Network Working Group L. Melegassi Internet-Draft Catellix Intended status: Informational 28 May 2026 Expires: 29 November 2026 MVPS Terrestrial Mobile and Vehicular Profile: Coherence Monitoring under Cellular Handover and Radio-Access Scheduling draft-melegassi-ippm-mvps-terrestrial-mobile-00 Abstract This document defines the terrestrial member of the Multi-Vantage Path Snapshot (MVPS) domain trio (space, sea, land). It targets vantages that move on land -- vehicles, trains, drones -- connected through cellular (5G/LTE) radio access, where the bounded joint clock-skew axiom A1 is stressed not by clock drift (GNSS is normally available) but by handover between base stations and slot-based scheduling jitter. The profile is DEFENSIVE: it concerns detection of coherence anomalies (intrusion, communications tampering, rogue base stations). It defines no navigation, targeting, or kinetic function. The document proves A1 holds on the deployment tick under explicit cellular-timing budgets, gives a closed-form maximum handover interruption, proves Doppler is dominated at terrestrial speeds, and inherits the core theorems via the MVPS Architecture-Invariance Theorem. All properties are validated by scripts/validate_terrestrial_mobile.py (7/7 PASS, exit 0) and recorded in evidence/terrestrial_mobile_receipt.json. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at https://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on 29 November 2026. Copyright Notice Copyright (c) 2026 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Revised BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Revised BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. The Space/Sea/Land Trio . . . . . . . . . . . . . . . . . 3 1.2. Defensive Scope and Non-Goals . . . . . . . . . . . . . . 3 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 4 3. The Cellular Joint-Skew Model . . . . . . . . . . . . . . . . 5 4. Re-establishing Axiom A1 (Lemma L-TER-1) . . . . . . . . . . 6 5. Maximum Handover Interruption (Lemma L-TER-2) . . . . . . . . 6 6. Doppler Is Dominated (Lemma L-TER-4) . . . . . . . . . . . . 7 7. Inheritance of the Core Theorems . . . . . . . . . . . . . . 8 8. Byzantine and Spoofed Vantages . . . . . . . . . . . . . . . 8 9. Rogue Base Stations (Conjecture C-TER-1) . . . . . . . . . . 9 10. Operational Logging . . . . . . . . . . . . . . . . . . . . . 9 11. Numerical Receipt . . . . . . . . . . . . . . . . . . . . . . 10 12. Security Considerations . . . . . . . . . . . . . . . . . . . 10 13. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 11 14. References . . . . . . . . . . . . . . . . . . . . . . . . . 11 14.1. Normative References . . . . . . . . . . . . . . . . . . 11 14.2. Informative References . . . . . . . . . . . . . . . . . 11 Appendix A. Worked Budgets (Normative) . . . . . . . . . . . . . 12 Author's Address . . . . . . . . . . . . . . . . . . . . . . . . 12 1. Introduction MVPS detects network-propagating anomalies by measuring the coherence of an observed state across multiple spatially independent vantages. Its theorems are surface-independent: they hold where the five MVPS axioms hold, by the Architecture-Invariance Theorem [I-D.melegassi-iab-mvps-architecture]. Terrestrial deployments where the vantages MOVE -- fleets of vehicles, trains, drones operating over cellular radio -- are common and important, and they stress the timing assumptions differently from sea or space. On land the satellite sky is normally available, so clock holdover is not the issue; the issue is that a moving vantage hands over between base stations and rides slot-based scheduling, both of which perturb timing. 1.1. The Space/Sea/Land Trio This profile is the land member of the MVPS domain trio: o space: the orbital profile [I-D.melegassi-ippm-mvps-orbital-coherence], stressing propagation delay and Doppler over LEO links; o sea: the maritime profile [I-D.melegassi-ippm-mvps-maritime-edge], stressing intermittent connectivity and GNSS-denied holdover; o land: this document, stressing cellular handover and radio-access scheduling jitter. Each re-establishes the same axiom (A1) under its domain's specific stress and inherits the rest. 1.2. Defensive Scope and Non-Goals This profile is strictly DEFENSIVE: detection of anomalies in network and timing telemetry (intrusion, comms tampering, rogue base stations). This document does NOT define and MUST NOT be claimed to define any navigation, guidance, targeting, or kinetic function, nor any output other than coherence-anomaly detection and audit logs. 2. Terminology eps_sync: GNSS/PTP residual at the base station. eps_ta: timing-advance residual of the UE alignment. tau_jit: radio-access scheduling jitter (slot-based). tau_ho: residual mis-timing during or after a handover. T_tick: the deployment coherence tick. Make-before-break: a handover that keeps the source link until the target is ready (NR DAPS), giving tau_ho near zero. The key words "MUST", "MUST NOT", "SHOULD", "MAY" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals. 3. The Cellular Joint-Skew Model A GNSS-disciplined base station holds time to eps_sync; the UE is aligned by Timing Advance to eps_ta. Slot-based scheduling bounds delivery jitter by tau_jit (5G numerology mu: slot = 1 ms / 2^mu; LTE about 1 ms). A handover adds a residual tau_ho, near zero for make-before-break and about the interruption time otherwise. The effective joint skew is skew_eff = 2 * ( eps_sync + eps_ta ) + tau_jit + tau_ho . Doppler is treated separately and shown dominated in Section 6. 4. Re-establishing Axiom A1 (Lemma L-TER-1) Axiom A1 holds on tick T_tick iff skew_eff = 2*(eps_sync+eps_ta) + tau_jit + tau_ho < T_tick. For representative budgets: 5G-uRLLC (DAPS): skew_eff = 0.128 ms < 100 ms tick LTE (break-before-make): skew_eff = 33.0 ms < 1000 ms tick high-speed rail (300 km/h, frequent HO): 54.0 ms < 100 ms tick All satisfy A1 (validator check L-TER-1). 5. Maximum Handover Interruption (Lemma L-TER-2) Solving skew_eff = T_tick for the handover residual gives tau_ho_max = T_tick - tau_jit - 2*(eps_sync + eps_ta). For the 5G-uRLLC budget, tau_ho_max is about 99.87 ms at a 100 ms tick. The practical reading is that the binding term on land is the handover interruption; make-before-break drives tau_ho toward zero, so even sub-second ticks have ample margin. 6. Doppler Is Dominated (Lemma L-TER-4) The time uncertainty contributed by Doppler over one tick is (v/c)*T_tick. At v = 300 km/h, v/c = 2.78e-7, so over a 100 ms tick the term is about 27.8 ns -- under 1% of the radio-access jitter. It is therefore absorbed and does not appear in the skew model (validator check L-TER-4: 11.0 ns, 83.4 ns, 27.8 ns across the three budgets). 7. Inheritance of the Core Theorems If A1 holds (Section 4) and the compromised-vantage fraction f < 1/2, then by the Architecture-Invariance Theorem [I-D.melegassi-iab-mvps-architecture] the core results inherit verbatim: T1 multi-vantage D^2 dominates per-vantage max-z; T2 Phi_D concentration under the null; T3' empirical-quantile false-alarm calibration; T9 Byzantine robustness of the geometric-median aggregator. No core theorem is re-derived (validator check A-TER-INHERIT). 8. Byzantine and Spoofed Vantages A vehicular fleet must assume some vantages are compromised or spoofed. For f < 1/2 the geometric-median aggregator has finite max-bias b(f) = C*f/(1-2f) (after [Minsker]; MVPS imported result I12), diverging only as f -> 1/2 (validator check B-TER-1: b(0.2)=0.333, b(0.4)=2.000). 9. Rogue Base Stations (Conjecture C-TER-1) It is plausible that a coordinated rogue / false base-station cluster (an IMSI-catcher fleet) injects a rank-low, correlated timing/identity signature across mobile vantages that the multi-vantage detector flags before any single UE alarms. This is stated as a CONJECTURE, not a theorem, with a falsification protocol (observable: cross-vantage correlated TA / cell-identity anomaly vs per-UE max-z; data: fleet RAN measurement reports plus a controlled false-base-station testbed; test: Wilson 95% lower bound on detection-time gain > 0; blocker: licensed spectrum for the testbed). The profile's guarantees do NOT depend on this conjecture. 10. Operational Logging Deployments SHOULD log events using the MVPS operational log format [I-D.melegassi-opsawg-mvps-logging], anchoring opportunistically; the handover and cell-change events are themselves useful audit records. 11. Numerical Receipt scripts/validate_terrestrial_mobile.py evaluates seven checks (L-TER-1..4, A-TER-INHERIT, B-TER-1, C-TER-1) over the budgets above and writes evidence/terrestrial_mobile_receipt.json with per-scenario skew and Doppler values, the closed-form handover tolerance, the inherited theorem list, the defensive non-claims, and a SHA-256 of its own canonical body. All seven checks PASS (exit 0). 12. Security Considerations The profile is a detection and audit capability; no kinetic or targeting surface is added. Its value is early, coherent detection of intrusion, comms tampering, and radio-layer attacks across a mobile fleet, with a tamper-evident audit trail (Section 10). Rogue-base-station detection is a conjecture (Section 9) and MUST NOT be relied upon as a guarantee. Quantum-era integrity of logs and anchors follows the Proof Envelope [I-D.melegassi-ippm-mvps-proof-envelope]. 13. IANA Considerations This document has no IANA actions. 14. References 14.1. Normative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. [RFC8174] Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC 2119 Key Words", BCP 14, RFC 8174, May 2017. [I-D.melegassi-iab-mvps-architecture] Melegassi, L., "MVPS Architecture Invariance", draft-melegassi-iab-mvps-architecture-00, 2026. 14.2. Informative References [I-D.melegassi-ippm-mvps-orbital-coherence] Melegassi, L., "MVPS Orbital Coherence", draft-melegassi-ippm-mvps-orbital-coherence-00, 2026. [I-D.melegassi-ippm-mvps-maritime-edge] Melegassi, L., "MVPS Maritime and Tactical-Edge Profile", draft-melegassi-ippm-mvps-maritime-edge-00, 2026. [I-D.melegassi-opsawg-mvps-logging] Melegassi, L., "The MVPS Operational Log Format", draft-melegassi-opsawg-mvps-logging-00, 2026. [I-D.melegassi-ippm-mvps-proof-envelope] Melegassi, L., "MVPS Proof Envelope", draft-melegassi- ippm-mvps-proof-envelope-00, 2026. [Minsker] Minsker, S., "Geometric median and robust estimation in Banach spaces", Bernoulli 21(4), 2015. Appendix A. Worked Budgets (Normative) The three budgets of Section 4 (5G-uRLLC, LTE, high-speed rail) and the infeasible control (150 ms handover at a 100 ms tick) are the normative vectors. A conformant implementation MUST reproduce, for each, the skew_eff value and the A1 verdict emitted by scripts/validate_terrestrial_mobile.py. Author's Address Leonardo Melegassi Catellix Brazil Email: melegassi@catellix.com