FIELD

[0001] The subject disclosure generally relates to wireless communication systems and more particularly, to wireless communication systems supporting user equipment (UE)-assisted detection of spoofing or inconsistency in timing. Yet more particularly, the subject disclosure contributes to time resiliency in 5G systems.

BACKGROUND

[0002] In Rel-17, the time synchronization framework within the 5G System (5GS) is planned to be extended. In particular, a more stand-alone 5GS time synchronization approach with or without the presence of an IEEE Time Sensitive Networking (TSN) is considered. To enable this wider and more flexible use of the 5GS for time synchronization, the 5GS is evolving to offer time synchronization as a service (i.e., expose time synchronization network capabilities, allow application to influence the time synchronization service, exchange of time sync capabilities between the UEs and the network, etc.).

[0003] For Rel-18, time synchronization in 5GS is progressing to offer time resilience as a service. However, potential requirements on the 5GS to support time-synchronization and the ability to act as a backup for Global Navigation Satellite System (GNSS) timing services have not yet been identified. The motivation is the dependency several services have on timing provided by GNSS (e.g., telecoms, finance, transportation, power, utility sector, banking, etc.). Smart grids rely on microsecond level time-stamping accuracy to reliably trouble-shoot and manage the power grid, today provided by GNSS. As another example, for financial markets it is essential to record each transaction with an accurate time stamp to comply with the regulatory requirements. Also, for the telecommunication industry, the operation of the cellular networks requires the reliable delivery of precision timing signals.

[0004] However, GNSS is not safe enough for mission critical services. GNSS time delivery may experience several vulnerabilities due to environmental phenomena, malicious or incidental interference, spoofing, adjacent band interference, etc. As a response to such concerns, backup solutions are required.

[0005] The 5GS, in combination with a timing resiliency solution leveraging both GNSS and fibre-based timing backup solutions, may serve as a global wireless timing resiliency solution for GNSS, and may also perform as a stand-alone and alternative time synchronization solution for the endpoints. That is, the 5GS in concert with other timing technologies may be used as a resilient timing source for end-users in complement/back-up/alternate to GNSS. The 5GS may be enhanced to enable time synchronization resiliency if GNSS or other timing services are compromised. [0006] Today’s solutions are based on GNSS (e.g., Global Positioning System, GPS) receivers including anti-spoofing technique. GPS spoofing detection is based on spatial processing (i.e., the use of an antenna array to receive a plurality of GPS signals is required) and thus relies on complex receivers.

[0007] Another solution is based on long holdover capabilities. This includes "Stratum 1" solutions, that are defined as a completely autonomous source of timing, which has no other input, other than e.g. a yearly calibration. The usual source of Stratum 1 timing is an atomic standard (Cesium Beam or Hydrogen Maser) or compensated reference oscillator (OCXO). Those solutions are very expensive and not suitable for integration into or close to radio sites.

SUMMARY

[0008] According to a first aspect, there may be provided a method to be performed by a user equipment (UE). The method comprises: receiving an indication from a network to command the UE to notify time inconsistency; obtaining first time information and second time information from different time sources; comparing the first time information and the second time information to determine a time difference; and responsive to determining the time difference, sending a report indicating the time difference to the network.

[0009] In some embodiments, the method further comprises receiving, from the network, a setup message for establishing connection to the network, the setup message including the indication to notify time inconsistency and information to configure sending the report.

[0010] In some embodiments, the method further comprises receiving, from the network, a system information block, the system information block being sent by the network and including the indication to notify time inconsistency and information to configure sending the report.

[0011] In some embodiments, the method further comprises receiving, from the network, a reconfiguration message for the connection to the network, the reconfiguration message including the indication to notify time inconsistency and information to configure sending the report.

[0012] In some embodiments of the method, the information to configure sending the report includes a threshold value and the time difference between the first and second time information is determined if the time difference exceeds the threshold value.

[0013] In some embodiments of the method, the information to configure sending the report includes a reporting frequency, and the report is sent to the network according to the reporting frequency.

[0014] In some embodiments of the method, the second time information is obtained, and the time difference is determined according to the reporting frequency.

[0015] In some embodiments of the method, obtaining first time information includes receiving timing information from the network and determining the first time information based on the timing information from the network. [0016] In some embodiments of the method, the timing information is included in a message from the network and/or a system information block sent by the network.

[0017] In some embodiments of the method, obtaining second time information includes receiving timing information from a global navigation satellite system and determining the second time information based on the timing information from the global navigation satellite system.

[0018] In some embodiments of the method, obtaining second time information includes receiving timing information from one or more neighboring networks and determining the second time information based on the timing information from the one or more neighboring networks.

[0019] In some embodiments, the method further comprises receiving, from the network, identification information about the one or more neighboring networks.

[0020] In some embodiments of the method, sending a report includes sending the report as part of at least one or more of a setup complete message, a reconfiguration complete message and a connection measurement signaling message.

[0021] In some embodiments of the method, the report includes one or more of the following: an indication that the time difference has been determined, the determined time difference between the first and second time information, the second time information, a timestamp at which the time difference was determined, and information about obtaining the second time information.

[0022] According to a second aspect, there may be provided a method to be performed by a network. The method comprises: sending an indication to a user equipment (UE) to command the UE to notify time inconsistency; receiving, from the UE, a report indicating a time difference between first time information and second time information from different time sources; and processing the report to determine time inconsistency in the network.

[0023] In some embodiments, the method further comprises sending, to the UE, a setup message for establishing connection to the network, the setup message including the indication to notify time inconsistency and information to configure sending the report by the UE.

[0024] In some embodiments, the method further comprises sending, to the UE, a system information block, the system information block including the indication to notify time inconsistency and information to configure sending the report by the UE.

[0025] In some embodiments, the method further comprises sending, to the UE, a reconfiguration message for the connection to the network, the reconfiguration message including the indication to notify time inconsistency and information to configure sending the report by the UE.

[0026] In some embodiments of the method, the information to configure sending the report includes a threshold value to configure the UE to determine if the time difference between the first and second time information exceeds the threshold value. [0027] In some embodiments of the method, the information to configure sending the report by the UE includes a reporting frequency to configure the UE to send the report according to the reporting frequency.

[0028] In some embodiments of the method, the reporting frequency is also to configure the UE to obtain the second time information and determine the time difference according to the reporting frequency.

[0029] In some embodiments, the method further comprises sending timing information to the UE, wherein the first time information is determined based on the timing information.

[0030] In some embodiments of the method, the timing information is included in a message and/or a system information block.

[0031] In some embodiments of the method, the second time information is determined based on timing information from a global navigation satellite system and/or from one or more neighboring networks.

[0032] In some embodiments, the method further comprises sending, to the UE, identification information about the one or more neighboring networks.

[0033] In some embodiments of the method, receiving a report includes receiving the report as part of at least one or more of a setup complete message, a reconfiguration complete message and a connection measurement signaling message.

[0034] In some embodiments of the method, the report includes one or more of the following: an indication that the time difference has been determined, the time difference between the first and second time information, the second time information, a timestamp at which the time difference was determined, and information about obtaining the second time information.

[0035] In some embodiments, the method further comprises receiving, from one or more UEs other than the UE, reports indicating time differences between first time information and second time information from different time sources, and processing the reports to determine the time inconsistency in the network.

[0036] In some embodiments, the method further comprises determining time inconsistency based on the report from the UE and/or the one or more UEs.

[0037] According to a third aspect, there may be provided a user equipment (UE) in a network. The UE comprises: at least one processor; and at least one memory including computer program code. The computer program code causes the UE, when executed with the at least one processor, to at least: receive an indication from the network to command the UE to notify time inconsistency; obtain first time information and second time information from different time sources; compare the first time information and the second time information to determine a time difference; and responsive to determining the time difference, send a report indicating the time difference to the network.

[0038] In some embodiments of the UE, the computer program code further causes the UE to at least receive, from the network, a setup message for establishing connection to the network, the setup message including the indication to notify time inconsistency and information to configure sending the report.

[0039] In some embodiments of the UE, the computer program code further causes the UE to at least receive, from the network, a system information block, the system information block being sent by the network and including the indication to notify time inconsistency and information to configure sending the report.

[0040] In some embodiments of the UE, the computer program code further causes the UE to at least receive, from the network, a reconfiguration message for the connection to the network, the reconfiguration message including the indication to notify time inconsistency and information to configure sending the report.

[0041] In some embodiments of the UE, the information to configure sending the report includes a threshold value and the time difference between the first and second time information is determined if the time difference exceeds the threshold value.

[0042] In some embodiments of the UE, the information to configure sending the report includes a reporting frequency, and the report is sent to the network according to the reporting frequency.

[0043] In some embodiments of the UE, the second time information is obtained, and the time difference is determined according to the reporting frequency.

[0044] In some embodiments of the UE, the computer program code causes the UE to at least receive timing information from the network and determine the first time information based on the timing information from the network.

[0045] In some embodiments of the UE, the timing information is included in a message from the network and/or a system information block sent by the network.

[0046] In some embodiments of the UE, the computer program code causes the UE to at least receive timing information from a global navigation satellite system and determine the second time information based on the timing information from the global navigation satellite system.

[0047] In some embodiments of the UE, the computer program code causes the UE to at least receive timing information from one or more neighboring networks and determine the second time information based on the timing information from the one or more neighboring networks.

[0048] In some embodiments of the UE, the computer program code further causes the UE to at least receive, from the network, identification information about the one or more neighboring networks.

[0049] In some embodiments of the UE, the computer program code causes the UE to at least send the report as part of at least one or more of a setup complete message, a reconfiguration complete message and a connection measurement signaling message.

[0050] In some embodiments of the UE, the report includes one or more of the following: an indication that the time difference has been determined, the determined time difference between the first and second time information, the second time information, a timestamp at which the time difference was determined, and information about obtaining the second time information.

[0051] According to a fourth aspect, there may be provided a base station in a network. The base station comprises: at least one processor; and at least one memory including computer program code. The computer program code causes the base station, when executed with the at least one processor, to at least: send an indication to a user equipment (UE) to command the UE to notify time inconsistency; receive, from the UE, a report indicating a time difference between first time information and second time information from different time sources; and process the report to determine time inconsistency in the network.

[0052] In some embodiments of the base station, the computer program code further causes the base station to at least send, to the UE, a setup message for establishing connection to the network, the setup message including the indication to notify time inconsistency and information to configure sending the report by the UE.

[0053] In some embodiments of the base station, the computer program code further causes the base station to at least send, to the UE, a system information block, the system information block including the indication to notify time inconsistency and information to configure sending the report by the UE.

[0054] In some embodiments of the base station, the computer program code further causes the base station to at least send, to the UE, a reconfiguration message for the connection to the network, the reconfiguration message including the indication to notify time inconsistency and information to configure sending the report by the UE.

[0055] In some embodiments of the base station, the information to configure sending the report by the UE includes a threshold value to configure the UE to determine if the time difference between the first and second time information exceeds the threshold value.

[0056] In some embodiments of the base station, the information to configure sending the report by the UE includes a reporting frequency to configure the UE to send the report according to the reporting frequency.

[0057] In some embodiments of the base station, the reporting frequency is also to configure the UE to obtain the second time information and determine the time difference according to the reporting frequency.

[0058] In some embodiments of the base station, the computer program code further causes the base station to at least send timing information to the UE, wherein the first time information is determined based on the timing information.

[0059] In some embodiments of the base station, the timing information is included in a message and/or a system information block. [0060] In some embodiments of the base station, the second time information is determined based on timing information from a global navigation satellite system and/or from one or more neighboring networks.

[0061] In some embodiments of the base station, the computer program code further causes the base station to send, to the UE, identification information about the one or more neighboring networks.

[0062] In some embodiments of the base station, to receive a report the computer program code causes the base station to at least receive the report as part of at least one or more of a setup complete message, a reconfiguration complete message and a connection measurement signaling message.

[0063] In some embodiments of the base station, the report includes one or more of the following: an indication that the time difference has been determined, the time difference between the first and second time information, the second time information, a timestamp at which the time difference was determined, and information about obtaining the second time information.

[0064] In some embodiments of the base station, the computer program code further causes the base station to at least receive, from one or more UEs other than the UE, reports indicating time differences between first time information and second time information from different time sources, and process the reports to determine the time inconsistency in the network.

[0065] In some embodiments of the base station, the computer program code further causes the base station to determine time inconsistency based on the report from the UE and/or the one or more UEs.

[0066] According to a fifth aspect, a computer program product comprises program instructions stored on a computer readable medium to execute steps according to any one of the embodiments of the methods outlined above when said program is executed on a computer.

[0067] The above-noted aspects and features may be implemented in systems, apparatuses, methods, articles and/or non-transitory computer-readable media depending on the desired configuration. The subject disclosure may be implemented in and/or used with a number of different types of devices, including but not limited to cellular phones, tablet computers, wearable computing devices, portable media players, and any of various other computing devices.

[0068] This summary is intended to provide a brief overview of some of the aspects and features according to the subject disclosure. Accordingly, it will be appreciated that the abovedescribed features are merely examples and should not be construed to narrow the scope of the subject disclosure in any way. Other features, aspects, and advantages of the subject disclosure will become apparent from the following detailed description, drawings and claims.

BRIEF DESCRIPTION OF THE DRAWINGS [0069] A better understanding of the subject disclosure can be obtained when the following detailed description of various embodiments is considered in conjunction with the following drawings, in which:

[0070] FIGURE 1 shows a schematic diagram of an example communication system comprising a base station and a plurality of communication devices;

[0071] FIGURE 2 shows a schematic diagram of an example mobile communication device;

[0072] FIGURE 3 shows a schematic diagram of an example control apparatus;

[0073] FIGURES 4 and 5 illustrate flow charts of methods for UE-assisted detection of spoofing or inconsistency in timing according to some embodiments of the subject disclosure;

[0074] FIGURE 6 illustrates signaling flow for UE-assisted spoofing detection while establishing RRC connection, according to some embodiments of the subject disclosure;

[0075] FIGURE 7 illustrates signaling flow for UE-assisted spoofing detection while the UE is in RRC connected state, according to some embodiments of the subject disclosure;

[0076] FIGURE 8 illustrates signaling flow for UE-assisted spoofing detection using multi-cell measurements from several UEs, according to some embodiments of the subject disclosure;

[0077] FIGURE 9 illustrates UE-assisted spoofing detection according to some embodiments of the subject disclosure.

DETAILED DESCRIPTION

[0078] Before explaining in detail the examples, certain general principles of a wireless communication system and mobile communication devices are briefly explained with reference to FIGURES 1 to 3 to assist in understanding the technology underlying the described examples.

[0079] In a wireless communication system 100, such as that shown in FIGURE 1, mobile communication devices or user equipment (UE) 102, 104, 105 are provided wireless access via at least one base station (e.g., next generation NB, gNB) or similar wireless transmitting and/or receiving node or point. Base stations may be controlled or assisted by at least one appropriate controller apparatus, so as to enable operation thereof and management of mobile communication devices in communication with the base stations. The controller apparatus may be located in a radio access network (e.g., wireless communication system 100) or in a core network (CN) (not shown) and may be implemented as one central apparatus or its functionality may be distributed over several apparatuses. The controller apparatus may be part of the base station and/or provided by a separate entity such as a Radio Network Controller. In FIGURE 1 control apparatus 108 and 109 are shown to control the respective macro level base stations 106 and 107. The control apparatus of a base station can be interconnected with other control entities. The control apparatus is typically provided with memory capacity and at least one data processor. The control apparatus and functions may be distributed between a plurality of control units. In some systems, the control apparatus may additionally or alternatively be provided in a radio network controller. [0080] In FIGURE 1, base stations 106 and 107 are shown as connected to a wider communications network 113 via gateway 112. A further gateway function may be provided to connect to another network.

[0081] As used herein, the term "base station" has the full breadth of its ordinary meaning, and at least includes a wireless communication station installed at a fixed location and used to communicate as part of a wireless telephone system or radio system. The communication area (or coverage area) of the base stations may be referred to as a "cell." The base stations and the UEs may be configured to communicate over the transmission medium using any of various radio access technologies (RATs), also referred to as wireless communication technologies, or telecommunication standards described hereinbelow. As illustrated in FIGURE 1 , while one of the base stations may act as a "serving cell" for UEs, each UE may also be capable of receiving signals from (and possibly within communication range of) one or more other cells (which might be provided by the base stations and/or any other base stations), which may be referred to as "neighboring cells".

[0082] The smaller base stations 116, 118 and 120 may also be connected to the network 113, for example by a separate gateway function and/or via the controllers of the macro level stations. The base stations 116, 118 and 120 may be pico or femto level base stations or the like. In the example, stations 116 and 118 are connected via a gateway 111 whilst station 120 connects via the controller apparatus 108. In some embodiments, the smaller stations may not be provided. Smaller base stations 116, 118 and 120 may be part of a second network, for example WLAN and may be WLAN APs. The communication devices 102, 104, 105 may access the communication system based on various access techniques, such as code division multiple access (CDMA), or wideband CDMA (WCDMA). Other non-limiting examples comprise time division multiple access (TDMA), frequency division multiple access (FDMA) and various schemes thereof such as the interleaved frequency division multiple access (IFDMA), single carrier frequency division multiple access (SC-FDMA) and orthogonal frequency division multiple access (OFDMA), space division multiple access (SDMA) and so on.

[0083] An example of wireless communication systems are architectures standardized by the 3rd Generation Partnership Project (3GPP). A latest 3GPP based development is often referred to as the long term evolution (LTE) of the Universal Mobile Telecommunications System (UMTS) radioaccess technology. The various development stages of the 3GPP specifications are referred to as releases. More recent developments of the LTE are often referred to as LTE Advanced (LTE-A). The LTE (LTE-A) employs a radio mobile architecture known as the Evolved Universal Terrestrial Radio Access Network (E-UTRAN) and a core network known as the Evolved Packet Core (EPC). Base stations of such systems are known as evolved or enhanced Node Bs (eNBs) and provide E-UTRAN features such as user plane Packet Data Convergence/Radio Link Control/Medium Access Control/Physical layer protocol (PDCP/RLC/MAC/PHY) and control plane Radio Resource Control (RRC) protocol terminations towards the communication devices. Other examples of radio access system comprise those provided by base stations of systems that are based on technologies such as wireless local area network (WLAN) and/or WiMax (Worldwide Interoperability for Microwave Access). A base station can provide coverage for an entire cell or similar radio service area. Core network elements include Mobility Management Entity (MME), Serving Gateway (S-GW) and Packet Gateway (P-GW).

[0084] An example of a suitable communications system is the 5G or NR concept. Network architecture in NR may be similar to that of LTE Advanced. Base stations of NR systems may be known as next generation Node Bs (gNBs). Changes to the network architecture may depend on the need to support various radio technologies and finer QoS support, and some on-demand requirements for e.g. QoS levels to support QoE of user point of view. Also network aware services and applications, and service and application aware networks may bring changes to the architecture. Those are related to Information Centric Network (ICN) and User-Centric Content Delivery Network (UC-CDN) approaches. NR may use multiple input - multiple output (MIMO) antennas, many more base stations or nodes than the LTE (a so-called small cell concept), including macro sites operating in co-operation with smaller stations and perhaps also employing a variety of radio technologies for better coverage and enhanced data rates.

[0085] Future networks may utilize network functions virtualization (NFV) which is a network architecture concept that proposes virtualizing network node functions into "building blocks" or entities that may be operationally connected or linked together to provide services. A virtualized network function (VNF) may comprise one or more virtual machines running computer program codes using standard or general type servers instead of customized hardware. Cloud computing or data storage may also be utilized. In radio communications this may mean node operations to be carried out, at least partly, in a server, host or node operationally coupled to a remote radio head. It is also possible that node operations will be distributed among a plurality of servers, nodes or hosts. It should also be understood that the distribution of labour between core network operations and base station operations may differ from that of the LTE or even be non-existent.

[0086] An example 5G core network (CN) comprises functional entities. The CN is connected to a UE via the radio access network (RAN). An UPF (User Plane Function) whose role is called PSA (PDU Session Anchor) may be responsible for forwarding frames back and forth between the DN (data network) and the tunnels established over the 5G towards the UE(s) exchanging traffic with the DN.

[0087] The UPF is controlled by an SMF (Session Management Function) that receives policies from a PCF (Policy Control Function). The CN may also include an AMF (Access & Mobility Function).

[0088] A possible mobile communication device will now be described in more detail with reference to FIGURE 2 showing a schematic, partially sectioned view of a communication device 200. Such a communication device is often referred to as user equipment (UE) or terminal. An appropriate mobile communication device may be provided by any device capable of sending and receiving radio signals. Non-limiting examples comprise a mobile station (MS) or mobile device such as a mobile phone or what is known as a smart phone, a computer provided with a wireless interface card or other wireless interface facility (e.g., USB dongle), personal data assistant (PDA) or a tablet provided with wireless communication capabilities, or any combinations of these or the like. A mobile communication device may provide, for example, communication of data for carrying communications such as voice, electronic mail (email), text message, multimedia and so on. Users may thus be offered and provided numerous services via their communication devices. Non-limiting examples of these services comprise two-way or multi-way calls, data communication or multimedia services or simply an access to a data communications network system, such as the Internet. Users may also be provided broadcast or multicast data. Non-limiting examples of the content comprise downloads, television and radio programs, videos, advertisements, various alerts and other information.

[0089] In an industrial application a communication device may be a modem integrated into an industrial actuator (e.g., a robot arm) and/or a modem acting as an Ethernet-hub that will act as a connection point for one or several connected Ethernet devices (which connection may be wired or un wired).

[0090] A mobile device is typically provided with at least one data processing entity 201, at least one memory 202 and other possible components 203 for use in software and hardware aided execution of tasks it is designed to perform, including control of access to and communications with access systems and other communication devices. The data processing, storage and other relevant control apparatus can be provided on an appropriate circuit board and/or in chipsets. This feature is denoted by reference 204. The user may control the operation of the mobile device by means of a suitable user interface such as keypad 205, voice commands, touch sensitive screen or pad, combinations thereof or the like. A display 208, a speaker and a microphone can be also provided. Furthermore, a mobile communication device may comprise appropriate connectors (either wired or wireless) to other devices and/or for connecting external accessories, for example hands-free equipment, thereto.

[0091] The mobile device 200 may receive signals over an air or radio interface 207 via appropriate apparatus for receiving and may transmit signals via appropriate apparatus for transmitting radio signals. In FIGURE 2 transceiver apparatus is designated schematically by block 206. The transceiver apparatus 206 may be provided for example by means of a radio part and associated antenna arrangement. The antenna arrangement may be arranged internally or externally to the mobile device.

[0092] The mobile device 200 may also or alternatively be configured to communicate using one or more global navigational satellite systems (GNSS, e.g., GPS or GLONASS), one or more mobile television broadcasting standards (e.g., ATSC-M/H or DVB-H), and/or any other wireless communication protocol, if desired. Other combinations of wireless communication standards (including more than two wireless communication standards) are also possible.

[0093] Generally, the communication device 200 illustrated in FIGURE 2 includes a set of components configured to perform core functions. For example, this set of components may be implemented as a system on chip (SOC), which may include portions for various purposes. Alternatively, this set of components may be implemented as separate components or groups of components for the various purposes. The set of components may be coupled (e.g., communicatively; directly or indirectly) to various other circuits of the communication device 200.

[0094] The communication device 200 may include at least one antenna in communication with a transmitter and a receiver (e.g., the transceiver apparatus 206). Alternatively, transmit and receive antennas may be separate. The communication device 200 may also include a processor (e.g., the at least one data processing entity 201) configured to provide signals to and receive signals from the transmitter and receiver, respectively, and to control the functioning of the communication device 200. The processor may be configured to control the functioning of the transmitter and receiver by effecting control signaling via electrical leads to the transmitter and receiver. Likewise, the processor may be configured to control other elements of the communication device 200 by effecting control signaling via electrical leads connecting processor to the other elements, such as a display (e.g., display 208) or a memory (e.g., the at least one memory 202). The processor may, for example, be embodied in a variety of ways including circuitry, at least one processing core, one or more microprocessors with accompanying digital signal processor(s), one or more processor(s) without an accompanying digital signal processor, one or more coprocessors, one or more multi-core processors, one or more controllers, processing circuitry, one or more computers, various other processing elements including integrated circuits (for example, an application specific integrated circuit (ASIC), a field programmable gate array (FPGA), and/or the like), or some combination thereof. Accordingly, in some examples, the processor may comprise a plurality of processors or processing cores.

[0095] The communication device 200 may be capable of operating with one or more air interface standards, communication protocols, modulation types, access types, and/or the like. Signals sent and received by the processor may include signaling information in accordance with an air interface standard of an applicable cellular system, and/or any number of different wireline or wireless networking techniques, comprising but not limited to Wi-Fi, wireless local access network (WLAN) techniques, such as Institute of Electrical and Electronics Engineers (IEEE) 802.11, 802.16, 802.3, ADSL, DOCSIS, and/or the like. In addition, these signals may include speech data, user generated data, user requested data, and/or the like.

[0096] For example, the communication device 200 and/or a cellular modem therein may be capable of operating in accordance with various first generation (1G) communication protocols, second generation (2G or 2.5G) communication protocols, third-generation (3G) communication protocols, fourth-generation (4G) communication protocols, fifth-generation (5G) communication protocols, Internet Protocol Multimedia Subsystem (IMS) communication protocols (for example, session initiation protocol (SIP) and/or the like. For example, the communication device 200 may be capable of operating in accordance with 2G wireless communication protocols IS- 136, Time Division Multiple Access TDMA, Global System for Mobile communications, GSM, IS-95, Code Division Multiple Access, CDMA, and/or the like. In addition, for example, the UE 120 may be capable of operating in accordance with 2.5G wireless communication protocols General Packet Radio Service (GPRS), Enhanced Data GSM Environment (EDGE), and/or the like. Further, for example, the communication device 200 may be capable of operating in accordance with 3G wireless communication protocols, such as Universal Mobile Telecommunications System (UMTS), Code Division Multiple Access 2000 (CDMA2000), Wideband Code Division Multiple Access (WCDMA), Time Division-Synchronous Code Division Multiple Access (TD-SCDMA), and/or the like. The communication device 200 may be additionally capable of operating in accordance with 3.9G wireless communication protocols, such as Long Term Evolution (LTE), Evolved Universal Terrestrial Radio Access Network (E-UTRAN), and/or the like. Additionally, for example, the communication device 200 may be capable of operating in accordance with 4G wireless communication protocols, such as LTE Advanced, 5G, and/or the like as well as similar wireless communication protocols that may be subsequently developed.

[0097] It is understood that the processor may include circuitry for implementing audio/video and logic functions of the communication device 200. For example, the processor may comprise a digital signal processor device, a microprocessor device, an analog-to-digital converter, a digital-to- analog converter, and/or the like. Control and signal processing functions of the communication device 200 may be allocated between these devices according to their respective capabilities. The processor may additionally comprise an internal voice coder (VC), an internal data modem (DM), and/or the like. Further, the processor may include functionality to operate one or more software programs, which may be stored in memory. In general, the processor and stored software instructions may be configured to cause the communication device 200 to perform actions. For example, the processor may be capable of operating a connectivity program, such as a web browser. The connectivity program may allow the communication device 200 to transmit and receive web content, such as location-based content, according to a protocol, such as wireless application protocol (WAP), hypertext transfer protocol (HTTP), and/or the like.

[0098] The communication device 200 may also comprise a user interface including, for example, an earphone or speaker, a ringer, a microphone, a display, a user input interface, and/or the like, which may be operationally coupled to the processor. The display may, as noted above, include a touch sensitive display, where a user may touch and/or gesture to make selections, enter values, and/or the like. The processor may also include user interface circuitry configured to control at least some functions of one or more elements of the user interface, such as the speaker, the ringer, the microphone, the display, and/or the like. The processor and/or user interface circuitry comprising the processor may be configured to control one or more functions of one or more elements of the user interface through computer program instructions, for example, software and/or firmware, stored on a memory accessible to the processor, for example, volatile memory, non-volatile memory, and/or the like. The communication device 200 may include a battery for powering various circuits related to the mobile terminal, for example, a circuit to provide mechanical vibration as a detectable output. The user input interface may comprise devices allowing the communication device 200 to receive data, such as a keypad (e.g., keypad 206) and/or other input devices. The keypad can also be a virtual keyboard presented on display or an externally coupled keyboard.

[0099] The communication device 200 may also include one or more mechanisms for sharing and/or obtaining data. For example, the communication device 200 may include a short-range radio frequency (RF) transceiver and/or interrogator, so data may be shared with and/or obtained from electronic devices in accordance with RF techniques. The communication device 200 may include other short-range transceivers, such as an infrared (IR) transceiver, a Bluetooth™ (BT) transceiver operating using Bluetooth™ wireless technology, a wireless universal serial bus (USB) transceiver, a Bluetooth™ Low Energy transceiver, a ZigBee transceiver, an ANT transceiver, a cellular device- to-device transceiver, a wireless local area link transceiver, and/or any other short-range radio technology. The communication device 200 and, in particular, the short-range transceiver may be capable of transmitting data to and/or receiving data from electronic devices within the proximity of the apparatus, such as within 10 meters, for example. The communication device 200 including the Wi-Fi or wireless local area networking modem may also be capable of transmitting and/or receiving data from electronic devices according to various wireless networking techniques, including 6LoWpan, Wi-Fi, Wi-Fi low power, WLAN techniques such as IEEE 802.11 techniques, IEEE 802.15 techniques, IEEE 802.16 techniques, and/or the like.

[0100] The communication device 200 may comprise memory, such as a subscriber identity module (SIM), a removable user identity module (R-UIM), an eUICC, an UICC, and/or the like, which may store information elements related to a mobile subscriber. In addition to the SIM, the communication device 200 may include other removable and/or fixed memory. The communication device 200 may include volatile memory and/or non-volatile memory. For example, the volatile memory may include Random Access Memory (RAM) including dynamic and/or static RAM, on- chip or off-chip cache memory, and/or the like. The non-volatile memory, which may be embedded and/or removable, may include, for example, read-only memory, flash memory, magnetic storage devices, for example, hard disks, floppy disk drives, magnetic tape, optical disc drives and/or media, non-volatile random-access memory (NVRAM), and/or the like. Like volatile memory, the nonvolatile memory may include a cache area for temporary storage of data. At least part of the volatile and/or non-volatile memory may be embedded in the processor. The memories may store one or more software programs, instructions, pieces of information, data, and/or the like which may be used by the apparatus for performing operations disclosed herein. [0101] The memories may comprise an identifier, such as an International Mobile Equipment Identification (IMEI) code, capable of uniquely identifying the communication device 200. The memories may comprise an identifier, such as an international mobile equipment identification (IMEI) code, capable of uniquely identifying the communication device 200. In the example embodiment, the processor may be configured using computer code stored at memory to cause the processor to perform operations disclosed herein.

[0102] Some of the embodiments disclosed herein may be implemented in software, hardware, application logic, or a combination of software, hardware, and application logic. The software, application logic, and/or hardware may reside on the memory, the processor, or electronic components, for example. In some example embodiment, the application logic, software or an instruction set is maintained on any one of various conventional computer-readable media. In the context of this document, a "computer-readable medium" may be any non-transitory media that can contain, store, communicate, propagate or transport the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer or data processor circuitry, with examples depicted at FIGURE 2, computer-readable medium may comprise a non-transitory computer-readable storage medium that may be any media that can contain or store the instructions for use by or in connection with an instruction execution system, apparatus, or device, such as a computer.

[0103] In some embodiments, the communication device 200 (i.e., a user equipment (UE) in a network) comprises the processor (e.g., the at least one data processing entity 201) and the memory (e.g., the at least one memory 202). The memory includes computer program code causing the communication device 200 to perform processing according to the method described below with reference to FIGURE 4. In particular, the computer program code causes the communication device 200 to receive an indication from the network to command the UE to notify time inconsistency via the transceiver 206, obtain first time information and second time information from different time sources, compare the first time information and the second time information to determine a time difference, and send a report indicating the time difference via the transceiver 206 to the network. The first time information may be obtained using the transceiver 206. The second time information may be obtained using the transceiver 206 and/or components configured to communicate using one or more global navigational satellite systems (GNSS, e.g., GPS or GLONASS).

[0104] FIGURE 3 shows an example embodiment of a control apparatus for a communication system, for example to be coupled to and/or for controlling a station of an access system, such as a RAN node, e.g., a base station, eNB or gNB, a relay node or a core network node such as an MME or S-GW or P-GW, or a core network function such as AMF/SMF, or a server or host. The method may be implanted in a single control apparatus or across more than one control apparatus. The control apparatus may be integrated with or external to a node or module of a core network or RAN. In some embodiments, base stations comprise a separate control apparatus unit or module. In other embodiments, the control apparatus can be another network element such as a radio network controller or a spectrum controller. In some embodiments, each base station may have such a control apparatus as well as a control apparatus being provided in a radio network controller. The control apparatus 300 can be arranged to provide control on communications in the service area of the system. The control apparatus 300 comprises at least one memory 301, at least one data processing unit 302, 303 and an input/output interface 304. Via the interface the control apparatus can be coupled to a receiver and a transmitter of the base station. The receiver and/or the transmitter may be implemented as a radio front end or a remote radio head.

[0105] Generally, the control apparatus 300 has an antenna, which transmits and receives radio signals. A radio frequency (RF) transceiver module, coupled with the antenna, receives RF signals from antenna, converts them to baseband signals and sends them to processor (e.g., the at least one data processing unit 302, 303). RF transceiver also converts received baseband signals from processor, converts them to RF signals, and sends out to antenna. Processor processes the received baseband signals and invokes different functional modules to perform features in control apparatus 300. Memory (e.g., the at least one memory 301) stores program instructions and data to control the operations of the control apparatus 300. In the example of FIGURE 3, the control apparatus 300 also includes protocol stack and a set of control functional modules and circuit. PDU session handling circuit handles PDU session establishment and modification procedures. Policy control module that configures policy rules for UE. Configuration and control circuit provides different parameters to configure and control UE of related functionalities including mobility management and session management. Suitable processors include, by way of example, a special purpose processor, a digital signal processor (DSP), a plurality of micro-processors, one or more micro-processor associated with a DSP core, a controller, a microcontroller, application specific integrated circuits (ASICs), file programmable gate array (FPGA) circuits, and other type of integrated circuits (ICs), and/or state machines.

[0106] In some embodiments, the control apparatus 300 (i.e., the base station or the wireless transmitting and/or receiving point equipment) comprises the processor (e.g., the at least one data processing unit 302, 303) and the memory (e.g., the at least one memory 301). The memory includes computer program code causing the control apparatus 300 to perform processing according to the method described below with reference to FIGURE 5. In particular, the computer program code causes the control apparatus 300 to send an indication to a user equipment, UE (e.g., the communication apparatus 300) to command the UE to notify time inconsistency to, receive, from the UE, a report indicating a time difference between first time information and second time information from different time sources, and process the report to determine time inconsistency.

[0107] FIGURE 4 illustrates a flow chart of a method for UE-assisted detection of spoofing or inconsistency in timing according to some embodiments. The method is performed by a user equipment (UE). For example, the UE may be represented by any one of the mobile communication devices 102, 104, 105 of the wireless communication system 100 as described above with reference to FIGURE 1, or the communication device 200 as described above with reference to FIGURE 2.

[0108] The method 400 starts with receiving an indication from a network to command the UE to notify time inconsistency, at block 410. The indication may be received from a base station (e.g., next generation NB, gNB) or similar wireless transmitting and/or receiving point (TRP). The base station or the wireless transmitting and/or receiving point providing the UE with wireless access to the network. The base station or the wireless transmitting and/or receiving point may be a serving base station for a cell (e.g., a service area). For example, the base station or the wireless transmitting and/or receiving point may be represented by any one of the base stations 106, 107, 116, 118, 120 shown in FIGURE 1.

[0109] In some embodiments, the indication may be included in a setup message for establishing connection to the network (e.g., RRC Setup message), in a system information block (e.g., system information block type 9, SIB9), and/or a reconfiguration message for the connection to the network (e.g., RRC Reconfiguration message, a message related to handover procedure). The setup message may be sent by the serving base station or wireless transmitting and/or receiving point, e.g., in response to receiving a setup request message for establishing connection to the network (e.g., RRC Setup Request message) sent from the UE to the base station or the wireless transmitting and/or receiving point. The system information block may be sent or broadcasted by the serving base station or wireless transmitting and/or receiving point periodically or on demand (e.g., requested by the network). The reconfiguration message may be sent by the serving base station or wireless transmitting and/or receiving point at any time the serving base station or wireless transmitting and/or receiving point determines that configuring reporting time inconsistency is needed (e.g., via RRC reconfiguration procedure). One example for sending the reconfiguration message may be when handover from the serving base station or wireless transmitting and/or receiving point to another base station or wireless transmitting and/or receiving point (e.g., target gNB or target TRP) is to be performed. For example, the handover may be performed in case the UE enters the service area (e.g., cell) of the target base station or wireless transmitting and/or receiving point, and leaves the service area (e.g., cell) of the serving base station or wireless transmitting and/or receiving point.

[0110] In some embodiments, the indication may be signaled, e.g., by setting one or more bits in a message sent to the UE. Additionally or alternatively, the UE may be configured to notify time inconsistency. In this case, the indication may be signaled to the UE in an implicit fashion, e.g., by including timing information in a message sent to the UE.

[0111] In some embodiments, one or more of the setup message, the system information block and the reconfiguration message for the connection to the network may further include information to configure sending the report, described below. Thereby, the network not only commands to the UE to start notifying about time inconsistency, but also configures how the UE is to report the time inconsistency to the network (e.g., what information to include in the report as described below). Some of the information to configure sending the report may not be sent with the system information block (e.g., SIB9).

[0112] At block 420, the UE obtains first time information and second time information from different time source. For example, the UE may obtain time information from at least two time sources.

[0113] In some embodiments, the first time information may be obtained from timing information received from the network (e.g., received from the serving base station or wireless transmitting and/or receiving point). For example, the timing information may be included in a message such as a RRC message (e.g., Downlink Information Transfer), or a system information block (e.g., the SIB9). The timing information may correspond to ReferenceTimelnfo as defined in 3GPP TS 38.331 and may have any format such as UTC-based time value. The first time information is determined based on the timing information received from the network, e.g., the timing information is used as, or converted into, the first time information.

[0114] In some embodiments, the second time information may be obtained from timing information received e.g. from one or more neighboring networks. The neighboring networks may be cells or service areas adjacent to the network serving the UE (e.g., the cell or service area of the serving base station or wireless transmitting and/or receiving point). For example, the timing information may be received from one or more other base stations or wireless transmitting and/or receiving points (i.e., the other base stations or wireless transmitting and/or receiving points are different from the serving base station or wireless transmitting and/or receiving point). The timing information may correspond to ReferenceTimelnfo and may have any format such as UTC-based time value. The second time information is determined based on the timing information received from the one or more neighboring networks, e.g., the timing information is used as, or converted into, the second time information.

[0115] In some embodiments related to handover, the serving base station or wireless transmitting and/or receiving point may provide information of the one or more neighboring networks in the reconfiguration message (e.g., the RRC Reconfiguration message) to the UE. The information may include identification information of the cell or service area of the target base station or wireless transmitting and/or receiving point. The identification information may be used by the UE to identify a message or a system information block (e.g., SIB9) sent by the target base station or wireless transmitting and/or receiving point associated with the identification information. The UE may then determine the second time information from the timing information received with the message or the system information block from the target base station or wireless transmitting and/or receiving point.

[0116] Additionally or alternatively, in some embodiments, the second time information may be obtained from timing information received from a global navigation satellite system (GNSS, e.g., GPS or GLONASS). The UE may receive one or more signals with timing information from one or more satellites of the GNSS. Signals may also be received from terrestrial stations of the GNSS. The timing information may have any format such as UTC-based time value. The second time information is determined based on the timing information received from the GNSS, e.g., the timing information is used as, or converted into, the second time information.

[0117] At block 430, the UE compares the first time information and the second time information and thereby determines existence of a time difference between the first time information and the second time information. If existent, the time different may be indicative of spoofing or inconsistency in timing.

[0118] In some embodiments, the indication received at block 410 may include a threshold value. The UE may determine the existence if the time difference between the first time information and the second time information exceeds the threshold value. Additionally or alternatively, the UE may determine the existence if a number of (subsequent) comparisons reveal a time difference, e.g., which exceeds the threshold value. The number may also be preset or specified by information included in the indication. Thus, the threshold value avoids excessive reporting, particularly in case the time difference is not an issue with the timing of the network (e.g., the clock of the 5GS).

[0119] At block 440, the UE reports to the network that the time difference has been determined at block 430. For example, the UE sends a message (e.g., a report) to the network (e.g., the serving base station or wireless transmitting and/or receiving point). The report indicates the existence of the time difference.

[0120] In some embodiments, the report may be included in (i.e., is part of) a setup complete message (e.g., RRC Setup Complete message) from the UE to the serving base station or wireless transmitting and/or receiving point, or of a reconfiguration complete message (e.g., RRC Reconfiguration Complete message) from the UE to the target base station or wireless transmitting and/or receiving point. The report may also be included in a measurement report (e.g., RRC Measurement Report message, a RRC time report, a connection measurement signaling message), which may be sent periodically using RRC signaling without being part of connection establishment or reconfiguration.

[0121] In some embodiments, as described above, the UE may have received information to configure sending the report in one or more of the setup message, the system information block and the reconfiguration message for the connection to the network. Responsive to receiving the information, the UE configures the report such as the information included in the report. The UE may further configure how to sent the report.

[0122] For example, a reporting frequency is included in the information to configure sending the report received at block 410. The reporting frequency triggers the frequency of sending the report to the network at block 440. Additionally or alternative, the reporting frequency triggers the frequency of obtaining the first and second time information at block 420 and/or comparing the first and second time information at block 430. Thus, the reporting frequency specifies a window of monitoring and thereby avoids excessive reporting.

[0123] In some embodiments, the report sent at block 440 to the network includes one or more of an indication that the time difference has been determined, the determined time difference between the first and second time information, the second time information, a timestamp at which the time difference was determined, and information about obtaining the second time information.

[0124] FIGURE 5 illustrates a flow chart of a method for UE-assisted detection of spoofing or inconsistency in timing according to some embodiments. The method is performed by a base station. For example, the base station may be represented by the control apparatus 300 as described above with reference to FIGURE 3. The base station may be a serving base station, or a gNB or a transmission/reception point (TRP) in a 5G system.

[0125] The method 500 starts with sending an indication to a user equipment (UE) to command the UE to notify time inconsistency, at block 510. The indication may be sent by a base station (e.g., gNB) or similar wireless transmitting and/or receiving point (TRP). The gNB/TRP provides the UE with wireless access to the network. The gNB/TRP may be a serving base station for a cell (e.g., a service area). For example, the gNB/TRP may be represented by any one of the base stations 106, 107, 116, 118, 120 shown in FIGURE 1. The UE may be represented by any one of the mobile communication devices 102, 104, 105 of the wireless communication system 100 as described above with reference to FIGURE 1. For example, the indication may be sent to one or more of the UEs within the service area or cell of the serving gNB/TRP.

[0126] The indication configures the UE to measure and report time inconsistency between a time of the network as a first time source (e.g., the serving base station or similar wireless transmitting and/or receiving point) and a time obtained from another time source such as (e.g., a target or any other base station or similar wireless transmitting and/or receiving point, or GNSS, e.g., GPS or GLONASS).

[0127] In some embodiments, the indication may be included in a setup message for establishing connection to the network (e.g., RRC Setup message), in a system information block (e.g., system information block type 9, SIB9), and/or a reconfiguration message for the connection to the network (e.g., RRC Reconfiguration message). The setup message may be sent by the serving gNB/TRP, e.g., in response to receiving a setup request for establishing connection to the network (e.g., RRC Setup Request message) sent from the UE to the gNB/TRP. The system information block may be sent or broadcasted by the serving base station or the wireless transmitting and/or receiving point periodically or on demand (e.g., requested by the network). The reconfiguration message may be sent by the serving gNB/TRP when handover from the serving gNB/TRP to another base station or wireless transmitting and/or receiving point (e.g., target gNB, or target TRP) is to be performed or due to other trigger the gNB/TRP determines the UE can use multi-cell measurement. For example, the handover may be performed in case the UE enters the service area (e.g., cell) of the target base station or wireless transmitting and/or receiving point, and leaves the service area (e.g., cell) of the serving gNB/TRP.

[0128] In some embodiments, the indication may be signaled, e.g., by setting one or more bits in a message sent to the UE.

[0129] At block 520, the network receives a report indicating a time difference from the UE to which the indication was sent. That is, reports may be received from one or more UEs within the service area or cell of the serving gNB/TRP. The report indicate that the UE determined a time difference between a first time information provided by the network (e.g., the serving gNB/TRP) and a second time information from another base station or wireless transmitting and/or receiving point, or from GNSS. The determination of the time difference may be performed by the UE as described above with reference to FIGURE 4.

[0130] In some embodiments, the report received at block 440 includes one or more of an indication that the time difference has been determined, the determined time difference between the first and second time information, the second time information, a timestamp at which the time difference was determined, and information about obtaining the second time information.

[0131] At block 530, the report received at block 520 is processed to determine time inconsistency in the network. For example, the serving gNB/TRP may aggregate one or more reports received from one or more UEs and determine whether the reports indicate the time inconsistency, thereby detecting spoofing and inconsistency in timing. The serving gNB/TRP may post-process the requests and determine if there is an issue with the timing within the network (e.g., the clock of the 5GS). If so, the serving gNB/TRP may interact with other components of the network (e.g., the 5G Core network) or perform configured actions to solve the issue, e.g., to perform a correction process and/or a verification process with regard to the time inconsistency and time of the network.

[0132] Examples of the subject disclosure will now be described with reference to the signaling flow shown in FIGURES 6, 7 and 8.

[0133] The examples shown in FIGURES 6, 7 and 8 relate to the implementation of the methods of the subject disclosure in the 5G system. In particular, the signaling flow between one or more UEs (i.e., a first UE referred to as UE1, and a number of other UEs referred to as UE_N), the serving/target base station (referred to as serving gNBl or target gNB2) or wireless transmitting and/or receiving point (referred to as serving/target TRP), and 5G Core Access and Mobility Management Function (AMF) and 5G Core network (5GC).

[0134] FIGURE 6 illustrates signaling flow for UE-assisted spoofing detection while establishing RRC connection, according to some embodiments of the subject disclosure.

[0135] The serving gNBl/TRP may broadcast a system information block (e.g., the system information block type 9, SIB9). The system information block may include timing information. The timing information indicate a time (e.g., the UTC time, ReferenceTimelnfo) of the network or the gNBl/TRP. The UEs within the service area of the gNBl/TRP may receive the system information block and thus the timing information. Based on the timing information, the UEs may obtain first time information representing the time of the gNBl/TRP. Further, the UEs may also obtain second time information, for example, by using a global navigation satellite system (GNSS) or a system information block received from another (neighboring) gNB/TRP. For example, the UEs may receive a signal including timing information from the GNSS and obtains the second time information representing the time of the GNSS. The UEs may compare the first and second time information to determine whether there is an inconsistency between them. The inconsistency in timing may be indicative of spoofing.

[0136] As part of the random access procedure between e.g. the UE1 and the gNBl/TRP to establish RRC connection, the UE1 may sent a RRC Setup Request message to the serving gNBl/TRP. In response to receiving the RRC Setup Request message, the serving gNBl/TRP may sent a RRC Setup message to the UE1. The RRC Setup message may include an indication to configure the UE1 to notify timing inconsistency (also referred to as 5G time inconsistency notification configuration). When the indication is received, the UE1 is configured to determine and notify inconsistency in timing to at least the serving gNBl/TRP in order to assist the gNBl/TRP in determining spoofing and/or timing issues. If configured, the UE1 determines if there is timing inconsistency (i.e., time reference inconsistency). For example, the UE1 may obtain first time information based on information such as timing information of the serving gNBl/TRP. The timing information may be included in the RRC Setup message or a system information block (SIB9) received from the gNBl/TRP. The UE1 may obtain second time information based on timing information received from e.g. GNSS. The UE1 may perform the determination if there is timing inconsistency by comparing the first and second time information. If the first and second time information differ from each other, e.g., by a certain amount such as by more than a threshold value, the UE1 determines that there is timing inconsistency. The UE1 may sent a RRC Setup Complete message indicating completion of connection establishment to the serving gNBl/TRP. The RRC Setup Complete message may also include a report to indicate to the gNB 1/TRP that a time difference has been determined (also referred to as 5G Time inconsistency report). The gNBl/TRP may also receive corresponding reports indicating time difference from other UEs. In response to receiving the report(s) indicating the time difference, the gNBl/TRP may process the report(s) to determine if there is inconsistency in the clock of the 5G system. If so, the gNB 1/TRP and the 5GC may interact e.g. with the 5GC to act based on the report(s). For example, the gNBl/TRP may interact to resolve the inconsistency in the clock of the 5G system or to perform actions against spoofing.

[0137] FIGURE 7 illustrates signaling flow for UE-assisted spoofing detection while the UE is in RRC connected state (after performing random access procedure and establishing connection), according to some embodiments of the subject disclosure.

[0138] The serving gNBl/TRP may broadcast a system information block (e.g., the system information block type 9, SIB9). The system information block may be sent periodically, or on demand requested by the network. The system information block includes timing information indicating a time (e.g., the UTC time, ReferenceTimelnfo) of the network or the gNBl/TRP. The UEs within the service area of the serving gNB 1/TRP may receive the system information block and thus the timing information. The system information block may further include an indication to configure the UEs (i.e., UE1 and UE_N) to notify timing inconsistency (also referred to as 5G time inconsistency notification configuration). When the indication is received for example by UE1, the UE1 is configured to determine and notify inconsistency in timing to at least the serving gNBl/TRP in order to assist the gNB 1/TRP in determining spoofing and/or timing issues. If configured, the UE1 determines if there is timing inconsistency (i.e., time reference inconsistency). For example, the UE1 may obtain first time information based on information such as the timing information provided by the serving gNBl/TRP. For example, the UE1 may use the timing information included in the system information block received from the serving gNBl/TRP. The UE1 may further obtain second time information based on timing information received from e.g. GNSS. For example, the UE1 may receive a signal including the timing information from the GNSS and obtain the second time information representing the time of the GNSS. The UE1 may perform the determination if there is timing inconsistency by comparing the first and second time information. If the first and second time information differ from each other, e.g., by a certain amount such as by more than a threshold value, the UE1 determines that there is timing inconsistency. The UE1 may sent a RRC Measurement Report message to the serving gNBl/TRP (e.g., a RRC time report, a connection measurement signaling message). The RRC Measurement Report message may be sent periodically using RRC signaling without being part of connection establishment or reconfiguration. The RRC Measurement Report message may also include a report to indicate to the serving gNBl/TRP that a time difference has been determined (also referred to as 5G Time inconsistency report). The gNBl/TRP may also receive corresponding reports indicating time difference from other UEs. In response to receiving the report(s) indicating the time difference, the gNBl/TRP may process the report(s) to determine if there is inconsistency in the clock of the 5G system. If so, the gNBl/TRP may interact e.g. with the 5GC to act based on the report(s). For example, the gNBl/TRP and the 5GC may interact to resolve the inconsistency in the clock of the 5G system or to perform actions against spoofing.

[0139] FIGURE 8 illustrates signaling flow for UE-assisted spoofing detection using multi-cell measurements from several UEs, according to some embodiments of the subject disclosure. For example, multi-cell measurements may be used by the UEs in case handover from the serving gNB 1/TRP to a target gNB2/TRP is prepared. The handover may be prepared in case UEs leaves the cell or service area of the serving gNBl/TRP and enters the cell or service area of the target gNB2/TRP.

[0140] As part of the handover, the serving gNBl/TRP may sent a RRC Reconfiguration message to the UE1. The RRC Reconfiguration message may include an indication to configure the UE1 to notify timing inconsistency (also referred to as 5G time inconsistency notification configuration). When the indication is received, the UE1 is configured to determine and notify inconsistency in timing to the serving gNBl/TRP and/or the target gNB2/TRP in order to assist the gNBl/TRP and/or the gNB2/TRP in determining spoofing and/or timing issues. If configured, the UE1 determines if there is timing inconsistency (i.e., time reference inconsistency). For example, the UE1 may obtain first time information based on information such as timing information of the serving gNBl/TRP. The timing information may be included in the RRC Reconfiguration message or a system information block (e.g., the system information block type 9, SIB9) received from the gNBl/TRP. For example, the serving gNBl/TRP may broadcast the system information block including the timing information. The timing information indicate a time (e.g., the UTC time, ReferenceTimelnfo) of the network or the serving gNBl/TRP. The UEs within the service area of the serving gNBl/TRP may receive the system information block and thus the timing information. Based on the timing information, the UE1 may obtain the first time information representing the time of the serving gNBl/TRP. Further, the UE1 may also obtain second time information, for example, by using a global navigation satellite system (GNSS) or a system information block received from another (neighboring) gNB/TRP. For example, the UE1 may receive a signal including timing information from the GNSS and obtain the second time information representing the time of the GNSS. In another example, the target gNB2/TRP may broadcast the system information block including the timing information. The timing information indicate a time (e.g., the UTC time, ReferenceTimelnfo) of the network or the target gNB2/TRP. The UEs within the service area of the target gNB2/TRP may receive the system information block and thus the timing information. Based on the timing information, the UE1 may obtain the second time information representing the time of the target gNB2/TRP. The UE1 may perform the determination if there is timing inconsistency by comparing the first and second time information. If the first and second time information differ from each other, e.g., by a certain amount such as by more than a threshold value, the UE1 determines that there is timing inconsistency. Optionally, the UE1 may sent a RRC Measurement Report message to the serving gNB 1/TRP. The RRC Measurement Report message may also include a report to indicate to the serving gNBl/TRP that a time difference has been determined (also referred to as 5G Time inconsistency report). Once the handover from the serving gNBl/TRP to the target gNB2/TRP has been executed, the UE1 may sent a RRC Reconfiguration Complete message to the target gNB2/TRP. The RRC Reconfiguration Complete message may also include a report to indicate to the target gNB2/TRP that a time difference has been determined (also referred to as 5G Time inconsistency report). Both the serving gNBl/TRP and the gNB2/TRP may also receive corresponding reports indicating time difference from other UEs. In response to receiving the report(s) indicating the time difference, the gNBl/TRP and also the gNB2/TRP may process the report(s) to determine if there is inconsistency in the clock of the 5G system. If so, the gNB 1/TRP, the gNB2/TRP and the 5GC may interact to act based on the report(s). For example, the gNBl/TRP, the gNB2/TRP and the 5GC may interact to resolve the inconsistency in the clock of the 5G system or to perform actions against spoofing.

[0141] FIGURE 9 illustrates UE-assisted spoofing detection according to some embodiments of the subject disclosure.

[0142] In FIGURE 9, the 5G system including the 5GC connected to gNBl and gNB2 is illustrated. Both the gNBl and gNB2 serve corresponding service areas/cells (referred to as gNBl service area and gNB2 service area). The gNBl and gNB2 have GNSS (e.g., GPS) receivers. A plurality of UEs is present in each service area. Among the UEs, some UEs are present in both service areas at the same time. Some of the UEs are provided with GNSS (e.g., GPS) receivers.

[0143] As shown in FIGURE 9, the GNSS is spoofed in an area around the gNB2 (referred to as GNSS spoofed area) such that the timing in that area is incorrect. That is, the timing is inconsistent with the timing outside that area. At least some of the UEs within the service areas are configured by the gNBl/gNB2 to report 5G time inconsistency in accordance with the methods described above. For example, based on the reports received from the UEs present in both service areas, the gNBl may determine 5G time inconsistency between the time of the gNB 1 and the time of the gNB2 within the GNSS spoofed area. Also, the gNB2 may determine 5G time inconsistency between the time of the gNB2 within the GNSS spoofed area and times of UEs within the gNB2 service area but not within the GNSS spoofed area (referred to as UE reports 5G time inconsistency). The gNBl, the gNB2 and the 5GC may interact to solve the 5G time inconsistency.

[0144] In UE-assisted spoofing detection according to some embodiments of the subject disclosure, the report(s) may include the time measurements the UEs compute or information processed by the UEs (e.g. explicit time inconsistency indication). The report(s) (e.g., the RRC time report) may include one or more of the following information:

- Timestamp at which the RRC measurement is made.

- Time measurements from different cells/time sources (if the UE reports directly the time measurements) or time inconsistency indication (if the UE reports the processed result computed from the time measurements). Additionally, the UE may include the observed deviation from the different cells/time sources.

- The cell ID and the beam that the UE was using while doing the measurement. This information assists the gNB in determining the area of UEs impacted. The propagation delay (PD) estimate will change depending on the beam used (depending on the beam used different multipath component will be stronger).

- The UE may also indicate the second source of the timing information (another cell or time source) relative to which the timing inconsistency is observed, thereby allowing the gNB to identify if the timing error is in itself or the target gNB.

[0145] The gNB/TRP may also configure a threshold and/or a reporting frequency to avoid frequent reports. The UEs may send periodic measurement and reporting of 5G timing reference. Other examples relate to filtering at the UEs and the gNB to avoid that the report(s) leads to a false detection of spoofing or frequent spoofing. At the UE side, clock offset thresholds or a window of monitoring may be configured to avoid reporting if there is not an issue with the 5G clock. At the gNB side, the frequency for such reports, cell ID(s) that the UE should monitor, also the threshold for inconsistency reporting may be configured.

[0146] In the UE-assisted spoofing detection of FIGURE 8, the gNB/TRP may provide identification information such as the cell ID(s) of the cell(s) for which the UEs should monitor 5G timing and report inconsistency.

[0147] The gNB/TRP aggregates and processes the report(s) received from the UE. For example, the gNB/TRP aggregates the report(s) based on the frequency/band supported by the UE, tracking area, and time sync serving area. The gNB may use the report(s) from the UEs to correlate which cell/beam is used to serve that user (e.g., directional positioning, range detection with TA, etc.).

[0148] The subject disclosure may provide, or at least contribute to, a solution of problems to reliably detect GNSS spoofing and to provide extended holdover capabilities at reasonable cost, including robustness to GNSS spoofing and loss of GNSS signal at a radio site.

[0149] The first problem to reliably detect GNSS spoofing: GNSS spoofing is typically done gradually and as a result not detected easily. Cheap devices may just generate a transient interference, but more expensive devices could do more advance spoofing where a valid GNSS signal is provided but with a wrong time. The gNBs are not prepared for GNSS spoofing. Additionally, acquiring timing according to spoofed GNSS time reference not only impacts any offered time synchronization service to verticals, it may also more critically impact: (a) TDD deployments, (b) advanced 3GPP coordination features (e.g. handover procedures, cooperative multipoint transmission), (c) positioning, and (d) general network stability, including networks ability to provide critical end-user services.

[0150] The second problem to provide extended holdover capabilities at reasonable cost, including robustness to GNSS spoofing and loss of GNSS signal at a radio site: Today’s best-in-class gNBs have ~4-6 hours holdover capabilities (for ~1.5 microsecond) whereas critical industries require 24 hours and even at tightened accuracy levels than those in use today. Upgrading each gNB to 24 hours capability would require use of more advanced and expensive oscillators compared to current in-use double oven controlled crystal oscillator (DOCXO) solutions. For networks where timing is provided via the operator backhaul infrastructure, such infrastructure would also need to be upgraded towards higher accuracy levels that what is used in existing cost-optimized deployments (ex. designing for PTP/ ITU-T G.8271.1). Hence, imposing a high cost in a single gNB without knowing if operators will make transport upgrades is not attractive. [0151] The methods according to some embodiments of the subject disclosure may be used as an alternative or complementary way of GNSS spoofing detection when intra-gNB or inter-gNB detection are insufficient.

[0152] It should be understood that the apparatuses may comprise or be coupled to other units or modules etc., such as radio parts or radio heads, used in or for transmission and/or reception. Although the apparatuses have been described as one entity, different modules and memory may be implemented in one or more physical or logical entities.

[0153] It is noted that whilst embodiments have been described in relation to LTE and 5G NR, similar principles can be applied in relation to other networks and communication systems where clock synchronization, detection of spoofing and/or detection of inconsistency in timing is required. Therefore, although certain embodiments were described above by way of example with reference to certain example architectures for wireless networks, technologies and standards, embodiments may be applied to any other suitable forms of communication systems than those illustrated and described herein.

[0154] It is also noted herein that while the above describes exemplary embodiments, there are several variations and modifications which may be made to the disclosed solution without departing from the scope of the subject disclosure.

[0155] In general, the various exemplary embodiments may be implemented in hardware or special purpose circuits, software, logic or any combination thereof. Some aspects of the subject disclosure may be implemented in hardware, while other aspects may be implemented in firmware or software which may be executed by a controller, microprocessor or other computing device, although the subject disclosure is not limited thereto. While various aspects of the subject disclosure may be illustrated and described as block diagrams, flow charts, or using some other pictorial representation, it is well understood that these blocks, apparatus, systems, techniques or methods described herein may be implemented in, as non-limiting examples, hardware, software, firmware, special purpose circuits or logic, general purpose hardware or controller or other computing devices, or some combination thereof.

[0156] Example embodiments of the subject disclosure may be implemented by computer software executable by a data processor of the mobile device, such as in the processor entity, or by hardware, or by a combination of software and hardware. Computer software or program, also called program product, including software routines, applets and/or macros, may be stored in any apparatus- readable data storage medium and they comprise program instructions to perform particular tasks. A computer program product may comprise one or more computer- executable components which, when the program is run, are configured to carry out embodiments. The one or more computerexecutable components may be at least one software code or portions of it.

[0157] Further in this regard it should be noted that any blocks of the logic flow as in the figures may represent program steps, or interconnected logic circuits, blocks and functions, or a combination of program steps and logic circuits, blocks and functions. The software may be stored on such physical media as memory chips, or memory blocks implemented within the processor, magnetic media such as hard disk or floppy disks, and optical media such as for example DVD and the data variants thereof, CD. The physical media is a non-transitory media.

[0158] The memory may be of any type suitable to the local technical environment and may be implemented using any suitable data storage technology, such as semiconductor-based memory devices, magnetic memory devices and systems, optical memory devices and systems, fixed memory and removable memory. The data processors may be of any type suitable to the local technical environment, and may comprise one or more of general-purpose computers, special purpose computers, microprocessors, digital signal processors (DSPs), application specific integrated circuits (ASIC), FPGA, gate level circuits and processors based on multi-core processor architecture, as nonlimiting examples.

[0159] Example embodiments of the subject disclosure may be practiced in various components such as integrated circuit modules. The design of integrated circuits is by and large a highly automated process. Complex and powerful software tools are available for converting a logic level design into a semiconductor circuit design ready to be etched and formed on a semiconductor substrate.

[0160] The foregoing description has provided by way of non-limiting examples a full and informative description of the exemplary embodiment of the subject disclosure. However, various modifications and adaptations may become apparent to those skilled in the relevant arts in view of the foregoing description, when read in conjunction with the accompanying drawings and the appended claims. However, all such and similar modifications of the teachings of this invention will still fall within the scope of the subject disclosure as defined in the appended claims. Indeed, there is a further embodiment comprising a combination of one or more embodiments with any of the other embodiments previously discussed.