Delayed PRS Parameter Disclosure for Secure UE Positioning

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Positioning reference signals in wireless communication networks are vulnerable to attacks by man-in-the-middle attackers that decode and mimic subsequent portions of the signals, leading to decreased location estimation accuracy.

Innovation Solution

Transmission parameters for decoding positioning reference signals are withheld until after signal transmission, and are made nondeterministic to prevent attackers from predicting subsequent parameters, allowing receiving devices to buffer and process the signals with the received parameters.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If transmission parameters for decoding PRS are provided before signal transmission, then receiving devices can decode the signals, but attackers can decode and mimic subsequent portions of the signals

Engineering Contradiction:

Improvesecurity of positioning reference signalsVSAvoidtime delay in providing transmission parameters

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent applies preliminary action by having receiving devices buffer the PRS signals before decoding. The transmission parameters are provided after transmission but the receiver is already prepared with buffering capability, so no actual waiting occurs. This resolves the contradiction by preparing the system in advance without revealing security-critical information prematurely.

Inventive Principle:

Principle #10Preliminary action

Solution Approach 2:

The patent segments the PRS transmission into multiple portions with different transmission parameters. Each portion uses unique parameters that are provided after transmission, preventing attackers from decoding and mimicking subsequent portions. This segmentation breaks the continuity that attackers exploit, maintaining security while enabling timely processing.

Inventive Principle:

Principle #1Segmentation

2Reliability

If transmission parameters are deterministic, then attackers can predict subsequent parameters, but making them nondeterministic increases system complexity

Engineering Contradiction:

Improveprevention of signal mimicry attacksVSAvoidcomplexity of generating and processing nondeterministic parameters

Core Design Contradiction:

ReliabilityVSDevice complexity

Solution Approach 1:

The patent changes the transmission parameters (scrambling IDs, frequency-domain parameters, comb patterns, OFDM symbol offsets) to be nondeterministic while transmitted. This prevents attackers from predicting subsequent parameters even if they intercept one portion. The parameter changes are implemented through standard wireless communication mechanisms, avoiding excessive complexity.

Inventive Principle:

Principle #35Parameter changes

3Ease of operation

If all transmission parameters are provided in first configuration data, then decoding can be simplified, but security is compromised as attackers can use the parameters to decode and mimic signals

Engineering Contradiction:

Improvesimplicity of signal decoding processVSAvoidvulnerability to man-in-the-middle attacks

Core Design Contradiction:

Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent segments the transmission parameters into two groups: those provided in first configuration data before transmission, and those provided in second configuration data after transmission. This segmentation allows simplified decoding for the first group while protecting the second group from attacker exploitation, resolving the contradiction between ease of operation and security.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent introduces transmission parameters as an intermediary between the PRS signal and the decoding process. By controlling when these intermediary parameters are provided, the system enables simplified decoding for legitimate receivers while preventing attackers from using the parameters to mimic signals. The intermediary parameters act as a security gate.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS12463779B2Positioning reference signal (PRS) securitization in user equipment (UE) positioning

Publication Date: 2025.11.04 QUALCOMM INC

AI summary

Reference signals used in location estimation of a user equipment (UE) in a wireless data network can be secured against a man-in-the-middle attack by a transmitting device withholding the conveyance of transmission parameters for decoding portions of a reference signal until after the portions are transmitted. Thus, receiving devices can buffer received signals and, after receiving the transmission parameters, process the buffered signals. To further prevent an attacker device from attacking future reference signals, transmission parameters can be nondeterministic such that an attacker device obtaining a parameter at a certain period of time is unable to use the decoded parameter predict or determine subsequent transmission parameters.