Every question of this course

Q1.1 What powers an Ambient IoT device?

• A cable from the reader
• A coin cell that is replaced once a year
• Energy harvested from radio waves, light, movement or heat

The architecture document describes the device as powered by energy harvesting, either with no battery at all or with limited storage such as a capacitor, from radio waves, light, motion or heat. §4.1

Q1.2 What does the cheapest kind of tag do instead of transmitting?

• It reflects a plain tone another node is already sending
• It waits for a satellite pass
• It stores its answer until a reader is plugged into it

A carrier-wave node emits one unmodulated tone and the tag changes how much of it bounces back. There is no transmitter in the tag, which is how it lives on about a microwatt. TS 38.291

Q1.3 Clause 4.3 of TS 22.369 names four jobs. Which one is sending a tag a command so that something happens?

• Asset tracking
• Actuator control
• Inventory

Actuator control is the job where the tag is attached to something that acts and the network sends it commands. The other three only read. TS 22.369

Q1.4 A reader opens TS 22.369 to find out what an Ambient IoT device must do. What does he find?

• A list of things the device shall do
• A conformance test plan for the tag
• Requirements placed on the 5G system, and the device only described

Every requirement in its clause 5 is placed on the 5G system or the 5G network. The device itself is described, in five characteristics, and never required to do anything. TS 22.369

Q1.5 How does the architecture document fence the Ambient IoT system in this release?

• As an isolated private network that does not interact with a public network
• As a roaming service between operators
• As a service every public operator sells

The scope clause says the AIoT system is defined as an isolated private network, such as SNPN, that does not interact with a public network. §1

Q2.1 Which part terminates the signalling with the tag, picks the base station and the readers, and allocates the identifier that ties one request together?

• The AMF
• The NEF
• The AIOTF

The AIOTF's function list carries all three, along with fetching the device profile and reporting the results. §4.5.3

Q2.2 Where does the architecture document put a tag's credentials?

• In the ADM
• In the AIOTF
• In the base station serving the tag

The ADM manages device profile data, device security data including credentials, and the data saying which application may do what. §4.5.9

Q2.3 How does application data reach an Ambient IoT tag?

• In a PDU session with its own quality settings
• Inside signalling messages, sitting on top of AIoT NAS
• Over an IP connection opened straight to the device

The protocol stack draws the application data on top of AIoT NAS, and the base station carries those messages through transparently. There is no user plane in this system. §4.6.2.2

Q2.4 How many jobs does the architecture document's job list give the AMF, and what kind are they?

• One, which is allocating the Correlation ID
• Four, including authorising the outside application
• Two, and both of them are relaying

The list names relaying signalling between base station and AIOTF, and carrying AIoT NAS between device and AIOTF. Elsewhere the same document gives the AMF a decision to make, which the list does not mention. §4.5.7

Q2.5 In the architecture where a phone acts as the reader, how are the base station and the AIOTF joined?

• Always through an AMF
• Directly, over the AIOTF's own reference point
• Through the NEF

The document defines two reader architectures, and says of this one that the base station and the AIOTF are connected indirectly via an AMF. §4.2.1

Q3.1 What has the network done by the time the application is told its inventory request was accepted?

• Read the first tag
• Nothing over the air — no tag has been touched yet
• Counted every tag in the area

The accept travels back in steps 5 and 6; the readers only broadcast the page in step 9, after it. §6.2.2.1

Q3.2 How does one tag win the right to send its report?

• The network hands it a slot in advance
• It sends whenever it has power and repeats until something answers
• It picks a slot at random, makes up a number, and hears that number echoed back

The page opens a set of slots, the tag chooses one and invents a random number, and hearing its own number back is what tells it the slot is its own. TS 38.391

Q3.3 How does a command procedure begin?

• With the inventory's own steps, plus an indication that a command follows
• It skips the page and speaks to the tag directly
• It authenticates the tag after the command, not before

Steps 7 to 11 of the command procedure are steps 7 to 11 of the inventory procedure, so the tag is found before it is commanded. §6.2.3.1

Q3.4 Why does the cheapest tag need no transmitter?

• The reader transmits on its behalf
• It reflects a tone another node is already sending, by changing how much bounces back
• It stores enough energy to transmit once a day

A carrier-wave node emits one plain tone and the tag switches how much of it its antenna returns, so there is nothing to generate. TS 38.194

Q3.5 What does the cheapest device's clock accuracy explain?

• Why the downlink carries error correction
• Why a tag reports only an identifier
• Why timing patterns sit in the middle of a message and not only at the front

With that much drift the tag loses the beat partway through a message, so it is given something to re-read the timing from on the way past. TS 38.291

Q4.1 Which of these must a conforming Ambient IoT deployment always do?

• Encrypt every command
• Check the integrity of every command
• Give every device a temporary identifier

Integrity protection of commands is mandatory. Encryption and temporary identifiers must be supported by the device and need not be used at all. TS 33.369

Q4.2 During an inventory, what proves to the device who is paging it?

• A signature the network puts in the paging message
• A certificate the credential store holds for the reader
• Nothing — it answers whoever paged it

Device authentication is always performed. The network is only ever authenticated afterwards, by the integrity check on a command. TS 33.369

Q4.3 What is fed into the protection algorithms as the message counter?

• All zeros
• A counter each device keeps for itself
• The random number the device sent

The counter and the bearer field are both all zeros. Freshness rests on the session key and on an assumption about how the system is used. TS 33.369

Q4.4 A device has received and verified a Permanent Disable command. What now?

• It answers inventories but refuses further commands
• It never responds to the inventory procedure again
• A later command from the same network can bring it back

The clause says it shall no longer respond to the inventory procedure, and the protocol carries no way back. §5.2.2.3

Q4.5 Updating a device's identifier hides it from a listener only when what is true?

• The reader stays inside the area it was authorised for
• The device holds a fresh session key
• The command carrying the new identifier is encrypted

Identifier privacy is only realised if the command request is encrypted — and encryption is optional. TS 33.369