CN119866657A - Network authentication of User Equipment (UE) location - Google Patents

Abstract

Techniques for location verification are disclosed. In one aspect, a radio access network (RAN) node receives a request from a core network node to verify the location of a user equipment (UE); performs a RAN-based positioning procedure with the UE to determine a verified location of the UE; and sends a response to the core network node, the response comprising: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Description

Network verification of User Equipment (UE) location

CROSS-REFERENCE TO RELATED APPLICATIONS

This patent application claims the benefit of U.S. Provisional Application No. 63/377,174, filed on September 26, 2022, entitled “NETWORK VERIFICATION OF USER EQUIPMENT (UE) LOCATION,” which is assigned to the assignee of this application and is expressly incorporated herein by reference in its entirety.

Background Art

1. Technical Field

Aspects of the present disclosure relate generally to wireless communications.

2. Description of related technologies

Wireless communication systems have evolved over many generations, including first generation analog wireless telephone service (1G), second generation (2G) digital wireless telephone service (including transitional 2.5G and 2.75G networks), third generation (3G) high speed data, wireless service with Internet capabilities, and fourth generation (4G) services (e.g., Long Term Evolution (LTE) or WiMax). There are many different types of wireless communication systems in use today, including cellular systems and personal communications service (PCS) systems. Examples of known cellular systems include the cellular analog Advanced Mobile Phone System (AMPS), and digital cellular systems based on code division multiple access (CDMA), frequency division multiple access (FDMA), time division multiple access (TDMA), Global System for Mobile Communications (GSM), and the like.

The fifth generation (5G) wireless standard, known as New Radio (NR), enables higher data transfer speeds, a greater number of connections, and better coverage, among other improvements. According to the Next Generation Mobile Networks Alliance, the 5G standard is designed to provide higher data rates, more accurate positioning (e.g., based on reference signals for positioning (RS-P), such as downlink, uplink, or sidelink positioning reference signals (PRS)), and other technical enhancements compared to previous standards. These enhancements, along with the use of higher frequency bands, advances in PRS processes and technologies, and high-density deployments of 5G, enable highly accurate positioning based on 5G.

Summary of the invention

The following presents a simplified summary of the invention related to one or more aspects disclosed herein. Thus, the following summary of the invention should neither be considered as an exhaustive overview related to all conceived aspects, nor should it be considered to identify key or decisive elements related to all conceived aspects or to delineate the scope associated with any particular aspect. Therefore, the sole purpose of the following summary of the invention is to present certain concepts related to one or more aspects of the mechanisms disclosed herein in a brief form before the detailed embodiments presented below.

In one aspect, a method of location verification performed by a radio access network (RAN) node includes: receiving a request to verify the location of a user equipment (UE) from a core network node; performing a RAN-based positioning procedure with the UE to determine the verified location of the UE; and sending a response to the core network node, the response including: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a method of location verification performed by a core network node comprises: sending a request to a radio access network (RAN) node to verify the location of a user equipment (UE); and receiving a response from the RAN node, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a method of location verification performed by a location server includes: receiving a request to verify the location of a user equipment (UE) from a core network node; performing a location server-based positioning procedure with the UE to determine the verified location of the UE; and sending a response to the core network node, the response including the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a radio access network (RAN) node includes: a memory; at least one transceiver; and at least one processor, the at least one processor being communicatively coupled to the memory and the at least one transceiver and configured to: receive a request to verify the location of a user equipment (UE) from a core network node via the at least one transceiver; perform a RAN-based positioning procedure with the UE to determine the verified location of the UE; and send a response to the core network node via the at least one transceiver, the response comprising: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a core network node comprises: a memory; at least one transceiver; and at least one processor, the at least one processor being communicatively coupled to the memory and the at least one transceiver and configured to: send a request to a radio access network (RAN) node via the at least one transceiver to verify the location of a user equipment (UE); and receive a response from the RAN node via the at least one transceiver, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a location server comprises: a memory; at least one transceiver; and at least one processor, the at least one processor being communicatively coupled to the memory and the at least one transceiver and configured to: receive a request to verify the location of a user equipment (UE) from a core network node via the at least one transceiver; perform a location server-based positioning procedure with the UE to determine the verified location of the UE; and send a response to the core network node via the at least one transceiver, the response including the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a radio access network (RAN) node includes: a component for receiving a request to verify the location of a user equipment (UE) from a core network node; a component for performing a RAN-based positioning procedure with the UE to determine the verified location of the UE; and a component for sending a response to the core network node, the response including: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a core network node includes: means for sending a request to a radio access network (RAN) node to verify the location of a user equipment (UE); and means for receiving a response from the RAN node, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a location server includes: a component for receiving a request to verify the location of a user equipment (UE) from a core network node; a component for performing a location server-based positioning procedure with the UE to determine the verified location of the UE; and a component for sending a response to the core network node, the response including the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a non-transitory computer-readable medium stores computer-executable instructions that, when executed by a radio access network (RAN) node, cause the RAN to: receive a request from a core network node to verify the location of a user equipment (UE); perform a RAN-based positioning procedure with the UE to determine the verified location of the UE; and send a response to the core network node, the response comprising: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a non-transitory computer-readable medium stores computer-executable instructions that, when executed by a core network node, cause the core network node to: send a request to a radio access network (RAN) node to verify the location of a user equipment (UE); and receive a response from the RAN node, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof.

In one aspect, a non-transitory computer-readable medium stores computer-executable instructions that, when executed by a location server, cause the location server to: receive a request to verify the location of a user equipment (UE) from a core network node; perform a location server-based positioning procedure with the UE to determine the verified location of the UE; and send a response to the core network node, the response including the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Other objects and advantages associated with the various aspects disclosed herein will be apparent to those skilled in the art based on the drawings and detailed description.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings are presented to aid in describing various aspects of the present disclosure and are provided solely for illustration and not limitation of the aspects.

FIG. 1 illustrates an example wireless communication system in accordance with aspects of the present disclosure.

2A , 2B and 2C illustrate example wireless network structures according to aspects of the present disclosure.

3A , 3B and 3C are simplified block diagrams of several sample aspects of components that may be employed in a user equipment (UE), a base station and a network entity, respectively, and configured to support communications as taught herein.

4 illustrates examples of various positioning methods supported in New Radio (NR) according to aspects of the present disclosure.

5 illustrates example Long Term Evolution (LTE) Positioning Protocol (LPP) reference sources for positioning.

6 illustrates a procedure for general network positioning of a location service (LCS) client outside a public land mobile network (PLMN) that regulates location services for a non-roaming scenario in accordance with aspects of the present disclosure.

7 is a diagram illustrating UE-provided location verification based on obtained information according to aspects of the present disclosure.

8 illustrates an example procedure for UE location verified by an access and mobility management function (AMF) in accordance with aspects of the present disclosure.

9 illustrates an example procedure for UE location verified by a location management function (LMF) in accordance with aspects of the present disclosure.

FIG. 10 illustrates further details of an example procedure for LMF verified UE location in accordance with aspects of the present disclosure.

11 illustrates an example procedure for radio access network (RAN) verified UE location in accordance with aspects of the present disclosure.

12 is a diagram illustrating an example of a space vehicle that generates multiple transmit beams over multiple geographic areas.

13-15 illustrate example methods of location verification according to aspects of the present disclosure.

DETAILED DESCRIPTION

Various aspects of the present disclosure are provided in the following description and related drawings for various examples provided for illustrative purposes. Alternative aspects may be designed without departing from the scope of the present disclosure. Additionally, well-known elements of the present disclosure will not be described in detail or will be omitted to avoid making the relevant details of the present disclosure difficult to understand.

Various aspects relate generally to wireless positioning. Some aspects relate more specifically to network verification of user equipment (UE) location. In some examples, location information reported by the UE may be verified by an access and mobility management function (AMF), a location management function (LMF), or a radio access network (RAN) node by performing a positioning method different from the UE, such as a positioning procedure based on a radio access technology (RAT). In some examples, the AMF may maintain a list of UEs with verified locations within its context. The UE may have a validity timer associated with it that may be triggered upon verification of the UE location. Another verification process may be triggered when a UE timer expires, a UE tracking area changes, a UE location change is above a threshold, and/or a UE registration area is updated.

Certain aspects of the subject matter described in this disclosure can be implemented to achieve one or more of the following potential advantages. In some examples, the described techniques can be used to enable network verification of a UE's location by performing a different positioning method than the one the UE uses to report its location.

The words "exemplary" and/or "example" are used herein to mean "serving as an example, instance, or illustration." Any aspect described herein as "exemplary" and/or "example" is not necessarily to be construed as preferred or superior to other aspects. Likewise, the term "aspects of the disclosure" does not require that all aspects of the disclosure include the discussed feature, advantage, or mode of operation.

Those skilled in the art will appreciate that any of a variety of different techniques and methods may be used to represent the information and signals described below. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be mentioned throughout the following description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or optical particles, or any combination thereof, which depends in part on the specific application, in part on the desired design, in part on the corresponding technology, and so on.

In addition, many aspects are described in terms of a sequence of actions to be performed by, for example, an element of a computing device. It should be understood that the various actions described herein may be performed by a specific circuit (e.g., an application specific integrated circuit (ASIC)), by a program instruction executed by one or more processors, or by a combination of the two. Additionally, the sequence of actions described herein may be considered to be fully embodied in any form of non-transient computer-readable storage medium, in which a corresponding computer instruction set is stored, which, when executed, will cause or command the associated processor of the device to perform the functionality described herein. Therefore, various aspects of the present disclosure may be embodied in a variety of different forms, all of which have been contemplated to be within the scope of the claimed subject matter. In addition, for each of the various aspects described herein, the corresponding form of any such aspect may be described herein as, for example, "a logical component configured to perform the described action".

As used herein, unless otherwise specified, the terms "user equipment" (UE) and "base station" are not intended to be specific or otherwise limited to any specific radio access technology (RAT). In general, a UE may be any wireless communication device (e.g., a mobile phone, a router, a tablet computer, a laptop computer, a consumer asset location device, a wearable device (e.g., a smart watch, glasses, an augmented reality (AR)/virtual reality (VR) head-mounted device, etc.), a vehicle (e.g., a car, a motorcycle, a bicycle, etc.), an Internet of Things (IoT) device, etc.) used by a user to communicate over a wireless communication network. A UE may be mobile or may be stationary (e.g., at certain times) and may communicate with a radio access network (RAN). As used herein, the term "UE" may be interchangeably referred to as an "access terminal" or "AT", "client device", "wireless device", "subscriber device", "subscriber terminal", "subscriber station", "user terminal" or "UT", "mobile device", "mobile terminal", "mobile station" or variations thereof. In general, a UE may communicate with a core network via a RAN, and through the core network, the UE may connect to external networks such as the Internet and to other UEs. Of course, other mechanisms for the UE to connect to the core network and/or the Internet are also possible, such as through a wired access network, a wireless local area network (WLAN) network (e.g., based on the Institute of Electrical and Electronics Engineers (IEEE) 802.11 specification, etc.), etc.

A base station may operate according to one of several RATs to communicate with a UE, depending on the network in which the base station is deployed, and may alternatively be referred to as an access point (AP), a network node, a Node B, an evolved Node B (eNB), a next generation eNB (ng-eNB), a new radio (NR) Node B (also referred to as a gNB or gNodeB), etc. A base station may be primarily used to support wireless access for UEs, including supporting data, voice, and/or signaling connections for supported UEs. In some systems, a base station may only provide edge node signaling functions, while in other systems, a base station may provide additional control and/or network management functions. The communication link by which a UE may transmit a signal to a base station is referred to as an uplink (UL) channel (e.g., a reverse traffic channel, a reverse control channel, an access channel, etc.). The communication link by which a base station may transmit a signal to a UE is referred to as a downlink (DL) or forward link channel (e.g., a paging channel, a control channel, a broadcast channel, a forward traffic channel, etc.). As used herein, the term "traffic channel (TCH)" may refer to an uplink/reverse traffic channel or a downlink/forward traffic channel.

The term "base station" may refer to a single physical transmit-receive point (TRP) or multiple physical TRPs that may or may not be co-located. For example, where the term "base station" refers to a single physical TRP, the physical TRP may be an antenna of the base station corresponding to a cell (or several cell sectors) of the base station. Where the term "base station" refers to multiple co-located physical TRPs, the physical TRP may be an antenna array of the base station (e.g., as in a multiple-input multiple-output (MIMO) system or where the base station employs beamforming). Where the term "base station" refers to multiple non-co-located physical TRPs, the physical TRP may be a distributed antenna system (DAS) (a network of spatially separated antennas connected to a common source via a transmission medium) or a remote radio head (RRH) (a remote base station connected to a serving base station). Alternatively, the non-co-located physical TRP may be a serving base station that receives measurement reports from a UE and an adjacent base station whose reference radio frequency (RF) signal the UE is measuring. Because, as used herein, a TRP is a point by which a base station transmits and receives wireless signals, references to transmitting from a base station or receiving at a base station should be understood to refer to a specific TRP of a base station.

In some implementations of supporting UE positioning, a base station may not support wireless access for a UE (e.g., may not support data, voice, and/or signaling connections for the UE), but may instead send a reference signal to be measured by the UE and/or may receive and measure a signal sent by the UE. Such a base station may be referred to as a positioning tower (e.g., in the case of sending a signal to the UE) and/or as a position measurement unit (e.g., in the case of receiving and measuring a signal from the UE).

An "RF signal" includes an electromagnetic wave of a given frequency that transmits information through the space between a transmitter and a receiver. As used herein, a transmitter may transmit a single "RF signal" or multiple "RF signals" to a receiver. However, due to the propagation characteristics of RF signals through multipath channels, a receiver may receive multiple "RF signals" corresponding to each transmitted RF signal. The same transmitted RF signal on different paths between a transmitter and a receiver may be referred to as a "multipath" RF signal. As used herein, an RF signal may also be referred to as a "wireless signal" or simply a "signal" where it is clear from the context that the term "signal" refers to a wireless signal or an RF signal.

FIG. 1 illustrates an example wireless communication system 100 according to various aspects of the present disclosure. The wireless communication system 100 (which may also be referred to as a wireless wide area network (WWAN)) may include various base stations 102 (labeled as "BS") and various UEs 104. The base stations 102 may include macro cell base stations (high power cellular base stations) and/or small cell base stations (low power cellular base stations). In one aspect, the macro cell base stations may include eNBs and/or ng-eNBs (where the wireless communication system 100 corresponds to an LTE network), or gNBs (where the wireless communication system 100 corresponds to an NR network), or a combination of the two, and the small cell base stations may include femto cells, pico cells, micro cells, etc.

The base stations 102 may collectively form a RAN and interface with a core network 170 (e.g., an evolved packet core (EPC) or a 5G core (5GC)) through a backhaul link 122, and interface with one or more location servers 172 (e.g., a location management function (LMF) or a secure user plane location (SUPL) location platform (SLP)) through the core network 170. The location server 172 may be part of the core network 170 or may be external to the core network 170. The location server 172 may be integrated with the base station 102. The UE 104 may communicate with the location server 172 directly or indirectly. For example, the UE 104 may communicate with the location server 172 via the base station 102 currently serving the UE 104. The UE 104 may also communicate with the location server 172 through another path, such as via an application server (not shown), via another network, such as via a wireless local area network (WLAN) access point (AP) (e.g., the AP 150 described below), and the like. For signaling purposes, communication between UE 104 and location server 172 may be represented as an indirect connection (e.g., through core network 170, etc.) or a direct connection (e.g., as shown via direct connection 128), with intermediate nodes (if any) omitted from the signaling diagram for clarity.

Among other functions, the base station 102 can perform functions related to one or more of the following: delivering user data, radio channel encryption and decryption, integrity protection, header compression, mobility control functions (e.g., handover, dual connectivity), inter-cell interference coordination, connection establishment and release, load balancing, distribution of non-access stratum (NAS) messages, NAS node selection, synchronization, RAN sharing, multimedia broadcast multicast service (MBMS), subscriber and equipment tracking, RAN information management (RIM), paging, positioning, and delivery of warning messages. The base stations 102 can communicate with each other directly or indirectly (e.g., through EPC/5GC) on a backhaul link 134, which can be wired or wireless.

Base station 102 may communicate wirelessly with UE 104. Each of base stations 102 may provide communication coverage for a corresponding geographic coverage area 110. In one aspect, one or more cells may be supported by base station 102 in each geographic coverage area 110. A "cell" is a logical communication entity used to communicate with a base station (e.g., via a frequency resource, which is referred to as a carrier frequency, component carrier, carrier, frequency band, etc.), and may be associated with an identifier (e.g., a physical cell identifier (PCI), an enhanced cell identifier (ECI), a virtual cell identifier (VCI), a cell global identifier (CGI), etc.) used to distinguish cells operating via the same or different carrier frequencies. In some cases, different cells may be configured according to different protocol types (e.g., machine type communication (MTC), narrowband IoT (NB-IoT), enhanced mobile broadband (eMBB), or other protocol types) that may provide access to different types of UEs. Since a cell is supported by a specific base station, the term "cell" may refer to either or both of a logical communication entity and a base station supporting the logical communication entity, depending on the context. In addition, since the TRP is generally the physical transmission point of the cell, the terms "cell" and "TRP" are used interchangeably. In some cases, the term "cell" may also refer to a geographic coverage area (e.g., a sector) of a base station, as long as the carrier frequency can be detected and used for communications within a portion of the geographic coverage area 110.

Although the geographic coverage areas 110 of neighboring macrocell base stations 102 may partially overlap (e.g., in a handover area), some areas of the geographic coverage areas 110 may substantially overlap with the larger geographic coverage areas 110. For example, a small cell base station 102' (labeled "SC" for "small cell") may have a geographic coverage area 110' that substantially overlaps with the geographic coverage areas 110 of one or more macrocell base stations 102. A network that includes both small cell base stations and macrocell base stations may be referred to as a heterogeneous network. A heterogeneous network may also include a home eNB (HeNB) that may provide services to a restricted group called a closed subscriber group (CSG).

The communication link 120 between the base station 102 and the UE 104 may include uplink (also referred to as a reverse link) transmissions from the UE 104 to the base station 102 and/or downlink (DL) (also referred to as a forward link) transmissions from the base station 102 to the UE 104. The communication link 120 may use MIMO antenna technology, including spatial multiplexing, beamforming, and/or transmit diversity. The communication link 120 may be over one or more carrier frequencies. The allocation of carriers may be asymmetric for the downlink and uplink (e.g., more or fewer carriers may be allocated to the downlink than to the uplink).

The wireless communication system 100 may also include a WLAN access point (AP) 150 that communicates with a wireless local area network (WLAN) station (STA) 152 in an unlicensed spectrum (e.g., 5 GHz) via a communication link 154. When communicating in the unlicensed spectrum, the WLAN STA 152 and/or the WLAN AP 150 may perform a clear channel assessment (CCA) or listen before talk (LBT) procedure prior to communication to determine whether a channel is available.

The small cell base station 102' can operate in licensed and/or unlicensed spectrum. When operating in the unlicensed spectrum, the small cell base station 102' can adopt LTE or NR technology and use the same 5GHz unlicensed spectrum used by the WLAN AP 150. The small cell base station 102' adopting LTE/5G in the unlicensed spectrum can improve the coverage of the access network and/or increase the capacity of the access network. NR in the unlicensed spectrum can be referred to as NR-U. LTE in the unlicensed spectrum can be referred to as LTE-U, License Assisted Access (LAA) or MulteFire.

The wireless communication system 100 may also include a millimeter wave (mmW) base station 180, which can operate in mmW frequencies and/or near mmW frequencies to communicate with UE 182. Extremely high frequency (EHF) is part of RF in the electromagnetic spectrum. EHF has a range of 30GHz to 300GHz, and a wavelength between 1 mm and 10 mm. The radio waves in this band can be called millimeter waves. Near mmW can be extended down to a frequency of 3GHz, and the wavelength is 100 mm. The super high frequency (SHF) band extends between 3GHz and 30GHz, which is also called centimeter waves. Communication using mmW/near mmW radio frequency bands has high path loss and relatively short distances. The mmW base station 180 and the UE 182 can utilize beamforming (sending and/or receiving) on the mmW communication link 184 to compensate for the extremely high path loss and short distance. In addition, it should be understood that in an alternative configuration, one or more base stations 102 can also use mmW or near mmW and beamforming to send. Therefore, it should be understood that the foregoing illustrations are merely examples and should not be construed as limiting the various aspects disclosed herein.

Transmit beamforming is a technique for focusing an RF signal in a specific direction. Traditionally, when a network node (e.g., a base station) broadcasts an RF signal, it broadcasts the signal in all directions (omnidirectionally). With transmit beamforming, the network node determines where a given target device (e.g., a UE) is located (relative to the transmitting network node) and projects a stronger downlink RF signal in that specific direction, thereby providing a faster (in terms of data rate) and stronger RF signal to the receiving device. In order to change the directionality of the RF signal when transmitting, the network node can control the phase and relative amplitude of the RF signal at each of the one or more transmitters that broadcast the RF signal. For example, a network node can use an array of antennas (referred to as a "phased array" or "antenna array") that produces RF beams that can be "steered" to point in different directions without actually moving the antenna. Specifically, the RF current from the transmitter is fed to each antenna in the correct phase relationship so that the radio waves from the separate antennas are added together in the desired direction to increase radiation while canceling out in the undesired direction to suppress radiation.

The transmit beams can be quasi-co-located, meaning that they appear to the receiver (e.g., UE) to have the same parameters, regardless of whether the network node's own transmit antennas are physically co-located. In NR, there are four types of quasi-co-location (QCL) relationships. Specifically, a given type of QCL relationship means that certain parameters about the second reference RF signal on the second beam can be derived based on information about the source reference RF signal on the source beam. Therefore, if the source reference RF signal is QCL type A, the receiver can use the source reference RF signal to estimate the Doppler shift, Doppler spread, average delay, and delay spread of the second reference RF signal sent on the same channel. If the source reference RF signal is QCL type B, the receiver can use the source reference RF signal to estimate the Doppler shift and Doppler spread of the second reference RF signal sent on the same channel. If the source reference RF signal is QCL type C, the receiver can use the source reference RF signal to estimate the Doppler shift and average delay of the second reference RF signal sent on the same channel. If the source reference RF signal is QCL type D, the receiver may use the source reference RF signal to estimate spatial reception parameters of a second reference RF signal transmitted on the same channel.

In receive beamforming, a receiver uses a receive beam to amplify an RF signal detected on a given channel. For example, a receiver may increase the gain setting of an antenna array in a particular direction and/or adjust the phase setting of an antenna array in a particular direction to amplify (e.g., increase its gain level) the RF signal received from that direction. Thus, when a receiver is said to be beamforming in a certain direction, this means that the beam gain in that direction is high relative to the beam gain along other directions, or that the beam gain in that direction is the highest compared to the beam gain in that direction of all other receive beams available to the receiver. This results in a stronger received signal strength (e.g., reference signal received power (RSRP), reference signal received quality (RSRQ), signal to interference plus noise ratio (SINR), etc.) of the RF signal received from that direction.

The transmit beam and the receive beam may be spatially correlated. The spatial relationship means that parameters of a second beam (e.g., a transmit beam or a receive beam) for a second reference signal may be derived based on information about a first beam (e.g., a receive beam or a transmit beam) for a first reference signal. For example, a UE may use a specific receive beam to receive a reference downlink reference signal (e.g., a synchronization signal block (SSB)) from a base station. The UE may then form a transmit beam for transmitting an uplink reference signal (e.g., a sounding reference signal (SRS)) to the base station based on the parameters of the receive beam.

Note that depending on the entity forming the "downlink" beam, the beam can be a transmit beam or a receive beam. For example, if the base station is forming a downlink beam to send a reference signal to the UE, the downlink beam is a transmit beam. However, if the UE is forming a downlink beam, the downlink beam is a receive beam that receives a downlink reference signal. Similarly, depending on the entity forming the "uplink" beam, the beam can be a transmit beam or a receive beam. For example, if the base station is forming an uplink beam, the uplink beam is an uplink receive beam, while if the UE is forming an uplink beam, the uplink beam is an uplink transmit beam.

The electromagnetic spectrum is typically subdivided into various categories, bands, channels, etc. based on frequency/wavelength. In 5GNR, two initial operating bands have been identified as frequency range designations FR1 (410 MHz–7.125 GHz) and FR2 (24.25 GHz–52.6 GHz). It should be understood that, although a portion of FR1 is greater than 6 GHz, FR1 is often (interchangeably) referred to as the “below 6 GHz” band in various documents and articles. A similar naming problem sometimes occurs with respect to FR2, which is often (interchangeably) referred to as the “millimeter wave” band in documents and articles, although different from the extremely high frequency (EHF) band (30 GHz–300 GHz) identified as the “millimeter wave” band by the International Telecommunication Union (ITU).

Frequencies between FR1 and FR2 are generally referred to as mid-band frequencies. Recent 5G NR research has identified the operating bands for these mid-band frequencies as frequency range designation FR3 (7.125GHz–24.25GHz). The bands falling within FR3 can inherit FR1 characteristics and/or FR2 characteristics, and therefore the features of FR1 and/or FR2 can be effectively extended to mid-band frequencies. In addition, higher frequency bands are currently being explored to extend 5G NR operations to more than 52.6GHz. For example, three higher operating bands have been identified as frequency range designations FR4a or FR4-1 (52.6GHz to 71GHz), FR4 (52.6GHz to 114.25GHz), and FR5 (114.25GHz to 300GHz). Each of these higher frequency bands falls within the EHF band.

In view of the above aspects, unless otherwise specifically stated, it should be understood that if the term "below 6 GHz" or the like is used in this document, it can be broadly referred to as a frequency that may be less than 6 GHz, may be within FR1, or may include mid-band frequencies. In addition, unless otherwise specifically stated, it should be understood that if the term "millimeter wave" or the like is used in this document, it can be broadly referred to as a frequency that may include mid-band frequencies, may be within FR2, FR4, FR4-a or FR4-1 and/or FR5, or may be within the EHF band.

In a multi-carrier system (such as 5G), one of the carrier frequencies is referred to as the "primary carrier" or "anchor carrier" or "primary serving cell" or "PCell", and the remaining carrier frequencies are referred to as "secondary carriers" or "secondary serving cells" or "SCells". In carrier aggregation, the anchor carrier is a carrier operating on the primary frequency (e.g., FR1) used by the UE 104/182 and the cell in which the UE 104/182 performs an initial radio resource control (RRC) connection establishment procedure or initiates an RRC connection re-establishment procedure. The primary carrier carries all common and UE-specific control channels and can be a carrier in a licensed frequency (however, this is not always the case). A secondary carrier is a carrier operating on a second frequency (e.g., FR2), which can be configured and can be used to provide additional radio resources once an RRC connection is established between the UE 104 and the anchor carrier. In some cases, the secondary carrier can be a carrier in an unlicensed frequency. The secondary carrier may contain only necessary signaling information and signals, for example, since the primary uplink carrier and the primary downlink carrier are typically UE-specific, those UE-specific signaling information and signals may not be present in the secondary carrier. This means that different UEs 104/182 in a cell may have different downlink primary carriers. The same is true for the uplink primary carrier. The network is able to change the primary carrier of any UE 104/182 at any time. This is done, for example, to balance the load on different carriers. Since a "serving cell" (whether PCell or SCell) corresponds to a carrier frequency/component carrier through which a base station communicates, the terms "cell", "serving cell", "component carrier", "carrier frequency", etc. may be used interchangeably.

For example, still referring to FIG. 1 , one of the frequencies used by the macrocell base station 102 may be an anchor carrier (or “PCell”), and the other frequencies used by the macrocell base station 102 and/or the mmW base station 180 may be secondary carriers (“SCells”). Simultaneous transmission and/or reception of multiple carriers enables the UE 104/182 to significantly increase its data transmission and/or reception rate. For example, two 20 MHz aggregated carriers in a multi-carrier system would theoretically result in a doubling of the data rate (i.e., 40 MHz) compared to the data rate obtained with a single 20 MHz carrier.

The wireless communication system 100 may also include a UE 164, which may communicate with the macrocell base station 102 via a communication link 120 and/or communicate with the mmW base station 180 via a mmW communication link 184. For example, the macrocell base station 102 may support a PCell and one or more SCells for the UE 164, and the mmW base station 180 may support one or more SCells for the UE 164.

In some cases, UE 164 and UE 182 are capable of sidelink communication. A UE with sidelink capability (SL-UE) can communicate with base station 102 via communication link 120 using a Uu interface (i.e., an air interface between UE and base station). SL-UEs (e.g., UE 164, UE 182) can also communicate directly with each other via a wireless sidelink 160 using a PC5 interface (i.e., an air interface between UEs with sidelink capability). A wireless sidelink (or just "sidelink") is an adaptation of a core cellular network (e.g., LTE, NR) standard that allows direct communication between two or more UEs without communicating through a base station. Sidelink communications can be unicast or multicast and can be used for device-to-device (D2D) media sharing, vehicle-to-vehicle (V2V) communications, vehicle-to-vehicle (V2X) communications (e.g., cellular V2X (cV2X) communications, enhanced V2X (eV2X) communications, etc.), emergency rescue applications, etc. One or more SL-UEs in a group of SL-UEs utilizing sidelink communications may be located within the geographic coverage area 110 of the base station 102. Other SL-UEs in such a group may be outside the geographic coverage area 110 of the base station 102, or may be unable to receive transmissions from the base station 102 for other reasons. In some cases, each group of SL-UEs communicating via sidelink communications may utilize a one-to-many (1:M) system, where each SL-UE transmits to each other SL-UE in the group. In some cases, the base station 102 facilitates the scheduling of resources for the sidelink communications. In other cases, the sidelink communications are performed between the SL-UEs without involving the base station 102.

In one aspect, the sidelink 160 may operate on a wireless communication medium of interest, which may be shared with other vehicles and/or infrastructure access points and other wireless communications between other RATs. A "medium" may include one or more time, frequency, and/or spatial communication resources associated with wireless communications between one or more transmitter/receiver pairs (e.g., covering one or more channels across one or more carriers). In one aspect, the medium of interest may correspond to at least a portion of an unlicensed band shared between various RATs. Although different licensed bands have been reserved for certain communication systems (e.g., by government entities such as the Federal Communications Commission (FCC) in the United States), these systems (particularly those employing small cell access points) have recently expanded operations into unlicensed bands such as the unlicensed National Information Infrastructure (U-NII) band used by wireless local area network (WLAN) technology (most notably the IEEE 802.11x WLAN technology commonly referred to as "Wi-Fi"). Example systems of this type include different variants of CDMA systems, TDMA systems, FDMA systems, orthogonal FDMA (OFDMA) systems, single carrier FDMA (SC-FDMA) systems, and the like.

It should be noted that although FIG. 1 illustrates only two of these UEs as SL-UEs (i.e., UEs 164 and 182), any of the illustrated UEs may be SL-UEs. In addition, although only UE 182 is described as being capable of beamforming, any of the illustrated UEs (including UE 164) may be capable of beamforming. Where SL-UEs are capable of beamforming, they may beamform toward each other (i.e., toward other SL-UEs), toward other UEs (e.g., UE 104), toward base stations (e.g., base stations 102, 180, small cells 102', access point 150), and the like. Thus, in some cases, UE 164 and UE 182 may utilize beamforming via side link 160.

In the example of FIG. 1 , any of the illustrated UEs (shown as a single UE 104 in FIG. 1 for simplicity) can receive a signal 124 from one or more earth orbiting space vehicles (SVs) 112 (e.g., satellites). In one aspect, the SV 112 can be part of a satellite positioning system that the UE 104 can use as an independent source of location information. A satellite positioning system typically includes a system of transmitters (e.g., SVs 112) that are positioned so that a receiver (e.g., UE 104) can determine its position on or above the earth based at least in part on a positioning signal (e.g., signal 124) received from the transmitter. Such a transmitter typically transmits a signal of a repeating pseudo-random noise (PN) code marked with a set number of chips. Although typically located in the SV 112, the transmitter can sometimes be located on a ground-based control station, a base station 102, and/or other UEs 104. The UE 104 can include one or more dedicated receivers that are specifically designed to receive the signal 124 so as to derive geographic location information from the SV 112.

In a satellite positioning system, the use of signal 124 may be enhanced by various satellite-based augmentation systems (SBAS) that may be associated with or otherwise enabled for use with one or more global and/or regional navigation satellite systems. For example, SBAS may include augmentation systems that provide integrity information, differential corrections, and the like, such as Wide Area Augmentation System (WAAS), European Geostationary Navigation Overlay Service (EGNOS), Multifunction Satellite Augmentation System (MSAS), Global Positioning System (GPS) Assisted Geographic Augmented Navigation, or GPS and Geographic Augmented Navigation System (GAGAN), and the like. Thus, as used herein, a satellite positioning system may include any combination of one or more global and/or regional navigation satellites associated with such one or more satellite positioning systems.

In one aspect, SV 112 may additionally or alternatively be part of one or more non-terrestrial networks (NTNs). In an NTN, SV 112 is connected to an earth station (also referred to as a ground station, NTN gateway, or gateway), which in turn is connected to an element in a 5G network, such as a modified base station 102 (without a ground antenna) or a network node in a 5GC. This element in turn will provide access to other elements in the 5G network, and ultimately provide access to entities outside the 5G network (such as Internet web servers and other user devices). In this way, instead of or in addition to communication signals from ground base stations 102, UE 104 can receive communication signals (e.g., signal 124) from SV 112.

The wireless communication system 100 may also include one or more UEs, such as UE 190, which are indirectly connected to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links (referred to as "side links"). In the example of FIG. 1, UE 190 has a D2D P2P link 192 with one of UEs 104 connected to one of base stations 102 (e.g., UE 190 can indirectly obtain cellular connectivity through the D2D P2P link), and has a D2D P2P link 194 with a WLAN STA 152 connected to a WLAN AP 150 (UE 190 can indirectly obtain WLAN-based Internet connectivity through the D2D P2P link). In one example, D2D P2P links 192 and 194 may be supported by any well-known D2D RAT, such as LTE Direct (LTE-D), WiFi Direct (WiFi-D), wait.

FIG. 2A illustrates an example wireless network architecture 200. For example, 5GC 210 (also referred to as Next Generation Core (NGC)) can be functionally viewed as control plane (C-plane) functions 214 (e.g., UE registration, authentication, network access, gateway selection, etc.) and user plane (U-plane) functions 212 (e.g., UE gateway functions, access to data networks, IP routing, etc.), which operate in conjunction to form a core network. A user plane interface (NG-U) 213 and a control plane interface (NG-C) 215 connect gNB 222 to 5GC 210, and specifically to user plane functions 212 and control plane functions 214, respectively. In additional configurations, ng-eNB 224 can also connect to 5GC 210 via NG-C 215 to control plane functions 214 and NG-U 213 to user plane functions 212. In addition, ng-eNB 224 can communicate directly with gNB 222 via backhaul connection 223. In some configurations, the next generation RAN (NG-RAN) 220 may have one or more gNBs 222, while other configurations include one or more of ng-eNBs 224 and gNBs 222. Either the gNB 222 or the ng-eNB 224 (or both) may communicate with one or more UEs 204 (e.g., any of the UEs described herein).

Another optional aspect may include a location server 230 that can communicate with the 5GC 210 to provide location assistance for the UE 204. The location server 230 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules distributed across multiple physical servers, etc.), or alternatively can each correspond to a single server. The location server 230 can be configured to support one or more location services for the UE 204 that can be connected to the location server 230 via the core network, the 5GC 210, and/or via the Internet (not illustrated). In addition, the location server 230 can be integrated into a component of the core network, or alternatively can be external to the core network (e.g., a third-party server, such as an original equipment manufacturer (OEM) server or a service server).

FIG2B illustrates another example wireless network structure 240. 5GC 260 (which may correspond to 5GC 210 in FIG2A) may be functionally considered as a control plane function provided by an access and mobility management function (AMF) 264, and a user plane function provided by a user plane function (UPF) 262, which operate in conjunction to form a core network (i.e., 5GC 260). The functions of AMF 264 include: registration management, connection management, reachability management, mobility management, lawful interception, transmission of session management (SM) messages between one or more UEs 204 (e.g., any UE described herein) and a session management function (SMF) 266, a transparent proxy service for routing SM messages, access authentication and access authorization, transmission of short message service (SMS) messages between UE 204 and a short message service function (SMSF) (not shown), and security anchor functionality (SEAF). AMF 264 also interacts with an authentication server function (AUSF) (not shown) and UE 204, and receives an intermediate key established as a result of the UE 204 authentication process. In the case of authentication based on the UMTS (Universal Mobile Telecommunications System) Subscriber Identity Module (USIM), the AMF 264 retrieves security material from the AUSF. The functionality of the AMF 264 also includes security context management (SCM). The SCM receives keys from the SEAF, which are used by the SCM to derive access network-specific keys. The functionality of the AMF 264 also includes location service management for regulatory services, for the transmission of location service messages between the UE 204 and the Location Management Function (LMF) 270 (which acts as a location server 230), for the transmission of location service messages between the NG-RAN 220 and the LMF 270, for the allocation of Evolved Packet System (EPS) bearer identifiers for interoperation with EPS, and UE 204 mobility event notifications. In addition, the AMF 264 also supports functionality for non-3GPP (Third Generation Partnership Project) access networks.

The functions of UPF 262 include: acting as an anchor point for intra-RAT/inter-RAT mobility (when applicable), acting as an external protocol data unit (PDU) session point for interconnection to a data network (not shown), providing packet routing and forwarding, packet inspection, user plane policy rule enforcement (e.g., gating, redirection, service steering), lawful interception (user plane collection), service usage reporting, user plane quality of service (QoS) handling (e.g., uplink/downlink rate enforcement, reflective QoS marking in downlink), uplink service verification (service data flow (SDF) to QoS flow mapping), transport level packet marking in uplink and downlink, downlink packet buffering and downlink data notification triggering, and transmitting and forwarding one or more "end markers" to the source RAN node. UPF 262 can also support the delivery of location service messages between UE 204 and a location server (such as SLP 272) on the user plane.

The functions of SMF 266 include session management, UE Internet Protocol (IP) address allocation and management, selection and control of user plane functions, traffic steering configuration for routing traffic to the correct destination at UPF 262, partial control of policy enforcement and QoS, and downlink data notification. The interface through which SMF 266 communicates with AMF 264 is called the N11 interface.

Another optional aspect may include an LMF 270 that can communicate with the 5GC 260 to provide location assistance for the UE 204. The LMF 270 can be implemented as multiple separate servers (e.g., physically separate servers, different software modules on a single server, different software modules distributed across multiple physical servers, etc.), or alternatively can each correspond to a single server. The LMF 270 can be configured to support one or more location services for the UE 204, which can be connected to the LMF 270 via the core network, the 5GC 260, and/or via the Internet (not illustrated). SLP 272 can support similar functionality as LMF 270, but LMF 270 can communicate with AMF 264, NG-RAN 220, and UE 204 on the control plane (e.g., using interfaces and protocols designed to carry signaling messages rather than voice or data), and SLP 272 can communicate with UE 204 and external clients (e.g., third-party servers 274) on the user plane (e.g., using protocols designed to carry voice and/or data, such as Transmission Control Protocol (TCP) and/or IP).

Yet another optional aspect may include a third-party server 274 that can communicate with LMF 270, SLP 272, 5GC 260 (e.g., via AMF 264 and/or UPF 262), NG-RAN 220, and/or UE 204 to obtain location information (e.g., location estimate) of UE 204. Thus, in some cases, the third-party server 274 may be referred to as a location service (LCS) client or an external client. The third-party server 274 may be implemented as a plurality of separate servers (e.g., physically separate servers, different software modules on a single server, different software modules distributed across multiple physical servers, etc.), or may alternatively each correspond to a single server.

The user plane interface 263 and the control plane interface 265 connect the 5GC 260, and specifically the UPF 262 and the AMF 264, respectively, to one or more gNBs 222 and/or ng-eNBs 224 in the NG-RAN 220. The interface between the gNB 222 and/or ng-eNB 224 and the AMF 264 is referred to as the "N2" interface, and the interface between the gNB 222 and/or ng-eNB 224 and the UPF 262 is referred to as the "N3" interface. The gNBs 222 and/or ng-eNBs 224 of the NG-RAN 220 may communicate directly with each other via a backhaul connection 223 referred to as an "Xn-C" interface. One or more of the gNBs 222 and/or ng-eNBs 224 may communicate with one or more UEs 204 via a wireless interface referred to as a "Uu" interface.

The functionality of the gNB 222 is divided between a gNB Central Unit (gNB-CU) 226, one or more gNB Distributed Units (gNB-DU) 228, and one or more gNB Radio Units (gNB-RU) 229. The gNB-CU 226 is a logical node that includes base station functions other than those specifically assigned to the gNB-DU 228, including delivery of user data, mobility control, radio access network sharing, positioning, session management, etc. More specifically, the gNB-CU 226 typically hosts the Radio Resource Control (RRC), Service Data Adaptation Protocol (SDAP), and Packet Data Convergence Protocol (PDCP) protocols of the gNB 222. The gNB-DU 228 is a logical node that typically hosts the Radio Link Control (RLC) and Medium Access Control (MAC) layers of the gNB 222. Its operation is controlled by the gNB-CU 226. One gNB-DU 228 can support one or more cells, and one cell is supported by only one gNB-DU 228. The interface 232 between the gNB-CU 226 and one or more gNB-DUs 228 is referred to as the "F1" interface. The physical (PHY) layer functionality of the gNB 222 is typically hosted by one or more independent gNB-RUs 229, which perform functions such as power amplification and signal transmission/reception. The interface between the gNB-DU 228 and the gNB-RU 229 is referred to as the "Fx" interface. Thus, the UE 204 communicates with the gNB-CU 226 via the RRC layer, the SDAP layer, and the PDCP layer, communicates with the gNB-DU 228 via the RLC layer and the MAC layer, and communicates with the gNB-RU 229 via the PHY layer.

The deployment of a communication system (such as a 5G NR system) can be arranged in a variety of ways with various components or components. In a 5G NR system or network, a network node, a network entity, a mobility element of a network, a RAN node, a core network node, a network element, or a network equipment (such as a base station or one or more units (or one or more components) that perform base station functionality) can be implemented in an aggregated or decomposed architecture. For example, a base station (such as a node B (NB), an evolved NB (eNB), an NR base station, a 5GNB, an access point (AP), a transmit receive point (TRP), or a cell, etc.) can be implemented as an aggregated base station (also referred to as a standalone base station or a monolithic base station) or a decomposed base station.

A converged base station may be configured to utilize a radio protocol stack physically or logically integrated within a single RAN node. A decomposed base station may be configured to utilize a protocol stack physically or logically distributed between two or more units, such as one or more central or centralized units (CUs), one or more distributed units (DUs), or one or more radio units (RUs). In some aspects, a CU may be implemented within a RAN node, and one or more DUs may be co-located with the CU, or alternatively, may be geographically or virtually distributed in one or more other RAN nodes. A DU may be implemented to communicate with one or more RUs. Each of a CU, a DU, and a RU may also be implemented as a virtual unit, i.e., a virtual central unit (VCU), a virtual distributed unit (VDU), or a virtual radio unit (VRU).

Base station type operations or network designs may take into account the aggregated nature of base station functionality. For example, a disaggregated base station may be used in an integrated access backhaul (IAB) network, an open radio access network (O-RAN (network configurations such as those initiated by the O-RAN Alliance)), or a virtualized radio access network (vRAN, also known as a cloud radio access network (C-RAN)). Decomposition may include distributing functions across two or more units at various physical locations, as well as virtually distributing the functions of at least one unit, which may enable flexibility in network design. Various units of a disaggregated base station or disaggregated RAN architecture may be configured for wired or wireless communication with at least one other unit.

FIG2C illustrates an example disaggregated base station architecture 250 according to aspects of the present disclosure. The disaggregated base station architecture 250 may include one or more central units (CUs) 280 (e.g., gNB-CUs 226) that may communicate directly with a core network 267 (e.g., 5GC 210, 5GC 260) via a backhaul link, or indirectly with the core network 267 through one or more disaggregated base station units, such as a near real-time (near-RT) RAN intelligent controller (RIC) 259 via an E2 link or a non-real-time (non-RT) RIC 257 associated with a service management and orchestration (SMO) framework 255, or both. The CU 280 may communicate with one or more distributed units (DUs) 285 (e.g., gNB-DUs 228) via corresponding midhaul links, such as F1 interfaces. The DUs 285 may communicate with one or more radio units (RUs) 287 (e.g., gNB-RUs 229) via corresponding fronthaul links. The RU 287 can communicate with a corresponding UE 204 via one or more radio frequency (RF) access links. In some implementations, a UE 204 can be served by multiple RUs 287 simultaneously.

Each of the units (i.e., CU 280, DU 285, RU 287, and near-RT RIC 259, non-RT RIC 257, and SMO framework 255) may include or be coupled to one or more interfaces configured to receive or send signals, data, or information (collectively, signals) via a wired or wireless transmission medium. Each of the units or an associated processor or controller that provides instructions to the communication interface of these units may be configured to communicate with one or more of the other units via a transmission medium. For example, these units may include a wired interface configured to receive or send signals to one or more of the other units via a wired transmission medium. Additionally, the unit may include a wireless interface that may include a receiver, transmitter, or transceiver (such as a radio frequency (RF) transceiver) that is configured to receive or send signals, or both, to one or more of the other units via a wireless transmission medium.

In some aspects, CU 280 may host one or more higher layer control functions. Such control functions may include radio resource control (RRC), packet data convergence protocol (PDCP), service data adaptation protocol (SDAP), etc. Each control function may be implemented using an interface that is configured to communicate signals with other control functions hosted by CU 280. CU 280 may be configured to handle user plane functionality (i.e., central unit-user plane (CU-UP)), control plane functionality (i.e., central unit-control plane (CU-CP)), or a combination thereof. In some specific implementations, CU 280 may be logically split into one or more CU-UP units and one or more CU-CP units. When implemented in an O-RAN configuration, the CU-UP unit may communicate bidirectionally with the CU-CP unit via an interface (such as an E1 interface). As needed, CU 280 may be implemented to communicate with DU 285 for network control and signaling.

DU 285 may correspond to a logical unit that includes one or more base station functions for controlling the operation of one or more RUs 287. In some aspects, DU 285 may host one or more of a radio link control (RLC) layer, a medium access control (MAC) layer, and one or more high physical (PHY) layers (such as modules for forward error correction (FEC) encoding and decoding, scrambling, modulation and demodulation, etc.) depending at least in part on a functional split such as defined by the Third Generation Partnership Project (3GPP). In some aspects, DU 285 may also host one or more low PHY layers. Each layer (or module) may be implemented using an interface that is configured to communicate signals with other layers (and modules) hosted by DU 285 or with control functions hosted by CU 280.

The lower layer functionality may be implemented by one or more RUs 287. In some deployments, a RU 287 controlled by a DU 285 may correspond to a logical node that hosts RF processing functions or low PHY layer functions (such as performing Fast Fourier Transform (FFT), Inverse FFT (iFFT), digital beamforming, physical random access channel (PRACH) extraction and filtering, etc.), or both, based at least in part on a functional split (such as a lower layer functional split). In such an architecture, the RU 287 may be implemented to handle over-the-air (OTA) communications with one or more UEs 204. In some implementations, real-time and non-real-time aspects of control plane and user plane communications with the RU 287 may be controlled by the corresponding DU 285. In some scenarios, this configuration may enable the implementation of the DU 285 and the CU 280 in a cloud-based RAN architecture (such as a vRAN architecture).

The SMO framework 255 may be configured to support RAN deployment and provisioning of non-virtualized network elements and virtualized network elements. For non-virtualized network elements, the SMO framework 255 may be configured to support the deployment of dedicated physical resources for RAN coverage requirements, which may be managed via an operation and maintenance interface (such as an O1 interface). For virtualized network elements, the SMO framework 255 may be configured to interact with a cloud computing platform (such as an open cloud (O-Cloud) 269) to perform network element lifecycle management (such as to instantiate virtualized network elements) via a cloud computing platform interface (such as an O2 interface). Such virtualized network elements may include, but are not limited to, CU 280, DU 285, RU 287, and near-RT RIC 259. In some specific implementations, the SMO framework 255 may communicate with hardware aspects of the 4G RAN (such as an open eNB (O-eNB) 261) via the O1 interface. Additionally, in some specific implementations, the SMO framework 255 may communicate directly with one or more RUs 287 via the O1 interface. The SMO framework 255 may also include a non-RT RIC 257 configured to support the functionality of the SMO framework 255 .

The non-RT RIC 257 may be configured to include logic functions that enable non-real-time control and optimization of RAN elements and resources, artificial intelligence/machine learning (AI/ML) workflows including model training and updating, or policy-based guidance of applications/features in the near-RT RIC 259. The non-RT RIC 257 may be coupled to or communicate with the near-RT RIC 259 (such as via an A1 interface). The near-RT RIC 259 may be configured to include logic functions that enable near-real-time control and optimization of RAN elements and resources via data collection and actions through an interface (such as via an E2 interface) that connects one or more CUs 280, one or more DUs 285, or both, and the O-eNB with the near-RT RIC 259.

In some implementations, in order to generate an AI/ML model to be deployed in the near-RT RIC 259, the non-RT RIC 257 may receive parameters or external enrichment information from an external server. Such information may be utilized by the near-RT RIC 259 and may be received from a non-network data source or from a network function at the SMO framework 255 or the non-RT RIC 257. In some examples, the non-RT RIC 257 or the near-RT RIC 259 may be configured to adjust RAN behavior or performance. For example, the non-RT RIC 257 may monitor long-term trends and patterns of performance and employ AI/ML models to perform corrective actions through the SMO framework 255 (such as via reconfiguration of O1) or via the creation of RAN management policies (such as A1 policies).

3A, 3B, and 3C illustrate several example components (represented by corresponding boxes) that may be incorporated into a UE 302 (which may correspond to any of the UEs described herein), a base station 304 (which may correspond to any of the base stations described herein), and a network entity 306 (which may correspond to or embody any of the network functions described herein, including the location server 230 and the LMF 270, or alternatively may be independent of the NG-RAN 220 and/or 5GC 210/260 infrastructure depicted in FIGS. 2A and 2B, such as a dedicated network) to support operations as described herein. It should be understood that these components may be implemented in different types of devices with different specific implementations (e.g., in an ASIC, in a system on a chip (SoC), etc.). The illustrated components are also incorporated into other devices in a communication system. For example, other devices in the system may include components similar to those described as providing similar functionality. Moreover, a given device may include one or more of these components. For example, an apparatus may include multiple transceiver components that enable the apparatus to operate on multiple carriers and/or communicate via different technologies.

UE 302 and base station 304 each include one or more wireless wide area network (WWAN) transceivers 310 and 350, respectively, which provide means (e.g., means for transmitting, means for receiving, means for measuring, means for tuning, means for preventing transmitting, etc.) for communicating via one or more wireless communication networks (not shown), such as NR networks, LTE networks, GSM networks, etc. WWAN transceivers 310 and 350 may each be connected to one or more antennas 316 and 356, respectively, for communicating with other network nodes (such as other UEs, access points, base stations (e.g., eNBs, gNBs), etc.) via at least one designated RAT (e.g., NR, LTE, GSM, etc.) on a wireless communication medium of interest (e.g., a certain set of time/frequency resources in a specific spectrum). The WWAN transceivers 310 and 350 can be configured in different ways to transmit and encode signals 318 and 358 (e.g., messages, indications, information, etc.) according to the specified RAT, and conversely, receive and decode signals 318 and 358 (e.g., messages, indications, information, pilots, etc.). Specifically, the WWAN transceivers 310 and 350 include: one or more transmitters 314 and 354 for transmitting and encoding signals 318 and 358, respectively, and one or more receivers 312 and 352 for receiving and decoding signals 318 and 358, respectively.

At least in some cases, the UE 302 and the base station 304 each further include one or more short-range wireless transceivers 320 and 360, respectively. The short-range wireless transceivers 320 and 360 can be connected to one or more antennas 326 and 366, respectively, and provide for communicating over the wireless communication medium of interest via at least one designated RAT (e.g., WiFi, LTE-D, The short-range wireless transceivers 320 and 360 are components (e.g., components for sending, components for receiving, components for measuring, components for tuning, components for preventing sending, etc.) for communicating with other network nodes (such as other UEs, access points, base stations, etc.) using a PC5, dedicated short-range communication (DSRC), wireless access for vehicle environments (WAVE), near field communication (NFC), ultra-wideband (UWB), etc.). The short-range wireless transceivers 320 and 360 can be configured in different ways to send and encode signals 328 and 368 (e.g., messages, indications, information, etc.) according to a specified RAT, and conversely, receive and decode signals 328 and 368 (e.g., messages, indications, information, pilots, etc.). Specifically, the short-range wireless transceivers 320 and 360 include: one or more transmitters 324 and 364 for sending and encoding signals 328 and 368, respectively, and one or more receivers 322 and 362 for receiving and decoding signals 328 and 368, respectively. As a specific example, the short-range wireless transceivers 320 and 360 may be WiFi transceivers, Transceiver, and/or transceiver, NFC transceiver UWB transceiver or vehicle-to-vehicle (V2V) and/or vehicle-to-everything (V2X) transceiver.

At least in some cases, the UE 302 and the base station 304 also include satellite signal receivers 330 and 370. The satellite signal receivers 330 and 370 may be connected to one or more antennas 336 and 376, respectively, and may provide components for receiving and/or measuring satellite positioning/communication signals 338 and 378, respectively. In the case where the satellite signal receivers 330 and 370 are satellite positioning system receivers, the satellite positioning/communication signals 338 and 378 may be global positioning system (GPS) signals, global navigation satellite system (GLONASS) signals, Galileo signals, Beidou signals, Indian regional navigation satellite system (NAVIC), Quasi-Zenith Satellite System (QZSS), etc. In the case where the satellite signal receivers 330 and 370 are non-terrestrial network (NTN) receivers, the satellite positioning/communication signals 338 and 378 may be communication signals (e.g., carrying control and/or user data) originating from a 5G network. The satellite signal receivers 330 and 370 may include any suitable hardware and/or software for receiving and processing satellite positioning/communication signals 338 and 378, respectively. Satellite signal receivers 330 and 370 may request appropriate information and operations from other systems and, at least in some cases, perform calculations using measurements obtained by any suitable satellite positioning system algorithm to determine the positions of UE 302 and base station 304, respectively.

The base station 304 and the network entity 306 each include one or more network transceivers 380 and 390, respectively, which provide components (e.g., components for sending, components for receiving, etc.) for communicating with other network entities (e.g., other base stations 304, other network entities 306). For example, the base station 304 may employ one or more network transceivers 380 to communicate with other base stations 304 or network entities 306 through one or more wired or wireless backhaul links. As another example, the network entity 306 may employ one or more network transceivers 390 to communicate with one or more base stations 304 through one or more wired or wireless backhaul links, or communicate with other network entities 306 through one or more wired or wireless core network interfaces.

The transceiver may be configured to communicate over a wired or wireless link. A transceiver (whether a wired transceiver or a wireless transceiver) includes a transmitter circuit system (e.g., transmitters 314, 324, 354, 364) and a receiver circuit system (e.g., receivers 312, 322, 352, 362). In some implementations, the transceiver may be an integrated device (e.g., embodying the transmitter circuit system and the receiver circuit system in a single device), in some implementations may include separate transmitter circuit systems and separate receiver circuit systems, or may be embodied in other ways in other implementations. The transmitter circuit system and the receiver circuit system of a wired transceiver (e.g., network transceivers 380 and 390 in some implementations) may be coupled to one or more wired network interface ports. The wireless transmitter circuitry (e.g., transmitters 314, 324, 354, 364) may include or be coupled to multiple antennas (e.g., antennas 316, 326, 356, 366), such as antenna arrays, which allow the corresponding device (e.g., UE 302, base station 304) to perform transmit "beamforming", as described herein. Similarly, the wireless receiver circuitry (e.g., receiver 312, 322, 352, 362) may include or be coupled to multiple antennas (e.g., antennas 316, 326, 356, 366), such as antenna arrays, which allow the corresponding device (e.g., UE 302, base station 304) to perform receive beamforming, as described herein. In one aspect, the transmitter circuitry and the receiver circuitry may share the same multiple antennas (e.g., antennas 316, 326, 356, 366) so that the corresponding device can only receive or only transmit at a given time, rather than both receive and transmit at the same time. The wireless transceivers (eg, WWAN transceivers 310 and 350, short-range wireless transceivers 320 and 360) may also include a network listening module (NLM) or the like for performing various measurements.

As used herein, various wireless transceivers (e.g., transceivers 310, 320, 350, and 360 in some implementations, and network transceivers 380 and 390) and wired transceivers (e.g., network transceivers 380 and 390 in some implementations) may be generally characterized as a "transceiver," "at least one transceiver," or "one or more transceivers." Thus, whether a particular transceiver is a wired or wireless transceiver may be inferred based on the type of communication being performed. For example, backhaul communications between network devices or servers typically involve signaling via a wired transceiver, while wireless communications between a UE (e.g., UE 302) and a base station (e.g., base station 304) will typically involve signaling via a wireless transceiver.

UE 302, base station 304, and network entity 306 also include other components that can be used in conjunction with the operations disclosed herein. UE 302, base station 304, and network entity 306 include one or more processors 332, 384, and 394, respectively, for providing functionality related to, for example, wireless communication, and for providing other processing functionality. Thus, processors 332, 384, and 394 may provide means for processing, such as means for determining, means for calculating, means for receiving, means for sending, means for indicating, etc. In one aspect, processors 332, 384, and 394 may include, for example, one or more general purpose processors, multi-core processors, central processing units (CPUs), ASICs, digital signal processors (DSPs), field programmable gate arrays (FPGAs), other programmable logic devices or processing circuit systems, or various combinations thereof.

UE 302, base station 304, and network entity 306 include memory circuitry implementing memory 340, 386, and 396 (e.g., each including a memory device) for maintaining information (e.g., information indicating reserved resources, thresholds, parameters, etc.). Thus, memory 340, 386, and 396 may provide means for storing, means for retrieving, means for maintaining, etc. In some cases, UE 302, base station 304, and network entity 306 may include positioning components 342, 388, and 398, respectively. Positioning components 342, 388, and 398, respectively, may be hardware circuits that are part of or coupled to processors 332, 384, and 394, respectively, which, when executed, cause UE 302, base station 304, and network entity 306 to perform the functionality described herein. In other aspects, the positioning components 342, 388, and 398 may be external to the processors 332, 384, and 394 (e.g., part of a modem processing system, integrated with another processing system, etc.). Alternatively, the positioning components 342, 388, and 398 may be memory modules stored in the memories 340, 386, and 396, respectively, which, when executed by the processors 332, 384, and 394 (or the modem processing system, another processing system, etc.), cause the UE 302, the base station 304, and the network entity 306 to perform the functionality described herein. FIG. 3A illustrates possible locations for the positioning component 342, which may be, for example, part of one or more WWAN transceivers 310, the memory 340, the one or more processors 332, or any combination thereof, or may be a stand-alone component. FIG. 3B illustrates possible locations for the positioning component 388, which may be, for example, part of one or more WWAN transceivers 350, the memory 386, the one or more processors 384, or any combination thereof, or may be a stand-alone component. 3C illustrates possible locations for a location component 398, which may be part of, for example, one or more network transceivers 390, memory 396, one or more processors 394, or any combination thereof, or may be a stand-alone component.

UE 302 may include one or more sensors 344 coupled to one or more processors 332 to provide a means for sensing or detecting movement and/or orientation information that is independent of motion data derived from signals received by one or more WWAN transceivers 310, one or more short-range wireless transceivers 320, and/or satellite signal receivers 330. By way of example, sensor 344 may include an accelerometer (e.g., a microelectromechanical system (MEMS) device), a gyroscope, a geomagnetic sensor (e.g., a compass), an altimeter (e.g., a barometric altimeter), and/or any other type of motion detection sensor. In addition, sensor 344 may include multiple different types of devices and combine their outputs to provide motion information. For example, sensor 344 may use a combination of a multi-axis accelerometer and an orientation sensor to provide the ability to calculate positioning in a two-dimensional (2D) and/or three-dimensional (3D) coordinate system.

In addition, the UE 302 includes a user interface 346, which provides components for providing indications to the user (e.g., audible and/or visual indications) and/or for receiving user input (e.g., when the user actuates a sensing device such as a keypad, touch screen, microphone, etc.). Although not shown, the base station 304 and the network entity 306 may also include a user interface.

Referring to the one or more processors 384 in more detail, in a downlink, IP packets from the network entity 306 may be provided to the processor 384. The one or more processors 384 may implement functionality for an RRC layer, a packet data convergence protocol (PDCP) layer, a radio link control (RLC) layer, and a medium access control (MAC) layer. One or more processors 384 may provide: RRC layer functionality associated with broadcasting of system information (e.g., master information block (MIB), system information block (SIB)), RRC connection control (e.g., RRC connection paging, RRC connection establishment, RRC connection modification, and RRC connection release), inter-RAT mobility, and measurement configuration for UE measurement reporting; PDCP layer functionality associated with header compression/decompression, security (encryption, decryption, integrity protection, integrity verification), and handover support functions; RLC layer functionality associated with delivery of upper layer PDUs, error correction through automatic repeat request (ARQ), concatenation, segmentation and reassembly of RLC service data units (SDUs), re-segmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, scheduling information reporting, error correction, priority handling, and logical channel prioritization.

The transmitter 354 and the receiver 352 may implement layer 1 (L1) functionality associated with various signal processing functions. Layer 1, including the physical (PHY) layer, may include: error detection on the transport channel, forward error correction (FEC) coding/decoding of the transport channel, interleaving, rate matching, mapping to the physical channel, modulation/demodulation of the physical channel, and MIMO antenna processing. The transmitter 354 handles the mapping to the signal constellation based on various modulation schemes (e.g., binary phase shift keying (BPSK), quadrature phase shift keying (QPSK), M-phase shift keying (M-PSK), M-quadrature amplitude modulation (M-QAM)). The coded and modulated symbols may then be separated into parallel streams. Each stream may then be mapped to an orthogonal frequency division multiplexing (OFDM) subcarrier, multiplexed with a reference signal (e.g., a pilot) in the time and/or frequency domain, and then combined together using an inverse fast Fourier transform (IFFT) to produce a physical channel carrying a time domain OFDM symbol stream. The OFDM symbol stream is spatially pre-coded to generate multiple spatial streams. Channel estimates from a channel estimator may be used to determine coding and modulation schemes and for spatial processing. Channel estimates may be derived from a reference signal and/or channel state feedback sent by the UE 302. Each spatial stream may then be provided to one or more different antennas 356. The transmitter 354 may modulate an RF carrier with a corresponding spatial stream for transmission.

At the UE 302, the receiver 312 receives the signal through its corresponding antenna 316. The receiver 312 recovers the information modulated onto the RF carrier and provides the information to one or more processors 332. The transmitter 314 and the receiver 312 implement layer 1 functionality associated with various signal processing functions. The receiver 312 can perform spatial processing on the information to recover any spatial streams destined for the UE 302. If multiple spatial streams are destined for the UE 302, they can be combined into a single OFDM symbol stream by the receiver 312. The receiver 312 then converts the OFDM symbol stream from the time domain to the frequency domain using a fast Fourier transform (FFT). The frequency domain signal includes a separate OFDM symbol stream for each subcarrier of the OFDM signal. The symbols on each subcarrier and the reference signal are recovered and demodulated by determining the most likely signal constellation point sent by the base station 304. These soft decisions can be based on channel estimates calculated by a channel estimator. The soft decisions are then decoded and deinterleaved to recover the data and control signals originally sent by the base station 304 on the physical channel. The data and control signals are then provided to one or more processors 332, which implement layer 3 (L3) and layer 2 (L2) functionality.

In the downlink, one or more processors 332 provide demultiplexing between transport and logical channels, packet reassembly, decryption, header decompression, and control signal processing to recover IP packets from the core network. One or more processors 332 are also responsible for error detection.

Similar to the functionality described in conjunction with downlink transmissions performed by the base station 304, the one or more processors 332 provide: RRC layer functionality associated with system information (e.g., MIB, SIB) acquisition, RRC connection, and measurement reporting; PDCP layer functionality associated with header compression/decompression and security (encryption, decryption, integrity protection, integrity verification); RLC layer functionality associated with delivery of upper layer PDUs, error correction through ARQ, concatenation, segmentation and reassembly of RLC SDUs, re-segmentation of RLC data PDUs, and reordering of RLC data PDUs; and MAC layer functionality associated with mapping between logical channels and transport channels, multiplexing of MAC SDUs onto transport blocks (TBs), demultiplexing of MAC SDUs from TBs, scheduling information reporting, error correction through hybrid automatic repeat request (HARQ), priority handling, and logical channel prioritization.

Channel estimates derived by the channel estimator from a reference signal or feedback sent by the base station 304 may be used by the transmitter 314 to select appropriate coding and modulation schemes and facilitate spatial processing. The spatial streams generated by the transmitter 314 may be provided to different antennas 316. The transmitter 314 may modulate an RF carrier with a corresponding spatial stream for transmission.

The uplink transmissions are processed at the base station 304 in a manner similar to that described in connection with the receiver functionality at the UE 302. The receiver 352 receives the signal through its respective antenna 356. The receiver 352 recovers the information modulated onto the RF carrier and provides the information to one or more processors 384.

In the uplink, the one or more processors 384 provide demultiplexing between transport and logical channels, packet reassembly, decryption, header decompression, control signal processing to recover IP packets from the UE 302. The IP packets from the one or more processors 384 may be provided to the core network. The one or more processors 384 are also responsible for error detection.

For convenience, UE 302, base station 304 and/or network entity 306 are shown in FIG. 3A, FIG. 3B and FIG. 3C as including various components that can be configured according to various examples described herein. However, it should be understood that the illustrated components may have different functionality in different designs. Specifically, various components in FIG. 3A to FIG. 3C are optional in alternative configurations, and various aspects include configurations that may vary due to design selection, cost, use of equipment or other considerations. For example, in the case of FIG. 3A, a specific implementation of UE 302 may omit WWAN transceiver 310 (e.g., a wearable device or tablet computer or PC or laptop computer may have Wi-Fi and/or Bluetooth capabilities without cellular capabilities), or may omit short-range wireless transceiver 320 (e.g., only cellular, etc.), or may omit satellite signal receiver 330, or may omit sensor 344, etc. In another example, in the case of FIG. 3B , a particular implementation of the base station 304 may omit the WWAN transceiver 350 (e.g., a Wi-Fi “hotspot” access point without cellular capabilities), or may omit the short-range wireless transceiver 360 (e.g., cellular only, etc.), or may omit the satellite signal receiver 370, etc. For the sake of brevity, illustrations of various alternative configurations are not provided herein, but will be readily apparent to those skilled in the art.

Various components of the UE 302, base station 304, and network entity 306 may be communicatively coupled to one another via data buses 334, 382, and 392, respectively. In an aspect, the data buses 334, 382, and 392 may form or be part of communication interfaces for the UE 302, base station 304, and network entity 306, respectively. For example, where different logical entities are embodied in the same device (e.g., gNB and location server functionality incorporated into the same base station 304), the data buses 334, 382, and 392 may provide for communication between the different logical entities.

The components of FIG. 3A, FIG. 3B, and FIG. 3C may be implemented in various ways. In some specific implementations, the components of FIG. 3A, FIG. 3B, and FIG. 3C may be implemented in one or more circuits (such as, for example, one or more processors and/or one or more ASICs (which may include one or more processors)). Here, each circuit may use and/or combine at least one memory component to store information or executable code used by the circuit to provide the functionality. For example, some or all of the functionality represented by blocks 310 to 346 may be implemented by the processor and memory component of UE 302 (e.g., by executing appropriate code and/or by appropriate configuration of the processor component). Similarly, some or all of the functionality represented by blocks 350 to 388 may be implemented by the processor and memory component of base station 304 (e.g., by executing appropriate code and/or by appropriate configuration of the processor component). Moreover, some or all of the functionality represented by blocks 390 to 398 may be implemented by the processor and memory component of network entity 306 (e.g., by executing appropriate code and/or by appropriate configuration of the processor component). For simplicity, various operations, actions and/or functions are described herein as being performed “by a UE,” “by a base station,” “by a network entity,” etc. However, it should be understood that such operations, actions and/or functions may actually be performed by a specific component or combination of components of the UE 302, base station 304, network entity 306, etc. (such as processors 332, 384, 394, transceivers 310, 320, 350, and 360, memories 340, 386, and 396, positioning components 342, 388, and 398, etc.).

In some designs, the network entity 306 may be implemented as a core network component. In other designs, the network entity 306 may be operated differently from a network operator or cellular network infrastructure (e.g., NG RAN 220 and/or 5GC 210/260). For example, the network entity 306 may be a component of a dedicated network that may be configured to communicate with the UE 302 via the base station 304 or independently of the base station 304 (e.g., via a non-cellular communication link such as WiFi).

NR supports a variety of cellular network-based positioning techniques, including downlink-based positioning methods, uplink-based positioning methods, and downlink and uplink-based positioning methods. Downlink-based positioning methods include: observed time difference of arrival (OTDOA) in LTE, downlink time difference of arrival (DL-TDOA) in NR, and downlink angle of departure (DL-AoD) in NR. Figure 4 illustrates examples of various positioning methods according to various aspects of the present disclosure. In the OTDOA or DL-TDOA positioning procedure illustrated in scenario 410, the UE measures the difference between the arrival time (ToA) of the reference signal (e.g., positioning reference signal (PRS)) received from the paired base stations (referred to as reference signal time difference (RSTD) or arrival time difference (TDOA) measurement), and reports these differences to the positioning entity. More specifically, the UE receives identifiers (IDs) of a reference base station (e.g., a serving base station) and multiple non-reference base stations in the auxiliary data. Then, the UE measures the RSTD between the reference base station and each of the non-reference base stations. Based on the known positions of the involved base stations and the RSTD measurements, a positioning entity (eg, a UE for UE-based positioning or a location server for UE-assisted positioning) may estimate the position of the UE.

For DL-AoD positioning illustrated in scenario 420, the positioning entity uses measurement reports from the UE regarding received signal strength measurements of multiple downlink transmit beams to determine the angle between the UE and the transmitting base station. The positioning entity can then estimate the position of the UE based on the determined angle and the known position of the transmitting base station.

Uplink-based positioning methods include uplink time difference of arrival (UL-TDOA) and uplink angle of arrival (UL-AoA). UL-TDOA is similar to DL-TDOA, but is based on uplink reference signals (e.g., sounding reference signals (SRS)) sent by the UE to multiple base stations. Specifically, the UE sends one or more uplink reference signals, which are measured by a reference base station and multiple non-reference base stations. Each base station then reports the reception time of the reference signal (referred to as relative time of arrival (RTOA)) to a positioning entity (e.g., a location server) that knows the location and relative timing of the base stations involved. Based on the receive-to-receive (Rx-Rx) time difference between the reported RTOA of the reference base station and the reported RTOA of each non-reference base station, the known location of the base stations, and their known timing offsets, the positioning entity can use TDOA to estimate the position of the UE.

For UL-AoA positioning, one or more base stations measure the received signal strength of one or more uplink reference signals (e.g., SRS) received from the UE on one or more uplink receive beams. The positioning entity uses the signal strength measurements and the angles of the receive beams to determine the angle between the UE and the base station. Based on the determined angle and the known location of the base station, the positioning entity can then estimate the location of the UE.

Downlink and uplink based positioning methods include: Enhanced Cell ID (E-CID) positioning and multiple round trip time (RTT) positioning (also referred to as "multi-cell RTT" and "multi-RTT"). In the RTT procedure, a first entity (e.g., a base station or UE) sends a first RTT-related signal (e.g., a PRS or SRS) to a second entity (e.g., a UE or a base station), and the second entity sends a second RTT-related signal (e.g., an SRS or PRS) back to the first entity. Each entity measures the time difference between the arrival time (ToA) of the received RTT-related signal and the transmission time of the transmitted RTT-related signal. The time difference is called the received-to-transmit (Rx-Tx) time difference. The Rx-Tx time difference measurement can be made or adjusted to include only the time difference between the nearest time slot boundaries of the received signal and the transmitted signal. The two entities may then transmit their Rx-Tx time difference measurements to a location server (e.g., LMF 270), which calculates the round trip propagation time (i.e., RTT) between the two entities based on the two Rx-Tx time difference measurements (e.g., calculated as the sum of the two Rx-Tx time difference measurements). Alternatively, one entity may transmit its Rx-Tx time difference measurements to the other entity, which then calculates the RTT. The distance between the two entities may be determined based on the RTT and a known signal speed (e.g., the speed of light). For multi-RTT positioning illustrated in scenario 430, a first entity (e.g., a UE or a base station) performs an RTT positioning procedure with multiple second entities (e.g., multiple base stations or UEs) to enable the location of the first entity to be determined based on the distance to the second entity and the known location of the second entity (e.g., using multi-point positioning). RTT and multi-RTT methods may be combined with other positioning techniques (such as UL-AoA and DL-AoD) to improve location accuracy, as illustrated in scenario 440.

The E-CID positioning method is based on radio resource management (RRM) measurements. In E-CID, the UE reports the serving cell ID, timing advance (TA), and the identifiers of detected neighboring base stations, estimated timing and signal strength. The UE's position is then estimated based on this information and the known locations of the base stations.

To assist the positioning operation, a location server (e.g., location server 230, LMF 270, SLP 272) may provide assistance data to the UE. For example, the assistance data may include: an identifier of the base station (or cell/TRP of the base station) from which the reference signal is measured, reference signal configuration parameters (e.g., the number of consecutive time slots including PRS, the periodicity of consecutive time slots including PRS, a silent sequence, a frequency hopping sequence, a reference signal identifier, a reference signal bandwidth, etc.), and/or other parameters applicable to a particular positioning method. Alternatively, the assistance data may originate directly from the base station itself (e.g., in a periodically broadcast overhead message, etc.). In some cases, the UE itself may be able to detect neighboring network nodes without using assistance data.

In the case of OTDOA or DL-TDOA positioning procedures, the assistance data may also include an expected RSTD value and an associated uncertainty or search window around the expected RSTD. In some cases, the value range of the expected RSTD may be +/-500 microseconds (μs). In some cases, when any of the resources used for positioning measurements are in FR1, the value range of the uncertainty of the expected RSTD may be +/-32μs. In other cases, when all resources used for positioning measurements are in FR2, the value range of the uncertainty of the expected RSTD may be +/-8μs.

The position estimate may be referred to by other names such as position estimate, position, fix, position fix, fix, etc. The position estimate may be geodetic and include coordinates (e.g., latitude, longitude, and possibly altitude), or may be municipal and include a street address, postal address, or some other verbal description of the location. The position estimate may be further qualified relative to some other known position or qualified in absolute terms (e.g., using latitude, longitude, and possibly altitude). The position estimate may include an expected error or uncertainty (e.g., by including an area or volume within which the location is expected to be included with some specified or default confidence level).

In LTE, and at least in some cases (NR), positioning measurements are reported via higher layer signaling, specifically LTE Positioning Protocol (LPP) signaling and/or RRC. LPP is used point-to-point between a location server (e.g., location server 230, LMF 270, SLP 272) and a UE (e.g., any of the UEs described herein) to position the UE using location-related measurements obtained from one or more reference sources. FIG. 5 is a diagram 500 illustrating an example LPP reference source for positioning. In the example of FIG. 5 , a target device, specifically a UE 504 (e.g., any of the UEs described herein) participates in an LPP session with a location server 530 (labeled “LMF” in the specific example of FIG. 5 ). UE 504 is also receiving/measuring wireless positioning signals from a first reference source, specifically one or more base stations 502 (which may correspond to any of the base stations described herein and, in the specific example of FIG. 5 , are labeled “gNode B”), and a second reference source, specifically one or more SPS satellites 520 (which may correspond to SV 112 in FIG. 1 ).

An LPP session is used between the location server 530 and the UE 504 to obtain location-related measurements or a location estimate, or to transfer assistance data. A single LPP session is used to support a single location request (e.g., for a single mobile-terminated location request (MT-LR), a mobile-originated location request (MO-LR), or a network-induced location request (NI-LR)). Multiple LPP sessions may be used between the same endpoints to support multiple different location requests. Each LPP session includes one or more LPP transactions, where each LPP transaction performs a single operation (e.g., capability exchange, assistance data transfer, or location information transfer). LPP transactions are referred to as LPP procedures. The initiator of an LPP session initiates the first LPP transaction, but subsequent transactions may be initiated by either endpoint. LPP transactions within a session may occur serially or in parallel. LPP transactions are indicated at the LPP protocol level with a transaction identifier to associate messages (e.g., requests and responses) with each other. Messages within a transaction are linked by a common transaction identifier.

The LPP positioning method and associated signaling content are defined in the 3GPP LPP standard (3GPP Technical Specification (TS) 36.355, which is publicly available and incorporated herein by reference in its entirety). LPP signaling can be used to request and report measurements related to the following positioning methods: OTDOA, DL-TDOA, Assisted Global Navigation Satellite System (A-GNSS), LTE E-CID, NR E-CID, Sensors, Terrestrial Beacon System (TBS), WLAN, Bluetooth, DL-AoD, UL-AoA, and Multi-RTT. Currently, an LPP measurement report may include the following measurements: (1) one or more ToA, TDOA, reference signal time difference (RSTD), or Rx-Tx time difference measurements, (2) one or more AoA and/or AoD measurements (currently only used for base stations to report UL-AoA and DL-AoD to location server 530), (3) one or more multipath measurements (per-path ToA, RSRP, AoA/AoD), (4) one or more motion states (e.g., walking, driving, etc.) and trajectories (currently only used for UE 504), and (5) one or more report quality indicators. In the present disclosure, positioning measurements (such as the example measurements just listed, and regardless of the positioning technology) may be collectively referred to as positioning state information (PSI)).

UE 504 and/or location server 530 may derive location information from one or more reference sources (illustrated as SPS satellites 520 and base stations 502 in the example of FIG. 5 ). Each reference source may be used to calculate an independent estimate of the location of UE 504 using an associated positioning technique. In the example of FIG. 5 , UE 504 is measuring characteristics (e.g., ToA, RSRP, RSTD, etc.) of positioning signals received from base station 502 to calculate or assist location server 530 in calculating an estimate of the location of UE 504 using one or more RAT-dependent (also referred to as “RAN-based”) positioning methods (e.g., multi-RTT, OTDOA, DL-TDOA, DL-AoD, E-CID, etc., as described above with respect to FIG. 4 ). Similarly, UE 504 is measuring characteristics (e.g., ToA) of GNSS signals received from SPS satellites 520 to triangulate its location in two or three dimensions based on the number of SPS satellites 520 measured. In some cases, UE 504 or location server 530 may combine location solutions derived from each of the different positioning techniques to improve the accuracy of the final location estimate.

As noted above, the UE 504 uses LPP to report location-related measurements obtained from different reference sources (e.g., base stations 502, Bluetooth beacons, SPS satellites 520, WLAN access points, motion sensors, etc.). As an example, for GNSS-based positioning, the UE 504 uses the LPP information element (IE) "A-GNSS-ProvideLocationInformation" to provide location measurements (e.g., pseudoranges, position estimates, velocity, etc.) together with time information to the location server 530. It can also be used to provide GNSS positioning specific error reasons. The "A-GNSS-ProvideLocationInformation" IE includes IEs such as "GNSS-SignalMeasurementInformation", "GNSS-LocationInformation", "GNSS-MeasurementList", and "GNSS-Error". When the UE 504 provides the location server 530 with a location derived using GNSS or hybrid GNSS and other measurements and (optionally) velocity information, the UE includes the "GNSS-LocationInformation" IE. The UE 504 provides GNSS signal measurement information to the location server 530 using the "GNSS-SignalMeasurementInformation" IE, and provides the GNSS network time association if requested by the location server 530. This information includes measurements of code phase, Doppler, C/No, and (optionally) accumulated carrier phase (also known as accumulated delta range (ADR)), which implements the UE-assisted GNSS method, in which the position is calculated in the location server 530. The UE 504 provides measurements of code phase, Doppler, C/No, and (optionally) accumulated carrier phase (or ADR) using the "GNSS-MeasurementList" IE.

As another example, for motion sensor based positioning, currently supported positioning methods use a barometric pressure sensor and a motion sensor, as described in 3GPP TS 36.305 (which is publicly available and incorporated herein by reference in its entirety). The UE 504 provides location information for sensor based methods to the location server 530 using the LPP IE "Sensor-ProvideLocationInformation". It can also be used to provide sensor specific error reasons. The UE 504 provides sensor measurements (e.g., barometric pressure readings) to the location server 530 using the "Sensor-MeasurementInformation" IE. The UE 504 provides motion information to the location server 530 using "Sensor-MotionInformation". The motion information may include an ordered series of points. This information may be obtained by the UE 504 using one or more motion sensors (e.g., accelerometers, barometers, magnetometers, etc.).

As yet another example, for Bluetooth-based positioning, the UE 504 uses the "BT-ProvideLocationInformation" IE to provide measurements of one or more Bluetooth beacons to the location server 530. This IE can also be used to provide Bluetooth positioning specific error reasons.

The network operator may be forced to cross-check the UE location reported by the UE in order to meet regulatory requirements regarding network-verified UE location (e.g., lawful interception, emergency calls, public warning systems, etc.). That is, the network operator should be able to check the UE's reported location information by, for example, estimating the UE's location on the network side, and specify whether a mechanism is needed to meet regulatory requirements. Currently, in order to determine the network-verified UE location, an NTN-capable UE may report its Global Navigation Satellite System (GNSS) location (because an NTN-capable UE needs to have GNSS), and the network (e.g., a location server) may verify or refine the UE's GNSS report through NTN positioning technology.

In more detail, the 5G NR system is being enhanced to support the service requirements of 5GC with satellite access. Currently, when the UE is using NR satellite access, in order to ensure that regulatory requirements are met, the network will verify whether the public land mobile network (PLMN) selected by the UE is allowed to operate in the country of the UE location based on the UE location information. Additionally, the broadcast tracking area identifier (TAI) and the TAI where the UE is geographically located (if known) should be provided to the AMF by the NG-RAN as part of the user location information (ULI). Using UE-generated location information (e.g., GNSS) to determine the TAI where the UE is geographically located may be accurate, but may be unreliable.

When a UE accesses 5G via satellite access, some services with regulatory requirements (such as emergency call services and lawful interception) require a trusted/reliable method to determine the UE location with sufficient accuracy. Any method that relies solely on location information generated by the UE may be unreliable unless the information provided by the UE can be verified by the network. However, there are still various problems that need to be solved. For example, it has not yet been determined what kind of location information can represent the UE location that will meet the accuracy required in NR satellite access. As another example, in a RAN collaboration scenario, for the reliability of location verification performed by the network for regulatory services, it has not yet been determined how the 5GC LCS can ensure that the network verification of the UE location is performed using a reliable method (which does not rely solely on the location information generated by the UE), and that the result of such network verification of the UE location meets the aforementioned requirements. As another example, also for the RAN collaboration scenario, it has not yet been determined whether the existing core network verification mechanism needs to be enhanced and adjusted. As yet another example, it has not yet been determined how to further enhance the LCS to verify location service related requirements.

FIG. 6 illustrates a procedure 600 for general network positioning of an LCS client outside a PLMN that regulates location services for a non-roaming scenario according to aspects of the present disclosure. In this scenario, it is assumed that a Subscription Permanent Identifier (SUPI), a General Public Subscription Identifier (GPSI), a Permanent Equipment Identifier (PEI), etc. is used to identify the target UE 204. The procedure 600 is applicable to a request for the current location of the target UE 204 from an LCS client (external location service client 630), and it is assumed that the LCS client is authorized to use location services and does not require privacy verification. The procedure 600 is defined in 3GPP TS 23.273, which is publicly available and incorporated herein by reference in its entirety.

At stage 1, the external location service client 630 transmits a request for the location of the target UE 204 identified by the GPSI or SUSI to the Gateway Mobile Location Center (GMLC) 610. The request may include the required QoS and the supported Geographic Area Description (GAD) shape. If the location of more than one UE is required, the steps that follow below may be repeated, and in this case, the GMLC 610 may verify whether the number of target UEs 204 in the LCS service request is equal to or less than the maximum number of target UEs for the LCS client. If the maximum number of target UEs is exceeded, the GMLC 610 rejects the LCS request, stages 2 to 10 are skipped, and then in stage 11 the GMLC 610 responds to the client with an appropriate error reason.

At stage 2, the GMLC 610 invokes a “Nudm_UECM_Get” service operation to the home unified data management (UDM) 620 of the target UE 204 to locate using the GPSI or SUPI of the UE 204.

At stage 3, the UDM 620 returns the network address of the current serving AMF 264. Note that for backward compatibility, the GMLC 610 may use the "Nudm_SDM_Get" service operation to retrieve the SUPI of the target UE 204 from an earlier generation of the UDM 620.

At stage 4, the GMLC 610 calls the "Namf_Location_ProvidePositioningInfo" service operation to the AMF 264 to request the current location of the UE 204. The service operation includes the SUPI, and the client type, and may include the required QoS and supported GAD shapes.

At stage 5, if the UE 204 is in the CM IDLE state, the AMF 264 initiates a network-triggered service request procedure to establish a signaling connection with the UE 204.

At stage 6, AMF 264 selects LMF 270 based on available information or based on AMF 264 local configuration. LMF 270 selects to take into account the 5G access network currently serving UE 204. This selection may be queried using a network repository function (NRF). Note that LMF 270 is a network entity in 5GC that supports at least the following functions: (1) supporting location determination for UE 204, (2) obtaining downlink location measurements or location estimates from UE 204, (3) obtaining uplink location measurements from NG-RAN 220, (4) obtaining non-UE associated assistance data from NG-RAN 220, and (5) providing broadcast assistance data to the UE and forwarding associated encryption keys to AMF 264.

At stage 7, the AMF 264 invokes the "Nlmf_Location_DetermineLocation" service operation to the LMF 270 to request the current location of the UE 204. The service operation includes the LCS related identifier, the serving cell identity of the primary cell in the primary RAN node and the primary cell in the secondary RAN node (when available based on the dual connectivity scenario), and the client type, and may include an indication of whether the UE 204 supports LPP, the required QoS, the UE positioning capability (if available), and the supported GAD shapes. In some cases, the service operation includes the AMF identity.

At stage 8, the LMF 270 performs one or more LPP-based positioning procedures with the UE 204, such as described above with reference to FIG4. During this stage, the LMF 270 may use the "Namf_Communication_N1N2MessageTransfer" service operation to request the delivery of positioning-related N1 messages to the UE 204 or the delivery of network positioning messages to the serving NG-RAN node (gNB or NG-eNB) of the UE 204. The LMF 270 determines the geographic location and optionally determines the location in local coordinates.

At stage 9, LMF 270 returns a "Nlmf_location_DetermineLocation" response to AMF 264 to return the current location of UE 204 and UE positioning capabilities (if UE positioning capabilities were received in stage 8), including an indication that these capabilities are immutable and were not received from AMF 264 in stage 7. The service operation includes an LCS-related identifier, the location estimate, its age and accuracy, and may include information about the positioning method and a timestamp for the location estimate.

At stage 10, the AMF 264 returns a "Namf_Location_ProvidePositioningInfo" response to the GMLC 610 to return the current location of the UE 204. The service operation includes the location estimate, its age and accuracy, and may include information about the positioning method and a timestamp of the location estimate. When received from the LMF 270, the AMF 264 stores the UE positioning capabilities in the UE context.

At stage 11 , the GMLC 610 transmits a location service response to the external location service client 630 .

One of the services provided by the LMF 270 to other network functions (NFs) is the "Nlmf_Location" service. The "Nlmf_Location" service enables the NF to request a location determination (current geodetic and optionally local and/or civic location) of a target UE, such as at stage 7 of Figure 6, or to request a periodic or triggered location of a target UE. The service operations defined for the "Nlmf_Location" service are as follows: (1) "DetermineLocation", which provides UE location information to the consumer NF; (2) "EventNotify", which notifies the consumer NF of an event for a periodic or triggered location of a target UE; (3) "CancelLocation", which enables the consumer NF to cancel an ongoing periodic or triggered location of a target UE; and (4) "LocationContextTransfer", which enables the consumer NF to transfer location context information for a periodic or triggered location of a target UE to a new LMF.

"DetermineLocation" includes input data such as Correlation ID, AMF ID, Location QoS, and Usage (which indicates the use of location measurements). There is a satellite specific input for "ueCountryDetInd". When this Boolean input parameter is present, it contains an indication of the country or international region indication in which the UE is located. The enumeration of the Usage input parameter indicates the type of use of location measurements from the UE. It can indicate the result is: (1) unsuccessful, (2) successful but not used, (3) successful and used to verify the location estimate, (4) successful and used to generate the location estimate, (5) or undetermined success method.

FIG. 7 is a diagram 700 illustrating UE-provided location verification based on obtained information according to aspects of the present disclosure.

At stage 1, UE 204 transmits UE location information (eg, GNSS information) to NG-RAN 220 over the NR-Uu interface via satellite access.

At stage 2, if the NG-RAN 220 can verify the UE location, it verifies the reported UE location. Whether and how the NG-RAN 220 can verify the UE location depends on the conclusion of the network verified UE location target.

At stage 3, if stage 2 is performed, the NG-RAN 220 transmits an N2 message including assistance information to the AMF 264.

At stage 4, if the assistance information provided by the NG-RAN 220 indicates that the UE location is unreliable, and the country of the UE reported location is the same as the country of the UE location verified by the network, and there are one or more NF 710 subscribed to UE location event reporting, the AMF 264 triggers the 5GC Network Initiated Location Request (NI-LR) procedure to obtain the UE location.

At stage 5, if stage 4 is performed, AMF 264 notifies NF 710 of the UE location.

At stage 6, the AMF 264 deregisters the UE 204 if the assistance information provided by the NG-RAN 220 indicates that the UE location is unreliable and the country of the UE reported location is different from the country of the UE location verified by the network.

The impact on services, entities and interfaces caused by the procedure illustrated in Figure 7 include the following. For AMF 264, AMF 264 receives assistance information from NG-RAN 220 and acts accordingly. For NG-RAN 220, NG-RAN 220 verifies the UE location reported by UE 204 and provides assistance information to AMF 264. It should be noted that whether NG-RAN 220 can provide assistance information and what assistance information can be provided depends on the conclusion of the UE location target verified by the network.

The present disclosure provides techniques for network verification of UE location. Different options for signal flow of location verification service are proposed. Based on which network node performs the verification, there may be three alternatives: (1) AMF verifies UE location, (2) LMF verifies UE location, or (3) RAN node verifies UE location.

8 illustrates an example procedure 800 for AMF-verified UE location according to aspects of the present disclosure. When the AMF 264 receives a request for the location of the UE 204, such as at stage 4 of FIG. 6, the procedure 800 illustrated in FIG. 8 may be performed.

At stage 1, the AMF 264 calls the "Nlmf_Location_DetermineLocation" service operation to the LMF 270 to request the current location of the UE 204, as at stage 7 of Figure 6.

At stage 2, LMF 270 obtains the location of UE 204 via LPP signaling. The location may be obtained using a RAT-dependent (RAN-based) positioning method, such as one of the positioning methods described above with reference to FIG. 4 , or a RAT-independent positioning method, such as a GNSS-based positioning method.

At stage 3, LMF 270 returns a "Nlmf_Location_DetermineLocation" response to AMF 264 (as at stage 9 of FIG. 6) to return the current location of UE 204. In addition, an additional flag may be included in the response to indicate that the UE location is "unverified", or alternatively, if the response indicates a particular positioning method (e.g., GNSS or any other RAT-independent method), AMF 264 may treat the location as "unverified".

At stage 4, the AMF 264 transmits a request to verify the UE location to the NG-RAN 220 serving the UE, represented as, for example, “NGAP_VerifyUELocationRequest.” Note that the Next Generation Application Protocol (NGAP) is a protocol used between the AMF 264 and the NG-RAN 220.

At stage 5, the NG-RAN 220 (e.g., a satellite in the NG-RAN 220) performs a RAT-dependent positioning procedure with the UE 204. The RAT-dependent positioning procedure may employ a positioning method using a single NG-RAN node, such as RTT, RSRP, AoA, AoD, etc.

At stage 6, the NG-RAN 220 responds to the AMF 264 with the verified location of the UE 204. The response may be denoted, for example, as "NGAP_VerifyUELocationResponse". The response may include assistance information, such as the type of positioning method and/or related measurements (e.g., UE Rx-Tx time difference, gNB Rx-Tx time difference, RSRP, AoA AoD, etc.).

At stage 7, AMF 264 may request LMF 270 to perform location verification by calling another "Nlmf_Location_DetermineLocation" service operation (as at stage 7 of Figure 6) to LMF 270. The request may indicate that the request is for UE location verification.

At stage 8, LMF 270 initiates an LPP session with UE 204 for a RAT-dependent positioning procedure, as at stage 8 of Figure 6. This positioning procedure may involve multiple NG-RAN nodes (if available) and thus may be different from the LPP positioning procedure performed at stage 5 (e.g., multi-RTT, DL-TDOA, UL-TDOA, etc.).

At stage 9, the LMF 270 responds to the AMF 264 with the UE location, as at stage 9 of FIG. 6 . The response may include a flag indicating that the location is “trusted” or “verified.” Alternatively, the AMF 264 may assume that the location information is trusted/verified based on the positioning method (e.g., a RAT-dependent method). The response may include assistance information, such as the type of positioning method and/or related measurements (e.g., UE Rx-Tx time difference, gNB Rx-Tx time difference, RSTD, RSRP, etc.).

At stage 10, based on the response from NG-RAN 220 (stage 6) and the response from LMF 270 (stage 9), AMF 264 determines whether the UE location is verified. If so, AMF 264 responds to the requesting entity with the location of UE 204, as at stage 10 of Figure 6.

FIG. 9 illustrates an example procedure 900 for LMF verified UE location in accordance with aspects of the present disclosure.

At stage 1, LMF 270 receives a request for verified UE location from AMF 264. The request may include the UE location to be verified or a flag indicating that LMF 270 should return a verified UE location. The request may be represented, for example, as "Nlmf_Location_VerifyLocationRequest" or the like.

At stage 2, LMF 270 initiates an LPP session with UE 204 to obtain the location of UE 204. In response, UE 204 provides its location, which may be based on a positioning method that does not rely on RAT and is therefore not considered verified. In some cases, even if the location is based on a positioning method that relies on RAT, the location may be considered unverified.

At stage 3, LMF 270 initiates a subsequent LPP session with UE 204 to obtain a verified location of UE 204. The positioning procedure should use a RAT-dependent positioning procedure and may involve one or more NG-RAN nodes (terrestrial and/or satellite-based). The positioning procedure may be UE-assisted (i.e., UE 204 provides positioning measurements and LMF 270 determines the location of UE 204 based on the measurements and other information (such as the locations of the measured base stations)) or UE-based (i.e., the UE provides its determined location based on assistance data received from LMF 270 and/or the base stations involved).

At stage 4, if the request at stage 1 included the UE location, LMF 270 responds to AMF 264 indicating whether the UE location has been verified. If the request at stage 1 is for a verified location, LMF 270 provides the verified UE location. The response may be represented, for example, as "Nlmf_Location_VerifyLocationResponse" or the like.

10 illustrates further details of an example procedure 1000 for LMF verified UE location according to aspects of the present disclosure. In some cases, any network function (NF) node 1010 may request the verified location of UE 204 from LMF 270. In the case where NF node 1010 is AMF 264, procedure 1000 may correspond to stages 1 and 4 of FIG. 9 .

To support such a procedure, a new LCS service may be added, denoted, for example, "Verify-Location". The Verify-Location request may include (but is not limited to) the following fields: (1) UE ID (e.g., SUPI, PEI, GPSI), (2) an indication of the region where the UE is expected to be located (e.g., country ID or state ID), (3) one or more accuracy parameters (e.g., up to five kilometers of horizontal distance accuracy, ignoring altitude estimation errors, etc.), and/or (4) a timer within which the LMF 270 should provide a response (failure will result in a timeout). If the request is simply to verify the obtained UE location, the request may also include the UE location to be verified.

A response to a Verify-Location request may be represented, for example, as "Verify-Location-Response". The following fields may be present in the response message: (1) LocationVerified (with a Boolean value of "0" or "1"), (2) QoS, (3) Error reason, (4) Which positioning method was used to verify the UE location (e.g., GNSS plus DL-TDOA), (5) Time taken to verify the location, and/or (6) Confidence value/probability indication. Error reasons that may be indicated in the response may include (1) rejected positioning, (2) UE not supported, (3) positioning failed and/or (4) request timed out. If the request is for the actual UE location, the response may also include the verified UE location.

FIG. 11 illustrates an example procedure 1100 for RAN verified UE location in accordance with aspects of the present disclosure. In one aspect, prior to triggering the procedure 1100, the NG-RAN node may indicate to other core network nodes (e.g., AMF 264, LMF 270, etc.) the capability to verify the location of the UE 204. For example, where the NG-RAN node is a satellite, it may have a steerable backup beam that may be used for AoA estimation that may satisfy the target verification requirement. Without a steerable backup beam, the satellite NG-RAN node may not be able to locate the UE with sufficient accuracy to verify the UE location.

More specifically, when the NG-RAN node is a satellite or other spacecraft, there may be some ambiguity about the country or state in which the UE is located. FIG. 12 is a diagram 1200 illustrating an example of a spacecraft 112 generating multiple transmit beams (labeled "B1", "B2", "B3", "B4", "B5", and "B6") over multiple geographic regions (labeled "Region A", "Region B", and "Region C"), which may be countries, states, or other types of regions. As shown in FIG. 12, a satellite or aerospace vehicle such as a spacecraft 112 typically generates several beams (e.g., B1 to B6) over a given geographic region (e.g., Regions A, B, and C), and the coverage areas of these beams are typically elliptical in shape. The beam coverage area may move on the earth as the satellite or aerospace vehicle moves in its orbit. Alternatively, the beam coverage area may be earth-fixed. In this case, a beam pointing mechanism (mechanical or electronic steering) may be used to compensate for the motion of the satellite or aerospace vehicle.

If the spacecraft 112 in FIG12 has a steerable spare beam, it can use the beam to estimate the AoA and/or AoD associated with the UE with sufficient accuracy to at least determine which region (e.g., regions A, B, and C) the UE is located in. For example, a UE served by beam B4 has an almost equal chance of being in region A or region B. However, if the spacecraft 112 has a steerable spare beam, it can steer the beam to region A or region B to determine which region the UE is located in.

Referring back to Figure 11, procedure 1100 is a modification of stages 4 to 6 of procedure 800 of Figure 8, where the location verification decision is performed by the NG-RAN node. At stage 1, the NG-RAN node (e.g., terrestrial or satellite-based gNB or ng-eNB) receives a location verification request from the LMF 270 (stage 1a) or AMF 264 (stage 1b). In this case, the request from the core network node should include the UE location.

At stage 2, the NG-RAN node engages in a positioning procedure with the UE 204 to obtain the location of the UE. This stage includes two steps. The first step is to obtain the unverified UE location at the NG-RAN node. This can be done by either: (1) the ULI in the verification request from the core network node or (2) the ULI from the UE 204 through RRC signaling. The second step is to verify the location, for which the NG-RAN node engages in a positioning procedure with the UE 204 to obtain the location of the UE 204. The positioning procedure can be a RAT-dependent positioning procedure (such as RTT, RSRP, AoA, AoD, etc.) involving only one NG-RAN node. Therefore, the NG-RAN node collects measurements from the UE 204 (e.g., DL-TDOA, UE Rx-Tx time difference, DL-RSRP, etc.) and performs some uplink measurements of reference signals (e.g., SRS) sent by the UE 204 (e.g., gNB Rx-Tx time difference, AoA, UL-TDOA, etc.). The positioning procedure may be UE-assisted. However, UE-based positioning may still be used (when the operation is performed internally to the cellular modem) because it is difficult to tamper with the operation (because the modem must meet a set of accuracy requirements). This is different from the case where the UE 204 simply reports its position obtained from a source external to the modem (e.g., GNSS).

At stage 3, if the request at stage 1 included the UE location, the NG-RAN node responds to the LMF 270 (stage 3a) or AMF 264 (stage 3b) with an indication of whether the UE location has been verified. If the request at stage 1 was for a verified location, the NG-RAN node provides the verified UE location.

Regarding the validity of the verification, the AMF 264 may maintain a list of UEs 204 and whether the locations of these UEs have been verified, as long as the UE 204 is within the context of the AMF 264. Once the location of the UE 204 is verified, the validity timer is triggered. The AMF 264 may trigger a subsequent verification process in the following situations: (1) the validity timer expires. (2) the UE 204 performs a tracking area update or a registration area update, (3) the UE 204 reports a new location and the location of the UE 204 has changed significantly (e.g., the change is greater than a certain threshold, such as the UE 204 has changed its country).

In one aspect, if the location of UE 204 has not changed significantly (e.g., the change is less than a threshold) between multiple transitions between RRC IDLE or RRC INACTIVE and RRC CONNECTED states, the network may use old measurement data together with new measurement data for a faster verification procedure. That is, old measurement data such as taken in a previous connection or while in RRC IDLE or RRC INACTIVE state is still considered valid.

13 illustrates an example method 1300 of location verification according to aspects of the present disclosure. In an aspect, the method 1300 may be performed by a RAN node (eg, any of the NG-RAN nodes described herein).

At 1310, the RAN node receives a request to verify the location of the UE from the core network node, as at stage 4 of Figure 8 or at stage 1 of Figure 11. In an aspect, operation 1310 may be performed by one or more WWAN transceivers 350, satellite signal receivers 370, one or more network transceivers 380, one or more processors 384, memory 386, and/or positioning component 388, any or all of which may be considered means for performing the operation.

At 1320, the RAN node performs a RAN-based positioning procedure with the UE to determine a verified location of the UE, as at stage 5 of FIG. 8 or stage 2 of FIG. 11. In an aspect, operation 1320 may be performed by one or more WWAN transceivers 350, satellite signal receivers 370, one or more network transceivers 380, one or more processors 384, memory 386, and/or positioning component 388, any or all of which may be considered means for performing the operation.

At 1330, the RAN node sends a response to the core network node, such as at stage 6 of FIG. 8 or at stage 3 of FIG. 11, the response comprising: measurements obtained by the UE during a RAN-based positioning procedure, measurements obtained by a RAN node during a RAN-based positioning procedure, a verified location of the UE, an indication that the location of the UE is verified, or any combination thereof. In an aspect, operation 1330 may be performed by one or more WWAN transceivers 350, satellite signal receivers 370, one or more network transceivers 380, one or more processors 384, memory 386, and/or positioning component 388, any or all of which may be considered means for performing the operation.

14 illustrates an example method 1400 of location verification according to aspects of the present disclosure. In one aspect, the method 1400 may be performed by a core network node (eg, AMF).

At 1410, the core network node sends a request to the RAN node to verify the location of the UE, as at stage 4 of Figure 8 or at stage 1 of Figure 11. In an aspect, operation 1410 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and/or positioning component 398, any or all of which may be considered means for performing the operation.

At 1420, the core network node receives a response from the RAN node, such as at stage 6 of FIG. 8 or at stage 3 of FIG. 11, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof. In an aspect, operation 1420 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and/or positioning component 398, any or all of which may be considered means for performing the operation.

15 illustrates an example method 1500 of location verification in accordance with aspects of the present disclosure. In one aspect, the method 1500 may be performed by a location server (eg, LMF).

At 1510, the location server receives a request to verify the location of the UE from the core network node, as at stage 7 of Figure 8 or at stage 1 of Figure 9. In an aspect, operation 1510 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and/or positioning component 398, any or all of which may be considered means for performing the operation.

At 1520, the location server performs a location server-based positioning procedure with the UE to determine a verified location of the UE, as at stage 8 of Figure 8 or at stage 3 of Figure 9. In an aspect, operation 1520 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and/or positioning component 398, any or all of which may be considered means for performing the operation.

At 1530, the location server sends a response to the core network node, such as at stage 9 of FIG. 8 or at stage 4 of FIG. 9, the response including the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof. In an aspect, operation 1530 may be performed by one or more network transceivers 390, one or more processors 394, memory 396, and/or positioning component 398, any or all of which may be considered means for performing the operation.

It should be appreciated that a technical advantage of methods 1300 to 1500 is to enable network verification of the location of the UE.

In the above specific embodiments, it can be seen that different features are grouped together in each example. This disclosure should not be understood as an intention that the example clauses have more features than the features explicitly mentioned in each clause. On the contrary, various aspects of the present disclosure may include less than all the features of the disclosed individual example clauses. Therefore, the following clauses should be considered to be incorporated into the description accordingly, where each clause itself can be used as a separate example. Although each subordinate clause can refer to a specific combination of one clause with other clauses in a clause, the aspects of the subordinate clause are not limited to specific combinations. It should be understood that other example clauses may also include a combination of the subject matter of the subordinate clause aspect with any other subordinate clause or independent clause or any feature with other subordinate clauses and independent clauses. Various aspects disclosed herein explicitly include these combinations, unless it is clearly expressed or can be easily inferred that a specific combination is not intended to be used (for example, contradictory aspects, such as defining an element as both an electrical insulator and an electrical conductor). In addition, it is also expected that various aspects of the clause can be included in any other independent clause, even if the clause is not directly subordinate to the independent clause.

Specific implementation examples are described in the following numbered clauses:

Clause 1. A method of location verification performed by a radio access network (RAN) node, the method comprising: receiving a request to verify the location of a user equipment (UE) from a core network node; performing a RAN-based positioning procedure with the UE to determine the verified location of the UE; and sending a response to the core network node, the response comprising: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Clause 2. The method of clause 1, wherein the response further includes a type of the RAN-based positioning procedure.

Clause 3. A method according to any one of clauses 1 to 2, wherein: the response includes an indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the verified location of the UE.

Clause 4. A method according to any one of clauses 1 to 3, the method further comprising: sending a capability message to the core network node, the capability message indicating that the RAN node is able to verify the location of the UE.

Clause 5. The method of clause 4, wherein the RAN node has a steerable spare beam.

Clause 6. A method as described in any of clauses 1 to 5, wherein the RAN node is or is located on a space vehicle.

Clause 7. A method according to any one of clauses 1 to 6, wherein the core network node is: an access and mobility management function (AMF), or a location management function (LMF).

Clause 8. A method of location verification performed by a core network node, the method comprising: sending a request to a radio access network (RAN) node to verify the location of a user equipment (UE); and receiving a response from the RAN node, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof.

Clause 9. The method according to Clause 8 further includes: receiving a request to verify the location of the UE from a second core network node; and sending a response to the second core network node, the response to the second core network node comprising: the measurements obtained by the UE during the RAN-based positioning procedure, the measurements obtained by the RAN node during the RAN-based positioning procedure, the location of the UE verified by the RAN node, the indication that the location of the UE is verified, or any combination thereof.

Clause 10. The method of clause 9, wherein the second core network node is a location management function (LMF).

Clause 11. The method according to any one of clauses 8 to 10, further comprising: sending a request to a location server to verify the location of the UE; and receiving a response from the location server, the response from the location server including the location of the UE verified by the location server, an indication that the location of the UE is verified, or any combination thereof.

Clause 12. The method of clause 11, further comprising determining whether the location of the UE is verified based on the response from the RAN node, the response from the location server, or both.

Clause 13. A method according to any one of clauses 11 to 12, wherein: the response from the location server includes the location of the UE verified by the location server, the response from the location server also includes the type of location server-based positioning procedure performed between the location server and the UE to determine the location of the UE verified by the location server, and the location of the UE verified by the location server is determined to be verified based on the type of the location server-based positioning procedure.

Clause 14. A method according to any one of clauses 11 to 13, wherein: the response from the location server includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the location of the UE verified by the location server.

Clause 15. A method as described in any of clauses 8 to 14, wherein the response from the RAN node also includes a type of the RAN based positioning procedure.

Clause 16. A method according to any of clauses 8 to 15, wherein: the response from the RAN node includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the location of the UE verified by the RAN node.

Clause 17. A method as described in any of clauses 8 to 16, the method further comprising: receiving a capability message from the RAN node, the capability message indicating that the RAN node is able to verify the location of the UE.

Clause 18. A method according to any of clauses 8 to 17, the method further comprising: triggering a validity timer for the location verified by the RAN node of the UE; and triggering a subsequent UE location verification procedure based on one or more triggering events.

Clause 19. A method according to clause 18, wherein the one or more triggering events include: expiration of the validity timer, UE tracking area update, UE registration area update, change of UE location above a threshold, change of country of UE location, or any combination thereof.

Clause 20. A method as described in any of clauses 18 to 19, wherein the subsequent UE location verification procedure is not triggered based on the location change of the UE during a radio resource control (RRC) state transition being less than a threshold.

Clause 21. A method as described in any of clauses 8 to 20, wherein the core network node is an Access and Mobility Management Function (AMF).

Clause 22. A method of location verification performed by a location server, the method comprising: receiving a request to verify the location of a user equipment (UE) from a core network node; performing a location server-based positioning procedure with the UE to determine the verified location of the UE; and sending a response to the core network node, the response including the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Clause 23. The method of clause 22, wherein: the response includes the verified location of the UE, and the response also includes a type of the location server-based positioning procedure.

Clause 24. A method according to any one of clauses 22 to 23, wherein: the response includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the verified location of the UE.

Clause 25. A method according to any of clauses 22 to 24, wherein the request comprises: an identifier of the UE, an indication of an area in which the UE is expected to be located, one or more accuracy parameters, a timer within which the location server is expected to provide the response, or any combination thereof.

Clause 26. A method according to any one of clauses 22 to 25, wherein the response comprises: the response comprises the indication that the location of the UE is verified, the type of positioning procedure based on the location server, the quality of service (QoS), the cause of the error, the amount of time taken to determine the verified location of the UE, a confidence value indicating the confidence of the verified location of the UE, or any combination thereof.

Clause 27. The method of clause 26, wherein the error cause comprises a value indicating: positioning rejected, UE not supported, positioning failed, or request timed out.

Clause 28. A radio access network (RAN) node, the radio access network (RAN) node comprising: a memory; at least one transceiver; and at least one processor, the at least one processor being communicatively coupled to the memory and the at least one transceiver and configured to: receive a request to verify the location of a user equipment (UE) from a core network node via the at least one transceiver; perform a RAN-based positioning procedure with the UE to determine the verified location of the UE; and send a response to the core network node via the at least one transceiver, the response comprising: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Clause 29. A RAN node as described in clause 28, wherein the response further comprises a type of the RAN based positioning procedure.

Clause 30. A RAN node according to any of clauses 28 to 29, wherein: the response includes the indication that the position of the UE is verified, the indication that the position of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the verified position of the UE.

Clause 31. A RAN node according to any of clauses 28 to 30, wherein the at least one processor is further configured to: send a capability message to the core network node via the at least one transceiver, the capability message indicating that the RAN node is able to verify the location of the UE.

Clause 32. A RAN node as described in clause 31, wherein the RAN node has a steerable spare beam.

Clause 33. A RAN node as described in any of clauses 28 to 32, wherein the RAN node is a space vehicle or is located on a space vehicle.

Clause 34. A RAN node as described in any of clauses 28 to 33, wherein the core network node is: an access and mobility management function (AMF), or a location management function (LMF).

Clause 35. A core network node, the core network node comprising: a memory; at least one transceiver; and at least one processor, the at least one processor being communicatively coupled to the memory and the at least one transceiver and configured to: send a request to a radio access network (RAN) node via the at least one transceiver to verify the location of a user equipment (UE); and receive a response from the RAN node via the at least one transceiver, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof.

Clause 36. A core network node according to clause 35, wherein the at least one processor is further configured to: receive a request to verify the location of the UE from a second core network node via the at least one transceiver; and send a response to the second core network node via the at least one transceiver, the response to the second core network node comprising: the measurements obtained by the UE during the RAN-based positioning procedure, the measurements obtained by the RAN node during the RAN-based positioning procedure, the location of the UE verified by the RAN node, the indication that the location of the UE is verified, or any combination thereof.

Clause 37. The core network node of clause 36, wherein the second core network node is a location management function (LMF).

Clause 38. A core network node according to any one of clauses 35 to 37, wherein the at least one processor is further configured to: send a request to a location server via the at least one transceiver to verify the location of the UE; and receive a response from the location server via the at least one transceiver, the response from the location server including the location of the UE verified by the location server, an indication that the location of the UE is verified, or any combination thereof.

Clause 39. A core network node according to clause 38, wherein the at least one processor is further configured to: determine whether the location of the UE is verified based on the response from the RAN node, the response from the location server, or both.

Clause 40. A core network node according to any one of clauses 38 to 39, wherein: the response from the location server includes the location of the UE verified by the location server, the response from the location server also includes the type of location server-based positioning procedure performed between the location server and the UE to determine the location of the UE verified by the location server, and the location of the UE verified by the location server is determined to be verified based on the type of the location server-based positioning procedure.

Clause 41. A core network node according to any one of clauses 38 to 40, wherein: the response from the location server includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the location of the UE verified by the location server.

Clause 42. A core network node as described in any of clauses 35 to 41, wherein the response from the RAN node also includes the type of the RAN-based positioning procedure.

Clause 43. A core network node according to any of clauses 35 to 42, wherein: the response from the RAN node includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the location of the UE verified by the RAN node.

Clause 44. A core network node according to any of clauses 35 to 43, wherein the at least one processor is further configured to: receive a capability message from the RAN node via the at least one transceiver, the capability message indicating that the RAN node is capable of verifying the location of the UE.

Clause 45. A core network node according to any one of clauses 35 to 44, wherein the at least one processor is further configured to: trigger a validity timer for the location verified by the RAN node for the UE; and trigger a subsequent UE location verification procedure based on one or more triggering events.

Clause 46. A core network node according to clause 45, wherein the one or more triggering events include: expiration of the validity timer, UE tracking area update, UE registration area update, change of UE location above a threshold, change of country of UE location, or any combination thereof.

Clause 47. A core network node as described in any of clauses 45 to 46, wherein the subsequent UE location verification procedure is not triggered based on the location change of the UE during a radio resource control (RRC) state transition being less than a threshold.

Clause 48. A network node as described in any of clauses 35 to 47, wherein the core network node is an Access and Mobility Management Function (AMF).

Clause 49. A location server, the location server comprising: a memory; at least one transceiver; and at least one processor, the at least one processor being communicatively coupled to the memory and the at least one transceiver and configured to: receive a request to verify the location of a user equipment (UE) from a core network node via the at least one transceiver; perform a location server-based positioning procedure with the UE to determine the verified location of the UE; and send a response to the core network node via the at least one transceiver, the response comprising the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Clause 50. The location server of clause 49, wherein: the response includes the verified location of the UE, and the response also includes a type of positioning procedure based on the location server.

Clause 51. A location server according to any one of clauses 49 to 50, wherein: the response includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the verified location of the UE.

Clause 52. A location server as described in any of clauses 49 to 51, wherein the request comprises: an identifier of the UE, an indication of the area in which the UE is expected to be located, one or more accuracy parameters, a timer within which the location server expects to provide the response, or any combination thereof.

Clause 53. A location server according to any one of clauses 49 to 52, wherein the response comprises: the response comprises the indication that the location of the UE is verified, the type of positioning procedure based on the location server, the quality of service (QoS), the cause of the error, the amount of time taken to determine the verified location of the UE, a confidence value indicating the confidence of the verified location of the UE, or any combination thereof.

Clause 54. A location server according to clause 53, wherein the error cause comprises a value indicating: positioning rejected, UE not supported, positioning failed, or request timed out.

Clause 55. A radio access network (RAN) node, the radio access network (RAN) node comprising: a component for receiving a request to verify the location of a user equipment (UE) from a core network node; a component for performing a RAN-based positioning procedure with the UE to determine the verified location of the UE; and a component for sending a response to the core network node, the response comprising: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Clause 56. A RAN node as described in clause 55, wherein the response also includes a type of the RAN based positioning procedure.

Clause 57. A RAN node according to any of clauses 55 to 56, wherein: the response includes the indication that the position of the UE is verified, the indication that the position of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the verified position of the UE.

Clause 58. A RAN node as described in any of clauses 55 to 57, the RAN node further comprising: a component for sending a capability message to the core network node, the capability message indicating that the RAN node is able to verify the location of the UE.

Clause 59. A RAN node as described in clause 58, wherein the RAN node has a steerable spare beam.

Clause 60. A RAN node as described in any of clauses 55 to 59, wherein the RAN node is a space vehicle or is located on a space vehicle.

Clause 61. A RAN node as described in any of clauses 55 to 60, wherein the core network node is: an access and mobility management function (AMF), or a location management function (LMF).

Clause 62. A core network node, the core network node comprising: means for sending a request to a radio access network (RAN) node to verify the location of a user equipment (UE); and means for receiving a response from the RAN node, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof.

Clause 63. According to the core network node described in clause 62, the core network node also includes: a component for receiving a request to verify the location of the UE from a second core network node; and a component for sending a response to the second core network node, the response to the second core network node including: the measurements obtained by the UE during the RAN-based positioning procedure, the measurements obtained by the RAN node during the RAN-based positioning procedure, the location of the UE verified by the RAN node, the indication that the location of the UE is verified, or any combination thereof.

Clause 64. The core network node of clause 63, wherein the second core network node is a location management function (LMF).

Clause 65. A core network node according to any one of clauses 62 to 64, wherein the core network node further comprises: a component for sending a request to a location server to verify the location of the UE; and a component for receiving a response from the location server, the response from the location server comprising the location of the UE verified by the location server, an indication that the location of the UE is verified, or any combination thereof.

Clause 66. The core network node of clause 65, further comprising: means for determining whether the location of the UE is verified based on the response from the RAN node, the response from the location server, or both.

Clause 67. A core network node according to any one of clauses 65 to 66, wherein: the response from the location server includes the location of the UE verified by the location server, the response from the location server also includes the type of location server-based positioning procedure performed between the location server and the UE to determine the location of the UE verified by the location server, and the location of the UE verified by the location server is determined to be verified based on the type of the location server-based positioning procedure.

Clause 68. A core network node according to any one of clauses 65 to 67, wherein: the response from the location server includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the location of the UE verified by the location server.

Clause 69. A core network node as described in any of clauses 62 to 68, wherein the response from the RAN node also includes the type of RAN-based positioning procedure.

Clause 70. A core network node according to any of clauses 62 to 69, wherein: the response from the RAN node includes an indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the location of the UE verified by the RAN node.

Clause 71. A core network node according to any of clauses 62 to 70, the core network node further comprising: a component for receiving a capability message from the RAN node, the capability message indicating that the RAN node is able to verify the location of the UE.

Clause 72. A core network node according to any one of clauses 62 to 71, wherein the core network node further comprises: a component for triggering a validity timer for a location verified by the RAN node for the UE; and a component for triggering a subsequent UE location verification procedure based on one or more triggering events.

Clause 73. A core network node according to clause 72, wherein the one or more triggering events include: expiration of the validity timer, UE tracking area update, UE registration area update, change of UE location above a threshold, change of country of UE location, or any combination thereof.

Clause 74. A core network node as described in any of clauses 72 to 73, wherein the subsequent UE location verification procedure is not triggered based on the location change of the UE during a radio resource control (RRC) state transition being less than a threshold.

Clause 75. A network node as described in any of clauses 62 to 74, wherein the core network node is an Access and Mobility Management Function (AMF).

Clause 76. A location server, the location server comprising: a component for receiving a request to verify the location of a user equipment (UE) from a core network node; a component for performing a location server-based positioning procedure with the UE to determine the verified location of the UE; and a component for sending a response to the core network node, the response including the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Clause 77. The location server of clause 76, wherein: the response includes the verified location of the UE, and the response also includes a type of positioning procedure based on the location server.

Clause 78. A location server according to any one of clauses 76 to 77, wherein: the response includes an indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the verified location of the UE.

Clause 79. A location server as described in any of clauses 76 to 78, wherein the request comprises: an identifier of the UE, an indication of the area in which the UE is expected to be located, one or more accuracy parameters, a timer within which the location server expects to provide the response, or any combination thereof.

Clause 80. A location server according to any of clauses 76 to 79, wherein the response comprises: the response comprises the indication that the location of the UE is verified, the type of positioning procedure based on the location server, the quality of service (QoS), the cause of the error, the amount of time taken to determine the verified location of the UE, a confidence value indicating the confidence of the verified location of the UE, or any combination thereof.

Clause 81. A location server according to clause 80, wherein the error cause comprises a value indicating: positioning rejected, UE not supported, positioning failed, or request timed out.

Clause 82. A non-transitory computer-readable medium storing computer-executable instructions which, when executed by a radio access network (RAN) node, cause the RAN to: receive a request from a core network node to verify the location of a user equipment (UE); perform a RAN-based positioning procedure with the UE to determine the verified location of the UE; and send a response to the core network node, the response comprising: measurements obtained by the UE during the RAN-based positioning procedure, measurements obtained by the RAN node during the RAN-based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Clause 83. The non-transitory computer-readable medium of Clause 82, wherein the response further comprises a type of the RAN-based positioning procedure.

Clause 84. A non-transitory computer-readable medium according to any one of clauses 82 to 83, wherein: the response includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the verified location of the UE.

Clause 85. A non-transitory computer-readable medium according to clauses 82 to 84, wherein the non-transitory computer-readable medium also includes computer-executable instructions, which, when executed by the RAN node, cause the RAN node to: send a capability message to the core network node, wherein the capability message indicates that the RAN node is capable of verifying the location of the UE.

Clause 86. The non-transitory computer-readable medium of clause 85, wherein the RAN node has a steerable spare beam.

Clause 87. A non-transitory computer-readable medium as described in any of clauses 82 to 86, wherein the RAN node is a space vehicle or is located on a space vehicle.

Clause 88. A non-transitory computer-readable medium as described in any of clauses 82 to 87, wherein the core network node is: an access and mobility management function (AMF), or a location management function (LMF).

Clause 89. A non-transitory computer-readable medium storing computer-executable instructions which, when executed by a core network node, cause the core network node to: send a request to a radio access network (RAN) node to verify the location of a user equipment (UE); and receive a response from the RAN node, the response from the RAN node comprising: measurements obtained by the UE during a RAN-based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN-based positioning procedure, a location of the UE verified by the RAN node, an indication that the location of the UE is verified, or any combination thereof.

Clause 90. A non-transitory computer-readable medium according to clause 89, wherein the non-transitory computer-readable medium also includes computer-executable instructions, which, when executed by the core network node, cause the core network node to: receive a request to verify the location of the UE from a second core network node; and send a response to the second core network node, the response to the second core network node comprising: the measurements obtained by the UE during the RAN-based positioning procedure, the measurements obtained by the RAN node during the RAN-based positioning procedure, the location of the UE verified by the RAN node, the indication that the location of the UE is verified, or any combination thereof.

Clause 91. The non-transitory computer-readable medium of Clause 90, wherein the second core network node is a location management function (LMF).

Clause 92. A non-transitory computer-readable medium according to any one of clauses 89 to 91, wherein the non-transitory computer-readable medium also includes computer-executable instructions, which, when executed by the core network node, cause the core network node to: send a request to a location server to verify the location of the UE; and receive a response from the location server, the response from the location server including the location of the UE verified by the location server, an indication that the location of the UE is verified, or any combination thereof.

Clause 93. According to the non-transitory computer-readable medium of Clause 92, the non-transitory computer-readable medium also includes computer-executable instructions, which, when executed by the core network node, cause the core network node to: determine whether the location of the UE is verified based on the response from the RAN node, the response from the location server, or both.

Clause 94. A non-transitory computer-readable medium according to any one of clauses 92 to 93, wherein: the response from the location server includes the location server-verified location of the UE, the response from the location server also includes a type of location server-based positioning procedure performed between the location server and the UE to determine the location server-verified location of the UE, and the location server-verified location of the UE is determined to be verified based on the type of the location server-based positioning procedure.

Clause 95. A non-transitory computer-readable medium according to any one of clauses 92 to 94, wherein: the response from the location server includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the location of the UE verified by the location server.

Clause 96. A non-transitory computer-readable medium as described in any of clauses 89 to 95, wherein the response from the RAN node also includes a type of the RAN-based positioning procedure.

Clause 97. A non-transitory computer-readable medium as described in any of clauses 89 to 96, wherein: the response from the RAN node includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the location of the UE verified by the RAN node.

Clause 98. A non-transitory computer-readable medium according to any one of clauses 89 to 97, wherein the non-transitory computer-readable medium also includes computer-executable instructions, which, when executed by the core network node, cause the core network node to: receive a capability message from the RAN node, wherein the capability message indicates that the RAN node is capable of verifying the location of the UE.

Clause 99. A non-transitory computer-readable medium according to any one of clauses 89 to 98, wherein the non-transitory computer-readable medium further comprises computer-executable instructions which, when executed by the core network node, cause the core network node to: trigger a validity timer for the location verified by the RAN node for the UE; and trigger subsequent UE location verification procedures based on one or more triggering events.

Clause 100. A non-transitory computer-readable medium according to clause 99, wherein the one or more triggering events include: expiration of the validity timer, a UE tracking area update, a UE registration area update, a change in UE location above a threshold, a change in country of UE location, or any combination thereof.

Clause 101. A non-transitory computer-readable medium as described in any of clauses 99 to 100, wherein the subsequent UE location verification procedure is not triggered based on the location change of the UE during a radio resource control (RRC) state transition being less than a threshold.

Clause 102. A non-transitory computer-readable medium as described in any of clauses 89 to 101, wherein the core network node is an access and mobility management function (AMF).

Clause 103. A non-transitory computer-readable medium storing computer-executable instructions, which, when executed by a location server, cause the location server to: receive a request to verify the location of a user equipment (UE) from a core network node; perform a location server-based positioning procedure with the UE to determine the verified location of the UE; and send a response to the core network node, the response including the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof.

Clause 104. The non-transitory computer-readable medium of clause 103, wherein: the response includes the verified location of the UE, and the response further includes a type of positioning procedure based on the location server.

Clause 105. A non-transitory computer-readable medium according to any one of clauses 103 to 104, wherein: the response includes the indication that the location of the UE is verified, the indication that the location of the UE is verified includes a Boolean value, and the response also includes a confidence value indicating the confidence of the verified location of the UE.

Clause 106. A non-transitory computer-readable medium as described in any of clauses 103 to 105, wherein the request comprises: an identifier of the UE, an indication of an area in which the UE is expected to be located, one or more accuracy parameters, a timer within which the location server expects to provide the response, or any combination thereof.

Clause 107. A non-transitory computer-readable medium as described in any of clauses 103 to 106, wherein the response includes: the response includes the indication that the location of the UE is verified, the type of positioning procedure based on the location server, the quality of service (QoS), the cause of the error, the amount of time taken to determine the verified location of the UE, a confidence value indicating the confidence of the verified location of the UE, or any combination thereof.

Clause 108. The non-transitory computer-readable medium of clause 107, wherein the error cause comprises a value indicating: positioning rejected, UE not supported, positioning failed, or request timed out.

It should be understood by those skilled in the art that information and signals may be represented using any of a variety of different techniques and methods. For example, data, instructions, commands, information, signals, bits, symbols, and chips that may be mentioned throughout the above description may be represented by voltage, current, electromagnetic waves, magnetic fields or magnetic particles, light fields or optical particles, or any combination thereof.

In addition, it will be appreciated by those skilled in the art that the various exemplary logic blocks, modules, circuits and algorithmic steps described in conjunction with the aspects disclosed herein can be implemented as electronic hardware, computer software or a combination of the two. In order to clearly illustrate this interchangeability of hardware and software, various exemplary components, frames, modules, circuits and steps have been generally described in terms of their functionality. Whether such functionality is implemented as hardware or software depends on the specific application and the design constraints proposed to the entire system. Those skilled in the art can implement the described functions in different ways for each specific application, but such specific implementation decisions should not be interpreted as causing a departure from the scope of the present disclosure.

The various illustrative logical blocks, modules, and circuits described in conjunction with the various aspects disclosed herein may be implemented or executed with a general purpose processor, a digital signal processor (DSP), an ASIC, a field programmable gate array (FPGA) or other programmable logic device, discrete gate or transistor logic components, discrete hardware components, or any combination thereof designed to perform the functions described herein. A general purpose processor may be a microprocessor, but in an alternative, the processor may be any conventional processor, controller, microcontroller, or state machine. The processor may also be implemented as a combination of computing devices, such as a combination of a DSP and a microprocessor, a plurality of microprocessors, a combination of one or more microprocessors and a DSP core, or any other such configuration.

The methods, sequences and/or algorithms described in conjunction with the various aspects disclosed herein may be directly embodied in hardware, in a software module executed by a processor, or in a combination of the two. The software module may reside in a random access memory (RAM), a flash memory, a read-only memory (ROM), an erasable programmable ROM (EPROM), an electrically erasable programmable ROM (EEPROM), a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art. An example storage medium is coupled to a processor so that the processor can read information from the storage medium and write information to the storage medium. In an alternative, the storage medium may be integral with the processor. The processor and the storage medium may reside in an ASIC. The ASIC may reside in a user terminal (e.g., UE). In an alternative, the processor and the storage medium may reside in a user terminal as discrete components.

In one or more example aspects, the described functions can be implemented in hardware, software, firmware, or any combination thereof. If implemented in software, the functions can be stored on a computer-readable medium or sent via a computer-readable medium as one or more instructions or codes. Computer-readable media include both computer storage media and communication media, which include any media that facilitates the transfer of computer programs from one place to another. Storage media can be any available media that can be accessed by a computer. By way of example, such computer-readable media can include RAM, ROM, EEPROM, CD-ROM or other optical disk storage devices, disk storage devices or other magnetic storage devices, or any other media that can be used to carry or store desired program codes in the form of instructions or data structures and can be accessed by a computer. In addition, any connection is appropriately referred to as a computer-readable medium. For example, if the software is sent from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, digital subscriber line (DSL), or wireless technologies such as infrared, radio, and microwaves, then coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwaves are included in the definition of the medium. As used herein, disk and disc include compact disc (CD), laser disc, optical disc, digital versatile disc (DVD), floppy disk and Blu-ray disc, where disks usually reproduce data magnetically, while discs reproduce data optically with lasers. Combinations of the above should also be included within the scope of computer readable media.

Although the foregoing disclosure shows the exemplary aspects of the present disclosure, it should be noted that various changes and modifications can be made herein without departing from the scope of the present disclosure as defined by the appended claims. For example, the functions, steps and/or actions of the method claims according to the various aspects of the present disclosure described herein do not need to be performed in any particular order. In addition, any component, function, action or instruction described or claimed herein should not be interpreted as critical or necessary unless explicitly described as such. In addition, as used herein, the terms "set", "group" and the like are intended to include one or more of the elements described. In addition, as used herein, the terms "have", "have", "include", "comprise" and the like do not exclude the presence of one or more additional elements (for example, an element "having" A may also have B). In addition, the phrase "based on" is intended to mean "based at least in part on", unless otherwise explicitly stated. Moreover, as used herein, the term "or" is intended to be open-ended when used in a series and may be used interchangeably with "and/or" unless otherwise expressly stated (e.g., if used in conjunction with "either" or "only one"), or these alternatives are mutually exclusive (e.g., "one or more" should not be interpreted as "one and more"). In addition, although components, functions, actions, and instructions may be described or claimed in the singular, the plural form may also be considered unless expressly stated to be limited to the singular. Therefore, as used herein, the articles "one", "a", "the", and "said" are intended to include one or more of the elements described. Additionally, as used herein, the terms "at least one" and "one or more" include "one" component, function, action, or instruction that performs or is capable of performing the functionality described or claimed, and also include "two or more" components, functions, actions, or instructions that perform or are capable of performing the functionality described or claimed in combination.

Claims (30)

1. A method of location verification performed by a Radio Access Network (RAN) node, the method comprising: receiving a request to verify a location of a user equipment (UE) from a core network node; performing a RAN-based positioning procedure with the UE to determine a verified location of the UE; and sending a response to the core network node, the response comprising: measurements obtained by the UE during the RAN based positioning procedure, measurements obtained by the RAN node during the RAN based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof. 2 . The method of claim 1 , wherein the response further comprises a type of the RAN-based positioning procedure. 3. The method according to claim 1, wherein: the response comprising the indication that the location of the UE is verified, The indication that the location of the UE is verified comprises a Boolean value, and The response also includes a confidence value indicating a confidence in the verified location of the UE. 4. The method according to claim 1, further comprising: A capability message is sent to the core network node, the capability message indicating that the RAN node is capable of verifying the location of the UE. 5. The method according to claim 4, wherein: The RAN node has steerable spare beams. 6. The method of claim 1, wherein the RAN node is or is located on a space vehicle. 7. The method of claim 1, wherein the core network node is: Access and Mobility Management Function (AMF), or Location Management Function (LMF). 8. A method of location verification performed by a core network node, the method comprising: sending a request to a radio access network (RAN) node to verify a location of a user equipment (UE); and receiving a response from the RAN node, the response from the RAN node comprising: measurements obtained by the UE during a RAN based positioning procedure performed by the RAN node and the UE, measurements obtained by the RAN node during the RAN based positioning procedure, a position of the UE verified by the RAN node, an indication that the position of the UE is verified, or any combination thereof. 9. The method according to claim 8, further comprising: receiving a request from a second core network node to verify the location of the UE; and and sending a response to the second core network node, the response to the second core network node comprising: the measurements obtained by the UE during the RAN based positioning procedure, the measurements obtained by the RAN node during the RAN based positioning procedure, the location of the UE verified by the RAN node, the indication that the location of the UE is verified, or any combination thereof. 10. The method of claim 9, wherein the second core network node is a Location Management Function (LMF). 11. The method according to claim 8, further comprising: sending a request to a location server to verify the location of the UE; and A response is received from the location server, the response from the location server comprising a location of the UE verified by the location server, an indication that the location of the UE is verified, or any combination thereof. 12. The method according to claim 11, further comprising: A determination is made whether the location of the UE is verified based on the response from the RAN node, the response from the location server, or both. 13. The method according to claim 11, wherein: the response from the location server includes the location of the UE verified by the location server, The response from the location server also includes a type of location server-based positioning procedure performed between the location server and the UE to determine the location server-verified location of the UE, and The location server-verified location of the UE is verified based on the type of the location server-based positioning procedure. 14. The method according to claim 11, wherein: the response from the location server comprising the indication that the location of the UE is verified, The indication that the location of the UE is verified comprises a Boolean value, and The response also includes a confidence value indicating a confidence of the location of the UE as verified by the location server. 15. The method of claim 8, wherein the response from the RAN node further includes a type of the RAN based positioning procedure. 16. The method of claim 8, wherein: the response from the RAN node comprises the indication that the location of the UE is verified, The indication that the location of the UE is verified comprises a Boolean value, and The response also includes a confidence value indicating a confidence in the location of the UE verified by the RAN node. 17. The method according to claim 8, further comprising: A capability message is received from the RAN node, the capability message indicating that the RAN node is capable of verifying the location of the UE. 18. The method according to claim 8, further comprising: triggering a validity timer for a location verified by the RAN node of the UE; and A subsequent UE location verification procedure is triggered based on one or more triggering events. 19. The method of claim 18, wherein the one or more triggering events include: expiry of the validity timer, UE tracking area update, UE registration area update, Change in UE location above a threshold, The country of the UE's location changes, or Any combination of them. 20. The method of claim 18, wherein the subsequent UE location verification procedure is not triggered based on the location change of the UE being less than a threshold during a radio resource control (RRC) state transition. 21. The method of claim 8, wherein the core network node is an Access and Mobility Management Function (AMF). 22. A method of location verification performed by a location server, the method comprising: receiving a request to verify a location of a user equipment (UE) from a core network node; performing a location server-based positioning procedure with the UE to determine a verified location of the UE; and A response is sent to the core network node, the response comprising the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof. 23. The method of claim 22, wherein: The response includes the verified location of the UE, and The response also includes the type of positioning procedure based on the location server. 24. The method of claim 22, wherein: the response comprising the indication that the location of the UE is verified, The indication that the location of the UE is verified comprises a Boolean value, and The response also includes a confidence value indicating a confidence in the verified location of the UE. 25. The method of claim 22, wherein the request comprises: an identifier of the UE, an indication of an area in which the UE is expected to be located, one or more accuracy parameters, a timer within which the location server is expected to provide the response, or Any combination of them. 26. The method of claim 22, wherein the response comprises: the response comprising the indication that the location of the UE is verified, the type of the location server-based positioning procedure, Quality of Service (QoS), Cause of error, an amount of time taken to determine the verified location of the UE, a confidence value indicating the confidence of the verified location of the UE, or any combination thereof. 27. The method of claim 26, wherein the error cause comprises a value indicating: Refuse to locate, UE does not support, Positioning failed, or The request timed out. 28. A radio access network (RAN) node, the radio access network (RAN) node comprising: Memory; at least one transceiver; and at least one processor, the at least one processor being communicatively coupled to the memory and the at least one transceiver, the at least one processor being configured to: receiving, via the at least one transceiver, from a core network node a request to verify a location of a user equipment (UE); performing a RAN-based positioning procedure with the UE to determine a verified location of the UE; and and sending a response to the core network node via the at least one transceiver, the response comprising: measurements obtained by the UE during the RAN based positioning procedure, measurements obtained by the RAN node during the RAN based positioning procedure, the verified location of the UE, an indication that the location of the UE is verified, or any combination thereof. 29. The RAN node of claim 28, wherein the response further comprises a type of the RAN based positioning procedure. 30. The RAN node of claim 28, wherein: the response comprising the indication that the location of the UE is verified, The indication that the location of the UE is verified comprises a Boolean value, and The response also includes a confidence value indicating a confidence in the verified location of the UE.