Secure ranging with passive devices

Various aspects of the present disclosure generally relate to wireless communication. In some aspects, a first user equipment (UE) may transmit, to a second UE via reflection by one or more passive devices, a first reference signal (RS) that is based at least in part on a shared first key that corresponds to a configuration of the one or more passive devices. The first UE may receive, from the second UE via reflection, a second RS that is based at least in part on the first key. The first UE may generate a second key based at least in part on a measurement of the second RS. The first UE may transmit a positioning reference signal that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE. Numerous other aspects are described.

FIELD OF THE DISCLOSURE

Aspects of the present disclosure generally relate to wireless communication and to techniques and apparatuses for secure ranging with passive devices.

BACKGROUND

SUMMARY

Some aspects described herein relate to a method of wireless communication performed by a first user equipment (UE). The method may include transmitting, to a second UE via reflection by one or more passive devices, a first reference signal (RS) that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices. The method may include receiving, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The method may include generating a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The method may include transmitting a positioning reference signal (PRS) that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE.

Some aspects described herein relate to a method of wireless communication performed by a second UE. The method may include transmitting, to a first UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices. The method may include receiving, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The method may include generating a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The method may include receiving a PRS that includes an indication of being generated with the second key. The method may include verifying, based on the second key, whether generation of the PRS is secure.

Some aspects described herein relate to a first UE for wireless communication. The first UE may include memory, one or more processors coupled to the memory, and instructions stored in the memory and executable by the one or more processors. The instructions may be executable by the one or more processors to cause the first UE to transmit, to a second UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices. The instructions may be executable by the one or more processors to cause the first UE to receive, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The instructions may be executable by the one or more processors to cause the first user equipment to generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The instructions may be executable by the one or more processors to cause the first user equipment to transmit a PRS that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE.

Some aspects described herein relate to a second UE for wireless communication. The second UE may include memory, one or more processors coupled to the memory, and instructions stored in the memory and executable by the one or more processors. The instructions may be executable by the one or more processors to cause the second UE to transmit, to a first UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices. The instructions may be executable by the one or more processors to cause the second UE to receive, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The instructions may be executable by the one or more processors to cause the second UE to generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The instructions may be executable by the one or more processors to cause the second UE to receive a PRS that includes an indication of being generated with the second key. The instructions may be executable by the one or more processors to cause the second UE to verify, based on the second key, whether generation of the PRS is secure.

Some aspects described herein relate to a non-transitory computer-readable medium that stores one or more instructions for wireless communication by a first UE. The one or more instructions, when executed by one or more processors of the first UE, may cause the first UE to transmit, to a second UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices. The one or more instructions, when executed by one or more processors of the first UE, may cause the first UE to receive, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The one or more instructions, when executed by one or more processors of the first UE, may cause the first UE to generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The one or more instructions, when executed by one or more processors of the first UE, may cause the first UE to transmit a PRS that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE.

Some aspects described herein relate to a non-transitory computer-readable medium that stores one or more instructions for wireless communication by a second UE. The one or more instructions, when executed by one or more processors of the second UE, may cause the second UE to transmit, to a first UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices. The one or more instructions, when executed by one or more processors of the second UE, may cause the second UE to receive, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The one or more instructions, when executed by one or more processors of the second UE, may cause the second UE to generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The one or more instructions, when executed by one or more processors of the second UE, may cause the second UE to receive a PRS that includes an indication of being generated with the second key. The one or more instructions, when executed by one or more processors of the second UE, may cause the second UE to verify, based on the second key, whether generation of the PRS is secure.

Some aspects described herein relate to an apparatus for wireless communication. The apparatus may include means for transmitting, to another apparatus via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the other apparatus and that corresponds to a configuration of the one or more passive devices. The apparatus may include means for receiving, from the other apparatus via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The apparatus may include means for generating a second key based at least in part on a measurement of the second RS on a channel that is established between the apparatus and the other apparatus according to the configuration of the one or more passive devices. The apparatus may include means for transmitting a PRS that is based at least in part on the second key and that is associated with a measurement of a range between the apparatus and the other apparatus.

Some aspects described herein relate to an apparatus for wireless communication. The apparatus may include means for transmitting, to another apparatus via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the other apparatus and that corresponds to a configuration of the one or more passive devices. The apparatus may include means for receiving, from the other apparatus via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The apparatus may include means for generating a second key based at least in part on a measurement of the second RS on a channel that is established between the apparatus and the other apparatus according to the configuration of the one or more passive devices. The apparatus may include means for receiving a PRS that includes an indication of being generated with the second key. The apparatus may include means for verifying, based on the second key, whether generation of the PRS is secure.

DETAILED DESCRIPTION

A network controller may couple to a set of BSs and may provide coordination and control for these BSs. The network controller may communicate with the BSs via a backhaul. The BSs may also communicate with one another directly or indirectly, via a wireless or wireline backhaul.

Wireless network100shows a first device (e.g., UE120a, base station110) that may communicate with a second device (e.g., base station110, UE120a) directly or by reflecting signals via a passive device140(e.g., a reconfigurable intelligent surface (RIS)). The first device may be a transmitting UE and the second device may be a receiving UE, because the transmitting UE is transmitting a reference signal to the receiving UE. This may be at the request of the base station.

In some aspects, a first UE (e.g., UE120) may include a communication manager150. As described in more detail elsewhere herein, the communication manager150may transmit, to a second UE via reflection by one or more passive devices, a first reference signal (RS) that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices. The communication manager150may receive, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The communication manager150may generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The communication manager150may transmit a positioning reference signal (PRS) that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE. Additionally, or alternatively, the communication manager150may perform one or more other operations described herein.

In some aspects, a second UE (e.g., UE120) may include a communication manager150. As described in more detail elsewhere herein, the communication manager150may transmit, to a first UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices. The communication manager150may receive, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The communication manager150may generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices and receive a PRS that includes an indication of being generated with the second key. The communication manager150may verify, using the second key, whether generation of the PRS is secure. Additionally, or alternatively, the communication manager150may perform one or more other operations described herein.

FIG.2is a diagram illustrating an example200of a base station110in communication with a UE120in a wireless network100, in accordance with the present disclosure. The base station110may be equipped with T antennas234athrough234t, and the UE120may be equipped with R antennas252athrough252r, where in general T≥1 and R≥1.

At the UE120, antennas252athrough252rmay receive the downlink signals from the base station110and/or other base stations and may provide received signals to demodulators (DEMODs)254athrough254r, respectively. Each demodulator254may condition (e.g., filter, amplify, downconvert, and digitize) a received signal to obtain input samples. Each demodulator254may further process the input samples (e.g., for OFDM) to obtain received symbols. A MIMO detector256may obtain received symbols from all R demodulators254athrough254r, perform MIMO detection on the received symbols if applicable, and provide detected symbols. A receive processor258may process (e.g., demodulate and decode) the detected symbols, provide decoded data for the UE120to a data sink260, and provide decoded control information and system information to a controller/processor280. The term “controller/processor” may refer to one or more controllers, one or more processors, or a combination thereof. A channel processor may determine a reference signal received power (RSRP) parameter, a received signal strength indicator (RSSI) parameter, a reference signal received quality (RSRQ) parameter, and/or a CQI parameter, among other examples. In some aspects, one or more components of the UE120may be included in a housing284.

The passive device140may include communication unit294, controller/processor290, memory292, and surface elements296. The controller/processor290may control a configuration (e.g., reflective direction) of the surface elements296by applying voltage to specific elements of the surface elements296. The passive device140may communicate with the base station110via the communication unit294.

Controller/processor240of the base station110, controller/processor280of the UE120, controller/processor290of the passive device140, and/or any other component(s) ofFIG.2may perform one or more techniques associated with measuring links associated with a passive device, as described in more detail elsewhere herein. For example, controller/processor240of base station110, controller/processor280of the UE120, controller/processor290of the passive device140, and/or any other component(s) ofFIG.2may perform or direct operations of, for example, process800ofFIG.8, process900ofFIG.9, and/or other processes as described herein. Memories242,282, and292may store data and program codes for the base station110, the UE120, and the passive device140, respectively. In some aspects, memory242, memory282, and/or memory292may include a non-transitory computer-readable medium storing one or more instructions (e.g., code and/or program code) for wireless communication. For example, the one or more instructions, when executed (e.g., directly, or after compiling, converting, and/or interpreting) by one or more processors of the base station110, the passive device140, and/or the UE120may cause the one or more processors, the base station110, the passive device140, and/or the UE120to perform or direct operations of, for example, process800ofFIG.8, process900ofFIG.9, and/or other processes as described herein. In some aspects, executing instructions may include running the instructions, converting the instructions, compiling the instructions, and/or interpreting the instructions, among other examples.

In some aspects, a first UE (e.g., UE120) includes means for transmitting, to a second UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices; means for receiving, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key; means for generating a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices; and/or means for transmitting a PRS that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE. The means for the first UE to perform operations described herein may include, for example, one or more of communication manager150, antenna252, modem254, MIMO detector256, receive processor258, transmit processor264, TX MIMO processor266, controller/processor280, or memory282.

In some aspects, a second UE (e.g., UE120) includes means for transmitting, to a first UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices; means for receiving, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key; means for generating a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices; means for receiving a PRS that includes an indication of being generated with the second key; and/or means for verifying, using the second key, whether generation of the PRS is secure. The means for the second UE to perform operations described herein may include, for example, one or more of communication manager150, antenna252, modem254, MIMO detector256, receive processor258, transmit processor264, TX MIMO processor266, controller/processor280, or memory282.

FIG.3is a diagram illustrating an example300of using a passive device, in accordance with the present disclosure. Example300shows a base station310(e.g., BS110) that may communicate with a UE320(e.g., UE120), and a BS330(e.g., BS110) that may communicate with UE340(e.g., UE120).

A network may have antennas that are grouped together at a transmitter or receiver, in order to increase throughput. The grouping of antennas may be referred to as “massive MIMO.” Massive MIMO may use active antenna units (AAUs) to achieve high beamforming gain. An AAU may combine an antenna, a radio, a tower-mounted amplifier, a feeder, and/or jumper functionalities into a single unit. An AAU may include an individual radio frequency (RF) chain for each antenna port.

There may be barriers to massive MIMO. The transmission of signals may be blocked by buildings, natural topography, or other blocking structures. For example, BS310may transmit signals to UE320, but BS310may not be able to transmit signals to UE340. As shown in example300, there is some type of blockage between BS310and UE340. UE340may instead be served by BS330.

In order to resolve transmission issues due to the blockage, the network may use a passive device350(e.g., passive device140). The passive device350may be a device that forwards, relays, repeats, or reflects in a passive or near passive manner. The passive device350may be configured as a RIS. A RIS may be a two-dimensional surface of engineered material whose properties are reconfigurable rather than static. The engineered material may contain integrated electronic circuits and software that enable the control of a wireless medium by altering an impedance of the surface or a portion of the surface. The change in impedance may alter a phase shift and/or an angle of reflection. Scattering, absorption, reflection, or diffraction properties may be changed with time and controlled by the software. A RIS may act as a reflective lens. In one example, a RIS may include large arrays of inexpensive antennas spaced half of a wavelength apart. In another example, a RIS may include metamaterial-based planar or conformal large surfaces whose elements (e.g., square elements) have sizes and inter-distances that are smaller than the wavelength. Each of the elements may have a configured impedance or other surface properties that are controlled by a voltage to the element. A RIS may also be referred to as a “software-controlled metasurface” or an “intelligent reflecting surface”.

The passive device350, when configured to operate as a RIS, may not have antennas or RF chains of its own, but may include a large number of small, low-cost elements on a surface to passively reflect incident signals transmitted from BS310. A controller of the passive device350may control the elements on the surface, and the surface may act as a phased array. The passive device350may be a smart device that is configured to use a specific angle of reflection for the signals. BS310may use a controller to control, as part of a reflective configuration, the angle of reflection (angle of arrival θifor an incident wave, angle of departure θrfor reflected wave), an amplitude, a phase, and/or a width of the elements of the passive device350by controlling a voltage to each of the elements. The reflective configuration may also correspond to analog beamforming weights or coefficients that are provided by the passive device when reflecting signals from one device to another. The reflective configuration may also be referred to as an “MS reflection configuration,” an “MS reflection matrix,” or a “P-MIMO configuration.” In sum, the passive device350may help to control a propagation environment with less power consumption than AAUs. Passive devices may even replace AAUs in the propagation environment. MIMO that uses passive devices may be referred to as “passive MIMO” or “P-MIMO”. The passive device350may be also referred to as a “passive node” or a “P-MIMO device”.

In some aspects, BS310may configure the passive device350by sending a control signal with information for configuring the properties and/or timing of the elements. For example, BS310may transmit a set of beam weights to the passive device350through explicit signaling (e.g., radio resource control (RRC) signaling) instead of using beam sweeping.

In some aspects, the BS310may transmit a control signal to the passive device350for operation of the passive device, and the passive device350may provide information back to the BS310. For example, the passive device350may provide a few bits of RIS-side information, such as an indication of an acknowledgement (ACK) or a negative acknowledgment (NACK) of the control signal. The information may also indicate quality of the channel.

FIG.4is a diagram illustrating an example400of PRSs, in accordance with the present disclosure.

Ranging involves an ability to determine a distance between two wireless devices. An example of a ranging system may include a vehicle system that uses a key fob for remotely locking and unlocking the doors of a vehicle and for starting the vehicle. The key fob may transmit wireless signals to another device over a short or intermediate range. A first UE in the key fob and a second UE in the vehicle system may use a PRS to calculate the range (distance) between the first UE (key fob) and the second UE (vehicle system).

The first UE and the second UE may use the range to provide security for wireless signals transmitted between the first UE and the second UE. For secure ranging systems, it is important that a “man-in-the-middle” device does not spoof a PRS to make it appear that the range between the first UE and the second UE is less than the actual distance. The middle-man may detect the PRS from the first UE and transmit a time-advanced PRS on top of the actual PRS to the second UE. For example, as shown in example400, a genuine signal may include an initial part s(k) and a latter part t(k). The middle-man may use the initial part s(k) to predict the latter part t(k). The middle-man may use the predicted latter part t(k) as an attack signal. The second UE may receive the attack signal superimposed onto the genuine signal. The middle-man may time advance the attack signal (with a slightly increased power) such that the fake first arrival of the attack signal is before the genuine first arrival of the genuine signal. The second UE may think that the genuine signal has arrived earlier. Because the range is a function of time, the second UE may think that the first UE is closer, and within the range when the vehicle is allowed to unlock and start the vehicle. In other words, by spoofing the latter part of the signal with a fake range, the operator of the middle-man device may steal the vehicle.

According to various aspects described herein, the first UE and the second UE may randomize the sequence of the PRS signal in such a way that only the legitimate transmitter and the legitimate receiver know the actual range, and the middle-man eavesdropper should not be able to estimate the range. The first UE and the second UE may secure the range by using a key that is shared between the first UE and the second UE and that changes over time. The first UE may transmit a PRS (common to both the first UE and the second UE) for the second UE to measure the channel. The second UE may transmit the common PRS to the first UE to measure the channel (the channel remains constant during this measurement phase). The first UE and the second UE may each generate the same secret key as follows. Let h(k) denote the channel measurement for subcarrier k, and let N be the number of subcarriers. Let

θk=tan-1(imag⁡(h⁡(k))real(h⁡(k)))
and be the channel phase for subcarrier k. Let fQ(θk)=q, if

θk∈[2⁢π⁡(q-1)Q,2⁢π⁢qQ],
q=1, . . . Q, where Q is the quantity of quantization levels. The first UE and the second UE may generate the shared key S=[fQ(θ1), fQ(θ2) . . . fQ(θN)]. The key generation between the first UE and the second UE may create common channel randomness that creates greater uncertainty for any middle-man that may be eavesdropping on the legitimate first UE and second UE.

FIG.5is a diagram illustrating an example500of generating a key when passive devices are involved, in accordance with the present disclosure. A roadside unit (RSU)510(e.g., BS110) may communicate with a UE520(e.g., UE120, UE340) or a UE530(e.g., UE120, UE340) via a passive device, such as RIS540(e.g., passive device350), RIS550, RIS560, or a combination thereof. UE520may be, for example, in a key fob that operates with UE530in a vehicle system to provide security for the vehicle. UE520and UE530may be considered legitimate (authorized) devices. There may be another UE570that is acting as an eavesdropper or a hacker.

UE520and UE530may coordinate to provide a two-layer scheme for secure ranging when using passive devices. The first layer involves the first key K1that is shared between the first UE and the second UE and that corresponds to a configuration of RIS540, RIS550, and RIS560. The configuration may include a pattern of activation and deactivation of RIS540, RIS550, and RIS560, where on or off states are mapped to specific slots or subframes in a time window. For example, as shown for a first value S1of the first key K1, RIS540is off and RIS550is on in slot 1, RIS540is off and RIS550is on in slot 2, RIS540is on and RIS550is off in slot 3, and RIS540is on and RIS550is on in slot 4. The shaded slots of the configuration indicated by the first key K1indicate when UE520and UE530are to perform channel estimation or other measurements on the common reciprocal channel between UE520and UE530. For the first value S1of the first key K1, UE520and UE530are to perform channel estimation at slot 1 and slot 4. The channel estimation may be used for generating a second key K2.

As shown for a second value S2of the first key K1, RIS540is on and RIS550is on in slot 1, RIS540is off and RIS550is on in slot 2, RIS540is off and RIS550is off in slot 3, and RIS540is on and RIS550is off in slot 4. For the second value S2of the first key K1, UE520and UE530are to perform channel estimation at slot 2 and slot 3. The RSU510may share values of the first key K1only with legitimate UEs and passive devices, such as UE520, UE530, RIS540, RIS550, and RIS560.

In addition to on and off patterns and slots for measurements, the RSU510may configure each RIS with a reflection configuration indicated by the first key K1. Each reflection configuration may include a configuration of analog beam forming weights that control a reflection angle of the RIS.

RIS540, RIS550, and RIS560may each receive the first key K1and configure itself to operate according to a configuration indicated by the first key K1. This may include activating or deactivating in specified slots. This may also include using a reflection configuration (e.g., adjusting analog beamforming weights) in specified slots. A RIS may be preconfigured with multiple possible configurations and the first key K1may indicate one of the configurations with an index or some other value.

UE520may reflect signals via one or more RISs, depending on the configuration for a given slot (or symbol). Example500shows a configuration where RIS540and RIS560are deactivated for a slot, and UE520reflects a signal to UE530via RIS550. UE570may be attempting to spoof the signal from UE520.

FIG.6is a diagram illustrating an example600of secure ranging, in accordance with the present disclosure. Example600shows a call flow of RSU510, UE520, UE530, RIS540, RIS550, and RIS560. Though not specifically shown in example600, signals from UE520may be reflected to UE530via one or more of RIS540, RIS550, or RIS560. Signals may also be reflected from UE530to UE520.

As part of the first layer of the two-layer scheme for secure ranging described in connection withFIG.5, the RSU510may transmit the first key K1to UE520and UE530and to RIS540, RIS550, and RIS560, among other passive devices, as shown by reference number605. The RSU510may transmit the first key K1via a radio resource control (RRC) message on a dedicated RRC connection between the UEs and the RISs. The RSU510may transmit the first key K1using the respective public keys of RIS540, RIS550, RIS560, UE520, and UE530, and each device may decode the first key K1using respective private keys. Alternatively, UE520or UE530may initiate a secure ranging session and distribute the first key K1, or each of the devices may derive the first key K1using identifiers of the devices.

As shown by reference number610, each of RIS540, RIS550, and RIS560may be configured by the first key K1. The configuration may include a timing of when each of RIS540, RIS550, and RIS560is activated or deactivated. For example, RIS540, RIS550, and/or RIS560may be on or off for each time slot of multiple time slots of a time window, according to the configuration of the passive devices indicated by the first key K1. As shown by reference number615, UE520may transmit an SL-RS (e.g., channel state information reference signal (CSI-RS)) to UE530, and UE530may transmit an SL-RS to UE520. Each of the SL-RSs may be reflected by RIS540, RIS550, and/or RIS560according to the configuration of the passive devices at the time slot. Different combinations of active RISs may be specified for each time slot. Each of RIS540, RIS550, and/or RIS560may be configured with a reflection configuration (e.g., analog beamforming weights) indicated by the first key K1or any other information associated with the first key K1.

As shown by reference number620, UE520may derive a second key K2based at least in part on measuring the SL-RS on the sidelink channel from UE530during the time slot, if the first key K1indicates that UE520is to perform a channel measurement at the time slot. The channel measurement may include measuring the phase or amplitude of an SL-RS at each of one or more subcarriers (subcarrier phases) of the SL-RS. The second key K2may be generated to include, for example, a concatenation of the phase or amplitude measurements, such as mi=[fQ(θ1), fQ(θ2) . . . fQ(θN)] measured during the time slot. The second key K2may be generated to includes a concatenation of measurements made over multiple slots. For example, for K1=S2, where measurements are performed in slot 2 and slot 3, the second key K2may be [m2m3], where m2, m3are the keys obtained by mapping the channel phases in each of N subcarriers in slot 2 and slot 3, respectively. The second key K2may be selected, from among multiple candidate key values, to map to a particular measurement value. As shown by reference number625, UE530may derive the second key K2based at least in part on the SL-RS received from UE520on the reciprocal channel at the same time slot.

As shown by reference number630, UE520may derive a sequence of a PRS based at least in part on the second key K2that is derived using the configuration of passives devices indicated by the first key K1. The PRS may infer the range between UE520and UE530. As shown by reference number635, UE530may derive a sequence of a local PRS based at least in part on the second key K2. In some aspects, UE520and UE530may use a preconfigured mapping between the second key K2and a sequence to be used for the PRS.

In some aspects, the mapping may be generated as follows. Let K2=[b0, b1, . . . bN] be a second key of length 6N bits, where N is the quantity of subcarriers, each biis of length 6, biis mapped to subcarrier i, and subcarrier i is mapped to a 64 quadrature amplitude modulation (QAM) symbol pi. Therefore, the derived PRS sequence P=[p1, p2, . . . pN].

As shown by reference number640, UE520may transmit the PRS. As shown by reference number645, UE530may correlate the PRS received from UE520with the local PRS derived by UE530. This correlation may include comparing the received PRS with the derived local PRS and using the result of the comparison to verify whether the range of the PRS is secure. For example, if the sequence of the received PRS matches or substantially matches the sequence of the derived local PRS, the range of the PRS may be accepted as secure, and UE530may treat UE520as a device that is authorized to transmit and/or receive remote signals (e.g., unlock, lock, remote start) to UE530. Note that the second key K2is not shared between UE520and UE530. Rather, the second key K2is independently derived by UE520and by UE530. In sum, UE530may verify that a range of a PRS is secure if the PRS is indicative of the second key K2.

In some aspects, UE530may compare a time of arrival (TOA) of the received PRS with the TOA predicted for the PRS. For example, UE520may transmit secure sequence P to UE530so that UE530may determine the range. Let P be the sequence received by UE530(possibly corrupted by the eavesdropper's signal and noise). UE530may infer or predict sequence P and correlate the received sequence {tilde over (P)} with P to determine the TOA. The TOA may be a function of the sequence, which may be a function of the range.

In some aspects, UE530may transmit a TOA of the PRS from UE520back to UE520, such that UE520is able to determine a round trip time (RTT) for the PRS. Also, UE530may determine a range of UE520based at least in part on a time of transmission of sequence P and a TOA of received sequence {tilde over (P)}.

By generating a second key K2that is based at least in part on a first key K1that indicates a changing configuration of passive devices, UE520and UE530make it difficult to spoof a range for a PRS. This increases security of a secure ranging system. In example600, the UE520may more securely signal to the UE530and help prevent theft or internal damage to the vehicle of UE530.

FIG.7is a diagram illustrating an example700of using multiple instances of a second key, in accordance with the present disclosure.

In some aspects, to better avoid spoofing of a range of a PRS, UE520and UE530may generate and use multiple instances of the second key over time. In this way, a spoofing middle-man has to generate multiple spoofing instances correctly. Example700shows, for a first instance, a first layer or phase (Phase-1) to use a first key and a second layer or phase (Phase-2) to generate the second key. UE520may transmit the PRS (PRS1) that is indicative of the second key and transmit PRS1 at time t1. In some aspects, UE520may transmit multiple repetitions of PRS1. For a second instance, UE520and UE530may perform the first phase and the second phase. UE520may transmit PRS2, which is indicative of the second key for the second instance. UE520may transmit multiple repetitions of PRS2. UE520may transmit PRS2 at time t1+Δ. Generation of the second key may extend to further independent PRS sequence derivations and consistency checks at times {t1+2Δ, . . . t1+nΔ}. By using keys that seem to randomly change, spoofing of the PRSs will be increasingly difficult and the ranges of PRSs will be more secure.

FIG.8is a diagram illustrating an example process800performed, for example, by a first UE, in accordance with the present disclosure. Example process800is an example where the UE (e.g., UE120, UE520) performs operations associated with secure ranging with passive devices.

As shown inFIG.8, in some aspects, process800may include transmitting, to a second UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices (block810). For example, the UE (e.g., using communication manager150and/or transmission component1004depicted inFIG.10) may transmit, to a second UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices, as described above.

As further shown inFIG.8, in some aspects, process800may include receiving, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key (block820). For example, the UE (e.g., using communication manager150and/or reception component1002depicted inFIG.10) may receive, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key, as described above.

As further shown inFIG.8, in some aspects, process800may include generating a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices (block830). For example, the UE (e.g., using communication manager150and/or generation component1008depicted inFIG.10) may generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices, as described above.

As further shown inFIG.8, in some aspects, process800may include transmitting a PRS that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE (block840). For example, the UE (e.g., using communication manager150and/or transmission component1004depicted inFIG.10) may transmit a PRS that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE, as described above.

In a first aspect, the configuration includes a timing of when each of the one or more passive devices is active or inactive.

In a second aspect, alone or in combination with the first aspect, the configuration includes a timing of when the first UE and the second UE are to perform channel measurements.

In a third aspect, alone or in combination with one or more of the first and second aspects, a first value of the first key indicates a first combination of active passive devices and one or more time slots for the first combination when the first UE and the second UE are to perform channel measurements, and a second value of the first key indicates a second combination of active passive devices and one or more time slots for the second combination when the first UE and the second UE are to perform channel measurements.

In a fourth aspect, alone or in combination with one or more of the first through third aspects, the configuration includes a reflection configuration for at least one active passive device of the one or more passive devices.

In a fifth aspect, alone or in combination with one or more of the first through fourth aspects, process800includes receiving the first key from an RSU or the second UE.

In a sixth aspect, alone or in combination with one or more of the first through fifth aspects, the measurement of the second RS includes a phase or amplitude measurement for each of multiple subcarriers of the second RS during a measurement slot indicated by the first key.

In a seventh aspect, alone or in combination with one or more of the first through sixth aspects, the second key corresponds to a concatenation of multiple phase or amplitude measurements.

In an eighth aspect, alone or in combination with one or more of the first through seventh aspects, process800includes generating the PRS based at least in part on a mapping of PRS sequences from candidate values based at least in part on the second key.

In a ninth aspect, alone or in combination with one or more of the first through eighth aspects, the transmitting the PRS includes transmitting repetitions of the PRS.

FIG.9is a diagram illustrating an example process900performed, for example, by a second UE, in accordance with the present disclosure. Example process900is an example where the UE (e.g., UE120, UE530) performs operations associated with secure ranging with passive devices.

As shown inFIG.9, in some aspects, process900may include transmitting, to a first UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices (block910). For example, the UE (e.g., using communication manager150and/or transmission component1104depicted inFIG.11) may transmit, to a first UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices, as described above.

As further shown inFIG.9, in some aspects, process900may include receiving, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key (block920). For example, the UE (e.g., using communication manager150and/or reception component1102depicted inFIG.11) may receive, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key, as described above.

As further shown inFIG.9, in some aspects, process900may include generating a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices (block930). For example, the UE (e.g., using communication manager150and/or generation component1108depicted inFIG.11) may generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices, as described above.

As further shown inFIG.9, in some aspects, process900may include receiving a PRS that includes an indication of being generated with the second key (block940). For example, the UE (e.g., using communication manager150and/or reception component1102depicted inFIG.11) may receive a PRS that includes an indication of being generated with the second key, as described above.

As further shown inFIG.9, in some aspects, process900may include verifying, based on or using the second key, whether generation of the PRS is secure (block950). For example, the UE (e.g., using communication manager150and/or verification component1110depicted inFIG.11) may verify, based on or using the second key, whether generation of the PRS is secure, as described above.

In a first aspect, the configuration includes a timing of when each of the one or more passive devices is active or inactive.

In a second aspect, alone or in combination with the first aspect, the configuration includes a timing of when the first UE and the second UE are to perform channel measurements.

In a third aspect, alone or in combination with one or more of the first and second aspects, a first value of the first key indicates a first combination of active passive devices and one or more time slots for the first combination when the first UE and the second UE are to perform channel measurements, and a second value of the first key indicates a second combination of active passive devices and one or more time slots for the second combination when the first UE and the second UE are to perform channel measurements.

In a fourth aspect, alone or in combination with one or more of the first through third aspects, the configuration includes a reflection configuration for at least one active passive device of the one or more passive devices.

In a fifth aspect, alone or in combination with one or more of the first through fourth aspects, process900includes receiving the first key from an RSU or the first UE.

In a sixth aspect, alone or in combination with one or more of the first through fifth aspects, the measurement of the second RS includes a phase or amplitude measurement for each of multiple subcarriers of the second RS during a measurement slot indicated by the first key.

In a seventh aspect, alone or in combination with one or more of the first through sixth aspects, the second key corresponds to a concatenation of multiple phase or amplitude measurements.

In an eighth aspect, alone or in combination with one or more of the first through seventh aspects, the verifying whether the generation of the PRS is secure includes determining an estimated TOA for the PRS based at least in part on the second key and comparing the estimated TOA of the PRS and an actual TOA of the PRS.

In a ninth aspect, alone or in combination with one or more of the first through eighth aspects, the verifying whether generation of the PRS is secure includes generating a local PRS based at least in part on the second key and comparing the local PRS and the PRS.

The transmission component1004may transmit, to a second UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices. The reception component1002may receive, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The generation component1008may generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The transmission component1004may transmit a PRS that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE.

The reception component1002may receive the first key from a roadside unit or the second UE. The generation component1008may generate the PRS based at least in part on a mapping of PRS sequences from candidate values based at least in part on the second key.

The transmission component1104may transmit, to a first UE via reflection by one or more passive devices, a first RS that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices. The reception component1102may receive, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key. The generation component1108may generate a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices. The reception component1102may receive a PRS that includes an indication of being generated with the second key. The verification component1110may verify, using the second key, whether generation of the PRS is secure. The reception component1102may receive the first key from a roadside unit or the first UE.

Aspect 1: A method of wireless communication performed by a first user equipment (UE), comprising: transmitting, to a second UE via reflection by one or more passive devices, a first reference signal (RS) that is based at least in part on a first key that is shared with the second UE and that corresponds to a configuration of the one or more passive devices; receiving, from the second UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key; generating a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices; and transmitting a positioning reference signal (PRS) that is based at least in part on the second key and that is associated with a measurement of a range between the first UE and the second UE.

Aspect 2: The method of Aspect 1, wherein the configuration includes a timing of when each of the one or more passive devices is active or inactive.

Aspect 3: The method of Aspect 2, wherein the configuration includes a timing of when the first UE and the second UE are to perform channel measurements.

Aspect 4: The method of Aspect 3, wherein a first value of the first key indicates a first combination of active passive devices and one or more time slots for the first combination when the first UE and the second UE are to perform channel measurements, and a second value of the first key indicates a second combination of active passive devices and one or more time slots for the second combination when the first UE and the second UE are to perform channel measurements.

Aspect 5: The method of Aspect 2, wherein the configuration includes a reflection configuration for at least one active passive device of the one or more passive devices.

Aspect 6: The method of any of Aspects 1-5, further comprising receiving the first key from a roadside unit or the second UE.

Aspect 7: The method of any of Aspects 1-6, wherein the measurement of the second RS includes a phase or amplitude measurement for each of multiple subcarriers of the second RS during a measurement slot indicated by the first key.

Aspect 8: The method of Aspect 7, wherein the second key corresponds to a concatenation of multiple phase or amplitude measurements.

Aspect 9: The method of any of Aspects 1-8, further comprising generating the PRS based at least in part on a mapping of PRS sequences from candidate values based at least in part on the second key.

Aspect 10: The method of any of Aspects 1-9, wherein the transmitting the PRS includes transmitting repetitions of the PRS.

Aspect 11: A method of wireless communication performed by a second user equipment (UE), comprising: transmitting, to a first UE via reflection by one or more passive devices, a first reference signal (RS) that is based at least in part on a first key that is shared with the first UE and that corresponds to a configuration of the one or more passive devices; receiving, from the first UE via reflection by the one or more passive devices and in association with the transmitting of the first RS, a second RS that is based at least in part on the first key; generating a second key based at least in part on a measurement of the second RS on a channel that is established between the first UE and the second UE according to the configuration of the one or more passive devices; receiving a positioning reference signal (PRS) that includes an indication of being generated with the second key; and verifying, based on the second key, whether generation of the PRS is secure.

Aspect 12: The method of Aspect 11, wherein the configuration includes a timing of when each of the one or more passive devices is active or inactive.

Aspect 13: The method of Aspect 12, wherein the configuration includes a timing of when the first UE and the second UE are to perform channel measurements.

Aspect 14: The method of Aspect 13, wherein a first value of the first key indicates a first combination of active passive devices and one or more time slots for the first combination when the first UE and the second UE are to perform channel measurements, and a second value of the first key indicates a second combination of active passive devices and one or more time slots for the second combination when the first UE and the second UE are to perform channel measurements.

Aspect 15: The method of Aspect 12, wherein the configuration includes a reflection configuration for at least one active passive device of the one or more passive devices.

Aspect 16: The method of any of Aspects 11-15, further comprising receiving the first key from a roadside unit or the first UE.

Aspect 17: The method of any of Aspects 11-16, wherein the measurement of the second RS includes a phase or amplitude measurement for each of multiple subcarriers of the second RS during a measurement slot indicated by the first key.

Aspect 18: The method of Aspect 17, wherein the second key corresponds to a concatenation of multiple phase or amplitude measurements.

Aspect 19: The method of any of Aspects 11-18, wherein the verifying whether the generation of the PRS is secure includes: determining an estimated time of arrival (TOA) for the PRS based at least in part on the second key; and comparing the estimated TOA of the PRS and an actual TOA of the PRS.

Aspect 20: The method of any of Aspects 11-19, wherein the verifying whether generation of the PRS is secure includes: generating a local PRS based at least in part on the second key; and comparing the local PRS and the PRS.