Increased security for multilateration timing advance

A positioning node (e.g., SMLC), a Radio Access Network (RAN) Node (e.g., BSS/BTS), and a wireless device (e.g., MS) are described herein which implement procedures and corresponding modified or new messages/information elements/fields to reduce the possibility of a bandit (e.g., invalid or unauthorized) wireless device from triggering the RAN Node (e.g., BSS/BTS) to generate false timing advance (TA) information associated with the wireless device and report the false TA information to the positioning node (e.g., SMLC) which leads the positioning node (e.g., SMLC) to estimate with degraded accuracy a position of the wireless device.

TECHNICAL FIELD

The present disclosure relates generally to the wireless telecommunications field and, more particularly, to a positioning node (e.g., SMLC), a Radio Access Network (RAN) Node (e.g., BSS/BTS), and a wireless device (e.g., MS) which implement procedures and corresponding modified or new messages/information elements/fields to reduce the possibility of a bandit (e.g., invalid or unauthorized) wireless device from triggering the RAN Node (e.g., BSS/BTS) to generate false timing advance (TA) information associated with the wireless device and report the false TA information to the positioning node (e.g., SMLC) which leads the positioning node (e.g., SMLC) to estimate with degraded accuracy a position of the wireless device.

BACKGROUND

The following abbreviations are herewith defined, at least some of which are referred to within the following description of the present disclosure.3GPP 3rd-Generation Partnership ProjectAB Access BurstAGCH Access Grant ChannelASIC Application Specific Integrated CircuitBSS Base Station SubsystemBTS Base Transceiver StationCN Core NetworkCR Change RequesteNB Evolved Node BEDGE Enhanced Data rates for GSM EvolutionEGPRS Enhanced General Packet Radio ServiceeMTC Enhanced Machine Type CommunicationsE-SMLC Evolved-Serving Mobile Location CenterE-UTRAN Evolved Universal Terrestrial Radio Access NetworkGSM Global System for Mobile CommunicationsGERAN GSM/EDGE Radio Access NetworkGPRS General Packet Radio ServiceID IdentifierIoT Internet of ThingsLMU Location Measurement UnitLTE Long-Term EvolutionMME Mobility Management EntityMS Mobile StationMTA Multilateration Timing AdvanceMTC Machine Type CommunicationsNB Node BNB-IoT Narrow Band Internet of ThingsPDN Packet Data NetworkPLMN Public Land Mobile NetworkRACH Random Access ChannelRAN Radio Access NetworkRAT Radio Access TechnologyRLC Radio Link ControlRRLP Radio Resource Location Services ProtocolSMLC Serving Mobile Location CenterSGSN Serving GPRS Support NodeTA Timing AdvanceTBF Temporary Block FlowTDMA Time Division Multiple AccessTLLI Temporary Logical Link IdentifierTS Technical SpecificationTSC Training Sequence CodeTSG Technical Specification GroupUE User EquipmentUL UplinkUTRAN Universal Terrestrial Radio Access NetworkWCDMA Wideband Code Division Multiple AccessWiMAX Worldwide Interoperability for Microwave Access

The 3rd-Generation Partnership Project (3GPP) is completing work on the Release 14 “ePOS_GERAN” work item for positioning enhancements for the GSM/EDGE Radio Access Network (GERAN) which introduces enhanced methods for multilateration based position estimation of a mobile station (MS) that does not require any additional hardware (e.g., Location Measurement Units (LMUs) at the network side) for performing enhanced position estimation. The enhanced multilateration positioning methods and associated signaling procedures are described in a Change Request (CR) from Radio Access Network (RAN) Working Group 6 (WG6) Meeting #3 (see R6-170151; “CR 43.059 Introduction of Multilateration”; Source: Ericsson L M; Athens, Greece; 13-17 Feb. 2017 where the contents of which are hereby incorporated herein by reference for all purposes) and are included as part of the Rel-14 specifications. The enhanced MTA positioning methods include the Radio Link Control (RLC) data block method, the Access Burst method, and the Extended Access Burst method.

The RLC data block method, the Access Burst method, and the Extended Access Burst method all involve estimating the position of a mobile station (MS) based on timing advance values being estimated by the Base Station Subsystem (BSS)/Base Transceiver Station (BTS) for the MS while it is in the serving cell and in a subset of neighbor cells. To allow the BSS/BTS to estimate the timing advance value applicable to a given MS in a specific cell, the MS must perform the MTA procedure in the specific cell and provide some information (e.g., MS Sync Accuracy parameter, MS Transmission Offset parameter) to the BSS/BTS. The MS that has been commanded to perform the MTA procedure therefore performs an MTA access procedure in a subset of the neighbour cells (and optionally in the serving cell) and sends some information to the BSS/BTS thereby allowing the BSS/BTS to acquire corresponding timing advance information. This timing advance information is then forwarded by the BSS/BTS to the Serving Mobile Location Center (SMLC) which then processes it to estimate the position of the corresponding MS.

One drawback of the enhanced MTA procedure, when performed using the RLC Data Block method or the Extended Access Burst method, is that a bandit MS (e.g., invalid or unauthorized MS) can monitor MTA transmissions made by a valid MS in a given cell and duplicate them in a neighbour cell. The information provided by the bandit MS when sending MTA related transmissions in a neighbour cell can be selected with the purpose of misleading the BSS/BTS receiving those transmissions thereby causing the BSS/BTS to estimate a substantially inaccurate timing advance value for the valid MS. This then leads to the SMLC processing the full set of timing advance values including the misleading timing advance value it receives for the valid MS and estimating a corresponding position of the valid MS with degraded accuracy. A more detailed discussion is provided next to explain the problems associated with the RLC Data Block method and the Extended Access Burst Method.

Problems with RLC Data Block Method:

The SMLC triggers the MTA procedure for a valid MS by sending a Radio Resource Location services Protocol (RRLP) Multilateration Timing Advance Request message to the valid MS indicating that the RLC Data Block method is to be used. The valid MS upon receiving the RRLP Multilateration Timing Advance Request message proceeds to perform the MTA procedure using the RLC Data Block method as follows:The valid MS sends a multilateration access request message on the random access channel (RACH) followed by an uplink Temporary Block Flow (TBF) establishment to enable the transfer of a single RLC data block. The RLC data block sent by the MS includes Temporary Logical Link Identifier (TLLI), MS Sync Accuracy and MS Transmission Offset parameters.A bandit MS that detects the transmission of the multilateration access request message on the random access channel (RACH) also monitors the access grant channel (AGCH) to determine the packet resources that the BSS assigns the valid MS to be used for transmitting the RLC data block.The bandit MS then monitors the RLC data block transmitted by the valid MS and thereby determines the TLLI, MS Sync Accuracy and MS Transmission offset parameters included therein.The bandit MS can then re-select to one or more neighbour cells and send a multilateration access request message on the random access channel (RACH) followed by an uplink TBF establishment to enable the transfer of a single RLC data block.The bandit MS includes the same TLLI used by the valid MS and a misleading MS Transmission Offset value in the single RLC data block it sends, thereby causing the serving BSS/BTS to estimate a substantially inaccurate timing advance value for the MS corresponding to the TLLI.The BSS/BTS does not know it has estimated a timing advance value for a bandit MS and so it sends the SMLC a report containing what can include a substantially inaccurate timing advance value for the MS corresponding to the received TLLI.The SMLC then uses this substantially inaccurate timing advance value when estimating the position of the corresponding valid MS thereby resulting in an estimated position that can have substantially degraded accuracy.
Problems with Extended Access Burst Method:

The SMLC triggers the MTA procedure for a valid MS by sending a RRLP Multilateration Timing Advance Request message to the valid MS indicating that the Extended Access Burst method is to be used. The valid MS upon receiving the RRLP Multilateration Timing Advance Request message proceeds to perform the MTA procedure using the Extended Access Burst method as follows:The valid MS sends a first multilateration access request message on the random access channel (RACH) using an Access Burst followed by sending a second multilateration access request message on the random access channel (RACH) using a Normal Burst. The payload within the first and second multilateration access request messages include MTA Reference ID Low, MTA Reference ID High, MS Sync Accuracy and MS Transmission Offset parameters.A bandit MS that detects the transmission of the first multilateration access request message on the random access channel (RACH) will be able to determine the MTA Reference ID Low (4 least significant bits of the 16 bit MTA Reference ID) and the MS Transmission Offset of the valid MS.The bandit MS that detects the transmission of the second multilateration access request message on the random access channel (RACH) will be able to determine the MTA Reference ID Low (4 least significant bits of the 16 bit MTA Reference ID), the MTA Reference ID High (12 most significant bits of the 16 bit MTA Reference ID), and the MS Sync Accuracy of the valid MS.The bandit MS can assume it has detected a matching pair of first and second multilateration access request messages on the random access channel (RACH) if both the first and second multilateration access messages have the same value for the MTA Reference ID Low parameter (4 least significant bits of the 16 bit MTA Reference ID).The bandit MS can then re-select to one or more neighbour cells and send a first and a second multilateration access request message on the random access channel (RACH) and include the same MTA Reference ID Low and MTA Reference ID High parameters as sent by the valid MS but will include a misleading MS Transmission Offset value, thereby causing the serving BSS/BTS to estimate a substantially inaccurate timing advance value for the MS corresponding to the MTA Reference ID.The BSS/BTS does not know it has estimated a timing advance value for a bandit MS and so it sends the SMLC a report containing what can be a substantially inaccurate timing advance value for the MS corresponding to the received MTA Reference ID.The SMLC then uses this substantially inaccurate timing advance value when estimating the position of the corresponding MS thereby resulting in an estimated position that can have substantially degraded accuracy.

In view of the foregoing, it can be seen there is a need to address the aforementioned problems in the state-of-the art associated with the MTA procedure. The present disclosure addresses at least these problems.

SUMMARY

A positioning node (e.g., SMLC), a RAN node (BSS/BTS), a wireless device (e.g., MS) and various methods for addressing the aforementioned problems are described in the independent claims. Advantageous embodiments of the positioning node, the RAN node, the wireless device, and various methods are further described in the dependent claims.

In one aspect, the present disclosure provides a positioning node configured to interact with a RAN node and a wireless device. The positioning node comprises a processor and a memory that stores processor-executable instructions, wherein the processor interfaces with the memory to execute the processor-executable instructions, whereby the positioning node is operable to perform a transmit operation, a receive operation, a validate operation, and a calculate operation. In the transmit operation, the positioning node transmits, through the RAN node to the wireless device, a RRLP Multilateration Timing Advance Request message comprising at least one identifier and indicating a type of MTA procedure that is to be performed by the wireless device. In the receive operation, the positioning node receives, from the RAN node, timing advance information associated with the wireless device in a cell for which the MTA procedure has been performed, and one identifier corresponding to one of the at least one identifier within the RRLP Multilateration Timing Advance Request message, wherein the identifier corresponds to the cell in which the MTA procedure is performed. In the validate operation, the positioning node validates the timing advance information using the received identifier. In the calculate operation, the positioning node calculates a position of the wireless device using at least the validated timing advance information (note: the positioning node can calculate a position of the wireless device using multiple instances of validated timing advance information wherein each validated instance corresponds to a specific cell in which the wireless device has performed the MTA procedure). An advantage of the positioning node performing these operations is to reduce the possibility of a bandit wireless device triggering the RAN node to generate false timing advance information associated with the wireless device and report the false timing advance information to the positioning node which could lead the positioning node to estimate with degraded accuracy a position of the wireless device.

In another aspect, the present disclosure provides a method implemented by a positioning node configured to interact with a RAN node and a wireless device. The method comprises a transmitting step, a receiving step, a validating step, and a calculating step. In the transmitting step, the positioning node transmits, through the RAN node to the wireless device, a RRLP Multilateration Timing Advance Request message comprising at least one identifier and indicating a type of MTA procedure that is to be performed by the wireless device. In the receiving step, the positioning node receives, from the RAN node, timing advance information associated with the wireless device in a cell for which the MTA procedure has been performed, and one identifier corresponding to one of the at least one identifier within the RRLP Multilateration Timing Advance Request message, wherein the identifier corresponds to the cell in which the MTA procedure is performed. In the validating step, the positioning node validates the timing advance information using the received identifier. In the calculating step, the positioning node calculates a position of the wireless device using at least the validated timing advance information (note: the positioning node can calculate a position of the wireless device using multiple instances of validated timing advance information wherein each validated instance corresponds to a specific cell in which the wireless device has performed the MTA procedure). An advantage of the positioning node performing these steps is to reduce the possibility of a bandit wireless device triggering the RAN node to generate false timing advance information associated with the wireless device and report the false timing advance information to the positioning node which could lead the positioning node to estimate with degraded accuracy a position of the wireless device.

In one aspect, the present disclosure provides a RAN node configured to interact with a positioning node and a wireless device. The RAN node comprises a processor and a memory that stores processor-executable instructions, wherein the processor interfaces with the memory to execute the processor-executable instructions, whereby the RAN node is operable to perform a forward operation, a receive operation, a determine operation, and a transmit operation. In the forward operation, the RAN node forwards a RRLP Multilateration Timing Advance Request message received from the positioning node to the wireless device, wherein the RRLP Multilateration Timing Advance Request message comprises at least one identifier and indicates a type of MTA procedure that is to be performed by the wireless device. In the receive operation, the RAN node receives, from the wireless device, at least a MS Sync Accuracy parameter, a MS Transmission Offset parameter, and one identifier corresponding to one of the at least one identifier within the RRLP Multilateration Timing Advance Request message, wherein the one identifier also corresponds to a cell in which the wireless device performed the MTA procedure. In the determine operation, the RAN node determines timing advance information using at least the MS Sync Accuracy parameter and the MS Transmission Offset parameter, wherein the timing advance information is associated with the wireless device (note: the timing advance information is associated with the wireless device operating in a cell for which it has performed the MTA procedure). In the transmit operation, the RAN node transmits, to the positioning node, the timing advance information and the one identifier associated with the wireless device. An advantage of the RAN node performing these operations is to reduce the possibility of a bandit wireless device triggering the RAN node to generate false timing advance information associated with the wireless device and report the false timing advance information to the positioning node which could lead the positioning node to estimate with degraded accuracy a position of the wireless device.

In another aspect, the present disclosure provides a method implemented by a RAN node configured to interact with a positioning node and a wireless device. The method comprises a forwarding step, a receiving step, a determining step, and a transmitting step. In the forwarding step, the RAN node forwards a RRLP Multilateration Timing Advance Request message received from the positioning node to the wireless device, wherein the RRLP Multilateration Timing Advance Request message comprises at least one identifier and indicates a type of MTA procedure that is to be performed by the wireless device. In the receiving step, the RAN node receives, from the wireless device, at least a MS Sync Accuracy parameter, a MS Transmission Offset parameter, and one identifier corresponding to one of the at least one identifier within the RRLP Multilateration Timing Advance Request message, wherein the one identifier also corresponds to the cell in which the wireless device performed the MTA procedure. In the determining step, the RAN node determines timing advance information using at least the MS Sync Accuracy parameter and the MS Transmission Offset parameter, wherein the timing advance information is associated with the wireless device (note: the timing advance information is associated with the wireless device operating in a cell for which it has performed the MTA procedure). In the transmitting step, the RAN node transmits, to the positioning node, the timing advance information and the one identifier associated with the wireless device. An advantage of the RAN node performing these steps is to reduce the possibility of a bandit wireless device triggering the RAN node to generate false timing advance information associated with the wireless device and report the false timing advance information to the positioning node which could lead the positioning node to estimate with degraded accuracy a position of the wireless device.

In one aspect, the present disclosure provides a wireless device configured to interact with a positioning node and a RAN node. The wireless device comprises a processor and a memory that stores processor-executable instructions, wherein the processor interfaces with the memory to execute the processor-executable instructions, whereby the wireless device is operable to perform a receive operation, a perform operation, and a transmit operation. In the receive operation, the wireless device receives, from the positioning node through the RAN node, a RRLP Multilateration Timing Advance Request message comprising at least one identifier and indicating a type of MTA procedure that is to be performed by the wireless device. In the perform operation, the wireless device performs the MTA procedure to obtain a MS Sync Accuracy parameter and a MS Transmission Offset parameter. In the transmit operation, the wireless device transmits, to the RAN node, at least the MS Sync Accuracy parameter, the MS Transmission Offset parameter, and one identifier corresponding to one of the at least one identifier within the RRLP Multilateration Timing Advance Request message, wherein the identifier also corresponds to a cell in which the wireless device has performed the MTA procedure. An advantage of the wireless device performing these operations is to reduce the possibility of a bandit wireless device triggering the RAN node to generate false timing advance information associated with the wireless device and report the false timing advance information to the positioning node which could lead the positioning node to estimate with degraded accuracy a position of the wireless device.

In another aspect, the present disclosure provides a method implemented by a wireless device configured to interact with a positioning node and a RAN node. The method comprises a receiving step, a performing step, and a transmitting step. In the receiving step, the wireless device receives, from the positioning node through the RAN node, a RRLP Multilateration Timing Advance Request message comprising at least one identifier and indicating a type of MTA procedure that is to be performed by the wireless device. In the performing step, the wireless device performs the MTA procedure to obtain a MS Sync Accuracy parameter and a MS Transmission Offset parameter. In the transmitting step, the wireless device transmits, to the RAN node, at least the MS Sync Accuracy parameter, the MS Transmission Offset parameter, and one identifier corresponding to one of the at least one identifier within the RRLP Multilateration Timing Advance Request message, wherein the identifier also corresponds to a cell in which the wireless device has performed the MTA procedure. An advantage of the wireless device performing these steps is to reduce the possibility of a bandit wireless device triggering the RAN node to generate false timing advance information associated with the wireless device and report the false timing advance information to the positioning node which could lead the positioning node to estimate with degraded accuracy a position of the wireless device.

Additional aspects of the present disclosure will be set forth, in part, in the detailed description, figures and any claims which follow, and in part will be derived from the detailed description, or can be learned by practice of the invention. It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure.

DETAILED DESCRIPTION

A discussion is first provided herein to describe an exemplary wireless communication network that includes a CN node (e.g., SGSN), multiple RAN nodes (e.g., BSSs/BTSs), a positioning node (e.g., SMLC), and multiple wireless devices (e.g., mobile stations) which are configured in accordance with different embodiments of the present disclosure (seeFIG. 1). Then, a discussion is provided to disclose various embodiments of the present disclosure as to how the positioning node, the RAN node, and the wireless device can implement procedures and corresponding modified or new messages/information elements/fields to reduce the possibility of a bandit (e.g., invalid or unauthorized) wireless device triggering the RAN node to generate false timing advance (TA) information associated with the wireless device and report the false TA information to the positioning node which leads the positioning node to estimate with degraded accuracy a position of the wireless device (seeFIGS. 2A-2C). Thereafter, a discussion is provided to explain the basic functionalities-configurations of the positioning node, the RAN node, and the wireless device in accordance with different embodiments of the present disclosure (seeFIGS. 3-8).

Exemplary Wireless Communication Network100

Referring toFIG. 1, there is illustrated an exemplary wireless communication network100in accordance with the present disclosure. The wireless communication network100includes a core network106(which comprises at least one CN node107) and multiple RAN nodes1021and1022(only two shown) which interface with multiple wireless devices1041,1042,1043. . .104n. The wireless communication network100also includes many well-known components, but for clarity, only the components needed to describe the features of the present disclosure are described herein. Further, the wireless communication network100is described herein as being a GSM/EGPRS wireless communication network100which is also known as an EDGE wireless communication network100. However, those skilled in the art will readily appreciate that the techniques of the present disclosure which are applied to the GSM/EGPRS wireless communication network100are generally applicable to other types of wireless communication systems, including, for example, WCDMA, LTE, and WiMAX systems.

The wireless communication network100includes the RAN nodes1021and1022(wireless access nodes—only two shown) which provide network access to the wireless devices1041,1042,1043. . .104n. In this example, the RAN node1021(e.g., BSS/BTS1021) is providing network access to wireless device1041while the RAN node1022(e.g., BSS/BTS1022) is providing network access to wireless devices1042,1043. . .104n. The RAN nodes1021and1022are connected to the core network106(e.g., SGSN core network106) and, in particular, to the CN node107(e.g., SGSN107). The core network106is connected to an external packet data network (PDN)108, such as the Internet, and a server110(only one shown). The wireless devices1041,1042,1043. . .104nmay communicate with one or more servers110(only one shown) connected to the core network106and/or the PDN108. In this example, the RAN nodes1021and1022are all connected to a positioning node150(e.g., Serving Mobile Location Center150).

The wireless devices1041,1042,1043. . .104nmay refer generally to an end terminal (user) that attaches to the wireless communication network100, and may refer to either a MTC device (e.g., a smart meter) or a non-MTC device. Further, the term “wireless device” is generally intended to be synonymous with the term mobile device, mobile station (MS). “User Equipment,” or UE, as that term is used by 3GPP, and includes standalone wireless devices, such as terminals, cell phones, smart phones, tablets, cellular IoT devices, IoT devices, and wireless-equipped personal digital assistants, as well as wireless cards or modules that are designed for attachment to or insertion into another electronic device, such as a personal computer, electrical meter, etc.

Likewise, unless the context clearly indicates otherwise, the term RAN node1021and1022(wireless access node1021and1022) is used herein in the most general sense to refer to a base station, a wireless access node, or a wireless access point in a wireless communication network100, and may refer to RAN nodes1021and1022that are controlled by a physically distinct radio network controller as well as to more autonomous access points, such as the so-called evolved Node Bs (eNodeBs) in Long-Term Evolution (LTE) networks.

Each wireless device1041,1042,1043. . .104nmay include a transceiver circuit1101,1102,1103. . .110nfor communicating with the RAN nodes1021and1022, and a processing circuit1121,1122,1123. . .112nfor processing signals transmitted from and received by the transceiver circuit1101,1102,1103. . .110nand for controlling the operation of the corresponding wireless device1041,1042,1043. . .104n. The transceiver circuit1101,1102,1103. . .110nmay include a transmitter1141,1142,1143. . .114nand a receiver1161,1162,1163. . .116n, which may operate according to any standard, e.g., the GSM/EDGE standard. The processing circuit1121,1122,1123. . .112nmay include a processor1181,1182,1183. . .118nand a memory1201,1202,1203. . .120nfor storing program code for controlling the operation of the corresponding wireless device1041,1042,1043. . .104n. The program code may include code for performing the procedures as described hereinafter.

Each RAN node1021and1022(wireless access node1021and1022) may include a transceiver circuit1221and1222for communicating with wireless devices1041,1042,1043. . .104n, a processing circuit1241and1242for processing signals transmitted from and received by the transceiver circuit1221and1222and for controlling the operation of the corresponding RAN node1021and1022, and a network interface1261and1262for communicating with the core network106. The transceiver circuit1221and1222may include a transmitter1281and1282and a receiver1301and3102, which may operate according to any standard, e.g., the GSM/EDGE standard. The processing circuit1241and1242may include a processor1321and122, and a memory1341and1142for storing program code for controlling the operation of the corresponding RAN node1021and1022. The program code may include code for performing the procedures as described hereinafter.

The CN node107(e.g., SGSN107, MME107) may include a transceiver circuit136for communicating with one or more RAN nodes, e.g., the RAN nodes1021and1022, a processing circuit138for processing signals transmitted from and received by the transceiver circuit136and for controlling the operation of the CN node107, and a network interface140for communicating with one or more RAN nodes, e.g., the RAN nodes1021and1022. The transceiver circuit136may include a transmitter142and a receiver144, which may operate according to any standard, e.g., the GSM/EDGE standard. The processing circuit138may include a processor146and a memory148for storing program code for controlling the operation of the CN node107.

Techniques for Ensuring Bandit Wireless Device Does Not Cause False TA to be Sent to Positioning Node

The present disclosure addresses the problems of the state-of-the-art as described above in the Background Section. More specifically, the present disclosure addresses the problems of the state-of-the-art by configuring the positioning node150(e.g., SMLC150), the RAN node1021(e.g., BSS/BTS1021) (for example), and the wireless device1041(for example) to implement procedures and corresponding modified or new messages/information elements/fields to reduce the possibility of a bandit wireless device1042(for example) triggering the RAN node1021to generate false TA information associated with the wireless device1041and report the false TA information to the positioning node150which leads the positioning node150to estimate with degraded accuracy a position of the wireless device1041. A detailed discussion is provided below to describe several different ways that the positioning node150, the RAN node1021, and the wireless device1041can address the problems of the state-of-the-art.

Solutions for the RLC Data Block Method:

In a first embodiment of the present disclosure, the objective of reducing the possibility of a bandit wireless device1042(for example) from triggering the RAN node1021(e.g., BSS/BTS1021) (for example) to generate false timing advance (TA) information and report the false TA information to the positioning node150(e.g., SMLC150) is achieved through the introduction of identifier(s)200a,200b,200cwhich are securely delivered to the valid wireless device1041in a triggering RRLP Multilateration Timing Advance Request message202, where the identifier(s)200a,200b,200ccan subsequently be used by the positioning node150to link reports203received from the serving RAN node1021to the valid wireless device1041and the associated instance of the MTA procedure. More specifically, the following improvements can be made for the RLC Data Block method when selected by the positioning node150:The positioning node150can include a cell specific “Random ID” parameter200a(e.g., 8 bits long) having a value randomly, or by other means, generated by the positioning node150for each cell for which it provides assistance information within the RRLP Multilateration Timing Advance Request message200(seeFIGS. 2A-2Cwhich illustrate a MTA method information element (including the Random ID parameter200a) of the RRLP Multilateration Timing Advance Request message202).When using a cell identified by assistance information to perform MTA using the RLC Data Block method, the wireless device1041would include the corresponding cell specific “Random ID” value200aas part of the information carried by the RLC Data Block204.The positioning node150may also include a “Spare Random ID” parameter200bthat does not correspond to a cell for which it provides cell specific assistance information (seeFIGS. 2A-2Cwhich illustrate a MTA method information element (including the Spare Random ID parameter200b) in the RRLP Multilateration Timing Advance Request message202). Alternatively, the positioning node150may provide the wireless device1041with a set of “Spare Random ID” values200cto be used in cells that do not correspond to a cell for which it provides cell specific assistance information. The set of “Spare Random ID” values200cmay e.g., consist of or comprise 5 “Spare Random ID” values200cwherein each Spare Random ID value200cis used only once by the wireless device1041when performing a MTA procedure and is reported as part of the information carried by the RLC Data Block204(seeFIGS. 2A-2Cwhich illustrate a MTA method information element (including the set of Spare Random ID values200c) of the RRLP Multilateration Timing Advance Request message202).The use of “Spare Random ID” parameter(s)200b,200callows the wireless device1041to select a cell (for which cell specific assistance information is not provided) and perform the MTA procedure therein and still include the “Spare Random ID” parameter200b,200c(originally received as non-cell specific information within the assistance information of the RRLP Multilateration Timing Advance Request message200) as the “Random ID” parameter200b,200cin the RLC Data Block204.Upon receiving the RLC Data Block204, the RAN node1021forwards the “Random ID” parameter200a,200b,200calong with the timing advance information230in report203to the positioning node150, thereby allowing the positioning node150to confirm the validity of the reported timing advance information for the corresponding cell.

The following is a more detailed step-by-step description of the improved RLC Data Block method per the first embodiment of the present disclosure:The positioning node150triggers the MTA procedure for a valid wireless device1041(for example) by sending a RRLP Multilateration Timing Advance Request message202to the valid wireless device1041indicating that the RLC Data Block method is to be used. Per the first embodiment of the present disclosure, the positioning node150includes any one of the “Random ID” parameter(s)200a,200b,200cin the RRLP Multilateration Timing Advance Request message202. The RRLP Multilateration Timing Advance Request message202is forwarded by the RAN node1021to the wireless device1041.The wireless device1041upon receipt of the RRLP Multilateration Timing Advance Request message202proceeds to perform the RLC Data Block method of the MTA procedure in a cell thereby allowing the RAN node1021to acquire corresponding timing advance information. In particular, the wireless device1041upon receipt of the RRLP Multilateration Timing Advance Request message202performs the specified MTA procedure and sends a multilateration access request message206on the random access channel (RACH) followed by establishing an uplink Temporary Block Flow (TBF) for the transfer of a RLC data block204. The RLC data block204sent by the wireless device1041includes a Temporary Logical Link Identifier (TLLI)270, a MS Sync Accuracy parameter272, a MS Transmission Offset parameter274, and a “Random ID” parameter200a,200b, or200c, wherein the “Random ID” parameter200a,200b, or200cindicated corresponds to the cell in which the wireless device1041performed the MTA procedure (note: this “Random ID” parameter200a,200b, or200cwas obtained by the wireless device1041from the RRLP Multilateration Timing Advance Request message202).The RAN node1021upon receiving the RLC data block204sent by the wireless device1041will estimate a timing advance information230for the wireless device1041in the corresponding cell.The RAN node1021sends the positioning node150a report203containing the timing advance information230along with the “Random ID” parameter200a,200b, or200cobtained from the RLC data block204.The positioning node150upon receiving the report203uses the “Random ID” parameter200a,200b, or200cto confirm the validity of the reported timing advance information230for the corresponding cell. Note: the wireless terminal1041performs the MTA process in other cells (neighbor cells or even the serving cell which are all managed by the same serving RAN node1021) and sends corresponding RLC data blocks204(each including a “Random ID” parameter200a,200b, or200c) to the RAN node1021as described above. In the event, the wireless device1041decides to perform the MTA procedure using a cell not managed by the serving RAN node1021(e.g., a cell managed by RAN node1022) then the non-serving RAN node1022will forward the information in a RLC data block204received from the wireless terminal1041in that cell to the serving RAN node1021.
Solutions for Enhanced Access Burst Method:

In a second embodiment, the objective of reducing the possibility of a bandit wireless device1042(for example) from triggering the RAN node1021(e.g., BSS/BTS1021) (for example) to generate false timing advance (TA) information and report the false TA information to the positioning node150(e.g., SMLC150) is achieved through the introduction of another set of identifier(s)200d,200e,200f,200g, securely delivered to the valid wireless device1041in a triggering RRLP Multilateration Timing Advance Request message202, where the identifier(s)200d,200e,200f,200gcan subsequently be used by the positioning node150to link reports203received from the serving RAN node1021to the valid wireless device1041and the associated instance of the MTA procedure. More specifically, the following improvements can be made for the Extended Access Burst method when selected by the positioning node150:The positioning node150can include a cell specific “Mini Random ID” parameter200d(e.g., 3 bits long) having a value randomly, or by other means, generated by the positioning node150for each cell for which it provides assistance information within the RRLP Multilateration Timing Advance Request message202(seeFIGS. 2A-2Cwhich illustrate a MTA method information element (including the Mini Random ID parameter200d) of the RRLP Multilateration Timing Advance Request message202). The number of bits used for this parameter will be determined by the available payload space within the first and second multilateration access request messages220and222subsequently sent by a wireless device1041(for example) using the Extended Access Burst method.When using a cell identified by assistance information to perform MTA using the Extended Access Burst method, the wireless device1041(for example) would include the corresponding “Mini Random ID” parameter200das part of the payload carried within the second multilateration access request message222also referred to as the Extended Access Burst.The positioning node150may also include a “Mini Spare Random ID” parameter200ethat does not correspond to a cell for which it provides cell specific assistance information (seeFIGS. 2A-2Cwhich illustrate a MTA method information element (including the Mini Spare Random ID parameter200e) in the RRLP Multilateration Timing Advance Request message202). Alternatively, the positioning node150may provide the wireless device1041with a set of “Mini Spare Random ID” parameters200fto be used in cells that do not correspond to a cell for which it provides cell specific assistance information (seeFIGS. 2A-2Cwhich illustrate a MTA method information element (including the set of Mini Random ID parameters200f) of the RRLP Multilateration Timing Advance Request message202). The set of “Mini Spare Random ID” parameters200fmay e.g., consist of or comprise five “Mini Spare Random ID” parameters wherein each value is used only once by the wireless device1041when performing a MTA procedure and is reported as part of the information carried by the second multilateration access request message222.The use of the “Mini Spare Random ID” parameter(s)200e,200fallows the wireless device1041to select a cell (for which cell specific assistance information is not provided) and perform the MTA procedure therein and still include a “Mini Spare Random ID” parameter200e,200f(originally received as non-cell specific information within the assistance information of the RRLP Multilateration Timing Advance Request message200) as the “Mini Random ID” parameter200e,200fin the second multilateration access request message222.Alternatively, a single sufficiently unique identifier200g(e.g., 3 bits as in the discussion above), generated by the positioning node105, can be used both in cells for which assistance information is provided in the triggering RRLP Multilateration Timing Advance Request message200as well as in cells selected autonomously by the wireless device1041(seeFIGS. 2A-2Cwhich illustrate a MTA method information element (including the unique identifier parameter200g) in the RRLP Multilateration Timing Advance Request message202). In both of these cases, the positioning node150will be able to use the single sufficiently unique identifier200gto confirm the validity of the reported timing advance value.Upon receiving the first and second multilateration access request messages220and223, the RAN node1021forwards the “Mini Random ID” parameter200d,200e,200f, or200g(along with the timing advance information230) in report203to the positioning node105, thereby allowing the positioning node150to confirm the validity of the reported timing advance information for the corresponding cell.

The following is a more detailed step-by-step description of the improved Extended Access Burst method per the second embodiment of the present disclosure:The positioning node150triggers the MTA procedure for a valid wireless device1041(for example) by sending a RRLP Multilateration Timing Advance Request message202to the valid wireless device1041indicating the Extended Access Burst method is to be used. Per the second embodiment of the present disclosure, the positioning node150includes any one of the “Mini Random ID” parameter(s)200d,200e,200f,200gin the RRLP Multilateration Timing Advance Request message202. The RRLP Multilateration Timing Advance Request message202is forwarded by the RAN node1021to the wireless device1041.The wireless device1041upon receipt of the RRLP Multilateration Timing Advance Request message202proceeds to perform the Extended Access Burst method of the MTA procedure in a cell thereby allowing the RAN node1021to acquire corresponding timing advance information230. In particular, the wireless device1041upon receipt of the RRLP Multilateration Timing Advance Request message202performs the specified MTA procedure and sends a first multilateration access request message220on the random access channel (RACH) using an Access Burst followed by sending a second multilateration access request message222on the random access channel (RACH) using a Normal Burst. The payload within the first multilateration access request message220includes a MS Transmission Offset parameter274. The payload with the second multilateration access request message222includes the MS Sync Accuracy272and the “Mini Random ID” parameter200d,200e,200f,200g, where the “Mini Random ID” parameter200d,200e,200f,200gindicated corresponds to the cell in which the wireless device1041performed the MTA procedure.The RAN node1021upon receiving the first and second multilateration access request messages220and222sent by the wireless device1041will estimate a timing advance information230for the wireless device1041.The RAN node1021sends the positioning node150a report203containing the timing advance information230along with the “Mini Random ID” parameter200d,200e,200f, or200gobtained from the second multilateration access request message222.The positioning node150upon receiving the report203uses the “Mini Random ID” parameter200d,200e,200f, or200gto confirm the validity of the reported timing advance information230for the corresponding MTA Reference ID. Note: the wireless terminal1041performs the MTA process in other cells (neighbor cells or even the serving cell which are all managed by the same serving RAN node1021) and sends the corresponding first and second multilateration access request messages220and222to the RAN node1021as described above. In the event, the wireless device1041decides to perform the MTA procedure using a cell not managed by the serving RAN node1021(e.g. a cell managed by RAN node1022) then the non-serving RAN node1022will forward the information in the first and second multilateration access request messages220and222received from the wireless terminal1041in that cell to the serving RAN node1021.
Basic Functionalities-Configurations of Positioning Node150, Wireless Device1041(For Example) and RAN Node1021(For Example)

Referring toFIG. 3, there is a flowchart of a method300implemented in the positioning node150(e.g., SMLC150) configured to interact with the RAN node1021(e.g., BSS/BTS1021) and the wireless device1041. At step302, the positioning node150transmits, through the RAN node1021to the wireless device1041, a RRLP Multilateration Timing Advance Request message202comprising at least one identifier200a,200b,200c,200d,200e,200f,200gand indicating a type of MTA procedure that is to be performed by the wireless device1041(see discussion below regarding the different types of MTA procedures and the different types of identifiers200a,200b,200c,200d,200e,200f,200g). At step304, the positioning node150receives, from the RAN node1021, timing advance information230associated with the wireless device1041in a cell for which the MTA procedure has been performed, and one identifier200a,200b,200c,200d,200e,200for200gcorresponding to one of the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202, wherein the identifier200a,200b,200c,200d,200e,200for200gcorresponds to the cell in which the wireless device1041performed the MTA procedure. At step306, the positioning node150validates the timing advance information230using the received identifier200a,200b,200c,200d,200e,200f, or200g. At step308, the positioning node150calculates a position of the wireless device1041using at least the validated timing advance information230(note: the positioning node150can calculate a position of the wireless device1041using multiple instances of validated timing advance information230wherein each validated instance corresponds to a specific cell in which the wireless device1041has performed the MTA procedure). In one embodiment, the RRLP Multilateration Timing Advance Request message202indicates that the type of MTA procedure is a RLC Data Block method, and the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202comprises: a cell specific Random ID parameter200afor each cell that the RRLP Multilateration Timing Advance Request message202provides cell specific assistance information; and a Spare Random ID parameter200bor a set of Spare Random ID parameters200cwhich do not correspond to a cell identified in the RRLP Multilateration Timing Advance Request message202. In another embodiment, the RRLP Multilateration Timing Advance Request message202indicates that the type of MTA procedure is an Extended Access Burst method, and the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202comprises: a cell specific Mini Random ID parameter200dfor each cell that the RRLP Multilateration Timing Advance Request message202provides cell specific assistance information; and a Mini Spare Random ID parameter200eor a set of Mini Spare Random ID parameters200fwhich do not correspond to a cell identified in the RRLP Multilateration Timing Advance Request message202. In yet another embodiment, the RRLP Multilateration Timing Advance Request message202indicates that the type of MTA procedure is an Extended Access Burst method, and the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202comprises a unique identifier200gfor cells that are and are not identified in the RRLP Multilateration Timing Advance Request message202.

Referring toFIG. 4, there is a block diagram illustrating structures of an exemplary positioning node150(e.g., SMLC150) configured in accordance with an embodiment of the present disclosure. In one embodiment, the positioning node150comprises a transmit module402, a receive module404, a validate module406, and a calculate module408. The transmit module402is configured to transmit, through the RAN node1021to the wireless device1041, a RRLP Multilateration Timing Advance Request message202comprising at least one identifier200a,200b,200c,200d,200e,200f,200gand indicating a type of MTA procedure that is to be performed by the wireless device1041(see discussion above regarding the different types of MTA procedures and the different types of identifiers200a,200b,200c,200d,200e,200f,200g). The receive module404is configured to receive, from the RAN node1021, timing advance information230associated with the wireless device1041in a cell for which the MTA procedure has been performed, and one identifier200a,200b,200c,200d,200e,200for200gcorresponding to one of the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202, wherein the identifier200a,200b,200c,200d,200e,200for200gcorresponds to the cell in which the wireless device1041performed the MTA procedure. The validate module406is configured to validate the timing advance information230using the received identifier200a,200b,200c,200d,200e,200f, or200g. The calculate module408is configured to calculate a position of the wireless device1041using at least the validated timing advance information230(note: the calculate module408can calculate a position of the wireless device1041using multiple instances of validated timing advance information230wherein each validated instance corresponds to a specific cell in which the wireless device1041has performed the MTA procedure). In addition, it should be noted that the positioning node150may also include other components, modules or structures which are well-known, but for clarity, only the components, modules or structures needed to describe the features of the present disclosure are described herein.

As those skilled in the art will appreciate, the above-described modules402,404,406, and408of the positioning node150may be implemented as suitable dedicated circuit. Further, the modules402,404,406, and408can also be implemented using any number of dedicated circuits through functional combination or separation. In some embodiments, the modules402,404,406, and408may be even combined in a single application specific integrated circuit (ASIC). As an alternative software-based implementation, the positioning node150may comprise a memory164, a processor162(including but not limited to a microprocessor, a microcontroller or a Digital Signal Processor (DSP), etc.) and a transceiver166. The memory164stores machine-readable program code executable by the processor162to cause the positioning node150to perform the steps of the above-described method300. Referring toFIG. 5, there is a flowchart of a method500implemented in the RAN node1021(e.g., BSS/BTS1021) which is configured to interact with a positioning node150(e.g., SMLC150) and a wireless device1041in accordance with an embodiment of the present disclosure. At step502, the RAN node1021forwards a RRLP Multilateration Timing Advance Request message202received from the positioning node150to the wireless device1041, wherein the RRLP Multilateration Timing Advance Request message202comprises at least one identifier200a,200b,200c,200d,200e,200f,200gand indicates a type of MTA procedure that is to be performed by the wireless device1041(see discussion above regarding the different types of MTA procedures and the different types of identifiers200a,200b,200c,200d,200e,200f,200g). At step504, the RAN node1021receives, from the wireless device1041, at least a Mobile Station (MS) Sync Accuracy parameter272, a MS Transmission Offset parameter274, and one identifier200a,200b,200c,200d,200e,200for200gcorresponding to one of the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202, wherein the one identifier200a,200b,200c,200d,200e,200f, or200galso corresponds to the cell in which the wireless device1041performed the MTA procedure (note 1: when the type of MTA procedure is the RLC Data Block method then a Temporary Logical Link Identifier (TLLI)270, the MS Sync Accuracy parameter272, the MS Transmission Offset parameter274, and the one identifier200a,200b, or200care received from the wireless device1041in a RLC Data Block204) (note 2: when the type of MTA procedure is the Extended Access Burst method then the MS Transmission Offset parameter274is received from the wireless device1041in a first multilateration access request message220, and the MS Sync Accuracy parameter272, and the one identifier200d,200e,200f, or200g, are received from the wireless device1041in a second multilateration message222). At step506, the RAN node1021determines timing advance information230using at least the MS Sync Accuracy parameter272and the MS Transmission Offset parameter274, wherein the timing advance information230is associated with the wireless device1041. At step508, the RAN node1021transmits, to the positioning node150, the timing advance information230and the one identifier200a,200b,200c,200d,200e,200f, or200gassociated with the wireless device1041, wherein the identifier200a,200b,200c,200d,200e,200f, or200gcorresponds to the cell in which the wireless device1041performed the MTA procedure.

Referring toFIG. 6, there is a block diagram illustrating structures of an exemplary RAN node1021configured in accordance with an embodiment of the present disclosure. In one embodiment, the RAN node1021comprises a forward module602, a receive module604, a determine module606, and a transmit module608. The forward module602is configured to forward a RRLP Multilateration Timing Advance Request message202received from the positioning node150to the wireless device1041, wherein the RRLP Multilateration Timing Advance Request message202comprises at least one identifier200a,200b,200c,200d,200e,200f,200gand indicates a type of MTA procedure that is to be performed by the wireless device1041(see discussion above regarding the different types of MTA procedures and the different types of identifiers200a,200b,200c,200d,200e,200f,200g). The receive module604is configured to receive, from the wireless device1041, at least a Mobile Station (MS) Sync Accuracy parameter272, a MS Transmission Offset parameter274, and one identifier200a,200b,200c,200d,200e,200for200gcorresponding to one of the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202, wherein the one identifier200a,200b,200c,200d,200e,200f, or200galso corresponds to the cell in which the wireless device1041performed the MTA procedure (note 1: when the type of MTA procedure is the RLC Data Block method then a Temporary Logical Link Identifier (TLLI)270, the MS Sync Accuracy parameter272, the MS Transmission Offset parameter274, and the one identifier200a,200b, or200care received from the wireless device1041in a RLC Data Block204) (note 2: when the type of MTA procedure is the Extended Access Burst method then the MS Transmission Offset parameter274is received from the wireless device1041in a first multilateration access request message220, and the MS Sync Accuracy parameter272, and the one identifier200d,200e,200f, or200g, are received from the wireless device1041in a second multilateration message222). The determine module606is configured to determine timing advance information230using at least the MS Sync Accuracy parameter272and the MS Transmission Offset parameter274, wherein the timing advance information230is associated with the wireless device1041. The transmit module608is configured to transmit, to the positioning node150, the timing advance information230and the one identifier200a,200b,200c,200d,200e,200f, or200gassociated with the wireless device1041, wherein the identifier200a,200b,200c,200d,200e,200f, or200gcorresponds to the cell in which the wireless device1041performed the MTA procedure. In addition, it should be noted that the RAN node1021may also include other components, modules or structures which are well-known, but for clarity, only the components, modules or structures needed to describe the features of the present disclosure are described herein.

As those skilled in the art will appreciate, the above-described modules602,604,608, and610of the RAN node1021may be implemented as suitable dedicated circuit. Further, the modules602,604,608, and610can also be implemented using any number of dedicated circuits through functional combination or separation. In some embodiments, the modules602,604,608, and610may be even combined in a single application specific integrated circuit (ASIC). As an alternative software-based implementation, the RAN node1021may comprise a memory1341, a processor1321(including but not limited to a microprocessor, a microcontroller or a Digital Signal Processor (DSP), etc.) and a transceiver1221. The memory1341stores machine-readable program code executable by the processor1321to cause the RAN node1021to perform the steps of the above-described method500. Note: the other RAN node1022may be configured the same as RAN node1021.

Referring toFIG. 7, there is a flowchart of a method700implemented in the wireless device1041which is configured to interact with the positioning node150(e.g., SMLC150) and the RAN node1021(e.g., BSS/BTS1021) in accordance with an embodiment of the present disclosure. At step702, the wireless device1041receives, from the positioning node150through the RAN node1021, a RRLP Multilateration Timing Advance Request message202comprising at least one identifier200a,200b,200c,200d,200e,200f,200gand indicating a type of MTA procedure that is to be performed by the wireless device1041(see discussion above regarding the different types of MTA procedures and the different types of identifiers200a,200b,200c,200d,200e,200f,200g). At step704, the wireless device1041performs the MTA procedure to obtain a MS Sync Accuracy parameter272, and a MS Transmission Offset parameter274. At step706, the wireless device1041transmits, to the RAN node1021, at least the MS Synch Accuracy parameter272, the MS Transmission Offset parameter274, and one identifier200a,200b,200c,200d,200e,200f, or200gcorresponding to one of the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202, wherein the identifier200a,200b,200c,200d,200e,200f, or200gcorresponds to the cell in which the wireless device1041performed the MTA procedure (note 1: when the type of MTA procedure is the RLC Data Block method then a Temporary Logical Link Identifier (TLLI)270, the MS Sync Accuracy parameter272, the MS Transmission Offset parameter274, and the one identifier200a,200b, or200care transmitted from the wireless device1041in a RLC Data Block204) (note 2: when the type of MTA procedure is the Extended Access Burst method then the MS Transmission Offset parameter274is transmitted from the wireless device1041in a first multilateration access request message220, and the MS Sync Accuracy parameter272, and the one identifier200d,200e,200f, or200gare transmitted from the wireless device1041in a second multilateration message222).

Referring toFIG. 8, there is a block diagram illustrating structures of an exemplary wireless device1041configured in accordance with an embodiment of the present disclosure. In one embodiment, the wireless device1041comprises a receive module802, a perform module804, and a transmit module806. The receive module802is configured to receive, from the positioning node150through the RAN node1021, a RRLP Multilateration Timing Advance Request message202comprising at least one identifier200a,200b,200c,200d,200e,200f,200gand indicating a type of MTA procedure that is to be performed by the wireless device1041(see discussion above regarding the different types of MTA procedures and the different types of identifiers200a,200b,200c,200d,200e,200f,200g). The perform module804is configured to perform the MTA procedure to obtain a MS Sync Accuracy parameter272, and a MS Transmission Offset parameter274. The transmit module806is configured to transmit, to the RAN node1021, at least the MS Sync Accuracy parameter272, the MS Transmission Offset parameter274, and one identifier200a,200b,200c,200d,200e,200f, or200gcorresponding to one of the at least one identifier200a,200b,200c,200d,200e,200f,200gwithin the RRLP Multilateration Timing Advance Request message202, wherein the identifier200a,200b,200c,200d,200e,200f, or200gcorresponds to the cell in which the wireless device1041performed the MTA procedure (note 1: when the type of MTA procedure is the RLC Data Block method then a Temporary Logical Link Identifier (TLLI)270, the MS Synch Accuracy parameter272, the MS Transmission Offset parameter274, and the one identifier200a,200b, or200care transmitted from the wireless device1041in a RLC Data Block204) (note 2: when the type of MTA procedure is the Extended Access Burst method then the MS Transmission Offset parameter274is transmitted from the wireless device1041in a first multilateration access request message220, and the MS Sync Accuracy parameter272, and the one identifier200d,200e,200f, or200gare transmitted from the wireless device1041in a second multilateration message222). In addition, it should be noted that the wireless device1041may also include other components, modules or structures which are well-known, but for clarity, only the components, modules or structures needed to describe the features of the present disclosure are described herein.

As those skilled in the art will appreciate, the above-described modules802,804, and806of the wireless device1041may be implemented as suitable dedicated circuit. Further, the modules802,804, and806can also be implemented using any number of dedicated circuits through functional combination or separation. In some embodiments, the modules802,804, and806may be even combined in a single application specific integrated circuit (ASIC). As an alternative software-based implementation, the wireless device1041may comprise a memory1201, a processor1181(including but not limited to a microprocessor, a microcontroller or a Digital Signal Processor (DSP), etc.) and a transceiver1101. The memory1201stores machine-readable program code executable by the processor1181to cause the wireless device1041to perform the steps of the above-described method800. Note: the other wireless devices1042,1043. . .104n, may be configured the same as wireless device1041.

In view of the foregoing, it should be appreciated that embodiments described herein are illustrated by exemplary embodiments. It should also be appreciated that these embodiments are not mutually exclusive. That is, the components from one embodiment may be tacitly assumed to be present in another embodiment and it will be obvious to a person skilled in the art how those components may be used in the other exemplary embodiments.

Further, the embodiments described herein have been mainly exemplified with GSM/EDGE as the communications network100but generally they are applicable to other existing communications networks such as Narrow Band Internet of Things (NB-IoT) and enhanced Machine Type Communication (eMTC) or even to future networks such as 5G and next radio. The radio access node1021,1022has been exemplified with a BSS1021,1022, but generally it may be another radio access node serving the communication Evolved Node B (eNb) as well. For example for eMTC and NB-IoT the applicable radio access node1021,1022may also be an eNb. The communication (wireless) device1041,1042,1043. . .1044has been exemplified as a mobile station1041,1042,1043. . .1044, sometimes also referred to as the device. The positioning node150has been exemplified with an SMLC but it may also be an Evolved SMLC (E-SMLC) in the case of NB-IoT, eMTC and Long-Term Evolution (LTE).

It should furthermore be noted that, to anyone skilled in the art, there are several realizations of the embodiments described herein with principally equivalent functionality where e.g. introduced fields may be longer or shorter or coded in a different way. An objective of the embodiments herein is to introduce procedures and the corresponding needed modified or new messages/information elements/fields to reduce the possibility of a bandit wireless device1042(for example) triggering a RAN node1021(e.g., BSS/BTS1021) to generate false timing advance information and report the false timing advance information to the positioning node150(e.g., SMLC150) which could lead the positioning node150(e.g., SMLC150) to estimate with degraded accuracy a position of the valid wireless device1041(for example).

Those skilled in the art will appreciate that the use of the term “exemplary” is used herein to mean “illustrative,” or “serving as an example,” and is not intended to imply that a particular embodiment is preferred over another or that a particular feature is essential. Likewise, the terms “first” and “second,” and similar terms, are used simply to distinguish one particular instance of an item or feature from another, and do not indicate a particular order or arrangement, unless the context clearly indicates otherwise. Further, the term “step,” as used herein, is meant to be synonymous with “operation” or “action.” Any description herein of a sequence of steps does not imply that these operations must be carried out in a particular order, or even that these operations are carried out in any order at all, unless the context or the details of the described operation clearly indicates otherwise.

Of course, the present disclosure may be carried out in other specific ways than those herein set forth without departing from the scope and essential characteristics of the invention. One or more of the specific processes discussed above may be carried out in a cellular phone or other communications transceiver comprising one or more appropriately configured processing circuits, which may in some embodiments be embodied in one or more application-specific integrated circuits (ASICs). In some embodiments, these processing circuits may comprise one or more microprocessors, microcontrollers, and/or digital signal processors programmed with appropriate software and/or firmware to carry out one or more of the operations described above, or variants thereof. In some embodiments, these processing circuits may comprise customized hardware to carry out one or more of the functions described above. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive.

Although multiple embodiments of the present disclosure have been illustrated in the accompanying Drawings and described in the foregoing Detailed Description, it should be understood that the invention is not limited to the disclosed embodiments, but instead is also capable of numerous rearrangements, modifications and substitutions without departing from the present disclosure that has been set forth and defined within the following claims.