IP Library › Granted Patent US 12,610,364
Granted Patent B2
US 12,610,364 · App. 18/213,822 · Granted Apr 21, 2026

System and apparatus for passive network monitoring

Inventors: Brian W. Stevens (Elkridge, MD); Katherine M. Woolls (Baltimore, MD); Jacob M. Ray (Marriottsville, MD); Jared S. Everett (Washington, DC); Yongwen Yang (Columbia, MD); Benjamin E. Henty (Columbia, MD); Abdullahi A. Inshaar (Columbia, MD); Avik Dayal (Laurel, MD)
Assignee: The Johns Hopkins University
H04W72/1263H04W72/232
View Patent ↗
Loading inventors, assignments & file history…
Monitor This Case
Get email alerts when status or documents change.
Order Certified Copies
Most orders are placed with the USPTO same day — all within 24 business hours.
Order via The Patent Place →
Pre-filled with this patent's details
Quick Facts
Patent No.
US 12,610,364
App. No.
18/213,822
Granted
Apr 21, 2026
Kind
B2
Abstract

A method for determining control and scheduling information of a network includes receiving a radio frequency waveform having scrambled downlink control information (DCI), performing a cell search to determine cell identity information, performing a beam search and beam detection to estimate a signal quality of the waveform, decoding scheduling information associated with the waveform, detecting a control channel encoded with an unknown identity based on the scrambling identity and extracting resource elements of the control channel based on the scheduling information, attempting to decode the control channel via a re-encoding technique that is tested for accuracy and, in response to accuracy testing not passing, via a blind scrambling seed recovery technique, recovering the DCI based on the re-encoding technique or the blind scrambling seed recovery technique, and obtaining the control and scheduling information from the DCI.

Claims (51)

1 . A method of determining control and scheduling information of a network via an out-of-network monitor, the method comprising:

passively receiving a radio frequency (RF) waveform of a radio interface, using only information that can be observed over the radio interface by the out-of-network monitor, having downlink control information (DCI) scrambled via a scrambling identity unknown to the out-of-network monitor, the DCI providing the control and scheduling information;

performing a cell search to determine cell identity information for a cell via which the RF waveform is received;

performing a beam search and beam detection for the cell to estimate a signal quality of the RF waveform;

in response to the signal quality being above a threshold signal quality, decoding scheduling information associated with the RF waveform;

detecting a control channel encoded with an unknown identity based on the scrambling identity and extracting resource elements of the control channel based on the scheduling information;

attempting to decode the control channel via a re-encoding technique that is tested for accuracy and, in response to accuracy testing not passing, via a blind scrambling seed recovery technique;

recovering the DCI based on the re-encoding technique or the blind scrambling seed recovery technique; and

obtaining the control and scheduling information from the DCI.

2 . The method of claim 1 , wherein the re-encoding technique comprises:

attempting to decode encoded bits of common control channel information from the control channel via an assumed identity;

re-encoding the common control channel information using a guessed identity to define re-encoded bits; and

comparing the control channel encoded with the guessed identity to the encoded bits to determine if the re-encoding is successful based on a number of bit errors.

3 . The method of claim 2 , wherein, in response to the number of bit errors being below a threshold bit error, recovering the DCI is performed based on the re-encoding technique without the blind scrambling seed recovery technique.

4 . The method of claim 3 , wherein the re-encoding technique is optimized via Monte Carlo thresholding.

5 . The method of claim 1 , wherein the blind scrambling seed recovery technique is performed in response to a number of bit errors being above a threshold bit error.

6 . The method of claim 5 , wherein the blind scrambling seed recovery technique comprises solving a system of equations to determine a set of unknown information associated with the DCI, the system of equations including a set of known information associated with the DCI, the set of unknown information, and a transformation matrix applied to the set of known information to obtain the set of unknown information to determine the DCI.

7 . The method of claim 6 , wherein the set of known information comprises received bits and a known portion of a length-31 Gold sequence.

8 . The method of claim 6 , wherein the system of equations is solved via a Galois field row reduction.

9 . The method of claim 6 , wherein solving the system of equations determines a calculated DCI payload and a seed value used to determine an unscrambled and decoded result, and

wherein the calculated DCI payload is compared to the unscrambled and decoded result to determine the DCI.

10 . The method of claim 9 , wherein responsive to a success of re-encode technique or scrambling seed technique in which a bit error is lower than a set threshold, DCI bit parsing is employed.

11 . The method of claim 9 , wherein responsive to no match between the calculated DCI payload and the unscrambled and decoded result, log-likelihood ratio (LLR) optimization is employed to determine the DCI.

12 . The method of claim 11 , wherein the LLR optimization comprises:

sorting received bit LLRs in descending order;

down-selecting N rows of the transformation matrix and the set of known information based on greatest magnitude LLRs to define an updated transformation matrix; and

iteratively calculating a rank of the updated transformation matrix until the rank of the updated transformation matrix is equal to N.

13 . An apparatus for determining control and scheduling information of a network from outside the network, the apparatus comprising processing circuitry configured to:

passively receive a radio frequency (RF) waveform of a radio interface, using only information that can be observed over the radio interface by the out-of-network monitor, having downlink control information (DCI) scrambled via a scrambling identity unknown to the apparatus, the DCI providing the control and scheduling information;

perform a cell search to determine cell identity information for a cell via which the RF waveform is received;

perform a beam search and beam detection for the cell to estimate a signal quality of the RF waveform;

in response to the signal quality being above a threshold signal quality, decode scheduling information associated with the RF waveform;

detect a control channel encoded with an unknown identity based on the scrambling identity and extracting resource elements of the control channel based on the scheduling information;

attempt to decode the control channel via a re-encoding technique that is tested for accuracy and, in response to accuracy testing not passing, via a blind scrambling seed recovery technique;

recover the DCI based on the re-encoding technique or the blind scrambling seed recovery technique; and

obtain the control and scheduling information from the DCI.

14 . The apparatus of claim 13 , wherein the re-encoding technique comprises:

attempting to decode encoded bits of common control channel information from the control channel via an assumed identity;

re-encoding the common control channel information using a guessed identity to define re-encoded bits; and

comparing the control channel encoded with the guessed identity to the encoded bits to determine if the re-encoding is successful based on a number of bit errors.

15 . The apparatus of claim 14 , wherein, in response to the number of bit errors being below a threshold bit error, recovering the DCI is performed based on the re-encoding technique without the blind scrambling seed recovery technique.

16 . The apparatus of claim 13 , wherein the blind scrambling seed recovery technique is performed in response to a number of bit errors being above a threshold bit error.

17 . The apparatus of claim 16 , wherein the blind scrambling seed recovery technique comprises solving a system of equations to determine a set of unknown information associated with the DCI, the system of equations including a set of known information associated with the DCI, the set of unknown information, and a transformation matrix applied to the set of known information to obtain the set of unknown information to determine the DCI.

18 . The apparatus of claim 17 , wherein solving the system of equations determines a calculated DCI payload and a seed value used to determine an unscrambled and decoded result, and

wherein the calculated DCI payload is compared to the unscrambled and decoded result to determine the DCI.

19 . The apparatus of claim 18 , wherein responsive to a success of re-encode technique or scrambling seed technique in which a bit error is lower than a set threshold, DCI bit parsing is employed, and

wherein responsive to no match between the calculated DCI payload and the unscrambled and decoded result, log-likelihood ratio (LLR) optimization is employed to determine the DCI.

20 . The apparatus of claim 19 , wherein the LLR optimization comprises:

sorting received bit LLRs in descending order;

down-selecting N rows of the transformation matrix and the set of known information based on greatest magnitude LLRs to define an updated transformation matrix; and

iteratively calculating a rank of the updated transformation matrix until the rank of the updated transformation matrix is equal to N.

Assignments (2)
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Sep 29, 2023
From: INSHAAR, ABDULLAHI A.; DAYAL, AVIK
To: THE JOHNS HOPKINS UNIVERSITY
Reel/Frame 065072/0396 →
ASSIGNMENT OF ASSIGNOR'S INTEREST Recorded Jul 12, 2023
From: STEVENS, BRIAN W.; WOOLLS, KATHERINE M.; RAY, JACOB M.; EVERETT, JARED S.; YANG, YONGWEN; HENTY, BENJAMIN E.
To: THE JOHNS HOPKINS UNIVERSITY
Reel/Frame 064266/0267 →
Continuity (2)
Provisional Application 63401211 · Aug 26, 2022
Related Publication 20240073885A1 · Feb 29, 2024
References Cited (29)
US 10805969B2 · Samal · 2020 [cited by applicant]
US 11218247B2 · Lo et al. · 2022 [cited by applicant]
US 11677496B2 · Lo et al. · 2023 [cited by applicant]
US 20100144363A1 · De Rosa · 2010 [cited by examiner]
US 20190110290A1 · Sun · 2019 [cited by examiner]
US 20220295405A1 · Seo · 2022 [cited by examiner]
US 20240365308A1 · Gao · 2024 [cited by examiner]
Iterative Decoding of Gold Sequences (Year: 2015). [cited by examiner]
Swarun Kumar et al., “LTE Radio Analytics Made Easy and Accessible,” SIGCOMM '14: Proceedings of the 2014 ACM conference on SIGCOMM, Aug. 17, 2014, pp. 211-222. [cited by applicant]
Robert Falkenberg et al., “Client-Based Control Channel Analysis for Connectivity Estimation in LTE Networks,” 2016 IEEE 84th Vehicular Technology Conference (VTC—Fall), Montreal, QC, Canada, 2016, pp. 1-6. [cited by applicant]
Nicola Bui et al., “OWL: a Reliable Online Watcher for LTE Control Channel Measurements,” AllThingsCellular '16, Proc. Annu. Int. Conf. Mob. Comput. Networking, MOBICOM, DOI: http://dx.doi.org/10.1145/2980055.2980057, 2… [cited by applicant]
Robert Falkenberg et al., “FALCON: An Accurate Real-Time Monitor for Client-Based Mobile Network Data Analytics,” 2019 IEEE Global Communications Conference (GLOBECOM), Waikoloa, HI, USA, 2019, pp. 1-7. [cited by applicant]
Brian W. Stevens et al., “Physical Layer and MAC Design for Self-Reliant Cognitive Multicast Networks Using LTE Resources,” IEEE Transactions on Cognitive Communications and Networking, vol. 7, No. 3, Sep. 2021, pp. 818… [cited by applicant]
Malgorzata Wasilewska et al., “Machine Learning for LTE Energy Detection Performance Improvement,” Sensors 19(19), 4348, Oct. 8, 2019, pp. 1-19. [cited by applicant]
Igor Kim et al., “SDR-based 5G NR Control Channel Analysis Equipment for Network Monitoring,” 2020 International Conference on Information and Communication Technology Convergence (ICTC), 2020, pp. 1060-1063. [cited by applicant]
Mathieu Des Noes et al., “Iterative decoding of Gold sequences,” 2015 IEEE International Conference on Communications (ICC), Signal Processing for Communications Symposium, 2015, pp. 4840-4845. [cited by applicant]
Brian W. Stevens et al., “Cognitive Resource Analyzer for Cellular Network Ecosystems,” IEEE Transactions on Cognitive Communications and Networking, vol. 8, No. 2, Jun. 2022, pp. 733-749. [cited by applicant]
Unknown, “Stingray phone tracker,” website, https://en.wikipedia.org/wiki/Stingray_phone_tracker, last accessed Jul. 12, 2023, pp. 1-16. [cited by applicant]
Unknown, “L3HARRIS: Public Safety and Critical Communications,” website, https://www.13harris.com/all-capabilities/public-safety-and-critical-communications, last accessed Jul. 12, 2023, pp. 1-15. [cited by applicant]
Unknown, “L3HARRIS: Communications for Police and Law Enforcement,” website, https://www.13harris.com/all-capabilities/law-enforcement-communications, last accessed Jul. 12, 2023, pp. 1-7. [cited by applicant]
Unknown, “PMC Wireless: Public Safety,” website, https://pmc-wireless.com/who-you-are/public-safety/, last accessed Jul. 12, 2023, pp. 1-5. [cited by applicant]
Timo Braysy et al., “Cognitive Techniques for Finding Spectrum for Public Safety Services,” Defense Technical Information Center (DTIC) report RTO-MP-IST-092, Sep. 2010, pp. 2-1 - 2-10. [cited by applicant]
Robert L. Foster, Jr. et al., “Cognitive Radio Access Management for Public Safety Communications Systems” Proceedings of the SDR '09 Technical Conference and Product Exposition, 2009, pp. 1-6. [cited by applicant]
Dell Cameron et al., “Cops Turn to Canadian Phone-Tracking Firm After Infamous ‘Stingrays’ Become ‘Obsolete’,” website, https://gizmodo.com/american-cops-turns-to-canadian-phone-tracking-firm-aft-1845442778, last access… [cited by applicant]
Prasanth Karunakaran et al., “A Reference Signal based GLRT for Simultaneous Sensing and Reception in Cognitive LTE-A Systems,” 2016 IEEE Wireless Communications and Networking Conference, Doha, Qatar, Apr. 3, 2016, pp.… [cited by applicant]
Ali Masood et al., “Surveying pervasive public safety communication technologies in the context of terrorist attacks,” Physical Communication, 41, 101109, Apr. 29, 2020, pp. 1-29. [cited by applicant]
Abbass Nasser et al., “Spectrum Sensing for Cognitive Radio: Recent Advances and Future Challenge,” Sensors, 21, 2408, Mar. 31, 2021, pp. 1-29. [cited by applicant]
Brian W. Stevens et al., “Detection Algorithm for Cellular Synchronization Signals in Airborne Applications,” IEEE Access, vol. 9, Apr. 7, 2021, pp. 55555-55566. [cited by applicant]
Vasanthan Raghavan et al., “Millimeter Wave Channel Measurements and Implications for PHY Layer Design,” IEEE Transactions on Antennas and Propagation, vol. 65, No. 12, Sep. 29, 2017, pp. 6521-6533. [cited by applicant]