Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 102/103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claims 1, 4 and 9 are rejected under 35 U.S.C. 102/103 as being unpatentable over Morchon (US Pub. No. 20230308877)
Per claim 1, Morchon (US Pub. No. 20230308877) is relied upon to teach a method, comprising: generating integrity protection information (reads on generating the secure RRC message about the hash of MIB/SIB1, SFN SSB index, see Morchon para 0469, 0480 – 0484 and Figure 19 and Figure 21) of a first broadcast message (reads on a MIB/SIB1, see Morchon para 0480 – 0484 and Figure 19 and Figure 21), wherein the integrity protection information is generated based on a beam index of (reads on SFN SSB index, see Morchon para 0469, 0480 – 0484 and Figure 19 and Figure 21 ) a beam (reads on the beam specific to the SSB index, see Morchon para 0201 and 0433) used to send or receive the first broadcast message (reads on the beam specific to the SSB index, see Morchon para 0201 and 0433); and sending the integrity protection information (reads on the RRC hash message being sent/transmitted from either the UE or the gNB, see Morchon Figure 19, 21 and para 0470, 0479 – 0484) of the first broadcast message (reads on a MIB/SIB1, see Morchon para 0480 – 0484 and Figure 19 and Figure 21).
PNG
media_image1.png
642
880
media_image1.png
Greyscale
PNG
media_image2.png
630
878
media_image2.png
Greyscale
[0089] Upon reception of timing information in SIB1 and SIB9, the secondary station obtains the Signature Generator time and checks whether the received message is too old, e.g., not older than a signature validity duration, e.g., shorter than the System Frame Numbering/HyperFrame Numbering (SFN/HFN) duration (2h54′45″). In other words, the signed message is only valid for around 3 hours.
[0090] In absence of other time source, this time may be used to synchronize the secondary station clock once it joins a primary station and establishes a secure connection with the core network. The time distributed by the primary station provides a synchronization error of around 10 ms which is enough for the purposes of secure broadcast of System Information. Indeed, MIB and SIB1 are distributed with a periodicity of at least 80 ms. Once a device has joined a trusted primary station and has access to trusted Signature Generator time: [0091] a) The device should further improve its time synchronization by using standard techniques. [0092] b) Afterwards, the device should not update its time unless it detects that it has lost synchronization due to other reasons.
[0130] In a variant of this third embodiment, it is possible to determine at step S603 whether a valid stored first hash value is present in a memory of the secondary station, and to retrieve such first hash value from the memory upon determination that a valid first hash value is present. Else, the secondary station may apply a first hash operation onto the first subset of fields to obtain the first hash value, and store the first hash value for subsequent use in the memory upon determination that a valid first hash value is not present. In such a variant, the first hash value is considered valid if one or more of the following conditions is satisfied: the time elapsed since its generation is below a validity threshold, the identity of the primary station is authenticated, the primary station is the currently serving primary station.
[0131] Such a validity threshold value can be signaled from the primary station or be equal to the periodicity of some System Information messages.
[0201] In a further example of this variant that could increase the accuracy and the robustness of the check, the location of the primary station can be estimated, in addition to (or instead of) the number of radiation beams, by taking into account that a primary station broadcast the synchronization signals using different beams radiated in different directions and using a different identifier as can be shown on FIG. 12. In particular, 5G supports up to 1008 PCIs computed as 3N.sub.SSS+N.sub.PSS where N.sub.SSS={0,1, . . . ,335} and N.sub.PSS={0, 1, 2}. Here, SSS refers to the Secondary Synchronization Signal identifier and PSS refers to the Primary Synchronization Signal identifier. The PSS and SSS are transmitted as part of a Synchronization Signal Block (SS Block). SSBs is transmitted in a batch by forming an SS Burst (one SSB per beam) that is used during beam sweeping by changing beam direction for each SSB transmission. The maximum number of SSBs in an SS Burst is frequency-dependent and it can be 4 (below 3 GHz), 8 (3 to 6 GHz), or 64 (6 to 52.6 GHz). The periodicity of the SSB is configured by the network, while the default transmission periodicity for initial cell selection, the SS burst set periodicity is default at 20 ms for all frequency ranges i.e., 2 NR frames. The primary station defines multiple candidate positions for SSBs within a radio frame. Each SSB, radiated in a different direction, can be identified by a unique number called SSB index and identification of which SSB is detected is depend on where secondary station is located. The secondary station can measure the signal strength of Demodulation Reference Signal (PBCH DMRS) of each SSB it detected for a certain period (a period of one SSB Set). From the measurement result, the secondary station can identify the SSB index with the strongest signal strength. This SSB with the strongest signal strength is the best beam for the secondary station.
[0434] a) the SSB index must also be signed and checked. The SSB index is specific to a beam, and thus, it is not part of the MIB. If this information is not signed, an attacker might create a FBS with an “additional beam” broadcasting an additional SSB. The type of attack that is also feasible is such in which an attacker creates a fake beam with index, e.g., XYZ, in an area where the actual beam XYZ cannot be received. If this information is not signed/verified, an attacker can get data from a beam (that is broadcasted slightly earlier) and can place it in its fake beam (forging a real beam) that is broadcasted slightly later. Alternatively, the SI might be enhanced to sign the number of beams used by a base station and a UE might check the number of beams that a base station uses.
[0469] Thus, more specifically, the communication flow described in FIG. 1 can be improved as follows: [0470] 1) A first embodiment to deal with limitation a) consists in extending the communication flow depicted in FIG. 1 in such a way that the hash of PBCH fields is exchanged and verified. This includes the SSB index, the SSB subcarrier offset bits, or the half-frame bits. Note that the 4 least significant bits (LSB) of the SFN might also be included. However, this is not always needed, e.g., if the MIB is transmitted every 40 ms in frame numbers 0, 4, 8, . . . In such a configuration, those 4 LSB are always 0000.
[0479] If the SFN is included, the UE might report the hash of MIB/SIB1 AND the time when the MIB was measured. Note that the MIB only contains the 6 MSBs of the SFN and that each MIB is broadcasted multiple times, this can lead to a time uncertainty. To improve the time accuracy and allow the receiving party to discern which MIB the UE has received, the UE should report time when a new MIB was received, i.e., a MIB in which the 6 MSBs of the SFN differ from the 6 MSBs of the SFN in the previously received MIB. Alternatively, next to the time of the received MIB, the 4 LSBs of the SFN should be included. The network should then keep track of the MIB/SIB1 values used at a specific point of time by the real base station. This is feasible since the SFN repeats the values every 10.24 seconds. Thus, if a base station informs the core network about the SFN value at time t0, and optionally transmits the 64 valid hash values for MIB/SIB1 or provide information for the core network to deduce by computation the 64 hash values, the core network will know which SFN value is used by the base station at any time t, and which hash value of MIB/SIB1 should be reported. By doing this, the network can better identify which hash value should be used in the verification and detect attackers that spoof the identity of a valid base station by replaying its system information, but that are not fully synchronized. Similarly, and as explained in this description, 5G base stations can broadcast MIB/SIB1 through multiple beams pointing at different respective locations. The SSB index for each beam is included in the PBCH and identifies the beam. When a UE reports the hash of MIB/SIB1, the UE might also include in the computation of the hash an identifier of the directional beam (for example the SSB index, or an indication of an angle representative of the direction) for which the measured signal has the highest received power, in other words, the directional beam the UE has used in the communication link with the cell. If the UE does so, then in the report to the base station including the received hash of MIB/SIB1, the UE can include its location and time when MIB/SIB were measured. The base station (and core network once the base station informs the core network) knows the radiation pattern (i.e., direction of beams) possibly as a function of time, for example in the case where the beams are not fully static, the base station knows that at time t, the beams were aimed in a specific direction. With this knowledge, the base station (and the core network) knows which directional beam a UE should have picked up at a given location and time. Then, the core network can check whether the hash of MIB/SIB1 reported by a UE for a given time/location fits the one that the UE should have measured. We note that the core network might include a policy defining a temporal window wt and location window wl so that if the core network knows that at time t0 and location l0 a base station was using SFN_i and beam index Bi, then the core network might accept as valid the hash of MIB/SIB1 for (SFN_i−wt, . . . , SFN_i+wt) and B_i−wl, . . . , B_i+wl).
[0480] It is to be noted that this additional information related to the timing and location described in the context of Solution #4 can also be incorporated to solutions #14 and #19 to increase the resistance of these solutions against replay attacks. In particular, in solution #19, the gNB provides the UE with the hash of MIB/SIB. When the gNB does so, the gNB can provide the UE for example through a secure RRC message with information about the hash of MIB/SIB that the UE should have received at a given time or location. For instance: [0481] if gNB provides the UE with the 64 hashes of MIB/SIB1 (for the 64 possible values of MIB taking into account that MIB includes 6 bits of SFN) and a reference time, e.g., the time at which the hash for MIB/SIB1 with those 6 bits set to 0 was broadcasted for first time. The UE can check whether the received MIB/SIB1 followed/follows the same timing of the real base station as received in the secure RRC message. This check can help the UE to identify replay attacks if the timing of the fake base station is not tightly synchronized with the timing of the actual base station. This can be done by having a time window, e.g., 1 ms. The UE might classify a base station as a FBS if the timing is outside of that time window. [0482] alternatively, the base station can include in the computation of hash MIB/SIB1 some fields of the PBCH, in particular, the SSB index and/or the least significant bits of the SFN. The base station can inform the UE through a secure RRC message about the hash of MIB/SIB1 computed using this information from the PBCH that the UE should have used/measured at its location. The base station can include this information next to the hash of MIB/SIB1. Note that this can require that the UE reports its location to the gNB in a secure way so that a MitM cannot modify it. Alternatively, this can require that the gNB can learn the position of the UE in a trustworthy manner without being influenced by the MitM. This is shown in FIG. 18. [0483] alternatively, the base station computes the hash of MIB/SIB1 without including the SFN or any fields in the PBCH. The base station provides then in a secure RRC message with this hash and the expected SFN and PBCH fields, e.g., SSB index. Upon reception, the UE needs to check that all values are correct. This is shown in FIG. 19.
Solution #14 is as solution #19, but in this case, the UE reports to the gNB the hash of MIB/SIB1. Following above description for #19, the UE can report to gNB in a secure way: [0484] The hash of MIB/SIB1 including the time when the MIB was obtained and triggered its request to join the cell. Then, gNB can check whether the MIB/SIB1 received by the UE fits its timing schedule as done above for Solution #19. This can be checked by verifying that the SFN time measured by UE is the same as the one of the gNB. Note that this can also be done in terms of an absolute time reference, e.g., UTC time assuming that gNB and UE are synchronized. To this end, both UE and gNB keep track of the UTC time when the MIB was received/transmitted before the UE sends its first message to join a cell. Given these two times t_rx and t_tx, it is possible to subtract the reception time t_rx (measured by UE) from the transmission time t_tx of MIB/SIB1 (as measured by gNB) and verify whether it is greater than a threshold, e.g., TH1=1 millisecond. If t_rx−t_tx>TH1, then a MitM might be present. This is shown in FIG. 20. Note that gNB will receive information from many UEs, and thus, the base station can use the timing information from multiple UEs to better determine whether MIB/SIB1 are received later than expected with a higher accuracy. The gNB can do so by subtracting the transmission time of MIB/SIB1 (as measured by gNB) from the reception time of MIB/SIB (as measured and delivered by UEs) and averaging out those values. The averaging out operation removes noise if the noise has suitable properties, e.g., it is uniformly distributed and has average 0. This noise might be caused, e.g., due to UE clocks that are not perfectly synchronized. If this average value is over a given threshold, e.g., TH2=0.5 milliseconds, the base station can trigger an alarm about the presence of a MitM. The values of TH1 and TH2 can be configurable. We note that, in general, TH2 should be smaller than TH1. Note that if the clock of the base station is not sync, this will caused a constant error that is likely to trigger a MITM alarm. Thus, if a MITM is detected, the base station should check whether its time is synchronized to avoid this source of errors, and then take the final MITM detection decision. [0485] The hash of MIB/SIB1 computed including SSB index present in the PBCH of the selected beam, i.e., the beam with the highest received power. Then, the gNB can check whether the SSB index corresponds to the same beam used when the UE joined the cell. This is shown in FIG. 21. [0486] Alternatively, the hash of MIB/SIB1 computed including SSB index and including the location of the UE when the UE measured that MIB/SIB1. Then, the gNB can check whether the received hash of SSB index/MIB/SIB1 corresponds to the MIB/SIB1 that the UE should have measured at that specific location and corresponding to the radiation pattern of the base station. For instance, knowing the UE location, the base station can know which SSB index the UE should have measured as the most powerful one, and then can use this SSB index to compare the received hash. This is shown in FIG. 22. Since the gNB receives multiple UE reports, the gNB checks not only whether the measurements are consistent with its own expected radiation pattern, but that those measurements are consistent with each other. We note that a base station can obtain the expected radiation pattern from a physical model or from measurements performed during initial network planning and deployment. Since the radiation pattern might be influenced by the construction of new buildings, vegetation (trees), etc, a base station can update its expected radiation pattern based on measurements reported by the UEs within a time window, e.g., the last 2 weeks. The radiation pattern at time t, RP(t), can be computed as a function of the radiation pattern at time t−1, RP(t−1), and the averaged measurements received at time t, AM(t). For instance, the RP can be updated as RP(t)=a*RP(t−1)+(1−a) M(t) where a is a memory factor. If a=0, then the system has no memory and the RP does not depend on the previous values. If a=1, then the radiation pattern does not change. We note that the radiation pattern can be influenced by other factors, e.g., rain. A base station can have multiple radiation patterns as above for different environmental circumstances.
Per claim 4, the prior art of record further suggests wherein the beam is a beam used to send the first broadcast message, and wherein the sending the integrity protection information of the first broadcast message comprises (see Morchon Figure 19 and 21): sending a broadcast message carrying (reads on "SIB1 would contain a MAC computed with the undisclosed link of the hash chain", see Morchon para 0448. Morchon's hash-chain variant likewise has SIB1 carry the MAC protecting the broadcast, confirming that in-band carriage of the protection value in the broadcast message was Morchon's ordinary configuration.) the first broadcast message and the integrity protection information on the beam (reads on "the SIB index must also be signed and checked. The SSB index is specific to a beam, and thus, it is not part of the MIB", see Morchon para 0433. Morchon requires the beam-specific SIB index to be signed, so the resulting signature differs per beam and is necessarily broadcast in the SIB1 of the beam whose SSB index it covers; Morchon does not state this per-beam in-band carriage in a single passage, and it would have been obvious to combine Morchon's own teachings at para 0433 and para 0117 (MPEP 2143(I)(A), predictable use of prior-art elements according to their established functions) so that each beam's SIB1 carries the signature computed with that beam's SSB index, the motivation being Morchon's stated need to prevent an attacker from adding or forging a beam.).
Claim 9 is analyzed with respect to claim 1. The prior art of record further suggests receiving integrity protection information of a first broadcast message (reads on "The base station can inform the UE through a secure RRC message about the hash of MIB/SIB1 computed using this information from the PBCH that the UE should have used/measured at its location", see Morchon para 0480. Morchon's UE receives, in a secure RRC message, the base station's hash of MIB/51B1, and a hash computed over broadcast content is integrity protection information of that content in the same sense as the hash value the specification describes. The receiving entity is the UE, which is the terminal-side receipt described in the governing specification support.); and checking the integrity protection information (reads on "The UE can compare the information provided by the gNB with the MIB/SIB/PCI previously received, and check whether they match", see Morchon para 0459. The UE compares the gNB-provided hash with the MIB/SIB/PCI it previously received and determines whether they match, which is a check of the received integrity protection information against the received broadcast content.) based on a beam index (reads on "This is so because the base station will inform the UE about the beam (SSB index) that it used for the communication (through the hash value)", see Morchon para 0476. Morchon states that the base station conveys the SSB index of the beam it used through the hash value itself, so the hash the UE checks is bound to an SSB index. An SSB index identifies one SS/PBCH beam of the cell, so an SSB-index-bound hash is checked based on a beam index.) of a beam (reads on "a) the SSB index must also be signed and checked. The SSB index is specific to a beam, and thus, it is not part of the MIB", see Morchon para 0433. In Morchon's signed-broadcast embodiment the SSB index is signed and checked, and Morchon identifies that index as specific to a beam, confirming that the index used in the check is a beam index.) used to receive the first broadcast message (reads on "AUE can check whether the SSB_index it has received is actually is set in this field, and that the hash of SIB1 as provided by the base station matches the one computed locally based on the received SIB1", see Morchon para 0472. The SSB_index the UE has received is the index the UE obtained on the beam over which it received the broadcast, and Morchon pairs that received index with verifying the base-station hash against the hash computed locally from the received SIB1.), to obtain a check result (reads on "If attacker used a different beam, the SSB index will be different, and the hashes will not match", see Morchon para 0476. Morchon's check produces a definite outcome, namely that the hashes do not match when a different beam carried the broadcast, and a match/no-match outcome is a check result.) of the integrity protection information of the first broadcast message (reads on "If they do not, then it sends an indication to the gNB", see Morchon para 0459. The mismatch outcome is the result of checking the gNB-provided MIB/SIB hash, and the UE acts on it by sending an indication, confirming that the check yields a concrete result for that broadcast message's integrity protection information.).
Claims 2 is rejected under 35 U.S.C. 102/103 as being unpatentable over Morchon (US Pub. No. 20230308877) in view of Agiwal (US Pub. No. 2017/0295489).
Per claim 2, the prior art of record further suggests: sending a signature period corresponding to the first broadcast message on the beam, wherein the signature period corresponding to the first broadcast message on the beam is a sending period of the integrity protection information of the first broadcast message on the beam (reads on a validity threshold value is signaled from the primary station, see Morchon para 0089 and 0131). The prior art of record is silent on explicitly stating sending a signature period corresponding to the first broadcast message on the beam; wherein the signature period corresponding to the first broadcast message on the beam is a sending period of the integrity protection information of the first broadcast message on the beam.
Agiwal (US Pub. No. 2017/0295489) is relied upon to teach sending a signature period (reads on "N can be pre-defined or signaled in scheduling information", see Agiwal para 0100. Agiwal's network signals the protection interval N in scheduling information, which is transmitting to the UE a parameter defining how often integrity protection accompanies the 51, i.e., sending a signature period.) corresponding to the first broadcast message (reads on "In order to reduce signaling overhead of MAC/D5, in one embodiment, if SI is periodically transmitted then instead of integrity protecting SI every period, SI can be protected once every N period", see Agiwal para 0100. Agiwal's N is defined relative to the periodic transmission of the SI itself (protection once every N periods of that SI), so the signaled interval corresponds to the particular broadcast message being protected.) on the beam (reads on "the SSB index must also be signed and checked. The SSB index is specific to a beam, and thus, it is not part of the MIS", see Morchon para 0433. Because Morchon's protection value is bound to the SSB index that is specific to a single beam, each beam carries its own protection value and the interval at which it is sent is necessarily an interval on that beam; applying Agiwal's interval per beam is the modification set out in the KSR statement.)
Before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to modify Morchon's beam-bound protection of broadcast system information, in which the SSB index of each beam is signed and checked by the UE together with the broadcast MIB/SIB content, by integrating the signaled, reduced-frequency integrity-protection schedule of Agiwal (see Agiwal ,0100: "N can be pre-defined or signaled in scheduling information.") to realize the instant limitations. One or more of the underpinning rationale(s), as discussed in KSR, also see MPEP 2141 {C, G}, support this conclusion. Accordingly, it would have been obvious to one of ordinary skill in the art to have Morchon's base station attach its SSB-index-bound signature to the broadcast system information on each beam once every N periods and signal N to the UE, and to have Morchon's UE receive that signaled N, as recited in the instant claims, by applying the once-every-N integrity-protection scheduling of Agiwal to the existing per-beam signed broadcast of Morchon. As Agiwal itself states: "In order to reduce signaling overhead of MAC/DS, in one embodiment, if SI is periodically transmitted then instead of integrity protecting SI every period, SI can be protected once every N period." (see Agiwal para 0100), which addresses the well-recognized overhead problem of carrying a MAC or digital signature with every periodic transmission of broadcast system information. One of ordinary skill in the art in wireless broadcast security would have recognized that Morchon's signing of the MIB/SIB content and of the beam-specific SSB index adds signature bits to every repetition of that content on every beam, and that Agiwal's protection once every N periods with a signaled N was a known, predictable solution to exactly that overhead, requiring no change to the underlying Morchon signature generation or UE-side verification. The combination is further supported by MPEP 2141 Rationale C (use of a known technique to improve similar methods in the same way) and Rationale G (teaching, suggestion, or motivation in the prior art, here Agiwal's express overhead-reduction motivation). The motivation to combine these references applies to all claims under this heading.
Claims 5, 10, 12, 13, 16 and 19 rejected under 35 U.S.C. 102/103 as being unpatentable over Morchon (US Pub. No. 20230308877) in view of Agiwal (US Pub. No. 2017/0295489) in view of TR 33.809 (3GPP TR 33.809 V0.9.0, S3-201476).
Claim 5 is analyzed with respect to claim 2. The prior art of record further suggests wherein the integrity protection information is further generated (reads on "reusing a single signature for multiple consecutive messages, wherein each message also includes a timestamp, the method further comprising computing an actual transmission timestamp from the received timestamp before checking the validity of the message", see Morchon para 0446. Morchon itself attaches a transmission timestamp to its signed broadcast messages, confirming that a time input belongs within Morchon's own broadcast-signature scheme into which the TR 33.809 Time Counter is integrated per the KSR statement at the end of this claim.) based on a timestamp, a downlink frequency (reads on "Next to the cell specific parameters PCI and downlink frequency that are already suggested to be signed and verified by a UE, the following parameters transmitted in PBCH must be signed as well", see Morchon para 0433. Morchon names the downlink frequency as a cell-specific parameter that is signed, so the downlink frequency is an input of the signature generated for the broadcast.), and a cell identity (reads on "Next to the cell specific parameters PCI and downlink frequency that are already suggested to be signed and verified by a UE, the following parameters transmitted in PBCH must be signed as well", see Morchon para 0433. The PCI that Morchon signs is the physical cell identifier, which the specification identifies as the cell identity.). The prior art of record does not explicitly state integrity protection information is further generated based on a timestamp that are used to send the first broadcast message.
TR 33.809 (3GPP TR 33.809 V0.9.0, S3-201476) is relied upon to teach integrity protection information is further generated (reads on "reusing a single signature for multiple consecutive messages, wherein each message also includes a timestamp, the method further comprising computing an actual transmission timestamp from the received timestamp before checking the validity of the message", see Morchon para 0446. Morchon itself attaches a transmission timestamp to its signed broadcast messages, confirming that a time input belongs within Morchon's own broadcast-signature scheme into which the TR 33.809 Time Counter is integrated per the KSR statement at the head of this claim.) based on a timestamp (reads on "Time Counter are input to security algorithm to generate the digital signature", see TR 33.809 section 6.7.2.1. The network-side digital signature over the broadcast system information of TR 33.809 is generated with the Time Counter as an input, which is integrity protection information generated based on a timestamp.) and downlink frequency (reads on "The input also contains downlink frequency and physical cell ID of the cell that is broadcasting the SI message, which ensures that any replay of the SI message in a different frequency/PCI is detected by the UE", see TR 33.809 section 6.7.2.1. TR 33.809 likewise places the downlink frequency of the broadcasting cell into the input of the network-generated signature.) and a cell identity (reads on "The input also contains downlink frequency and physical cell ID of the cell that is broadcasting the SI message, which ensures that any replay of the SI message in a different frequency/PCI is detected by the UE", see TR 33.809 section 6.7.2.1. TR 33.809 includes the physical cell ID of the broadcasting cell in the same signature input as the downlink frequency and the Time Counter.) that are used to send the first broadcast message (reads on "The Time Counter input to the security algorithm is the value of counter corresponding to time slot in which system information is transmitted", see TR 33.809 section 6.7.2.1. The Time Counter input is tied to the time slot in which the system information is transmitted, so the timestamp is the one used to send the broadcast message; and reads on "The input also contains downlink frequency and physical cell ID of the cell that is broadcasting the SI message, which ensures that any replay of the SI message in a different frequency/PCI is detected by the UE", see TR 33.809 section 6.7.2.1. The downlink frequency and physical cell ID in the input are those of the cell that is broadcasting the SI message, i.e., the values used to send it.)
Before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to modify Morchon's broadcast signature, which Morchon states covers the cell-specific PCI and downlink frequency that are signed and verified by a UE and must also cover the beam-specific SIB index (see Morchon para 0433), by integrating the time-counter signature input of TR 33.809[AltContent: ](see TR 33.809 section 6.7.2.1: "Time Counter are input to security algorithm to generate the digital signature.") to realize the instant limitations. One or more of the underpinning rationale(s), as discussed in KSR, also see MPEP 2141 {A, G}, support this conclusion. Accordingly, it would have been obvious to one of ordinary skill in the art to have Morchon's base station generate, and Morchon's UE check, one signature whose inputs are the Time Counter of the time slot in which the system information is transmitted, the downlink frequency, the physical cell ID, and the SSB index of the beam over which the broadcast is sent and received, as recited in the instant claims, by applying the multi-parameter signature input of TR 33.809 to the existing SSB-index-extended signature of Morchon. As TR 33.809 itself states: "The usage of Time Counter ensures that received system information cannot be replayed." (see TR 33.809 section 6.7.2.1), which addresses the well-recognized problem of a false base station replaying captured system information. One of ordinary skill in the art in wireless broadcast security would have recognized that Morchon adds the SSB index to a signature over PCI and downlink frequency without reciting a time input in that same signature, although Morchon discusses timestamps for its signed messages (see Morchon para 0446), and that the single signature of TR 33.809 over the system information, a Time Counter, the downlink frequency and the physical cell ID was a known, predictable solution to exactly that gap, requiring no change to the underlying Morchon signature generation or verification. The combination is further supported by MPEP 2141 Rationale A (combining prior art elements according to known methods to yield predictable results) and Rationale G (teaching, suggestion, or motivation in the prior art, here the stated replay-prevention purpose of the Time Counter). The motivation to combine these references applies to all claims under this heading.
Claim 10 is analyzed with respect to claim 5, the prior art of record further suggests receiving a signature period (reads on "Period can be pre-defined or signaled by network in NAS or access stratum (AS) signaling. UE can receive this and use it to validate MAC/OS to determine whether cell is rogue or not", see Agiwal para 0099. Agiwal's network signals the period of the MAC/OS-bearing message in NAS or AS signaling, and the UE receives that period and uses it to validate the MAC/DS, which is a terminal device receiving the period of the integrity protection information.)corresponding to the first broadcast message (reads on "N can be pre-defined or signaled in scheduling information", see Agiwal para 0100. N is signaled in the scheduling information of the periodically transmitted SI whose protection it governs, so the signaled period corresponds to that broadcast message.) on the beam (reads on "Similarly, and as explained in this description, SG base stations can broadcast MIB/SIB1 through multiple beams pointing at different respective locations. The SSB index for each beam is included in the PBCH and identifies the beam", see Morchon para 0479. Morchon broadcasts MIB/SIB1 separately on each beam identified by its SSB index, so a sending period applied to Morchon's signed broadcast is necessarily applied to the signature carried on each such beam. Associating Agiwal's N with the signed broadcast on the beam is the per-beam application set out in the KSR statement at the head of this claim, not an express disclosure of a per-beam period in either reference.), wherein the signature period corresponding to the first broadcast message on the beam is a sending period of the integrity protection information reads on "In order to reduce signaling overhead of MAC/OS, in one embodiment, if SI is periodically transmitted then instead of integrity protecting SI every period, SI can be protected once every N period", see Agiwal para 0100. Under Agiwal the MAC/DS accompanies the SI only once every N SI periods instead of every period, so N defines the interval at which the integrity protection information of that SI is sent, which is the claimed sending period.) of the first broadcast message (reads on "UE can determine the SI window where SI message is transmitted with protection and without protection", see Agiwal para 0100. Agiwal's UE determines which SI windows carry the SI message with protection and which carry it without protection, confirming that N is the sending period of the protection of that specific broadcast message.) on the beam (reads on "a) the SSB index must also be signed and checked. The SSB index is specific to a beam, and thus, it is not part of the MIB", see Morchon para 0433. Because Morchon signs the beam-specific SSB index, the signature carried on one beam differs from the signature carried on any other beam, so the signature whose sending period Agiwal's N governs is itself a per-beam signature.).
Claim 12 is analyzed with respect to claim 5. The prior art of record further suggests wherein the first broadcast message comprises (reads on "The signature itself can be in SIB! and both MIB and SIB1 would need to be obtained to verify the signature", see Morchon para 0117. Because the single signature covers both MIB and SIB! and both must be obtained to verify it, the broadcast message protected and checked in Morchon comprises those different broadcast messages.) different broadcast messages (reads on "However, it can also be computed over multiple blocks of SI including MIB, SIB!, SIB2 for example. The secondary station can for instance obtain a single signature for both MIB and SIB1 that form MSI", see Morchon para 0117. Morchon computes one signature over multiple blocks of broadcast SI, such as MIB, SIB1 and SIB2, which are different broadcast messages.) having a same transmission period (reads on "Only SIBs having the same periodicity can be mapped to the same SI message", see TS 38.331 section 5.2.1, p. 24 (PDF p. 25). TS 38.331 requires that SIBs mapped to one SI message have the same periodicity, so SIBs grouped in one SI message are different broadcast messages having a same transmission period.).
Claim 13 is analyzed with respect to claim 5. The prior art of record further suggests checking the integrity protection information based on a timestamp, a downlink frequency, a cell identity, and the beam index of the beam that are used to receive the first broadcast message, to obtain (reads on "The input also contains downlink frequency and physical cell ID of the cell that is broadcasting the SI message, which ensures that any replay of the SI message in a different frequency/PC! is detected by the UE", see TR 33.809 section 6.7.2.1. TR 33.809 places the Time Counter, the downlink frequency and the physical cell ID into one signature input that the UE verifies, supplying the timestamp as an input of the same single check that Morchon extends with the SSB index.) the check result of the integrity protection information of the first broadcast message (reads on "Next to the cell specific parameters PCI and downlink frequency that are already suggested to be signed and verified by a UE, the following parameters transmitted in PBCH must be signed as well", see Morchon para 0433. Morchonextends a single UE-verified signature that already covers PCI and downlink frequency with the parameters transmitted in PBCH, including the SSB index, so one check in Morchon covers three of the four recited inputs. Morchon does not recite the timestamp as an input to that same signature, and the four-input conjunction is the modification set out in the TR 33.809 KSR statement.).
Claim 16 is analyzed with respect to claim 5, the prior art of record further suggests, comprising: sending a first broadcast message (reads on "SG base stations can broadcast MIB/SIB1 through multiple beams pointing at different respective locations", see Morchon para 0479. Morchon's base station broadcasts the MIB/SIB1 system information on each of its beams, and a MIB/SIB1 broadcast is the "first broadcast message" that the network device sends in S201 of the specification. The same passage ties each broadcast to a beam, which is the beam context in which the later hash report and check of Solution #14 operate.); receiving response information of the first broadcast message (reads on "Solution #14 is as solution #19, but in this case, the UE reports to the gNB the hash of MIB/SIB1", see Morchon para 0480. The gNB of Morchon's Solution #14 is the recipient of a UE report whose content is the hash of the MIB/SIB1 broadcast the UE received, so the report is information sent in response to, and about, that broadcast message. This matches the construction of "response information" in S203, where the network device receives from the terminal device information about the first broadcast message.), wherein the response information comprises a beam index (reads on "the UEs only report in a secure way the beam that they perceive as the strongest/preferred one," see Morchon para 0487. Morchon teaches that, for the FIG. 18-22 embodiments (which include the Solution #14 hash report), where UEs report in a secure way the beam they perceive as strongest, the network detects a fake-beam attacker by tracking the UEs connecting through each beam, so Morchon treats the UE-perceived beam as information the network obtains from the UE. Morchon does not expressly state that the beam is conveyed as a separate SSB-index field of the Solution #14 report rather than only through the index-dependent hash; the recited beam index carried in the response information is therefore reached by the modification set out in the KSR statement above, under which the UE includes the SSB index as an explicit field of the report. TS 38.331 confirms that an SSB index is a conventional, standardized UE-to-network report field, since the UE includes in its report the index of the best beam (see TS 38.331 section 5.5.5.2, p. 97 (PDF p. 98): "3> include within resultsSSB-Indexes the index associated to the best beam for that SS/PBCH block sorting") encoded as "ssb-Index SSB-Index" (see TS 38.331 section 6.3.2 (MeasResults), p. 237 (PDF p. 238)).) of a beam used by a terminal device to receive the first broadcast message (reads on "the directional beam the UE has used in the communication link with the cell", see Morchon para 0479. Morchon identifies the beam at issue as the directional beam, identified for example by its SSB index, on which the UE measured the highest received power and which it uses with the cell, i.e., the beam over which the UE received the MIB/SIB1. This is the same beam the specification selects in para 0170 (the beam with highest signal received strength), so the beam identity required by the claim is the identity Morchon already feeds into the UE hash.), and integrity protection information that is of the first broadcast message(reads on "The hash of MIB/SIB1 computed including SSB index present in the PBCH of the selected beam, i.e., the beam with the highest received power", see Morchon para 0480. The reported hash of MIB/SIB1 is a digest of the broadcast message content used by the gNB to verify that content, which is integrity protection information "of the first broadcast message"; the specification itself states the integrity protection information may be a hash value (para 0171).) and that is generated by the terminal device (reads on "When a UE reports the hash of MIB/SIB1, the UE might also include in the computation of the hash an identifier of the directional beam (for example the SSB index, or an indication of an angle representative of the direction)", see Morchon para 0479. Morchon assigns the computation of the reported hash to the UE, i.e., the terminal device generates the integrity protection information that it reports.) based on the beam index (reads on "computed including SSB index present in the PBCH of the selected beam," see Morchon para 0480. The SSB index of the selected beam is an input of the UE's hash computation, so the hash is generated based on the beam index of the beam over
which the UE received the MIB/SIB1, as in 5202 of the specification. In the combination, that same SSB index is the index carried in the response above) ; and checking the integrity protection information (reads on "Then, the gNB can check whether the SSB index corresponds to the same beam used when the UE joined the cell", see Morchon para 0480. Morchon's gNB performs the check on the UE-reported hash whose input is the SSB index, so the object of the gNB check is the terminal-generated integrity protection information.) based on the first broadcast message and the beam index (reads on "the base station can include in the computation of hash MIB/SIB1 some fields of the PBCH, in particular, the SSB index", see Morchon para 0480. Morchon's base station computes the MIB/SIB1 hash from the MIB/SIB1 it broadcasts and the SSB index, and Solution #14 follows Solution #19, so the gNB check of the UE hash is made against a hash formed from the broadcast MIB/S1B1 and an SSB index, which is the recompute-and-compare check of para 0179 of the specification. In the combination with TS 38.331, the SSB index used by the gNB for that recomputation is the index carried in the UE response.), to obtain a check result of the integrity protection information of the first broadcast message (reads on "If attacker used a different beam, the SSB index will be different, and the hashes will not match", see Morchon para 0476. The comparison of Morchon produces a match or mismatch outcome of the index-based hash, and a mismatch indicates an attacker, which is a check result of the integrity protection information of the broadcast message.).
Per claim 19, the prior art of record further suggests wherein the first broadcast message comprises different broadcast messages (reads on "However, it can also be computed over multiple blocks of SI including MIB, SIB1, SIB2 for example", see Morchon para 0117. Morchon computes a single integrity value over several distinct system-information blocks, so the message covered by the integrity protection information comprises different broadcast messages, and the Solution #14 hash of MIB/SIB1 of claim 16 is itself a hash over two different broadcast messages.) having a same transmission period.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Brian Shaw whose telephone number is (571)270-5191. The examiner can normally be reached on Mon-Thurs from 6:00 AM-3:30 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeff Nickerson can be reached on (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 703-872-9306.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRIAN F SHAW/
Primary Examiner, Art Unit 2432
