BACKGROUND

[0001] Obtaining a reliable, accurate location of one or more mobile devices may be useful for many applications including, for example, emergency calls, personal navigation, asset tracking, locating a friend or family member, etc. Existing positioning methods include methods based on measuring radio signals transmitted from a variety of devices or entities including satellite vehicles (SVs) and terrestrial radio sources in a wireless network such as base stations and access points. It is expected that standardization for the 5G (Fifth Generation) wireless networks will include support for various positioning methods, which may utilize reference signals transmitted by base stations in a manner similar to which LTE (Long-Term Evolution) wireless networks currently utilize Positioning Reference Signals (PRS) and/or Cell-specific Reference Signals (CRS) for position determination.

SUMMARY

[0002] An example user equipment includes: an SPS receiver (Satellite Positioning System receiver) to receive satellite positioning system signals including a first SPS signal; a memory; and a processor communicatively coupled to the memory and to the SPS receiver, to receive SPS signals from the SPS receiver, and configured to: determine whether the first SPS signal is anomalous by being configured to at least one of: (1) determine a first SPS signal measurement of the first SPS signal, a first format of the first SPS signal corresponding to a first SV (satellite vehicle); determine a second SPS signal measurement of a second SPS signal, the second SPS signal being separate from the first SPS signal, and a second format of the second SPS signal corresponding to a second SV; and determine whether an actual measurement difference between the first SPS signal measurement and the second SPS signal measurement is consistent with an expected measurement difference between expected SPS signals from the first SV and the second SV; or (2) determine whether a received power of the first SPS signal exceeds a maximum expected SPS signal received power; or (3) determine whether the first SPS signal originated from an SV location consistent with first SV location information for the first SV comprising first ephemeris data for the first SV, first orbital information for the first SV, or a combination thereof; or (4) determine whether a first pseudorange, based on the first SPS signal, to the first SV differs by more than a first pseudorange threshold from an expected pseudorange to the first SV based on a time- filtered location of the user equipment determined by the processor; or (5) determine that a first location, of the user equipment, based on the first SPS signal measurement corresponds to at least one of an unexpected location or a high likelihood of anomaly location; or (6) determine whether one or more base station signal measurements are consistent with the first SPS signal measurement; or (7) a measured signal quality of the first SPS signal is consistent with an expected signal quality. [0003] Implementations of such a user equipment may include one or more of the following features. To determine whether the first SPS signal is anomalous, the processor is configured to determine whether an actual power difference between a first power of the first SPS signal measurement and a second power of the second SPS signal measurement differs from an expected power difference by more than a first power threshold. The processor is configured in accordance with (1) and is configured to select the first SPS signal and the second SPS signal such that: the first SPS signal has a first carrier frequency, the second SPS signal has a second carrier frequency that is different from the first carrier frequency, and the first SV and the second SV are the same SV; or the first SV is in a separate constellation from the second SV. The processor is configured in accordance with (1) and is configured to determine the expected measurement difference based on the first SV location information for the first SV and based on second SV location information for the second SV. To determine whether the first SPS signal is anomalous, the processor is configured to determine whether an actual pseudorange difference, between the first pseudorange based on the first SPS signal and a second pseudorange based on the second SPS signal, differs from an expected pseudorange difference by more than a second pseudorange threshold. The processor is configured in accordance with (1), the first SPS signal measurement is a first time, and the second SPS signal measurement is a second time. The processor is configured to respond to an initial determination that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on a third SPS signal that is different from any SPS signal on which the initial determination was based. The processor is configured to select the third SPS signal such that a third format of the third SPS signal corresponds to a third SV that is part of a satellite vehicle constellation that excludes the first SV.

[0004] Also or alternatively, implementations of such a user equipment may include one or more of the following features. The processor is configured to respond to determining that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on at least one technology other than SPS technology. The processor is configured to determine at least one of how many other SV signals or what other technologies to use based on a security level of knowledge of a position of the user equipment. [0005] Also or alternatively, implementations of such a user equipment may include one or more of the following features. The user equipment includes at least one motion sensor communicatively coupled to the processor, and the processor is configured to determine, based on at least one sensor measurement from the at least one motion sensor, a dead-reckoning position of the user equipment and to determine whether the first SPS signal is anomalous in response to at least one of the first SPS signal measurement and the second SPS signal measurement being inconsistent with the dead reckoning position of the user equipment. The processor is configured to respond to determining that the first SPS signal is anomalous by at least one of: disregarding the first SPS signal to determine a position of the user equipment; or disregarding the first pseudorange based on the first SPS signal to determine the position of the user equipment; or de-weighting the first SPS signal to determine the position of the user equipment; or de-weighting the first pseudorange based on the first SPS signal to determine the position of the user equipment; or using the one or more base station signal measurements to determine the position of the user equipment; or increasing one or more weightings of the one or more base station signal measurements to determine the position of the user equipment; or sending an anomaly indication, indicating that the first SPS signal is anomalous, to a first network entity; or sending a set of SPS signal measurements to a second network entity.

[0006] Another example user equipment includes: signal receiving means for receiving SPS signals including a first SPS signal; and anomaly means for determining whether the first SPS signal is anomalous, the anomaly means comprising at least one of: measurement difference means for: determining a first SPS signal measurement of the first SPS signal from the signal receiving means and having a first format corresponding to a first SV; determining a second SPS signal measurement of a second SPS signal from the signal receiving means and having a second format corresponding to a second SV; and determining whether an actual measurement difference between the first SPS signal measurement and the second SPS signal measurement is consistent with an expected measurement difference between expected SPS signals from the first SV and the second SV; or expectation means for determining whether a received power of the first SPS signal exceeds a maximum expected SPS signal received power; or origination means for determining whether the first SPS signal originated from an SV location consistent with first SV location information for the first SV comprising first ephemeris data for the first SV, first orbital information for the first SV, or a combination thereof; or pseudorange means for determining whether a first pseudorange, based on the first SPS signal, to the first SV differs by more than a first pseudorange threshold from an expected pseudorange to the first SV based on a time-filtered location of the user equipment; or location/likelihood means for determining that a first location, of the user equipment, based on the first SPS signal measurement corresponds to at least one of an unexpected location or a high likelihood of anomaly location; or means for determining whether one or more base station signal measurements are consistent with the first SPS signal measurement; or means for determining whether a measured signal quality of the first SPS signal is consistent with an expected signal quality.

[0007] Implementations of such a user equipment may include one or more of the following features. The anomaly means comprise the measurement difference means, and the measurement difference means are for determining whether an actual power difference between a first power of the first SPS signal measurement and a second power of the second SPS signal measurement differs from an expected power difference by more than a first power threshold. The user equipment comprises the measurement difference means and the measurement difference means are for selecting the first SPS signal and the second SPS signal such that: the first SPS signal has a first carrier frequency, the second SPS signal has a second carrier frequency that is different from the first carrier frequency, and the first SV and the second SV are the same SV; or the first SV is in a separate constellation from the second SV. The user equipment comprises the measurement difference means and the measurement difference means are for determining the expected measurement difference based on the first SV location information for the first SV and based on second SV location information for the second SV. The anomaly means comprise the measurement difference means, and the measurement difference means are for determining whether an actual pseudorange difference, between the first pseudorange based on the first SPS signal and a second pseudorange based on the second SPS signal, differs from an expected pseudorange difference by more than a second pseudorange threshold. The anomaly means comprise the measurement difference means, the first SPS signal measurement is a first time, and the second SPS signal measurement is a second time. The anomaly means are for responding to an initial determination that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on a third SPS signal that is different from any SPS signal on which the initial determination was based. The anomaly means are for selecting the third SPS signal such that a third format of the third SPS signal corresponds to a third SV that is part of a satellite vehicle constellation that excludes the first SV.

[0008] Also or alternatively, implementations of such a user equipment may include one or more of the following features. The anomaly means are for responding to an initial determination that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on at least one technology other than SPS technology. The anomaly means are for determining at least one of how many other SV signals or what other technologies to use based on a security level of knowledge of a position of the user equipment.

[0009] Also or alternatively, implementations of such a user equipment may include one or more of the following features. The anomaly means comprise the measurement difference means, and the measurement difference means are for determining a dead-reckoning position of the user equipment, and wherein the anomaly means are for determining whether the first SPS signal is anomalous in response to at least one of the first SPS signal measurement and the second SPS signal measurement being inconsistent with the dead-reckoning position of the user equipment.

The user equipment includes at least one of: position determination means for determining a position of the user equipment by responding to determining that the first SPS signal is anomalous by at least one of: disregarding the first SPS signal to determine the position of the user equipment; or disregarding the first pseudorange based on the first SPS signal to determine the position of the user equipment; or de-weighting the first SPS signal to determine the position of the user equipment; or de-weighting the first pseudorange based on the first SPS signal to determine the position of the user equipment; or using the one or more base station signal measurements to determine the position of the user equipment; or increasing one or more weightings of the one or more base station signal measurements to determine the position of the user equipment; or first sending means for responding to determining that the first SPS signal is anomalous by sending an anomaly indication, indicating that the first SPS signal is anomalous, to a first network entity; or second sending means for responding to determining that the first SPS signal is anomalous by sending a set of SPS signal measurements to a second network entity.

[0010] An example method of detecting an anomalous SPS signal includes: receiving, at a user equipment, a first SPS signal; and determining, at the user equipment, whether the first SPS signal is anomalous by at least one of: determining whether an actual measurement difference, between a first SPS signal measurement of the first SPS signal and a second SPS signal measurement of a second SPS signal, is consistent with an expected measurement difference between expected SPS signals from a first SV (satellite vehicle) and a second SV, wherein the first SPS signal has a first format corresponding to the first SV and the second SPS signal has a second format corresponding to the second SV; or determining whether a received power of the first SPS signal exceeds a maximum expected SPS signal received power; or determining whether the first SPS signal originated from an SV location consistent with first SV location information for the first SV comprising first ephemeris data for the first SV, first orbital information for the first SV, or a combination thereof; or determining whether a first pseudorange, based on the first SPS signal, to the first SV differs by more than a first pseudorange threshold from an expected pseudorange to the first SV based on a time-filtered location of the user equipment; or determining that a first location, of the user equipment, based on the first SPS signal measurement corresponds to at least one of an unexpected location or a high likelihood of anomaly location; or determining whether one or more base station signal measurements are consistent with the first SPS signal measurement; or determining whether a measured signal quality of the first SPS signal is consistent with an expected signal quality.

[0011] Implementations of such a method may include one or more of the following features. Determining whether the first SPS signal is anomalous comprises determining whether the actual measurement difference is consistent with the expected measurement difference by determining whether an actual power difference between a first power of the first SPS signal measurement and a second power of the second SPS signal measurement differs from an expected power difference by more than a first power threshold. Determining whether the first SPS signal is anomalous comprises determining whether the actual measurement difference is consistent with the expected measurement difference, the method further comprising selecting the first SPS signal and the second SPS signal such that: the first SPS signal has a first carrier frequency, the second SPS signal has a second carrier frequency that is different from the first carrier frequency, and the first SV and the second SV are the same SV; or the first SV is in a separate constellation from the second SV. Determining whether the first SPS signal is anomalous comprises determining whether the actual measurement difference is consistent with the expected measurement difference, the method further comprising determining the expected measurement difference based on the first SV location information for the first SV and based on second SV location information for the second SV. Determining whether the first SPS signal is anomalous comprises determining whether the actual measurement difference is consistent with the expected measurement difference by determining whether an actual pseudorange difference, between the first pseudorange based on the first SPS signal and a second pseudorange based on the second SPS signal, differs from an expected pseudorange difference by more than a second pseudorange threshold. The method comprises determining whether the actual measurement difference is consistent with the expected measurement difference, the first SPS signal measurement is a first time, and the second SPS signal measurement is a second time. The method includes responding to an initial determination that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on a third SPS signal that is different from any SPS signal on which the initial determination was based. The method includes selecting the third SPS signal such that a third format of the third SPS signal corresponds to a third SV that is part of a satellite vehicle constellation that excludes the first SV. [0012] Also or alternatively, implementations of such a method may include one or more of the following features. The method includes responding to an initial determination that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on at least one technology other than SPS technology. The method includes determining at least one of how many other SV signals or what other technologies to use, for determining whether the first SPS signal is anomalous, based on a security level of knowledge of a position of the user equipment.

[0013] Also or alternatively, implementations of such a method may include one or more of the following features. The method comprising determining a dead-reckoning position of the user equipment, and determining whether the first SPS signal is anomalous is performed in response to at least one of the first SPS signal measurement and the second SPS signal measurement being inconsistent with the dead-reckoning position of the user equipment. The method comprising responding to determining that the first SPS signal is anomalous by at least one of: disregarding the first SPS signal to determine a position of the user equipment; or disregarding the first pseudorange based on the first SPS signal to determine the position of the user equipment; or de-weighting the first SPS signal to determine the position of the user equipment; or de-weighting the first pseudorange based on the first SPS signal to determine the position of the user equipment; or using the one or more base station signal measurements to determine the position of the user equipment; or increasing one or more weightings of the one or more base station signal measurements to determine the position of the user equipment; or sending an anomaly indication, indicating that the first SPS signal is anomalous, to a first network entity; or sending a set of SPS signal measurements to a second network entity.

[0014] An example non-transitory, processor-readable storage medium includes processor-readable instructions configured to cause a processor of a user equipment to: determine whether a first SPS signal is anomalous by causing the processor to at least one of: (1) determine a first SPS signal measurement of the first SPS signal, a first format of the first SPS signal corresponding to a first SV; determine a second SPS signal measurement of a second SPS signal, the second SPS signal being separate from the first SPS signal, and a second format of the second SPS signal corresponding to a second SV; and determine whether an actual measurement difference between the first SPS signal measurement and the second SPS signal measurement is consistent with an expected measurement difference between expected SPS signals from the first SV and the second SV; or (2) determine whether a received power of the first SPS signal exceeds a maximum expected SPS signal received power; or (3) determine whether the first SPS signal originated from an SV location consistent with first SV location information for the first SV comprising first ephemeris data for the first SV, first orbital information for the first SV, or a combination thereof; or (4) determine whether a first pseudorange, based on the first SPS signal, to the first SV differs by more than a first pseudorange threshold from an expected pseudorange to the first SV based on a time- filtered location of the user equipment determined by the processor; or (5) determine that a first location, of the user equipment, based on the first SPS signal measurement corresponds to at least one of an unexpected location or a high likelihood of anomaly location; or (6) determine whether one or more base station signal measurements are consistent with the first SPS signal measurement; or (7) determine whether a measured signal quality of the first SPS signal is consistent with an expected signal quality.

[0015] Implementations of such a storage medium may include one or more of the following features. The instructions configured to cause the processor to determine whether the first SPS signal is anomalous comprise instructions configured to cause the processor to determine whether an actual power difference between a first power of the first SPS signal measurement and a second power of the second SPS signal measurement differs from an expected power difference by more than a first power threshold. The instructions configured to cause the processor to determine whether the first SPS signal is anomalous in accordance with (1), and wherein the instructions comprise instructions configured to cause the processor to select the first SPS signal and the second SPS signal such that: the first SPS signal has a first carrier frequency, the second SPS signal has a second carrier frequency that is different from the first carrier frequency, and the first SV and the second SV are the same SV; or the first SV is in a separate constellation from the second SV. The instructions configured to cause the processor to determine whether the first SPS signal is anomalous in accordance with (1), and wherein the instructions comprise instructions configured to cause the processor to determine the expected measurement difference based on the first SV location information for the first SV and based on second SV location information for the second SV. The instructions configured to cause the processor to determine whether the first SPS signal is anomalous comprise instructions configured to cause the processor to determine whether an actual pseudorange difference, between the first pseudorange based on the first SPS signal and a second pseudorange based on the second SPS signal, differs from an expected pseudorange difference by more than a second pseudorange threshold. The instructions comprise the instructions configured to cause the processor to determine whether the first SPS signal is anomalous by causing the processor to determine whether the actual measurement difference between the first SPS signal measurement and the second SPS signal measurement is consistent with the expected measurement difference, the first SPS signal measurement is a first time, and the second SPS signal measurement is a second time. The instructions comprise instructions configured to cause the processor to respond to an initial determination that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on a third SPS signal that is different from any SPS signal on which the initial determination was based. The instructions comprise instructions configured to cause the processor to select the third SPS signal such that a third format of the third SPS signal corresponds to a third SV that is part of a satellite vehicle constellation that excludes the first SV. [0016] Also or alternatively, implementations of such a storage medium may include one or more of the following features. The instructions comprise instructions configured to cause the processor to respond to determining that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on at least one technology other than SPS technology. The instructions comprise instructions configured to cause the processor to determine at least one of how many other SV signals or what other technologies to use based on a security level of knowledge of a position of the user equipment.

[0017] Also or alternatively, implementations of such a storage medium may include one or more of the following features. The instructions comprise instructions configured to cause the processor to determine a dead-reckoning position of the user equipment, and wherein the instructions are configured to cause the processor to determine whether the first SPS signal is anomalous in response to at least one of the first SPS signal measurement and the second SPS signal measurement being inconsistent with the dead-reckoning position of the user equipment. The instructions comprise instructions configured to cause the processor to respond to determining that the first SPS signal is anomalous by at least one of: disregarding the first SPS signal to determine a position of the user equipment; or disregarding the first pseudorange based on the first SPS signal to determine the position of the user equipment; or de-weighting the first SPS signal to determine the position of the user equipment; or de-weighting the first pseudorange based on the first SPS signal to determine the position of the user equipment; or using the one or more base station signal measurements to determine the position of the user equipment; or increasing one or more weightings of the one or more base station signal measurements to determine the position of the user equipment; or sending an anomaly indication, indicating that the first SPS signal is anomalous, to a first network entity; or sending a set of SPS signal measurements to a second network entity. [0018] Another example user equipment comprising: an SPS receiver to receive satellite positioning system signals; a communication transmitter; a memory; and a processor communicatively coupled to the memory, to the SPS receiver to receive SPS signals from the SPS receiver, and to the communication transmitter to convey communication signals wirelessly, the processor being configured to respond to a request for authorization for a financial transaction by conveying, via the communication transmitter to a network entity: a plurality of SPS measurements corresponding to a plurality of SPS signals; identities of satellite vehicles corresponding to the plurality of SPS signals; a position of the user equipment based on a positioning technique other than an SPS positioning technique; and a timestamp.

[0019] Implementations of such a user equipment may include one or more of the following features. The processor is configured to encrypt the plurality of SPS measurements. The plurality of SPS measurements comprise pseudoranges. The plurality of SPS measurements comprise raw measurements of the plurality of SPS signals.

[0020] An example method, at a user equipment, of processing positioning signals including an alleged satellite positioning signal that is spoofed includes: measuring a plurality of positioning signals, including the alleged satellite positioning signal, to produce a plurality of positioning signal measurements including a first positioning signal measurement of the alleged satellite positioning signal and a second positioning signal measurement of one of the plurality of positioning signals other than the alleged satellite positioning signal; determining a difference between the first positioning signal measurement and the second positioning signal measurement; determining that the difference is greater than a threshold difference; and determining a location of the user equipment using at least one location-determining measurement of the plurality of positioning signal measurements while, in response to determining that the difference is greater than the threshold difference, excluding the first positioning signal measurement from the at least one location-determining measurement.

[0021] An example positioning method at a user equipment includes: measuring a plurality of location signals including at least one alleged satellite positioning signal that is spoofed; determining a difference between at least one measurement of the at least one alleged satellite positioning signal and at least one expected satellite positioning signal measurement; determining that the difference is greater than a threshold difference; and determining a location of the user equipment using measurements of the plurality of location signals while excluding the at least one measurement of the at least one alleged satellite positioning signal.

BRIEF DESCRIPTION OF THE DRAWINGS [0022] FIG. 1 is a simplified diagram of an example wireless communications and satellite signaling environment.

[0023] FIG. 2 is a block diagram of components of an example user equipment shown in FIG. 1.

[0024] FIG. 3 is a block diagram of components of an example transmission/reception point shown in FIG. 1.

[0025] FIG. 4 is a block diagram of components of an example server shown in FIG. 1.

[0026] FIG. 5 is a block diagram of an example user equipment.

[0027] FIG. 6 is a simplified diagram of an environment in which a user equipment of FIG. 5 receives anomalous and non-anomalous signals.

[0028] FIG. 7 is a simplified diagram of a signal emulator shown in FIG. 6.

[0029] FIG. 8 is a signal and process flow for identifying an anomalous signal.

[0030] FIG. 9 is a block flow diagram of a method of determining location of a user equipment in the presence of one or more spoofed satellite signals.

[0031] FIG. 10 is a block flow diagram of a method of detecting an anomalous signal.

[0032] FIG. 11 is a block flow diagram of a method of processing positioning signals.

[0033] FIG. 12 is a block flow diagram of a positioning method.

DETAILED DESCRIPTION

[0034] Techniques are discussed herein for detecting anomalous signals such as spoofed satellite positioning system signals. For example, a mobile device may receive one or more anomalous signals. In various embodiments, there may be a set of anomalous signals that overpower or replace the existing SPS (Satellite Positioning System) or other location-related signals to cause mobile devices and/or other devices to calculate an incorrect location or to obfuscate or jam or otherwise make reliable location determination difficult. For example, anomalous signals may be used to spoof or otherwise cause a false location to be determined. Location spoofing may be utilized to fool location-enabled point-of-sale protection or other security based around transactions that are limited to particular geographical scopes or requiring different degrees of authentication depending on geography. Anomalous signals and location spoofing could also be utilized to clog traffic or to cause traffic accidents or to direct autonomous vehicles to the wrong destination or to foil asset-tracking attempts. Anomalous signals could be transmitted in a localized manner such as in a screened chamber or in an enclosed building, taking advantage of weaker indoor SPS signals, or in a more global sense, such as by a satellite constellation (e.g., of another country). No matter the purpose of the anomalous signal(s), the mobile device (e.g., a vehicle) may be configured to detect anomalous signals and to address the anomalous signal(s), for example, by ignoring the anomalous signal(s) in favor of non-spoofed and/or more reliable location sources and/or to flag the anomalous signal(s) to other devices, for example via a location server or base-station based alert or by marking signal sources in assistance data as unreliable. Anomalous signals may be SPS-related or may be terrestrial-based such as being from fake base stations and/or access points. Whatever the signal source and/or the spoofed device, the mobile device may be configured to detect spoofed and/or otherwise anomalous signals and to calculate the location of the mobile device while eliminating or reducing impact from the anomalous signal(s).

[0035] An anomalous signal may have a corresponding purported source, e.g., by having a format similar to (e.g., identical to) a format of signals sent by the purported source; however, the anomalous signal may have modified parameters such as time and/or date information, identification, encoded ephemeris or other encoded information that would lead the mobile device to calculate the wrong location or fail to calculate a location. For example, a set of SPS signals may be emulated to cause the mobile device to calculate a location that is different than the actual location. For example, anomalous signals may simulate signals of a particular SPS constellation at a particular frequency band such as GPS (Global Positioning System) signal(s) at LI or may comprise simulated signals corresponding to multiple SPS constellations and/or of multiple frequency bands. The more complex the anomalous scenario becomes, the more technically difficult the scenario may be to create/emulate and the more expensive the anomalous scenario becomes to deploy. In an embodiment, the mobile device may compare a measurement of the received anomalous signal to a measurement of another received signal that is expected to have comparable power, path delay, and/or other signal parameters. In an embodiment, a GPS LI signal from a particular satellite may be compared against what would be expected for a corresponding signal from the same satellite at a different band such as GPS L5 or GPS L2 or other frequency band relative to signal strength, signal delay, encoded information and other signal parameters. If the corresponding signal from the other band is not present or differs significantly in one or more details such as signal strength, timing, and/or encoded information, the signal may be anomalous.

In an embodiment, a GPS signal from a first satellite may be compared against other GPS signals from other satellites or SPS signals from other constellations such as GLONASS for consistency in predicted location and/or signal strength, timing, or encoded messaging, comparing predicted signal and messaging parameters against expected signal and messaging parameters, given current ephemeris information for each constellation and approximate location of the mobile device.

Similar techniques may be applied across other constellations such as GLONASS, Galileo, and BeiDou. In an embodiment, a least squares fit calculation may be done or measurements inserted into a Kalman or other positioning filter, where measurements that do not agree with the current estimated location and/or that have significant variance from the other measurements inserted into the location calculation may be flagged as suspect. This is particularly true if signal parameters vary by more than can be predicted by naturally-occurring signal multipath conditions (e.g., predict a location more than a few hundred meters away from the true location or are significantly stronger than signals from other satellites and/or constellations), possibly also considering the current environment and blockage conditions. For example, SPS multipath may result in determined location being off hundreds of meters but will typically not result in a calculated location further away from true location than a few hundred meters, such as in another city or another country, determined from other detected signals and/or from location state engines such as a location predicted by an ongoing Kalman filtering operation or recently stored determined location, possibly aged for uncertainty growth based upon a reasonable estimated travel speed or a maximum travel speed.

[0036] Received power of the received signal(s) may be compared with an expected power for signals from the sources corresponding to the received signals. If the signal power is significantly different than a predicted or expected signal power, then the received signal(s) may be identified as anomalous. In an embodiment, SPS signals may be compared against other SPS signals received at the same time for consistency in received power, encoded messaging, ephemeris information, time, and other parameters and SPS signals that do not agree with either the majority of the received signals or that do not agree with location history or do not agree with location filter output, especially those that would predict significantly different locations, may be flagged as anomalous. In an embodiment, a set of SPS signals may be identified that are consistent with each other, perhaps received at a stronger signal power, and the power, encoded data, and predicted location can be compared against prior or predicted location, against lower-power-received SPS signals, either on the same band or on other bands, for consistency and rejected if the SPS signals in the set disagree with current or predicted location state by a significant degree or if the SPS signals in the set do not agree with a plurality of other SPS signals such as signals from other constellations and/or SPS signals received at other frequencies. In some scenarios, a spoofing source (regardless of technology, whether SPS, WAN, or WiFi) is likely to be the strongest signal source present as the intent is to cause the mobile device to disregard other signal sources based on typical criteria to use the strongest signal sources (which would normally mean the sources with the least multipath, with the exception of spoofed signals which take advantage of these criteria). [0037] A satellite measurement may be compared against other measurements of signals from other satellites within a given constellation or multiple constellations to determine whether all satellites are consistent within reason with what would be predicted based on ephemeris information and time. If, for example, measurements of signals from many (e.g., a majority of) the satellites yield one location and measurements of a few signals, albeit with stronger receive power, coalesce around a different location (especially one far off from the first location), then the few signals may be identified as anomalous (e.g., potentially spoofed). In such a scenario, there may be two clusters of locations, one close to a location based on historical data and/or other satellite systems which may be used to predict where the other satellites ought to be (or their signal strength, or Doppler, or time-of-flight/delay, or combination thereof, ought to be) and another clustered around a bogus emulated location.

[0038] In another embodiment, the mobile device may determine, based on known almanac and/or ephemeris information and time, a region of sky corresponding to the origin of the anomalous signal and determine whether the purported source of the anomalous signal is consistent with what would be predicted based on ephemeris/almanac and time. In an embodiment, the mobile device, particularly in areas of significant blockage and/or multipath, may compare an SPS signal against other SPS signals that are, based on ephemeris predictions and time, predicted to be originating from satellites in the same region of the sky for consistency in signal power and timing (with the assumption that these signals would experience the same multipath and attenuation). [0039] As yet another example, a time-filtered location of the mobile device may be determined with a filter, such as a Kalman filter, that uses multiple measurements over time. The mobile device may identify a received signal as being anomalous if a pseudorange based on the received signal is inconsistent with the time-filtered location (e.g., comes no closer than a threshold distance from the time-filtered location).

[0040] Still other example techniques may be used to identify anomalous signals. In an embodiment, a group of strong signals, particularly if the strong signals are from the same SPS constellation and the same band, may be used to determine a location which is then validated against terrestrial location signals and/or Kalman filter output and/or recently stored location (e.g., less than an hour) and, if there is inconsistency, weaker SPS signals stored in memory may be utilized to determine the location while ignoring the stronger signals. Also or alternatively, a secondary SPS search could be conducted identifying secondary or lower-strength correlation peaks and comparing the pseudoranges predicted by these lower-strength peaks against other constellations and/or against terrestrial sources to attempt to calculate a true SPS location while disregarding anomalous sources. Also or alternatively, phase delay times and/or Doppler of the signals may be compared to determine whether the higher-strength-peak signals may be anomalous (with signals outside expected time windows and/or Doppler windows being identified as anomalous). Also or alternatively, a coarse location of a mobile device (e.g., based on WAN and/or WiFi signals) may be used to determine expected Doppler and phase shift, and an SPS signal that is significantly different from the expected Doppler and/or phase shift may be identified as anomalous. In an embodiment, search windows may be set based on weaker SPS location sources or based on terrestrial signal sources and time information, such that anomalous signal sources are ignored. In an embodiment, additional correlation peaks may be reported to and utilized by the location engine, including those further away from strong detected correlation peaks, particularly if the weaker peaks are in agreement with predicted or known location approximations.

[0041] A signal identified as anomalous may be re-checked to help determine whether the signal is erroneous (e.g., spoofed or otherwise inaccurate). One or more techniques used to identify the signal as anomalous may be repeated, e.g., using different measurements or expectations for comparison, and/or one or more other techniques may be used to determine whether the signal is anomalous. If the re-checking does not determine that the signal is anomalous, then the signal may be re-classified as not anomalous and may, for example, be used for location determination. If the re-checking determines that the signal is anomalous, then the signal may be identified as erroneous and appropriate action taken (e.g., disregarding the signal, notifying other entities of the erroneous nature of the signal, etc.).

[0042] These are examples, and other examples may be implemented.

[0043] Items and/or techniques described herein may provide one or more of the following capabilities, as well as other capabilities not mentioned. Spoofed or otherwise inaccurate signals such as satellite positioning signals may be identified. Use of inaccurate signals in determining a location of a mobile device may be avoided or discounted. Determination of an incorrect location based on one or more inaccurate signals may be avoided and actions based on such incorrect location may be prevented. Fraudulent assertions of location may be prevented. Fraudulent financial transactions using location verification may be avoided. Other capabilities may be provided and not every implementation according to the disclosure must provide any, let alone all, of the capabilities discussed.

[0044] Referring to FIG. 1, an example wireless communications and satellite signaling environment 100 includes a wireless communication system 110, mobile SPS-enabled devices 161, 162, 163, a satellite signal emulator 170, and satellite constellations 180, 190. The wireless communication system 110 includes a user equipment (UE) 112, a UE 113, a UE 114, a UE 115, base transceiver stations (BTSs) 120, 121, 122, 123, a network 130, a core network 140, and an external client 150. The core network 140 (e.g., a 5G core network (5GC)) may include back-end devices including, among other things, an Access and Mobility Management Function (AMF) 141, a Session Management Function (SMF) 142, a server 143, and a Gateway Mobile Location Center (GMLC) 144. The AMF 141, the SMF 142, the server 143, and the GMLC 144 are communicatively coupled to each other. The server 143 may be, for example, a Location Management Function (LMF) that supports positioning of the UEs 112-114 (e.g., using techniques such as Assisted Global Navigation Satellite System (A-GNSS), OTDOA (Observed Time Difference of Arrival, e.g., Downlink (DL) OTDOA and/or Uplink (UL) OTDOA), Round Trip Time (RTT), Multi-Cell RTT, RTK (Real Time Kinematic), PPP (Precise Point Positioning), DGNSS (Differential GNSS), E-CID (Enhanced Cell ID), AoA (Angle of Arrival), AoD (Angle of Departure), etc.). The communication system 110 may include additional or alternative components. The satellite signal emulator 170 may be configured to provide erroneous, e.g., spoofed, SPS (Satellite Positioning System) signals that appear to be from a satellite, which may lead to erroneous location determination, e.g., by one or more of the devices 161-163 and/or one or more of the UEs 112-114. The devices 161-163 and the UEs 112-114 may be configured to identify anomalous SPS signals and take appropriate action, e.g., ignoring the anomalous signals for determining location.

[0045] An LMF may also be referred to as a Location Manager (LM), a Location Function (LF), a commercial LMF (CLMF), or a value-added LMF (VLMF). The server 143 (e.g., an LMF) and/or one or more other devices of the system 110 (e.g., one or more of the UEs 112-114) may be configured to determine locations of the UEs 112-114. The server 143 may communicate directly with the BTS 121 (e.g., a gNB) and/or one or more other BTSs, and may be integrated with the BTS 121 and/or one or more other BTSs. The SMF 142 may serve as an initial contact point of a Service Control Function (SCF) (not shown) to create, control, and delete media sessions. The server 143 (e.g., an LMF) may be co-located or integrated with a gNB or a TRP (Transmission/Reception Point), or may be disposed remote from the gNB and/or TRP and configured to communicate directly or indirectly with the gNB and/or the TRP.

[0046] The AMF 141 may serve as a control node that processes signaling between the UEs 112- 114 and the core network 140, and may provide QoS (Quality of Service) flow and session management. The AMF 141 may support mobility of the UEs 112-114 including cell change and handover and may participate in supporting signaling connection to the UEs 112-114. [0047] The system 110 is capable of wireless communication in that components of the system 110 can communicate with one another (at least some times using wireless connections) directly or indirectly, e.g., via the BTSs 120-123 and/or the network 130 (and/or one or more other devices not shown, such as one or more other base transceiver stations). For indirect communications, the communications may be altered during transmission from one entity to another, e.g., to alter header information of data packets, to change format, etc. The UEs 112-114 shown are a smartphone, a tablet computer, and a vehicle-based device, but these are examples only as the UEs 112-114 are not required to be any of these configurations, and other configurations of UEs may be used. The UEs 112, 113 shown are mobile wireless communication devices (although they may communicate wirelessly and via wired connections) including mobile phones (including smartphones) and a tablet computer. The UE 114 shown is a vehicle-based mobile wireless communication device (although the UE 114 may communicate wirelessly and via wired connections). The UE 115 is shown as a generic UE and may be one or more types of UEs, whether mobile or not, whether of a type shown or not. For example, the UE 115 may include one or more UEs that are, or may be associated with an entity that is, a typically-static or static device such as a cash register, an automatic teller machine (ATM), a restaurant or other building, etc. Other types of UEs may include wearable devices (e.g., smart watches, smart jewelry, smart glasses or headsets, etc.). Still other UEs may be used, whether currently existing or developed in the future. Further, other wireless devices (whether mobile or not) may be implemented within the system 110 and may communicate with each other and/or with the UEs 112-115, the BTSs 120-123, the network 130, the core network 140, and/or the external client 150. For example, such other devices may include internet of thing (IoT) devices, medical devices, home entertainment and/or automation devices, etc. The core network 140 may communicate with the external client 150 (e.g., a computer system), e.g., to allow the external client 150 to request and/or receive location information regarding the UEs 112-114 (e.g., via the GMLC 144).

[0048] The UEs 112-115 or other devices may be configured to communicate in various networks and/or for various purposes and/or using various technologies (e.g., 5G, Wi-Fi communication, multiple frequencies of Wi-Fi communication), satellite positioning, one or more types of communications (e.g., GSM (Global System for Mobiles), CDMA (Code Division Multiple Access), LTE (Long-Term Evolution), V2X (Vehicle-to-everything e.g., V2P (Vehicle-to- Pedestrian), V2I (Vehicle-to-Infrastructure), V2V (Vehicle-to-Vehicle), etc.), IEEE 802. lip, etc.). V2X communications may be cellular (Cellular-V2X (C-V2X)) and/or WiFi (e.g., DSRC (Dedicated Short-Range Connection)). The system 110 may support operation on multiple carriers (waveform signals of different frequencies). Multi-carrier transmitters can transmit modulated signals simultaneously on the multiple carriers. Each modulated signal may be a Code Division Multiple Access (CDMA) signal, a Time Division Multiple Access (TDMA) signal, an Orthogonal Frequency Division Multiple Access (OFDMA) signal, a Single-Carrier Frequency Division Multiple Access (SC-FDMA) signal, etc. Each modulated signal may be sent on a different carrier and may carry pilot, overhead information, data, etc. The communication links shown in FIG. 1 are examples and not limiting of the disclosure. The UEs 112-114 may communicate with base stations, with other UEs, etc.

[0049] The BTSs 120-123 may wirelessly communicate with the UEs 112-115 in the system 110 via one or more antennas. A BTS may also be referred to as a base station, an access point, a gNode B (gNB), an access node (AN), a Node B, an evolved Node B (eNB), etc. For example, each of the BTSs 120, 121 may be a gNB or a transmission point gNB, the BTS 122 may be a macro cell (e.g., a high-power cellular base station) and/or a small cell (e.g., a low-power cellular base station), and the BTS 123 may be an access point (e.g., a short-range base station configured to communicate with short-range technology such as WiFi, WiFi-Direct (WiFi-D), Bluetooth®, Bluetooth®-low energy (BEE), Zigbee, etc. One or more of the BTSs 120-123 may be configured to communicate with the UEs 112-115 via multiple carriers. Each of the BTSs 120, 121 may provide communication coverage for a respective geographic region, e.g. a cell. Each cell may be partitioned into multiple sectors as a function of the base station antennas. A BTS may be any of a variety of forms such as a desktop device, a roadside unit (RSU), etc.

[0050] The BTSs 120-123 each comprise one or more Transmission/Reception Points (TRPs).

For example, each sector within a cell of a BTS may comprise a TRP, although multiple TRPs may share one or more components (e.g., share a processor but have separate antennas). The system 110 may include only macro TRPs or the system 110 may have TRPs of different types, e.g., macro, pico, and/or femto TRPs , etc. A macro TRP may cover a relatively large geographic area (e.g., several kilometers in radius) and may allow unrestricted access by terminals with service subscription. A pico TRP may cover a relatively small geographic area (e.g., a pico cell) and may allow unrestricted access by terminals with service subscription. A femto or home TRP may cover a relatively small geographic area (e.g., a femto cell) and may allow restricted access by terminals having association with the femto cell (e.g., terminals for users in a home).

[0051] The UEs 112-115 may be referred to as terminals, access terminals (ATs), mobile stations, mobile devices, subscriber units, etc. The UEs 112-115 may include various devices as listed above and/or other devices. The UEs 112-115 may be configured to connect indirectly to one or more communication networks via one or more device-to-device (D2D) peer-to-peer (P2P) links. The D2D P2P links may be supported with any appropriate D2D radio access technology (RAT), such as LTE Direct (LTE-D), WiFi Direct (WiFi-D), Bluetooth®, and so on. One or more of a group of the UEs 112-115 utilizing D2D communications may be within a geographic coverage area of a TRP such as one or more of the BTSs 120-123. Other UEs in such a group may be outside such geographic coverage areas, or be otherwise unable to receive transmissions from a base station. Groups of the UEs 112-115 communicating via D2D communications may utilize a one-to-many (1 :M) system in which each UE may transmit to other UEs in the group. A TRP of the BTSs 120-123 may facilitate scheduling of resources for D2D communications. In other cases, D2D communications may be carried out between UEs without the involvement of a TRP.

[0052] The mobile SPS-enabled devices 161-163 are configured with SPS capabilities (e.g., to determine location based on received SPS signals). One or more of the SPS-enabled devices 161- 163 may be configured with other capabilities, e.g., communication capabilities, similar to those of the UEs 112-115. The device 161 is an airplane and the device 162 is an unoccupied aerial vehicle (UAV), but these are examples only and not limiting of the disclosure. The mobile SPS-enabled device 163 is shown as a generic SPS-enabled device. The device 163 may be one or more mobile SPS-enabled devices such as one or more land-based items (e.g., a train, a truck, a tank, etc.), one or more water-based items (e.g., a ship, a jet-ski, etc.), and/or one or more air-based items (e.g., a missile, a space ship, etc.), etc. These examples are non-limiting of the disclosure and other SPS- enabled devices may be used.

[0053] The communication system 110 may utilize information from a constellation 180 of satellite vehicles (SVs) 181, 182, 183 and/or a constellation 190 ofSVs 191, 192, 193. Each of the constellations 180, 190 may correspond to a respective Global Navigation Satellite System (GNSS) (i.e., Satellite Positioning System (SPS)) such as the Global Positioning System (GPS), the GLObal NAvigation Satellite System (GLONASS), Galileo, BeiDou, or some other local or regional SPS such as the Indian Regional Navigational Satellite System (IRNSS), the European Geostationary Navigation Overlay Service (EGNOS), or the Wide Area Augmentation System (WAAS). Only three SVs are shown for each of the constellations 180, 190, but constellations of GNSS SVs will include more than three SVs.

[0054] Referring also to FIG. 2, a UE 200 is an example of one of the UEs 105, 106 and comprises a computing platform including a processor 210, memory 211 including software (SW) 212, one or more sensors 213, a transceiver interface 214 for a transceiver 215 (that includes a wireless transceiver 240 and/or a wired transceiver 250), a user interface 216, a Satellite Positioning System (SPS) receiver 217, a camera 218, and a position device (PD) 219. The processor 210, the memory 211, the sensor(s) 213, the transceiver interface 214, the user interface 216, the SPS receiver 217, the camera 218, and the position device 219 may be communicatively coupled to each other by a bus 220 (which may be configured, e.g., for optical and/or electrical communication). One or more of the shown apparatus (e.g., the camera 218, the position device 219, and/or one or more of the sensor(s) 213, etc.) may be omitted from the UE 200. The processor 210 may include one or more intelligent hardware devices, e.g., a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 210 may comprise multiple processors including a general-purpose/ application processor 230, a Digital Signal Processor (DSP) 231, a modem processor 232, a video processor 233, and/or a sensor processor 234. One or more of the processors 230-234 may comprise multiple devices (e.g., multiple processors). For example, the sensor processor 234 may comprise, e.g., processors for RF (radio frequency) sensing (with one or more (cellular) wireless signals transmitted and reflection(s) used to identify, map, and/or track an object), and/or ultrasound, etc. The modem processor 232 may support dual SIM/dual connectivity (or even more SIMs). For example, a SIM (Subscriber Identity Module or Subscriber Identification Module) may be used by an Original Equipment Manufacturer (OEM), and another SIM may be used by an end user of the UE 200 for connectivity. The memory 211 is a non-transitory storage medium that may include random access memory (RAM), flash memory, disc memory, and/or read-only memory (ROM), etc. The memory 211 stores the software 212 which may be processor- readable, processor-executable software code containing instructions that are configured to, when executed, cause the processor 210 to perform various functions described herein. Alternatively, the software 212 may not be directly executable by the processor 210 but may be configured to cause the processor 210, e.g., when compiled and executed, to perform the functions. The description may refer only to the processor 210 performing a function, but this includes other implementations such as where the processor 210 executes software and/or firmware. The description may refer to the processor 210 performing a function as shorthand for one or more of the processors 230-234 performing the function. The description may refer to the UE 200 performing a function as shorthand for one or more appropriate components of the UE 200 performing the function. The processor 210 may include a memory with stored instructions in addition to and/or instead of the memory 211. Functionality of the processor 210 is discussed more fully below.

[0055] The configuration of the UE 200 shown in FIG. 2 is an example and not limiting of the disclosure, including the claims, and other configurations may be used. For example, an example configuration of the UE includes one or more of the processors 230-234 of the processor 210, the memory 211, and the wireless transceiver 240. Other example configurations include one or more of the processors 230-234 of the processor 210, the memory 211, the wireless transceiver 240, and one or more of the sensor(s) 213, the user interface 216, the SPS receiver 217, the camera 218, the PD 219, and/or the wired transceiver 250.

[0056] The UE 200 may comprise the modem processor 232 that may be capable of performing baseband processing of signals received and down-converted by the transceiver 215 and/or the SPS receiver 217. The modem processor 232 may perform baseband processing of signals to be upconverted for transmission by the transceiver 215. Also or alternatively, baseband processing may be performed by the processor 230 and/or the DSP 231. Other configurations, however, may be used to perform baseband processing.

[0057] The UE 200 may include the sensor(s) 213 that may include, for example, one or more of various types of sensors such as one or more inertial sensors, one or more magnetometers, one or more environment sensors, one or more optical sensors, one or more weight sensors, one or more radio frequency (RF) sensors, one or more ranging sensors, and/or one or more audio sensors (e.g., microphones), etc. An inertial measurement unit (IMU) may comprise, for example, one or more accelerometers (e.g., collectively responding to acceleration of the UE 200 in three dimensions) and/or one or more gyroscopes (e.g., three-dimensional gyroscope(s)). The sensor(s) 213 may include one or more magnetometers (e.g., three-dimensional magnetometer(s)) to determine orientation (e.g., relative to magnetic north and/or true north) that may be used for any of a variety of purposes, e.g., to support one or more compass applications. The environment sensor(s) may comprise, for example, one or more temperature sensors, one or more barometric pressure sensors, one or more ambient light sensors, one or more camera imagers, and/or one or more microphones, etc. The sensor(s) 213 may generate analog and/or digital signals indications of which may be stored in the memory 211 and processed by the DSP 231 and/or the processor 230 in support of one or more applications such as, for example, applications directed to positioning and/or navigation operations. Ranging sensors may include RADAR (radio detection and ranging), LIDAR (light detection and ranging), and/or SONAR (sound navigation and ranging) systems (e.g., each including one or more appropriate transducers such as antennas, optical transducers, and/or one or more speakers and/or microphones).

[0058] The sensor(s) 213 may be used in relative location measurements, relative location determination, motion determination, etc. Information detected by the sensor(s) 213 may be used for motion detection, relative displacement, dead reckoning, sensor-based location determination, and/or sensor-assisted location determination. The sensor(s) 213 may be useful to determine whether the UE 200 is fixed (stationary) or mobile and/or whether to report certain useful information to the LMF 143 regarding the mobility of the UE 200. For example, based on the information obtained/measured by the sensor(s) 213, the UE 200 may notify/report to the LMF 143 that the UE 200 has detected movements or that the UE 200 has moved, and report the relative displacement/distance (e.g., via dead reckoning, or sensor-based location determination, or sensor- assisted location determination enabled by the sensor(s) 213). In another example, for relative positioning information, the sensors/IMU can be used to determine the angle and/or orientation of the other device with respect to the UE 200, etc.

[0059] The IMU may be configured to provide measurements about a direction of motion and/or a speed of motion of the UE 200, which may be used in relative location determination. For example, one or more accelerometers and/or one or more gyroscopes of the IMU may detect, respectively, a linear acceleration and a speed of rotation of the UE 200. The linear acceleration and speed of rotation measurements of the UE 200 may be integrated over time to determine an instantaneous direction of motion as well as a displacement of the UE 200. The instantaneous direction of motion and the displacement may be integrated to track a location of the UE 200. For example, a reference location of the UE 200 may be determined, e.g., using the SPS receiver 217 (and/or by some other means) for a moment in time and measurements from the accelerometer(s) and gyroscope(s) taken after this moment in time may be used in dead reckoning to determine present location of the UE 200 based on movement (direction and distance) of the UE 200 relative to the reference location.

[0060] The magnetometer(s) may determine magnetic field strengths in different directions which may be used to determine orientation of the UE 200. For example, the orientation may be used to provide a digital compass for the UE 200. The magnetometer(s) may include a two-dimensional magnetometer configured to detect and provide indications of magnetic field strength in two orthogonal dimensions. The magnetometer(s) may include a three-dimensional magnetometer configured to detect and provide indications of magnetic field strength in three orthogonal dimensions. The magnetometer(s) may provide means for sensing a magnetic field and providing indications of the magnetic field, e.g., to the processor 210.

[0061] The transceiver 215 may include a wireless transceiver 240 and a wired transceiver 250 configured to communicate with other devices through wireless connections and wired connections, respectively. For example, the wireless transceiver 240 may include a wireless transmitter 242 and a wireless receiver 244 coupled to one or more antennas 246 for transmitting (e.g., on one or more uplink channels and/or one or more sidelink channels) and/or receiving (e.g., on one or more downlink channels and/or one or more sidelink channels) wireless signals 248 and transducing signals from the wireless signals 248 to wired (e.g., electrical and/or optical) signals and from wired (e.g., electrical and/or optical) signals to the wireless signals 248. Thus, the wireless transmitter 242 may include multiple transmitters that may be discrete components or combined/integrated components, and/or the wireless receiver 244 may include multiple receivers that may be discrete components or combined/integrated components. The wireless transceiver 240 may be configured to communicate signals (e.g., with TRPs and/or one or more other devices) according to a variety of radio access technologies (RATs) such as 5G New Radio (NR), GSM (Global System for Mobiles), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), UTE (Long- Term Evolution), LTE Direct (LTE-D), 3 GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.1 lp), WiFi, WiFi Direct (WiFi-D), Bluetooth®, Zigbee etc. New Radio may use mm-wave frequencies and/or sub-6GHz frequencies. The wired transceiver 250 may include a wired transmitter 252 and a wired receiver 254 configured for wired communication, e.g., a network interface that may be utilized to communicate with the network 130 to send communications to, and receive communications from, the network 130. The wired transmitter 252 may include multiple transmitters that may be discrete components or combined/integrated components, and/or the wired receiver 254 may include multiple receivers that may be discrete components or combined/integrated components. The wired transceiver 250 may be configured, e.g., for optical communication and/or electrical communication. The transceiver 215 may be communicatively coupled to the transceiver interface 214, e.g., by optical and/or electrical connection. The transceiver interface 214 may be at least partially integrated with the transceiver 215.

[0062] The user interface 216 may comprise one or more of several devices such as, for example, a speaker, microphone, display device, vibration device, keyboard, touch screen, etc. The user interface 216 may include more than one of any of these devices. The user interface 216 may be configured to enable a user to interact with one or more applications hosted by the UE 200. For example, the user interface 216 may store indications of analog and/or digital signals in the memory 211 to be processed by DSP 231 and/or the general-purpose processor 230 in response to action from a user. Similarly, applications hosted on the UE 200 may store indications of analog and/or digital signals in the memory 211 to present an output signal to a user. The user interface 216 may include an audio input/output (I/O) device comprising, for example, a speaker, a microphone, digital-to-analog circuitry, analog-to-digital circuitry, an amplifier and/or gain control circuitry (including more than one of any of these devices). Other configurations of an audio I/O device may be used. Also or alternatively, the user interface 216 may comprise one or more touch sensors responsive to touching and/or pressure, e.g., on a keyboard and/or touch screen of the user interface 216.

[0063] The SPS receiver 217 (e.g., a Global Positioning System (GPS) receiver) may be capable of receiving and acquiring SPS signals 260 via an SPS antenna 262. The antenna 262 is configured to transduce the wireless SPS signals 260 to wired signals, e.g., electrical or optical signals, and may be integrated with the antenna 246. The SPS receiver 217 may be configured to process, in whole or in part, the acquired SPS signals 260 for estimating a location of the UE 200. For example, the SPS receiver 217 may be configured to determine location of the UE 200 by trilateration using the SPS signals 260. The general-purpose processor 230, the memory 211, the DSP 231 and/or one or more specialized processors (not shown) may be utilized to process acquired SPS signals, in whole or in part, and/or to calculate an estimated location of the UE 200, in conjunction with the SPS receiver 217. The memory 211 may store indications (e.g., measurements) of the SPS signals 260 and/or other signals (e.g., signals acquired from the wireless transceiver 240) for use in performing positioning operations. The general-purpose processor 230, the DSP 231, and/or one or more specialized processors, and/or the memory 211 may provide or support a location engine for use in processing measurements to estimate a location of the UE 200.

[0064] The UE 200 may include the camera 218 for capturing still or moving imagery. The camera

218 may comprise, for example, an imaging sensor (e.g., a charge coupled device or a CMOS imager), a lens, analog-to-digital circuitry, frame buffers, etc. Additional processing, conditioning, encoding, and/or compression of signals representing captured images may be performed by the general-purpose processor 230 and/or the DSP 231. Also or alternatively, the video processor 233 may perform conditioning, encoding, compression, and/or manipulation of signals representing captured images. The video processor 233 may decode/decompress stored image data for presentation on a display device (not shown), e.g., of the user interface 216.

[0065] The position device (PD) 219 may be configured to determine a position of the UE 200, motion of the UE 200, and/or relative position of the UE 200, and/or time. For example, the PD

219 may communicate with, and/or include some or all of, the SPS receiver 217. The PD 219 may work in conjunction with the processor 210 and the memory 211 as appropriate to perform at least a portion of one or more positioning methods, although the description herein may refer only to the PD 219 being configured to perform, or performing, in accordance with the positioning method(s). The PD 219 may also or alternatively be configured to determine location of the UE 200 using terrestrial-based signals (e.g., at least some of the signals 248) for trilateration, for assistance with obtaining and using the SPS signals 260, or both. The PD 219 may be configured to use one or more other techniques (e.g., relying on the UE’s self-reported location (e.g., part of the UE’s position beacon)) for determining the location of the UE 200, and may use a combination of techniques (e.g., SPS and terrestrial positioning signals) to determine the location of the UE 200. The PD 219 may include one or more of the sensors 213 (e.g., gyroscope(s), accelerometer(s), magnetometer(s), etc.) that may sense orientation and/or motion of the UE 200 and provide indications thereof that the processor 210 (e.g., the processor 230 and/or the DSP 231) may be configured to use to determine motion (e.g., a velocity vector and/or an acceleration vector) of the UE 200. The PD 219 may be configured to provide indications of uncertainty and/or error in the determined position and/or motion. Functionality of the PD 219 may be provided in a variety of manners and/or configurations, e.g., by the general purpose/application processor 230, the transceiver 215, the SPS receiver 217, and/or another component of the UE 200, and may be provided by hardware, software, firmware, or various combinations thereof.

[0066] Referring also to FIG. 3, an example of a TRP 300 of the base stations 120-123 comprises a computing platform including a processor 310, memory 311 including software (SW) 312, and a transceiver 315. The processor 310, the memory 311, and the transceiver 315 may be communicatively coupled to each other by a bus 320 (which may be configured, e.g., for optical and/or electrical communication). One or more of the shown apparatus (e.g., a wireless interface) may be omitted from the TRP 300. The processor 310 may include one or more intelligent hardware devices, e.g., a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 310 may comprise multiple processors (e.g., including a general-purpose/ application processor, a DSP, a modem processor, a video processor, and/or a sensor processor as shown in FIG. 2). The memory 311 is a non-transitory storage medium that may include random access memory (RAM)), flash memory, disc memory, and/or read-only memory (ROM), etc. The memory 311 stores the software 312 which may be processor-readable, processor-executable software code containing instructions that are configured to, when executed, cause the processor 310 to perform various functions described herein. Alternatively, the software 312 may not be directly executable by the processor 310 but may be configured to cause the processor 310, e.g., when compiled and executed, to perform the functions. The description may refer only to the processor 310 performing a function, but this includes other implementations such as where the processor 310 executes software and/or firmware. The description may refer to the processor 310 performing a function as shorthand for one or more of the processors contained in the processor 310 performing the function. The description may refer to the TRP 300 performing a function as shorthand for one or more appropriate components of the TRP 300 (and thus of one of the base stations 120-123) performing the function. The processor 310 may include a memory with stored instructions in addition to and/or instead of the memory 311. Functionality of the processor 310 is discussed more fully below.

[0067] The transceiver 315 may include a wireless transceiver 340 and/or a wired transceiver 350 configured to communicate with other devices through wireless connections and wired connections, respectively. For example, the wireless transceiver 340 may include a wireless transmitter 342 and a wireless receiver 344 coupled to one or more antennas 346 for transmitting (e.g., on one or more uplink channels and/or one or more downlink channels) and/or receiving (e.g., on one or more downlink channels and/or one or more uplink channels) wireless signals 348 and transducing signals from the wireless signals 348 to wired (e.g., electrical and/or optical) signals and from wired (e.g., electrical and/or optical) signals to the wireless signals 348. Thus, the wireless transmitter 342 may include multiple transmitters that may be discrete components or combined/integrated components, and/or the wireless receiver 344 may include multiple receivers that may be discrete components or combined/integrated components. The wireless transceiver 340 may be configured to communicate signals (e.g., with the UE 200, one or more other UEs, and/or one or more other devices) according to a variety of radio access technologies (RATs) such as 5G New Radio (NR), GSM (Global System for Mobiles), UMTS (Universal Mobile Telecommunications System),

AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long-Term Evolution), LTE Direct (LTE-D), 3 GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.1 lp), WiFi, WiFi Direct (WiFi-D), Bluetooth®, Zigbee etc. The wired transceiver 350 may include a wired transmitter 352 and a wired receiver 354 configured for wired communication, e.g., a network interface that may be utilized to communicate with the network 130 to send communications to, and receive communications from, the LMF 120, for example, and/or one or more other network entities. The wired transmitter 352 may include multiple transmitters that may be discrete components or combined/integrated components, and/or the wired receiver 354 may include multiple receivers that may be discrete components or combined/integrated components. The wired transceiver 350 may be configured, e.g., for optical communication and/or electrical communication.

[0068] The configuration of the TRP 300 shown in FIG. 3 is an example and not limiting of the disclosure, including the claims, and other configurations may be used. For example, the description herein discusses that the TRP 300 is configured to perform or performs several functions, but one or more of these functions may be performed by the LMF 143 and/or the UE 200 (i.e., the LMF 143 and/or the UE 200 may be configured to perform one or more of these functions).

[0069] Referring also to FIG. 4, a server 400, which is an example of the LMF 143, comprises a computing platform including a processor 410, memory 411 including software (SW) 412, and a transceiver 415. The processor 410, the memory 411, and the transceiver 415 may be communicatively coupled to each other by a bus 420 (which may be configured, e.g., for optical and/or electrical communication). One or more of the shown apparatus (e.g., a wireless interface) may be omitted from the server 400. The processor 410 may include one or more intelligent hardware devices, e.g., a central processing unit (CPU), a microcontroller, an application specific integrated circuit (ASIC), etc. The processor 410 may comprise multiple processors (e.g., including a general-purpose/ application processor, a DSP, a modem processor, a video processor, and/or a sensor processor as shown in FIG. 2). The memory 411 is a non-transitory storage medium that may include random access memory (RAM)), flash memory, disc memory, and/or read-only memory (ROM), etc. The memory 411 stores the software 412 which may be processor-readable, processor-executable software code containing instructions that are configured to, when executed, cause the processor 410 to perform various functions described herein. Alternatively, the software 412 may not be directly executable by the processor 410 but may be configured to cause the processor 410, e.g., when compiled and executed, to perform the functions. The description may refer only to the processor 410 performing a function, but this includes other implementations such as where the processor 410 executes software and/or firmware. The description may refer to the processor 410 performing a function as shorthand for one or more of the processors contained in the processor 410 performing the function. The description may refer to the server 400 performing a function as shorthand for one or more appropriate components of the server 400 performing the function. The processor 410 may include a memory with stored instructions in addition to and/or instead of the memory 411. Functionality of the processor 410 is discussed more fully below.

[0070] The transceiver 415 may include a wireless transceiver 440 and/or a wired transceiver 450 configured to communicate with other devices through wireless connections and wired connections, respectively. For example, the wireless transceiver 440 may include a wireless transmitter 442 and a wireless receiver 444 coupled to one or more antennas 446 for transmitting (e.g., on one or more downlink channels) and/or receiving (e.g., on one or more uplink channels) wireless signals 448 and transducing signals from the wireless signals 448 to wired (e.g., electrical and/or optical) signals and from wired (e.g., electrical and/or optical) signals to the wireless signals 448. Thus, the wireless transmitter 442 may include multiple transmitters that may be discrete components or combined/integrated components, and/or the wireless receiver 444 may include multiple receivers that may be discrete components or combined/integrated components. The wireless transceiver 440 may be configured to communicate signals (e.g., with the UE 200, one or more other UEs, and/or one or more other devices) according to a variety of radio access technologies (RATs) such as 5G New Radio (NR), GSM (Global System for Mobiles), UMTS (Universal Mobile Telecommunications System), AMPS (Advanced Mobile Phone System), CDMA (Code Division Multiple Access), WCDMA (Wideband CDMA), LTE (Long-Term Evolution), LTE Direct (LTE- D), 3 GPP LTE-V2X (PC5), IEEE 802.11 (including IEEE 802.1 lp), WiFi, WiFi Direct (WiFi-D), Bluetooth®, Zigbee etc. The wired transceiver 450 may include a wired transmitter 452 and a wired receiver 454 configured for wired communication, e.g., a network interface that may be utilized to communicate with the network 130 to send communications to, and receive communications from, the TRP 300, for example, and/or one or more other entities. The wired transmitter 452 may include multiple transmitters that may be discrete components or combined/integrated components, and/or the wired receiver 454 may include multiple receivers that may be discrete components or combined/integrated components. The wired transceiver 450 may be configured, e.g., for optical communication and/or electrical communication.

[0071] The description herein may refer only to the processor 410 performing a function, but this includes other implementations such as where the processor 410 executes software (stored in the memory 411) and/or firmware. The description herein may refer to the server 400 performing a function as shorthand for one or more appropriate components (e.g., the processor 410 and the memory 411) of the server 400 performing the function.

[0072] Positioning Techniques

[0073] For terrestrial positioning of a UE in cellular networks, techniques such as Advanced Forward Link Trilateration (AFLT) and Observed Time Difference Of Arrival (OTDOA) often operate in “UE-assisted” mode in which measurements of reference signals (e.g., PRS, CRS, etc.) transmitted by base stations are taken by the UE and then provided to a location server. The location server then calculates the position of the UE based on the measurements and known locations of the base stations. Because these techniques use the location server to calculate the position of the UE, rather than the UE itself, these positioning techniques are not frequently used in applications such as car or cell-phone navigation, which instead typically rely on satellite -based positioning.

[0074] A UE may use a Satellite Positioning System (SPS) (a Global Navigation Satellite System (GNSS)) for high-accuracy positioning using precise point positioning (PPP) or real time kinematic (RTK) technology. These technologies use assistance data such as measurements from ground- based stations. LTE Release 15 allows the data to be encrypted so that only the UEs subscribed to the service can read the information. Such assistance data varies with time. Thus, a UE subscribed to the service may not easily “break encryption” for other UEs by passing on the data to other UEs that have not paid for the subscription. The passing on would need to be repeated every time the assistance data changes.

[0075] In UE-assisted positioning, the UE sends measurements (e.g., TDOA, Angle of Arrival (AoA), etc.) to the positioning server (e.g., LMF/eSMLC). The positioning server has the base station almanac (BSA) that contains multiple ‘entries’ or ‘records’, one record per cell, where each record contains geographical cell location but also may include other data. An identifier of the ‘record’ among the multiple ‘records’ in the BSA may be referenced. The BSA and the measurements from the UE may be used to compute the position of the UE.

[0076] In conventional UE-based positioning, a UE computes its own position, thus avoiding sending measurements to the network (e.g., location server), which in turn improves latency and scalability. The UE uses relevant BSA record information (e.g., locations of gNBs (more broadly base stations)) from the network. The BSA information may be encrypted. But since the BSA information varies much less often than, for example, the PPP or RTK assistance data described earlier, it may be easier to make the BSA information (compared to the PPP or RTK information) available to UEs that did not subscribe and pay for decryption keys. Transmissions of reference signals by the gNBs make BSA information potentially accessible to crowd-sourcing or war driving, essentially enabling BSA information to be generated based on in-the-field and/or over- the-top observations.

[0077] Positioning techniques may be characterized and/or assessed based on one or more criteria such as position determination accuracy and/or latency. Latency is a time elapsed between an event that triggers determination of position-related data and the availability of that data at a positioning system interface, e.g., an interface of the LMF 143. At initialization of a positioning system, the latency for the availability of position-related data is called time to first fix (TTFF), and is larger than latencies after the TTFF. An inverse of a time elapsed between two consecutive position- related data availabilities is called an update rate, i.e., the rate at which position-related data are generated after the first fix. Latency may depend on processing capability, e.g., of the UE. For example, a UE may report a processing capability of the UE as a duration of DL PRS symbols in units of time (e.g., milliseconds) that the UE can process every T amount of time (e.g., T ms) assuming 272 PRB (Physical Resource Block) allocation. Other examples of capabilities that may affect latency are a number of TRPs from which the UE can process PRS, a number of PRS that the UE can process, and a bandwidth of the UE.

[0078] One or more of many different positioning techniques (also called positioning methods) may be used to determine position of an entity such as one of the UEs 105, 106. For example, known position-determination techniques include RTT, multi-RTT, OTDOA (also called TDOA and including UL-TDOA and DL-TDOA), Enhanced Cell Identification (E-CID), DL-AoD, UL- AoA, etc. RTT uses a time for a signal to travel from one entity to another and back to determine a range between the two entities. The range, plus a known location of a first one of the entities and an angle between the two entities (e.g., an azimuth angle) can be used to determine a location of the second of the entities. In multi-RTT (also called multi-cell RTT), multiple ranges from one entity (e.g., a UE) to other entities (e.g., TRPs) and known locations of the other entities may be used to determine the location of the one entity. In TDOA techniques, the difference in travel times between one entity and other entities may be used to determine relative ranges from the other entities and those, combined with known locations of the other entities may be used to determine the location of the one entity. Angles of arrival and/or departure may be used to help determine location of an entity. For example, an angle of arrival or an angle of departure of a signal combined with a range between devices (determined using signal, e.g., a travel time of the signal, a received power of the signal, etc.) and a known location of one of the devices may be used to determine a location of the other device. The angle of arrival or departure may be an azimuth angle relative to a reference direction such as true north. The angle of arrival or departure may be a zenith angle relative to directly upward from an entity (i.e., relative to radially outward from a center of Earth). E-CID uses the identity of a serving cell, the timing advance (i.e., the difference between receive and transmit times at the UE), estimated timing and power of detected neighbor cell signals, and possibly angle of arrival (e.g., of a signal at the UE from the base station or vice versa) to determine location of the UE. In TDOA, the difference in arrival times at a receiving device of signals from different sources along with known locations of the sources and known offset of transmission times from the sources are used to determine the location of the receiving device.

[0079] In a network-centric RTT estimation, the serving base station instructs the UE to scan for / receive RTT measurement signals (e.g., PRS) on serving cells of two or more neighboring base stations (and typically the serving base station, as at least three base stations are needed). The one of more base stations transmit RTT measurement signals on low reuse resources (e.g., resources used by the base station to transmit system information) allocated by the network (e.g., a location server such as the LMF 143). The UE records the arrival time (also referred to as a receive time, a reception time, a time of reception, or a time of arrival (ToA)) of each RTT measurement signal relative to the UE’s current downlink timing (e.g., as derived by the UE from a DL signal received from its serving base station), and transmits a common or individual RTT response message (e.g., SRS (sounding reference signal) for positioning, i.e., UL-PRS) to the one or more base stations (e.g., when instructed by its serving base station) and may include the time difference T _Rx®Tx (i.e., UE TRX-TX or UERX-TX) between the ToA of the RTT measurement signal and the transmission time of the RTT response message in a payload of each RTT response message. The RTT response message would include a reference signal from which the base station can deduce the ToA of the RTT response. By comparing the difference T _Tx®Rx between the transmission time of the RTT measurement signal from the base station and the ToA of the RTT response at the base station to the UE-reported time difference T _Rx®Tx , the base station can deduce the propagation time between the base station and the UE, from which the base station can determine the distance between the UE and the base station by assuming the speed of light during this propagation time.

[0080] A UE-centric RTT estimation is similar to the network-based method, except that the UE transmits uplink RTT measurement signal(s) (e.g., when instructed by a serving base station), which are received by multiple base stations in the neighborhood of the UE. Each involved base station responds with a downlink RTT response message, which may include the time difference between the ToA of the RTT measurement signal at the base station and the transmission time of the RTT response message from the base station in the RTT response message payload.

[0081] For both network-centric and UE-centric procedures, the side (network or UE) that performs the RTT calculation typically (though not always) transmits the first message(s) or signal(s) (e.g., RTT measurement signal(s)), while the other side responds with one or more RTT response message(s) or signal(s) that may include the difference between the ToA of the first message(s) or signal(s) and the transmission time of the RTT response message(s) or signal(s).

[0082] A multi-RTT technique may be used to determine position. For example, a first entity (e.g., a UE) may send out one or more signals (e.g., unicast, multicast, or broadcast from the base station) and multiple second entities (e.g., other TSPs such as base station(s) and/or UE(s)) may receive a signal from the first entity and respond to this received signal. The first entity receives the responses from the multiple second entities. The first entity (or another entity such as an LMF) may use the responses from the second entities to determine ranges to the second entities and may use the multiple ranges and known locations of the second entities to determine the location of the first entity by trilateration. [0083] In some instances, additional information may be obtained in the form of an angle of arrival (AoA) or angle of departure (AoD) that defines a straight-line direction (e.g., which may be in a horizontal plane or in three dimensions) or possibly a range of directions (e.g., for the UE from the locations of base stations). The intersection of two directions can provide another estimate of the location for the UE.

[0084] For positioning techniques using PRS (Positioning Reference Signal) signals (e.g., TDOA and RTT), PRS signals sent by multiple TRPs are measured and the arrival times of the signals, known transmission times, and known locations of the TRPs used to determine ranges from a UE to the TRPs. For example, an RSTD (Reference Signal Time Difference) may be determined for PRS signals received from multiple TRPs and used in a TDOA technique to determine position (location) of the UE. A positioning reference signal may be referred to as a PRS or a PRS signal. The PRS signals are typically sent using the same power and PRS signals with the same signal characteristics (e.g., same frequency shift) may interfere with each other such that a PRS signal from a more distant TRP may be overwhelmed by a PRS signal from a closer TRP such that the signal from the more distant TRP may not be detected. PRS muting may be used to help reduce interference by muting some PRS signals (reducing the power of the PRS signal, e.g., to zero and thus not transmitting the PRS signal). In this way, a weaker (at the UE) PRS signal may be more easily detected by the UE without a stronger PRS signal interfering with the weaker PRS signal.

The term RS, and variations thereof (e.g., PRS, SRS), may refer to one reference signal or more than one reference signal.

[0085] Positioning reference signals (PRS) include downlink PRS (DL PRS, often referred to simply as PRS) and uplink PRS (UL PRS) (which may be called SRS (Sounding Reference Signal) for positioning). A PRS may comprise a PN code (pseudorandom number code) or be generated using a PN code (e.g., scrambling a PN code with another signal) such that a source of the PRS may serve as a pseudo-satellite (a pseudolite). The PN code may be unique to the PRS source (at least within a specified area such that identical PRS from different PRS sources do not overlap). PRS may comprise PRS resources or PRS resource sets of a frequency layer. A DL PRS positioning frequency layer (or simply a frequency layer) is a collection of DL PRS resource sets, from one or more TRPs, with PRS resource(s) that have common parameters configured by higher-layer parameters DL-PRS-PositioningFrequencyLayer, DL-PRS-ResourceSet, and DL-PRS-Re source. Each frequency layer has a DL PRS subcarrier spacing (SCS) for the DL PRS resource sets and the DL PRS resources in the frequency layer. Each frequency layer has a DL PRS cyclic prefix (CP) for the DL PRS resource sets and the DL PRS resources in the frequency layer. In 5G, a resource block occupies 12 consecutive subcarriers and a specified number of symbols. Also, a DL PRS Point A parameter defines a frequency of a reference resource block (and the lowest subcarrier of the resource block), with DL PRS resources belonging to the same DL PRS resource set having the same Point A and all DL PRS resource sets belonging to the same frequency layer having the same Point A. A frequency layer also has the same DL PRS bandwidth, the same start PRB (and center frequency), and the same value of comb size (i.e., a frequency of PRS resource elements per symbol such that for comb-N, every N- resource element is a PRS resource element). A PRS resource set is identified by a PRS resource set ID and may be associated with a particular TRP (identified by a cell ID) transmitted by an antenna panel of a base station. A PRS resource ID in a PRS resource set may be associated with an omnidirectional signal, and/or with a single beam (and/or beam ID) transmitted from a single base station (where a base station may transmit one or more beams). Each PRS resource of a PRS resource set may be transmitted on a different beam and as such, a PRS resource (or simply resource), can also be referred to as a beam. This does not have any implications on whether the base stations and the beams on which PRS are transmitted are known to the UE.

[0086] A TRP may be configured, e.g., by instructions received from a server and/or by software in the TRP, to send DL PRS per a schedule. According to the schedule, the TRP may send the DL PRS intermittently, e.g., periodically at a consistent interval from an initial transmission. The TRP may be configured to send one or more PRS resource sets. A resource set is a collection of PRS resources across one TRP, with the resources having the same periodicity, a common muting pattern configuration (if any), and the same repetition factor across slots. Each of the PRS resource sets comprises multiple PRS resources, with each PRS resource comprising multiple Resource Elements (REs) that may be in multiple Resource Blocks (RBs) within N (one or more) consecutive symbol(s) within a slot. An RB is a collection of REs spanning a quantity of one or more consecutive symbols in the time domain and a quantity (12 for a 5G RB) of consecutive sub carriers in the frequency domain. Each PRS resource is configured with an RE offset, slot offset, a symbol offset within a slot, and a number of consecutive symbols that the PRS resource may occupy within a slot. The RE offset defines the starting RE offset of the first symbol within a DL PRS resource in frequency. The relative RE offsets of the remaining symbols within a DL PRS resource are defined based on the initial offset. The slot offset is the starting slot of the DL PRS resource with respect to a corresponding resource set slot offset. The symbol offset determines the starting symbol of the DL PRS resource within the starting slot. Transmitted REs may repeat across slots, with each transmission being called a repetition such that there may be multiple repetitions in a PRS resource. The DL PRS resources in a DL PRS resource set are associated with the same TRP and each DL PRS resource has a DL PRS resource ID. A DL PRS resource ID in a DL PRS resource set is associated with a single beam transmitted from a single TRP (although a TRP may transmit one or more beams).

[0087] A PRS resource may also be defined by quasi-co-location and start PRB parameters. A quasi-co-location (QCL) parameter may define any quasi-co-location information of the DL PRS resource with other reference signals. The DL PRS may be configured to be QCL type D with a DL PRS or SS/PBCH (Synchronization Signal/Physical Broadcast Channel) Block from a serving cell or a non-serving cell. The DL PRS may be configured to be QCL type C with an SS/PBCH Block from a serving cell or a non-serving cell. The start PRB parameter defines the starting PRB index of the DL PRS resource with respect to reference Point A. The starting PRB index has a granularity of one PRB and may have a minimum value of 0 and a maximum value of 2176 PRB s . [0088] A PRS resource set is a collection of PRS resources with the same periodicity, same muting pattern configuration (if any), and the same repetition factor across slots. Every time all repetitions of all PRS resources of the PRS resource set are configured to be transmitted is referred as an “instance”. Therefore, an “instance” of a PRS resource set is a specified number of repetitions for each PRS resource and a specified number of PRS resources within the PRS resource set such that once the specified number of repetitions are transmitted for each of the specified number of PRS resources, the instance is complete. An instance may also be referred to as an “occasion.” A DL PRS configuration including a DL PRS transmission schedule may be provided to a UE to facilitate (or even enable) the UE to measure the DL PRS.

[0089] Multiple frequency layers of PRS may be aggregated to provide an effective bandwidth that is larger than any of the bandwidths of the layers individually. Multiple frequency layers of component carriers (which may be consecutive and/or separate) and meeting criteria such as being quasi co-located (QCLed), and having the same antenna port, may be stitched to provide a larger effective PRS bandwidth (for DL PRS and UL PRS) resulting in increased time of arrival measurement accuracy. Being QCLed, the different frequency layers behave similarly, enabling stitching of the PRS to yield the larger effective bandwidth. The larger effective bandwidth, which may be referred to as the bandwidth of an aggregated PRS or the frequency bandwidth of an aggregated PRS, provides for better time-domain resolution (e.g., of TDOA). An aggregated PRS includes a collection of PRS resources and each PRS resource of an aggregated PRS may be called a PRS component, and each PRS component may be transmitted on different component carriers, bands, or frequency layers, or on different portions of the same band. [0090] RTT positioning is an active positioning technique in that RTT uses positioning signals sent by TRPs to UEs and by UEs (that are participating in RTT positioning) to TRPs. The TRPs may send DL-PRS signals that are received by the UEs and the UEs may send SRS (Sounding Reference Signal) signals that are received by multiple TRPs. A sounding reference signal may be referred to as an SRS or an SRS signal. In 5G multi-RTT, coordinated positioning may be used with the UE sending a single UL-SRS for positioning that is received by multiple TRPs instead of sending a separate UL-SRS for positioning for each TRP. A TRP that participates in multi-RTT will typically search for UEs that are currently camped on that TRP (served UEs, with the TRP being a serving TRP) and also UEs that are camped on neighboring TRPs (neighbor UEs). Neighbor TRPs may be TRPs of a single BTS (e.g., gNB), or may be a TRP of one BTS and a TRP of a separate BTS. For RTT positioning, including multi-RTT positioning, the DL-PRS signal and the UL-SRS for positioning signal in a PRS/SRS for positioning signal pair used to determine RTT (and thus used to determine range between the UE and the TRP) may occur close in time to each other such that errors due to UE motion and/or UE clock drift and/or TRP clock drift are within acceptable limits. For example, signals in a PRS/SRS for positioning signal pair may be transmitted from the TRP and the UE, respectively, within about 10 ms of each other. With SRS for positioning signals being sent by UEs, and with PRS and SRS for positioning signals being conveyed close in time to each other, it has been found that radio-frequency (RF) signal congestion may result (which may cause excessive noise, etc.) especially if many UEs attempt positioning concurrently and/or that computational congestion may result at the TRPs that are trying to measure many UEs concurrently.

[0091] RTT positioning may be UE-based or UE-assisted. In UE-based RTT, the UE 200 determines the RTT and corresponding range to each of the TRPs 300 and the position of the UE 200 based on the ranges to the TRPs 300 and known locations of the TRPs 300. In UE-assisted RTT, the UE 200 measures positioning signals and provides measurement information to the TRP 300, and the TRP 300 determines the RTT and range. The TRP 300 provides ranges to a location server, e.g., the server 400, and the server determines the location of the UE 200, e.g., based on ranges to different TRPs 300. The RTT and/or range may be determined by the TRP 300 that received the signal(s) from the UE 200, by this TRP 300 in combination with one or more other devices, e.g., one or more other TRPs 300 and/or the server 400, or by one or more devices other than the TRP 300 that received the signal(s) from the UE 200.

[0092] Various positioning techniques are supported in 5G NR. The NR native positioning methods supported in 5G NR include DL-only positioning methods, UL-only positioning methods, and DL+UL positioning methods. Downlink-based positioning methods include DL-TDOA and DL-AoD. Uplink -based positioning methods include UL-TDOA and UL-AoA. Combined DL+UL-based positioning methods include RTT with one base station and RTT with multiple base stations (multi -RTT).

[0093] A UE and a server, e.g., an LMF, may engage in upper-layer message exchange (handshaking) to exchange UE capabilities, assistance data for measuring reference signals, and providing position information (e.g., reference signal measurement(s), range(s), position estimate(s), etc.). For example, an LMF may request capabilities of the UE, e.g., for support for E- CID, multi -RTT, DL-AoD, DL-TDOA, and/or UL positioning techniques. The UE may respond to the request by providing the capability(ies) of the UE regarding one or more of the positioning techniques. As another example, the UE may send a request for assistance data to the LMF, e.g., for use by the UE to facilitate measurement and/or other processing of one or more reference signals for one or more positioning techniques such as multi-RTT, DL-AoD, and/or DL-TDOA.

The LMF may respond to the request by providing assistance data to facilitate the measurement and/or processing of one or more reference signals for one or more of the positioning techniques.

As another example, the LMF may request position information from the UE, e.g., regarding E- CID, multi-RTT, DL-AoD, and/or DL-TDOA positioning techniques. The UE may respond by providing position information for one or more of the positioning techniques requested.

[0094] OTDOA-based positioning performance depend on the bandwidth (e.g., maximum bandwidth) of the UE and carrier frequency. Accuracy using OTDOA is affected by a time bandwidth product and thus the bandwidth of the UE affects the resolution providable by the UE for OTDOA. The bandwidth of the UE may vary from UE to UE, but is typically fixed for each UE and may be reported by the UE to an LMF, although each UE may have different bandwidths for different radio technologies (e.g., WiFi vs. LTE vs. NR vs. Bluetooth®, etc.). Further, different carrier frequencies may have different line of sight (LOS) paths due to different propagation of the different carrier frequencies. For example, FR2 (24.25 GHz - 52.6 GHz) typically has better and/or more LOS paths, but higher loss than FR1 (410 MHz - 7.125 GHz).

[0095] Angle of departure/angle of arrival (AoD/AoA) based positioning performance may depend on carrier frequency more so than bandwidth. Propagation may be more affected by carrier frequency than bandwidth, and thus AoD/AoA-based positioning performance may be more dependent on carrier frequency. AoD/AoA-based positioning may be more suitable for indoor positioning of a UE than for outdoor positioning of a UE, e.g., due to stricter outdoor requirements. [0096] SPS Spoofing Detection and Mitigation [0097] Knowing the location of a UE is important for many applications and/or in many circumstances. Consequently, determining an incorrect location of a UE may have significant consequences. An incorrect location may be determined based on erroneous input information such as an incorrect SPS signal, whether the inaccuracy of the SPS signal is unintentional (e.g., due to SV error) or intentional (e.g., due to an entity providing one or more spoofed signals). A spoofed signal is a signal that appears to be from a particular source (e.g., a known, trusted source) but is from a different source. For example, a spoofed signal may have characteristics of a signal from a GPS SV but originate from a GLONASS SV or an SPS simulator (e.g., a terrestrial-based SPS signal generator). Identifying anomalous signals (i.e., signals that are unexpected and that may be spoofed or otherwise inaccurate) may help a UE mitigate the consequences of receiving such signals, e.g., with the UE ignoring or discounting such signals in a determination of a location of the UE.

[0098] Referring to FIG. 5, with further reference to FIGS. 1-4, a UE 500 includes a processor 510, an SPS receiver 515, an interface 520, and a memory 530 communicatively coupled to each other by a bus 540. The UE 500 may include the components shown in FIG. 5, and may include one or more other components such as any of those shown in FIG. 2 such that the UE 200 may be an example of the UE 500. The interface 520 may include one or more components of the transceiver 215 or one or more portions thereof (e.g., the antenna 246 and the wireless transmitter 242, the wireless receiver 244 and the antenna 246, or the wireless transmitter 242, the wireless receiver 244, and the antenna 246). Also or alternatively, the interface 520 may include the wired transmitter 252 and/or the wired receiver 254. The SPS receiver 515 may include the SPS receiver 217 and the antenna 262. The memory 530 may be configured similarly to the memory 211, e.g., including software with processor-readable instructions configured to cause the processor 510 to perform functions.

[0099] The description herein may refer only to the processor 510 performing a function, but this includes other implementations such as where the processor 510 executes software (stored in the memory 530) and/or firmware. The description herein may refer to the UE 500 performing a function as shorthand for one or more appropriate components (e.g., the processor 510 and the memory 530) of the UE 500 performing the function. The processor 510 (possibly in conjunction with the memory 530 and, as appropriate, the SPS receiver 515 (and possibly the interface 520)) includes an anomaly detection unit 550 configured to identify anomalous SPS signals that may be inaccurate, e.g., spoofed. The processor (possibly in conjunction with the memory 530) may include a location determination unit 560 and/or an anomaly reporting unit 570. The processor 510 may be configured to respond to a determination that a signal is anomalous by taking appropriate mitigation action, e.g., discarding the signal, discarding a measurement of the signal, discounting the signal and/or a measurement of the signal as part of determining a location of the UE 500, etc. The configuration and operation of the anomaly detection unit 550 is discussed further below, e.g., with respect to FIGS. 8 and 9, after discussion of FIG. 6 that provides examples of scenarios of anomalous SPS signals.

[00100] The location determination unit 560 is configured to determine a location of the UE 500 in one or more ways. The location determination unit 560 may be configured to determine an approximate location or a more precise location. For example, the location determination unit 560 may be configured to use a location of another entity, e.g., a TRP 300 (e.g., a serving base station) or another UE, that is within communication range of the UE 500 as an approximate location of the UE 500. As another example, the location determination unit 560 may be configured to implement one or more of the positioning techniques discussed above to calculate a precise location of the UE 500. The location determination unit 560 may be configured to determine a time-filtered location of the UE 500 by using a filter, e.g., a Kalman filter, to calculate location using measurements over time. The location determination unit 560 may be configured to provide other location filtering and/or location prediction using previous locations stored in the memory 530. The location determination unit 560 may be configured to map information (e.g., locations of roads, railways, waterways, etc.) as part of a location determination, e.g., to select a location within a range of locations that is consistent with the type of the UE 500 (e.g., to select a road as a location for a car when a range of locations includes a pond). The unit 560 may be configured to disregard (e.g., not use) an anomalous SPS signal and/or an SPS signal measurement based on an anomalous SPS signal in determining the location of the UE 500. The unit 560 may be configured to use, but to de weight, an SPS signal measurement of an SPS signal identified as anomalous to determine a location of the UE 500. For example, the unit 560 may reduce a weighting of (e.g., apply a weighting factor less than 1 to) the SPS signal measurement or may weight the SPS signal measurement less than other SPS signal measurements when the measurement is used in a positioning technique (e.g., an algorithm) for determining the location of the UE 500.

[00101] The anomaly reporting unit 570 is configured to report one or more indications of an anomalous SPS signal (or signals). The unit 570 may report the anomaly(ies) to a user of the UE 500 (e.g., through the user interface 216) and/or to another entity such as a network entity (e.g., the TRP 300 and/or the server 400). The report may be an alarm such as an audible alert and/or a visual alert via the user interface 216. [00102] Referring also to FIG. 6, in an example environment 600, the UE 500 may receive one or more anomalous SPS signals due to various scenarios. For example, the SV 183 may send an anomalous SPS signal 680 to the UE 500. The anomalous SPS signal 680 may be anomalous in one or more ways. For example, the signal 680 may be a spoofed signal, being produced with a format associated with the SV 183 but being inaccurate, e.g., having incorrect timing, which may lead to an inaccurate determination of the range from the UE 500 to the SV 183. As another example, the signal 680 may be a spoofed signal, having a format associated with another SV, e.g., another SV of the same constellation that contains the SV 183 (i.e., the constellation 180) or another SV of a different constellation, e.g., of the constellation 190. In this case, a pseudorange determined for the signal 680 may correspond to the range from the UE 500 to the SV 183 but the UE 500 will use this range as a range from the UE 500 to the expected location (e.g., as indicated by ephemeris data) of the SV 191. In either of these scenarios, i.e., inaccurate information in a signal of a format of the SV 183 or simulating a format of another SV, the UE 500 may calculate an incorrect location for the UE 500 if the UE 500 does not recognize the signal 680 as being anomalous and thus does not take appropriate action, e.g., not use the signal 680 and/or a pseudorange determined from the signal 680 to determine the location of the UE 500. The anomalous SPS signal 680 has a carrier frequency, and the carrier frequency may be a frequency often used by UEs to determine location using SPS signals, such as an LI frequency (1575.42 MHz) of a GPS system. The SV 183 may also send one or more non-anomalous SPS signals such a non-anomalous SPS signal 683, especially if the anomalous SPS signal 680 was sent due to an operational error of the SV 183. The non-anomalous SPS signal 683 may have a different carrier frequency than the anomalous SPS signal 680.

[00103] As another example of the UE 500 receiving an anomalous SPS signal, the UE 500 may receive one or more anomalous SPS signals 615, 625 from signal emulators 610, 620, respectively. The signal emulators 610, 620 may be SPS signal simulators configured to produce and send signals that mimic SPS signals and/or may be configured to simulate one or more non-satellite signals, e.g., WiFi signals, WAN signals, Bluetooth® signals, etc. The anomalous SPS signals 615, 625 may thus emulate signals from (e.g., have formats (e.g., pseudorandom codes) corresponding to) SVs such as the SVs 191, 192, respectively, and/or one or more other signal sources (e.g., terrestrial base stations). The anomalous SPS signals 615, 625 may have much higher power than non-anomalous signals, e.g., SPS signals 691, 692 from the SVs 191, 192, when received by the UE 500, which may cause the UE 500 to lock to the anomalous SPS signals 615, 625 over (instead of) the non-anomalous signals, e.g., the SPS signals 691, 692 actually sent by the SVs 191, 192. The discussion herein may assume that signals to be determined as anomalous/non-anomalous are SPS signals, but the discussion is applicable to non-SPS signals.

[00104] As discussed further below, the UE 500 may use one or more other entities in the environment 600 to help identify anomalous signals as being anomalous, e.g., by determining consistency or inconsistency of the anomalous signal with other information. For example, the UE 500 may be configured to determine a distance to the UE 114 using signaling 630 (e.g., radar signals, sonar signals, and/or lidar signals). The UE 500 may, for example, use this distance information and a location of the UE 114 provided by the UE 114 to the UE 500 to help determine consistency of one or more SPS signals with an approximate location of the UE 500. The UE 500 may be configured to use visual information (e.g., light rays 642 reflected off a landmark 640) to determine the approximate location of the UE 500. The UE 500 may, for example, capture one or more images of the landmark 640 using the camera 218, identify the landmark 640, find a location of the landmark 640 in a lookup table of landmarks and locations (or by inquiring another entity, such as the server 400, for this information), and use the location of the landmark 640 as an approximate location of the UE 500. The UE 500 may also consider one or more other factors such as an orientation of the UE 500, a zoom factor used in capturing an image of the landmark 640, and a size of the landmark in the image, to determine a location of the UE 500 (e.g., based on a location of the UE 500 relative to the landmark 640).

[00105] Referring to FIG. 7, with further reference to FIGS. 1-6, a signal emulator 700 includes a processor 710, an interface 720, and a memory 730 communicatively coupled to each other by a bus 740. The emulator 700 may include some or all of the components shown in FIG. 7, and may include one or more other components such as any of those shown in FIG. 3. The processor 710 may include one or more components of the processor 310. The interface 720 may include one or more of the components of the transceiver 315, e.g., the wireless transmitter 342 and the antenna 346, or the wireless receiver 344 and the antenna 346, or the wireless transmitter 342, the wireless receiver 344, and the antenna 346. The memory 730 may be configured similarly to the memory 311, e.g., including software with processor-readable instructions configured to cause the processor 710 to perform functions.

[00106] The description herein may refer only to the processor 710 performing a function, but this includes other implementations such as where the processor 710 executes software (stored in the memory 730) and/or firmware. The description herein may refer to the emulator 700 performing a function as shorthand for one or more appropriate components (e.g., the processor 710 and the memory 730) of the emulator 700 performing the function. The processor 710 (possibly in conjunction with the memory 730 and, as appropriate, the interface 720) includes an emulation unit 750. The emulation unit 750 may comprise software (e.g., part of the memory 730) to be executed by a processor, and/or firmware, and/or hardware. The configuration and functionality of the emulation unit 750 is discussed further herein.

[00107] The emulation unit 750 may be configured to simulate signals, e.g., from satellites and/or terrestrial-based sources. The emulation unit 750 may be configured to emulate one or more satellite signals (e.g., from one or more satellite constellations, e.g., GPS, GLONASS, BeiDou) and/or one or more non-satellite signals (e.g., WiFi signal(s), WWAN signal(s), Bluetooth® signal(s), etc.), sending the one or more emulated satellite signals via the interface 720 (e.g., one or more appropriate wireless transmitters and/or one or more antennas). The emulation unit 750 may be configured to simulate signals from stationary and/or moving locations. For example, the emulation unit 750 may emulate signals from satellites that move with respect to the Earth over time. As another example, the emulation unit 750 may simulate a location that moves around a geographic area, e.g., in a circle. Such simulation may confuse a UE such that the UE cannot tell which signal(s) to trust, even if the UE can tell that at least one signal being received should not be trusted, e.g., is a spoof signal.

[00108] Referring also to FIG. 8, a signaling and process flow 800 is shown for the UE 500 receiving one or more anomalous SPS signals and identifying the anomalous SPS signals as anomalous. The flow 800 includes the stages shown but is an example only, as stages may be added, rearranged, and/or removed. For example, one or more stages or portions of stages of a method 900 shown in FIG. 9 and discussed herein may be included in the flow 800. Also, a limited quantity of SPS signals are shown in order to facilitate understanding, but numerous other signals may be received by the UE 500, some of which are discussed.

[00109] At stage 810, the UE 500 receives anomalous SPS signals 680, 625 from the SV 183 and the signal emulator 620, respectively. The anomalous SPS signal 680 may, for example, have a format that corresponds to the SV 183 but may be in inaccurate in some way (e.g., timing, power, etc.). As another example, the signal 680 may have a format of another SV, i.e., an SV other than the source of the signal 680, in this example, the SV 183. The anomalous SPS signal 625 may have the format of an SPS signal corresponding to an SV, in this example, the SV 191. For example, the emulation unit 750 of one or more of the signal emulators 700 produces and sends one or more emulated satellite signals, including the anomalous SPS signal 625, via the interface 720 to the UE 500. The emulated signal may have a much higher signal strength, at least at the UE 500, than a satellite signal from a satellite being spoofed by the anomalous SPS signal 625. Anomalous signals spoofing non-SV signals may be received by the UE 500 from the signal emulator 620 (a spoofed- signal source), but the discussion of FIG. 7 uses the example of spoofed SV signals.

[00110] At stage 820, the UE 500 may perform a sky aperture test to determine whether a received signal is expected to be received and/or whether a received signal originated from an expected region of the sky. For example, the anomaly detection unit 550 may be configured to use an estimate of the location of the UE 500 to determine which SVs should be visible and/or which SVs should not be visible to the UE 500. The estimate of the location of the UE 500 may be determined using one or more of various techniques such as dead reckoning based on a previously-determined location, or using a known location of a serving base station as the estimated location, or another technique. The unit 550 may be configured to determine expected visibility based on ephemeris data (indicative of current and future SV locations) for one or more constellations of SVs and an approximate location of the UE 500. The approximate location of the UE 500 may be based, e.g., on a received base station signal and known location of the base station sending the signal, a previously-determined location of the UE 500 and time since the determination of that location, etc. The anomaly detection unit 550 may be configured to identify a signal as anomalous if the signal corresponds to an SV that should not be visible at the present approximate location of the UE 500. Also or alternatively, the anomaly detection unit 550 may be configured to determine an approximate direction (possibly corresponding to a region of the sky) from which a received signal was sent. For example, the unit 550 may use sensor information from one or more of the sensor(s) 213 regarding orientation of the UE 500 and an angle of arrival, relative to the UE 500, of a received signal to determine a region relative to a location of the UE 500 from which the received signal originated, i.e., a source region. The source region may be a range of angles relative to a location of the UE 500, e.g., multiple combinations of Q and f in spherical coordinates. The source region may, for example, be a source direction determined from the angle of arrival and orientation of the UE 500, and an uncertainty around the source direction, e.g., such that the source region includes the source direction and any direction within a threshold angle (e.g., 5°) of the source direction. The unit 550 may be configured to determine whether the source region corresponds to (includes) an expected location of an SV (e.g., based on ephemeris data) corresponding to the received signal (e.g., an SV that sends signals with a same format as a format of the received signal). The unit 550 may be configured to identify the received signal as an anomalous SPS signal if the signal did not originate from the expected location of the SV, e.g., if the expected location is not in the determined source region. For the exaggerated example shown in FIG. 6, the unit 550 may determine that for the anomalous signal 615, the source region (which would include the signal emulator 610) does not include the SV 191, and thus the unit 550 may label the anomalous signal 615 as anomalous.

[00111] The sky aperture test performed at stage 820 may help reduce successful spoofing, particularly for some types of UEs. For example, for a vehicle UE (i.e., a UE in or part of a vehicle), the region of sky corresponding to a spoofed signal may change rapidly, much more rapidly than the region of sky for an actual satellite signal. The UE may thus identity a signal as a spoofed signal based on the corresponding region of sky changing faster than a threshold rate. To combat this, numerous signal emulators could be placed over a large area to attempt to simulate signals from the same satellite. As another example, a spoofed signal may come from a terrestrial- based entity and a sky aperture test performed by an aerial UE may identify a signal source as not being from the sky at all, but from the ground and thus may identify a corresponding “satellite” signal from this source as a spoofed signal.

[00112] At stage 830, non-anomalous signals are sent, e.g., the non-anomalous SPS signals 682, 683, 691, 692 sent by the SVs 182, 183, 191, 192, and received by the UE 500. The timing of the SPS signals shown are examples, and SPS signals may be received at times in addition or instead of the times shown. For example, the non-anomalous SPS signal 691 may be sent by the SV 191 and received by the UE 500 before the anomalous SPS signal 615 is sent by the signal emulator 620 and received by the UE 500. The non-anomalous SPS signal 683 may, for example, have a different carrier frequency than the anomalous SPS signal 680. The non-anomalous SPS signal 691 may, for example, have the same carrier frequency as the anomalous SPS signal 615. The non-anomalous SPS signals 682, 692 may, for example, have the same carrier frequencies as the non-anomalous SPS signals 683, 691, respectively.

[00113] At stage 840, the UE 500 may perform dead reckoning position determination. For example, the processor 510 may use one or more motion sensor measurements to determine an amount (and possibly direction) of movement of the UE 500 since the time of the previously- determined position. The processor 510 may be configured to use the determined movement of the UE 500 and one or more previous SPS signal measurements (e.g., one or more raw measurements, such as time of arrival, and/or one or more processed measurements, such as pseudorange) to determine one or more expected present SPS signal measurements. For example, processor 510 may be configured to use the determined movement (e.g., magnitude and direction) and a previously-determined location of the UE 500 to determine an approximate present location of the UE 500. The processor 510 may be configured to use the approximate present location of the UE 500 and a time since the previously-determined location was determined to determine the expected present SPS signal measurement. The processor 510 may be configured to trigger a consistency check in response to the expected present SPS signal measurement differing from a corresponding actual present SPS signal measurement by more than a threshold amount. The threshold may take a variety of forms (e.g., a percentage, a quantity in units of the measurement (e.g., power)) and may have a variety of values.

[00114] At stage 850, the UE 500 may check SPS signal consistency to determine whether an SPS signal is anomalous. The anomaly detection unit 550 may be configured to determine whether there are one or more inconsistencies regarding one or more signals, e.g., SPS signals, received by the UE 500 relative to one or more expectations. An SPS signal inconsistency may be an unexpected signal measurement determined, for example, relative to one or more other SPS signals from the same SV and/or relative to one or more other SPS signals from one or more other SVs (from the same constellation and/or one or more other constellations), and/or based on a determined location approximation for the UE 500. For example, the anomaly detection unit 550 may be configured to determine whether an inconsistency exists between SPS signals of different bands (carrier frequencies in different bands) and/or between SPS signals of different SVs (intra constellation and/or inter-constellation). Other examples are possible for determining SPS signal inconsistency.

[00115] The anomaly detection unit 550 may be configured to determine whether an SPS signal has a received power that is inconsistent with one or more expectations. For example, the unit 550 may be configured to detect that the received power differs from another received signal power by significantly more than an expected amount. The anomaly detection unit 550 may be configured to determine an actual power difference between received signals and a corresponding expected power difference and determine whether the actual power difference differs from the expected power difference by more than a power threshold, or is higher than a maximum expected power (e.g., for any SPS signal). The analyzed SPS signals may correspond to the same SV and may have the same or different carrier frequencies, or the analyzed SPS signals may correspond to different SVs (within the same constellation or in different constellations). For example, the anomaly detection unit 550 may determine an actual power difference between the anomalous SPS signal 615 (from the signal emulator 620) and the non-anomalous SPS signal 691 (from the SV 191) in response to the anomalous signal 615 having a format corresponding to (similar to or identical to) the format of signals sent by the SV 191, thus giving the appearance that the anomalous signal 615 originated from the SV 191. The anomaly detection unit 550 may be able to differentiate the anomalous SPS signal 615 from the non-anomalous SPS signal 691 based on the signals 615, 691 being in different search windows (i.e., different combinations of time and frequency (with the frequency possibly varying due to Doppler shift of the same carrier frequency)). For example, the anomaly detection unit 550 may determine that signals from one or more other constellations (e.g., GLONASS, BeiDou) have expected received powers, and thus use these signals and/or terrestrial positioning (e.g., using WiFi and/or WAN positioning techniques) to determine an estimated location of the UE 500. Knowing the estimated location and time, the anomaly detection unit 550 may determine the search windows (in time and frequency) for the non-anomalous signals 691, 692, etc. (e.g., of the GPS constellation). The anomaly detection unit 550 may use these search windows to measure the non-anomalous signals 691, 692, and not measure the anomalous signals 615, 625 (or at least to differentiate between the signals 615, 625 and the signals 691, 692, e.g., in response to which the UE 500 may de-weight measurements of the anomalous signals 615, 625 relative to the non- anomalous signals 691, 692). This may be particularly effective when the UE 500 is outdoors, and thus will typically have multiple constellations visible. The anomaly detection unit 550 may also or alternatively determine an expected power difference for multiple SPS signals received from the SV 191. For example, for multiple SPS signals with the same carrier frequency both received from the SV 191 within a threshold amount of time of each other, the anomaly detection unit 550 may determine (e.g., retrieve from the memory 530) an expected power difference that is very small.

The anomaly detection unit 550 may determine whether the actual power difference between the signals 615, 691 differs by more than a power threshold from the expected power difference. For example, the expected power difference for signals from the same SV within a small time window may be zero (or nearly zero), and the power threshold may be small, e.g., 1 dB. Because the anomalous signal 615 came from the signal emulator 620, the power of the signal 615 may be much higher than the power of the signal 691, and thus the difference in power between the signals 615, 691 may be much higher than 1 dB. The anomaly detection unit 550 may respond to the actual difference being more than a threshold amount (e.g., 5%, 10%, 20%, or other amount) greater than the expected difference by identifying the signal 615 as anomalous (and/or identify the signal 691 as anomalous). Comparing signals over time that are supposedly from the same SV and have the same carrier frequency may help detect introduction of a spoofed SPS signal.

[00116] As another example, the anomaly detection unit 550 may determine actual and expected power differences for the signals 615, 691, where the signals 615, 691 have different carrier frequencies. In this case, the expected power difference may be small (e.g., zero or close to zero) and the power threshold may be small, e.g., 1 dB. Comparing signals from the same SV but with different carrier frequencies may help identify spoofed signals as signals may only be spoofed for an SV (or a constellation) for one carrier frequency (or at least less than all carrier frequencies). [00117] As another example, the anomaly detection unit 550 may determine actual and expected power differences between the anomalous SPS signal 615 and another SPS signal of another SV, e.g., one of the SPS signals 682, 683, 692. The anomaly detection unit 550 may determine the expected power difference based on ephemeris data for the appropriate SV 182, 183, 192 and an approximate location of the UE 500. The power threshold may depend on the expected power difference, or may be independent of the power difference, e.g., being a percentage or an amount of decibels. Comparing signals from different SVs may help identify spoofed signals as signals might only be spoofed for one constellation (or at least less than all constellations). For example, if the UE 500 is indoors, all SPS signals will typically be received with very low power if at all, but spoofed SPS signals may be received with much higher power than the actual SPS signals, and with adequate power for location determination. The SVs may be selected based on their visibility to the UE 500 and/or their relative position in the sky. For example, the anomaly detection unit 550 may select SPS signals for SVs that are close enough to each other that the attenuation and/or multi-path effects for the SPS signals from the SVs are likely to be similar, e.g., such that the expected power difference will be near zero.

[00118] Received power inconsistency over time and/or between SVs (e.g., between constellations) may be particularly helpful in identifying indoor SPS signal spoofing. For example, if the anomaly detection unit 550 determines that an SPS signal from an SV in one constellation, e.g., the SV 181 in the constellation 180, decreases in power (e.g., due to the UE 500 moving from being outdoor to indoor) but that the received power from an SPS signal purportedly from another SV of another constellation, e.g., the SV 191 of the constellation 190, increases or at least does not decrease similarly to the power decrease of the SPS signal from the SV 181, then the anomaly detection unit 550 may identify the SPS signal from the SV 191 as anomalous. The anomaly detection unit 550 may be configured to analyze the SPS signals from multiple SVs of multiple constellations such that the anomaly detection unit 550 may identify SPS signals of one constellation as anomalous where the received power of these SPS signals do not decrease in power nearly as much as (or even increase in power relative to) the received power of multiple SPS signals from another constellation. As another example, the anomaly detection unit 550 may determine that an SPS is a spoofed SPS signal if the signal has a received power above a threshold, e.g., a threshold higher than an expected power of any non-spoofed SPS signal. [00119] The anomaly detection unit 550 may be configured to determine whether an SPS signal has a corresponding pseudorange that is inconsistent with expectation. For example, the anomaly detection unit 550 may be configured to determine that a pseudorange to an SV based on a time- filtered location determination differs by more than a pseudorange threshold relative to a pseudorange determined using an SPS signal purportedly from that SV. The anomaly detection unit 550 may use a filter result (e.g., a Kalman filter result) for a location of the UE 500 to determine an expected pseudorange to an expected location of an SV based on ephemeris data. The anomaly detection unit 550 may determine a measured pseudorange to the SV based on a measured SPS signal corresponding to the SV (e.g., having a format of signals from the SV). The anomaly detection unit may identify the measured SPS signal as anomalous if the expected pseudorange differs from the measured pseudorange by more than the pseudorange threshold, e.g., by more than 1%, or 5%, or 10% of the measured pseudorange (or of the expected pseudorange). This may help identify a signal from an SV of one constellation that emulates a signal from another constellation as anomalous. As another example, the anomaly detection unit 550 may be configured to determine that a pseudorange based on received (actual or spoofed) SPS signals purportedly from the same SV deviates from an expectation by more than a pseudorange threshold. For example, the anomaly detection unit 550 may identify a change in pseudorange of more than 1% or more than 5% or more than 10% between pseudorange determinations to indicate that the SPS signal corresponding to the later pseudorange determination is anomalous. The value of the pseudorange threshold may be a function of the time between reception of the SPS signals corresponding to the pseudoranges being compared (e.g., with the pseudorange threshold having a higher value (e.g., a higher percentage) the longer the time between signal reception leading to the pseudoranges being compared). As another example, the anomaly detection unit 550 may be configured to determine whether a pseudorange difference based on measured SPS signals differs by more than a threshold amount from an expected amount. Similar to the discussion above with respect to power differences, the anomaly detection unit 550 may determine a measured pseudorange difference based on measured signals, e.g., the anomalous signal 615 and the non-anomalous signal 692, and determine an expected pseudorange difference to the corresponding SVs 191, 192 (e.g., based on an approximate location of the UE 500 and ephemeris data for the SVs 191, 192), and identify at least one of the signals 615, 691 as anomalous if the difference between measured pseudorange difference and the expected pseudorange difference differ by more than a threshold amount, e.g., by more than 1%, 5%, or 10% of the measured pseudorange (or of the expected pseudorange). [00120] The anomaly detection unit 550 may be configured to identify signal inconsistencies based on ephemeris data. Spoofing signals may be broadcast with significantly higher signal strength than actual SPS signals, but may be broadcast inconsistent with known ephemeris data for the actual satellites. A UE may perform a broad/standalone search for the strongest signals, and thus may lock onto a strong signal allegedly belonging to a constellation and use that signal to determine search windows for other signals of the constellation. The UE may thus only see signals from the spoofed constellation as long as the other spoofed signals are consistent with the spoofed constellation based on an almanac and/or collective ephemeris and/or long-term orbital predictions of the actual constellation, which the UE may have obtained and stored. The anomaly detection unit 550 may be configured to compare the received signals against the existing orbital data (almanac, ephemeris, long-term ephemeris (i.e., long-term orbital)) for the SVs of the constellation. The anomaly detection unit 550 may be configured to identify the received signal(s) spoofed signal(s) base on the received signals being inconsistent with (e.g., not matching) expectation(s) based on the location of the UE 500 and known orbital information for the constellation. Thus, if the spoofed satellites are not consistently generated by the signal emulator(s) 700, e.g., the broadcast ephemeris data of the signals are not consistent with ephemeris data, long-term orbital predictions, and/or GNSS almanac data stored by the UE 500, then the anomaly detection unit 550 may identify the signals as spoofed. The inconsistency(ies) may, for example, be that the signals purport to be from different locations than the stored data indicate the locations to be, e.g., spoofed satellites being present at locations (e.g., together) when the stored ephemeris data indicates that the satellites are at other locations (e.g., not together).

[00121] The anomaly detection unit 550 may be configured to determine time consistency of one or more received, allegedly satellite signals relative to one or more other sources of time. The anomaly detection unit 550 may obtain the time of day (TOD) from the first alleged satellite signal to which the UE 500 locks. This TOD may be used for search windows for other signals, e.g., from the same purported constellation of satellites. The anomaly detection unit 550 may be configured to determine consistency of the TOD from the acquired signal relative to a time kept by the UE 500 (e.g., based on a previously-determined time and time propagation of the previously-determined time using a local clock of the UE 500), one or more times determined from one or more terrestrial- based networks (e.g., WWAN, WiFi, WAN, Internet, etc.), and/or one or more times determined from one or more satellite constellations (e.g., the actual constellation corresponding to a spoofed constellation and/or one or more other constellations). The anomaly detection unit 550 may identify the acquired signal as a spoofed signal if the corresponding TOD differs by more than one or more threshold amounts from one or more other time sources, with the anomaly detection unit 550 allowing for reasonable error/discrepancy between the times, e.g., due to clock drift and/or other sources of known/acceptable error. The anomaly detection unit 550 may be configured to identify significant time difference between the TOD indicated by a received signal to identify the received signal as a spoofed signal. The time difference may be considered different if the time difference is more than a threshold amount that allows for predictable, typical error between systems. The anomaly detection unit 550 may be configured to cause a measurement from a signal identified as being spoofed to be ignored or de-weighted, e.g., by the location determination unit 560.

[00122] The anomaly detection unit 550 may select which SPS signals to use to perform a consistency check, e.g., to determine received power differences and/or pseudorange differences. For example, the anomaly detection unit 550 may be configured to select one or more SPS signals corresponding to one or more respective SVs based on a priority of SVs and/or constellations. The anomaly detection unit 550 may, for example, select SPS signals for SVs based on levels of trust for the SVs and/or constellations, and/or based on one or more other criteria. For example, a native SPS (i.e., an SPS owned by a country associated with the UE 500) may be given a highest level of trust. For example, GPS may be given highest trust (relative to other SPSs) by a UE associated with (e.g., believed to be presently in, or purchased in) the United States of America, Galileo by a UE associated with Europe, BeiDou by a UE associated with China, and GLONASS by a UE associated with Russia. Non-native SPSs may be given lower trust, e.g., in a hierarchy of trust that may depend, for example, on the native SPS. The UE 500 may use the SPSs in order of trust, for example, using the most trusted SPS or the two most trusted SPSs to determine an approximate location of the UE 500, and use this approximate location to check consistency with one or more of the remaining SPSs.

[00123] If the UE 500 is in or part of a moving vehicle, the consequences of a successful spoofing may have a greater impact than for spoofing of another device. The vehicle, however, may have one or more other systems, e.g., redundancy systems, upon which the vehicle may rely to reduce or negate the effect(s) of the spoofing. For example, small inaccuracies may be corrected by checking for consistency with a map and adjusting the location to be consistent with the map (e.g., to move a vehicle location to a road). As another example, a vehicle may use input from one or more cameras, one or more radar systems, one or more lidar systems, and/or one or more sonar systems (and/or one or more other systems) to determine, e.g., inter-vehicle spacing, inter-object spacing, and/or location. Such systems may enable a self-driving vehicle to navigate without GNSS-based location at least for some amount of time. One or more other systems, e.g., WiFi and/or WAN positioning, may be used to determine or verify position, e.g., using one or more crowd-sourced maps and one or more positioning techniques, e.g., trilateration (based on ranges to base stations) or heat-map positioning (based on signal strengths and a map of signal strengths). Such positioning techniques may provide redundant localization data.

[00124] At stage 860, the UE 500 receives a base station signal 865 from the TRP 300 (e.g., one or more of the base stations 120-123 or another base station). The base station signal 865 may include a positioning signal (e.g., a PRS) and/or a communication signal. Signals from more than one TRP 300 may be received.

[00125] At stage 870, the base station signal 865 may be used by the anomaly detection unit 550 to detect consistency between the base station signal 865 and one or more SPS signals. For example, the anomaly detection unit 550 may be configured to use the base station signal 865 from the TRP 300 (e.g., from the BTS 120 or the BTS 123 as shown in FIG. 6) to determine an approximate location of the UE 500. The unit 550 may be configured to use the approximate location to determine one or more expected received powers of one or more SPS signals and/or to determine one or more expected pseudoranges to one or more SVs. The unit 550 may be configured to determine whether the expected received power(s) and/or the expected pseudorange(s) is(are) consistent with measured received power(s) and/or pseudorange(s) determined from a measured SPS signal or measured SPS signals. For example, the unit 550 may determine whether measured and expected received powers differ by less than a power threshold and/or whether measured and expected pseudoranges differ by less than a pseudorange threshold.

[00126] At stage 880, the UE 500 may perform a consistency check using one or more other technologies, i.e., non-SPS technologies. For example, the anomaly detection unit 550 may be configured to obtain location information based on radar, Lidar, WAN, and/or Wi-Fi technologies as such information is available. The anomaly detection unit 550 may be configured to use the location information obtained by one or more of these other technologies to determine whether a location of the UE 500 according to such information is consistent with one or more SPS signals, e.g., consistent with received power level and/or determined pseudorange or location. For example, the anomaly detection unit 550 may obtain an approximate location using the signaling 630 (e.g., radar, lidar, sonar) between the UE 500 and the UE 114 to determine the approximate location of the UE 500 based on a location of the UE 114 and a distance between the UE 114 and the UE 500. As another example, the anomaly detection unit 550 may use visual information to determine the approximate location of the UE 500, e.g., by using visual information to recognize the landmark 640 and use a location of the landmark (e.g., either stored in the memory 530, provided by the landmark 640, or provided by another entity such as the server 400) as the approximate location of the UE 500. The anomaly detection unit 550 may combine technologies, e.g., using visual information of the landmark to identify the landmark and obtain the location of the landmark, using radar to determine a distance from the landmark, and using this distance and the landmark location to determine the approximate location of the UE 500. As another example, the anomaly detection unit 550 may use information regarding constraints on the location of the UE 500 to help identify SPS signals as anomalous. For example, the anomaly detection unit 550 may use map information and information as to characteristics of the UE 500 and/or a vehicle in which the UE 500 resides. Thus, for example, the anomaly detection unit 550 may compare determined location and/or pseudorange corresponding to an SPS signal to identify an SPS signal as anomalous that indicates that the UE 500 is in an impossible (or at least highly unlikely) location, such as on land if the UE 500 is (or resides in) a boat, is in water if the UE 500 is (or resides in) a land vehicle such as car or truck (and is not on a ferry route), is displaced significantly from train tracks if the UE 500 is (or resides in) a train, etc. As another example, the UE 500 may check with one or more other UEs within communication range to determine whether a location determined by the other UE(s) corresponds to an SPS signal measurement obtained by the UE 500. For example, the UE 500 may request a location of another UE and/or may receive a notification (e.g., a safety notification) pushed by another UE (e.g., the UE 114 shown in FIG. 6) that indicates a location of the other UE. The UE 500, e.g., the anomaly detection unit 550, may determine whether the location indicated by the notification or provided in response to the request is consistent with an SPS signal measurement (e.g., pseudorange, location (e.g., a time-filtered location), etc.) obtained by the UE 500 from a received SPS signal to determine whether the received SPS signal is anomalous.

[00127] The anomaly detection unit 550 may be configured to re-perform one or more consistency checks of stage 850, and/or to perform one or more of the consistency checks of stages 870, 880. The anomaly detection unit 550 may be configured to perform such checks for every signal or based on one or more criteria such as every N- SPS signal or in response to identifying an SPS signal as anomalous at stage 850. The anomaly detection unit 550 may be configured to perform different consistency checks and/or different amounts of consistency checks based on a sensitivity level of knowledge of the location of the UE 500. For example, the anomaly detection unit 550 for a smartphone may be configured not to perform consistency check beyond SPS signal checking at stage 850 for an exercise application, but the anomaly detection unit 550 for a military aircraft may be configured to perform every consistency check for which information is available. Checking, and re-checking, consistency of an anomalous SPS signal may help confirm or contradict the initial identification of an SPS signal as anomalous. If an SPS signal is identified as anomalous but subsequent consistency checking reveals that the SPS signal is consistent with one or more other SPS signals and/or other forms of consistency checking, then the SPS signal may be re-identified as not anomalous.

[00128] At stage 890, the anomaly detection unit 550 may send position information 892 (e.g.,

SPS signal measurement(s), pseudorange(s), location(s), signal source identity(ies), etc.) to a network entity, in this example, the server 400. The anomaly detection unit 550 may be configured to send the position information, such as one or more SPS signal measurements, to a network entity (e.g., the server 400, another server, a TRP 300, etc.) as encrypted data. The anomaly detection unit 550 may be configured to a timestamp in the position information. The anomaly detection unit 550 may be configured to send the position information in response to a command from a network entity and/or in response to performance of an operation by the processor related to a particular scenario such as a point-of-sale transaction.

[00129] The processor 510 may be configured to use the identification of an SPS signal as anomalous in one or more of a variety of ways. For example, the location determination unit 560 may respond to an SPS signal being identified as anomalous (e.g., due to source location discrepancy, time discrepancy, etc.) by disregarding (e.g., ignoring) an SPS signal measurement of the SPS signal when determining location of the UE 500 (e.g., not using a pseudorange based on the SPS signal in a positioning method). As another example, the location determination unit 560 may de-weight an SPS signal measurement of an SPS signal identified as anomalous (e.g., reduce a weighting of the SPS signal measurement or weight the SPS signal measurement less than other SPS signal measurements) when used in a positioning technique (e.g., an algorithm) for determining the location of the UE 500. As another example, the location determination unit 560 may be configured to determine and compare multiple location estimates for the UE 500 (e.g., using WWAN, WiFi, GLONASS, GPS, BeiDou, Galileo, Kalman-filter-propagated location, etc.) and to use the largest consistent collection of such information to determine the location of the UE 500. Also or alternatively, the location determination unit 560 may be configured to use one or more location estimates from the most trusted one or more sources of location estimate information (e.g., measurements for determining UE location or estimates of the UE location). Trusted sources may include, for example, base stations that are difficult to spoof such as bi-directional sources such as WAN base stations because successful spoofing of such base stations may entail spoofing a connection to the network. Other examples of trusted sources may include visual and/or audio input devices such as a camera and/or a microphone, and/or ranging devices such as radar, lidar, and/or sonar sensors. These entities may be considered trustworthy because images captured by a camera and/or audio captured by a microphone and/or ranges determined from UE sensors to determine UE location may be difficult to spoof, especially to spoof consistent with one or more other sources of location information and especially over time (e.g., for a moving UE). As another example, the anomaly reporting unit 570 may respond to identifying one or more SPS signals as anomalous by reporting the anomaly(ies) to one or more other entities such as a network entity and/or other UEs. For example, the anomaly reporting unit 570 may report to nearby UEs that a particular signal is being spoofed, and/or may report the spoofed signal to a network entity for widespread warning (e.g., nationwide warning, especially during a time of national concern such as a war). As another example, the processor 510 may respond to identifying one or more SPS signals as anomalous by triggering an inquiry. For example, the processor 510 may provide an inquiry (e.g., “Are you presently in the middle of a lake?”) through a user interface of the UE 500 to a user of the UE 500 to help determine whether the SPS signal was incorrect.

[00130] Numerous variations of the flow 800 may be implemented. For example, the UE 500, e.g., the processor 510, may be configured to receive SPS signals (real and/or spoofed) via the SPS receiver 515, such as in stage 810 and/or stage 830. The processor 510 may be configured to respond to receiving a request for authorization for a secure transaction, e.g., a financial transaction, by conveying information, via the interface 520 (e.g., via the wireless transmitter 242 and the antenna 246), to a network entity such as the TRP 300 and/or the server 400, e.g., the position information 892 to the server 400. The conveyed information may facilitate and/or enable the secure transaction by confirming a location of the UE 500, e.g., to be proximate (or not) to an entity requesting the transaction. The conveyed information may include SPS measurements corresponding to real and/or spoofed SPS signals, identities of the real and/or spoofed SVs corresponding to the SPS signals, a position of the UE based on one or more positioning techniques other than an SPS positioning technique, and a timestamp. The timestamp may correspond to the time corresponding to receipt of the SPS signals and thus the time corresponding to the position of the UE 500 determined from the SPS signals. The timestamp may include multiple timestamps (indications of time) as the SPS signals may be received over a period of time. The conveyed information, e.g., the SPS measurements, may be encrypted by the UE 500. The SPS measurements may include pseudoranges (i.e., processed signal measurements) and/or raw signal measurements (e.g., RSRP, time of arrival, etc.). [00131] Another example alternative to the flow 800 may include a subset of the stages shown in the flow 800. For example, the UE 500 may receive and measure positioning signals, e.g., at least one non-spoofed SPS signal as at stage 830 and at least one spoofed SPS signal as at stage 810.

The UE 500, e.g., the anomaly detection unit 550, may determine a difference between multiple positioning signal measurements, e.g., between a measurements of a spoofed SPS signal and a measurement of a non-spoofed SPS signal. The anomaly detection unit 550 may determine that the difference (e.g., a power difference, a pseudorange difference, a time of day difference, etc.) is greater than a threshold difference, e.g., as at stage 850. The location determination unit 560, possibly in combination with the anomaly detection unit 550, may determine a location of the UE 500 without using or de-weighting a positioning signal measurement in response to the anomaly detection unit 550 flagging the corresponding signal as a spoofed signal (e.g., in response to the difference exceeding the threshold difference).

[00132] Another example alternative to the flow 800 may include a subset of the stages shown in the flow 800. For example, the UE 500 may receive and measure location signals including an alleged satellite positioning signal. The anomaly detection unit 550 may determine a difference between a measurement (e.g., power, pseudorange, etc.) of the alleged satellite positioning signal (or multiple SPS signals), which may be spoofed, and one or more expected satellite positioning signal measurements. The expected measurement(s) may be based on ephemeris data for one or more satellites and a location estimate for the UE 500, e.g., based on one or more terrestrial-based positioning signals, one or more terrestrial-based communication signals, one or more other satellite positioning signals, and/or may be a maximum power expected from any satellite vehicle. The anomaly detection unit 550 may determine that the difference is greater than a threshold difference (e.g., if the satellite positioning signal is spoofed). For example, the expected measurement may be a maximum power expected from any satellite vehicle and the threshold may be 0 dBm such that if the measurement of the alleged satellite signal has a power exceeding the maximum expected power, then the anomaly detection unit 550 may identify the satellite positioning signal as being spoofed or anomalous. The location determination unit 560 may determine a location of the UE 500 using measurements of the location signals while excluding (or de-weighting) the measurement of the alleged satellite signal.

[00133] Referring to FIG. 9, with further reference to FIGS. 1-8, a method 900 of determining UE location in the presence of one or more spoofed SPS signals includes the stages shown. The method 900 is, however, an example only and not limiting. The method 900 may be altered, e.g., by having stages added, removed, rearranged, combined, performed concurrently, and/or having single stages split into multiple stages. For example, one or more stages or portions of stages from the flow 800 may be included in the method 900. As another example, one or more of stages 930, 940, 950 may be omitted from the method 900.

[00134] At stage 910, the method 900 includes obtaining UE location information. The location information may include a location or information that may be used in determining a location of the UE 500, e.g., one or more measurements, one or more ranges (e.g., pseudoranges), etc. For example, the processor 510 may receive an indication of the location of the UE 500 via the interface 520. The indication of the location of the UE 500 may, for example, be a cell sector center for a serving TRP 300 for the UE 500. As another example, the location of the UE 500 may be propagated forward from a Kalman filter or other filter and/or another location estimator. The location may be determined from GNSS, WiFi, WAN, WLAN, and/or Bluetooth® (and/or another short-range wireless technology) signaling, from one or more images obtained by the camera 218, and/or from information from one or more of the sensor(s) 213, and/or any combination thereof, and possibly in combination with prior state information. As another example, the processor 510 may determine one or more measurements of one or more satellite signals and/or one or more terrestrial-based signals. As another example, the location determination unit 560 may use terrestrial-based signal measurements to determine a location of the UE 500 using RTT, multi-RTT, OTDOA, sidelink positioning, and/or one or more other positioning techniques. As another example, the obtained location information may be a location determined from satellite signals from one or more GNSS constellations. As another example, the obtained location information may be a location determined using one or more non-GNSS information such as WAN, WiFi, sonar, lidar, and/or radar information, and/or one or more camera images (e.g., through recognition of an object of known location), and/or inter-vehicle/inter-device communication (e.g., positions of neighboring devices). As another example, the processor 510 may retrieve previously-determined location information, e.g., one or more previously-determined measurements and/or a previously- determined location of the UE 500, from the memory 530. The processor 510 may apply dead reckoning to a retrieved location to determine a present location estimate or may use the previously- determined location as the present location estimate. Still other techniques may be used alone or in combination with one or more techniques mentioned to obtain the UE location information. The location information obtained at stage 910 may include multiple locations, e.g., multiple locations overtime.

[00135] At stage 920, the method 900 includes receiving spoofed signals. The description of the method 900 assumes that multiple spoofed signals are received, but a single spoofed signal could be received. The processor 510 of the UE 500 receives the spoofed signals and determines one or more appropriate measurements for each of the signals. The processor 510 may determine location information based on the spoofed signals, e.g., one or more signal measurements and/or one or more locations. The anomaly detection unit 550 may not know that a signal is spoofed, but may consider signals to be from a possibly-spoofed constellation where the signals are purportedly from the possibly-spoofed constellation and have received signal powers significantly higher than received signal powers of signals from one or more other constellations or even from the purported constellation. Spoofed signals will typically be rebroadcast and thus have a time delay, but have a stronger signal than the signal being spoofed and the anomaly detection unit 550 may look for such characteristics to determine that a signal is possibly spoofed or spoofed. Spoofed signals will often not be provided for all satellite constellations and/or all frequency bands. Also, WAN signals (for a cooperative or uncooperative base station) are typically not spoofed as the spoofer does not cooperate (to communicate) with the UE 500 and a neighbor list and/or base station almanac can be used to identify a fake base station. The anomaly detection unit 550 may search for consistency across constellations, or attempt to communicate with a source of a WAN signal, and/or analyze a neighbor list or base station almanac to identify a fake base station. The anomaly detection unit 550 may assume that signals having one or more characteristics of spoofed signals (e.g., high power, inconsistent across constellations, associated with a base station that will not cooperate or is not in a neighbor list or base station almanac, etc.) are spoofed signals and proceed to determine whether this assumption is justified/correct in one or more of stages 930, 940, 950.

[00136] At stage 930, the method 900 includes determining whether spoofed location information and the obtained location information are consistent. For example, the location determination unit 560 may use the spoofed signals received at stage 920 to determine spoofed location information for the UE 500, e.g., a spoofed location of the UE 500. The anomaly detection unit 550 may compare location information determined based on the spoofed signals and location information obtained at stage 910 to determine whether the obtained location information and the spoofed location information are consistent.

[00137] The anomaly detection unit 550 may determine whether the spoofed location differs substantially relative to a present obtained location and/or a location history, e.g., whether there is a large discontinuity (larger than a threshold) between the spoofed location and the obtained present location information, with a large discontinuity being considered by the anomaly detection unit 550 as the spoofed and obtained location information being inconsistent. For example, a spoofed location may differ significantly from one or more pseudoranges from one or more other (non- spoofed) constellations and/or from one or more locations determined from signals from one or more other constellations. The threshold may vary with a time difference between a present time and a time corresponding to the obtained location. For example, the anomaly unit 550 may determine that the spoofed location is inconsistent with the obtained location if the spoofed location is significantly different than the obtained location corresponding to a most-recent time (the most- recent obtained location) without a reasonable explanation. A speed corresponding to a distance difference between the spoofed location and the most-recent obtained location divided by the time difference between the spoofed location and the most-recent obtained location should be reasonable. What is reasonable may be based on historical locations of the UE 500, motion of the UE 500, and/or other information (e.g., user input indicating a flight). For example, a vehicle speed or less may be reasonable unless the UE 500 is determined to have been travelling by airplane, or a running speed or less may be reasonable if the UE 500 is determined to be undergoing pedestrian motion (e.g., as determined by an IMU of the UE 500).

[00138] Also or alternatively, the anomaly detection unit 550 may determine whether visible satellites of a spoofed constellation and/or search windows of the spoofed signals are consistent with a location of the obtained UE location information. The location of the obtained UE location information may be determined from SPS signals that are weaker than the spoofed signals and/or from one or more other indications of location. The anomaly detection unit 550 may use the location(s) of the obtained UE location information (e.g., determined by the location determination unit 560 using the weaker signals) to determine which satellites of the possibly-spoofed constellation should be visible to the UE 500 and/or determine expected search windows/pseudoranges to the satellites of the possibly-spoofed constellation. The anomaly detection unit 550 may search for satellites of the possibly-spoofed constellation. Also or alternatively, the anomaly detection unit 550 may determine expected visible satellites, signal strengths, and/or search windows/pseudoranges for other constellations based on a determined location using the signals of the possibly-spoofed constellation, i.e., the signals assumed to be spoofed. If fewer (e.g., more than a threshold quantity fewer) than all of the satellites (e.g., of the possibly-spoofed constellation and/or of the other constellation(s)) expected to be visible are visible and/or the search windows/pseudoranges are significantly different than expected, then the anomaly detection unit 550 may conclude that the location information of the possibly-spoofed constellation and the obtained location information are inconsistent.

[00139] Also or alternatively, the anomaly detection unit 550 may determine whether locations determined from multiple satellite constellations are consistent with each other and/or with location determined from one or more non-GNSS techniques. For example, the anomaly detection unit 550 may determine the location of the UE 500 based on signals from different constellations and compare the locations. If the locations differ by more than a threshold amount, the anomaly detection unit 550 may identify at least one of the constellations as being spoofed. The anomaly detection unit 550 may compare one or more GNNS -determined locations of the UE 500 against a location determined using a non-GNSS technique and identify a GNSS-determined location as being the result of spoofing if the GNSS -determine location differs from the non-GNSS-determined location by more than a threshold amount.

[00140] Also or alternatively, the anomaly detection unit 550 may determine whether pseudoranges determined using different GNSS frequency bands are consistent. For example, if pseudoranges determined from LI signals and L5 signals are inconsistent (e.g., not within a threshold of each other, accounting for tropospheric and ionospheric effects on the two different frequencies for various satellites), then the anomaly detection unit 550 may conclude that one or more of the signals of at least one of the frequency bands are being spoofed. The anomaly detection unit 550 may attempt to determine which of the signals are being spoofed, e.g., by comparing the pseudoranges to non-GNSS determined information. If signals are determined not to be spoofed, then those signals may be used to determine the location of the UE 500.

[00141] Consistency checking may be performed at a measurement engine level or a positioning engine level. The measurement engine may include RF and baseband processing components to determine GNSS pseudoranges that can be sent to the positioning engine to be combined with information from other sources. Measurement-engine -level consistency checking looks for suspicious jumps, suspicious power levels, and/or pseudoranges that disagree with pseudoranges determined based on time and ephemeris/long-term ephemeris/orbital information and an approximate location of the UE 500. The positioning engine may include a Kalman filter and GNSS processing/pseudorange management components, e.g., to de-weight spurious pseudoranges, apply a least-squares processing, etc. For example, a least-squares fit of GNSS pseudoranges may be performed for multiple sources and pseudoranges that are inconsistent with other pseudoranges (or information/signals from which the inconsistent pseudoranges are determined) are de-weighted. This checking identifies inconsistencies of location information (e.g., pseudoranges) determined from spoofed satellite signals with location information determined from other sources (e.g., WAN, WiFi, sensor(s) (e.g., steering wheel, tire rotation tracker, accelerometer, gyroscope, camera, etc.)). Positioning-engine-level consistency checking looks for predicted locations or pseudoranges that are inconsistent with other sources of such information. [00142] If the spoofed and obtained location information are determined to be inconsistent (e.g., by the anomaly detection unit 550) at stage 930, then the method 900 proceeds to stage 935. At stage 935, the processor 510, e.g., the location determination unit 560, may ignore (e.g., discard) or de-weight location information corresponding to one or more signals from the possibly-spoofed constellation, e.g., one or more measurements of such one or more signals and/or one or more locations based on such one or more signals. From stage 935, or from stage 930 if the spoofed and obtained location information are determined to be consistent, the method 900 proceeds to stage 940.

[00143] At stage 940, the method 900 includes determining whether time determined from spoofed signals and the obtained location information are consistent. For example, the anomaly detection unit 550 may read a time of day (TOD) indicated by one or more of the spoofed signals, propagate the read time to a present TOD, and combine (e.g., average) multiple present TODs corresponding to multiple spoofed signals. The anomaly detection unit 550 may determine a present TOD from one or more other sources, e.g., a terrestrial-based network (e.g., WAN, the Internet, etc.) and/or one or more GNSS constellations. The anomaly detection unit 550 may compare the present TOD determined from the spoofed signals and the present TOD determined from the other source(s). If the two present TODs differ by more than a threshold amount, then the anomaly detection unit 550 concludes that the spoofed and obtained times are inconsistent.

[00144] The anomaly detection unit 550 may determine whether time determined from signals purportedly from different constellations is consistent. The time should be consistent across all constellations. If the time determined from a constellation is significantly different (e.g., by more than a threshold time) from time determined by other constellations and/or other non-GNSS sources, or if the time determined from a constellation indicates a jump in time compared to a predicted time, e.g., propagated time using a base station frequency as a reference, then (one or more signals of) the constellation from which the time was determined may be identified as having been spoofed. Spoofing of a constellation (i.e., one or more signals of the constellation) may be identified in particular if the determined time is delayed relative to time determined by other sources. Thus, the anomaly detection unit 550 may look for a time with added delay to identify the signal(s) from which the time was determined as anomalous (e.g., spoofed).

[00145] If the spoofed and obtained times of day are determined to be inconsistent (e.g., by the anomaly detection unit 550) at stage 940, then the method 900 proceeds to stage 945. At stage 945, the processor 510, e.g., the location determination unit 560, may ignore (e.g., discard) or de-weight location information corresponding to one or more signals from the possibly-spoofed constellation, e.g., one or more measurements of such one or more signals and/or one or more locations based on such one or more signals. From stage 945, or from stage 940 if the spoofed and obtained times of day are determined to be consistent, the method 900 proceeds to stage 950.

[00146] At stage 950, the method 900 includes determining whether location and/or movement and/or one or more other parameters determined from spoofed signals is/are rational. For example, the anomaly detection unit 550 may determine that the location of the UE 500 is in an area known for spoofing, or at least known for spoofing of the constellation corresponding to the signals that the anomaly detection unit 550 has assumed are spoofed for purposes of evaluating the signals to verify whether the signals are spoofed or not. If the determined location puts the UE 500 in a known-spoofed location, then the anomaly detection unit 550 may conclude that the spoofed signals are indeed spoofed or may increase a spoofing confidence score indicative of the confidence of the anomaly detection unit 550 that a signal (e.g., the signals assumed to be spoofed) are spoofed (or decrease a no-spoofing confidence score indicative of a confidence of the anomaly detection unit 550 that a signal is not spoofed). As another example, the anomaly detection unit 550 may determine that the location of the UE 500 is irrational if the location is unexplained or unexpected, e.g., being in a different country than a previous location without an indication of an expected change of location to that country (e.g., travel plans in a calendar, indication of purchase of a plane ticket to that country, etc.). As another example, the anomaly detection unit 550 may determine that the location of the UE 500 is irrational if the location is indicative of a sudden significant change in location (perhaps using one or more different criteria than used at stage 930). As another example, the anomaly detection unit 550 may determine that movement of the UE 500 is irrational if the movement is unexpected, e.g., based on one or more criteria such as location and/or location history of the UE 500. The anomaly detection unit 550 may, for example, determine that a speed of the UE 500 above about 15 miles per hour (e.g., above about 7 m/s) with the UE 500 disposed in a shopping mall is irrational. The anomaly detection unit 550 may, as another example, determine that a speed of the UE 500 below about 50 miles per hour (e.g., below about 22 m/s) with the UE 500 disposed in an airplane and a location history indicating a speed consistent with air travel. The anomaly detection unit 550 may, as another example, determine that a sudden change in speed of the UE 500 is irrational if the speed changes by more than a threshold rate (e.g., by more than a threshold percentage of a prior speed within a threshold amount of time). As another example, the anomaly detection unit 550 may determine whether there is a sudden change in signal strength of received signals purportedly from the same constellation. If the signal strength of signals from a constellation change from weak to strong such that the strong signals would be assumed to be spoofed if the strong signals were detected first, then the anomaly detection unit 550 may determine this change to be irrational.

[00147] Sudden jumps in pseudorange, time, or frequency may be used to identify spoofed signals. For example, signals that lead to a sudden jump in a time-frequency bin, or a locked frequency and locked time (in a frequency tracking loop and time tracking loop) may be identified as spoofed. [00148] If irrational location, movement, and/or other parameter(s) is/are detected at stage 950, then the method 900 proceeds to stage 955. At stage 955, the processor 510, e.g., the location determination unit 560, may ignore (e.g., discard) or de-weight location information corresponding to one or more signals from the possibly-spoofed constellation, e.g., one or more measurements of such one or more signals and/or one or more locations based on such one or more signals. From stage 955, or from stage 950 if no irrational location, movement, or other parameter is detected, the method 900 proceeds to stage 960.

[00149] At stage 960, the location determination unit 560 selects signal information to be used for determining location of the UE 500. For example, the location determination unit 560 may analyze the measured signals from spoofed and non-spoofed sources and determine the signals that are consistent with each other and not assumed to be spoofed (e.g., have high confidence of not being spoofed). The signals may be determined to be consistent if, for example, the signals are of expected signal strengths (within respective expected signal strength ranges), pseudoranges corresponding to all the signals overlap in a common area, and/or the signals have not been determined, at stage 935, 945, or 955, to be ignored. As another example, the location determination unit 560 may be configured to identify signals with high confidence (e.g., above a threshold confidence value) of not being spoofed. For example, the location determination unit 560 may be configured to identify signals corresponding to signal sources that are difficult to spoof and/or are historically reliable as not being spoofed. The location determination unit 560 may be configured to assign or determine a confidence score corresponding to the signals, e.g., based on historical reliability and/or historical difficulty in spoofing the signals, indicia of likelihood of spoofing (e.g., consistency with other signals, parameter value(s) within expectation(s), etc.). The location determination unit 560 may be configured to select signal information (e.g., signal measurements) corresponding to the consistent signals and/or the signals with high confidence (above a threshold confidence) of not being spoofed for use in determining location of the UE 500. [00150] At stage 970, the location determination unit 560 may determine the location of the UE 500. If sufficient signal information is selected at stage 960 to enable determination of the location of the UE 500, the location determination unit 560 determines the location of the UE 500 using at least some of the selected information. The location determination unit 560 may use one or more positioning techniques based on the selected signal information.

[00151] At stage 980, the processor 510 reports a location and/or a no-spoofing confidence, or a rejection (spoof detection) condition. For example, the location determination unit 560 may report, via the interface 520, the location of the UE 500 if the location determination unit 560 was able to determine a location (e.g., with one or more desired criteria such as a threshold level of accuracy). The location determination unit 560 may report a no-spoofing confidence level alone, or with a location if a location is reported. The no-spoofing confidence may indicate a confidence of the location determination unit 560 that the location is not based on any spoofed signals. The anomaly reporting unit 570 may report a rejection condition and/or a spoof detection indication, e.g., if no location was determined or if the no-spoof confidence level is below a threshold confidence. The spoof detection may be dependent upon a use or application of a location of the UE 500. For example, for a critical application such as a military application or a financial transaction (or a financial transaction of at least a threshold monetary amount), the confidence level required for a location of the UE 500 to be reported may be higher than for a non-critical application (e.g., directions within a shopping mall). Also or alternatively, if the location of the UE 500 is determined to be in a suspect location (i.e., a location of likely spoofing activity), then the confidence level required for a location of the UE 500 to be reported may be higher than for other, non-suspect, locations. The location of the UE 500, possibly in combination with the nature of an information request (e.g., for a financial transaction or other sensitive and/or secure transaction), may be used by the processor 510 to trigger one or more safety precautions such as shutdown of the UE 500, prevention of transmission by the UE 500 of location and/or other information, erasure of more or all of the memory 530, message transmission (e.g., indicating that a suspect action is being requested (possibly due to the location of the UE 500) and/or that the UE 500 is compromised (e.g., being spoofed, possibly stolen, etc.), secure authentication, etc. Secure authentication may be triggered to require input of authentication information such as a fingerprint, a voice print, a facial image, one or more retinal images, a combination of two or more of these, and/or other information. Upon input of such information and verification of the information (e.g., matching securely-stored information), a rejection of location reporting and/or other action(s) may be overridden and approved.

[00152] Referring to FIG. 10, with further reference to FIGS. 1-9, a method 1000 of detecting an anomalous SPS signal includes the stages shown. The method 1000 is, however, an example only and not limiting. The method 1000 may be altered, e.g., by having stages added, removed, rearranged, combined, performed concurrently, and/or having single stages split into multiple stages. For example, one or more stages may be added to the method 1000 and/or the method 1000 repeated (e.g., periodically) to determine whether a signal that was spoofed is no longer being spoofed or that a non-spoofed signal can be determined and used for positioning.

[00153] At stage 1010, the method 1000 includes receiving, at a user equipment, a first SPS signal. For example, the SPS receiver 515 may receive one or more SPS signals from one or more SVs in one or more constellations. The SPS receiver 515 may provide the SPS signals to the processor 510, i.e., provide transduced electrical versions of the wireless received SPS signals to the processor 510. The SPS receiver 515 along with the processor 510 may comprise means for receiving the first SPS signal.

[00154] At stage 1020, the method 1000 includes determining, at the user equipment, whether the first SPS signal is anomalous. Stage 1020 may include one or more of various techniques to determine whether the first SPS signal is anomalous, e.g., being out of the ordinary, unexpected and possibly incorrect/inaccurate. The processor 510 along with the memory 530, and possibly the SPS receiver 515, may comprise means for determining whether the first SPS signal is anomalous, e.g., in accordance with the discussion herein, in particular the further discussion of stage 1020 below. [00155] Stage 1020 may include performing one or more consistency checks, e.g., as discussed with respect to stage 850. The anomaly detection unit 550 may determine whether the first SPS signal and the second SPS signal yield consistent location and/or time measurements, e.g., consistency between historical measurement(s) (e.g., of location (possibly location overtime such as speed and travel heading)) and present measurement(s) and/or consistency between SPS measurement(s) and non-SPS measurements (e.g., location and/or time determined by other (non- SPS) means). A spoofed signal may, for example result in a jump in time and/or frequency of the received signals, e.g., due a time loop of the UE 500 changing from being locked onto a non- spoofed signal to being locked to a spoofed signal and/or due a frequency loop of the UE 500 changing from being locked onto a non-spoofed signal to being locked to a spoofed signal. Thresholds on phase offset and frequency may be used to set a search window for satellite signals to help prevent measurement of spoofed signals. Stage 1020 may comprise, for example, determining whether an actual measurement difference, between a first SPS signal measurement of the first SPS signal and a second SPS signal measurement of a second SPS signal, is consistent with an expected measurement difference between expected SPS signals from a first SV (satellite vehicle) and a second SV, wherein the first SPS signal has a first format corresponding to the first SV and the second SPS signal has a second format corresponding to the second SV. For example, the anomaly detection unit 550 may determine whether the actual measurement difference and the expected measurement difference are consistent by determining whether the actual measurement difference of SPS signals is within a threshold of an expected measurement difference of SPS signals. The actual and expected measurement differences may be received power differences and the threshold may be a power threshold. The threshold may be, for example, a relative threshold (e.g., a percentage or a maximum ratio) or a raw (absolute) value (e.g., a power quantity, e.g., an amount of watts or dBm). The first and second SPS signals may have different carrier frequencies and the first and second SVs may be the same SV or different SVs. The actual and expected measurement differences may be power differences of power measurements (actual and expected). The processor 510 may determine the expected measurement difference using SV location information such as ephemeris data and/or (long-term) orbital information, such as ephemeris data and/or orbital information for the first SV and the second SV respectively, e.g., estimating received power based on known location of an SV and approximate location of the UE 500, and thus estimating a range between the UE 500 and the SV and determining an estimated expected receive power from the estimated range. As another example, determining whether the actual and expected measurement differences are consistent may comprise determining whether a difference of pseudoranges based on SPS (actual or spoofed) signals is within a threshold (relative or absolute) of an expected pseudorange. For example, the processor 510 may determine the expected pseudorange difference by using SV location information to determine expected ranges between the UE 500 and the SVs corresponding to the (actual or spoofed) SPS signals used to determine the actual pseudorange difference. If the pseudorange difference based on SPS signals differs by more than a threshold from the expected pseudorange difference, then the first SPS signal may be labeled anomalous. As another example, the first SPS signal measurement may be a first time (e.g., first TOD), the second SPS signal measurement may be a second time (e.g., second TOD), and determining whether the first SPS signal is anomalous comprises determining whether an actual difference between the first and second times is within a threshold of an expected difference of the first and second times (e.g., based on SV location information of satellite locations and an estimated location of the UE). Times should be consistent (though not necessarily identical, e.g., for different constellations), and a signal yielding an inconsistent time may be deemed anomalous. The processor 510 may obtain ephemeris data from satellites via the SPS receiver 515 and/or from one or more TRPs 300 via the interface 520. SV location information may be stored in the memory 530 and/or obtained by the processor 510 via the interface 520 (e.g., from the server 400). The processor 510, possibly in combination with the memory 530 and/or the interface 520, in combination with the SPS receiver 515, may comprise means for determining whether the actual measurement difference is consistent with the expected measurement difference.

[00156] The SPS signals compared to determine the measurement differences may be from the same SV (or purportedly from the same SV), e.g., with different carrier frequencies, or may be from different SVs from the same constellation or from different constellations. For example, spoofed signals may be consistent for a constellation, e.g., with multiple spoofed signals provided to yield a consistent location determined using the spoofed signals, but will differ significantly from a location determined using non-spoofed constellation signals. Also, for a given satellite, a measurement of a pseudorange/time/code phase using a spoofed signal will jump compared to the pseudorange/time/code phase using a non-spoofed signal. Thus, the first SPS signal may be determined to be anomalous if a jump is detected between measurements derived from the first SPS signal and the second SPS signal allegedly from the same satellite. As another example, the first and second SPS signals may correspond to the same satellite but different frequency bands (e.g., two of LI, L2, and L5). Satellite signals may only be spoofed for one frequency band, and thus a significant measurement difference based on signals allegedly from the same satellite but of different frequencies may be used to identify at least one of the signals as being anomalous. If a signal yields a measurement that is consistent with other measurements (e.g., from another frequency band, from another constellation), then that signal may be deemed non-anomalous and if a signal yields a measurement that is not consistent with other measurements, then that signal may be deemed anomalous. As another example, the first and second SPS signals may correspond to first and second SVs of different constellations. If measurements of signals from different constellations are inconsistent (accounting for expected differences), then the first SPS signal may be deemed anomalous. For example, the second SPS signal may be chosen from the GLONASS constellation because each satellite has a unique sub-band, making spoofing more difficult. As another example, measurements from signals from multiple constellations may be compared against a measurement from the first SPS signal for consistency. For example, Beidou III, GPS, and Galileo use the same LI frequency and thus an impact on any of these constellations (e.g., delay between LI and L5 timing, effects on Doppler/time windows and pseudoranges) should be similar for all of the constellations. If an impact seen in one of these constellations according to a signal (the first SPS signal) allegedly from one of these constellations is different from impacts seen across the other constellations, then the first SPS signal is determined to be anomalous.

[00157] Also or alternatively, stage 1020 may include determining whether a received power of the first SPS signal exceeds a maximum expected SPS signal received power. For example, the anomaly detection unit 550 may determine whether the received power of an alleged SPS signal exceeds a maximum expected SPS signal received power for the location of the UE 500 from the SV that allegedly sent the alleged SPS signal based on an estimate of the location of the UE 500 and SV location information for the SV that allegedly sent the alleged SPS signal. As another example, the anomaly detection unit 550 may determine whether the received power exceeds a maximum power expected from any SV anywhere on Earth. The maximum expected signal strength may be dependent on the receiver, e.g., components of the receiver such as one or more antennas, one or more LNAs (low-noise amplifiers), etc. The maximum expected signal strength may be programmed into a device during manufacture and based on the device type (e.g., the components used) and may be based on theoretical and/or experimental values determined for the device type. The maximum expected signal strength may be determined for a particular receiver through measurements, e.g., of satellite signals with clear sky. The maximum expected signal strength may be crowd sourced by collecting measurements from multiple devices. As another example, a crowd-sourced value may be used as a seed value of maximum expected signal strength and then calibrated by the individual receiver using satellite signal measurements made by the receiver. The processor 510, possibly in combination with the memory and/or the interface 520, in combination with the SPS receiver 515, may comprise expectation means for determining whether the received power of the first SPS signal exceeds the maximum expected SPS signal received power.

[00158] Also or alternatively, stage 1020 may include determining whether the first SPS signal originated from an SV location consistent with first SV location information (e.g., ephemeris data and/or orbital information) for the first SV. For example, the anomaly detection unit 550 may perform a sky aperture test as discussed with respect to stage 820. For example, the anomaly detection unit 550 may determine which SVs should be visible to the UE 500 and determine whether those SVs are indeed visible. The anomaly detection unit 550 may determine which SVs should be visible by, for example, using SV location information and an approximate location of the UE 500 and a present time. As another example, the anomaly detection unit 550 may determine from which portion of the sky an SPS signal was received, and independently determine (e.g., from independent information) whether the SV from which the SPS signal was purportedly sent (e.g., the SV that is known to send SPS signals of the format of the received SPS signal) is presently in that portion of the sky. The anomaly detection unit 550 may identify the SPS signal as anomalous if the independent information indicates that the SV is not in the portion of the sky corresponding to the received SPS signal, which may be a spoofed SPS signal. For example, a directional antenna or combination of antennas may be used to determine an angle of arrival of a signal and compare that angle with an expected angle of arrival based on SV location information and an approximate location of the UE 500. Multiple spoofed signals allegedly for different SVs may originate from the same location and thus if SV signals are grouped with the same or very similar angles of arrival when expected angles of arrival are spread apart, then the signals may be flagged as being spoofed, and thus de-weighted, ignored, discarded, etc. As another example, if the first SPS signal corresponds to an SV that should not be visible, e.g., is low on the horizon or should be blocked (e.g., due to the UE 500 being in an urban canyon), but is visible, then the first SPS signal may be deemed to be anomalous. As another example, if more SV signals corresponding to a constellation are visible than expected, then one or more of the SV signals from that constellation may be deemed anomalous. The processor 510, possibly in combination with the memory 530 and/or the interface 520, may comprise means for determining whether the first SPS signal originated from an SV location consistent first SV location information for the first SV.

[00159] Also or alternatively, stage 1020 may include determining whether a first pseudorange, based on the first SPS signal, to the first SV differs by more than a first pseudorange threshold from an expected pseudorange to the first SV based on a time-filtered location of the user equipment.

For example, the processor 510 may determine location of the UE 500 using a time-based filter such as a Kalman filter and identify an SPS signal as anomalous if a corresponding pseudorange differs by more than a threshold from a range based on the time-filtered location and known location of the SV corresponding to the SPS signal. Equivalently, the processor 510 may identify the SPS signal as anomalous if the corresponding pseudorange would place the UE 500 more than a threshold distance from the time-filtered location. The processor 510, possibly in combination with the memory 530, may comprise means for determining whether the first pseudorange differs by more than the first pseudorange threshold from the expected pseudorange.

[00160] Also or alternatively, stage 1020 may include determining that a first location, of the user equipment, based on the first SPS signal measurement corresponds to at least one of an unexpected location or a high likelihood of anomaly location. For example, the anomaly detection unit 550 may determine that the location of the UE 500 is in a city, county, state, or country unexpectedly (e.g., without user input, e.g., in a calendar, indicating travel to that city, county, state, or country at the present time). As another example, the anomaly detection unit 550 may determine that the location of the UE 500 changed at a faster than reasonable rate (e.g., a dramatic change in location in a short period of time, such that to change between the locations, the speed of the UE 500 would be unreasonable (e.g., faster than an airplane)). As another example, the anomaly detection unit 550 may determine that the location of the UE 500 differs significantly from an expected/predicted location output by a filter (e.g., a Kalman filter), or not agreeing with other sources of location, or both. As another example, the anomaly detection unit 550 may determine that the present location of the UE 500 is in an area known to have a high number and/or high rate of signal spoofing and/or fraudulent transactions. The processor 510, possibly in combination with the memory 530, may comprise location/likelihood means for determining that the first location corresponds to at least one of an unexpected location or a high likelihood of anomaly location.

[00161] Also or alternatively, stage 1020 may include determining whether one or more base station signal measurements are consistent with the first SPS signal measurement. For example, the processor 510 may determine whether to disregard the first SPS signal measurement based on whether one or more base station signal measurements are consistent with the first SPS signal measurement, e.g., the base station signal(s) and the first SPS signal all indicate that the UE 500 is in the same approximate location (e.g., within a threshold distance (e.g., 50m, 100m 1,000m) of a location, in the same city, in the same country, etc.). The processor 510, possibly in combination with the memory 530 and/or the interface 520, may comprise means for determining whether the first SPS signal measurement is consistent with one or more base station signal measurements. [00162] Also or alternatively, stage 1020 may include determining whether a measured signal quality of the first SPS signal is consistent with an expected signal quality. For example, the anomaly detection unit 550 will expect SPS signals to be noisy when the UE 500 is in certain environments such as an urban canyon. Thus, the anomaly detection unit 550 may deem a signal to be anomalous in response to the signal having noise lower than a threshold and/or in response to the signal having a signal-to-noise ratio (SNR) higher than a threshold SNR based on the present environment of the UE 500, e.g., based on a coarse location estimate (e.g., from E-CID, image analysis, serving cell location, etc.).

[00163] The method 1000 may include one or more of the following features. For example, the method 1000 may include responding to an initial determination that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on a third SPS signal that is different from any SPS signal on which the initial determination was based. For example, the anomaly detection unit 550 may make an initial determination, based on the first SPS signal and/or the second SPS signal (e.g., based on power difference of the SPS signals and expected power difference), that the first SPS signal is anomalous. The anomaly detection unit 550 may respond to this determination by using another SPS signal to determine whether the first SPS signal is anomalous. This may help detect changes that cause the first SPS signal to be identified as anomalous, but that are not due to the first SPS signal being inaccurate (e.g., spoofed). This may help with location determination by allowing the processor 510 to use the SPS signal to determine location of the UE 500, e.g., without de-weighting. The method 1000 may include selecting the third SPS signal such that a format of the third SPS signal corresponds to an SV that is in a different constellation than the first SV, i.e., in a constellation that excludes (does not include) the first SV. [00164] Also or alternatively, the method 1000 may include one or more of the following features. For example, the method 1000 may include responding to an initial determination that the first SPS signal is anomalous by determining whether the first SPS signal is anomalous based on at least one technology other than SPS technology. The anomaly detection unit 550 may use one or more non- SPS technologies, in addition to or instead of SPS technology, to determine whether the first SPS signal is anomalous. This may help determine whether the first SPS signal, although anomalous based on SPS technology, is not a false SPS signal (e.g., spoofed or otherwise inaccurate). The method 1000 may include determining at least one of how many other SV signals or what other technologies to use, for determining whether the first SPS signal is anomalous, based on a security level of knowledge of a position of the user equipment. For example, the processor 510 may determine one or more other SV signals and/or one or more other technologies to use to determine whether the first SPS signal is anomalous. The processor 510 may determine the quantity of the SV signals and/or the quantity of other technologies, and which SV signal(s) and/or which technology(ies) to use based on sensitivity of the location of the UE 500, e.g., with more sensitive UE location (based on the UE and/or based on the location) resulting in a more stringent anomaly determination (e.g., higher confidence of determining whether a signal is inaccurate).

[00165] Also or alternatively, the method 1000 may include one or more of the following features. For example, the method 1000 may include determining a dead-reckoning position of the user equipment, wherein determining whether the first SPS signal is anomalous is performed in response to at least one of the first SPS signal measurement and the second SPS signal measurement being inconsistent with the dead-reckoning position of the user equipment. For example, the processor 510 may use one or more sensor measurements (e.g., wheel rotation, odometer, steering wheel, gyroscope, accelerometer, and/or camera measurements, etc.) and a prior location of the UE 500 to determine a present location by dead reckoning and to trigger the determination of the whether the first SPS signal is anomalous in response to the dead reckoning position being inconsistent with the first and/or second SPS signal measurement. For example, the processor 510 may trigger the anomaly determination in response to a range from the dead reckoning position to the first or second SV significantly differing (e.g., by more than a threshold) from a respective pseudorange based on the first or second SPS signal. An sudden stop or jump in motion/location of the UE 500 that is not detected from the sensor measurement(s) indicates that the SPS signal(s) is(are) spoofed. [00166] Also or alternatively, the method 1000 may include one or more of the following features. For example, the method 1000 may include taking one or more actions in response to determining that the first SPS signal is anomalous. The method 1000 may include responding to the anomaly determination by: disregarding the first SPS signal to determine the position of the user equipment; or disregarding a pseudorange based on the first SPS signal to determine the position of the user equipment; or de-weighting the first SPS signal to determine the position of the user equipment; or de-weighting the pseudorange based on the first SPS signal to determine the position of the user equipment; or using one or more base station signal measurements to determine the position of the user equipment; or increasing one or more weightings of the one or more base station signal measurements to determine the position of the user equipment; or sending an anomaly indication, indicating that the first SPS signal is anomalous, to a first network entity; or sending a set of SPS signal measurements to a second network entity. For example, the UE may disregard (e.g., discarded) all SPS signals, or all SPS signals in a particular frequency band (for a satellite, a constellation, or a set of constellation), or all measurements from a particular constellation or a set of constellations, or any combination of these. As another example, the UE 500 may use one or more base station signal measurements, that the UE would not otherwise use absent determining that the first SPS signal is anomalous, to determine the position of the UE 500, or may weight more heavily one or more base station signal measurements that the UE 500 would already use to determine the position of the UE 500. Sending the set of SPS signal measurements to a network entity may help prevent use of inaccurate information (e.g., falsified base station signals or identified location) to authorize actions (e.g., financial transactions), e.g., because simulating SPS signals, especially for multiple constellations, may be much more difficult than falsifying some information such as simulating a base station signal, or simulating a few SPS signals from a single constellation, or injecting a false location indication into a communication.

[00167] Referring to FIG. 11, with further reference to FIGS. 1-10, a method 1100 of processing positioning signals including an alleged satellite positioning signal that is spoofed includes the stages shown. The method 1100 is, however, an example only and not limiting. The method 1100 may be altered, e.g., by having stages added, removed, rearranged, combined, performed concurrently, and/or having single stages split into multiple stages.

[00168] At stage 1110, the method 1100 includes measuring a plurality of positioning signals, including the alleged satellite positioning signal, to produce a plurality of positioning signal measurements including a first positioning signal measurement of the alleged satellite positioning signal and a second positioning signal measurement of one of the plurality of positioning signals other than the alleged satellite positioning signal. For example, the SPS receiver 515 receives and measures SPS signals including a spoofed SPS signal to produce measurements of the SPS signals. The SPS receiver 515, possibly in combination with the processor 510 (possibly in combination with the memory 530), may comprise means for measuring the plurality of positioning signals. [00169] At stage 1120, the method 1100 includes determining a difference between the first positioning signal measurement and the second positioning signal measurement. For example, the anomaly detection unit 550 compares positioning signal measurements determined by the SPS receiver 515 and/or the processor 510 and determines a difference between the measurements. The processor 510 (possibly in combination with the memory 530), may comprise means for determining a difference between the first and second positioning signal measurements.

[00170] At stage 1130, the method 1100 includes determining that the difference is greater than a threshold difference. For example, the anomaly detection unit 550 compares the determined difference with a corresponding threshold (e.g., time threshold, power threshold, etc.) and determines that the difference exceeds the corresponding threshold. The processor 510 (possibly in combination with the memory 530), may comprise means for determining that the difference is greater than a threshold difference.

[00171] At stage 1140, the method 1100 includes determining a location of the user equipment using at least one location-determining measurement of the plurality of positioning signal measurements while, in response to determining that the difference is greater than the threshold difference, excluding the first positioning signal measurement from the at least one location determining measurement. For example, the location determination unit 560 disregards the positioning signal measurement corresponding to the alleged satellite positioning signal, and uses one or more other positioning signal measurements (e.g., of one or more satellite positioning signals and/or one or more other positioning signals (e.g., from one or more base stations)) to determine a location of the UE 500. The processor 510, possibly in combination with the memory 530, possibly in combination with the interface 520 (e.g., the wireless receiver 244 and the antenna 246) may comprise means for determining a location of the UE.

[00172] Referring to FIG. 12, with further reference to FIGS. 1-10, a method 1200 for determining, at a user equipment, that an at least one alleged satellite positioning signal is spoofed includes the stages shown. The method 1200 is, however, an example only and not limiting. The method 1200 may be altered, e.g., by having stages added, removed, rearranged, combined, performed concurrently, and/or having single stages split into multiple stages.

[00173] At stage 1210, the method 1200 includes measuring a plurality of location signals including at least one alleged satellite positioning signal that is spoofed. For example, the SPS receiver 515 receives and measures one or more SPS signals including a spoofed SPS signal to produce measurements of the SPS signals. The processor 510 may also measure one or more other locations signals (e.g., DL-PRS) to produce one or more other measurements. The SPS receiver 515, possibly in combination with the processor 510 (possibly in combination with the memory 530 and/or the interface 520), may comprise means for measuring the plurality of location signals. [00174] At stage 1220, the method 1200 includes determining a difference between at least one measurement of the at least one alleged satellite positioning signal and at least one expected satellite positioning signal measurement. For example, the anomaly detection unit 550 compares one or more measurements of the spoofed SPS signal with one or more expected SPS signal measurements that is(are) expected to be similar to the measurement(s) of the spoofed SPS signal if the spoofed SPS signal was not spoofed. The expected measurement(s) may be, for example, determined from one or more other locations signals (e.g., SPS signal(s), base station signal(s), etc.) and/or other information (e.g., SV location information, sensor information (e.g., dead-reckoning information, etc.). The processor 510 (possibly in combination with the memory 530 and/or the interface 520), may comprise means for determining a difference between the at least one measurement of the at least one alleged satellite positioning signal and the at least one expected satellite positioning signal measurement.

[00175] At stage 1230, the method 1200 includes determining that the difference is greater than a threshold difference. For example, the anomaly detection unit 550 compares the determined difference with a corresponding threshold (e.g., time threshold, power threshold, etc.) and determines that the difference exceeds the corresponding threshold. The processor 510 (possibly in combination with the memory 530), may comprise means for determining that the difference is greater than a threshold difference.

[00176] At stage 1240, the method 1200 includes determining a location of the user equipment using measurements of the plurality of location signals while excluding the at least one measurement of the at least one alleged satellite positioning signal. For example, the location determination unit 560 disregards the positioning signal measurement corresponding to the alleged satellite positioning signal, and uses one or more other positioning signal measurements (e.g., of one or more satellite positioning signals and/or one or more other positioning signals (e.g., from one or more base stations)) to determine a location of the UE 500. The processor 510, possibly in combination with the memory 530, possibly in combination with the interface 520 (e.g., the wireless receiver 244 and the antenna 246) may comprise means for determining a location of the UE.

[00177] Other considerations

[00178] Other examples and implementations are within the scope of the disclosure and appended claims. For example, due to the nature of software and computers, functions described above can be implemented using software executed by a processor, hardware, firmware, hardwiring, or a combination of any of these. Features implementing functions may also be physically located at various positions, including being distributed such that portions of functions are implemented at different physical locations. A statement that a feature that may implement a function includes that the feature may be configured to implement the function (e.g., a statement that an item may perform function X includes that the item may be configured to perform function X). Components, functional or otherwise, shown in the figures and/or discussed herein as being connected or communicating with each other are communicatively coupled unless otherwise noted. That is, they may be directly or indirectly connected to enable communication between them.

[00179] As used herein, the singular forms “a,” “an,” and “the” include the plural forms as well, unless the context clearly indicates otherwise. The terms “comprises,” “comprising,” “includes,” and/or “including,” as used herein, specify the presence of stated features, integers, steps, operations, elements, and/or components, but do not preclude the presence or addition of one or more other features, integers, steps, operations, elements, components, and/or groups thereof. [00180] Also, as used herein, “or” as used in a list of items (possibly prefaced by “at least one of’ or prefaced by “one or more of’) indicates a disjunctive list such that, for example, a list of “at least one of A, B, or C,” or a list of “one or more of A, B, or C” or a list of “A or B or C” means A, or B, or C, or AB (A and B), or AC (A and C), or BC (B and C), or ABC (i.e., A and B and C), or combinations with more than one feature (e.g., AA, AAB, ABBC, etc.). Thus, a recitation that an item, e.g., a processor, is configured to perform a function regarding at least one of A or B, or a recitation that an item is configured to perform a function A or a function B, means that the item may be configured to perform the function regarding A, or may be configured to perform the function regarding B, or may be configured to perform the function regarding A and B. For example, a phrase of “a processor configured to measure at least one of A or B” or “a processor configured to measure A or measure B” means that the processor may be configured to measure A (and may or may not be configured to measure B), or may be configured to measure B (and may or may not be configured to measure A), or may be configured to measure A and measure B (and may be configured to select which, or both, of A and B to measure). Similarly, a recitation of a means for measuring at least one of A or B includes means for measuring A (which may or may not be able to measure B), or means for measuring B (and may or may not be configured to measure A), or means for measuring A and B (which may be able to select which, or both, of A and B to measure). As another example, a recitation that an item, e.g., a processor, is configured to at least one of perform function X or perform function Y means that the item may be configured to perform the function X, or may be configured to perform the function Y, or may be configured to perform the function X and to perform the function Y. For example, a phrase of “a processor configured to at least one of measure X or measure Y” means that the processor may be configured to measure X (and may or may not be configured to measure Y), or may be configured to measure Y (and may or may not be configured to measure X), or may be configured to measure X and to measure Y (and may be configured to select which, or both, of X and Y to measure).

[00181] Substantial variations may be made in accordance with specific requirements. For example, customized hardware might also be used, and/or particular elements might be implemented in hardware, software (including portable software, such as applets, etc.) executed by a processor, or both. Further, connection to other computing devices such as network input/output devices may be employed.

[00182] As used herein, unless otherwise stated, a statement that a function or operation is “based on” an item or condition means that the function or operation is based on the stated item or condition and may be based on one or more items and/or conditions in addition to the stated item or condition.

[00183] The systems and devices discussed above are examples. Various configurations may omit, substitute, or add various procedures or components as appropriate. For instance, features described with respect to certain configurations may be combined in various other configurations. Different aspects and elements of the configurations may be combined in a similar manner. Also, technology evolves and, thus, many of the elements are examples and do not limit the scope of the disclosure or claims.

[00184] A wireless communication system is one in which communications are conveyed wirelessly, i.e., by electromagnetic and/or acoustic waves propagating through atmospheric space rather than through a wire or other physical connection. A wireless communication network may not have all communications transmitted wirelessly, but is configured to have at least some communications transmitted wirelessly. Further, the term “wireless communication device,” or similar term, does not require that the functionality of the device is exclusively, or evenly primarily, for communication, or that the device be a mobile device, but indicates that the device includes wireless communication capability (one-way or two-way), e.g., includes at least one radio (each radio being part of a transmitter, receiver, or transceiver) for wireless communication.

[00185] Specific details are given in the description to provide a thorough understanding of example configurations (including implementations). However, configurations may be practiced without these specific details. For example, well-known circuits, processes, algorithms, structures, and techniques have been shown without unnecessary detail in order to avoid obscuring the configurations. This description provides example configurations only, and does not limit the scope, applicability, or configurations of the claims. Rather, the preceding description of the configurations provides a description for implementing described techniques. Various changes may be made in the function and arrangement of elements without departing from the scope of the disclosure.

[00186] The terms “processor-readable medium,” “machine-readable medium,” and “computer- readable medium,” as used herein, refer to any medium that participates in providing data that causes a machine to operate in a specific fashion. Using a computing platform, various processor- readable media might be involved in providing instructions/code to processor(s) for execution and/or might be used to store and/or carry such instructions/code (e.g., as signals). In many implementations, a processor-readable medium is a physical and/or tangible storage medium. Such a medium may take many forms, including but not limited to, non-volatile media and volatile media. Non-volatile media include, for example, optical and/or magnetic disks. Volatile media include, without limitation, dynamic memory.

[00187] Having described several example configurations, various modifications, alternative constructions, and equivalents may be used without departing from the disclosure. For example, the above elements may be components of a larger system, wherein other rules may take precedence over or otherwise modify the application of the invention. Also, a number of operations may be undertaken before, during, or after the above elements are considered. Accordingly, the above description does not bound the scope of the claims.

[00188] A statement that a value exceeds (or is more than or above) a first threshold value is equivalent to a statement that the value meets or exceeds a second threshold value that is slightly greater than the first threshold value, e.g., the second threshold value being one value higher than the first threshold value in the resolution of a computing system. A statement that a value is less than (or is within or below) a first threshold value is equivalent to a statement that the value is less than or equal to a second threshold value that is slightly lower than the first threshold value, e.g., the second threshold value being one value lower than the first threshold value in the resolution of a computing system.