Embodiments of the present disclosure generally relate to the field of communication, and in particular, to methods, apparatuses and computer readable medium for positioning.
In Release 18 of 3rd Generation Partnership Project (3GPP) radio access network (RAN) meeting, there was an interest to extend the study on new radio (NR) positioning enhancements conducted in Release 17. Therefore, it was agreed and approved to have a study on expanded and improved NR positioning.
One of the objectives of the study targets on improving accuracy, integrity and power efficiency in NR positioning. However, how to achieve positioning integrity in NR positioning is currently not clear, for example, sproofer of a reference signal.
In general, example embodiments of the present disclosure provide methods, apparatuses and computer readable medium for positioning.
In a first aspect, there is provided a terminal device. The terminal device comprises one or more transceivers; and one or more processors coupled to the one or more transceivers, and the one or more transceivers are configured, with the one or more processors, to cause the terminal device to: obtain timing advance, TA, information of one or more network nodes, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and perform, using the obtained TA information of the one or more network nodes, integrity check of a positioning reference signal, PRS; or report, to a location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS.
The above aspect enables the terminal device to determine the authenticity of the PRS, for example to determine whether the transmission of the PRS is from a genuine network node, or from a malicious network node (e.g., a spoofer) or a malfunctioning network node (e.g., a misconfigured network node). Advantageously, the integrity check of the PRS and/or the TA information enables the terminal device to identify spoofing of PRS and perform necessary mitigation actions to avoid positioning error of the terminal device.
In a second aspect, there is provided a positioning entity. The positioning entity comprises one or more transceivers; and one or more processors coupled to the one or more transceivers, and the one or more transceivers are configured, with the one or more processors, to cause the positoning entity to: obtain timing advance, TA, information of one or more network nodes, or an integrity check result of a positioning reference signal, PRS, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and determine, based on the obtained TA information or integrity check result, whether the PRS is valid for positioning of a terminal device.
The above aspect enables the the LMF to determine the authenticity of the PRS, for example to determine whether the transmission of the PRS is from a genuine network node, or from a malicious network node (e.g., a spoofer) or a malfunctioning network node (e.g., a misconfigured network node). Advantageously, the integrity check of the PRS and/or the TA information enables the LMF to identify spoofing of PRS and perform necessary mitigation actions to avoid positioning error of the terminal device.
In a third aspect, there is provided a method implemented at a terminal device. The method comprises: obtaining timing advance, TA, information of one or more network nodes, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and performing, using the obtained TA information of the one or more network nodes, integrity check of a positioning reference signal, PRS; or reporting, to a location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS.
In a fourth aspect, there is provided a method implemented at a positioning entity. The method comprises: obtaining timing advance, TA, information of one or more network nodes, or an integrity check result of a positioning reference signal, PRS, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and determining, based on the obtained TA information or integrity check result whether the PRS is valid for positioning of a terminal device.
In a fifth aspect, there is provided an apparatus of a terminal device. The apparatus comprises: means for obtaining timing advance, TA, information of one or more network nodes, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and means for performing, using the obtained TA information of the one or more network nodes, integrity check of a positioning reference signal, PRS; or means for reporting, to a location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS.
In a sixth aspect, there is provided an apparatus of a positioning entity. The apparatus comprises: means for obtaining timing advance, TA, information of one or more network nodes, or an integrity check result of a positioning reference signal, PRS, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and means for determining, based on the obtained TA information or integrity check result whether the PRS is valid for positioning of a terminal device.
In a seventh aspect, there is provided a terminal device. The terminal device comprises at least one processor; and at least one memory including computer program codes, wherein the at least one memory and the computer program codes are configured to, with the at least one processor, cause the terminal device to: obtain timing advance, TA, information of one or more network nodes, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and perform, using the obtained TA information of the one or more network nodes, integrity check of a positioning reference signal, PRS; or report, to a location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS.
In an eighth aspect, there is provided a positioning entity. The positioning entity comprises at least one processor; and at least one memory including computer program codes, wherein the at least one memory and the computer program codes are configured to, with the at least one processor, cause the positioning entity to: obtain timing advance, TA, information of one or more network nodes, or an integrity check result of a positioning reference signal, PRS, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and determine, based on the obtained TA information or integrity check result whether the PRS is valid for positioning of a terminal device.
In a ninth aspect, there is provided a non-transitory computer readable medium comprising program instructions for causing an apparatus to perform at least the method according to third or fourth aspect.
In a tenth aspect, there is provided a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus at least to: obtain timing advance, TA, information of one or more network nodes, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and perform, using the obtained TA information of the one or more network nodes, integrity check of a positioning reference signal, PRS; or report, to a location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS.
In an eleventh aspect, there is provided a computer program comprising instructions, which, when executed by an apparatus, cause the apparatus at least to: obtain timing advance, TA, information of one or more network nodes, or an integrity check result of a positioning reference signal, PRS, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and determine, based on the obtained TA information or integrity check result whether the PRS is valid for positioning of a terminal device.
In a twelfth aspect, there is provided a terminal device. The terminal device comprises receiving circuitry configured to obtain timing advance, TA, information of one or more network nodes, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and configured to perform, using the obtained TA information of the one or more network nodes, integrity check of a positioning reference signal, PRS; or configured to report, to a location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS.
In a thirteenth aspect, there is provided a positioning entity. The positioning entity comprises obtaining circuitry configured to obtain timing advance, TA, information of one or more network nodes, or an integrity check result of a positioning reference signal, PRS, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes; and configured to determine, based on the obtained TA information or integrity check result whether the PRS is valid for positioning of a terminal device.
It is to be understood that the summary section is not intended to identify key or essential features of embodiments of the present disclosure, nor is it intended to be used to limit the scope of the present disclosure. Other features of the present disclosure will become easily comprehensible through the following description.
Some example embodiments will now be described with reference to the accompanying drawings, where:
Throughout the drawings, the same or similar reference numerals represent the same or similar element.
Principle of the present disclosure will now be described with reference to some example embodiments. It is to be understood that these embodiments are described only for the purpose of illustration and help those skilled in the art to understand and implement the present disclosure, without suggesting any limitation as to the scope of the disclosure. The disclosure described herein can be implemented in various manners other than the ones described below.
In the following description and claims, unless defined otherwise, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skills in the art to which this disclosure belongs.
References in the present disclosure to “one embodiment,” “an embodiment,” “an example embodiment,” and the like indicate that the embodiment described may include a particular feature, structure, or characteristic, but it is not necessary that every embodiment includes the particular feature, structure, or characteristic. Moreover, such phrases are not necessarily referring to the same embodiment. Further, when a particular feature, structure, or characteristic is described in connection with an embodiment, it is submitted that it is within the knowledge of one skilled in the art to affect such feature, structure, or characteristic in connection with other embodiments whether or not explicitly described.
It shall be understood that although the terms “first” and “second” etc. may be used herein to describe various elements, these elements should not be limited by these terms. These terms are only used to distinguish one element from another. For example, a first element could be termed a second element, and similarly, a second element could be termed a first element, without departing from the scope of example embodiments. As used herein, the term “and/or” includes any and all combinations of one or more of the listed terms.
The terminology used herein is for the purpose of describing particular embodiments only and is not intended to be limiting of example embodiments. As used herein, the singular forms “a”, “an” and “the” are intended to include the plural forms as well, unless the context clearly indicates otherwise. It will be further understood that the terms “comprises”, “comprising”, “has”, “having”, “includes” and/or “including”, when used herein, specify the presence of stated features, elements, and/or components etc., but do not preclude the presence or addition of one or more other features, elements, components and/or combinations thereof. As used herein, “at least one of the following: <a list of two or more elements>” and “at least one of <a list of two or more elements>” and similar wording, where the list of two or more elements are joined by “and” or “or”, mean at least any one of the elements, or at least any two or more of the elements, or at least all the elements.
As used in this application, the term “circuitry” may refer to one or more or all of the following:
This definition of circuitry applies to all uses of this term in this application, including in any claims. As a further example, as used in this application, the term circuitry also covers an implementation of merely a hardware circuit or processor (or multiple processors) or portion of a hardware circuit or processor and its (or their) accompanying software and/or firmware. The term circuitry also covers, for example and if applicable to the particular claim element, a baseband integrated circuit or processor integrated circuit for a mobile device or a similar integrated circuit in server, a cellular network device, or other computing or network device.
As used herein, the term “communication network” refers to a network following any suitable communication standards, such as Long Term Evolution (LTE), LTE-Advanced (LTE-A), Wideband Code Division Multiple Access (WCDMA), High-Speed Packet Access (HSPA), Narrow Band Internet of Things (NB-IoT) and so on. Furthermore, the communications between a terminal device and a network device in the communication network may be performed according to any suitable generation communication protocols, including, but not limited to, the third generation (3G), the fourth generation (4G), 4.5G, the fifth generation (5G) communication protocols, and/or any other protocols either currently known or to be developed in the future. Embodiments of the present disclosure may be applied in various communication systems. Given the rapid development in communications, there will of course also be future type communication technologies and systems with which the present disclosure may be embodied. It should not be seen as limiting the scope of the present disclosure to only the aforementioned system.
As used herein, the term “network node” refers to a node in a communication network via which a terminal device accesses the network and receives services therefrom. The network node may refer to a base station (BS) or an access point (AP), for example, a node B (NodeB or NB), an evolved NodeB (eNodeB or eNB), a new radio (NR) NB (also referred to as a gNB), a remote radio unit (RRU), a radio header (RH), a remote radio head (RRH), road side unit (RSU) a relay, a low power node such as a femto, a pico, and so forth, depending on the applied terminology and technology.
The term “terminal device” refers to any end device that may be capable of wireless communication. By way of example rather than limitation, a terminal device may also be referred to as user equipment (UE), a subscriber station (SS), a portable subscriber station, an mobile station (MS), or an access terminal (AT). The terminal device may include, but not limited to, a mobile phone, a cellular phone, a smart phone, voice over IP (VoIP) phones, wireless local loop phones, a tablet, a wearable terminal device, a personal digital assistant (PDA), portable computers, desktop computer, image capture terminal devices such as digital cameras, gaming terminal devices, music storage and playback appliances, vehicle-mounted wireless terminal devices, wireless endpoints, mobile stations, laptop-embedded equipment (LEE), laptop-mounted equipment (LME), USB dongles, smart devices, wireless customer-premises equipment (CPE), an internet of things (IoT) device (e.g., passive or ambient IoT device), a watch or other wearable, a head-mounted display (HMD), a vehicle, a drone, a medical device and applications (e.g., remote surgery), an industrial device and applications (e.g., a robot and/or other wireless devices operating in an industrial and/or an automated processing chain contexts), a consumer electronics device, a device operating on commercial and/or industrial wireless networks, and the like. In the following description, the terms “terminal device”, “terminal”, “user equipment” or “UE” may be used interchangeably.
The term “positioning entity” refers to an entity, element or component within or connected to new generation radio access network (NG-RAN), for example, an access and mobility management function (AMF) entity, location management function (LMF) entity and an mobility management entity (MME). The positioning entity may be an entity in the NG-RAN configured for performing a certain functionality, such as positioning. In the following description, the terms “positioning entity”, “server entity”, “LMF” may be used interchangeably.
3GPP positioning technology is based on the transmission of positioning reference signal (PRS) that are transmitted from a gNB-controlled transmission reception point (TRP). The PRS configuration is uniquely based on the TRP identification (ID), which is an 8-bit downlink PRS ID information element in assistance information.
In the context of positioning integrity, one of the key problem is how to recognize if a given PRS transmission is affected by a major timing error. The major timing error may degrade the accuracy of a target UE positioning, irrespective of whether the error is intentional or unintentional.
An intentional error may be due to malicious replication or jamming by a spoofer, i.e. a network node that emulates a legitimate PRS transmissions with the intention to cause harm. An unintentional error may be due to corrupted timing of a malfunctioning TRP, or excessively long non-line-of-sight (NLOS) propoagation with respect to direct line-of-sight (LOS) path.
Another key problem is how to estimate the magnitude of the major timing error. The capability to estimate the magnitude of the major timing error is important to support integrity monitoring efficiently and adaptive mitigation measures. For example, if integrity key performance indexes (KPIs) of current PRS exceed certain thresholds related to requirements of positioning quality-of-service (QoS) for the target UE, an alternative PRS resource selection may be provided. For example, maximum timing error may be used as one of the integrity KPI as measure of minimum accuracy.
There is currently no known solution to the problem of joint detection and quantification of positioning error as part of integrity monitoring which would be acceptable in 3GPP. In general, known anti-spoofing solutions are based on encrypting or other personalization of PRS signals, i.e. by using UE or gNB-specific secret sequence to generate PRS. A spoofer would then be unable to replicate correctly such sequence and become detectable by the target UE when measuring the PRS.
However, these known anti-spoofing solutions are not possible to be adopted in 3GPP because PRS in 3GPP context is standardized to be a simple generic sequence of a known format, length and offset. The requirement to meet backward compatibility and reliability as well as complexity constraints exclude the potential adoption of the known anti-spoofing solutions.
In summary, there is a need to provide anti-spoofing solution which utilizes PRS in 3GPP context for adopting NR positioning integrity.
According to embodiments of the present disclosure, there is provided a solution, in particular signalling framework, for IoT. With this solution, a terminal device obtains timing advance, TA, information of one or more network nodes. The TA information indicates at least a TA value. The TA value corresponds to one of the one or more network nodes. Moreover, the terminal device performs integrity check of a PRS using the obtained TA information of the one or more network nodes, or alternatively, the terminal device reports to a location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS.
The provided solution is based on two observations. The first observation is multi-path propagation and/or spoofers create additional peaks in energy profile of received PRS due to the presence of PRS replicas. The legitimate PRS peak, i.e. the peak of the energy profile of PRS transmitted by a legitimate network node, should be aligned with uplink timing advance (TA) obtained during initial random access channel (RACH) when setting up the radio resource control (RRC) connection.
The second observation is the specified small data transmission (SDT) mechanism allows UEs to engage with any reachable gNB in a given RAN notification area (RNA). The RNA comprises of group of cells pre-defined for paging purpose, which importantly includes neighbouring gNBs in which the UE does not have prior communications with. The UE could initiate communication with these neighbouring gNBs using message 1 or A in SDT mechanism.
More specifically, any UE in RRC_CONNECTED mode has a TA updated by its serving gNB. However, in positioning, a UE measures signals from neighbouring gNBs. Therefore, the UE may use SDT mechanism to establish contact with non-serving gNBs without having any prior connection with these gNBs. This can be performed even in RRC_INACTIVE mode, for both serving and non-serving gNBs.
Accurate TA information is delivered from the gNB as part of any SDT communication using message 2 or B. The TA information effectively corresponds to the distance between the UE and gNB. According to 3GPP specifications, the basic unit for TA adjustment provided by the gNB is the sampling period (for example, 32.55 nanoseconds, ns, for the shortest frequency range 1, FR1, cyclic prefix). This implies high spatial resolution (32.55 ns×speed of light) with respect to cell size (i.e. 100 to 1000 of meters), i.e. 1% granularity or lower.
These observations are used to solve the above-mentioned problem of positioning integrity and error quantification.
Hereinafter, principle and embodiments of the present disclosure will be described in detail below with reference to the accompanying drawings. Reference is first made to
The radio network 100, which may be a part of a communication network, comprises a terminal device 110, one or more network nodes 120 which communicates with the terminal devices 110 and/or with at least one spoofer 130.
The radio network 100 may comprise any suitable number of network nodes 120 and spoofer 130. In the radio network 100, the terminal device 110 and the network node(s) 120 can exchange data and control information each other. A link from the network node(s) 120 to the terminal device 110 may be referred to as a downlink (DL), while a link from the terminal device 110 to the network node(s) 120 may be referred to as an uplink (UL).
A link in the present disclosure may be a communication channel that connects two or more devices for transmission of data or signalling. The link may be a dedicated physical link or a virtual circuit that uses one or more physical links or shares a physical link with other links.
It is to be understood that the devices are shown in the radio network 100 only for the purpose of illustration, without suggesting any limitation to the scope of the present disclosure. In some example embodiments, the radio network 100 may comprise one or more further devices to communicate with the terminal device 110, network node(s) 120 or spoofer 130.
The communications in the radio network 100 may follow any suitable communication standards or protocols, which are already in existence or to be developed in the future, such as Universal Mobile Telecommunications System (UMTS), long term evolution (LTE), LTE-Advanced (LTE-A), the fifth generation (5G) New Radio (NR), Wireless Fidelity (Wi-Fi) and Worldwide Interoperability for Microwave Access (WiMAX) standards, and employs any suitable communication technologies, including, for example, Multiple-Input Multiple-Output (MIMO), Orthogonal Frequency Division Multiplexing (OFDM), time division multiplexing (TDM), frequency division multiplexing (FDM), code division multiplexing (CDM), Bluetooth, ZigBee, and machine type communication (MTC), enhanced mobile broadband (eMBB), massive machine type communication (mMTC), ultra-reliable low latency communication (URLLC), Carrier Aggregation (CA), Dual Connectivity (DC), and New Radio Unlicensed (NR-U) technologies.
The spoofer 130 may be referred as a communication apparatus that emulates a legitimate PRS transmissions with the intention to cause harm in the present disclosure. The spoofer 130 may emulate and transmit signals which are typically transmitted by a legitimate network node. Because of this, the spoofer 130 may appear to be a legitimate device from the terminal device 110 perspective, but the spoofer 130 may be a maliciuous or illegitimate network node in the radio network 100.
As discussed above, the generic PRS design by 3GPP and public availability of positioning assistance data allow arbitrary and undetectable spoofing of PRS signals transmitted by the spoofer 130. For example, the spoofer 130 may transmit a replica of PRS by network node(s) 120. This situation may cause the terminal device 110 to estimate the distance of network node(s) 120 wrongly. This estimation error in the terminal device 110 is also unknown by terminal device 110 itself which makes mitigation more difficult.
As shown in
In step 214, upon receiving random access preamble message, the network node 120 may measure or calulate a TA based on the received preamble and send a random access response message back to the terminal device 110. The random access response message may be referred as message 2 or Msg 2. In some example embodiments, the random access response message may comprise the measured or calculated valid TA value. As described above, the TA value provided by the network node 120 may be determined with sampling period accuracy.
In step 216, the terminal device 110 may send scheduled transmission (which may be referred as message 3 or Msg 3) to the network node 120. In step 218, the network node 120 may send back contention resolution (which may be referred as message 4 or Msg 4) to terminal device 110. For a contention-free RACH procedure, step 218 may not be applicable after step 216. It should be noted that step 216 and 218 may be optional if the SDT procedure is only for TA obtaining purpose.
In some example embodiments, Msg 1 in step 212 may indicate to the network node 120 that subsequent steps 216 and 218 is not required and/or not of interest of the terminal device 110. In other words, the Msg1 indicates to the network node 120 to abandon and/or terminate the 4-step RACH SDT procedure after the delivery of Msg 2 in step 214, without waiting for expiry of standardized timers for UE response time deadline. In some example embodiments, the indication may be a pre-configured preamble configured via RRC message or system information block (SIB).
In some example embodiments, the intention of network node 120 to abandon or terminate the 4-step RACH SDT procedure may be explicitly indicated in Msg 2, e.g. using a dedicated flag in Msg 2). In some example embodiment, the indication may be a simple binary field.
In some example embodiments, the intention of network node 120 to abandon or terminate the 4-step RACH SDT procedure may be implicitly understood by network node 120 and/or terminal device 110. For example, if the Msg 2 is a response message to Msg 1 which indicating only the need to obtain TA value from given network node 120, both terminal device 110 and/or network node 120 may terminate remaining steps 216 and 218. For example, if a dedicate preamble is used for SDT transmission, both UE and network will know only two steps are needed for the RACH SDT procedure.
As shown in
In step 224, upon receiving random access preamble message, the network node 120 sends a random access response message back to the terminal device 110. The random access response message may be referred as message B or Msg B. In some example embodiments, the Msg B may comprise the requested valid TA value. As described above, the TA value provided by the network node 120 may be determined with sampling period accuracy.
In some example embodiments, the network node(s) 120 in the same RNA may reserve a given RACH resource for all network node(s) 120. This may enable the same Msg 1 or Msg A from the terminal device 110 to trigger multiple network node(s) 120. Advantageously, RACH resource efficiency can be optimized and signalling overhead can be reduced.
In some example embodiments, power transmission for both terminal device 110 and/or network node(s) 120 may be adapted to ensure sufficient range. However, the network node(s) 120 may have to reply their Msg 2 in a non-colliding manner if multiple network nodes(s) are triggered using same RACH resource as described above. In some example embodiments, a random backoff or pre-configured order (e.g. based on physical cell ID, PCI) may be used to determine the order of network node(s)'s 120 transmissions in time.
As shown in
As shown in
As shown in
As shown in
The above method 300 enables the terminal device 110 to determine the authenticity of the PRS, for example to determine whether the transmission of the PRS is from a genuine network node, or from a malicious network node (e.g., a spoofer) or a malfunctioning network node (e.g., a misconfigured network node). Advantageously, the integrity check of the PRS and/or the TA information enables the terminal device 110 to identify spoofing of PRS and perform necessary mitigation actions to avoid positioning error of the terminal device 110.
In some example embodiments, the terminal device 110 may identify one of the one or more network nodes 120, in which the PRS transmitted by the identified one network node may be tested for integrity check. This may be performed based on positioning assistance data obtained from the LMF.
For examples, NR-DL-PRS-AssistanceData field in LTE positioning protocol (LPP) Common Information Elements may comprise DL-PRS-ID-Info field and NR-DL-PRS-AssistanceDataPerTRP field. The DL-PRS-ID-Info field may comprise information about the PRS and the NR-DL-PRS-AssistanceDataPerTRP field may comprise of the identification of the one or more network nodes 120.
In some example embodiments, the terminal device 110 may collect the TA information of the one or more network nodes 120. The collected TA information of the one or more network nodes 120 may be used for performing the integrity check of the PRS by the terminal device 110. In some example embodiments, the terminal device 110 may collect the TA information of the one or more network nodes 120 for performing the integrity check of the PRS by the LMF.
In some example embodiments, the collection of TA information may be triggered by any network node. For example, the terminal device 110 may start proactively collecting the TA information to assist the LMF with integrity check of PRS. The terminal device 110 may deliver the measured or obtained TA information to the LMF. This may be delivered using extended or adapted enhanced cell identity (ECID) reporting mechanism. In addition, a physical cell ID (PCI) and/or a beam index of the network node may be included in the TA information for angle-of-arrival (AoA) enhancements. Alternatively, the terminal device 110 may tag PRS measurement with associated TA information, or a flag indicating the availability of the TA information.
In some example embodiments, the terminal device 110 may transmit to one or more network nodes 120, an indication for obtaining the TA information. In some example embodiments, the indication for obtaining the TA information may be indicated in message 1 of 4-step RACH or message A of 2-step RACH. In some example embodiments, the indication for obtaining the TA information may comprise at least a binary field or a preconfigured preamble.
In some example embodiments, the terminal device 110 may obtain the TA information from the one or more network nodes 120 in RRC_CONNECTED mode. In RRC_CONNECTED mode, a serving network nodes from the one or more network nodes 120 may maintain the TA information, by default, with the terminal device 110 using RRC procedures, for example, via system information. In some example embodiments, the terminal device 110 may obtain the TA information via medium access channel (MAC) control element (CE) update.
In RRC CONNECTED mode, the TA information may be obtained from the serving network node directly via the legacy via initial Random Access procedure or Timing Advance Command MAC CE. This allows for efficient fine-grained collection of the TA as function of the terminal device's own mobility (that is, UE-observed changes of signal strength). This leaves the spoofer only with the option to emulate non-serving network nodes.
In some example embodiments, the terminal device 110 may obtain the TA information from the one or more network node 120 using SDT procedure. In some example embodiments, the terminal device 110 may use SDT procedure for obtaining TA information when the one and more network node 120 is a non-serving network node.
In some example embodiments, the terminal device 110 may use SDT procedure for obtaining TA information when the terminal device 110 is in RRC_INACTIVE mode. For this case, the identified network node may need to be confirmed as part of the RAN-based notification area (RNA) of the terminal device 110. In some example embodiments, the terminal device may use system information from the one of more network nodes 120 to determine active RACH resources for SDT procedure.
In some example embodiments, the one or more network nodes 120 in the same
RAN may share same pre-defined SDT resources to allow a single SDT broadcast transmission by the terminal device 110 to all network nodes at the same time. Advantageously, this may reduce signalling overhead. However, this option may require coordination of the message 2 in SDT procedure (e.g. random backoff, PCI-based ordering or central pre-configuration) in order to deliver the TA information in a sequential non-conflicting manner.
In some example embodiments, the TA information may be obtained by the terminal device 110 using a legacy message (e.g. message 1 or message A is used to request for the TA information). In some example embodiments, the terminal device 110 may use a modified signalling message e.g. a modified message 1 or message A indicates that the sole purpose of this SDT transmission is to obtain a valid TA, or request the one or more network nodes 120 to perform other actions such as forwarding of the TA information to other network nodes or LMF. In some example embodiments, the terminal device 110 may receive an indication from the one or more network nodes to interrupt or terminate the ongoing SDT procedure. This may be done explicitly (e.g. via a dedicated flag in message 2) or implicitly (e.g. via a specific preamble in message 1).
In some example embodiments, the terminal device 110 may reports, to the location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS. In some example embodiments, the terminal device 110 may transmit to the LMF the obtained TA information via long term evolution, LTE, positioning protocol (LPP). In some example embodiments, the terminal device 110 may transmit to the LMF the obtained TA information via sidelink positioning protocol, SLPP. For example, an ECID-SignalMeasurementInformation field may comprise an optional ASN.1 information element dedicated for signalling the TA information. To this end, the eCID localization process may be setup as part of the integrity check by the LMF.
In some example embodiments, the terminal device 110 may request a positioning measurement gap for collecting TA information of one or more neighbouring network nodes. Autonomous gaps for positioning measurements may be used, as the gaps are sufficiently long (10/20 ms). Standard radio resource management (RRM) measurement gaps may be used as well for SDT exchange assuming the target network node responds within the duration of the measurement gap. In some example embodiments, the terminal device 110 may collect TA information of one or more neighbouring network nodes without requesting the positioning measurement gap if measurement without gap can be supported by the terminal device 110.
In some example embodiments, the terminal device 110 may obtains the TA information of the one or more network nodes 120 when the terminal device 110 receives, from any one or more network nodes or LMF, an indication indicating the terminal device 110 to obtain the TA information. The indication may indicates that the terminal device 110 may start collecting the TA information when the terminal device 110 detects inconsistency in the PRS. The indication may be an implicit indication from one or mode network nodes 120 or a explicit indication from the LMF via LPP.
In some example embodiments, the terminal device 110 may obtains the TA information of the one or more network nodes 120 when the terminal device 110 is configured with an integrity class. For examples, the terminal device 110 configured as an integrity class, may have a duty to collect certain amount of TA information from a certain number of network nodes 120. This configuration may be provided to terminal device 110 via assistance information.
In some example embodiments, the terminal device 110 may obtains the TA information of the one or more network nodes 120 when the terminal device 110 moves to another serving network node. In some example embodiments, the terminal device 110 may obtains the TA information of the one or more network nodes 120 when the terminal device 110 performs radio access network, RAN-based notification area, RNA change or update.
Then, as shown in
In some example embodiments, the terminal device 110 may verify whether a reference value of the PRS used for positioning is within an interval range around the TA value of the one or more network nodes 120. The reference value may be defined based on a pulse detection criterion, for example, signal amplitude is above a threshold, signal slop is above a threshold, or a signal maximum of a fraction of the signal maximum is reached. The reference value may be a filtered value, such as rolling average, to remove noise and random fluctuations. The reference value may be defined in unit of dB or dBm.
In some example embodiments, the terminal device 110 may verify whether a peak of the PRS energy profile used of positioning is aligned with the TA value of the one or network nodes 120.
As discussed above, if the main peak of the PRS used for positioning is within the interval range, the terminal device 110 may determine that the PRS received is valid or legitimate for positioning. If the main peak of the PRS used for positioning is outside the interval range, the terminal device 110 may determine that the PRS received is illegitimate or invalid. In some example embodiments, an outcome of the determination may be stored or included in a result, e.g. an integrity check result of the PRS.
In some example embodiments, the terminal device 110 may transmit, to the LMF, an indication of the integrity check result of the PRS. In some example embodiments, the PRS tested for integrity check and/or the corresponding measurements may be tagged with a warning flag in a message to the LMF. Based on the message to the LMF, the corresponding PRS and/or the spoofer 130 may be removed from positioning session. Alternatively, a new anchor or one from the one or more network nodes 120 may be selected for positioning.
In some example embodiment, the terminal device 110 may receive a request or response from the LMF to use the TA information to replace the missing PRS measurements until a new and creditable anchor or PRS is activated.
As shown in
The above method 400 enables the the LMF to determine the authenticity of the PRS, for example, to determine whether the transmission of the PRS is from a genuine network node, or from a malicious (e.g., a spoofer), or a malfunctioning network node (e.g. a misconfigured network node). Advantagneously, the integrity check of the PRS and/or the TA information enables the LMF to identify spoofing of PRS and perform necessary mitigation actions to avoid positioning error of the terminal device 110.
In some example embodiments, the positioning entity may receive the TA information of the one or more network nodes 120, from the terminal device 110. In some example embodiments, the positioning entity may receive the integrity check result of the PRS, from the terminal device 110. In some example embodiments, the TA information of the one of more network nodes 120 may be received from the terminal device 110 via long term evolution, LTE, positioning protocol, LPP, or sidelink positioning protocol, SLPP. In some example embodiments, the integrity check result of the PRS may be received from the terminal device 110 via long term evolution, LTE, positioning protocol, LPP, or sidelink positioning protocol, SLPP.
In some example embodiments, the positioning entity may receive, from the one or network nodes 120, the TA information of the one of more network nodes 120. In some example embodiments, the TA information of the one or more network nodes may be received from the one or more network nodes 120 via new radio, NR, positioning protocol A, NRPPa. For example, a dedicated field in the NRPPa may be specified in the future to provide for a more robust method. In this case, an external spoofer may not be able to gain internal access to the LMF via a serving AMF and pass the associated NAS authentication.
In some embodiments, the positioning entity may command the terminal device 110 to start collecting the timing advance information when there is inconsistency of the PRS. The command may be a indirect command from the one or more network nodes 120. The command may be an explicit command from the positioning entity to the terminal device 110 via LPP or SLPP. Alternatively, the command may be from assistance information received by the terminal device 110.
In some example embodiments, the positioning entity obtains an integrity check result of the PRS. The PRS may be associated with one or more network nodes 120. In some example embodiments, the integrity check result is obtained from the terminal device 110. In some example embodiments, the positioning entity may obtain the integrity check result via LPP or SLPP.
Then, as shown in
In some example embodiments, the positioning entity may verify whether a peak of the PRS energy profile used of positioning is aligned with the TA value of the one or network nodes 120. As discussed above, if the main peak of the PRS used for positioning is within the interval range, the positioning entity may determine that the PRS received is valid or legitimate for positioning. If the main peak of the PRS used for positioning is outside the interval range, the positioning entity may determine that the PRS received is illegitimate or invalid.
In some example embodiments, the positioning entity determines whether the PRS is valid for positioning of a terminal device 110, based on the obtained integrity check result. In some example embodiments, the PRS tested for integrity check and/or the corresponding measurements may be tagged with a warning flag in the obtained integrity check result. Based on the integrity check result, the positioning entity may remove the corresponding PRS and/or the spoofer 130 from positioning session. Alternatively, the positioning entity may select a new anchor or one from the one or more network nodes 120 for positioning.
In some example embodiments, the positioning entity may send a request or response from to the terminal device 110 to use the TA information to replace the missing PRS measurements until a new and creditable anchor or PRS is activated.
In some example embodiments, the positioning entity may transmit an indication to the terminal device 110. The indication may indicate to the terminal device 110 to obtain the TA information of the one or more network nodes 120. In some example embodiments, the indication may be transmitted to the terminal device 110 via LTE positioning protocol, LPP, or sidelink positioning protocol, SLPP.
In some example embodiments, an apparatus capable of performing any of operations of the method 300 (for example, the terminal device 110) may include means for performing the respective steps of the method 300. The means may be implemented in any suitable form. For example, the means may be implemented in a circuitry or software module.
In some example embodiments, the apparatus may comprise means for obtaining timing advance, TA, information of one or more network nodes. The TA information may indicate at least a TA value. The TA value may correspond to one of the one or more network nodes. In some example embodiments, the apparatus may comprise means for performing, using the obtained TA information of the one or more network nodes, integrity check of a positioning reference signal, PRS. In some example embodiments, the apparatus may comprise means for reporting, to a location management function, LMF, the obtained TA information of the one or more network nodes for the integrity check of the PRS.
In some example embodiments, the apparatus may further comprise means for performing other steps in some embodiments of the method 300. In some example embodiments, the apparatus may further comprise means for performing steps described in above embodiments performed by the terminal device 110. In some example embodiments, the means comprises at least one processor and/or at least one memory which may include computer program code. The at least one memory are configured to, with the at least one processor, cause the performance of the apparatus.
In some example embodiments, an apparatus capable of performing any of the method 400 (for example, the positioning entity) may include means for performing the respective steps of the method 400. The means may be implemented in any suitable form. For example, the means may be implemented in a circuitry or software module.
In some example embodiments, the apparatus may comprise means for obtaining timing advance, TA, information of one or more network nodes, or an integrity check result of a positioning reference signal, PRS, wherein the TA information indicates at least a TA value corresponding to one of the one or more network nodes. In some example embodiments, the apparatus may comprise means for determining, based on the obtained TA information or integrity check result whether the PRS is valid for positioning of a terminal device.
In some example embodiments, the apparatus may further comprise means for performing other steps in some embodiments of the method 400. In some example embodiments, the apparatus may further comprise means for performing steps described in above embodiments performed by the positioning entity. In some example embodiments, the means comprises at least one processor and at least one memory including computer program code. The at least one memory and computer program code are configured to, with the at least one processor, cause the performance of the apparatus.
The communication interface 640 may be for bidirectional communications. The communication interface 640 may have at least one antenna to facilitate communication. The communication interface may represent any interface that is necessary for communication with other network elements. The communication interface may be hardware or software based interface. For example, the communication interface may be one ore more transceivers. The one or more transceivers may be coupled to one or more antennas or antenna ports to wirelessly transmit and/or receive communication signals. The antennas or antenna ports may be the same or different types. The antennas or antenna ports may be located in different positions of an apparatus. The one or more transceivers allow the apparatus to communicate with other devices that may be wired and/or wireless. The transceiver may support one or more radio technologies. For example, the one or more transceivers may include a cellular subsystem, a WLAN subsystem, and/or a Bluetooth™ subsystem. The one or more transceivers may include processors, controllers, radios, sockets, plugs, buffers, or the like circuits to form one or more communication channels to one or more radio frequency units.
The processor 610 may be of any type suitable to the local technical network and may include one or more of the following: general purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs) and processors based on multicore processor architecture, as non-limiting examples. The device 600 may have multiple processors, such as an application specific integrated circuit chip that is slaved in time to a clock which synchronizes the main processor.
The memory 620 may include one or more non-volatile memories and one or more volatile memories. Examples of the non-volatile memories include, but are not limited to, a read only memory (ROM) 624, an electrically programmable read only memory (EPROM), a flash memory, a hard disk, a compact disc (CD), a digital video disk (DVD), and other magnetic storage and/or optical storage. Examples of the volatile memories include, but are not limited to, a random access memory (RAM) 622 and other volatile memories that will not last in the power-down duration.
A computer program 630 includes computer executable instructions that may be executed by the associated processor 610. The program 630 may be stored in the ROM 624. The processor 610 may perform any suitable actions and processing by loading the program 630 into the RAM 622.
The embodiments of the present disclosure may be implemented by means of the program so that the device 600 may perform any process of the disclosure as discussed with reference to
In some embodiments, the program 630 may be tangibly contained in a computer readable medium which may be included in the device 600 (such as in the memory 620) or other storage devices that are accessible by the device 600. The device 500 may load the program 630 from the computer readable medium to the RAM 622 for execution. The computer readable medium may include any types of tangible non-volatile storage, such as ROM, EPROM, a flash memory, a hard disk, CD, DVD, and the like.
Generally, various embodiments of the present disclosure may be implemented in hardware or special purpose circuits, software, logic or any combination thereof. Some aspects may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device. While various aspects of embodiments of the present disclosure are illustrated and described as block diagrams, flowcharts, or using some other pictorial representations, it is to be understood that the block, apparatus, system, technique or method described herein may be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof.
The present disclosure also provides at least one computer program product tangibly stored on a non-transitory computer readable storage medium. The computer program product includes computer-executable instructions, such as those included in program modules, being executed in a device on a target real or virtual processor, to carry out the method 300 or 400 as described above with reference to
Program code for carrying out methods of the present disclosure may be written in any combination of one or more programming languages. These program codes may be provided to a processor or controller of a general purpose computer, special purpose computer, or other programmable data processing apparatus, such that the program codes, when executed by the processor or controller, cause the functions/operations specified in the flowcharts and/or block diagrams to be implemented. The program code may execute entirely on a machine, partly on the machine, as a stand-alone software package, partly on the machine and partly on a remote machine or entirely on the remote machine or server.
In the context of the present disclosure, the computer program codes or related data may be carried by any suitable carrier to enable the device, apparatus or processor to perform various processes and operations as described above. Examples of the carrier include a signal, computer readable medium, and the like.
The computer readable medium may be a computer readable signal medium or a computer readable storage medium. A computer readable medium may include but not limited to an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination of the foregoing. More specific examples of the computer readable storage medium would include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or Flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing. The term “non-transitory,” as used herein, is a limitation of the medium itself (i.e., tangible, not a signal) as opposed to a limitation on data storage persistency (e.g., RAM vs. ROM).
Further, while operations are depicted in a particular order, this should not be understood as requiring that such operations be performed in the particular order shown or in sequential order, or that all illustrated operations be performed, to achieve desirable results. In certain circumstances, multitasking and parallel processing may be advantageous. Likewise, while several specific implementation details are contained in the above discussions, these should not be construed as limitations on the scope of the present disclosure, but rather as descriptions of features that may be specific to particular embodiments. Certain features that are described in the context of separate embodiments may also be implemented in combination in a single embodiment. Conversely, various features that are described in the context of a single embodiment may also be implemented in multiple embodiments separately or in any suitable sub-combination.
Although the present disclosure has been described in languages specific to structural features and/or methodological acts, it is to be understood that the present disclosure defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.
This application claims priority to, and the benefit of, U.S. Provisional Application No. 63/483,038, filed on Feb. 3, 2023, the contents of which is incorporated herein by reference in its entirety.
Number | Date | Country | |
---|---|---|---|
63483038 | Feb 2023 | US |