The adoption of Service-Based Architecture (SBA) in 5G Core Networks (5GC) has significantly transformed the design and operation of the control plane, enabling greater flexibility and agility for cloud-native deployments. While the infrastructure has initially evolved by implementing key functions, there remains significant potential for additional services, such as localization, paving the way for the integration of the Location Management Function (LMF). However, the extensive functional decomposition within SBA leads to consequences, such as the increase of control plane operations. Specifically, we observe that the additional signaling traffic introduced by the presence of the LMF overwhelms the Access and Mobility Management Function (AMF) which is responsible for authentication and mobility. In fact, in mobile positioning, each connected mobile device requires a significant amount of control traffic to support location algorithms in the 5GC. To address this scalability challenge, we analyze the impact of three well-known optimization techniques on location procedures to reduce control message traffic in the specific context of the 5GC, namely a caching system, a request aggregation system, and a service scalability system. Our solutions are evaluated in an OpenAirInterface (OAI) emulated environment with real hardware. After the analysis in the emulated environment, we select the caching system – due to its feasibility – for being analyzed in a real 5G testbed. Our results demonstrate a significant reduction in the additional overhead introduced by the LMF, improving scalability by minimizing the impact on AMF processing time up to a 50% reduction.

Crowdsensing networks for the sole purpose of performing spectrum measurements have resulted in prior initiatives that have failed primarily due to their costs for maintenance. In this paper, we take a different view and propose ORAN-Sense, a novel architecture of Internet of Things (IoT) spectrum crowd-sensing devices integrated into the Next Generation of cellular networks. We use this framework to extend the capabilities of 5G networks and localize a transmitter that does not collaborate in the process of positioning. While 5G signals can not be applied to this scenario as the transmitter does not participate in the localization process through dedicated pilot symbols and data, we show how to use Time Difference of Arrival-based positioning using low-cost spectrum sensors, minimizing hardware impairments of low-cost spectrum receivers, introducing methods to address errors caused by over-the-air signal propagation, and proposing a low-cost synchronization technique. We have deployed our localization network in two major cities in Europe. Our experimental results indicate that signal localization of non-collaborative transmitters is feasible even using low-cost radio receivers with median accuracies of tens of meters with just a few sensors spanning cities, which makes it suitable for its integration in the Next Generation of cellular networks.

Ensuring user privacy remains critical in mobile networks, particularly with the rise of connected devices and denser 5G infrastructure. Privacy concerns have persisted across 2G, 3G, and 4G/LTE networks. Recognizing these concerns, the 3rd Generation Partnership Project (3GPP) has made privacy enhancements in 5G Release 15. However, the extent of operator adoption remains unclear, especially as most networks operate in 5G Non Stand Alone (NSA) mode, relying on 4G Core Networks. This study provides the first qualitative and experimental comparison between 5G NSA and Stand Alone in real operator networks, focusing on privacy enhancements addressing top 8 pre-5G attacks based on recent academic literature. Also, it evaluates the privacy levels of OpenAirInterface, a leading open-source software for 5G, against real network deployments for the same attacks, revealing two new 5G privacy vulnerabilities, and underscoring the need for further studies and stricter standards.

Positioning is a key focus in 5G standardization, starting with 3GPP Release 16. However, most of the effort from the research community and work presented in the technical standardization has been limited mainly to simulation studies. This paper explores the use of software-defined radios (SDRs) platforms for 5G positioning, presenting an overview of the current state-of-the-art and available open-source platforms. Utilizing an advanced SDR-based multi-gNodeBs (gNBs) synchronized testbed, the paper conducts a series of time-based, over-the-air measurements. Results offer insights into the impact of various real-world system parameters, such as the number of gNBs, transmission bandwidth, signal processing techniques, and localization algorithms on positioning accuracy and Time to First Fix (TTFF). These findings provide a pathway for the cost-effective and efficient implementation of high-precision 5G localization systems. The paper contributes to advancing both theoretical understanding and practical applications, serving as a guide for the development of 5G positioning technology.

Indoor positioning is a major challenge for location-based services. WiFi deployments are often used to address indoor positioning. Yet, they requiremultiple access points, which may not be available or accessible for localization in all scenarios, or they make unrealistic assumptions for practical deployments. In this paper we presentSPRING+, a positioning system that extracts and processes Channel State Information (CSI) and Fine Time Measurements (FTM) from a single Access Point (AP) to localize commercial smartphones. First, we propose an adaptive method for estimating the Angle of Arrival (AOA) from CSI that works on single packets and leverages information from the estimated number of paths. Second, we present a new method to detect the first path using FTM measurements, robust to multipath scenarios. We evaluate SPRING+ in an extensive experimental campaign consisting of four different testbeds: i) generic indoor spaces, ii) generic indoor spaces with obstacles, iii) office environments and iv) home environments. Our results show that SPRING+ is able to achieve a median 2D positioning error between 1 and 1.8 meters with asingle WiFi AP.

Localization has achieved great attention in 5G networks, pushed by standardization. However, experimentation in 5G networks lacks the integration of network function modules designed for localization. We present our implementation of the 5G Localization Management Function. It complies with the 3GPP standard and OpenAirInterface, the most advanced framework that implements a full 5G-New Radio stack. We show that we are able to extend the functionality of OpenAirInterface, enabling location services. Finally, we demonstrate that the tool's performance satisfies the 5G Key Performance Indicators required by 3GPP for localization.

Recent advances on WLAN technology have been focused mostly on boosting network capacity by means of a more efficient and flexible physical layer. A new concept is required at MAC level to exploit fully the new capabilities of the PHY layer. In this article, we propose a contention mechanism based on Repeated Contentions (ReCo) in frequency domain. It provides a simple-to-configure, robust and short-term fair algorithm for the random contention component of the MAC protocol. The throughput efficiency of ReCo is not sensitive to the number of contending stations, so that ReCo does not require adaptive tuning of the access parameters for performance optimization. Efficiency and robustness is gained through the power of repeated contention rounds. We also apply the ReCo concept to the emerging IEEE 802.11ax standard, showing how it can boost performance of random access with respect to the current version of IEEE 802.11ax OFDMA Back-Off (OBO). Our proposal is supported by an experimental test-bed that realizes ReCo by means of simultaneous transmission and reception of short tones, which is feasible on top of programmable OFDM PHY layers.

In this paper we study the capability of LoRa technology in rejecting different interfering LoRa signals and the impact on the cell capacity. First, we analyze experimentally the link-level performance of LoRa and show that collisions between packets modulated with the same Spreading Factor (SF) usually lead to channel captures, while different spreading factors can indeed cause packet loss if the interference power is strong enough. Second, we model the effect of such findings to quantify the achievable capacity in a typical LoRa cell: we show that high SFs, generally seen as more robust, can be severely affected by inter-SF interference and that different criteria for deciding SF allocations within the cell may lead to significantly different results. Moreover, the use of power control and packet fragmentation can be detrimental more than beneficial in many deployment scenarios. Finally, we discuss the capacity improvements that can be achieved by increasing the density of LoRa gateways. Our results have important implications for the design of LoRa networks: for example, allocating high SFs to faraway end devices might not improve the experienced performance in case of congested networks because of the increased transmission time and vulnerability period.

Most modern standards for wireless communications support physical layer adaptations, in terms of dynamic selection of channel central frequency, transmission power, modulation format, etc., in order to increase link robustness under time-varying propagation and interference conditions. In this demo, we demonstrate that another powerful solution for extending physical layer flexibility in OFDM-based technologies is the dynamic adaptation of the channel width. Although some standards already define the possibility of utilizing multiple channel widths (e.g. 20MHz, 10MHz, 5MHz for IEEE 802.11a standards), such an utilization is limited to a static configuration of a value defined during the network set-up. Conversely, we demonstrate that channel width adaptations can be performed in real-time during network operation, even on a per-packet basis. To this purpose, we propose an innovative and efficient receiver design, which allows the transmitter to take decisions about the channel width without explicitly informing the receiver.