Random Access Timing Advance Coding Against UE Location Exposure

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

The current 5G and LTE standards expose the Timing Advance Command in the Random Access Response (RAR) in plain form, making it vulnerable to interception, which can reveal the location of user equipment and compromise security and safety in private networks and military applications.

Innovation Solution

Coding the true timing advance to a coded timing advance and sending it to the user equipment, ensuring secure communication by preventing unauthorized access to timing information.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If the Timing Advance Command is transmitted in plain form in the Random Access Response, then the UE can easily decode and apply the timing adjustment, but the location information of the UE becomes vulnerable to interception and estimation by unauthorized parties

Engineering Contradiction:
ImproveEase of decoding timing advanceVSAvoidLocation estimation vulnerability
Core Design Contradiction:
Ease of operationVSObject-affected harmful factors

Solution Approach 1:

The patent introduces a coded representation of the Timing Advance Command that acts as an intermediary between the base station and UE. The coded TA command contains the necessary timing information but in an encoded form that prevents unauthorized parties from directly extracting location information, while still allowing the legitimate UE to decode and apply the timing adjustment correctly.

Inventive Principle:
Principle #24Intermediary (Mediator)

Solution Approach 2:

The patent transforms the Timing Advance Command from its original plain form into a coded form by applying encoding parameters. This parameter change modifies the representation of the timing information while preserving its functional meaning for the intended recipient (UE), thereby protecting the underlying location information from unauthorized access.

Inventive Principle:
Principle #35Parameter changes

2Loss of time

If the Random Access Response is sent before UE Attach Request completion, then the timing advance can be provided early for connection establishment, but the timing information is exposed without encryption protection

Engineering Contradiction:
ImproveConnection establishment timeVSAvoidSecurity protection
Core Design Contradiction:
Loss of timeVSReliability

Solution Approach 1:

The patent applies preliminary encoding action to the Timing Advance Command before it is transmitted in the Random Access Response. By pre-coding the TA command with encoding parameters, the system enables early transmission of timing information (reducing connection establishment time) while simultaneously protecting the information from unauthorized access (maintaining security) because the coded form cannot be easily interpreted without the decoding key.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentUS12507070B23GPP, 5G, and LTE random access response timing advance command coding for safety and security-related breach
Publication Date: 2025.12.23 NOKIA TECHNOLOGIES OY
  • US12507070B2 patent drawing
  • US12507070B2 patent drawing
  • US12507070B2 patent drawing

AI summary

A true TA is determined by a BS for a UE. The BS codes the true TA to a coded TA and sends the coded TA to the UE. The UE receives the coded TA from the BS and determines, based on the coded TA, a true TA for the UE to use for communications with the BS. A source BS, in response to a handover of a UE from the source BS to a target BS, determines an offset to be used to determine a value of a true TA between the UE and the target BS. The source BS sends the offset toward the UE and the target BS during a handover process for the handover. The UE receives the offset and a coded TA from the target BS and determines the true TA by adjusting the received coded TA with the received offset.