. Merely by way of example, one or more procedures described with respect to the method(s) discussed above may be implemented as code and / or instructions in memory 1060 that are executable by the mobile device 105 (and / or processing unit(s) 1010 or DSP 1020 within mobile device 115). In an aspect, then such code and / or instructions can be used to configure and / or adapt a general- purpose computer (or other device) to perform one or more operations in accordance with the described methods.

[0135] FIG. 11 illustrates an embodiment of the base station 120 described above. As indicated above, a base station may also be referred to as a TRP (also known as transmit / receive point), a “gNB,” or a “ng-eNB.” Physical transmission points may comprise an array of antennas of the base station 120 (e.g., as in a Multiple Input- Multiple Output (MIMO) system and / or where the base station employs beamforming). According to aspects of applicable 5G cellular standards, the base station 120 (e.g., gNB) may be capable of transmitting different “beams” in different directions and performing “beam sweeping” in which a signal is transmitted in different beams, along different directions (e.g., one after the other). The term “base station” used herein may additionally refer to multiple non-co-located physical transmission points, the physicalWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -45- transmission points may be a Distributed Antenna System (DAS) (a network of spatially separated antennas connected to a common source via a transport medium) or a Remote Radio Head (RRH) (a remote base station connected to a serving base station).

[0136] The base station 120 can be utilized in various ways as described above (e.g., in association with FIGS. 1-8). For example, the base station 120 can perform one or more of the functions of the method shown in FIG. 8. It should be noted that FIG. 11 is meant only to provide a generalized illustration of various components, any or all of which may be utilized as appropriate. Furthermore, as indicated above, the term “base station” may generically refer to a single physical transmission point, or multiple colocated physical transmission points, which may be located at a base station 120.

[0137] The base station 120 is shown comprising hardware elements that can be electrically coupled via a bus 1105 (or may otherwise be in communication, as appropriate). The hardware elements may include a processing unit(s) 1110 which can include without limitation one or more general-purpose processors, one or more specialpurpose processors (such as DSP chips, graphics acceleration processors, ASICs, and / or the like), and / or other processing structure or means. As shown in FIG. 11, some embodiments may have a separate DSP 1120, depending on desired functionality. Operations such as authenticating location determination and detecting position spoofing, for example, that may be based on wireless communication can be provided in the processing unit(s) 1110 and / or wireless communication interface 1130 according to some embodiments.

[0138] The wireless communication interface 1130 may comprise without limitation a modem, a network card, an infrared communication device, a wireless communication device, and / or a chipset (such as a Bluetooth® device, an IEEE 802.11 device, an IEEE 802.15.4 device, a Wi-Fi device, a WiMAX device, cellular communication facilities, etc.), and / or the like, which may enable the base station 120 to communicate as described herein. The wireless communication interface 1130 may permit data and signaling to be communicated (e.g., transmitted and received) to UEs, other base stations / TRPs (e.g., eNBs, gNBs, and ng-eNBs), and / or other network components, computer systems, and / or any other electronic devices described herein. The communication can be carried out via one or more wireless communication antenna(s) 1132 that send and / or receive wireless signals 1134.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -46-

[0139] The base station 120 may also include a network interface 1180, which can include support of wireline communication technologies. The network interface 1180 may include a modem, network card, chipset, and / or the like. The network interface 1180 may include one or more input and / or output communication interfaces to permit data to be exchanged with a network, communication network servers, computer systems, and / or any other electronic devices described herein.

[0140] In many embodiments, the base station 120 may further comprise a memory 1160. The memory 1160 can include, without limitation, local and / or network accessible storage, a disk drive, a drive array, an optical storage device, a solid-state storage device, such as a RAM, and / or a ROM, which can be programmable, flash- updateable, and / or the like. Such storage devices may be configured to implement any appropriate data stores, including without limitation, various file systems, database structures, and / or the like.

[0141] The memory 1160 of the base station 120 also may comprise software elements (not shown in FIG. 11), including an operating system, device drivers, executable libraries, and / or other code, such as one or more application programs, which may comprise computer programs provided by various embodiments, and / or may be designed to implement methods, and / or configure systems, provided by other embodiments, as described herein. Merely by way of example, one or more procedures described with respect to the method(s) discussed above may be implemented as code and / or instructions in memory 1160 that are executable by the base station 120 (and / or processing unit(s) 1110 or DSP 1120 within base station 120). In an aspect, then such code and / or instructions can be used to configure and / or adapt a general-purpose computer (or other device) to perform one or more operations in accordance with the described methods.

[0142] It will be apparent to those skilled in the art that substantial variations may be made in accordance with specific requirements. For example, customized hardware might also be used and / or particular elements might be implemented in hardware, software (including portable software, such as applets, etc.), or both. Further, connection to other computing devices such as network input / output devices may be employed.

[0143] With reference to the appended figures, components that can include memory can include non-transitory machine-readable media. The term “machine-WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -47- readable medium” and “computer-readable medium” as used herein, refer to any storage medium that participates in providing data that causes a machine to operate in a specific fashion. In embodiments provided hereinabove, various machine-readable media might be involved in providing instructions / code to processors and / or other device(s) for execution. Additionally or alternatively, the machine-readable media might be used to store and / or carry such instructions / code. In many implementations, a computer- readable medium is a physical and / or tangible storage medium. Such a medium may take many forms, including but not limited to, non-volatile media and volatile media. Common forms of computer-readable media include, for example, magnetic and / or optical media, any other physical medium with patterns of holes, a RAM, a programmable ROM (PROM), erasable PROM (EPROM), a FLASH-EPROM, any other memory chip or cartridge, or any other medium from which a computer can read instructions and / or code.

[0144] The methods, systems, and devices discussed herein are examples. Various embodiments may omit, substitute, or add various procedures or components as appropriate. For instance, features described with respect to certain embodiments may be combined in various other embodiments. Different aspects and elements of the embodiments may be combined in a similar manner. The various components of the figures provided herein can be embodied in hardware and / or software. Also, technology evolves and, thus many of the elements are examples that do not limit the scope of the disclosure to those specific examples.

[0145] It has proven convenient at times, principally for reasons of common usage, to refer to such signals as bits, information, values, elements, symbols, characters, variables, terms, numbers, numerals, or the like. It should be understood, however, that all of these or similar terms are to be associated with appropriate physical quantities and are merely convenient labels. Unless specifically stated otherwise, as is apparent from the discussion above, it is appreciated that throughout this Specification discussion utilizing terms such as “processing,” “computing,” “calculating,” “determining,” “ascertaining,” “identifying,” “associating,” “measuring,” “performing,” or the like refer to actions or processes of a specific apparatus, such as a special purpose computer or a similar special purpose electronic computing device. In the context of this Specification, therefore, a special purpose computer or a similar special purpose electronic computing device is capable of manipulating or transforming signals, typically represented asWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -48- physical electronic, electrical, or magnetic quantities within memories, registers, or other information storage devices, transmission devices, or display devices of the special purpose computer or similar special purpose electronic computing device.

[0146] Terms, “and” and “or” as used herein, may include a variety of meanings that also is expected to depend, at least in part, upon the context in which such terms are used. Typically, “or” if used to associate a list, such as A, B, or C, is intended to mean A, B, and C, here used in the inclusive sense, as well as A, B, or C, here used in the exclusive sense. In addition, the term “one or more” as used herein may be used to describe any feature, structure, or characteristic in the singular or may be used to describe some combination of features, structures, or characteristics. However, it should be noted that this is merely an illustrative example and claimed subject matter is not limited to this example. Furthermore, the term “at least one of’ if used to associate a list, such as A, B, or C, can be interpreted to mean any combination of A, B, and / or C, such as A, AB, AA, AAB, AABBCCC, etc.

[0147] Having described several embodiments, various modifications, alternative constructions, and equivalents may be used without departing from the scope of the disclosure. For example, the above elements may merely be a component of a larger system, wherein other rules may take precedence over or otherwise modify the application of the various embodiments. Also, a number of steps may be undertaken before, during, or after the above elements are considered. Accordingly, the above description does not limit the scope of the disclosure.

[0148] In view of this description embodiments may include different combinations of features. Implementation examples are described in the following numbered clauses:

[0149] Clause 1 A method performed by a base station to authenticate position determination comprising transmitting, to a first user equipment (UE), at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; receiving, from the first UE, a first response indicating a first detected cyclic shift detected by the first UE in the first PN sequence; determining a first difference between the first detected cyclic shift and the first cyclic shift; and authenticating a position determination operation based on the first difference.

[0150] Clause 2 The method of clause 1, wherein the first PN sequence accommodates cyclic shifting.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -49-

[0151] Clause 3 The method of either clause 1 or 2, further comprising setting a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the first signal; and detecting position spoofing based, at least in part, on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter.

[0152] Clause 4 The method of clause 3, further comprising transmitting, to the first UE, at a second instance, a second signal comprising a second PN sequence that provides an indication of a second cyclic shift that is different than the first cyclic shift; receiving, from the first UE, a second response indicating a second detected cyclic shift that is detected by the first UE in the second PN sequence; determining a second difference between the second detected cyclic shift and the second cyclic shift; setting a second threshold parameter based on the second detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the second signal; and detecting position spoofing based on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter and that the second difference between the second detected cyclic shift and the second cyclic shift violates the second threshold parameter.

[0153] Clause 5 The method of clause 4, wherein at least one of the first response or the second response is transmitted by a second UE that performs position spoofing on behalf of the first UE.

[0154] Clause 6 The method of clause 4, further comprising authenticating the position determination operation based on determining that at least one of the first difference or the second difference has a monotonic relationship with respect to two or more previously detected differences; and detecting position spoofing further based on determining that the at least one of the first difference or the second difference has a non-monotonic relationship with respect to the two or more previously detected differences.

[0155] Clause 7 The method of either clause 1 or clause 2, wherein the first cyclic shift is a random cyclic shift that is set by the base station, and wherein the method further comprises setting a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the firstWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -50-UE, the first PN sequence comprising the random cyclic shift; and detecting position spoofing based, at least in part, on determining that the first difference between the first detected cyclic shift and the random cyclic shift violates the first threshold parameter.

[0156] Clause 8 The method of clause 1, further comprising transmitting, to the first UE, at a second instance, a second signal comprising an indication of a verification cyclic shift that is different than the first cyclic shift; receiving, from the first UE, a second response in lieu of, or in addition to, the first response, the second response indicating a second detected cyclic shift detected by the first UE based on the verification cyclic shift; determining a second difference between the second detected cyclic shift and the verification cyclic shift; and authenticating the position determination operation based on the second difference.

[0157] Clause 9 A method performed by a first user equipment (UE) to assist a base station to authenticate position determination, comprising receiving, from the base station, at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; evaluating the first PN sequence to identify the first cyclic shift; and transmitting, to the base station, a first response indicating the identified first cyclic shift, wherein the identified first cyclic shift is useable by the base station to authenticate a position determination operation performed by the first UE, based at least in part, on a first difference between the identified first cyclic shift and the first cyclic shift.

[0158] Clause 10 The method of clause 9, wherein the identified first cyclic shift is further useable by the base station to detect a position spoofing operation performed by the first UE based, at least in part, on the first difference between the identified first cyclic shift and the first cyclic shift.

[0159] Clause 11 The method of either clause 9 or clause 10, wherein the first PN sequence accommodates cyclic shifting.

[0160] Clause 12 The method of any of clauses 9, 10, or 11, wherein the identified first cyclic shift is a false cyclic shift transmitted to the base station by the first UE as a part of a position spoofing operation.

[0161] Clause 13 The method of any of clauses 9, 10, or 11, wherein the identified first cyclic shift is a false cyclic shift transmitted to the base station by a second UE onWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -51- behalf of the first UE as a part of a position spoofing operation.

[0162] Clause 14 The method of clause 13, wherein the first UE enables the second UE to transmit the false cyclic shift based on communications between the first UE and the second UE.

[0163] Clause 15 The method of clause 9, wherein the first cyclic shift is identified by the first UE at a first location and transmitted to the base station by the first UE from a second location.

[0164] Clause 16 The method of clause 15, wherein the first cyclic shift transmitted to the base station from the second location is one of unintentional or is a part of a position spoofing operation.

[0165] Clause 17 A base station comprising at least one transceiver; at least one memory; and one or more processors communicatively coupled with the at least one memory, the one or more processors configured to transmit via the at least one transceiver, to a first user equipment (UE), at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; receive via the at least one transceiver, from the first UE, a first response indicating a first detected cyclic shift detected by the first UE in the first PN sequence; determine a first difference between the first detected cyclic shift and the first cyclic shift; and authenticate a position determination operation based at least in part on the first difference.

[0166] Clause 18 The base station of clause 17, wherein the first PN sequence is a peak-to-average power ratio (PAPR) sequence that accommodates cyclic shifting.

[0167] Clause 19 The base station of either of clause 17 or clause 18, wherein the one or more processors are further configured to set a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the PN sequence comprising the first cyclic shift; and detect position spoofing based, at least in part, on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter.

[0168] Clause 20 The base station of clause 19, wherein the one or more processors are further configured to transmit via the at least one transceiver, to the first UE, at aWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -52- second instance, a second PN sequence comprising a second cyclic shift that is different than the first cyclic shift; receive via the at least one transceiver, from the first UE, a second response indicating a second detected cyclic shift that is detected by the first UE in the second PN sequence; determine a second difference between the second detected cyclic shift and the second cyclic shift; set a second threshold parameter based on the second detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the second PN sequence comprising the second cyclic shift; and detect position spoofing based on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter and that the second difference between the second detected cyclic shift and the second cyclic shift violates the second threshold parameter.

[0169] Clause 21 The base station of clause 20, wherein at least one of the first response or the second response is transmitted by a second UE that performs position spoofing on behalf of the first UE.

[0170] Clause 22 The base station of clause 20, wherein the one or more processors are further configured to authenticate the position determination operation based on determining that at least one of the first difference or the second difference has a monotonic relationship with respect to two or more previously detected differences; and detect position spoofing further based on determining that the at least one of the first difference or the second difference has a non-monotonic relationship with respect to the two or more previously detected differences.

[0171] Clause 23 The base station of either of clause 17 or clause 18, wherein the first cyclic shift is a random cyclic shift that is set by the base station, and wherein the one or more processors are further configured to set a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the first PN sequence comprising the random cyclic shift; and detect position spoofing based, at least in part, on determining that the first difference between the first detected cyclic shift and the random cyclic shift violates the first threshold parameter.

[0172] Clause 24 A first user equipment (UE) comprising at least one transceiver; at least one memory; and one or more processors communicatively coupled with the at least one memory, the one or more processors configured to receive via the at least oneWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -53- transceiver, from a base station, at a first instance, a first pseudo-random number (PN) sequence comprising a first cyclic shift; evaluate the first PN sequence to identify the first cyclic shift; and transmit via the at least one transceiver, to the base station, a first response indicating the identified first cyclic shift, wherein the identified first cyclic shift is useable by the base station to authenticate a position determination operation performed by the first UE, based at least in part, on a first difference between the identified first cyclic shift and the first cyclic shift.

[0173] Clause 25 The first UE of clause 24, wherein the identified first cyclic shift is further useable by the base station to detect a position spoofing operation performed by the first UE based, at least in part, on the first difference between the identified first cyclic shift and the first cyclic shift.

[0174] Clause 26 The first UE of either of clause 24 or clause 25, wherein the first PN sequence accommodates cyclic shifting.

[0175] Clause 27 The first UE of either of clause 24 or clause 25, wherein the identified first cyclic shift is a false cyclic shift transmitted to the base station by the first UE as a part of a position spoofing operation.

[0176] Clause 28 The first UE of either of clause 24 or clause 25, wherein the identified first cyclic shift is a false cyclic shift transmitted to the base station by a second UE on behalf of the first UE as a part of a position spoofing operation.

[0177] Clause 29 The first UE of clause 28, wherein the first UE enables the second UE to transmit the false cyclic shift based on communications between the first UE and the second UE.

[0178] Clause 30 The first UE of either of clause 24 or clause 25, wherein the first cyclic shift is identified by the first UE at a first location and transmitted to the base station by the first UE from a second location.WAVS Ref. No. QLCMP465WO

Claims

Qualcomm Ref. No. 2403838WO -54-CLAIMSWhat is claimed is:

1. A method performed by a base station to authenticate position determination, comprising: transmitting, to a first user equipment (UE), at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; receiving, from the first UE, a first response indicating a first detected cyclic shift detected by the first UE in the first PN sequence; determining a first difference between the first detected cyclic shift and the first cyclic shift; and authenticating a position determination operation based on the first difference.

2. The method of claim 1, wherein the first PN sequence accommodates cyclic shifting.

3. The method of claim 1, further comprising: setting a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the first signal; and detecting position spoofing based, at least in part, on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter.

4. The method of claim 3, further comprising: transmitting, to the first UE, at a second instance, a second signal comprising a second PN sequence that provides an indication of a second cyclic shift that is different than the first cyclic shift; receiving, from the first UE, a second response indicating a second detected cyclic shift that is detected by the first UE in the second PN sequence; determining a second difference between the second detected cyclic shift and the second cyclic shift; setting a second threshold parameter based on the second detected cyclicWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -55- shift expected to be received from the first UE in response to transmitting to the first UE, the second signal; and detecting position spoofing based on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter and that the second difference between the second detected cyclic shift and the second cyclic shift violates the second threshold parameter.

5. The method of claim 4, wherein at least one of the first response or the second response is transmitted by a second UE that performs position spoofing on behalf of the first UE.

6. The method of claim 4, further comprising: authenticating the position determination operation based on determining that at least one of the first difference or the second difference has a monotonic relationship with respect to two or more previously detected differences; and detecting position spoofing further based on determining that the at least one of the first difference or the second difference has a non-monotonic relationship with respect to the two or more previously detected differences.

7. The method of claim 1, wherein the first cyclic shift is a random cyclic shift that is set by the base station, and wherein the method further comprises: setting a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the first signal; and detecting position spoofing based, at least in part, on determining that the first difference between the first detected cyclic shift and the random cyclic shift violates the first threshold parameter.

8. The method of claim 1, further comprising: transmitting, to the first UE, at a second instance, a second signal comprising an indication of a verification cyclic shift that is different than the first cyclic shift; receiving, from the first UE, a second response in lieu of, or in addition to, the first response, the second response indicating a second detected cyclic shift detected by the first UE based on the verification cyclic shift;WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -56- determining a second difference between the second detected cyclic shift and the verification cyclic shift; and authenticating the position determination operation based on the second difference.

9. A method performed by a first user equipment (UE) to assist a base station to authenticate position determination, comprising: receiving, from the base station, at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; evaluating the first PN sequence to identify the first cyclic shift; and transmitting, to the base station, a first response indicating the identified first cyclic shift, wherein the identified first cyclic shift is useable by the base station to authenticate a position determination operation based, at least in part, on a first difference between the identified first cyclic shift and the first cyclic shift.

10. The method of claim 9, wherein the identified first cyclic shift is further useable by the base station to detect a position spoofing operation performed by the first UE based, at least in part, on the first difference between the identified first cyclic shift and the first cyclic shift.

11. The method of claim 9, wherein the first PN sequence accommodates cyclic shifting.

12. The method of claim 9, wherein the identified first cyclic shift is a false cyclic shift transmitted to the base station by the first UE as a part of a position spoofing operation.

13. The method of claim 9, wherein the identified first cyclic shift is a false cyclic shift transmitted to the base station by a second UE on behalf of the first UE as a part of a position spoofing operation.

14. The method of claim 13, wherein the first UE enables the second UE to transmit the false cyclic shift based on communications between the first UE and the second UE.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -57-15. The method of claim 9, wherein the first cyclic shift is identified by the first UE at a first location and transmitted to the base station by the first UE from a second location.

16. The method of claim 15, wherein the first cyclic shift transmitted to the base station from the second location is one of unintentional or is a part of a position spoofing operation.

17. A base station comprising: at least one transceiver; at least one memory; and one or more processors communicatively coupled with the at least one memory, the one or more processors configured to: transmit via the at least one transceiver, to a first user equipment (UE), at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; receive via the at least one transceiver, from the first UE, a first response indicating a first detected cyclic shift detected by the first UE in the first PN sequence; determine a first difference between the first detected cyclic shift and the first cyclic shift; and authenticate a position determination operation based at least in part on the first difference.

18. The base station of claim 17, wherein the first PN sequence accommodates cyclic shifting.

19. The base station of claim 17, wherein the one or more processors are further configured to: set a first threshold parameter based on the first detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the first signal; and detect position spoofing based, at least in part, on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -58-20. The base station of claim 19, wherein the one or more processors are further configured to: transmit via the at least one transceiver, to the first UE, at a second instance, a second signal comprising a second PN sequence that provides an indication of a second cyclic shift that is different than the first cyclic shift; receive via the at least one transceiver, from the first UE, a second response indicating a second detected cyclic shift that is detected by the first UE in the second PN sequence; determine a second difference between the second detected cyclic shift and the second cyclic shift; set a second threshold parameter based on the second detected cyclic shift expected to be received from the first UE in response to transmitting to the first UE, the second signal; and detect position spoofing based on determining that the first difference between the first detected cyclic shift and the first cyclic shift violates the first threshold parameter and that the second difference between the second detected cyclic shift and the second cyclic shift violates the second threshold parameter.

21. The base station of claim 20, wherein at least one of the first response or the second response is transmitted by a second UE that performs position spoofing on behalf of the first UE.

22. The base station of claim 20, wherein the one or more processors are further configured to: authenticate the position determination operation based on determining that at least one of the first difference or the second difference has a monotonic relationship with respect to two or more previously detected differences; and detect position spoofing further based on determining that the at least one of the first difference or the second difference has a non-monotonic relationship with respect to the two or more previously detected differences.

23. The base station of claim 17, wherein the first cyclic shift is a random cyclic shift that is set by the base station, and wherein the one or more processors are further configured to: set a first threshold parameter based on the first detected cyclic shiftWAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -59- expected to be received from the first UE in response to transmitting to the first UE, the first signal; and detect position spoofing based, at least in part, on determining that the first difference between the first detected cyclic shift and the random cyclic shift violates the first threshold parameter.

24. A first user equipment (UE) comprising: at least one transceiver; at least one memory; and one or more processors communicatively coupled with the at least one memory, the one or more processors configured to: receive via the at least one transceiver, from a base station, at a first instance, a first signal comprising a first pseudo-random number (PN) sequence that provides an indication of a first cyclic shift; evaluate the first PN sequence to identify the first cyclic shift; and transmit via the at least one transceiver, to the base station, a first response indicating the identified first cyclic shift, wherein the identified first cyclic shift is useable by the base station to authenticate a position determination operation that is based at least in part, on a first difference between the identified first cyclic shift and the first cyclic shift.

25. The first UE of claim 24, wherein the identified first cyclic shift is further useable by the base station to detect a position spoofing operation performed by the first UE based, at least in part, on the first difference between the identified first cyclic shift and the first cyclic shift.

26. The first UE of claim 24, wherein the first PN sequence accommodates cyclic shifting.

27. The first UE of claim 24, wherein the identified first cyclic shift is a false cyclic shift transmitted to the base station by the first UE as a part of a position spoofing operation.

28. The first UE of claim 24, wherein the identified first cyclic shift is a false cyclic shift transmitted to the base station by a second UE on behalf of the first UE as a part of a position spoofing operation.WAVS Ref. No. QLCMP465WOQualcomm Ref. No. 2403838WO -60-29. The first UE of claim 28, wherein the first UE enables the second UE to transmit the false cyclic shift based on communications between the first UE and the second UE.

30. The first UE of claim 24, wherein the first cyclic shift is identified by the first UE at a first location and transmitted to the base station by the first UE from a second location.WAVS Ref. No. QLCMP465WO

Images