With reference to FIG. 1, cellular networks typically include a plurality of adjacent cells 100, each of which is managed by a centralized scheduling and communication device 102, commonly referred to as a base station (“BS”), which communicates with subscribers 104, 106 that are located within the cell 100 and connected to the BS 102. The subscribers 104, 106 are commonly referred to as user equipment (“UE”).
With reference to FIG. 2A, communication between the BS 102 and the UE's 104, 106 is tightly controlled by the BS 102. According to the Long Term Evolution (“LTE”) protocol, messages are exchanged between the base station 102 and the UE's 104 through a plurality of “physical channels” 202, 204, 206, 210, 212. In particular, the base station 102 transmits both downlink scheduling and uplink scheduling to the UE's 104, 106 through the Physical Downlink Control CHannel (“PDCCH”) 212. The downlink scheduling information contains the information for the UE 104 to understand and decode messages from the base station, while the uplink scheduling information contains the information that is used by the UE 104 to transmit its own messages to the base station.
If the base station transmits downlink information to a UE, it transmits downlink scheduling information on the PDCCH 212 and sends the actual downlink information on the PDSCH 206. If a UE 104 wishes to send uplink information to the BS 102, it first sends a request for authorization to the BS 102 through the Physical Uplink Control CHannel (“PUCCH”) 210, and the BS 102 responds with an uplink scheduling grant through the PDCCH 212. The data is then sent to the base station in the PUSCH 204 using parameters specified by the scheduling grant information.
Of course, this means that all of the active UE's 104, 106 in the cell 100 must monitor the PDCCH 212 at all times. With reference to FIG. 2B, a PDCCH transmission 218 will generally contain PDCCH messages for a plurality of UE's. The BS multiplexes the PDCCH messages for the various UEs across the available bandwidth as shown in FIG. 2B. The smallest relevant section of the bandwidth is known as a Control Channel Elements (CCE) 216. Each CCE 216 consists of 36 subcarriers. A single PDCCH message can include 1, 2, 4 or 8 CCEs 216 to account for different amounts of information included in the messages. PDCCH messages cannot overlap in frequency, but must be multiplexed in frequency as shown in FIG. 2B.
Each UE must therefore consider a plurality of different combinations of CCE's 216 in each PDCCH transmission 218 to determine if it is the intended recipient for any of the messages. As illustrated in FIG. 2C, this search is made easier by the fact that the RNTI defines a limited search space for each UE, so that the UE need not perform an exhaustive search over all potential combinations of CCE's 216 in the transmission.
Each UE must also search across various Downlink Control Information (“DCI”) formats, which correspond to different packet lengths, message types, and structures that are typically related to the number of antennas and the MIMO type supported by the terminal. For downlink specific DCI formats, the downlink transmission mode (“TM”) dictates the DCI formats that the UE must check.
To ensure that each PDCCH scheduling message is accepted only by the intended recipient UE or recipient UE's, the BS 102 assigns a unique Radio Network Temporary Identifier (“RNTI”) to each active UE 104, 106 in the cell, and then scrambles the cyclic redundancy check (CRC) for each PDCCH message using the RNTI that has been assigned to the intended recipient. The UE 104 then monitors the PDCCH and performs a descrambling operation on the CRC using its RNTI. If the CRC passes the UE knows that the scheduled information is intended for it.
Note that the LTE standard defines several types of RNTI, including not only RNTI's that are assigned uniquely to individual UE's (e.g. RA-RNTI's and C-RNTI's), but also RNTI's that are assigned to groups of UE's (e.g. P-RNTI's), or even to all the UE's in the cell (e.g. SI-RNTI's). For simplicity, unless otherwise specified, the invention is described herein with reference to RNTI's that are uniquely assigned to UE's, but it should be noted that the invention can be applied to many or all types of RNTI, and that the term “RNTI” is used herein generically to refer to all such types of RNTI.
At any given time there may be many UE's in the cell that are idle. Accordingly, the BS 102 assigns RNTI's to the UE's as they transition from the idle state to the active state through a process called “acquisition.” When a UE transitions back to an idle state, the assigned RNTI is released, and may subsequently be assigned to a different UE in the cell 100.
During acquisition 200 an idle UE initiates the acquisition process by sending an authorization request through the “Physical Random Access CHannel (“PRACH”) 202. The BS 102 responds by assigning an RNTI to the UE 104. The acquisition process then proceeds through an exchange of messages that are transmitted by the UE on the Physical Uplink Scheduling CHannel (“PUSCH”) 204 and by the BS on the Physical Downlink Scheduling CHannel (“PDSCH”) 206.
FIG. 3A presents a somewhat more detailed illustration of the LTE acquisition handshake process in terms of seven “events” that are included in the handshake.
For each possible combination of CCE's in a PDCCH transmission, referred to herein as PDCCH “detections,” there will be a corresponding “valid” RNTI. This applies both to actual “correct” messages and to “incorrect” detections that do not represent actual messages. This effect occurs due to the PDCCH CRC being 16 bits, as well as there being 2^16 valid RNTIs, making one RNTI appear to be valid for every possible combination of CCEs. Since only a small subset of the total RNTI's will typically be allocated to UE's, herein referred to as the “active” RNTIs, most of these valid RNTI's will not correspond with any of the RNTI's that have been assigned by the BS to active UE's in the cell. However, it can sometimes happen by chance that a certain combination of CCE's in a PDCCH transmission corresponds with a valid RNTI that has in fact been assigned to an active UE, even though the combination of CCE's is not an actual message. This can cause the UE to falsely attempt to transmit or receiver a message, depending on the contents of the falsely decoded PDCCH message.
It may be desirable under some circumstances to use a device such as a “PDCCH sniffer,” to obtain complete scheduling knowledge for a cell by decoding all of the PDCCH messages transmitted by the BS 102. Such a device can be useful for drive testing, network monitoring, and/or debugging, for a network that is either in a lab or fielded. A PDCCH sniffer can also be useful as a parameter receiver which monitors nearby cells in order in improve their performance and/or the performance of some aspect of the network. A parameter receiver may be integrated into a UE or a base station.
The PDCCH sniffer may perform an exhaustive search over all possible combinations of CCE's in each PDCCH transmission. In general, this will result in many PDCCH “false alarms,” where the sniffer has falsely detected that a certain PDCCH detection is destined for a UE with a certain RNTI. The false alarm rate will be very high, because each combination of CCE's that is searched will have a valid RNTI that is one of the possible RNTI's, regardless of whether the detection is actually a message. Since the false alarm rate will be so high, the information obtained by the sniffer cannot be relied upon as accurate.
This false alarm problem becomes worse as multiple DCI formats are considered with different packet lengths. The different DCI formats use different message structures and lengths, each format being intended for a different purpose. These multiple formats exacerbate the problem of false alarms, because a sniffer device attempting to obtain complete scheduling knowledge must search each combination of CCI's for each DCI format, unless the sniffer knows the transmission mode of the BS and can thereby narrow the search.
What is needed, therefore, is a method for reducing PDCCH false alarms during analysis of PDCCH transmissions by a sniffer device.