Generic access to the Iu interface

Cross-reference to related applications for universal access to Iu interface This application claims priority to the U.S. Provisional Application No. 60/807, 470 entitled "E-UMA Technology" filed on July 14, 2006, in 2006 Submitted on August 21, ^αPriority of the U.S. Provisional Application No. 60/823, 092 of Generic Access to the Iu Interface, No. 60/862, 564 entitled E-UMA-Generic Access to the Iu Interface, filed on October 23, 2006 Priority of U.S. Provisional Application No. and the title Generic Access to the Iu Interface filed on July 13, 2007^M Priority of U.S. Provisional Application No. 60/949, 826. The contents of each of these four provisional applications are incorporated herein by reference.

Technical Field The technical field of the present invention mainly relates to telecommunications. More specifically, the present invention relates to such a mechanism, which extends Unlicensed Mobile Access (UMA) or Universal Access Network (GAN) to be compatible with the GSM core by using the Universal Mobile Telecommunications System (UMTS) Iu interface. Network interoperability.

Background Art Authorized wireless systems provide mobile wireless communications for individuals using wireless transceivers. An authorized wireless system refers to a public cellular telephone system and/or a personal communication service (PCS) telephone system. Wireless transceivers include cellular phones, PCS phones, wireless-enabled personal digital assistants, wireless modems, and so on.

Authorize wireless systems to use government-licensed wireless signal frequencies. In order to use these frequencies, a high cost is required. Only expensive base stations (BS) can be used to provide support for communications on licensed frequencies. Base stations (for example, cell towers in cellular networks) are usually placed about one mile apart from each other. The wireless transmission mechanism and frequency used by a typical authorized wireless system limit the data transmission rate and range. As a result, the quality of service (voice quality and data transfer speed) in authorized wireless systems is far inferior to that provided by landline (wired) connections. In this way, users of authorized wireless systems have to pay relatively high fees for relatively low-quality services.

Landline (wired) connections are widely used and low in cost, while having high voice quality and

200780032892.1 The highest speed data service. The problem with the landline connection is that it restricts the user's movement. Usually, a physical connection to the land line is required.

In recent years, technologies that use unlicensed wireless communication systems to facilitate mobile access to landline-based networks have developed rapidly. For example, such an unlicensed wireless system can support wireless communication based on the IEEE 802.1 la, b or g standard (WiFi) or based on Bluetooth®. The range of movement corresponding to this system is usually about 100 meters or less. A typical unlicensed wireless communication system includes a base station, which includes a wireless access point (AP), which has a physical connection to a land-based network (for example, coaxial cable, twisted pair, or optical cable) . The AP has an RF transceiver to communicate with wireless handsets operating within a modest distance from the AP. The data transmission rate supported by the WiFi and Bluetooth® standards is much higher than the data supported by the above-mentioned authorized wireless system Transmission rate. Therefore, this approach provides a higher quality service at a lower cost, but this service only extends to a moderate distance from the base station.

At present, the existing technology has been developed to the extent that the use of authorized wireless systems and unauthorized wireless systems are seamlessly integrated, so that users can access unauthorized wireless systems via a single handheld when they are within the range of such systems. , And the user can also access the authorized wireless system via a single handset when it is outside the range of the unauthorized wireless system.

SUMMARY Some embodiments provide a method for registering user equipment (UE) in a communication system including an authorized wireless communication system and a general access network (GAN), wherein the general access network includes a general access network controller (GANC) ). This method sends a registration request message from the UE to the GANC, which indicates that only the A/Gb GAN mode capability is used for the UE. When the GANC has the A/Gb GAN mode capability, the GANC registers the UE with the GAN. When GANC only has Iu's GAN mode capability, GANC rejects the registration request message. When the GANC has both the A/Gb GAN mode capability and the Iu GAN mode capability, the GANC registers the UE based on a set of GANC mode selection rules used to register the UE with the GAN. Some embodiments provide that the first authorized wireless The packet transmission channel (PTC) method is enabled in the communication system and the communication system of the second universal access network (GAN), where the second universal access network includes the universal access network controller (GANC). GANC adopts the Global System for Mobile Communications ( The Iu interface of the UMTS terrestrial radio access network (UTRAN) is communicatively coupled to the first communication system. This method sends a GA-PSR PTC activation request from the GANC to the user equipment (UE)

200780032892.1 The first news. The message includes the terminal endpoint identifier (TEID) assigned to the UE by the GANC.

Some embodiments provide a communication system including a first authorized wireless communication system and a second general access network (GAN), wherein the second general access network includes a general access network controller (GANC). GANC is communicatively coupled to the first communication system through the Iu interface of the Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (UTRAN). The communication system also includes User Equipment (UE)» GANC includes a UDP protocol layer and a GTP-U protocol layer, where the GTP-U protocol layer is above the UDP protocol layer of GANC. The UE includes a UDP protocol layer and a GTP-U protocol layer, wherein the GTP-U protocol layer is located above the UDP protocol layer of the UE. The UDP protocol layer of GANC is communicatively coupled with the UDP protocol layer of UE. The GTP-U protocol layer of GANC and the GTP-U protocol layer of the UE are communicatively coupled.

BRIEF DESCRIPTION OF THE DRAWINGS The novel features of the invention are set forth in the appended claims. However, for the sake of explanation, the following figures illustrate several embodiments of the present invention.

Figure 1 shows an integrated communication system (ICS) of some embodiments.

Figure 2 shows several application modes of ICS in some embodiments.

Figure 3 shows the overall functional architecture of the A/Gb-mode GAN of some embodiments.

Figure 4 shows the overall functional architecture of the Iu mode GAN of some embodiments.

Figure 5 shows the basic elements of the Femtocell system architecture with asynchronous transfer mode based on the Iu interface for the core network in some embodiments.

Figure 6 shows the basic elements of the Femtocell system architecture with IP based on the Iu interface for the core network in some embodiments.

Figure 7 shows the CS domain control plane architecture of some embodiments.

Figure 8 shows the CS domain control plane architecture of some embodiments.

Figure 9 shows the CS domain control plane architecture of some embodiments.

Figure 10 shows the UECS domain control plane architecture of some embodiments.

Figure 11 shows the CS domain user plane protocol architecture of some embodiments.

Figure 12 shows the CS domain user plane protocol architecture of some embodiments.

Figure 13 shows the UECS domain user plane architecture of some embodiments.

Figure 14 shows the PS domain control plane architecture of some embodiments.

Figure 15 shows the PS domain control plane architecture of some embodiments.

200780032892.1 Figure 16 shows the UEPS domain control architecture of some embodiments.

Figure 17 shows the PS domain user plane protocol architecture of some embodiments.

Figure 18 shows the PS domain user plane protocol architecture of some embodiments.

Figure 19 shows the PS domain user plane protocol architecture of some embodiments.

Figure 20 shows the UE PS domain user plane architecture of some embodiments.

FIG. 21 shows a state diagram of generic access (generic access) in the UE of some embodiments.

Figure 22 shows the GAN security mechanism of some embodiments.

Figure 23 illustrates the discovery process of some embodiments.

Figure 24 shows the registration process of some embodiments.

Figure 25 shows the De-registration procedure initiated by the UE in some embodiments.

Figure 26 shows the De-registration process initiated by the GANC in some embodiments.

Figure 27 shows the registration update uplink in some embodiments.

Figure 28 shows the registration update downlink in some embodiments.

Figure 29 shows a keep alive process (keep alive) in some embodiments.

Figure 30 shows cell broadcast information in some embodiments.

Figure 31 shows the GA-CSR connection establishment process in some embodiments.

Figure 32 shows the GA-CSR connection release process in some embodiments.

Figure 33 shows safe mode control in some embodiments.

Figure 34 shows NAS signaling from the core network to the UE in some embodiments.

Figure 35 shows NAS signaling from the UE to the core network in some embodiments.

Figure 36 shows a CS call initiated by a mobile station in some embodiments.

Figure 37 shows a CS call initiated by a mobile station in some embodiments.

Figure 38 shows a CS call terminated by a mobile station in some embodiments.

Figure 39 shows UE-originated CS call clearing in some embodiments.

Figure 40 shows a CS Handover (CS Handover) from GERAN to GAN in some embodiments. Figure 41 shows a replacement process performed during GERAN to GAN in some embodiments.

Figure 42 shows a CS handover from UTRAN to GAN in some embodiments.

Figure 43 shows the replacement process performed during the period from UTRAN to GAN in these embodiments.

Figure 44 shows a CS handover from GAN to GERAN in some embodiments.

Figure 45 shows a CS handover from GAN to UTRAN in some embodiments.

200780032892.1 Figure 46 shows the GA-PSR connection establishment process of some embodiments.

Figure 47 shows the GA-PSR connection release process in some embodiments.

Figure 48 shows a message flow regarding PS security mode control in some embodiments.

Figure 49 shows PS NAS signaling from the core network to the user equipment in some embodiments.

Figure 50 shows NAS signaling from the user equipment to the core network in some embodiments.

FIG. 51 shows the initial activation process (initial activation) of the PTC in some embodiments.

Figure 52 shows PTC data transfer in some embodiments.

Figure 53 shows the PTC deactivation process starting from the UE in some embodiments.

Figure 54 shows the PTC re-enablement process from the UE in some embodiments.

Figure 55 shows the PTC deactivation process from the network in some embodiments.

Figure 56 shows the PTC re-enablement process from the network in some embodiments.

Figure 57 shows the implicit PTC deactivation process in some embodiments.

Figure 58 shows the PDP context activation process in some embodiments.

Figure 59 shows the PDP context activation process requested by the network in some embodiments.

Figure 60 shows the UTRAN to GAN SRNS relocation preparation phase in some embodiments.

Figure 61 shows the implementation phase of UTRAN to GAN SRNS relocation in some embodiments.

Figure 62 shows the GAN to UTRAN SRNS relocation preparation phase in some embodiments.

Figure 63 shows the implementation phase of GAN to UTRAN SRNS relocation in some embodiments.

Figure 64 shows the GAN architecture supporting the CS domain control plane in some embodiments.

Figure 65 shows the GAN protocol architecture supporting the CS domain user plane in some embodiments.

Figure 66 shows the GAN architecture supporting the PS domain control plane in some embodiments.

Figure 67 shows the GAN architecture regarding the PS domain user plane in some embodiments.

Figure 68 shows the GA-RC sublayer in the UE in some embodiments.

Figure 69 shows the successful (and unsuccessful) establishment process of the GA-RRC connection when initiated by the UE in some embodiments.

Figure 70 shows the successful establishment of a GA-RRC connection when initiated by the network in some embodiments.

200780032892.1 Figure 71 shows the release process of the logical GA-RRC connection between the UE and the GANC in some embodiments.

Figure 72 shows a message flow regarding security mode control in some embodiments.

Figure 73 shows NAS signaling from the core network to the UE in some embodiments.

Figure 74 shows NAS signaling from the UE to the core network in some embodiments.

Figure 75 shows a CS call process originating from a mobile station in some embodiments.

Figure 76 shows a replacement procedure performed during a CS call originating from a mobile station in some embodiments.

Figure 77 shows the CS call procedure terminated by the mobile station in some embodiments.

Figure 78 illustrates the call clearing procedure initiated by the UE in some embodiments.

Figure 79 shows the CS handover process from GERAN to GAN in some embodiments.

Figure 80 shows an alternative procedure to the CS handover procedure from GERAN to GAN in some embodiments.

Figure 81 shows the CS handover process from UTRAN to GAN in some embodiments.

Figure 82 shows an alternative procedure for CS handover from UTRAN to GAN using the RRC protocol in some embodiments.

Figure 83 shows the CS handover process from GAN to GERAN in some embodiments.

Figure 84 shows the CS handover process from GAN to UTRAN in some embodiments.

FIG. 85 shows a packet transmission channel initialization and enabling process of some embodiments.

Figure 86 shows the process of transmitting GPRS user data packets via the GAN packet transmission channel in some embodiments.

Fig. 87 shows a scheme in which the user equipment deactivates the packet transmission channel after the PTC timer expires in some embodiments.

Fig. 88 shows a scenario when the user equipment starts to re-enable the packet transmission channel in some embodiments.

Figure 89 shows a scenario when the network starts to deactivate the packet transmission channel in some embodiments.

Figure 90 shows a scenario when the network starts to re-enable the packet transmission channel in some embodiments. Figure 91 shows the PDP context activation process successfully initiated by the user equipment in some embodiments.

Figure 92 illustrates the PDP context activation process successfully requested by the network in some embodiments.

FIG. 93 shows the PDP context activation process successfully initiated by the UE in some embodiments.

FIG. 94 shows the connection from UTRAN to the UE in the PMM connected state in some embodiments.

200780032892.1 No.

GAN's SRNS relocation process.

Fig. 95 conceptually illustrates a computer system utilized when some embodiments of the present invention are implemented.

Figure 96 shows a process regarding implicit PTC deactivation in some embodiments.

DETAILED DESCRIPTION OF THE INVENTION In the following detailed description of the present invention, many details, examples and embodiments of the present invention are presented and described. However, it will be clear and obvious to those skilled in the art that the present invention is not limited to the proposed embodiments, and the present invention can be implemented even without some specific details and examples discussed.

In the following description, acronyms with only acronyms commonly used in the telecommunications industry related to wireless services are used, and acronyms with only acronyms dedicated to the present invention are also used. Section IX contains a list of acronyms used in this application with only the first letter.

Some embodiments provide a method for registering a user equipment (UE) in a communication system including an authorized wireless communication system and a general access network (GAN), wherein the general access network (GAN) has a general access network controller (GANC) ). This method sends a registration request message from the UE to the GANC, which indicates that only the A/Gb GAN mode capability is used for the UE. When the GANC has the A/Gb GAN mode capability, the GANC registers the UE with the GAN. When GANC only has Iu's GAN mode capability, GANC rejects the registration request message. When the GANC has both the A/Gb GAN mode capability and the Iu GAN mode capability, the GANC registers the UE based on a set of GANC mode selection rules used when the GANC registers the UE with the GAN.

Some embodiments provide a method for enabling a packet transport channel (PTC) in a communication system including a first authorized wireless communication system and a second universal access network (GAN), wherein the second universal access network (GAN) has a universal access Into the network controller (GANC). GANC is communicatively coupled to the first communication system through the Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (UTRAN) Iu interface. This method sends a GA-PSR PTC enabling request message from the GANC to the user equipment (UE). The message includes the terminal identifier (TEID) assigned to the UE by the GANC.

Some embodiments provide a communication system including a first authorized wireless communication system and a second general access network (GAN), where the second general access network (GAN) includes a general access network controller (GANC). GANC is communicatively coupled to the first communication system through the Universal Mobile Telecommunications System (UMTS) Terrestrial Radio Access Network (UTRAN) Iu interface. The communication system also includes user equipment (UE). GANC includes UDP protocol layer and GTP-U protocol layer, among which the GTP-U

200780032892.1 The first protocol layer is above the UDP protocol layer of GANC. The UE includes a UDP protocol layer and a GTP-U protocol layer above the UDP protocol layer of the UE. The UDP protocol layer of GANC is communicatively coupled with the UDP protocol layer of UE. The GTP-U protocol layer of GANC and the GTP-U protocol layer of the UE are communicatively coupled.

Several more detailed embodiments of the present invention are described in the following sections. Specifically, Section I describes a comprehensive integrated communication system incorporated in some embodiments. After Section I, the functional entities of some embodiments are discussed in Section II. Next, Section III describes the control plane and user plane architecture of some embodiments. Then, Section IV describes the general access network (GAN) security mechanism of some embodiments.

Next, Section V describes some embodiments of high-level processes such as discovery, registration, authentication, handover, etc. Then, Section VI describes configuration information for some embodiments. Next, the identifiers used in GAN are shown in Section VII. An alternative embodiment that utilizes the same protocol for voice and data services is disclosed in Section VIII. After that, Section IX describes the computer system used in the implementation of some embodiments of the present invention. Finally, Chapter X lists the abbreviations used.

I. System as a whole

A. Integrated Communication System (ICS) FIG. 1 shows an Integrated Communication System (ICS) architecture 100 according to some embodiments of the present invention. The ICS architecture 100 enables the user equipment (UE) 102 to access the voice and data network 165 either via the authorized air interface 106 or via the ICS interface 110, wherein the mobile core network 165 can be accessed through the authorized air interface 106 or the ICS interface 110 section.

The mobile core network 165 includes one or more home location registers (HLR) 150 and a database 145 for user authentication and authorization. Once authorized, the UE 102 can access the voice and data services of the mobile core network 165. In order to provide such services, the mobile core network 165 includes a mobile switching center (MSC) 160 for providing access to voice services. Data services are provided through a service GPRS (General Packet Radio Service) Support Node (SGSN) 155 combined with a gateway such as a Gateway GPRS Support Node (GGSN) 157.

The SGSN 155 is generally responsible for transferring data packets from the GGSN 157 and user equipment in the geographic service area of the SGSN 155, and transfer data packets to the GGSN 157 and user equipment in the geographic service area of the SGSN 155. In addition, the SGSN 155 may perform functions such as mobility management, storing user profiles, and storing location information. However, from the mobile core network 165 to various external data packet services

200780032892.1 The actual interface of the network (for example, the public Internet) is facilitated by GGSN 157 (facilitated)_oBecause data packets originating from user equipment are usually not structured in a format that can be transmitted in an external data network, the task of the GGSN 157 is to act as a gateway into this packet service network. In this way, the GGSN 157 provides addressing for data packets delivered to the UE 102 and an external packet service network (not shown) and data packets delivered from the UE 102 and an external packet service network (not shown). In addition, since the user equipment of the authorized wireless network spans multiple service areas and thus multiple SGSNs, the task of the GGSN 157 is to provide a static gateway to the external data network.

In the illustrated embodiment, what is described is a common component of the cell network 185 based on the UMTS Terrestrial Radio Access Network (UTRAN), including multiple base stations called Node B 180 (for the sake of brevity, only shown One of the base stations), these base stations provide wireless communication services for each user equipment 102 via a corresponding authorized radio link 106 (for example, a radio link using a radio frequency within an authorized bandwidth). However, those of ordinary skill in the art will recognize that in some embodiments, authorized wireless networks may include other authorized wireless networks, such as GSM/EDGE Radio Access Network (GERAN). Figure 3 shows an example of a system that uses A and Gb interfaces to access GERAN.

The authorized wireless channel 106 may include any authorized wireless service that has a defined UTRAN or GERAN interface protocol for voice/data networks (for example, Iu-cs and Iu-ps interfaces for UTRAN, or for GERAN A and Gb interface). UTRAN 185 generally includes at least one Node B 180 and a Radio Network Controller (RNC) 175 for managing a group of Node Bs 180. Generally, multiple Node Bs 180 are configured in a cellular configuration (one for each cell) that covers a larger service area.

Each RNC 175 communicates with the components of the core network 165 through a standard radio network controller interface such as the Iu-cs interface and the Iu-ps interface shown in FIG. 1. For example, RNC 175 communicates with MSC 160 via a UTRAN Iu-cs interface for circuit-switched voice services. And, the RNC 175 communicates with the SGSN 155 through the GGSN 157 via the UTRAN Iu-ps interface for packet data services. In addition, those of ordinary skill in the art will recognize that in some embodiments, other networks with other standard interfaces may be applied. For example, the RNC 175 in the GERAN network may be replaced by a base station controller (BSC) that transmits voice to the MSC 160 via the A interface, and the BSC transmits data to the SGSN via the Gb interface of the GERAN network.

In some embodiments of the ICS architecture, the user equipment 102 passes through the ICS access interface 110 and the universal access network controller (GANC) 120 (also known as the global network controller or UNC)

200780032892.1 The second communication network implemented first uses the services provided by the mobile core network (CN) 165.

In some embodiments, voice and data services through the ICS access interface 110 are implemented via an access point 114 that is communicatively coupled to the broadband IP network 116. In some embodiments, the access point 114 is a universal wireless access point, which connects the user equipment 102 to the ICS network through an unlicensed wireless network 118 created by the access point 114.

The signaling from the UE 102 is transferred to the GANC 120 through the ICS access interface 110. After the GANC 120 authenticates and authorizes the user, the GANC 120 uses the same or similar radio network controller interface as the aforementioned UTRAN radio network controller interface to communicate with the components of the mobile core network 165, and the GANC 120 includes The UTRAN Iu-cs interface for circuit-switched voice services and the UTRAN Iu-ps interface for packet data services (for example, GPRS). In this way, the GANC 120 uses the same or similar interface as the UTRAN radio network subsystem (for example, Node B 180 and RNC 175) to connect to the mobile core network.

In some embodiments, GANC 120 communicates with other system components of the ICS system through one or more of the following other interfaces, these interfaces are: (1) "Up" interface, (2) ^¢¢Wm^^ interface, (3) "D'/Gr" interface, (4) "Gn" interface, and (5) "S1" interface. The "Up" interface is the interface between UE102 and GANC 120. The "Wm" interface is a standardized interface between the GANC 120 and the authorization, authentication, and accounting (AAA) server 170, where the AAA server 170 is used to authenticate and authorize the UE 102 entering the ICS. The "D,/Gr" interface is a standardized interface between the AAA server 170 and the HLR 160. Optionally, some embodiments use the "Gn" interface as a modified interface to communicate directly with the data service gateway (eg, GGSN) of the core authorization network. Some embodiments optionally include an "S1" interface. In these embodiments, the "S1" interface provides an authorization and authentication interface from the GANC 120 to the AAA server 140. In some embodiments, the AAA server 140 supporting the SI interface and the AAA server 170 supporting the Wm interface may be the same server. The subject submitted on February 6, 2006 is^uService Access Control Interface for an Unlicensed Wireless Communication System^w US Patent No. 11/349,025 provides more detailed details of the SI interface.

In some embodiments, UE 102 must register with GANC 120 before accessing ICS services. The registration information of some embodiments includes the users international mobile subscriber identity (IMSI), medium access control (MAC) address, and service setting identifier (SSID) of the service access point, as well as from the GSM or UTRAN that the UE 102 has already reserved. The cell ID. In some embodiments, the GANC 120 may pass this information to the AAA server 140 to authenticate the user and determine that the user is available

200780032892.1 The first service (for example, voice and data). If the AAA server 140 agrees to access, the GANC 120 allows the UE 102 to access the voice and data services of the ICS system.

These voice and data services are seamlessly provided by the ICS to the UE 102 through the various interfaces described above. In some embodiments, when a data service is requested by the UE 102, the ICS uses an optional Gri interface for communicating directly with the GGSN 157. The Gd interface allows the GANC 120 to avoid the overhead and delay caused by communicating with the SGSN 155 through the Iu-ps interface of UTRAN or the Gb interface of the GSM core network before reaching the GGSN 157.

In some other embodiments, the access point 114 is a Femtocell Access Point (FAP). FAP implements a short-range authorized wireless communication session 118, which is independent of the authorized communication session 106. In the case of Femtocell, the user equipment 102 is connected to the ICS network through the short-range authorized wireless network 118 created by the FAP 114. Then, the signal from the FAP is sent through the broadband IP network 116.

B. ICS application

ICS provides an upgradeable and secure interface into the core service network of the mobile communication system. Figure 2 shows several applications of ICS in some embodiments. As shown in the figure, homes, offices, hot spots, hotels, and other public or private places 205 are connected to one or more network controllers 210 (such as the GANC 120 shown in FIG. 1) through the Internet 215_oThe network controller is then connected to the mobile core network 220 (such as the core network 165 shown in FIG. 1).

Figure 2 also shows several user equipment. These user equipment are just examples of user equipment that can be used for each application situation. Although in most examples, only one of each type of user equipment is shown, those of ordinary skill in the art will realize that other types of user equipment can also be used in these examples without departing from the teachings of the present invention. Also, although only one of each type of access point, user equipment, or network controller is shown, many such access points, user equipment, or network controllers can be used in FIG. 2. For example, an access point can be connected to several user equipments, a network controller can be connected to several access points, and several network controllers can be connected to a core network. The following sub-sections provide several examples of services that ICS can provide.

1. Wi-Fi

The Wi-Fi access point 230 enables the dual-mode cellular/Wi-Fi UE 260-265 to obtain high-performance, low-cost services at home, in the office, or within the range of a public Wi-Fi network. Dual-mode

200780032892.1 No.

UE, users can roam and switch between authorized wireless communication systems and Wi-Fi, and can obtain consistent services when switching between networks.

2. Femtocells

Femtoce 11 enables user equipment (such as the standard mobile station 270 and the computer 275 capable of wireless communication as shown) to obtain low-cost services through the FAP 235 using short-range authorized wireless communication sessions.

3. Terminal Adapter The terminal adapter 240 allows the integration of fixed terminal devices such as the telephone 245, the facsimile machine 250, and other devices in the ICS that cannot communicate wirelessly. As long as the user is involved, the service behaves like a standard analog fixed telephone line. The service is delivered in a similar way to other fixed-line VoIP services, where the UE is connected to the user's existing broadband (for example, Internet) service.

4. WiMAX Some authorized wireless communication system operators are investigating the use of WiMAX networks in parallel with their existing cellular networks. Dual-mode cellular/WiMAX LJE 290 enables users to seamlessly switch between cellular networks and this WiMAX network.

5. SoftMobiles, especially for international business travelers, has become popular to connect laptops 280 to broadband access points and Wi-Fi hotspots in hotels. In addition, many travelers are beginning to use their laptops and broadband connections for voice communications. They use SoftMobiles (SoftPhones) and VoIP services when making long-distance calls, instead of using mobile phones to make calls, and do not have to pay high roaming fees.

In order to use the SoftMobile service, the user inserts the SIM-embedded USB memory stick 285 into the USB port of their laptop 280. The SoftMobile client will automatically start running and connect to the mobile service provider via IP. From then on, as long as the user is in her home calling area, the user can make and receive mobile calls.

In the following sub-sections, several examples of integrated communication systems (ICS) are given. Those of ordinary skill in the art will realize that the teachings in these examples can be easily combined. For example, one ICS may be an IP-based system with an A/Gb interface facing the core network, and another ICS may have a similar IP-based system with an Iu interface facing the core network.

C. Integrated system with core network-oriented A/Gb interface and/or Iu interface FIG. 3 shows the A/Gb-mode General Access Network (GAN) functional architecture of some embodiments.

200780032892.1 No.

The GAN includes one or more general access network controllers (GANC) 310 and one or more general IP access networks 315. One or more UEs 305 (only one is shown for brevity) can be connected to the GANC 310 through the general IP access network 315. The GANC 310 has a core network 325 that behaves like a GSM/EDGE radio access network (GERAN) The same function as the base station controller. The GANC 310 includes a security gateway (SEGW) 320 that terminates the secure remote access tunnel from the UE 305, which provides interactive authentication, encryption, and data integrity for signaling, voice, and data services.

The universal IP access network 315 provides the connection between the UE 305 and the GANC 310. The IP transport connection extends from GANC 310 to UE 305. A single interface, the Up interface is defined between GANC 310 and UE305.

GAN and GERAN exist at the same time, and maintain the interconnection with the core network (CN) 325 via standardized interfaces defined for GERAN. These standardized interfaces include the A interface for circuit switching services to the Mobile Switching Center (MSC) 330, the Gb interface for packet switching services to the Serving GPRS Support Node (SGSN) 335, and the Serving Mobile Location Center (SMLC) 350. The Lb interface used to support location services, and the interface to the Cell Broadcast Center (CBC) 355 to support cell broadcast services. Transaction control (for example, connection management, CC and session management, SM) and user services are provided by the core network (for example, MSC/VLR and SGSN/GGSN).

As shown in the figure, the SEGW 320 is connected to the AAA server 340 through the Wm interface. The AAA server 340 is used to authenticate the UE 305 when the UE 305 establishes a secure tunnel. Some embodiments only require a subset of the Wm functions of the GAN application. In these embodiments, at least the GANC-SEGW should support the Wm authentication process.

Figure 4 shows the Iu-mode General Access Network (GAN) functional architecture of some embodiments. The GAN includes one or more general access network controllers (GANC) 410 and one or more general IP access networks 415. One or more UEs 405 (only one is shown for brevity) may be connected to the GANC 410 through a general IP access network 415. Compared with the GANC 310, the GANC 410 has the same capabilities as the UMTS Terrestrial Radio Access Network (UTRAN) Radio Network Controller (RNC) for the core network 425. In some embodiments, the GANC has the expansion capability to support the Iu interface and the A/Gb interface, so that it can support both Iu-mode and A/Gb-mode UEs. Similar to GANC 310, GANC 410 includes a security gateway (SEGW) 420, which terminates the proper remote access tunnel from UE405 and provides mutual authentication, encryption and data integrity for signaling, voice and data services .

200780032892.1 The first universal IP access network 415 provides the connection between the UE 405 and the GANC 410. The IP transport connection extends from GANC 410 to UE405. A single interface, the Up interface is defined between GANC 410 and UE 405. Add functions to this interface through the Up interface shown in Figure 3 to support the Iu mode GAN service.

GAN and UTRAN exist at the same time, and maintain the interconnection with the core network (CN) 425 via the standardized interface defined for UTRAN. These standardized interfaces include the Iu-cs interface for circuit-switched services to the mobile switching center (MSC) 430, the Iu-ps interface for packet-switched services to the serving GPRS support node (SGSN) 435, and the serving mobile location center. (SMLC) 450 Iu-pc interface for supporting location services, and Iu-bc interface to cell broadcast center (CBC) 455 for supporting cell broadcast services. Transaction control (such as connection management, CC and session management, SM) and user services are provided by the core network (such as MSC/VLR and SGSN/GGSN).

As shown in the figure, the SEGW 420 is connected to the AAA server 440 through the Wm interface. The AAA server 440 is used to authenticate the UE 405 when the UE 405 establishes a secure tunnel. Some embodiments only require a subset of the Wm functions of the Iu mode GAN application. In these embodiments, at least the GANC-SEGW should support the Wm authentication process.

D. ATM and IP-based architectures In some embodiments, the system uses an Iu (Iu-cs and Iu-ps) interface based on Asynchronous Transfer Mode (ATM) for CN. In some embodiments, the system architecture also supports CN-oriented IP-based (Iu-cs and Iu-ps) interfaces. The following two sub-sections describe these architectures for Femtocell.

Those of ordinary skill in the art will recognize that the same example can be easily applied to other types of ICS. For example, when the ICS access interface 110 (shown in Figure 1) uses an unlicensed frequency (instead of the authorized frequency of Femtocell), and the access point 114 is a general WiFi access point (instead of FAP), these examples can be used . Also, those of ordinary skill in the art will recognize that it is easy to use the A/Gb interface (above) instead of the Iu interface to implement the same example.

Figure 5 shows the basic part of the Femtocell system architecture with Iu (Iu-cs and Iu-ps) interfaces for the CN-based asynchronous transfer mode (ATM) in some embodiments. These parts include User Equipment (UE) 505, FAP510, and General Access Network Controller (GANC) 515, and Access Point Management System (AMS) 570.

For brevity, only one UE and one FAP are shown. However, each GANC can support

200780032892.1 supports multiple FAPs, and each FAP can support multiple UEs. As shown in the figure, GANC 515 includes IP network controller (INC) 525, GANC security gateway (SeGW) 530, GANC signaling gateway 535, GANC media gateway (MGW) 540, and ATM gateway (545). The Femtocell is further described below. Parts.

Figure 6 shows the basic parts of the Femtoce 11 system architecture with CN-oriented Iu (Iu-cs and Iu-ps) interfaces based on IP in some embodiments. For brevity, only one UE and one FAP are shown. However, each GANC can support multiple FAPs, and each FAP can support multiple UEs. This solution eliminates the need for the GANC signaling gateway 535 and the ATM gateway 545. Optionally, for the IP-based Iu interface, if the R4 MGW 605 in the CN can support the termination of voice data (ie, such as "IETF RFC 3267-Real-Time Transport Protocol (RTP) Payload Format and File Storage Format for The Adaptive Multi-Rate (AMR) and Adaptive Multi-Rate Wideband (AMR-WB) Audio Codecs, RTP frames defined in "RFC 3267"), the GANC media gateway 540 can also be deleted.

Figures 5 and 6 also show the components of the authorized wireless communication system. These components are 3G MSC 550, 3GSGSN 555, and (shown together) other core network systems 565. 3GMSC 550 provides a standard Iu-cs interface for GANC. Figure 6 shows another alternative to the MSC. As shown in the figure, MSC 650 is divided into MSS (MSC server) 675 for Iu-cs-based signaling and MGW680 for bearer path »R4 MSC 650 is a version 4 3G MSC with different architectures. That is, the R4 MSC is divided into MSS for control services and MGW for handling loads. A similar MSC can be used for the ATM architecture of Figure 5. The architectures shown in Figure 5 and Figure 6 are both suitable for using future versions of MSC.

3G SGSN 555 provides packet service (PS) via a standard Iu-ps interface. The SGSN is connected to INC 525 for signaling and to SeGW 530 for PS data. The AAA server 560 communicates with the SeGW 530 through the Wm interface and supports the EAP-AKA and EAP-SIM procedures used in IKEv2, and includes the MAP interface to the HLR/AUC. In some embodiments, this system also supports enhanced service access control functions through the SI interface.

II. Functional entities

A. User equipment

UE405 contains the functions needed to access Iu-mode GAN. In some embodiments, the UE also includes functions required to access the A/Gb-mode GAN. In some embodiments, the user equipment (UE) 305 is a dual-mode (eg, GSM and unlicensed radio frequency) handheld device that can switch between two modes.

200780032892.1 The first user equipment can support Bluetooth@ or IEEE 802.11 protocol. In some embodiments, the UE supports an IP interface to the access point. In these embodiments, the IP connection from the GANC extends all paths to the UE. In some other embodiments, the user equipment (UE) 305 is a standard 3G handheld device operating on the provider's licensed spectrum.

In some embodiments, the user equipment includes a cell phone, a smart phone, a personal digital assistant, or a computer equipped with a user identification mobile (SIM) card to communicate over an authorized or unlicensed wireless network. In addition, in some embodiments, a computer equipped with a SIM card communicates through a wired communication network.

Alternatively, in some embodiments, the user equipment includes a fixed wireless device that provides a set of terminal adapter functions. The terminal adapter function is used to integrate Integrated Services Digital Network (ISDN), Session Initiation Protocol (SIP) or ordinary old telephone services ( POTS) The terminal is connected to the ICS. The application of this type of equipment in the present invention enables wireless service providers to provide users with so-called landline replacement services even when the user's location is not fully covered by the authorized wireless network. In addition, although alternative embodiments of the terminal adapter provide equivalent wireless functions for connecting through an unauthorized wireless network or an authorized wireless network, some embodiments of the terminal adapter are used to connect ISDN, SIP, or POTS terminals to different communication networks ( For example, IP network) fixed wired equipment.

B. General Access Network Controller (GANC) The core network 425 interacts with the GANC 410 in the same way as the GANC 410 is an RNC. The universal IP access network 415 provides the connection between the GANC 410 and the UE 405. The GANC 410 entity interacts between the Iu interface and the general IP access network by using the functions of the control plane and the functions of the user plane. Use control plane functions for call control signaling, and use user plane functions for information transfer (for example, voice or data). In some embodiments, GANC also has the ability to interwork with GERAN A/Gb interface.

Some embodiments of the above-mentioned equipment, such as user equipment, FAP or GANC, include electronic devices such as microprocessors and memories (not shown), which will be used in computers that execute wireless protocols for managing voice and data services The program instructions are stored in a machine-readable or computer-readable medium, as described in the section entitled "Computer System" below. Examples of machine-readable media or computer-readable media include, but are not limited to, magnetic media such as memory modules, magnetic tapes, magnetic disks, optical media such as CD-ROMs and holographic devices, magneto-optical media such as optical disks, and specialized Hardware devices configured to store and execute program codes, such as application-specific integrated circuits (ASIC), programmable logic devices (PLD), ROM and RAM devices. Computer program or plan

200780032892.1 Examples of the first computer code include: such as machine code generated by a compiler, and files containing high-level code that are executed by a computer, electronic device, or microprocessor using a translator.

III. Control Plane and User Plane Architecture In some embodiments, the Iu interface includes functions that support asynchronous transfer mode (ATM) and IP-based signaling and user data transmission mechanisms. The following sections describe the control plane and user plane architectures of some embodiments for the circuit switched (CS) domain and the packet switched (PS) domain.

A. Circuit switched (CS) domain

1. CS domain-control plane FIG. 7 shows the GAN architecture supporting the CS domain control plane in some embodiments. The figure shows the different protocol layers for UE 705, general IP network 710, GANC 715 and MSC 720. Figure 7 also shows two interfaces Up 725 and Iu-cs 730. The main features of the GAN CS domain control plane architecture are as follows. The access layer 735 and the transport IP layer 740 at the bottom provide a general IP connection between the UE 705 and the GANC 715. The IPSec layer 745 provides encryption and data integrity between UE 705 and GANC 715. The remote IP layer 750 is the "internal" IP layer of the IPSec tunnel mode and is used by the UE 705 for address resolution by the GANC 715. The remote IP layer 750 is configured during the establishment of the IPSec connection.

In some embodiments, a single TCP connection is used to provide reliable transmission for the GA-RC and GA-CSR signaling connections between UE 705 and GANC 715. The TCP connection is managed by GA-RC and uses the remote IP layer for transmission. Non-Access Stratum (NAS) protocols such as MM 760 and the aforementioned protocols are transparently transmitted between UE 705 and MSC 720. The General Access Resource Control (GA-RC) protocol manages the Up session, including the GAN discovery and registration process. GA-RC protocol (in 3GPP TS 43.318 standard,^HGeneric access to the A/Gb interface; described in Clause 8.1.4 of Stage 2) is extended to support A/Gb mode or Iu mode GAN.

The General Access Circuit Switching Resource (GA-CSR) protocol supports UMTS-specific requirements and GERAN-specific requirements. GANC 715 terminates the GA-CSR protocol and connects it to the RANAP 755 protocol through the Iu-cs 730 interface. In some embodiments, the Iu-cs signaling transport layer 765 conforms to the UTRAN Iu interface signalling transport, 3GPP TS 25.412 standard, which is hereinafter referred to as "3GPPTS 25.412".

a) CS domain-an alternative architecture of the control plane The embodiment shown in Figure 7 is just an alternative for the realization of the CS domain control plane architecture

200780032892.1 In the first solution, in this architecture, UE705 and general IP network 710 are used to connect users who use UE to MSC720 through GANC 715. Those of ordinary skill in the art will recognize that the teachings of the present invention can be applied to other user equipment and access points (such as the equipment and access points described in FIG. 2).

For example, Figure 8 illustrates the CS domain control plane architecture of some embodiments. As shown in the figure, the GANC and MSC in Fig. 8 are similar to the GANC and MSC shown in Fig. 7. In Figure 8, the local node where the user is located is represented as a black box (referred to as the local node 805). Different embodiments use different devices to connect users located in the local node 805 to the MSC 720 through the GANC 715. For example, in the embodiment shown in Figure 7, the UE 705 and the general IP network 710 are used. Figure 9 shows another In the embodiment, the UE 905, the Femtocell Access Point (FAP) 910 and the general IP network 915 are used to connect the local node 805 to the MSC 720 through the GANC 715.

As shown in the figure, each protocol layer of the GANC 880-885 is communicatively coupled with the corresponding protocol layer in the general IP network 915 (represented by arrows 845-850, respectively). Similarly, GANC layers 855-875 are communicatively coupled with corresponding layers in FAP 910 (represented by arrows 820-840, respectively). In addition, the MM layer 890 and the CC/CS/SMS layer 895 of the MSC 720 are transparently connected to the corresponding layers in the UE 905 (shown by arrows 810-815 respectively). By using this technology, a FAP similar to the FAP 235 shown in FIG. 2 can be used to connect UEs (such as UEs 270-275) to the wireless core network 220 through the network controller 210. Those of ordinary skill in the art can use the techniques shown in Figures 8 and 9 to communicatively couple any user equipment, access points, terminal adapters, SoftMobiles, etc. (such as the equipment shown in Figure 2) to the use diagram. 7 shows the integrated communication system (ICS) of the multi-layer CS domain control architecture.

b) CS domain-control plane-UE architecture Figure 10 shows the UE architecture of the CS domain control plane. As shown in the figure, the architecture supports GERAN, UTRAN, A/Gb mode GAN and Iu mode GAN. The main features of the UE CS domain control plane architecture shown in Figure 10 are as follows. The GERAN RR-SAP interface 1015 to the GSM-MM layer 1005 is reserved for GERAN access and A/Gb-mode GAN access. Likewise, the UTRAN RR-SAP interface 1020 to the GSM-MM layer 1005 is reserved for UTRAN access and Iu-mode GAN access. An access mode switch 1010 is provided to switch between GERAN/UTRAN. A/GB-mode GAN and Iu-mode GAN modes. GA-CSR/GA-RC1025 is at the same level as UTRAN RRC 1030 and GERAN RRC 1035 in order to provide cooperation on roaming and handover. As shown in Figure 10, GA-CSR/GA-RC 1025, UTRAN RRC

200780032892.1 No.

1030 and GERAN RRC 1035 interact through a set of service access interfaces (SAP) 1040.

2. CS Domain-User Plane FIG. 11 shows the GAN protocol architecture supporting the CS domain user plane in some embodiments. The figure shows different protocol layers for UE 1105, general IP network 1110, GANC 1115 and MSC 1120. Figure 11 also shows two interfaces Up 1125 and Iu-csll30. The main features of the GAN CS domain user plane architecture are as follows. The access layer 1135 and the transport IP layer 1140 at the bottom provide a universal connection between the UE 1105 and the GANC 1115. The IPSec layer 1145 provides encryption and data integrity. The CS user plane data transmission through the Up interface 1125 is the same as the CS user plane used in the A/Gb mode GAN, that is, it uses real-time protocol, RTP, and conforms to IETF RFC 3267. GANC 1115 communicates with CS domain user plane between RTP/UDP and Iu user plane (Iu-UP) protocol through Iu-cs interface 1130. In some embodiments, the Iu-cs data transport layer 1165 complies with the 3GPPTS 25.414 standard.

Those of ordinary skill in the art will recognize that other user equipment, access points, terminal adapters, SoftMobiles, etc. can be connected to the core network through GANC. For example, FIG. 12 shows the CS domain user plane architecture of UE 1205, Femtocell Access Point (FAP) 1210, and general IP network 1215. By using the techniques described in conjunction with Figures 8 and 9, those of ordinary skill in the art can use UE 1205, FAP 1210, and general IP network 1215 to replace the UE 1105 and general IP network 1110 shown in Fig. 11 to integrate Femtocell UE 1205 is connected to the core network through GANC. Similarly, other types of UEs, access points, terminal adapters, SoftMobiles, etc. can be connected to the core network through GANC.

b) CS domain-user plane-UE architecture FIG. 13 shows the UE architecture regarding the CS domain user plane in some embodiments. As shown in the figure, the architecture includes functions to support A/Gb mode and Iu mode GAN 1305, as well as GERAN 1310 and UTRAN 1315. RFC 3267 AMR processing layer 1320 is used to connect GAN RTP/UDP/IP layer 1325 to AMR audio processing layer 1330 through CS user plane routing service layer 1335, where CS user plane routing service layer 1335 routes CS user plane data to the selected Access network (ie, GERAN, UTRAN, or GAN), and select a route for the CS user plane data from the selected access network. When connected to the CS data processing layer 1340, the RFC 3267 AMR processing layer 1320 is not used; that is, in the case of circuit switched data, it is opposite to the case of circuit switched voice.

B. Packet Switching (PS) domain

1. PS Domain-Control Plane Figure 14 shows the GAN architecture supporting the PS domain control plane. The figure shows the use of UE 1405,

200780032892.1 Different protocol layers of the general IP network 1410, GANC 1415 and SGSN 1420. Figure 14 also shows two interfaces Up 1425 and Iu-ps 1430. The main features of the GANPS domain control plane architecture shown in Figure 14 are as follows. The access layer 1435 and the transport IP layer 1440 at the bottom provide a universal connection between the UE 1405 and the GANC 1415. The IPSec layer 1445 provides encryption and data integrity. TCP 1450 provides reliable transmission for GA-PSR between UE 1405 and GANC 1415. GA-RC manages the IP connection, including the GAN registration process. The General Access Packet Switched Resource (GA-PSR) protocol supports UMTS-specific requirements.

GANC 1415 terminates the GA-PSR protocol and interconnects it to the RANAP protocol 1455 through the Iu-ps interface 1430. NAS protocols 1460 such as those used for GMM, SM, and SMS are transmitted transparently between the UE 1405 and the SGSN 1420. In some embodiments, the Iu-ps signaling transport layer 1465 complies with 3GPP TS 25.412.

Those of ordinary skill in the art will recognize that other user equipment, access points, terminal adapters, SoftMobiles, etc. can be connected to the core network through the GANC. For example, FIG. 15 shows the PS domain and control plane protocol architecture of UE 1505, Femtocell Access Point (FAP) 1510, and general IP network 1515. By using the technology described in conjunction with Figures 8 and 9, those of ordinary skill in the art will be able to use UE 1505, FAP 1510, and general IP network 1515 to replace UE 1405 and general IP network 1410 shown in Fig. 11 in order to integrate Femtocell UE 1505 is connected to the core network through GANC. Similarly, other types of UEs, access points, terminal adapters, SoftMobiles, etc. can be connected to the core network through GANC.

c) PS domain-control plane-UE architecture FIG. 16 shows the UE architecture regarding the PS domain control plane in some embodiments. As shown in the figure, the architecture includes functions to support A/Gb mode and Iu mode GAN, as well as GERAN and UTRAN. The main features of the UEPS domain control plane architecture shown in Figure 16 are as follows. The GERAN GRR-SAP interface 1615 and GERAN GMMRR-SAP interface 1617 to the GMM layer 1605 are reserved for GERAN access and A/Gb mode GAN access equally. Similarly, the UTRAN RABMAS-SAP interface 1620 and the UTRAN GMMAS-SAP interface 1622 to the GMM layer 1605 are reserved for the same use for UTRAN access and Iu-mode GAN access. Equipped with access mode switch 1610 for GERAN/UTRAN. Switch between each mode of Α/GB-mode GAN and Iu-mode GAN. GA-PSR/GA-RC 1625 is at the same level as UTRAN RRC 1630 and GERAN RRC 1635 in order to provide cooperation for roaming and handover. As shown in Figure 6, GA-PSR/GA-RC 1625, UTRAN RRC 1630 and GERAN RRC 1635 pass a set of servers

200780032892.1 The first service access interface (SAP) 1640 interacts.

2. PS Domain-User Plane FIG. 17 shows the GAN architecture regarding the PS domain user plane in some embodiments. The figure shows different protocol layers regarding UE 1705, general IP network 1710, GANG 1715 and SGSN 1720. Figure 17 also shows two interfaces Up 1725 and Iu-psl730. The main features of the GAN PS domain user plane architecture shown in Figure 17 are as follows. The access layer 1735 and the transport IP layer 1740 at the bottom provide a universal connection between the UE 1705 and the GANC 1715. The IPSec layer 1745 provides encryption and data integrity.

GA-PSR is extended to include support for the GTP-U G-PDU message format in order to transmit PS user data (for example, IP packets), but does not include support for the LLC PDU message format in the A/Gb mode GAN. As shown in Figure 17, the user data in the GTP-U G-PDU message can be transparently transmitted between the UE 1705 and the core network through the SGSN, thereby reaching the GGSN. In some embodiments, the Iu-ps data transmission lower layer 1765 complies with the 3GPP TS 25.414 standard.

Figure 18 shows an alternative GAN PS domain user plane configuration supported by the Up interface process of some embodiments. In this configuration, the GANC 1815 terminates the Up interface GTP-U tunnel with the UE 1805, and also terminates the separated Iu-ps GTP-U tunnel connected to the SGSN 1820. GANC 1815 relays PS user data between the Up interface GTP-U tunnel and the associated Iu-ps interface GTP-U tunnel to allow PS user data to flow between the UE and the SGSN.

This configuration minimizes the number of active GTP-U paths presented to the core network, that is, the SGSN can be limited in terms of the number of RNCs with which the SGSN can exchange PS user data at the same time (for example, currently, in a given PLMN The number of RNCs cannot exceed 4096. Without software upgrades, it may not be able to support simultaneous communication with hundreds or thousands of UEs, and when the GTP-U tunnel is from UE to SGSN, it may not be able to support simultaneous communication with hundreds of UEs. It is necessary for hundreds or thousands of UEs to communicate simultaneously. Terminating the Iu-ps GTP-U tunnel on the GANC avoids this potential SGSN restriction. In some embodiments, the Iu-ps data transmission lower layer 1865 complies with 3GPP TS 25.414 standard.

Those of ordinary skill in the art will recognize that other user equipment, access points, terminal adapters, SoftMobiles, etc. can be connected to the core network through GANC. For example, FIG. 19 shows the PS domain user plane protocol architecture of UE 1905, Femtocell Access Point (FAP) 1910, and general IP network 1915. By using the technology described in conjunction with Figures 8 and 9, those of ordinary skill in the art will be able to use UE 1905, FAP 1910, and general IP network 1915 to replace the UE 1805 and general IP network 1810 shown in Fig. 11 in order to integrate Femtocell UE 1905 is connected to the core network through GANC. Similarly,

200780032892.1 Other types of UEs, access points, terminal adapters, SoftMobiles, etc. can be connected to the core network through GANC.

a) PS domain-user plane-UE architecture FIG. 20 shows the UE architecture regarding the PS domain user plane in some embodiments. As shown in the figure, the architecture includes support for A/Gb mode and Iu mode GAN 2005, as well as GERAN 2010 and UTRAN 2015. Provide access mode switching 2020 to switch between GERAN/UTRAN. A/GB mode GAN and Iu-mode GAN.

C. GA-RC (General Access Resource Control)

The GA-RC protocol provides a resource management layer, which has the following functions. Use GANC for discovery and registration, use GANC for registration update, use GANC for application-level keep-alive, and support the identification of APs that are being used for GAN access.

1. State of the GA-RC sublayer FIG. 21 shows a state diagram related to general access in the UE in some embodiments. As shown in the figure, the GA-RC sublayer in the UE can be in one of the following two states: GA-RC-registered 2105 or GA-RC-registered 2110. When the service RR is switched (arrow 2112 represents the inverted Iu-mode GAN, the following results may occur: (1) Switch to GA-CSR-IDLE 2115 and GA-PSR-IDLE 2120 (that is, if the UE is idle during the switch ), (2) switch to GA-CSR-CONNECTED 2125 and GA-PSR-IDLE 2130 (ie, due to CS switching or relocation), (3) switch to GA-CSR-IDLE 2115 and GA-PSR-CONNECTED 2130 (Ie, due to PS handover or relocation), (4) Switch to GA-CSR-CONNECTED 2125 and GA-PSR-CONNECTED 2130 (ie, due to dual transmission mode switching or CS+PS relocation). When the UE is in GA- In any combination of CSR and GA-PSR states, the service RR is switched from GAN to GERAN/UTRAN RRC (indicated by arrow 2135).

In the GA-RC-DEREGISTERED state 2105, the UE may be in the GAN coverage area; but the UE has not successfully registered with the GANC. When in the GA-RC-DEREGISTERED state 2105, the UE can start the GAN registration process. In the absence of a TCP or IPSec connection or when performing the GAN de-registration process, the UE returns to the GA-RC-DEREGISTERED state 2105.

In the GA-RC-REGISTERED state 2110, the UE is registered with the serving GANC. The UE has an IPSec tunnel and TCP connection established to the serving GANC, and the UE can exchange GA-RC, GA-CSR, and GA-PSR signaling messages with the GANC through this IPSec tunnel and TCP connection.

When the UE stays in the GA-RC-REGISTERED state 2110, it executes with GANC

200780032892.1 Keep alive at the application level. In the GA-RC-REGISTERED state 2110, the UE can be in UTRAN/GERAN mode or GAN mode. The UE can either (1) camp on GERAN or UTRAN and be idle, or (2) be active in GERAN or UTRAN (for example, a GSMRR connection or UTRAN RRC connection may be established), or ( 3) Has "roamed" into GAN mode, or (4) recently "roamed out" of GAN mode (for example, due to switching from GAN).

D. GA-CSR (Common Access Circuit Switching Resources)

The GA-CSR protocol provides a circuit-switched service resource management layer, which supports the following functions: (1) Establish a transmission channel for CS traffic between UE and GANC, (2) CS handover between UTRAN/GERAN and GAN Support, (3) direct NAS messaging between the UE and the core network, and (4) other functions such as CS paging and security configuration.

1. Status of the GA-CSR sublayer

The GA-CSR sublayer in the UE can be in two states, namely, GA-CSR-IDLE or GA-CSR-CONNECTED as shown in FIG. 21. When the UE switches the serving RR entity to GAN, the UE enters the GA-CSR-IDLE state 2115. This switch will only occur when the GA-RC is in the GA-RC-REGISTERED state 2110.

When the GA-CSR connection is established and returns to the GA-CSR-IDLE state 2115 and when the GA-CSR connection is released, the UE transitions from the GA-CSR-IDLE state 2115 to the GA-CSR-CONNECTED state 2125. When the GA-CSR connection is released, an indication that there is no dedicated CS resource is passed to the upper layer. When switching to the GAN, if it is in the GA-RC-REGISTERED state 2110 in the GERAN/UTRAN mode, the UE can also enter the GA-CSR-CONNECTED state 2125. Similarly, when the handover from GAN is successful, the UE enters the GA-RC-REGISTERED state 2110 in the GERAN/UTRAN mode from the GA-CSR-CONNECTED state 2125.

E. GA-PSR (General Access Packet Switching Resource)

The GA-PSR protocol provides a packet switching service resource management layer. This layer provides the following functions: (1) Establish a transmission channel for PS traffic between the UE and the network, (2) Support PS between UTRAN/GERAN and GAN Relocation/handover, (3) Direct the transmission of NAS messages between the UE and the PS core network, (4) Transmit GPRS user plane data, and (5) other functions such as PS paging and security configuration.

1. Status of the GA-PSR sublayer

200780032892.1 As shown in Figure 21, the GA-PSR sublayer in the UE can be in two states, GA-PSR-IDLE or GA-PSR-CONNECTED» When the UE switches the serving RR entity to GAN, the UE enters GA-PSR -IDLE state 2120. This switching may only occur when the GA-RC is in the GA-RC-REGISTERED state 2110. When the GA-PSR connection is established, the UE changes from the GA-PSR-IDLE state 2120 to the GA-PSR-CONNECTED state 2130. When the GA-PSR connection is released, the UE returns to the GA-PSR-IDLE state 2120. When the GA-PSR connection is released, an indication that no dedicated resources exist is passed to the upper layer.

When handover to GAN, while still in GA-RC-REGISTERED state 2110 in GERAN/UTRAN mode, the UE can also enter GA-PSR-CONNECTED state 2130. Similarly, when switching from the GAN successfully, the UE enters the GA-RC-REGISTERED state 2110 in the GERAN/UTRAN mode from the GA-PSR-CONNECTED state 2130. The GA-PSR packet transmission channel (GA-PSR PTC) provides the connection between the UE and the GANC in order to transmit GPRS user data through the Up interface. It is described in the PS NAS signaling process in the following VP sub-chapter.

IV. GAN Security Mechanism As shown in Figure 22, GAN supports security mechanisms at different levels and interfaces. The security mechanism 2205 on the Up interface protects the control plane and user plane service flow between UE 2210 and GANC 2215 from unauthorized use, data manipulation, and data eavesdropping. That is, authentication, encryption and data integrity mechanisms are obtained stand by.

The network access security mechanism 2220 is included in the 3G Security; Security Architecture (3G security mechanism; security architecture)", the architecture defined in the 3GPPTS 33.102 standard. The interactive authentication between the user and the core network (CN) 2225 occurs in the MSC/VLR ( Or SGSN) and UE, and this interactive authentication is transparent to GANC. However, there is a password binding between UE-CN authentication and UE-GANC authentication to prevent man-in-the- middle) attack.

An additional application-level security mechanism 2230 can be used in the PS domain to ensure the security of the end-to-end communication between the UE 2210 and the application server 2235. For example, in some embodiments, the UE 2210 may run the HTTP protocol on the SSL session to ensure the security of web access.

All control plane and user plane traffic sent through the Up interface between UE 2210 and GANC 2215 are protected by the IPSec tunnel between UE 2210 and GANC-SEGW. This tunnel is used with 3G security; Wireless Local Area Network (WLAN) ) Interworking security 3G security mechanism; wireless local area network (WLAN) interworking security mechanism)", 3GPP TS 33.234

200780032892.1 The same mechanism as the one defined in Section 200780032892.1 provides interactive authentication (through the use of USIM credential), encryption, and data integrity.

As shown above (related to Figures 9, 12, 15 and 19), some embodiments utilize Femtocell Access Point (FAP) to communicatively couple user equipment UE to GANC via a general IP network» As shown in Figure 9, CS The FAP architecture of the control plane has an IPSec layer 920. Similarly, the FAP architecture of the CS user plane, the PS control plane, and the PS user plane architecture also include the IPSec (or IPSec ESP) layer (1220, 1520, and 1920, respectively). As shown in Figures 9, 12, 15 and 19, these IPSec layers are on top of the transport IP layer and remote IP layer of GANC, and can be communicatively coupled to their corresponding GANC IPSec layer, thereby providing between GANC and FAP Secure link between.

V. Advanced process

A. Mode selection in a multi-mode terminal A UE capable of universal access supports all IP access technologies in addition to supporting UTRAN and possibly GERAN radio interfaces. The UE may be in GERAN/UTRAN mode or in GAN mode during operation. The UE can be configured to work in one of two modes (ie, GERAN/UTRAN or GAN) at any given moment. There may also be a preferred mode of operation, which can be configured by the user or service provider through various mechanisms such as device management.

When powering up, the UE always starts in GERAN/UTRAN mode and executes the normal power-up procedure. In some embodiments, the UE implements the 3GPP TS 23.122 standard-Non-Access-Stratum functions related to Mobile Station (MS) in idle mode. The defined power-up procedure. After this, the UE can switch to the GAN mode based on the user preference or the mode selection preference determined by the operator configuration.

The various priority options that may exist for the UE are: only GERAN/UTRAN, preferably GERAN/UTRAN, preferably GAN and only GAN. In the GERAN/UTRAN mode only, the UE RR entity remains in the GERAN/UTRAN mode and will not switch to the GAN mode. In the preferred GERAN/UTRAN mode, as long as there is an available PLMN and the passage of GERAN/UTRAN is not restricted, the UE RR entity is in the GERAN/UTRAN mode. If no permitted PLMN can be used through GERAN/UTRAN, and the UE has successfully registered with the GAN through the general IP access network, the UE switches to the GAN mode. When the PLMN becomes available through GERAN/UTRAN and the PLMN is not prohibited, or when the UE has

200780032892.1 The UE returns to GERAN/UTRAN mode when it deregisters from the GAN through the general IP access network or loses the connection with the GAN.

In the preferred GAN mode, when the UE has successfully registered with the GAN through the general IP access network, the UE switches to the GAN mode and remains in this mode as long as the GAN is available. When the UE deregisters through the general IP access network, or loses the connection with the GAN through the general IP access network, the UE switches to the GERAN/UTRAN mode.

In GAN-only mode, the UE switches to GAN mode (after performing the initial power-on procedure of GERAN/UTRAN mode to obtain cellular network information, but excluding the MM and GMM process with the GERAN/UTRAN core network), it does not It will switch to GERAN/UTRAN mode. During the initial power-up procedure in GERAN/UTRAN mode, the UE shall ignore all paging messages received through the GERAN/UTRAN network.

B. PLMN selection In some embodiments, there is no change from the PLMN selection process in the UE's NAS layer (above the MM layer), except for the case where "VPLMN background scanning" is disabled in GAN mode. GANC can only connect to one PLMN. The PLMN selection in the NAS layer does not cause a mode change between GERAN/UTRAN mode and GAN mode. For a specific example of PLMN selection, provide the NAS layer with a PLMN that can only be used through GAN or a PLMN that can only be used through GERAN/UTRAN (ie, a combination of PLMN that can not be used through GERAN/UTRAN and GAN).

Among GAN-enabled UEs, some embodiments require a GANC selection process as part of the process of establishing a connection between the UE and the GANC. During GAN registration, when GAN-enabled UEs can choose between two or more GANC-PLMN pairs indicated by the default GANC (that is, indicated in the GA-RC REGISTER REDIRECT message), GANC can occur Select processing. The GANC selection process occurs before the UE is still in GERAN/UTRAN mode and before the UE roams into GAN mode. If the currently selected PLMN can be used by GAN, the PLMN should be selected. If not, the selection of GANC shall be realized according to the specific situation.

If the UE does not have any stored information about the serving GANC of the cell or AP to which the UE is currently connected, the UE attempts to register with the default GANC (usually located in HPLMN) stored in the UE. In the GA-RC REGISTER REQUEST message, the UE includes an identifier that recognizes GANC as the default GANG.

200780032892.1 First, when the UE attempts to register on the default GANC, the following will happen, where the default GANC includes an indication that it is in the automatic PLMN selection mode. If the default GANC decides to provide services for the UE, the default GANC responds with a GA-RC REGISTER ACCEPT message. When the default GANC decides to direct the UE to another GANC in the HPLMN, it responds with a GA-RC REGISTER REDIRECT message by default, which does not include the list of PLMN identifications.

When the default GANC decides to redirect the UE to a PLMN that is not HPLMN, the default GANC responds with a GA-RC REGISTER REDIRECT message and puts a list of PLMNs in its current location that can provide GAN services to the UE in the message. This list contains one or more PLMN identities (in the form of IP address or FQDN) and the identities of the GANC and SEGW nodes associated with them. After the GANC selection process, the GA-RC entity in the UE attempts to register on the relevant GANC.

If at any given moment, the user wants to perform manual PLMN selection or "user reselection", regardless of whether the UE is in manual or automatic PLMN selection mode, the UE sends a GA-RC REGISTER REQUEST message to the default GANC, which includes a message indicating that it is in Indication of manual PLMN selection mode. By default, GANC is not allowed to accept registration. By default, GANC also responds with a GA-RC REGISTER REDIRECT message and includes a list of PLMNs in its current location that can provide GAN services to the UE.

When the UE includes the identity of the currently serving GSM network in the GA-RC REGISTER REQUEST message, the GANC uses the identity to identify the list of PLMNs by default, so as to send to the UE in the response message.

After successfully registering with the serving GANC, the UE does not store the PLMN list. The UE does not use the PLMN list provided to the UE during the registration process for background scanning. UE cannot use GA in VPLMN unless HPLMN supports GA and license GA.

C. Reselect between GERAN/UTRAN and GAN modes

1. Rove-in (from GERAN/UTRAN mode to GAN mode) Only available in GAN service, the UE is not in NC2 mode (if the UE is in GERAN mode and is in accordance with the 3GPP TS 45.008 standard Radio subsystem link control (radio subsystem link control) Control)" is the same as defined in the definition, then this process is available) and there is only GAN, preferably GAN UE preference, or if there is no allowed PLMN available through GERAN/UTRAN for the preferred GERAN/UTRAN mode, this process Only available.

200780032892.1 After successfully registering GAN, the access mode in the UE is switched to GAN mode. The GA-CSR entity in the UE provides the NAS layer with NAS-related system information received during the GAN registration process. NAS treats the cell identity allocated by GANC as the current serving cell. When in the GAN mode, the GERAN-RR and UTRAN RRC entities are separated from the RR-SAP in the UE. As a result, these entities do not: (1) notify the NAS of any GERAN/UTRAN cell reselection and/or changes in the system information of the currently reserved cell, (2) notify the NAS of the PLMN recently found through GERAN or UTRAN, and (3) Process any paging request messages received via GERAN or UTRAN.

2. Rove-out (from GAN mode to GERAN/UTRAN mode) This process is available when the UE is disconnected from the general IP access network and its mode is selected as Preferred GAN or Preferred GERAN/UTRAN. When the UE is disconnected from the general IP access network, depending on the previous environment, the UE may be able to deregister with the GANC first.

For the preferred GAN and preferred GERAN/UTRAN mode selection, the UE separates the GA-CSR entity from the RR-SAP and reconnects the GERAN-RR or UTRAN RRC entity to the RR-SAP, and restores the normal GERAN-RR or UTRAN RRC Features. For GAN mode only selection, GA-CSR remains connected to NAS, and UE stays in GAN mode (ie, in the case of "no service").

D. Process related to GAN registration

1. Discovery and registration for universal access are in the GERAN/UTRAN preferred mode, only when the UE's priority selection is when only GAN, preferred GAN, or unlicensed PLMN can be used through GERAN/UTRAN. Carry out the discovery and registration process.

Once the UE has established a connection to the general IP access network, the UE determines the appropriate GANC-SEGW to be connected by completing the discovery process of the provisioning GANC in the HPLMN of the UE.

During the discovery process, the UE attempts to register on the default GANC provided by the service provider GANC by completing the registration process. The default GANC can accept the registration; redirect the UE to another GANC; or reject the registration.

a) Security gateway identification

200780032892.1 No.

The USIM of the UE includes the FQDN (or IP address) of the service provider GANC and the relevant SEGW, or the UE obtains this information based on the information in the USIM. When the UE does not store any information about other GANCs and related SEGWs, the UE completes the discovery process of the specified GANC. As part of the registration process, the default GANC can indicate whether this GANC and SEGW address or the address of the GANC to which the UE is being redirected can be stored by the UE.

The UE may store service GANC information about the service GANC, which is a GANC with which the UE can complete a successful registration process. The default GANC controls whether to allow the UE to store the service GANC information. When there is no GERAN/UTRAN coverage area at the AP location, the stored service GANC information is associated with the AP-ID. When there is a GERAN core TRAN coverage area at the AP location, the stored service GANC information is associated with GSM CGI or LAI or UTRAN CI. The stored service GANC information is: (1) Service SEGWFQDN or IP address after successful registration, (2) Service GANC FQDN or IP address after successful registration, and (3) Optional, after successful registration and in the slave network Return the TCP port of the service GANC in the case. The different numbers of such entities stored in the UE in different embodiments are determined according to specific implementation manners. When the default GANC indicates that the UE is allowed to store these addresses, only the GANC associations that are finally successfully registered are stored. The UE can preferentially connect to the general IP access network points of the accessory devices that serve the GANC associations that have been stored in the memory.

After connecting to the general IP access network, when the UE has stored the service GANC about the AP-ID or GERAN/UTRAN cell, the UE attempts to register with the related service GANC in its memory. Even if the GANC has served the UE before, the GANC can still reject the UE for any reason. After the UE receives the registration rejection or if the registration fails for any other reason (for example, no response is received), the UE deletes the address serving the GANC from its stored list.

If the UE does not receive a response to the registration request sent to the serving GANC (the GANC is not the default GANC), the UE retryes to register with the default GANC. If the UE does not receive a response to the registration request sent to the default GANC, it tries to perform a discovery process on the service provision GANC to obtain a new default GANC.

After the UE fails to register on the GANC, if the UE attempts to register or discover a GANC, the UE provides an indication during the registration or discovery process. This indication indicates that the UE has tried to register on another GANC and the reason for the failure. And the address of GANC and SEGW that failed to register. When the UE is connected to the general IP access network, the UE does not exist in the general IP access network.

200780032892.1 When the service GANC is stored in the first memory, the UE tries to register with the default GANC.

b) After the GANC capability is successfully registered, the specific information of the GANC is transmitted to the UE.

c) UE capabilities During the registration process, the specific GAN capabilities of the UE are transmitted to GANCo. d) The required GAN services are part of the registration process. The UE can request the GAN services required by the UE from the GANC.

e) GAN mode selection During the discovery and registration process, the UE (which can support Iu-mode GAN) transmits the UE's GAN mode support information to the GANC, that is, the GAN classification mark (classmark). The GAN mode support options are: support A/Gb Mode, Iu mode is supported, or both modes are supported. When no GAN mode support information is received, GANC assumes that the UE only supports A/Gb mode operation.

The service providing GANC can use the received GAN mode support information to assign the UE to the appropriate default GANC (for example, in the case where separate A/Gb mode and Iu mode GANC are utilized in the network) or to assign the UE to the default GANC Appropriate TCP port (for example, if separate TCP ports are used for GAN services in A/Gb mode and Iu mode). The GANC that can use the Iu mode also indicates the GAN mode used for the current session in the GAN mode indicator IE; this allows the UE to determine the Iu mode capability of the home PLMN.

Table 1 lists the discovery process for various combinations of UE and home PLMN GAN mode capabilities.

Table 1: GAN mode selection process related to GAN discovery

<td></td><td>Attribution PLMN GAN</td><td colspan="2">F mode ability</td>

<td>UEGAN mode capabilities</td><td>Only supports A/Gb</td><td>Only supports Iu</td><td>Both support</td>

<td>Only supports A/Gb</td><td>GANC: Follow the normal A/Gb mode discovery process to operate UE: Use the A/Gb mode registration process to process</td><td>GANC: There is no GAN mode support information provided by the UE or the (only) A/Gb mode indicated by the UE, so it is rejected (unspecified) UE: Power on next time</td><td>GANC: There is no GAN mode support information provided by ΌΈ or the (only) A/Gb mode indicated by the UE, so it is sent according to the normal A/Gb mode</td>

200780032892.1 No.

<td></td><td></td><td>Try again when</td><td>Now proceed to the operation. Assign UE to GANCoUE that can support A/Gb: Process in A/Gb mode registration process</td>

<td>Only supports Iu</td><td>GANC: Operate according to the normal A/Gb mode discovery process. UE: There is no GAN mode selection provided by GANC, so abandon the GAN operation and try again at the next power-up</td><td>GANC: UE (only) indicates that Iu mode is supported, so it accepts and sends GAN mode indicator=IuUE: It is processed in the Iu mode registration process</td><td>GANC: The (only) Iu mode indicated by the UE is supported, so the GAN mode indicator=Iu is accepted and sent. Assign the UE to the GANCoUE that can support Iu: Process in the Iu mode registration process</td>

<td>Both support</td><td>GANC: Follow the normal A/Gb discovery process to operate, LJE: There is no GAN mode selection provided by GANC, so it is processed in the Iu mode registration process (Note 1)</td><td>GANC: Supports the two modes indicated by the UE, so it accepts and sends the GAN mode indicator-IuUE: Processes in the Iu mode registration process</td><td>GANC: Supports the two modes indicated by the UE, so it accepts and sends GAN mode indicator=Iu. Assign the UE to the GANC UE that can support Iu: Process in the Iu mode registration process</td>

Note: As shown in Figure 2 below, the result of the Iu mode registration process for the A/Gb capable UE on the A/Gb capable GANC is that the UE is set to the A/Gb mode.

200780032892.1 In some embodiments, the default GANC or the serving GANC uses the received GAN mode support information to redirect the UE to a different GANC or a different TCP port on the current GANC. The GANC that can support the Iu mode also indicates the GAN mode used for the current session in the GAN mode indicator IE.

Table 2 lists the registration processing for various combinations of UE and home PLMN GAN mode capabilities.

Table 2: GAN mode selection process related to GAN registration process

<td></td><td colspan="3">Default/service GANC GAN mode capability</td>

<td>UEGAN mode capabilities</td><td>Only supports A/Gb</td><td>Only supports Iu</td><td>Both support</td>

<td>Only supports A/Gb</td><td>GANC: Operate according to the normal A/Gb mode registration process UE: Process according to the A/Gb mode GAN process</td><td>GANC: There is no GAN mode support information provided by the UE or the (only) A/Gb mode indicated by the UE, so it is rejected (invalid GANC) UE: Attempt to register or rediscover with the default GANC (according to the A/Gb mode GAN process )</td><td>GANC: There is no GAN mode support information provided by the UE or the (only) A/Gb mode indicated by the UE, so the operation is performed according to the normal A/Gb mode registration process. If necessary, redirect the UE to a GANC that can support A/Gb. UE: Process according to the A/Gb mode GAN process</td>

<td>Only supports Iu</td><td>GANC: Operate according to the normal A/Gb mode registration process. UE: There is no GAN mode selection provided by GANC, so the registration is cancelled.</td><td>GANC: UE (only) indicates Iu mode support, so accept and send GAN mode indicator=IuUE: follow Iu mode</td><td>GANC: The (only) Iu mode indicated by the UE is supported, so the GAN mode indicator=Iu is accepted and sent.</td>

200780032892.1 No.

<td></td><td>Remember and treat it as registration rejection (invalid GANC)</td><td>GAN process to handle</td><td>UE: Process according to the Iu mode GAN process</td>

<td>Both support</td><td>GANC: Operate according to the normal A/Gb registration process, UE: There is no GAN mode selection provided by GANC, so follow the A/Gb mode GAN process to process</td><td>GANC: Support the two modes indicated by the UE, so accept and send the GAN mode indicator=IuUE: Process according to the Iu mode GAN process</td><td>GANC: Supports the two modes indicated by the UE, so it accepts and sends GAN mode indicator=Iu or A/Gb (see note 1 below). If necessary, redirect the UE to GANCUE that can support Iu or A/Gb: follow the Iu or A/Gb mode GAN process for processing</td>

Note 1: The selection of GANC between Iu mode and A/Gb mode can be based on other information received in the GAN registration message from UE, information stored in GANC, and based on operator (ie, service provider) policy For example, if the GSM RR/UTRAN RRC status IE indicates that the UE is in GERAN dedicated mode, the location of the UE is an area without UTRAN coverage, and the operator wants to minimize the handover between RATs, GANC can direct the UE to use A/ Gb mode.

f) Discovery process When a UE supporting GAN first tries to connect to a GAN, the UE needs to recognize the default GANC. Each UE that can support GAN can be configured with the FQDN (or IP address) of the service provider GANC and the related SEGW, or the UE can derive this FQDN based on the information in the USIM (see 3GPP TS 23.003 standard, Numbering, addressing and identification^w ) The UE first establishes a secure IPSec tunnel and TCP connection by using the privisioned or derived address to connect to the service provider GANC-SEGW and GANC in the HPLMN of the UE. The UE passes

200780032892.1 The discovery process is used to obtain the FQDN or IP address of the default GANC in HPLMN and the related SEGW.

If there is no GERAN/UTRAN coverage area available when the UE is connected to the GANC for GAN service, then the GANC cannot determine the location of the UE in order to assign the UE to the correct service GANC (for example, making handover and location-based services become may). In this case, GANC allows the operator to determine the service policy. For example, the operator (may use the user interface instructions on the UE) to provide the user with some restricted services. When the UE starts the discovery/registration process and no GERAN/UTRAN coverage area is available, the GANC may not have sufficient information to correctly route subsequent emergency calls.

Figure 23 illustrates the discovery process in some embodiments. This figure shows the message exchange process between UE 2305, DNS 2310, service provider GANC 2315, security gateway SEGW 2320 associated with service provider GANC 2315, and DNS server 2325 associated with service provider GANC 2315. In the following description, it is assumed that the mode of the UE 2305 is selected as only GAN, preferably GAN or preferably GERAN/UTRAN and it is assumed that the UE has been connected to the general IP access network. In different embodiments, the signal levels required to trigger the GAN discovery and registration process are different. The following steps are taken in the discovery process of some embodiments.

As shown in Figure 23, when the UE 2305 has the FQDN provided or derived by the service provider SEGW, the UE (via the universal IP access network interface) performs (in step 1) a DNS query to resolve the FQDN into IP address. When the UE has the IP address provided by the service provider SEGW, the DNS step is omitted. Next, the DNS server 2310 returns (in step 2) a response including the IP address of the service providing SEGW 2320.

As shown in the figure, the UE 2305 establishes (in step 3) a secure tunnel to the service provider SEGW 2320. When the UE 2305 has the FQDN provided or derived by the service provision GANC 2315, the UE 2305 (through the secure tunnel) performs (in step 4) a DNS query to the DNS server 2325 associated with the service provision GANC 2315 to Resolve FQDN to IP address. When the UE 2305 has the IP address provided by the service provider GANC, the DNS step will be omitted. The DNS server 2325 returns (in step 5) a response including the IP address of the GANC 2315 provided by the service.

The UE 2305 establishes a TCP connection to the well-defined port of the service provider GANC 2315. Then, the UE 2305 provides the GANC 2315 query to the service by using the GA-RC DISCOVERY REQUEST message (step 6) to provide the default GANC. The message includes: (1) Cell information: or

200780032892.1 The first is the currently reserved UTRAN/GERAN cell ID or the last LAI successfully registered by the UE, and an indicator showing which cell it is, (2) General IP access network connection point information: AP-ID, such as in As defined in the following sub-chapter VII about the identifiers in GAN, (3) UE identification: IMSI, and (4) GAN classification flag: including indications supported by A/Gb mode and supported by Iu mode.

Next, the service provider GANC 2315 returns (in step 7) the GA-RC DISCOVERY ACCEPT message by using the information provided by the UE (for example, cell ID) to provide the default GANC and the FQDN or IP address of the default SEGW associated with it. Doing so will guide the UE to the "local" default GANC in HPLMN, thereby optimizing network performance. It may include the GANC port that the UE must use for registration. As described in the sub-chapter above, the GAN mode chapter, a GAN mode indicator can be included.

When the service provider GANC 2315 cannot accept the GA-RC DISCOVERY REQUEST message, it returns (in step 8) the GA-RC DISCOVERY REJECT message, which indicates the reason for the rejection. The secure IPSec tunnel to the service provider SEGW2320 is released (in step 9). The same IPSec tunnel can also be used again for the GAN registration process. In this case, the IPSec tunnel is not released.

g) Registration process-Normally, after the discovery process, the UE establishes a secure tunnel with the security gateway of the default GANC. The default GANC is provided by the service provider GANC during the discovery process, and the UE attempts to register with the default GANC. The default GANC can become the connected service GANC by accepting registration, or the default GANC can redirect the UE that is performing registration to a different service GANC_O

GANC redirection can be based on information provided by the UE during the registration process, a policy selected by the operator, or network load balancing. The GAN registration process can play the following roles: (1) Ensure that the UE is registered with the appropriate GANC entity; that is, by using redirection processing, (2) Notify GANC that the UE is now connected through the general IP access network and is Available at the IP address. GANC maintains a registration context (3) for the purpose of, for example, a call terminated by the mobile station to provide the UE with operational parameters related to the GAN service. During the GAN registration process, the content of the "system information" message applicable to the GAN cell is delivered to the UE. This enables the UE to switch to GAN mode, and enables the UE to trigger NAS procedures with the core network after the registration process (such as location/routing area update, mobile-initiated calls, mobile-terminated calls, etc.), and (4 ) Enable the UE to request those NAS services it needs.

Figure 24 illustrates the registration process in some embodiments. The figure shows the UE 2405, DNS

200780032892.1 No.

2410. Different message exchange processes between the service provider GANC 2415, the security gateway SEGW 2420 associated with the service provider GANC 2415, and the DNS server 2425 associated with the service provider GANC 2415. The following steps are performed during the registration process.

As shown in FIG. 24, when the UE 2405 is provided with the FQDN of the default or serving SEGW, the UE (in step 1) performs a DNS query (via the universal IP access network interface) to resolve the FQDN into an IP address. When the UE has the IP address provided by the SEGW service, the DNS step is omitted. DNS server 2410 (in step 2) returns a response.

As shown in the figure, (in step 3) UE 2405 establishes a secure IPSec tunnel to SEGW 2420. If the IPSec tunnel in the previous discovery or registration process is used again, this step can be omitted. When the UE 2405 is provided with the default or serving GANC FQDN, the UE (in step 4) performs a DNS query (through a secure tunnel) to resolve the FQDN into an IP address. When the UE has the IP address of the GANC, the DNS step is omitted. Next, the DNS server 2425 (in step 5) returns a response.

The UE 2405 then establishes a TCP connection to the TCP port on the GANC. The TCP port is either a known port or a port previously received from the network during discovery or registration. UE 2405 (in step 6) attempts to register on the GANC by sending a GA-RC REGISTER REQUEST message. The message includes: (1) Cell information: either the currently reserved UTRAN/GERAN cell ID, or the final LAI successfully registered by the UE, and an indicator showing which cell it is, (2) General IP access network Connection point information: as defined in the following chapter VII, in the GAN identifier, AP-ID, (3) UE identity: IMSI, (4) UE capability information, (5) required GAN service, ( 6) GAN classification mark: Including the indication of A/Gb mode support and Iu mode support.

When GANC 2415 accepts the registration attempt, GANC 2415 (in step 7) responds with a GA-RC REGISTER ACCEPT message. In this case, as long as the UE is registered with this GANC, the TCP connection and secure IPSec tunnel will not be released and the TCP connection and secure IPSec tunnel will always be maintained.

The GA-RC REGISTER ACCEPT message includes: (1) GAN capability information, and (2) GAN specific system information. The message includes (a) GAN mode indicator: A/Gb mode GAN or Iu mode GAN, (b) GAN cell Cell description, (c) location area identification includes: mobile station country code, mobile station network code, and location area code corresponding to the GAN cell, (d) the cell that identifies the cell in the location area corresponding to the GAN cell Identification, and (e) applicable

200780032892.1 The system timer value (for example, for the application-level keep-alive message transmission interval, see the following keep-alive sub-chapters).

Alternatively, GANC 2415 can deny the request. In this case, (in step 8) GANC 2415 responds with a GA-RC REGISTER REJECT message, which indicates the reason for the rejection. Then release the TCP connection and the secure IPSec tunnel.

Or, if GANC 2415 decides to redirect the UE to (another) service GANC, then (in step 9) GANC 2415 responds with a GA-RC REGISTER REDIRECT message, which provides the FQDN or FQDN of the target service GANC and related SEGW. IP address, if the GANC needs to serve the specific mode used by the GANC (for example, if the GANC knows that the service GANC only supports the A/Gb mode GAN), the message also provides a GAN mode indicator. In this case, the TCP connection is released, and the same IPSec tunnel can be used again for the next registration according to whether the network indicates or not, and the secure IPSec tunnel is released as needed (in step 10). The GA-RC REGISTER REDIRECT message may contain: (1) a single service SEGW and GANC address, or (2) a PLMN identification and a list of related service SEGW and GANC addresses. The message may also contain an indication as to whether the GANC address can be stored in the UE for future use.

a) Registration process-abnormal situation When the service GANC rejects the registration request and does not provide the service of redirecting to another service GANC, the UE tries to register with the default GANC again, including the reason for the failed registration attempt and the request to it. The service GANC and SEGW whose registration request failed» The UE also deletes all stored information about this service GANC.

When the default GANC rejects the registration request and cannot provide the service redirected to the appropriate service GANC, the UE can try again the discovery process of the service providing GANC (including indicating the reason for the failed registration attempt and the default GANC provided in the last discovery process) ). The UE also deletes all stored information about this default GANC.

2. Deregistration Figure 25 shows the deregistration process initiated by the UE 2505 in some embodiments. The GA-RC deregistration process allows UE 2505 to explicitly notify GANC 2510 that it is leaving GAN mode (for example, when it is disconnected from the general IP access network by sending a GA-RC DEREGISTER message to GANC 2510 (in step 1) Time), allowing GANC 2510 to release the resources allocated to UE 2505. When the TCP connection to the UE is suddenly lost, GANC 2510 also supports "Implicit GAN Deregistration".

200780032892.1 Figure 26 shows the de-registration process initiated by GANC 2610 in some embodiments. As shown in the figure, the GANC 2610 can release the UE registration context autonomously, and (in step 1) send a GA-RC DEREGISTER message to the UE 2605. Alternatively, the GANC 2610 can implicitly deregister the UE 2605 by closing the TCP connection with the UE. When the power is off, the UE's GA-RC sublayer ensures that the UE can explicitly disconnect from the network before completing the GA-RC deregistration process if possible.

3. Registration Update Figure 27 shows the registration update process in some embodiments. The GA-RC registration update process allows the UE 2705 to update the information in the GANC 2710 about the change of the overlapped GERAN cell identity or the change of the connected general IP access network point. As shown in the figure, UE2705 sends a GA-RC REGISTER UPDATE UPLINK message carrying update information to GANC 2710 (step 1). For example, due to the operator's policy, this may cause the UE 2705 to be redirected to another service GANC, or it may cause the UE 2705 to be denied service.

When UE 2705 detects UTRAN/GERAN coverage area after reporting no coverage area during GAN registration, LJE sends GA-RC REGISTER UPDATE UPLINK message with updated information to GANC. Whenever the connected general IP access network point changes, the UE sends a GA-RC REGISTER UPDATE UPLINK message with the updated information of the connected general IP access network point to the GANC. When the UE needs to update the GANC with a new list of required GAN services, the UE sends a GA-RC REGISTER UPDATE UPLINK message including the required new list of GAN services to the GANC.

When GANC 2710 decides to redirect to the UE based on the updated information, GANC 2710 may optionally send GA-RC REGISTER REDIRECT messages (in step 2). GANC 2710 may also optionally send GA-RC DEREGISTER (in step 3) to the UE to deregister the UE 2705 when an update is received.

Figure 28 shows the registration update downlink procedure in some embodiments. The GAN registration update process also allows the GANC 2810 to update the GAN system information in the UE 2805 by sending a GA-RC REGISTER UPDATE DOWNLINK message carrying the update information to the UE 2805 if needed.

4. Keep-alive Figure 29 shows a keep-alive process in some embodiments. Keep-alive processing is a mechanism between peer GA-RC entities to instruct the UE to still register with the GANC. By using GA-RC KEEPALIVE

200780032892.1 Periodic transmission of the message (in step 1), UE2805 then determines that GANC 2810 can still be used by using the currently established low-level connection.

5. Cell broadcast information FIG. 30 shows the cell broadcast information mechanism of some embodiments. Cell broadcast information is a mechanism between peer GA-RC entities, which allows GANC to deliver UE information about cell broadcast services. The UE 3005 puts the information required by the GAN service in the GA-RC REGISTER REQUEST and GA-RC REGISTER UPDATE UPLINK messages delivered to the GANC, thereby indicating that the UE needs the cell broadcast service. GANC 3010 then uses the GA-RC CELL BROADCAST INFO message to deliver the required information to UE 1105 (in step 1).

E. Certification

The Up interface supports (in order to establish a secure tunnel) the ability to authenticate UEs with GANC by using GSM or UMTS credential. The authentication between UE and GANC is performed by using EAP-SIM or EAP-AKA in IKEv2.

F. Encryption and integrity protection

All control and user plane traffic on the Up interface are sent through a pair of IPSec ESP tunnel mode security links (one tunnel in each direction). The pair of IPSec ESP tunnel mode security links are established in IKEv2 security links. Established during the period. Encryption and security protection are carried out through a negotiated cryptographic algorithm based on the core network policy imposed by GANC-SEGW.

G. GA-CSR connection processing

The GA-CSR connection of the Iu-mode GAN is a logical connection between the UE and the GANC regarding the CS domain. The GA-CSR connection is established when the upper layer in the UE requests to establish a CS domain signaling connection and the UE is in the GA-CSR-IDLE state (that is, when no GA-CSR connection exists). When receiving a successful response from the network, the GA-CSR responds to the upper layer that the CS domain signaling connection is established and the UE has entered the equivalent mode of the RRC connection mode (ie, the GA-CSR-CONNECTED state).

1. GA-CSR connection establishment FIG. 31 shows the successful establishment process and the unsuccessful establishment process of the GA-CSR connection in some embodiments. As shown in the figure, UE3105 initiates the GA-CSR connection establishment process by sending a GA-CSR REQUEST message (in step 1) to GANC 3110. This message contains the establishment reason indicating the reason for establishing the GA-CSR connection.

When GANC determines that the connection request is acceptable, GANC 3110 passes (in step 2) the issue

200780032892.1 sends GA-CSR REQUEST ACCEPT to signal the acceptance of the UE3105 connection request, and the UE enters the GA-CSR-CONNECTED state. On the other hand, when GANC determines that the GA-CSR connection request must be rejected, GANC 3110 (in step 3) sends a GA-CSR REQUEST REJECT to UE 3105, indicating the reason for rejection, thereby completing the process.

2. GA-CSR Connection Release Figure 32 shows the release process of the logical GA-CSR connection between the UE and the GANC in some embodiments. As shown in the figure, MSC3215 sends a RANAP Iu release command to GANC 3210 (in step 1) to instruct GANC 3210 to release the CS resources allocated to the UE.

Next, GANC 3210 (in step 2) confirms the resource release to MSC 3215 by using the Iu Release Complete message. GANC 3210 then (in step 3) orders the UE 3205 to release resources by using the GA-CSR RELEASE message. Finally, the UE 3205 (in step 4) confirms the resource release to the GANC by using the GA-CSR RELEASE COMPLETE message, and the GA-CSR status in the UE becomes GA-CSR-IDLE.

H. CS Security Mode Control FIG. 33 shows a message flow regarding security mode control in some embodiments. As shown in the figure, MSC 3315 (in step 1) sends a RANAP security mode command message to GANC 3310. The message contains the integrity key (IK) and allowed algorithms, and optionally also contains the encryption key (CK) and allowed algorithms.

Next, GANC 3310 (in step 2) sends a GA-CSR SECURITY MODE COMMAND message to UE 3305. The message indicates integrity protection and encryption settings (ie, protection and settings that apply after relocation to UTRAN), and a random number. The UE stores information that may be used after relocation to UTRAN.

Next, the UE 3305 calculates the MAC based on the random number, the UE IMSI, and the integrity key calculated by the UE. MAC or "message authentication code" allows GANC to verify whether the UE has been able to calculate an integrity key that is exactly the same as the integrity key received by GANC from the MSC, thus preventing some kind of "man-in-the-middle" Security attacks. Then, UE 3305 (in step 3) sends GA-CSR SECURITY MODE COMPLETE message to GANC 3310 to signal its selected algorithm and calculated MAC.

GANC 3310 then verifies the MAC by using the random number, the UE IMSI and the integrity key provided by the MSC in step 1. When the GANC verifies that the MAC is correct (that is, the MAC calculated by the GANC is the same as the MAC calculated by the UE), it (in step 4) reports to the MSC 3315

200780032892.1 The safety mode complete message is sent. The MAC proves that the identity authenticated to the GANC is the same as the identity authenticated to the core network.

I. CS NAS signaling process After the GA-CSR connection establishment process, NAS signaling can be transmitted from the MSC to the UE and from the UE to the MSC.

1. NAS signaling from MSC to UE Figure 34 shows NAS signaling from MSC to UE in some embodiments. As shown in the figure, for the NAS signaling from the MSC to the UE, the MSC 3415 (in step 1) sends the NAS PDU to the GANC via the RANAP guidance transfer message. The GANC 3410 encapsulates the NAS PDU into the GA-CSR DL DIRECT TRANSFER message, and ( In step 2) the message is forwarded to UE3405 via the existing TCP connection »

2. NAS signaling from UE to MSC FIG. 35 shows NAS signaling from UE to MSC in some embodiments. As shown in the figure, the UE3505 UNAS layer receives the request to transmit the uplink NAS PDU. Assuming that the required signaling connection already exists, the UE 3505 encapsulates the NAS PDU into the GA-CSR UL DIRECT TRANSFER message, and (in step 1) sends the message to the GANC 3510. GANC3510 (in step 2) forwards the received message to the MSC 3515 via RANAP instructed transfer message.

J. CS call initiated by the mobile station

1. GANC terminates the Iu UP protocol Figure 36 shows the steps performed during a CS call initiated by a mobile station in some embodiments. This process assumes that the UE is in the GAN mode, that is, the UE has successfully registered with the GANC and the GA-CSR is the RR entity that is serving the CS service in the UE. This process also assumes that there is no GA-CSR signaling connection (that is, the GA-CSR-IDLE state) between the UE and the GANC. As shown in the figure, (in step 1) execute the GA-CSR connection establishment process. In some embodiments, this process is performed as described in the GA-CSR connection establishment subsection above. Then, UE 3605 sends a CM service request message to GANC 3610 in the GA-CSR UL DIRECT TRANSFER message.

Next, GANC 3610 establishes an SCCP connection to MSC 3615, and (in step 3) uses RANAP initial UE message to forward the NAS PDU (ie, CM service request message) to MSC 3615_OThe message includes a domain indicator whose value is set to the value "CS domain". In UE and MSC

200780032892.1 Subsequent NAS messages will be sent between GANC and MSC using RANAP to guide the transmission of messages.

The MSC 3615 may optionally authenticate the UE by using the standard UTRAN authentication process (in step 4). MSC 3615 can start the safe mode control process described in the CS safe mode control subsection as needed (in step 5). UE 3605 (in step 6) sends a setup message that provides details about the call to the MSC, the UE's bearer capabilities, and supported codecs. This message is contained in the GA-CSR UL DIRECT TRANSFER between UE and GANC. GANC forwards the setup message to the MSC.

Then (in step 7) the MSC 3615 uses the call progress message sent to the GANC to indicate that it has received the call setup and will not accept additional call setup information. (In step 7) GANC forwards this message to the UE through the GA-CSR DL DIRECT TRANSFER message.

(In step 8) MSC 3615 uses RANAP RAB allocation request message to request GANC 3610 to allocate call resources. MSC 3615 includes RAB-ID. CN transport layer address used for user data and CNIu transmission link, as well as an indication that Iu UP support mode is required, and other parameters.

Then (in step 9) GANC 3610 sends a GA-CSR ACTIVATE CHANNEL message to UE 3605, which includes bearer path setting information, such as: (1) channel mode, (2) multi-rate codec configuration, (3) The UDP port and IP address used for the uplink RTP stream, and (4) the voice sample size.

Then (in step 10) UE 3605 sends GA-CSR ACTIVATE CHANNEL ACK to GANC 3610 to indicate the UDP port used for the downlink RTP stream. Since the IuUP support mode is indicated by the MSC in step 8, (in step 11) GANC 3610 sends an Iu UP INITIALIZATION packet to the MSC.

In response, (in step 12) the MSC responds with an Iu UP INITIALISATION ACK packet. (In step 13) GANC 3610 signals the completion of the RAB establishment process to UE 3605 with a GA-CSR ACTIVATE CHANNEL COMPLETE message. Alternatively, steps 11 and 12 may occur before step 9.

By sending a RANAPRAB allocation response message (in step 14), the GANC 3610 signals to the MSC 3615 that the RAB has been established. The MSC3615 signals the UE3505 with an alarm message that the called party is ringing. (In step 15) the message is transmitted to GANC 3610, and GANC (in step 15) passes GA-CSR DL DIRECT TRANSFER

200780032892.1 forwards the message to UE 3605. When the UE has not connected the audio path to the user, it generates a ring back tone to the calling party. Otherwise, the ring back tone generated by the network will be returned to the caller.

Next, the MSC3615 signals through the connection message that the called party has responded. (In step 16) The message is delivered to GANC 3610, and GANC (in step 16) forwards the message to the UE in GA-CSR DL DIRECT TRANSFER. The UE connects the user to the audio path. If the UE is generating a ringback tone, it stops the operation and connects the user to the audio path.

Then (in step 17) UE 3605 sends a connection Ack message as a response, so that the UE and GANC are connected to make a voice call. This message is contained in the GA-CSR UL DIRECT TRANSFER between UE and GANC. GANC forwards the connection Ack message to the MSC. At this time, the two-way voice service stream is transmitted between the UE 3605 and the MSC 3615 through the GANC 3610 (in step 18).

2. The UE terminates the Iu UP protocol. Some embodiments use an alternative procedure to make a CS call initiated by the mobile station. Figure 37 shows the steps performed during the CS call initiated by the mobile station in these embodiments. This process assumes that the UE is in the GAN mode, that is, the UE has successfully registered with the GANC, and the GA-CSR is the RR entity that is serving the CS service in the UE. This process also assumes that there is no GA-CSR signaling connection (that is, the GA-CSR-IDLE state) between the UE and the GANC. The execution process of steps 1 to 8 is the same as that described for steps 1 to 8 shown in FIG. 36, so the description will not be repeated for the sake of brevity.

Since in step 8 the MSC indicates the Iu UP support mode (as described with reference to Figure 36), (in step 9) GANC indicates in the GA-CSR ACTIVATE CHANNEL message that the Iu UP support mode is required, and (in step 10) The UE 3705 sends an Iu UP INITIALIZATION packet to the MSC 3715. In response, in step 11, the MSC 3715 responds with an Iu UP INITIALISATION ACK packet. Then (in step 12) UE3705 sends GA- CSR ACTIVATE CHANNEL ACK to GANC 3710 »

GANC 3710 signals to MSC 3715 that the RAB has been established by sending a RANAP RAB allocation response message (in step 13). GANC 3710 also (in step 14) sends a GA-CSR ACTIVATE CHANNEL COMPLETE message to UE 3705. The execution process of steps 15 to 18 is the same as that described above for steps 15 to 18 shown in FIG. 36, so the description will not be repeated for the sake of brevity.

200780032892.1 No.

K. Mobile Station Terminated CS Call Figure 38 shows the steps performed during a mobile station terminated CS call in some embodiments. The description of this process assumes that the UE is in the GAN mode, that is, the UE has successfully registered with the GANC, and the GA-CSR is an RR entity that is serving the CS service in the UE. This process also assumes that there is no GA-CSR signaling connection between the UE and the GANC (that is, the UE is in the GACSR-IDLE state). When the call terminated by the mobile station arrives at the MSC3815, as shown in Figure 38, the MSC 3815 (in step 1) sends a RANAP paging message to the GANC 3810 identified by the last location update received by it, and when the TMSI can be obtained The following message includes the IMSI of the mobile station that the TMSL is paging is always included in the request.

Next, GANC 3810 uses the IMSI provided by MSC 3815 to identify the UE registration context. Then (in step 2) GANC 3810 pages UE 3805 with GA-CSR PAGING REQUEST message. If the TMSI is available in the request from the MSC, the message includes the TMSI, otherwise the message only includes the IMSL of the UE

UE 3805 responds with GA-CSR PAGING RESPONSE. The UE transitions to the GA-CSR CONNECTED state. GANC 3810 establishes an SCCP connection to MSC 3815. Then (in step 4) GANC 3810 uses the RANAP initial UE message to forward the paging response to the MSC 3815. Subsequent NAS messages between the UE and the core network will be sent between the GANC and the MSC using RANAP guided transfer messages.

MSC 3815 may use standard UTRAN authentication process to authenticate UE 3805 as needed (in step 5). The MSC can update the security configuration in the UE through the GANC as needed (in step 6), as described in the CS security mode control subsection above.

Then (in step 7) the MSC3815 initiates the call setup with the setup message sent to the UE through the GANC. GANC (in step 7) forwards the setup message to the UE 3805 in the GA-CSR DL DIRECT TRANSFER message.

Then, after the UE 3805 has checked its capabilities related to the bearer service requested in the settings and modified the bearer service as required, it responds to the confirmed call with GA-CSR UL DIRECT TRANSFER. When the setting includes the signal information element, the UE warns the user with the indicated signal, otherwise the UE warns the user after successfully configuring the user plane. (In step 8) GANC 3810 forwards the message of call configuration to MSC 3815.

Then, MSC3815 starts the allocation process with GANC 3810, which triggers (in step 9) the establishment process of the RTP stream (voice load channel) between GANC and UE.

200780032892.1 The first process is the same as steps 8-14 in the CS call scheme initiated by the mobile station described above.

The UE 3805 then (in step 10) signals that it is warning the user through the warning message contained in the GA-CSR UL DIRECT TRANSFER. GANC (in step 10) forwards the alert message to the MSC. The MSC sends a corresponding alarm message to the calling party.

Then (in step 11) the UE 3805 signals that the called party has answered through the connection message contained in the GA-CSR UL DIRECT TRANSFER. (In step 11) GANC 3810 forwards the connection message to MSC 3815. The MSC sends the corresponding connection message to the calling party and connects to the audio completely. The UE connects the user to the audio channel.

Then (in step 12) MSC3815 confirms to GANC 3810 through a connection confirmation message. (In step 12) GANC forwards the message to UE3805 in GA-CSR DL DIRECT TRANSFER »The two parties involved in the call are connected to the audio channel. At this time, (in step 13) the two-way voice traffic flow is transmitted between the UE and the MSC through the GANC.

L. CS Call Clearing Figure 39 shows call clearing initiated by the UE in some embodiments. As shown in the figure, (in step 1) UE 3905 sends a disconnect message to MSC3915 to release the call. This message is contained in the GA-CSR UL DIRECT TRANSFER message between UE 3905 and GANC 3910. GANC 3910 (in step 1) forwards the disconnect message to the MSC (ie, by using RANAP to guide the transfer of the message).

Then (in step 2) MSC3915 responds to the GANC with a release message. (In step 2) GANC forwards the release message to UE3905 with GA-CSR DL DIRECT TRANSFER message. (In step 3) UE3905 responds with a release complete message. This message is contained in the GA-CSR UL DIRECT TRANSFER message between UE and GANC. (In step 3) GANC forwards the disconnect message to MSCo. (In step 4) MSC triggers the release of the connection as described in the GA-CSR connection release subsection above.

M. CS switch

1. CS handover from GERAN to U GAN a) GANC terminates the Iu UP protocol Figure 40 shows the CS handover from GERAN to GAN in some embodiments. The description of the handover process from GERAN to GAN assumes that the following conditions are true: (1) UE is in an active call using GERAN, (2) UE mode selection is preferred GAN, or in the case of preferred GERAN/UTRAN, then The RxLev of the current serving cell falls below the defined threshold. In some implementation

200780032892.1 In the first example, the threshold can be defined as a fixed value, or it can be provided by GERANBBS to the UE in dedicated mode, (3) the UE has successfully registered with the GANC, allowing the UE to obtain GAN system information, and (4) GERAN Provides information about neighboring 3G cells so that a cell in the 3G neighbor list matches the 3G cell information related to GANC. The 3G cell information related to GANC is the same as that provided in the AS related part of the system information obtained from GANC . As shown in the figure, UE 4005 starts to put GAN cell information in the measurement report message transmitted to GERAN BSC 4015. UE 4005 reports the highest signal level on the GAN cell. This is not the signal level actually measured in the GAN, but an artificial value (for example, RxLev = 63), which allows the UE to indicate the priority of the GAN.

Based on the UE measurement report and other internal algorithms, GERAN BSC 4015 decided to switch to the GAN cell. The BSC 4015 starts the handover preparation by sending (in step 2) a message that requires handover to the MSC 4020, so as to identify the target 3G RNC (GANC).

(In step 3) The MSC 4020 uses a relocation request message to request the target GANC 4010 to allocate resources for handover. The UE is identified by the included IMSI parameters.

Since the Iu UP support mode is indicated, (in step 4) GANC 4010 sends an Iu UP INITIALISATION packet to the MSC. (In step 5) MSC responds with Iu UP INITIALISATION ACK packet.

GANC 4010 establishes a handover to UTRAN command message, and (in step 6) sends the command message to MSC 4020 via a relocation request confirmation message. The MSC (in step 7) forwards the handover to UTRAN command message in the BSSMAP handover command message to GERAN BSC 4015, thereby completing the handover preparation work.

Next, GERAN BSC 4015 (in step 8) sends the internal system to UTRAN handover command message containing the command message for handover to UTRAN to UE 4005 to initiate the handover to GAN. Until the handover is completed (that is, until it sends a GA-CSR HANDOVER COMPLETE message), the UE will switch its audio path from GERAN to GAN in order to make the audio interruption shorter.

(In step 9) UE 4005 uses GA-CSR HANDOVER ACCESS message to access GANC 4010, and provides a handover command message from the complete internal system received from GERAN to UTRAN. (In step 10) GANC 4010 sends a GA-CSR ACTIVATE CHANNEL message to UE 4005. This message includes load path setting information, such as: (1) channel mode, (2) multi-rate codec configuration, (3) for UDP port and IP address of the uplink RTP stream

200780032892.1 address, and (4) voice sample size.

Then (in step 11) UE 4005 sends GA-CSR ACTIVATE CHANNEL ACK to GANC 4010 to indicate the UDP port used for the downlink RTP data stream. (In step 11) GANC 4010 uses the GA-CSR ACTIVATE CHANNEL COMPLETE message to signal the UE 4005 that the RAB establishment process is complete.

(In step 13) UE4005 sends a GA-CSR HANDOVER COMPLETE message at the end of the handover process to indicate the completion of the handover process. It switches the user from the GERAN user plane to the GAN user plane. (In step 14) GANC 4010 uses a relocation detection message to indicate to MSC 4020 that GANC 4010 has detected the UE. CN can now switch the user plane from the source GERAN to the target GAN as needed.

(In step 15) Two-way voice traffic is transferred between UE 4005 and MSC 4020 through GANC 4010. (In step 16) The target GANC 4010 uses a relocation complete message to indicate that the handover is complete. If it has not done so before, the CN will switch the user plane from the source GERAN to the target GAN.

(In step 17) The CN disconnects the connection to the source GERAN by using the clear command message. Finally, (in step 18) the source GERAN 4015 confirms that the GERAN resources allocated for this call have been released by using a clear complete message.

b) The UE terminates the IuUP protocol. Some embodiments utilize alternative procedures to perform CS handover from GERAN to GAN. Figure 41 shows the steps performed during GERAN to GAN in these embodiments. The description of the handover process from GERAN to GAN assumes that the following conditions are true: (1) UE is in an active call through GERAN (2) UE mode is selected as preferred GAN, or in the case of preferred GERAN/UTRAN, from current The RxLev of the serving cell falls below the defined threshold. In some embodiments, the threshold may be defined as a fixed value, or it may be provided by GERANEBS to the UE in a dedicated mode, (3) the UE has successfully registered with the GANC, thereby allowing the UE to obtain GAN system information, and (4) GERAN Provide information about neighboring 3G cells, so that a cell in the 3G neighbor list matches the 3G cell information related to GANC. The 3G cell information related to GANC is the same as that provided in the AS related part of the system information obtained from GANC . Steps 1 to 3 are performed in the same manner as the above description of steps 1 to 3 in FIG. 40, so the description will not be repeated for the sake of brevity.

(In step 4) GANC 4110 sends GA-CSR ACTIVATE to UE 4105

200780032892.1 No.

CHANNEL message, which includes new types of load path settings, such as: (1) channel mode, (2) multi-rate codec configuration, (3) UDP port and IP address for uplink RTP data stream, (4) Voice sample size, and an indication that Iu UP support mode is required. In some embodiments, GANC 4110 puts radio access load (RAB) parameters and IuUP parameters in the message (for example, IuUP mode in the case of using support mode for AMR voice calls).

Since the IuUP support mode is indicated, (in step 5) UE4110 sends an Iu UP INITIALISATION packet to the IP address and UDP port indicated in the GA-CSR ACTIVATE CHANNEL message.

(In step 6) MSC 4115 responds with Iu UP INITIALISATION ACK packet. MSC 4115 sends the message to the source IP address and UDP port number of the received INITIALISATION packet. (In step 7) UE4105 sends GA-CSR ACTIVATE CHANNEL ACK to GANC 4110. GANC 4110 creates a command message to switch to UTRAN, and (in step 8) sends it to CN4115 via a relocation request confirmation message »(in step 9) GANC 4110 uses GA-CSR ACTIVATE CHANNEL COMPLETE message to signal to the UE 4105 informs RAB that the establishment is complete. There is now an end-to-end audio path between UE4105 and MSC4115. (In step 10) MSC4115 forwards the command message for handover to UTRAN in the ESSMAP handover command message to GERANBSC4120, thus completing the handover preparation.

(In step 11) GERAN BSC 4120 sends a handover command message from the internal system to UTRAN to the UE in order to start the handover to GAN, where the message contains the command message for handover to UTRAN. Until the handover is completed (that is, until the UE sends a GA-CSR HANDOVER COMPLETE message), the UE will switch its audio path from GERAN to GAN in order to make the audio terminal as short as possible.

The UE (in step 12) uses the GA-CSR HANDOVER ACCESS message to access the GANC 4110 and provides a complete handover command message from the internal system to UTRAN received from GERAN. (In step 13) GANC 4110 uses a relocation detection message to indicate to MSC 4115 that GANC 4110 has detected the UE. At this time, the MSC 4115 can switch the user plane from the source GERAN to the target GAN as needed. At this time, (in step 14) the two-way voice traffic is transmitted between the UE and the MSC 4115 through the GANC 4110.

At the end of the handover process, the UE (in step 15) sends a GA-CSR HANDOVER COMPLETE message to indicate that the handover process is complete. The UE switches the user from the GERAN user plane to

200780032892.1 No.

GAN user interface.

(In step 16) The target GANC 4110 uses a relocation complete message to indicate the completion of the handover. If it has not done so before, the MSC 4115 will switch the user plane from the source GERAN to the target GAN at this time.

Finally, (in step 17) MSC 4115 uses a clear command message to disconnect the source GERAN. (In step 18) The source GERAN uses a clear complete message to confirm that the GERAN resources allocated for this call have been released.

2. CS handover from UTRAN to GAN a) GANC terminates Iu UP packet Figure 42 shows the CS handover from UTRAN to GAN in some embodiments. The description of the handover process from UTRAN to U GAN assumes that the following conditions are true: (1) UE is in a valid call via UTRAN, (2) UE has been ordered by RNC to make interfrequency measurements (ie, if The GAN cell has been allocated a frequency different from the frequency used in UTRAN), (a) If the UE is in the GAN preferred mode configured with Event 2A (Event 2A), the UE will use a specific GAN method (as in 3GPP TS 25.331). The standard "Radio Resource Control (RRC) protocol specification^^, which is referred to as "3GPPTS 25.331" hereinafter) processes the parameters related to event 2A in order to report EGAN, (B) When the UE is in GERAN/UTRAN preferred mode and event 2A has been configured for the GAN cell, the UE should only send the measurement about the GAN cell, when the event is triggered, and there is no UTRAN from the UEs neighbor cell list When the cell can meet the triggering conditions of this event (as described in 3GPPTS 25.331), (3) UTRAN provides information about neighboring cells so that a cell in the neighboring cell list matches a cell related to GANC, as obtained from GANC As provided in the AS related part of the system information.

As shown in Figure 42, UE4205 starts to put information about the GAN cell in the measurement report message to be sent to RNC 4215 (in step 1). The UE 4205 reports the highest signal level for the GAN cell. This signal level is not the signal level actually measured for GAN, but an artificial value that allows UE 4205 to indicate the priority of GAN.

Based on the UE measurement report and other internal algorithms, RNC 4215 decides to initiate a handover to the GAN cell. RNC 4215 starts the preparation phase of the relocation process by sending (in step 2) a message requesting relocation to the MSC to identify the target (GAN) cell.

Then, follow the steps 3-5 described above in the GERAN to GAN switching sub-chapter

200780032892.1 Perform steps 3 to 5 shown in Figure 42 for the first sample. (In step 6) The target GANC 4210 confirms the handover request message with a relocation request confirmation message, which indicates that it can support the requested handover, and includes a physical channel reconfiguration message indicating which radio channel the UE should be directed to .

Then (in step 7) MSC4220 sends a relocation command message to RNC 4215 to complete the relocation preparation process. (In step 8) RNC 4215 sends a PHYSICAL CHANNEL RECONFIGURATION message to UE 4205 to initiate the handover to GAN. Before the handover is completed (that is, before the UE sends the GA-CSR HANDOVER COMPLETE message), the UE will not switch its audio path from UTRAN to GAN to make the audio interruption as short as possible.

Next, steps 9-16 shown in FIG. 42 are performed in a similar manner to steps 9-16 of the GERAN to GAN handover described above. Then (in step 17) the MSC 4220 uses the Iu release command to disconnect to the source RNC. Finally (in step 18) the source RNC 4215 uses the Iu Release Complete message to confirm that the UTRAN resources allocated for this call have been released.

b) The UE terminates the IuUP packet. Some embodiments use an alternative procedure to perform the CS handover from UTRAN to GAN. Figure 43 shows the steps performed during UTRAN to GAN in these embodiments. As shown in the figure, (in step 1) the UE starts to put information about the GAN cell in the measurement report message to be sent to the RNC 4320. The UE reports the highest signal level for the GAN cell. This is not the signal level actually measured for the GAN, but an artificial value that allows the UE to indicate the priority of the GAN.

Based on the UE measurement report and other internal algorithms, RNC 4320 decides to initiate a handover to the GAN cell. RNC 4320 begins the preparation phase of the relocation process by sending (in step 2) a message requiring relocation to MSC 4315 to identify the target GAN cell.

(In step 3) MSC 4315 uses a relocation request message to request the target GANC 4310 to allocate resources for handover. UE4305 is identified by the included IMSI parameters.

(In step 4) GANC 4310 sends a GA-CSR ACTIVATE CHANNEL message to UE 4305, which includes the load path setting information received in the relocation request message, such as: (1) For uplink RTP flow UDP port and IP address, (2) Radio Access Load (RAB) parameters, and (3) IuUP parameters (for example, Iu UP mode, which is the support mode used for AMR voice calls).

Since the Iu UP support mode is indicated, (in step 5) UE 4305 sends an Iu UP INITIALISATION packet to the IP address and UDP port indicated in the GA-CSR ACTIVATE CHANNEL message. This message (for example, via the R4 media gateway) is routed to the core

200780032892.1 No. 4315 of the heart network.

(In step 6) MSC 4315 responds with Iu UP INITIALISATION ACK packet. MSC 4315 sends a message to the source IP address and UDP port number of the received INITIALISATION packet. (In step 7) UE 4305 sends GA-CSR ACTIVATE CHANNEL ACK to GANC 4310. (In step 8) The target GANC 4310 uses a relocation request confirmation message to confirm the handover request message. The relocation request confirmation message indicates GANC The requested handover can be supported and includes a physical channel reallocation message indicating which radio channel the UE 4305 should be directed to.

(In step 9) GANC 4310 uses the GA-CSR ACTIVATE CHANNEL COMPLETE message to signal the UE4305 of the completion of the RAB establishment. At this time, there is an end-to-end audio path between the UE 4305 and the MSC 4315. (In step 10) MSC 4315 sends a relocation command message to RNC 4320 to complete the preparatory work for relocation.

(In step 11) RNC 4320 sends a PHYSICAL CHANNEL RECONFIGURATION message to UE to start the handover process to GAN. Before the handover is completed (that is, before the UE sends the GA-CSR HANDOVER COMPLETE message), the UE will not switch its audio path from UTRAN to GAN to make the audio interruption shorter. (In step 12) UE uses GA-CSR HANDOVER ACCESS message to access GANC 4310 and provides the complete PHYSICAL CHANNEL RECONFIGURATION message received from RNC 4320.

(In step 13) GANC 4310 uses a relocation detection message to indicate to MSC 4315 that GANC 4310 has detected UEo. At this time, MSC 4315 may switch the user plane from source RNC 4320 to target GANC 4310 as needed. (In step 14) At this time, the two-way voice traffic is transmitted between the UE and the MSC 4315 through the GANC 4310.

(In step 15) The UE sends a GA-CSR HANDOVER COMPLETE message to indicate that the handover process has been completed from its perspective. The UE switches the user from the UTRAN user plane to the GAN user plane. (In step 16) The target GANC 4310 uses a relocation complete message to indicate the completion of the handover. If it has not done so before, CN 4315 will switch the user plane from the source RNC 4320 to the target GANC 4310 at this time.

Finally, (in step 17), the MSC 4315 uses the Iu release command to disconnect the connection to the source RNC 4320. (In step 18) The source RNC 4320 uses the Iu release completion packet to confirm that the UTRAN resources allocated for this call have been released.

200780032892.1 No.

3. CS handover from GAN to GERAN FIG. 44 shows the handover process from GAN to GERAN in some embodiments. The process description in this sub-chapter assumes that the following conditions are true: (1) UE is in a valid call in GAN Iu-mode, and (2) GERAN becomes available, and (a) UE mode selection is preferred GERAN/UTRAN, or (B) The UE mode selection is the preferred GAN, and the UE starts to leave the GAN coverage based on its local measurements, received RTCP reports, and any uplink quality indications received from the GANC. The handover process from GAN to GERAN is always triggered by the UE. As shown in Figure 44, the following steps are performed during the handover process from GAN to GERAN.

When there is a problem with the uplink quality of the ongoing call, GANC 4410 can (in step 1) send GA-CSR UPLINK QUALITY INDICATION»Uplink quality indication is the information sent by the GANC to the UE, which indicates Crossing of the uplink quality threshold in the uplink direction (crossing)_oWhenever the UE receives an indication of poor quality, it should start the handover process, as described in the following steps. Alternatively, the UE may use its local measurement or the received RTCP report to decide whether to start the handover process.

As shown in the figure, the UE 4405 (in step 2) sends a GA-CSR HANDOVER INFORMATION message to the GANC 4410, indicating the channel mode and channel mode and List of target GERAN cells, and put the received signal strength of each identified GERAN cell in the message. This list is the latest information available from the GSM RR subsystem. In addition, the GA-CSR HANDOVER INFORMATION message may include a list of target UTRAN cells sorted in order of handover priority, and the received signal strength of each identified UTRAN cell.

If the serving GANC selects the target GERAN cell, the handover procedure to GERAN is performed. The serving GANC 4410 starts the handover preparation by signaling the MSC 4420's need for handover (in step 3), using the required relocation, and putting the GERAN cell list provided by the UE in the message. GANC may only include a subset of the cell list provided by the UE.

The MSC 4420 then uses the handover request to select the target GERAN cell and (in step 4) requests the target GERAN cell to allocate the necessary resources. The target GERAN BSC 4415 establishes a handover command message (this message provides information about the allocated channel), and (in step 5) sends the handover command message to the MSC 4420 through a handover request confirmation message.

(In step 6) MSC 4420 uses a relocation command message to signal GANC 4410 to handover UE 4405 to GERAN, thereby ending the handover preparation phase. (In step 7)

200780032892.1 No.

GANC sends a GA-CSR HANDOVER COMMAND message to the UE, which includes the details of the target resource allocation sent by GERAN.

Next, (in step 8) UE 4405 sends a "Um: Handover Access" message containing the handover reference element to allow the target GERAN BSC 4415 to access this handover from the previous handover sent to the MSC in response to the handover message required. Correlate command messages. (In step 9) The target GERAN BSC 4415 confirms the detection of the handover to the MSC 4420 with the handover detection message.

(In step 10) MSC 4420 may switch the user plane to the target BSS at this time (in step 11) GERAN BSC 4415 provides physical information (ie timing advance) to the UE to allow the UE to synchronize with GERAN. (In step 12) The UE 4405 uses the handover complete message to signal the GERAN BSC 4415 that the handover is complete.

(In step 13) GERAN BSC 4415 notifies the MSC 4420 of the completion of the handover through the handover complete message. In order to charge, the MSC 4420 can use the target CGL used in the handover process (in step 14) two-way voice traffic is transmitted between the UE 4405 and the MSC 4420 through the GERAN BSC 4415 at this time. After receiving the confirmation of the completion of the handover, the MSC 4420 (in step 15) instructs the GANC to release all the resources allocated to the UE through the Iu release command.

Then (in step 16) GANC4415 uses GA-CSRRELEASE message to order UE4405 to release resources. (In step 17) GANC 4410 uses Iu Release Complete message to confirm the release of resources to MSC 4420.

(In step 18) UE4405 uses GA-CSR RELEASE COMPLETE message to confirm the release of resources to GANC 4410. Finally, (in step 19) UE 4405 can use the GA-RC DEREGISTER message to deregister from the GANC.

4. CS handover from GAN to UTRAN FIG. 45 shows the handover process from GAN to UTRAN in some embodiments. The process description assumes that the following conditions are true: (1) UE is in a valid call through GAN, (2) UE can operate in all modes among GAN mode, GERAN mode and UTRAN mode (3) UTRAN becomes available and ( a) The UE is in the preferred GERAN/UTRAN mode, or (b) UE mode selection is GAN preferred and starts based on its local measurement, received RTCP reports and any uplink quality indications received from GANC Leave the GAN coverage area. The handover to leave the GAN is always triggered by the UE. As shown in Figure 45, the following steps are from GAN

200780032892.1 Executed during the first handover to UTRAN.

If there is a problem with the uplink quality of the ongoing call, the GANC 4510 can (in step) send a GA-CSR UPLINK QUALITY INDICATION message. The uplink quality indicator is information sent by the GANC 4510 to the UE 4505, which indicates the intersection of the uplink quality threshold in the uplink direction. Whenever LJE4505 receives an indication of poor quality, it will start the switching process, as shown in the next step. Alternatively, the UE may use its local measurement or received RTCP report to decide whether to start the handover process.

Then (in step 2) UE 4505 sends a GA-CSR HANDOVER INFORMATION message to the serving GANC to indicate the channel mode and a list of candidate target UTRAN and GERAN cells sorted by handover priority, and put each identification in the message The received signal strength of the cell. UTRAN cells are identified by PLMN ID, LAC and 3G cell identity (defined in 3GPP TS 25.331).

If the service GANC 4510 selects UTRAN as the target RAT, the handover procedure for handover to UTRAN is performed. The service GANC 4510 signals (in step 3) the MSC 4520 that a handover is required by using the relocation required message and putting the UTRAN cell list provided by the UE 4505 in the message to start handover preparations. GANC 4510 can only put a subset of the cell list provided by UE 4505 in the message.

The MSC 4520 starts the handover process towards the target RNC 4515 identified by the serving GANC.

(In step 4) The MSC 4520 uses a relocation request message to request the target RNC 4515 to allocate the necessary resources. The target RNC 4515 establishes a physical channel reallocation message that provides information about the allocated UTRAN resources, and (in step 5) sends the message to the MSC 4520 via a relocation request confirmation message.

Then (in step 6) the MSC 4520 uses a relocation command message (which includes a physical channel reconfiguration message) to signal the serving GANC 4510 to switch the UE to UTRAN, thereby ending the handover preparation phase.

(In step 7) The serving GANC 4510 sends a GA-CSR HANDOVER COMMAND message to the UE, which includes the details of the target resource allocation sent by UTRAN. (In step 8) The target RNS 4515 implements uplink synchronization on the Uu interface.

(In step 9) The target RNC 4515 confirms the detection of the handover to the MSC with a relocation detection message. (In step 10) The MSC 4520 now switches the user plane to the target RNS 4515.

200780032892.1 Next, (in step 11) the UE 4505 uses the handover complete message to UTRAN to signal the UTRAN RNC 4515 that the handover is complete. (In step 12) UTRAN RNC 4515 confirms the completion of handover to MSC 4520 through a relocation complete message. If the user plane has not been switched in step 10, the MSC 4520 switches the user plane to the target RNS.

(In step 13) Two-way voice traffic is now transferred between UE 4505 and MSC 4520 via UTRAN RNC4515. After receiving the confirmation of the completion of the handover, (in step 14) the MSC 4520 instructs the serving GANC 4510 to release all the resources allocated for the UE through the Iu release command.

(In step 15) The serving GANC 4510 then uses the GA-CSR RELEASE message to order the UE 4505 to release resources. (In step 16) The serving GANC 4510 uses the Iu Release Complete message to confirm the resource release to the MSC 4520.

(In step 17) UE 4505 uses GA-CSR RELEASE COMPLETE message to confirm resource release to GANC 4510. UE 4505 can finally (in step 18) use the GA-RC DEREGISTER message to deregister from the service GANC 4510.

N. GA-PSR connection processing

The Iu-mode GA-PSR connection is a logical connection between the UE and the GANC regarding the PS domain. When the upper layer in the UE requests to establish a PS domain signaling connection and the UE is in the GA-PSR-IDLE state, that is, when no GA-PSR connection exists, the GA-PSR connection is established. When a successful response is received from the network, the GA-PSR replies to the upper layer that the PS domain signaling connection has been established and the UE has entered the equivalent mode of the RRC mode (that is, the GA-PSR-CONNECTED state).

1. GA-PSR connection establishment FIG. 46 shows the successful establishment process and the unsuccessful establishment process of the GA-PSR connection in some embodiments. As shown in the figure, the UE 4605 initiates the GA-PSR connection establishment process by sending a GA-PSR REQUEST message to the GANC 4610 (in step 1). This message contains the establishment reason indicating the reason for the GA-PSR connection establishment. When GANC 4610 determines that the GA-PSR connection request is acceptable, GANC 4610 signals the acceptance of the connection request by the UE 4605 by sending GA-PSR REQUEST ACCEPT (in step 2), and the UE enters the GA-PSR-CONNECTED state. In another case, when GANC 4610 determines that the GA-PSR connection request has to be rejected, GANC 4610 (in step 3) sends a GA-PSR REQUEST REJECT indicating the reason for rejection to UE ZC05 to complete the process.

200780032892.1 No.

2. GA-PSR Connection Release Figure 47 shows the release of the logical GA-PSR connection between the UE and the GANC in some embodiments. The following steps are performed during the release process. As shown in the figure, SGSN4715 sends a RANAP Iu release command message to GANC 4710 (in step 1) to instruct GANC 4710 to release the PS resources allocated to the UE.

Next, the GANC 4710 (in step 2) uses the Iu Release Complete message to confirm the resource release to the SGSN 4715. Then (in step 3) GANC 4710 uses GA-PSR RELEASE message to order UE 4705 to release resources. Finally, (in step 4) UE 4705 uses the GA-PSR RELEASE COMPLETE message to confirm the resource release to GANC 4710, and the GA-PSR status in the UE becomes GA-PSR-IDLE.

O. PS Security Mode Control FIG. 48 shows a message flow for PS security mode control in some embodiments. As shown in the figure, (in step 1) SGSN 4815 sends a RANAP security mode command message to GANC 4810. This message contains the integrity key (IK) and allowed algorithms, and if necessary, also includes the encryption key (CK) and allowed algorithms.

Next, (in step 2) GANC 4810 sends a GA-PSR SECURITY MODE COMMAND message to UE 4805. This message indicates the integrity protection and encryption settings (that is, the protection and settings that apply after relocation to UTRAN), and a random number. The UE stores this information for future use after relocation to UTRAN.

Next, the UE 4805 calculates a message authentication code (MAC) based on the random number, the UE IMSI, and the integrity key calculated by the UE. Then (in step 3) UE 4805 sends GA-PSR SECURITY MODE COMPLETE message to GANC 4810 to signal the selected algorithm and calculated MAC of UE 4805 ο

GANC 4810 then uses the random number, the UE IMSI and the integrity key provided by the SGSN in step 1 to verify the MAC. When GANC verifies that the MAC is correct, (in step 4) GANC sends a security mode complete message to SGSN 4815. The MAC proves that the identity authenticated to the GANC is the same as the identity authenticated to the core network.

P. PS NAS signaling process After the GA-PSR connection is established, NAS signaling can be transmitted from the SGSN to the UE and from the UE to the SGSN.

1. NAS signaling from SGSN to UE

200780032892.1 Figure 49 shows the PS NAS signaling from the SGSN to the UE in some embodiments. As shown in the figure, for the NAS signaling from the SGSN to the UE, (in step 1) the SGSN 4915 sends a NAS PDU to the GANC through a RANAP guided transfer message. GANC 4910 encapsulates the NAS PDU in the GA-PSR DL DIRECT TRANSFER message, and (in step 2) forwards the message to the UE 4905 through the existing TCP connection.

2. UE to SGSN NAS signaling Figure 50 shows UE to SGSN NAS signaling in some embodiments. As shown in the figure, UE 5005 receives a request from the NAS layer to transmit an uplink NAS PDU. Assuming that the required signaling connection already exists, the UE 5005 encapsulates the NAS PDU in the GA-PSR UL DIRECT TRANSFER message, and (in step 1) sends the message to the GANC 5010. (In step 2) GANC 5010 forwards the received message to the SGSN 5015 currently serving the UE through a RANAP guided transfer message.

Q. GA-PSR packet transmission channel management process

The GA-PSR packet transmission channel (GA-PSR PTC) provides the connection between the UE and the network for transmitting GPRS user data on the Up interface (ie, data transmitted through the GAN in the Iu mode). PTC uses the GTP-U protocol that runs above the UDP transport layer. The PTC endpoint address is the IP address and UDP port allocated to the UE and the PTC in the network during the PTC startup process. The UDP port number used for GTP-U is the same as defined in the 3GPP TS 25.414 standard (hereinafter referred to as "3GPP TS 25.414), UTRAN Iu interface data transport &amp; transport signalling^^.

The same endpoint address can be used to enable multiple PTC instances between the UE and the network at the same time. During the activation process, each PTC instance is assigned a unique GTP-U tunnel endpoint ID (a ID for the UE and an ID for the network). The UE and the GANC manage the activation and deactivation of the PTC instance based on the request for data transmission and a configurable PTC timer.

1. The state of the GA-PSR packet transmission channel is in the GA-PSR-CONNECTED state. The UE may be in one of two PTC sub-states (PTC-STANDBY or PTC-ACTIVE). The PTC-STANDBY sub-state is the initial/default PTC sub-state when the UE is in the GA-PSR-CONNECTED state of the GAN mode. The UE cannot send GPRS user data to the network or receive GPRS user data from the network. Before sending GPRS user data, the UE needs to enable PTC. When the UE successfully establishes the PTC, the UE transitions to the PTC-ACTIVE sub-state.

200780032892.1 In the PTC-ACTIVE sub-state, the UE is in the GA-PSR-CONNECTED state, and the PTC is valid between the UE and the network, and the UE can send and receive GPRS user data to and from the network. Several events can trigger the GA-PSR PTC activation process on the UE side. These events include the UE starting the uplink data transmission process or the GANC starting the PTC activation process, that is, the UE receives the GA-PSR-ACTIV ATE-PTC-REQUEST message from the GANC.

After successfully performing the PTC activation process, and in parallel with the transition to the PTC-ACTIVE sub-state, the UE starts the PTC timer. When the PTC timer expires, the UE sends a message to the GANC to start the deactivation process of the PTC. After successfully deactivating the PTC, the UE transitions to the PTC-STANDBY sub-state.

Whenever in the GA-PSR-CONNECTED state and the PTC-ACTIVE sub-state, the UE can receive the GA-PSR RELEASE message. In addition to requesting the release of the GA-PSR session, this can also be interpreted by the UE as an implicit PTC deactivation command.

Whenever in GAN mode, if the serving RR entity is switched to GSM-RR/UTRAN-RRC, GA-PSR is disconnected from GPRS SAP, and the UE enters GERANAJTRAN mode. At the same time, the UE will release the related PTC regardless of the status of the PTC timer.

The UE GA-PSR entity maintains a PTC for each valid PDP context. Whenever any uplink user data packet related to the PDP context is sent or a downlink user data packet is received, the PTC timer is restarted. The PTC timer value is provided to the UE as part of the GAN registration process (ie, in the GA-RC REGISTER ACCEPT message).

2. PTC initial activation FIG. 51 shows the initial activation process of the packet transmission channel under the assumption that the UE is in the GA-PSR-IDLE state. As shown in the figure, perform the following steps. As described in the GA-PSR connection establishment subsection above, perform the GA-PSR connection establishment process (in step 1). UE 5105 transitions to GA-PSR-CONNECTED state and PTC-STANDBY sub-state. Next, (in step 2) the additional PS signaling procedure is performed. Examples of these signaling procedures are shown in the following PDP context activation and PDP context activation subsections requested by the network.

Then (in step 3) SGSN5115 starts the RAB allocation process and puts the RAB-ID of the user data in the message. The CN transport layer address (IP address) and the CN Iu transport link (GTP-U terminal endpoint identifier, TEID). (In step 4) GANC 5110 sends GA-PSR to UE

200780032892.1 No.

ACTIVATE PTC REQUEST message to request to enable the packet transmission channel. The message includes the RAB-ID. The TEID assigned to the UE by GANC, as well as the GANC IP address and GANC TEID_OIf the GANC is configured to allow the UE to send directly to the SGSN (ie, GTP-U message) PTC packets (ie, the configuration shown in Figure 17), then the GANC will set the GANC IP address to the CN IP address and set the GANC TEID Become CNTEID; otherwise, GANC assigns a local address as the GANC IP address and assigns a TEID assigned by GANC as the GANC TEID, and sends this information to the UE (ie, the configuration shown in Figure 18). (In step 5) UE5105 confirms the enabling of PTC.

(In step 6) GANC 5110 sends RAB allocation response message to SGSN 5115 to complete the RAB allocation process. If GANC is configured to allow SGSN 5115 to send GTP-U messages directly to UE 5105 (ie, the configuration shown in Figure 17), then GANC 5110 &lt;RAN IP address is set to the UEs IP address and RAN TEID is set to be set by GANC The TEID assigned to the UE; otherwise, the GANC specifies a local address as the RAN IP address and a TEID assigned by the GANC as the RANTEID, and sends this information to the SGSN (ie, the configuration shown in Figure 18).

Next, (in step 7) GANC 5110 uses the GA-PSR ACTIVATE PTC COMPLETE message to signal the UE 5105 of the completion of the RAB establishment process. After receiving the message, the UE transitions to the PTC-ACTIVE sub-state and starts the PTC timer. Next, perform an additional PS signaling process (in step 8). Examples of these PS signaling are shown in the following PDP context activation and PDP context activation subsections requested by the network. The UE 5105 starts to transmit uplink user data through the established PTC (in step 9), and the SGSN 5115 can use the same transmission channel to transmit downlink user data packets.

3. PTC Data Transmission Figure 52 shows the transmission of GPRS user data packets through the GAN packet transmission channel. This scenario assumes that user data is transparently transferred between the UE and the core network (ie, the configuration shown in FIG. 17). As shown in the figure, perform the following steps.

When needed, (in step 1) GAN PTC is established as detailed in the PTC initialization subsection above. After the GA-PSR PTC is established, the UE 5205 enters the PTC-ACTIVE sub-state and starts the PTC timer. Then (in step 2) UE 5205 uses the standard GTP-U protocol specified in the 3GPP TS 29.060 standard (hereinafter referred to as "3GPP TS 29.060") "GPRS Tunnelling Protocol (GTP) across the Gn and Gp interface" to initialize the connection The transmission process of uplink user data packets, and restart the PTC timer.

200780032892.1 Next, (in step 3) SGSN 5215 uses the same PTC related to the specific PDP context to transmit downlink user data packets. Downlink user data packets are transmitted by using the standard GTP-U protocol as defined in 3GPP TS 29.060. After receiving the downlink data packet, the UE restarts the related PTC timer. (In step 4) The additional uplink and downlink user data packets are transmitted through the same PTC as the PTC described in step 2 and step 3, respectively. After each transmission or reception, the UE restarts the PTC timer. If the configuration shown in Figure 18 is used, then the uplink GTP-U packet is sent from the UE to the GANC, and then relayed from the GANC to the SGSN, otherwise the downlink GTP-U packet is sent from the SGSN to GANC, then relay from GANC to UE.

4. MS-initiated PTC deactivation process FIG. 53 shows a situation when the UE deactivates the packet transmission channel after the PTC timer expires. The UE is in the GA-PSR-CONNECTED state and the PTC-ACTIVE sub-state. As shown in the figure, perform the following steps.

(In step 1) The PTC timer associated with one of the active packet transmission channels has expired.

(In step 2) UE 5305 sends GA-PSR DEACTIVATE PTC REQUEST message to GANC 5310, this message includes RAB-ID for identifying PTC, and this message also indicates normal release as the reason for deactivation. In another case, the UE may indicate the expiration of the PTC timer as a reason for deactivation.

Then (in step 3) GANC 5310 sends an RAB release request message to SGSN 5315 to request the release of the related RAB. (In step 4) SGSN 5315 responds with a RAB allocation request message indicating release.

(In step 5) GANC 5310 responds to UE 5305 with a GA-PSR DEACTIVATE PTC ACK message to confirm successful deactivation. UE 5305 transitions to the PTC-STANDBY sub-state. (In step 6) GANC 5310 sends RAB allocation response message to notify SGSN 5315 that the RAB release process is complete.

5. MS-initiated PTC re-enablement Figure 54 shows the situation when the UE initiates the re-enablement of the packet transmission channel while in the GA-PSR-CONNECTED and PMM-CONNECTED states; for example, there is a PS signaling connection between the UE and the CN And a valid PDP context, but the PTC was previously disabled by the UE because the PTC timer expired. As shown in the figure, perform the following steps. UE is in

200780032892.1 No.

GA-PSR-CONNECTED state and PTC-STANDBY sub-state. The UE is in the PMM-CONNECTED state (that is, the PS signaling connection and a valid PDP context exist).

When the UE 5405 has a PDU to send, (in step 1) the UE 5405 sends a service request message (with a service type value of "data") to the GANC 5410 through the GA-PSRUL DIRECT TRANSFER message. Then (in step 2) GANC 5410 forwards the service request to SGSN 5415 through the existing signaling connection using the RANAP guided transfer message.

(In step 3) SGSN 5415 can start the security mode control process described in the above security mode control subsections as needed. (In step 4) SGSN 5415 sends a service acceptance message to GANC 5410. (In step 5) GANC 5410 forwards the message to the UE.

Next, (in step 6) UE 5405, GANC 5410 and SGSN 5415 establish the GA-PSR packet transport channel (PTC) as described in the PTC initial activation subsection above. The UE transitions to the PTC-ACTIVE sub-state and turns it on PTC timer. Finally, (in step 7) UE 5405 sends an uplink PDU. Additional data transfers are also possible.

6. Network-initiated PTC deactivation FIG. 55 shows a situation when the network initiates the deactivation process of the packet transmission channel in some embodiments. The UE is in the GA-PSR-CONNECTED state and the PTC-ACTIVE sub-state. As shown in the figure, perform the following steps.

If necessary, for example, due to error handling procedures, GANC 5510 can initiate the PTC disabling process. If so, (in step 1) GANC 5510 sends a RAB release request message to SGSN 5515.

(In step 2) SGSN 5515 sends an RAB allocation request message to request the release of the related RAB. The release request may include one or more RABs. Then, GANC 5510 sends a GA-PSR DEACTIVATE PTC REQUEST message to UE 5505 (in step 3) to request the deactivation of the related GA-PSR PTC.

UE 5505 transitions to the PTC-STANDBY sub-state, stops the PTC timer and (in step 4) sends back an acknowledgement to GANC. Repeat steps 3 and 4 for each additional RAB/PTC that needs to be released. Finally, (in step 5) GANC 5510 informs SGSN 5515 that the release has been successful.

7. Network-initiated PTC re-enablement FIG. 56 shows the situation when the network initiates the re-enablement of the packet transmission channel while the UE is in the GA-PSR-CONNECTED state and the PMM-CONNECTED state in some embodiments, for example, in the UE and CN There is a PS signaling connection and a valid PDP context but PTC

200780032892.1 was previously suspended. The UE is in the GA-PSR-CONNECTED state and in the PTC-STANDBY sub-state. The UE is in the PMM-CONNECTED state (that is, the PS signaling connection and a valid PDP context exist). As shown in the figure, perform the following steps.

When the SGSN5615 has a PDU to send to the UE 5605, the SGSN5615 can start the security mode control process described in the security mode control subsection above as needed (in step 1). (In step 2) UE 5605, GANC 5610, and SGSN 5615 can establish a GA-PSR packet transport channel (PTC) as described in steps 3 to 7 in the PTC initial activation subsection above. The UE transitions to the PTC-ACTIVE sub-state and starts the PTC timer. Then (in step 3) SGSN 5615 sends a downlink PDU. Additional data transfers are also possible.

&amp; Implicit PTC deactivation due to UE de-registration As part of the GAN de-registration process, GANC needs to release all resources allocated to the UE. The GAN de-registration process can be explicitly started by the UE, or can be implicitly started by the GANC when the loss of the signaling connection is detected (as described in the de-registration subsection above). Figure 57 shows the implicit PTC deactivation process in some embodiments. Initially, one or more GA-PSRPTCs related to the UE are in the PTC-ACTIVE state. As shown in the figure, perform the following steps.

(In step 1) Either the UE 5705 or the GANC 5710 initiates the GAN de-registration process for the UE 5705. Optionally, (in step 2) release all outstanding resources related to the CS domain.

(In step 3) GANC 5710 initiates the Iu release process to release the corresponding RAB. (In step 4) SGSN 5715 responds with an Iu release command.

After receiving the Iu release command, GANC 5710 locally (in step 6) deactivates all relevant PTCs, and (in step 6) responds to SGSN 5715 with an Iu release complete message.

R. PDP context enablement FIG. 58 shows a UE-initiated PDP context enablement process assuming that the UE is successfully in the GA-PSR-IDLE state in some embodiments. As shown in the figure, perform the following steps.

(In step 1) Perform the GA-PSR connection establishment process as described in the GA-PSR connection establishment subsection above. GANC 5810 establishes the SCCP connection to the SGSN, and (in step 2) uses the RANAP initial UE message to forward the service request message (with the service type value of "signaling") to the SGSN 5815. Subsequent NAS messages between the UE and the core network can be sent between the GANC and the SGSN using RANAP guided transfer messages.

(In step 3) SGSN5815 may use standard UTRAN authentication process to authenticate as needed

200780032892.1 No.

UE. (In step 4) SGSN 5815 can start the safe mode control process described in the safe mode control subsection above as needed. (In step 5) SGSN 5815 responds with a service accept message. (In step 5) GANC 5810 forwards the message to UE 5805.

Then (in step 6) UE 5805 sends a PDP Context Enable Request message to SGSN 5815, which provides details about the PDP context. This message is contained in the GA-PSR UL DIRECT TRANSFER message between UE5805 and GANC 5810. (In step 6) GANC 5810 forwards the PDP Context Enable Request message to SGSN 5815.

Next, (in step 7) as described in the PTC initial activation section above, UE 5805, GANC 5810 and SGSN 5815 establish a GA-PSR packet transport channel (PTC). (In step 8) SGSN 5815 uses the Enable PDP Context Accept message to indicate to the GANC that the PDP context establishment process is complete. GANC forwards this message to the UE through the GA-PSR DL DIRECT TRANSFER message. Finally, (in step 9) UE 5805 and CN 5815 exchange user data transmission through the established PTC.

S. Network Requested PDP Context Activation FIG. 59 shows a successful network request PDP context activation process under the assumption that the UE is in the GA-PSR-IDLE state in some embodiments. Initially, the SGSN receives the downlink user data to be transmitted to the UE, and the related RAB has not been established. The UE is in the PMM-IDLE state. As shown in the figure, (in step 1) SGSN 5915 sends a RANAP paging message to UE 5905 through GANC 5910 to locate the user. The paging request is at least about the paging of PS domain signaling.

(In step 2) GANC 5910 forwards the paging information to UE 5905 through the GA-PSR PAGING REQUEST message. (In step 3) Perform the GA-PSR connection establishment process as described in the GA-PSR connection establishment subsection above. In another case, instead of using the GA-PSR connection establishment process, (in step 3) UE 5905 can send a GA-PSR PAGING RESPONSE message and then transition to the GA-PSR CONNECTED state.

GANC 5910 establishes the SCCP connection to the SGSN, and (in step 4) uses the RANAP initial UE message to forward the service request message (service type value "Paging Response") to SGSN 5915. The subsequent NAS messages between the UE 5905 and the core network 5915 will be sent between the GANC 5910 and the SGSN 5915 using the RANAP guided transfer message.

SGSN 5915 can use standard UTRAN authentication process to authenticate UE 5905 as needed (in step 5). SGSN 5915 can start the above control in safe mode as needed (in step 6)

200780032892.1 The safety mode control process described in the sub-chapter.

Next, (in step 7) SGSN 5915 sends a request PDP context activation message to GANC 5910. (In step 7) GANC 5910 puts this message in the GA-PSR DL DIRECT TRANSFER message and forwards it to UE 5905. (In step 8) UE 5905 sends to SGSN 5915 an enable PDP context request message that provides details about the PDP context. This message is contained in the GA-PSR UL DIRECT TRANSFER between UE and GANC. (In step 8) GANC 5910 forwards a request to enable PDP context to SGSN 5915.

(In step 9) As described in steps 3 to 7 in the PTC initial activation subsection above, UE 5905, GANC 5910 and SGSN 5915 establish a GA-PSR packet transport channel (PTC) o (in step 10 ) SGSN 5915 uses the Enable PDP Context Accept message to indicate to the GANC that the PDP context establishment process has been completed. GANC forwards this message to the UE through the GA-PSR DL DIRECT TRANSFER message. Finally, (in step 11) UE 5905 and SGSN 5915 exchange user data transmission through the established PTC.

T. SRNS relocation between UTRAN and GAN Perform the SRNS relocation process to move one or more PS sessions between GAN and UTRAN in Iu mode. It relocates the Iu-ps connection point at GAN/UTRAN (in all cases), and relocates the Iu-ps connection point at the SGSN (only for relocation within the SGSN).

This article does not describe the support for the Iur interface between UTRAN and GAN. Therefore, only the combination of hard handover and SRNS relocation is applicable to GAN-UTRAN SRNS relocation. Therefore, only the "UE-related" relocation type is supported.

1. SRNS relocation from UTRAN to GAN a) Preparation phase Figure 60 shows the SRNS relocation preparation phase from UTRAN to GAN in some embodiments. As shown in the figure, perform the following steps.

The UE 6005 has one or more valid PDP contexts, and this context has a valid RAB in UTRAN. Next, UE 6005 detects GAN 6015, (in step 2) uses valid GAN cell identification information to perform the registration process and enter the GA-RC-REGISTERED state.

The measurement control message from RNC 6010 to UE 6005 (in step 3) includes the cell identity of this GAN. UE starts to put GAN in the measurement report sent to RNC (in step 3a)

200780032892.1 Cell information. In that message, it sets the signal strength indicator of the GAN cell to the maximum possible value.

Next, RNC 6010 decides to start the combined hard handover and SRNS relocation process. This decision is based on measurement reports and vendor/operator specific criteria. After deciding to start relocation, (in step 4) RNC 6010 sends a relocation required message to the SGSN.

Based on the content of the relocation message, SGSN 6020 determines that the target cell is GANC. Then (in step 5) SGSN 6020 sends a relocation request message to GANC 6015.

After receiving the relocation request message, (in step 6) GANC 6015 will establish the required functions as described in steps 4, 5, and 7 of the PTC initial activation sub-chapter above (in step 6). Packet transmission channel with appropriate attributes. (In step 6a) GANC 6015 will send a relocation request confirmation message to the SGSN.

b) Execution Phase Figure 61 shows the SRNS relocation execution phase from UTRAN to GAN in some embodiments. As shown in the figure, perform the following steps.

After receiving a positive confirmation from the GANC 6115 to provide services to the UE 6105, the SGSN 6120 initiates the execution phase by sending a relocation command to the RNC6110 (in step 1). RNC6110 sends a physical channel reconfiguration message (in step 2a) to instruct UE6105 to initiate a physical layer handover to move to GANo. When the QoS attributes of any valid RAB require lossless in-sequence SDU delivery (lossless PDCP), then RNC 6110 (in Step 2b) Start to forward GTP PDUs to the GANC 6115, and at the same time send them to the UE 6105 in the downlink direction. This forwarding is routed through the Iu PS interface. GANC can buffer these forwarded GTP PDUs according to QoS profile (profile), network conditions and whether it supports lossless relocation, send these forwarded GTP PDUs in the downlink, or discard these forwarded GTP PDUs. The specific implementation is determined according to the specific vendor and/or according to the specific operator. In addition, GANC can delay the downlink transmission until the following step 5 before starting, in order to synchronize the GTP-U sequence number.

The RNC (in steps 2c and 3a) sends a "forward SRNS context message" to the GAN through the SGSN. In this message, the next expected sequence number of the uplink and downlink GTP-U packets is indicated to GANC by the old SRNC. If QoS attributes require lossless relocation and GANC supports lossless relocation, these sequence numbers are used to ensure that GTP PDUs are delivered in order.

After receiving the physical channel re-allocation message, UE6105 immediately (in step 3b) to the GANC

200780032892.1 No.

6115 sends GA-PSR-HANDOVER-COMPLETE message. Upon receiving this message and the forwarding SRNS context message sent from SGSN6120 (in step 3a), GANC 6115 becomes the serving RNC» After receiving the GA-PSR-HANDOVER-COMPLETE message from the UE, GANC 6115 immediately (in step 4 Center) Send a relocation detection message to SGSN 6120. When the UE supports lossless relocation and one or more RAE QoS attributes require it, (in step 5) the UE starts the process of exchanging the GTP-U sequence number with the GANC through the newly established PTC and GANC. When GANC 6115 supports lossless relocation and one or more RAB QoS attributes require it, if the UE has not started the GTP-U sequence number exchange process, the GANC can start the GTP-U sequence number exchange process.

After completing the GTP-U sequence number exchange process, (in step 6) GANC6115 sends a relocation complete message to the SGSN. If the GTP-U sequence number exchange process is skipped (or it is not needed due to lack of UE and/or GAN support or QoS attributes), the relocation complete message is sent immediately after the relocation detection message. Effective RAB and PDP contexts are now moving between UE, GANC and SGSN. Then (in step 7) SGSN 6120 releases the Iu PS connection with the old RNC 6110. When the routing area of the GANC cell (indicated to the UE by the GANC) is different from that of the old RNC, then (in step 8) UE 6105 performs the routing area update process.

2. SRNS relocation from GAN to UTRAN a) Preparation phase Figure 62 shows the SRNS relocation preparation phase from GAN to UTRAN in some embodiments. As shown in the figure, perform the following steps.

(In step 1) UE 6205 uses the effective PDP context and PTC in GAN to exchange effective packet streams. If there is a problem with the uplink quality of the ongoing session, GANC 6215 may (in step 2) send a GA-PSR UPLINK QUALITY INDICATION message. The uplink quality indicator is the information sent by the GANC 6215 to the UE 6205, which indicates the intersection point with the uplink quality threshold in the uplink direction. Whenever the UE receives an indication of poor quality, it should start the relocation process, as described in the following steps. Alternatively, the UE can use its local measurements to decide whether to initiate the handover procedure.

Next, the UE decides to start the SRNS relocation from GAN to UTRAN by sending a GA-PSR-HANDOVER-INFORMATION message to GANC 6215 (in step 3). The specific criteria for this decision include that the UE is leaving the GAN coverage area

200780032892.1 The first situation (for example, based on degraded WLAN signal quality).

GANC 6215 selects the target RNC based on the content of the GA-PSR-HANDOVER-INFORMATION message (for example, the RNCL that is serving the cell identified by the UE as having the best signal quality) GANC 6215 (in step 4) sends a request to the SGSN 6220 Relocation message, which contains the selected RNC information.

The SGSN 6220 (in step 5) sends a relocation request message to the target RNC 6210. RNC 6210 (in step 6) performs the necessary allocation of radio and Iu transmission resources, and (in step 7) returns a relocation request confirmation message to the SGSN. This message contains the channelization information required by the UE to access UTRAN.

b) Execution phase Figure 63 shows the SRNS relocation execution phase from GAN to UTRAN in some embodiments. As shown in the figure, perform the following steps.

SGSN 6320 begins this execution phase by sending (in step 1) a relocation command to GANC 6315. This message contains channel access information in the target UTRAN cell. GANC 6315 (in step 2a) sends GA-PSR-HANDOVER-COMMAND to UE 6305. This message contains the information about the relocation command received in step 1. GANC can delay the transmission of the downlink GTPPDU at this time. If the GANC supports lossless SRNS relocation and the QoS of any existing RAB requires it, the GANC can start (in step 2c) to forward the GTP PDU to the target RNC 6310 via the SGSN 6320.

GANC 6315 also (in step 2b and step 3) forwards the SRNS context message to the target RNC through the SGSN. As shown in the figure, the GANC (in step 2b) sends the forwarding SRNS context message to the SGSN, and the SGSN (in step 3) relays the forwarding SRNS context message to the target RNC.

After receiving the GA-PSR-HANDOVER-COMMAND, the UE immediately delays the transmission of the uplink GTP PDU. It immediately starts to access UTRAN with the channel access parameters indicated in the message. The UE's access attempt is detected by Node B and RNC 6310, and (in step 4) is reported to SGSN 6320 through a relocation detection message.

The UE completes the low-level setup and configuration, and (in step 5a) sends an RRC physical channel reconfiguration complete message to the target RNC 6310. This causes RNC 6310 (in step 5b) to send a relocation complete message to SGSN 6320. At this stage, the target RNC assumes the rules of the SRNC for the UE.

At this time the packet data stream (in step 6) is transmitted via UTRAN. Then, the SGSN passed

200780032892.1 (in step 7a) sends an Iu release command message to GANC to release the Iu PS connection, and GAN (in step 7b) responds to the GANC with an Iu release complete message. If the routing area of the cell managed by the target RNC is different from that under the old GANC cell management, the UE 6305 (in step 8) performs the routing area update procedure.

U. Short Message Service

GAN provides support for circuit switched and packet switched SMS services. The UE connected to the GAN can send and receive SMS messages via the GAN.

1. SMS based on CS

The mechanism based on the SMS support of CS in GAN is the same as that used for CS mobility management and call control. On the UE side, the SMS layer (including the supported CM sublayer functions) uses the MM layer services to transmit SMS messages through standard circuit-switched UMTS implementations.

By using the GA-CSR UPLINK DIRECT TRANSFER message and the GA-CSR DOWNLINK DIRECT TRANSFER message passed between the UE and the GANC, the SM-CP protocol can be effectively encapsulated (tunnel) between the UE and the CN, where GANC passes through the RANAP message Relay the SM-CP message for transmission using the Iu-cs interface. Due to the mobility management and call control process, secure IPSec tunnels and TCP sessions are used for secure and reliable SMS delivery over IP networks.

2. PS-based SMS The PS-based SMS messaging is based on the same mechanism as the PS mobility management and session management signaling message. On the UE side, the SMS layer (including the supported CM sublayer functions) uses the services of the GA-PSR layer to deliver SMS messages through standard packet-switched UMTS implementations. With mobility management and session management signaling, secure IPSec tunnels and TCP sessions are used for secure and reliable PS-based SMS delivery over IP networks.

VI. Configuration information

A. GAN UARFCN and basic scrambling code for switching to GAN In some embodiments, the UMTS absolute radio frequency channel number (UARFCN) is selected according to the following guidelines:

1. UARFCN should be specified from the UARFCN value assigned by the operator.

2. It may be hoped that UARFCN will be the same and unique number in the entire operator network,

200780032892.1 In order to make the RNC configuration process the most labor-saving.

3. The basic scrambling code (its value can be from 0 to 511) should not be specified from the value being used by the operator (ie, the code used by the macro cell).

4. It may be hoped that the basic scrambling code is the same and unique number in the entire operator network, so that the RNC configuration is the most labor-saving.

Several options are discussed in more detail below.

1 Option 1 Some embodiments specify GAN UARFCN from the DCS frequency band used for GSM. This will put DL UARFCN in the range of 1162 to 1513. In this scheme, there is no restriction on the selection of the specific basic scrambling code (PSC) used in the GAN, and any one of the 512 values can be used in the selected specific UARFCN.

In the case that the initial UMTS configuration is in the 1900MHz frequency band, an analog method can be used, that is, using the UARFCN from the 850MHz frequency band_OThis will make the range of GAN UARFCN be greater than or equal to 4357 and less than or equal to 445 &amp; alternatively, UARFCN from PCS subband for non-UMTS technology can also be specified. Likewise, there are no restrictions on the choice of PCS in a given GANUARFCN.

2. Option 2 The strategy here is for GAN to utilize TDD unpaired spectrum and use its UARFCN range. Many operators, as part of the UMTS auction (auction), in addition to obtaining one or more FDDs, they also obtain TDD unpaired 5MHz spectrum. The TDD spectrum remains unused, and may remain unused for the foreseeable future in the near future.

Even if a given operator does not obtain any TDD spectrum in a given market, any unused TDD spectrum of any operator in the market can be used, because for UE cell search, this is a completely harmless and non-interference the process of. Even if the unpaired 5MHz of a given TDD is being used in UTRAN-TDD mode, a handset that only uses FDD may fail after the PHY layer is initialized and synchronized. Many handsets designed for the foreseeable future are FDD-only.

If the handset nominally allows these values, these UARFCNs are actually defined in 3GPP, and the infrastructure vendors allow to follow the UARFCN scope regulations in their systems, then this approach is feasible. In this case, the UARFCN range is: 9504 to 9596, and 10054 to 10121. As in option 1, select PSC in GAN

200780032892.1 There is no restriction on the selection.

3. Option 3 This design requires UARFCN to utilize free FDD spectrum for GAN. The "free" spectrum may or may not belong to a specific operator. In many regions of Europe and Asia, because of the cost of the equipment and the availability of the equipment, the bidder of the auction stopped the transaction or the owner chose not to use this service, and the FDD spectrum remained unused.

VII. Identifiers in GAN

A. Identifiers used for UEs and universal IP access networks. The key UE and universal IP access network addressing parameters are the public IP address of the IMSL UE associated with the terminal (U) SIM, and the general purpose of the subsidiary address IP access network point (AP-ID). The IMSI associated with the (U)SIM is provided to the GANC by the UE during the registration process. GANC maintains a record for each registered UE. For example, when GANC receives a RANAP PAGING message, GANC uses IMSI to find the appropriate UE record.

The public IP address of the UE is the source IP provided in the outermost IP header of the packet received by the UE through the GANC-SEGW. If available, this identifier can be used by the GANC to support location services and counterfeit detection, or can be Used by service providers to signal managed IP network IP flows that require special QoS processing.

The universal IP access network point (AP-ID) of the subsidiary address is provided to the GANC by the UE during registration. The AP-ID can be used by GANC to support location services, or can be used by service providers to restrict GAN access to authorized APs.

B. GAN's service area identifier

1. GAN service area and billing for location services

The Service Area Identifier (SAI) in UMTS can perform location-based routing for calls to services such as: emergency services; operators; broadcast and toll-free phone numbers. SAI can also be used by the core network to identify the location of call origination and termination to facilitate charging. GANC provides SAI to the core network to indicate the Iu-mode GAN service area.

a) Based on UTRAN/GERAN location allocation GAN SAI In the Iu-mode GAN architecture, the UE has a direct IP-based connection to the GANC. The GAN coverage area can overlap with the UTRAN/GERAN coverage area. The logical mapping from GAN cells to SAI can be completed in various ways, such as (but not limited to): (1) GAN SAI for each UTRAN/GERAN cell, (2) GAN SAI for each UTRAN/GERAN routing area; or

200780032892.1 Article (3) GAN SAL of each UTRAN/GERAN positioning area A single GANC can represent one or more SALs in one or more positioning areas (LAI)

VIII. Alternative Embodiments In some embodiments, as described in the previous section, a single protocol, General Access Radio Resource Control (GA-RRC) is used instead of separate CSR and PSR protocols. The following sections describe the architecture and message characteristics of this protocol layer. Only the features that differ from the previous embodiment are described.

A. Control plane architecture and user plane architecture

The Iu interface standard includes support for ATM and IP-based signaling and user data transmission mechanisms.

1. Circuit switched (CS) domain

2. a) CS Domain-Control Plane Figure 64 shows a GAN architecture that supports the CS domain control plane in some embodiments. The figure shows different protocol layers regarding UE 6405, general IP network 6410, GANC 6415 and MSC 6420. Figure 64 also shows two interfaces Up 6425 and Iu-cs 6430. The main features of the GAN CS domain control plane architecture are as follows. The basic access layer 6435 and the transport IP layer 6440 provide a universal connection between the UE 6405 and the GANC 6415. The IPSec layer 6445 provides encryption and data integrity between UE 6405 and GANC 6415. The remote IP layer 6450 is the "internal" IP layer used for the IPSec tunnel mode and is used by the UE 6405 for addressing by the GANC 6415. The remote IP layer 6450 is configured during the establishment of the IPSec connection.

In some embodiments, a single TCP connection 6455 is used to provide reliable transmission for GA-RC 6460 and GA-RRC 6465 signaling between UE 6405 and GANC 6415. The TCP connection 6455 is managed by the GA-RC 6460 and is transmitted using the remote IP layer 6450.

The General Access Resource Control (GA-RC) protocol 6460 manages the Up session, including the GAN discovery and registration process. By using the basic connection managed by the GA-RC sublayer 6460, the General Access Radio Resource Control (GA-RRC) protocol 6465 performs functions equivalent to the UMTS-RRC protocol. It should be noted that GA-RRC 6465 includes signaling messages related to CS service and PS service. GANC 6415 terminates the GA-RRC protocol 6465 and connects it to the RANAP protocol 6470 through the Iu-cs 6430 interface. NAS protocols, such as MM 6475 and above, are transported transparently between UE 6405 and MSC 6420. In some embodiments, the Iu-cs signaling transport layer 6495 complies with 3GPP TS 25.412.

200780032892.1 No.

b) CS Domain-User Plane Figure 65 shows the GAN protocol architecture supporting the CS domain user plane in some embodiments. The figure shows the different protocol layers of UE 6505, general IP network 6510, GANC 6515 and MSC 6520. Figure 65 also shows two interfaces, Up 6525 and Iu-cs 6530. The main features of the GAN CS domain user plane architecture are as follows. The basic access layer 6535 and the transport IP layer 6540 provide a universal connection between the UE 6505 and the GANC 6515.

The IPSec layer 6545 provides encryption and data integrity. The CS domain user plane data is transmitted between the UE 6505 and the MSC 6520 using the Iu user plane (Iu UP) protocol 6550 running above RTP/UDP (6555 and 6560). As described in the 3GPP TS 25.415 standard "UTRAN Iu interface user plane protocols^^, each Iu UP protocol 6550 instance can work in a transparent mode or in a support mode. This mode selection is indicated to the GANC by the MSC through the use of RANAP , And by GANC through the use of GA-RRC to indicate to the UE. As specified in the 3GPPTS 26.071 standard AMR speech codec; General description, when running in GAN mode, mandatory regulations must support AMR FR codec, and for other The support of codec is optional. In some embodiments, the Iu-cs data transport layer 6595 complies with the 3GPP TS 25.414.

Some embodiments using the GA-RRC protocol implement a protocol stack for GANC, which is different from the protocol stack shown for GANC 6515. In these embodiments, the GANC protocol stack is similar to the GANC 1115 protocol stack shown in FIG. 11. In these embodiments, GANC has additional protocol layers: remote IP, UDP, and RTP above the IPSec layer 6545. GANC also has an additional Iu UP protocol layer above the data transmission layer 6595. Similar to the GANC 1115 shown in FIG. 11, the GANC in these embodiments communicates with the CS domain user plane between the RTP/UDP and the Iu user plane protocol.

2. Packet switched (PS) domain

a) PS M-Control Plane Figure 66 shows the GAN architecture that supports the PS domain control plane in some embodiments. The figure shows the different protocol layers of UE6605, general IP network 6610, GANC 6615 and SGSN 6620. Figure 66 also shows two interfaces: Up 6625 and Iu-ps 6630. The main features of the GAN PS domain control plane architecture are as follows. The functions of GA-RRC 6635 and the base layer are as described above in Sub-Chapter VIII. AI a:

As described in "CS Domain-Control Plane". By using the basic Up session managed by the GA-RC 6640, the GA-RRC protocol 6635 performs functions equivalent to the UTRAN RRC protocol. GA-RRC 6635 includes signaling messages related to CS service and PS service.

200780032892.1 No.

GANC 6615 terminates the GA-RRC protocol 6635 and will use the Iu-ps interface 6630 to communicate with the RANAP protocol 6645. NAS protocols such as those used for GMM, SM, and SMS 6650 are transmitted transparently between UE 6605 and SGSN 6620. In some embodiments, the Iu-ps signaling transport layer 6695 complies with 3GPP TS 25.412.

b) PS Domain-User Plane Figure 67 shows the GAN architecture regarding the PS domain user plane in some embodiments. The figure shows the different protocol layers of UE6705. General IP network 6710&gt; GANC 6715 and SGSN 6720. Figure 67 also shows two interfaces: Up 6725 and Iu-ps 6730. The main features of the GAN PS domain user plane architecture are as follows. The basic access layer 6735 and the transport IP 6740 layer provide a universal connection between UE 6705 and GANC 6715. The IPSec layer 6745 provides encryption and data integrity. The GTP-U 6750 protocol works between the UE 6705 and the SGSN 6720, and transmits the upper layer payload (that is, the PS domain user plane data 6755) through the Up 6725 and the Iu-ps interface 6730. The user data is transparent between the UE 6705 and the core network Transmission. In some embodiments, Iu-ps data transmission lower layer 6795 complies with 3GPP TS 25.414.

Some embodiments using the GA-RRC protocol implement a protocol stack for GANC, which is different from the protocol stack shown for GANC 6715. In these embodiments, the GANC protocol stack is similar to the GANC 1815 protocol stack shown in FIG. 18. In these embodiments, GANC has additional protocol layers: remote IP, UDP, and GTP-U above the IPSec layer 6745. In these embodiments, the GTP-U in the UE and the GTP-U layer located above the UDP layer in the GANC are part of the GA-RRC protocol. GANC also has additional IP, UDP and GTP-U layers, all of which are located above the 6795 data transmission layer.

3. GA-RC (General Access Resource Control)

The GA-RC protocol provides a resource management layer, which has the following functions. Use GANC to discover and register, use GANC to perform registration update, use GANC to perform application-level keep-alive, and support for identifying APs are used to perform GAN access.

b) State of the GA-RC sublayer Figure 68 shows the GA-RC sublayer in the UE in some embodiments. As shown in the figure, the GA-RC sublayer in the UE can be in one of the following two states: GA-RC-DEREGISTERED 6805 or GA-RC-REGISTERED 6810. In the GA-RC-DEREGISTERED state 6805, the UE may be in the GAN coverage area, but the UE has not successfully registered with the GANC. When in GA-RC-DEREGISTERED status

200780032892.1 In state 6805, the UE can start the GAN registration process. After losing the TCP or IPSec connection or performing the GAN deregistration process, the UE returns to the GA-RC-DEREGISTERED state 6805.

In the GA-RC-REGISTERED state 6810, the UE registers with the serving GANC. The UE has an IPSec tunnel and a TCP connection established to connect to the serving GANC. Through the IPSec tunnel and TCP connection, the UE can exchange GA-RC or GA-RRC signaling messages with the GANC. When the UE stays in the GA-RC-REGISTERED state 6805, it performs an application-level keep-alive process with the GANC.

In the GA-RC-REGISTERED state, the UE can either be in UTRAN/GERAN mode 6815 or in GAN mode 6820. The UE can (1) camp on GERAN or UTRAN and be idle, (2) be in a working state in GERAN or UTRAN (for example, a GSM RR or UTRAN RRC connection can be established), (3) have "roamed" into GAN mode , Or (4) Has recently "roamed out" of GAN mode (for example, left GAN due to handover).

4. GA-RRC (General Access Radio Resource Control)

The GA-RRC protocol provides a resource management layer, which is used to replace UTRAN-RRC and provides the following functions: (1) Establish a transmission channel for transmitting CS and PS traffic between UE and GANC (2) To PS traffic Perform flow control (3) CS and PS handover support between UTRAN/GERAN and GAN, (4) Guide the transfer of NAS messages between the UE and the core network, and (5) Others such as paging and security configuration Features.

b) The state of the GA-RRC sublayer is shown in Figure 68. The GA-RRC sublayer in the UE can be in the following two states: GA-RRC-IDLE 6825 or GA-RRC-CONNECTED 6830. When the UE switches the serving RR entity to GA-RRC and the SAP between NAS and GA-RRC is activated, the UE enters the GA-RRC-IDLE 6825 state. This switching can only happen when the GA-RC is in the GARC-REGISTERED state. When the GA-RRC connection is established, the UE changes from the GA-RRC-IDLE state 6825 to the GA-RRC-CONNECTED state 6830; and when the GA-RRC connection is released, the UE returns to the GA-RRC-IDLE state. After the GA-RRC connection is released, an indication that no dedicated resources exist is delivered to the upper layer. When switching to GAN while in the GA-RC-REGIS TERED state and GERAN/UTRAN mode, the UE can also enter the GA-RRC-CONNECTED state. In the same way, when the handover from GAN is successful, the UE enters the GA-RC-REGISTERED in GERAN/UTRAN mode from the GA-RRC-CONNECTED state status.

200780032892.1 No.

B. High-level process

1. GA-RRC connection handling

The GA-RRC connection refers to the connection between the UE and the GANC in the CS domain or the PS domain. This kind of connection is established when the upper layer in the UE requests GA- RRC to establish a signaling connection and the UE is in idle mode (there is no RRC connection). When receiving a successful response from the network, GA-RRC responds to the upper layer: it has entered the mode of connecting to RRC. As a result, the upper layer may request that the NAS message be sent to the network.

a) GA-RRC connection establishment procedure i) UE-initiated GA-RRC connection establishment procedure Figure 69 shows the successful (and unsuccessful) establishment procedure of the GA-RRC connection when initiated by the UE in some embodiments. The UE 6905 initiates the GA-RRC connection establishment process by sending a GA-RRC REQUEST message to the GANC 6910 (in step 1). This message contains the establishment reason indicating the reason for the GA-RRC connection establishment. The message also includes the domain indicator (CS or PS). GANC 6910 transmits a successful response to UE 6905 by sending GA-RRC REQUEST ACCEPT (in step 2), and UE 6905 enters GA-RRC connected mode. Alternatively, GANC 6910 may (in step 3) return a GA-RRC REQUEST REJECT indicating the reason for rejection_O ii) Network-initiated GA-RRC connection establishment process FIG. 70 shows the successful establishment process of the GA-RRC connection when initiated by the network in some embodiments. CN 7015 (in step 1) sends a RANAP paging message to the GANC 7010 identified by the last location update message it received, and puts the IMSI of the TMSL paging UE in the message if possible. It is included in the request as a domain indicator (CS or PS). You can also put a paging reason in the message.

Next, GANC 7010 uses the IMSI provided by CN 7015 to identify the UE registration context. GANC 7010 then (in step 2) uses the GA-RRC PAGING REQUEST message to page UE 7005. UE 7005 (in step 3) responds with the GA-RRC INITIAL DIRECT TRANSFER message, which contains the domain indicator ( CS or PS) corresponding to the NAS message and reason. Alternatively, UE 7005 (in step 3) responds with a GA-RRC PAGING RESPONSE message containing the NAS message, domain indicator (ie CS or PS) and reason The UE 7005 enters the GA-RRC connection mode. GANC 7010 establishes an SCCP connection to CN 7015. GANC 7010 then (in step 4) uses the RANAP initial UE message to forward the NAS message to CN 7015. Between the UE and the core network Subsequent NAS messages in between can be guided by RANAP

200780032892.1 The first transmission message is sent between GANC and CN.

b) GA-RRC connection release Figure 71 shows the release process of the logical GA-RRC connection between the UE and the GANC in some embodiments. CN 7115 (in step 1) instructs GANC 7110 to release the user plane connection allocated to UE 7115 through the RANAPIu release command message. GANC 7110 (in step 2) uses Iu release complete message 7125 to confirm the resource release to CN7115.

Then, the GANC 7110 (in step 3) uses the GA-RRC CONNECTION RELEASE message to order the UE 7105 to release resources. The UE 7105 (in step 4) uses the GA-RRC CONNECTION RELEASE COMPLETE message to confirm the release of resources to the GANC 7110, and the GA-RRC state in the UE changes to idle.

3. Safe Mode Control Figure 72 shows a message flow for safe mode control in some embodiments. CN7215 (in step 1) sends a RANAP security mode command message to GANC 7210. This message contains the integrity key (IK) and allowed algorithms, and optionally also includes the encryption key (CK) and allowed algorithms. GANC 7210 (in step 2) sends a GA-RRC SECURITY MODE COMMAND message to UE 7205. This message indicates integrity protection and encryption settings (that is, applicable after relocation to UTRAN), and a random number. The UE 7205 stores this information for use after switching to UTRAN.

Next, the UE 7205 calculates the MAC based on the random number, the UE IMSI calculated by the UE and the integrity key »UE 7205 then (in step 3) sends a GA-RRC SECURITY MODE COMPLETE message to signal its selected algorithm And the calculated MAC. GANC 7210 then uses the random number, UE IMSI and the integrity key provided by CN 7215 in step 1 to verify the MAC. If GANC verifies that the MAC is correct, it (in step 4) sends a security mode complete message to CN7215. The MAC certification has the same identity authenticated to the GANC as the identity authenticated to the core network.

4. GA-RRC NAS signaling process.

After the GA-RRC connection is established, NAS signaling can be sent from CN to UE, and can be sent from UE to CNo a) NAS signaling from CN to UE Figure 73 shows NAS signaling from the core network to the UE in some embodiments . For the NAS signaling from CN to UE, the core network 7315 (in step 1) transmits messages to

200780032892.1 No.

GANC sends NAS PDU. GANC 7310 (in step 2) encapsulates the NAS PDU in the GA-RRC DL DIRECT TRANSFER message, and forwards the message to UE7305 through the existing TCP connection.

b) NAS signaling from UE to U CN Figure 74 shows NAS signaling from UE to core network of some embodiments. The UE 7405 GA-RRC layer receives the request from the NAS layer and transmits the uplink NAS PDU. Since the MM connection (here, the RR signaling connection) already exists, the UE GA-RRC encapsulates the NAS PDU into the GA-RRC UL DIRECT TRANSFER Within the message and (in step 1) send the message to GANC 7410. The GANC 7410 (in step 2) relays the received message to the core network 7415 through the RANAP guided transfer message 7420.

5. CS call initiated by the mobile station a) UE terminates the Iu UP packet Figure 75 shows the CS call process initiated by the mobile station in some embodiments. The description of this process assumes that the UE 7505 is in the GAN mode, that is, the UE has successfully registered with the GANC 7510 and GA-RRC is the serving RR entity in the UE 7505. It also assumes that there is no GA-RRC connection between UE 7505 and GANC 7510 (ie, GA- RRC-IDLE state). Perform the GA-RRC connection establishment process as described in the above subsection VIII.Blai: GA-RRC connection establishment process initiated by the UE (in step 1). Upon request to the upper layer, the UE 7505 (in step 2) sends a CM service request to the GANC 7510 in the form of a GA-RRC INITIAL DIRECT TRANSFER message.

GANC 7510 establishes its SCCP connection to CN 7515 and (in step 3) uses the RANAP initial UE message to forward the CM service request to CN 7515. Subsequent NAS messages between UE 7505 and core network 7515 will be sent between GANC 7510 and CN 7515 by using RANAP to guide the transfer message.

Optionally, CN 7515 may (in step 4) use standard UTRAN authentication procedures to authenticate UE 7505. Optionally, CN 7515 can (in step 5) activate the above sub-chapter VIII.B.3:

The safe mode control process described in "Safe Mode Control".

The UE 7505 (in step 6) sends a setup message, which provides the details of the call to CN 7515 and its load capacity and supported codecs. This message is contained in the GA-RRC UL DIRECT TRANSFER between UE 7505 and GANC 7510. GANC 7510 (in step 6) forwards the setting message to CN 7515.

200780032892.1 No.

CN 7515 (in step 7) uses the call progress message sent to GANC 7510 to indicate that it has received the call setup and that it will accept no additional call setup information. GANC 7510 (in step 7) forwards this message to UE 7505 in the form of a GA-RRC DL DIRECT TRANSFER message.

CN 7515 (in step 8) requests GANC 7510 to allocate call resources by using RANAP RAB allocation request message_OCN 7515 puts the RAB-ID about the user data in the message. The CN transmission layer address (IP address) and the CN Iu transmission link (UDP port number). GANC 7510 (in step 9) sends a GA-RRC ACTIVATE CHANNEL message to UE 7505, which includes the load path setting information received in the RAB allocation request message, such as: (1) Radio Access Load (RAE) parameters, For example, regarding the RAB-ID, UDP port and IP address of the uplink RTP data stream, and (2) Iu UP parameters (for example, Iu UP mode, where the support mode is used for AMR voice calls).

Since the Iu UP support mode is indicated, the UE 7505 (in step 10) sends an Iu UP INITIALISATION packet to the IP address and UDP port indicated in the GA-RRC ACTIVATE CHANNEL message. This message is transmitted to the core network 7515 (for example, R4 media gateway). The core network 7515 (in step 11) responds with an Iu UP INITIALISATION ACK packet. The core network 7515 sends a message to the source IP address and port number of the received INITIALISATION packet.

UE 7505 (in step 12) sends GA-RRC ACTIVATE CHANNEL ACK to GANC 7510₀ GANC (in step 13) signals that CN7515RAB has been established by sending a RANAP RAB allocation response message. GANC 7510 (in step 14) uses the GA-RRC ACTIVATE CHANNEL COMPLETE message to signal that the UE 7505 has completed the RAB establishment process.

At this time, there is an end-to-end audio path between UE 7505 and CN 7515. At this time, the UE 7505 can connect the user to the audio channel. CN 7515 informs UE 7505 with an alarm message that the called party is ringing. The message (in step 15) is transferred to the GANC 7510, and the GANC (in step 15) forwards the message to the UE 7505 in the form of GA-RRC DL DIRECT TRANSFER.

When the UE 7505 has not connected the audio channel to the user, it generates a ring back tone to the calling party. Otherwise, the ring back tone generated by the network will be returned to the caller. CN 7515 uses a connection message to signal that the called party has responded. The message (in step 16) is passed to the GANC

200780032892.1 No.

7510, and GANC (in step 16) forwards the message to UE 7505 in the form of GA-RRC DL DIRECT TRANSFER 7595. The UE 7505 connects the user to the audio channel. If the UE 7505 is generating a ringback tone, it stops the operation and connects the user to the audio channel.

UE7505 (in step 17) sends a connection confirmation message as a response, and the two parties are connected to make a voice call. This message is included in the GA-RRC UL DIRECT TRANSFER between UE 7505 and GANC 7510. GANC (in step 17) forwards the connection confirmation message to CN 7515. (In step 18) Two-way voice traffic is transmitted between UE 7505 and CN 7515 through GANC 7510.

b) GANC terminates the Iu UP packet. Some embodiments use an alternative procedure to make a CS call initiated by a mobile station using the RRC protocol. Fig. 76 shows the call steps performed during the CS call initiated by the mobile station in these embodiments. The process assumes that the UE is in GAN mode; that is, it has successfully registered with GANC, and GA-RRC is a serving RR entity for CS services in the UE. The process also assumes that there is no GA-RRC signaling connection between the UE and the GANC (ie, the GA-RRC-IDLE state). As shown in the figure, (in step 1) perform the GA-RRC connection establishment process. In some embodiments, this process is performed. Then, the UE 7605 sends a CM service request message to the GANC 7610 in the GA-RRC UL DIRECT TRANSFER message.

Next, GANC 7610 establishes an SCCP connection to the core network CN7615, and (in step 3) uses the RANAP initial UE message to forward the NAS PDU (ie, CM service request message) to the core network CN 7615. The message includes a domain indicator whose value is set to the value "CS domain". The subsequent NAS message between the UE and the core network CN will be sent between the GANC and the core network CN using RANAP to guide the transfer message.

The core network CN 7615 can use the standard UTRAN authentication process to authenticate the UE as needed (in step 4). The core network CN 7615 can start the safe mode control process as needed (in step 5). The UE 7605 (in step 6) sends a setup message, which provides the details of the call to the core network CN and its load capacity and supported codecs. This message is contained in the GA-RRC UL DIRECT TRANSFER between UE and GANC. GANC forwards the setting message to the core network CN.

Next, the core network CN 7615 (in step 7) uses the call proceeding message to indicate to the GANC that it has received the call setup and that it will accept no additional call setup information. GANC (in step 7) forwards this message as a GA-RRC DL DIRECT TRANSFER message to

200780032892.1 No.

The UE, the core network CN7615 (in step 8) uses the RANAP RAB allocation request message to request the GANC 7610 to allocate call resources. The core network CN 7615 puts the RAB-ID about the user data in the message. The CN transport layer address is linked to the CNIu transmission, as well as an indication that Iu UP support mode is required, and other parameters.

GANC 7610 then (in step 9) sends a GA-RRC ACTIVATE CHANNEL message to UE 7605, which includes payload channel setting information, such as: (1) channel mode, (2) multi-rate codec configuration, (3) about uplink The UDP port and IP address of the link RTP data stream, and (4) the voice sample size.

Next, UE 7605 (in step 10) sends GA-RRC ACTIVATE CHANNEL ACK to GANC 7610 to indicate the UDP port for the downlink RTP data stream. Since the core network CN indicates the IuUP support mode in step 8, GANC 7610 (in step 11) sends an Iu UP INITIALIZATION packet to the core network CN.

In response, the core network CN (in step 12) responds with the Iu UP INITIALISATION ACK packet. GANC 7610 (in step 13) uses the GA-RRC ACTIVATE CHANNEL COMPLETE message to signal that the UE 7605 has completed the RAB establishment process. Alternatively, steps 11 and 12 may occur before step 9.

GANC 7610 sends a RANAP RAB allocation response message (in step 14) to signal that the core network CN 7615 has established an RAE. The core network CN7615 informs the UE 3505 that the called party is ringing with an alarm message. The message (in step 15) is delivered to GANC 7610, and GANC (in step 15) forwards this message to UE 7605 in the form of a GA-RRC DL DIRECT TRANSFER message. When the UE has not connected the audio channel to the user , Which generates the ring back tone to be sent to the caller. Otherwise, the ring back tone generated by the network will be returned to the caller.

Next, the core network CN 7615 informs the called party that it has responded through a connection message. (In step 16) The message is transmitted to GANC 7610, and GANC (in step 16) forwards this message to the UE in the form of a GA-RRC DL DIRECT TRANSFER message. The UE connects the user to the audio channel. If the UE is generating a ringback tone, it will stop the operation and connect the user to the audio channel.

Then, UE7605 (in step 17) sends a connection confirmation message in response, and the two parties connect to make a voice call. This message is included in the GA-RRC UL DIRECT TRANSFER message between UE and GANC. GANC forwards the connection confirmation message to the core network CN.

200780032892.1 At this moment, (in step 18) the two-way voice traffic is transmitted between the UE 7605 and the core network CN 7615 through the GANC 7610.

6. CS call terminated by the mobile station Figure 77 shows the CS call process terminated by the mobile station in some embodiments. The description of this process assumes that the UE 7705 is in GAN mode, that is, it has successfully registered with the GANC 7710 and GA-RRC is the serving RR entity in the UE 7705. This process also assumes that there is no GA-RRC connection between the UE 7705 and the GANC 7710 (ie, the GA- RRC-IDLE state).

The call terminated by the mobile station arrives at CN 7715. CN 7715 (in step 1) sends a RANAP paging message to the GANC 7710 identified by the last location update it received, and puts the IMSI total of the mobile station that TMSL is paging in the message if possible. Is put in the request. GANC 7710 uses the IMSI provided by CN 7715 to identify the UE registration context. Then, GANC (in step 2) uses the GA-RRC PAGING REQUEST message to page the UE 7705. When TMSI is available in the request from CN 7715, the message includes TMSL otherwise, the message only includes the IMSL of UE 7705

The UE 7705 (in step 3) responds with the GA-RRC INITIAL DIRECT TRANSFER message, which contains the page response. UE 7705 enters GA-RRC connection mode. GANC 7710 establishes an SCCP connection to CN 7715. Then, GANC 7710 (in step 4) uses the RANAP initial UE message to forward the paging response to CN 7715. The subsequent NAS message between the UE 7705 and the core network 7715 will be sent between the GANC 7710 and CN 7715 using the RANAP guided transfer message.

CN7715 can use standard UTRAN authentication process to authenticate UE 7705 as needed (in step 5). CN 7715 can update the security configuration in UE 7705 through GANC 7710 as needed (in step 6), as described above in sub-chapter VIII.B.3:^uAs described in Security Mode Control". CN 7715 uses (in step 7) the setup message sent to UE 7705 via GANC 7710 to initiate call setup. GANC (in step 7) uses this message as GA-RRC DL DIRECT The form of TRANSFER message is forwarded to UE 7705.

After the UE 7705 (in step 8) has checked its compatibility with the payload service requested in the setup message and modified the payload service as required, it responds with a call confirmation with a GA-RRC UL DIRECT TRANSFER message. If the setting includes the signal information part, the UE 7705 warns the user with the indicated signal, otherwise the UE 7705 warns the user after successfully configuring the user plane. GANC 7710 (in step 8) forwards the call confirmation message to CN 7715o CN7715 (in step 9)

200780032892.1 first starts the configuration process using GANC 7710, which triggers the setup process of the RTP data stream (voice load channel) between GANC 7710 and UE 7705.

The UE 7705 (in step 10) signals that it is warning the user through the warning message contained in the GA-RRC UL DIRECT TRANSFER. GANC 7710 (in step 10) forwards the warning message to CN7715. CN 7715 sends the corresponding alarm message to the calling party. The UE 7705 (in step 11) informs the called party that it has answered through the connection message contained in the GA-RRC UL DIRECT TRANSFER. GANC 7710 (in step 11) forwards the connection message to CN7715. CN7715 sends the corresponding connection message to the calling party and connects the audio thoroughly. The UE 7705 connects the user to the audio channel.

CN7715 (in step 12) gives an affirmative response to GANC 7710 via the connection Ack message. GANC 7710 (in step 12) forwards this message to the UE in the form of a GA-RRC DL DIRECT TRANSFER message. Both parties in the call are connected to the audio channel. (In step 13) Two-way voice traffic is transmitted between UE 7705 and CN 7715 through GANC 7710.

7. CS call clearing FIG. 78 shows call clearing initiated by the UE in some embodiments. As shown in the figure, UE7805 (in step 1) sends a disconnect message to CN7815 to release the call. This message is included in the GA-RRC UL DIRECT TRANSFER message between UE 7805 and GANC 7810.

(In step 1) GANC 7810 (ie, use RANAP to guide the transmission of the message) forward this disconnect message to CN7815»

CN 7815 (in step 2) responds to GANC 7810 with a release message. GANC 7810 (in step 2) uses GA-RRC DL DIRECT TRANSFER to forward the release message to UE7805.

The UE 7805 (in step 3) responds with a release complete message. This message is contained in the GA-RRC UL DIRECT TRANSFER message between UE 7805 and GANC 7810. GANC 7810 (in step 3) forwards the disconnect message to CN7815. CN7815 (in step 4) triggers the connection release process, as described in sub-chapter VIII.B: "GA-CSR connection release".

&amp; CS handover a) CS handover from GERAN to GAN i) UE terminates Iu UP packet

200780032892.1 Figure 79 shows the CS handover process from GERAN to GAN in some embodiments. For the handover process from GERAN to GAN, it is assumed that the following conditions are true (1) UE is in a valid call using GERAN; (2) UE mode selection is preferred GAN, or if it is preferred GERAN/UTRAN, the RxLev from the current serving cell falls Below the limit threshold. In some embodiments, this threshold can be defined as a fixed value or provided by GERANBSS to UEs in dedicated mode; (3) The UE has successfully registered with GANC, allowing the UE to obtain GAN system information, and (4) GERAN provides Information about neighboring 3G cells such that one of the cells in the 3G neighbor list matches the 3G cell information related to GANC, as provided in the AS related part of the system information obtained from the GANC.

The UE starts (in step 1) to put the GAN cell information into the measurement report message sent to GERAN. The UE reports the highest signal level for the GAN cell. This is not the signal level actually measured in the GAN, but an artificial value (for example, RxLev = 63) to allow the UE to indicate a preference for the GAN.

According to the UE measurement report and other internal algorithms, GERAN BSC decides to switch to the GAN cell. BSC 7920 sends (in step 2) a message requesting handover to CN 7915 and recognizes the target 3G RNC (GANC) 7910 to start handover preparations. CN 7915 (in step 3) uses the relocation request message to request the target GANC 7910 to allocate resources for handover. Identify the UE 7905 by the included IMSI parameters.

GANC 7910 (in step 4) sends a GA-RRC ACTIVATE CHANNEL message to UE 7905, which includes the load path setting information received in the relocation request message, such as: (1) About the uplink RTP data stream UDP port and IP address, (2) Radio Access Load (RAB) parameters, and (3) Iu UP parameters (for example, IuUP mode, where the support mode is used for AMR voice calls).

Since the Iu UP support mode is indicated, the UE 7905 (in step 5) sends an Iu UP INITIALISATION packet to the IP address and UDP port indicated in the GA-RRC ACTIVATE CHANNEL message. This message is transmitted to the core network 7915 (for example, R4 media gateway).

The core network 7915 (in step 6) responds with an Iu UP INITIALISATION ACK packet. The core network 7915 sends a message to the source IP address and UDP port number of the received INITIALISATION packet. UE 7905 (in step 7) sends GA-RRC ACTIVATE CHANNEL ACK to GANC 7910_O GANC 7910 constructs a command message for switching to UTRAN, and (in step 8) sends this message to CN 7915 through a relocation request confirmation message.

200780032892.1 No.

GANC 7910 (in step 9) uses the GA-RRC ACTIVATE CHANNEL COMPLETE message to notify the UE 7905 that the RAB establishment process is complete. At this time, there is an end-to-end audio path between UE 7905 and CN 7915. (In step 10) CN 7915 forwards the switch to UTRAN command message to GERAN BSC 7920 in the form of a BSSMAP switch command message to complete the handover preparation.

(In step 11) GERAN BSC 7920 sends an intersystem to UTRAN handover command message to the UE. The message contains a handover command message to UTRAN to start the handover operation to GAN. The UE will not switch its audio path from GERAN to GAN until the handover is completed (that is, before it sends the GA-RRC HANDOVER COMPLETE message) to ensure a short audio interruption.

The UE (in step 12) uses the GA-RRC HANDOVER ACCESS message to access GANC 7910, and provides a complete system-to-UTRAN handover command message received from GERAN. GANC 7910 (in step 13) uses a relocation detection message to indicate to CN 7915 that GANC has detected the UE. At this point, CN 7915 can switch the user plane from the source GERAN to the target GAN as needed. At this time, (in step 14) Two-way voice traffic is transmitted between UE and CN 7915 through GANC 7910.

(In step 15) The UE sends a GA-RRC HANDOVER COMPLETE message when the handover process is completed to indicate that the handover process is complete. It switches the user from the GERAN user plane to the GAN user plane.

(In step 16) The target GANC 7910 uses a relocation complete message to indicate that the handover is complete. If it has not done so before, CN 7915 will switch the user plane from the source GERAN to the target GAN at this time.

Finally, CN 7915 (in step 17) uses a clear command message to disconnect the source GERAN. The source GERAN (in step 18) confirms that the GERAN resources allocated for this call have been released with a clear complete message.

ii) GANC terminates Iu UP grouping. Figure 80 shows an alternative procedure for CS handover from GERAN to GAN in some embodiments. The description of the handover process from GERAN to GAN assumes that the following conditions are true: (1) UE is in an active call using GERAN; (2) UE mode selection is the preferred GAN, or if it is the preferred GERAN/UTRAN, from the current serving cell The RxLev falls below the defined threshold. In some embodiments, this threshold can be defined as a fixed value or provided by GERANBSS

200780032892.1 The UE in dedicated mode; (3) The UE has successfully registered with GANC, allowing the UE to obtain GAN system information, and (4) GERAN provides information about neighboring 3G cells, so that one of the cells in the 3G neighbor list Match 3G cell information related to GANC, as provided in the AS related part of the system information obtained from GANC. As shown in the figure, UE 8005 starts to put the GAN cell information into the measurement report message sent to GERAN BSC 8015. UE 8005 reports the highest signal level for the GAN cell. This is not the signal level actually measured in the GAN, but an artificial value (for example, RxLev = 63) to allow the UE to indicate the priority for the GAN.

According to the LJE measurement report and other internal algorithms, GERANBSC 8015 decided to switch to the GAN cell. BSC 8015 sends (in step 2) a message requesting handover to the core network CN 8020 and recognizes the target 3GRNC (GANC) to start handover preparations.

The core network CN 8020 (in step 3) uses the relocation request message to request the target GANC 8010 to allocate resources for handover. The UE is identified by the included IMSI parameters.

Since the Iu UP support mode is indicated, (in step 4) GANC 8010 sends the Iu UP INITIALISATION packet to the core network CN. (In step 5) The core network CN responds with an Iu UP INITIALISATION ACK packet.

GANC 8010 constructs a handover to UTRAN command message, and (in step 6) sends this message to the core network CN 8020 via a relocation request confirmation message. (In step 7) The core network CN forwards the command message for handover to UTRAN to GERANBSC 8015 in the form of a BSSMAP handover command message to complete the handover preparation.

Next, (in step 8) GERAN BSC 8015 sends to UE 8005 a command message for handover to UTRAN in the system, which contains a command message for handover to UTRAN to start the handover operation for handover to GAN. The UE will not switch its audio path from GERAN to GAN before the handover is completed (that is, before it sends the GA-RRC HANDOVER COMPLETE message) in order to maintain a short audio interruption.

The UE (in step 9) uses the GA-RRC HANDOVER ACCESS message to access the GANC 8010 and provides a complete Intersystem (Intersystem) to UTRAN handover command message received from GERAN. GANC 8010 (in step 10) sends a GA-RRC ACTIVATE CHANNEL message to UE 8005, which includes payload channel setting information, such as: (1) channel mode, (2) multi-rate codec configuration, (3) about uplink The UDP port and IP address of the RTP data stream, and (4) the voice sample size.

200780032892.1 Next, (in step 11) UE 8005 sends GA-RRC ACTIVATE CHANNEL ACK to GANC 8010 to indicate the UDP port of the downlink RTP data stream. (In step 12) GANC 8010 uses the GA- RRC ACTIVATE CHANNEL COMPLETE message to notify UE 8005 that the RAB establishment process has been completed.

(In step 13) UE 8005 sends a GA-RRC HANDOVER COMPLETE message at the end of the handover process to indicate the completion of the handover process. It switches the user from the GERAN user plane to the GAN user plane. (In step 14) The GANC 8010 uses a relocation detection message to indicate to the core network CN 8020 that the GANC has detected the UE. At this time, the CN can switch the user plane from the source GERAN to the target GAN as needed.

At this time, the two-way voice traffic (in step 15) is transmitted between the UE 8005 and the core network CN 8020 through the GANC 8010. The target GANC 8010 (in step 16) uses a relocation complete message to indicate that the handover is complete. If it has not done so before, the CN will switch the user plane from the source GERAN to the target GAN at this time.

(In step 17) The CN uses a clear command message to disconnect from the source GERAN. Finally, the source GERAN 8015 (in step 18) confirms that the GERAN resources allocated for this call have been released with a clear complete message.

b) CS handover from UTRAN to GAN i) UE terminates the Iu UP packet. The description of the handover process from UTRAN to GAN assumes that the following conditions are true: (1) UE is in a valid call using UTRAN; (2) UE has been RNC Command to make inter-frequency measurements. When the UE is in the preferred GAN mode and the event is configured as 2A, the UE processes the parameters related to the event 2A in a specific GAN manner (as described in 3GPP TS 25.331) in order to report the GAN. When the UE is in the preferred GERAN/UTRAN mode and event 2A has been configured for the GAN cell, the UE should only send the measurement results about the GAN cell. When this event is triggered and there is no UTRAN cell from the UEs neighbor cell list that meets the requirements of this event When the condition is triggered (as described in 3GPP TS 25.331); and (3) UTRAN provides information about neighboring cells, so that one of the cells in the neighbor list matches the cell related to GANC, such as the information in the system information obtained from GANC. As provided in the AS section.

Figure 81 shows the CS handover process from UTRAN to GAN in some embodiments. (In step 1) The UE starts to put information about the GAN cell in the measurement report message sent to the RNC 8120. The UE reports the highest signal level of the GAN cell. This is not actually measured in GAN

200780032892.1 is the first signal level, but allows the UE to indicate the artificial value of preference for the GAN.

According to the UE measurement report and other internal algorithms, RNC 8120 decides to start the handover operation to the GAN cell. RNC 8120 begins the preparation phase of the relocation process by sending (in step 2) a message requesting relocation to CN 8115 and identifying the target (EGAN) cell.

(In step 3) CN 8115 uses a relocation request message to request the target GANC 8110 to allocate resources for handover. UE8105 uses the included IMSI parameters to identify it.

GANC 8110 (in step 4) sends a GA-RRC ACTIVATE CHANNEL message to UE 8105, which includes the load path setting information received in the relocation request message, such as: (1) UDP on the uplink RTP data stream Port &amp; IP address (2) Radio Access Load (RAB) parameters, and (3) IuUP parameters (for example, IuUP mode, where the support mode is used for AMR voice calls).

Since the Iu UP support mode is indicated, the UE 8105 (in step 5) sends an Iu UP INITIALISATION packet to the IP address and UDP port indicated in the GA-RRC ACTIVATE CHANNEL message. This message is transmitted to the core network 8115 (for example, R4 media gateway).

(In step 6) The core network 8115 responds with an Iu UP INITIALISATION ACK packet. The core network 8115 sends a message to the source IP address and UDP port number of the received INITIALISATION packet. (In step 7) UE 8105 sends GA-RRC ACTIVATE CHANNEL ACK to GANC 8110_O The target GANC 8110 (in step 8) confirms the handover request message with a relocation request confirmation message, which indicates that the GANC can support the requested handover and includes the physical information indicating the radio channel to which the UE8105 should be directed. Channel reconfiguration message.

GANC 8110 (in step 9) uses the GA-RRC ACTIVATE CHANNEL COMPLETE message to notify the UE 8105 that the RAB establishment process has been completed. At this time, there is an end-to-end audio path between UE 8105 and CN8115. CN8115 (in step 10) sends a relocation command message to RNC 8120 to complete the relocation preparation.

The RNC 8120 (in step 11) sends a PHYSICAL CHANNEL RECONFIGURATION message to the UE to initiate the handover operation to the GAN. The UE will not switch its audio path from UTRAN to GAN until the handover is completed (that is, before it sends the GA-RRC HANDOVER COMPLETE message) to maintain a short audio interruption. UE (in step 12) uses GA-RRC HANDOVER ACCESS message to access GANC 8110 and provides the complete PHYSICAL CHANNEL received from RNC 8120 to U

200780032892.1 No.

RECONFIGURATION message.

GANC 8110 (in step 13) uses a relocation detection message to indicate to CN 8115 that GANC 8110 has detected the UE. At this time, CN8115 can switch the user plane from the source RNC 8120 to the target GANC 8110 as needed. At this time, the two-way voice traffic (in step 14) is transmitted between the UE and CN 8115 through GANC 8110.

The UE (in step 15) sends a GA-RRC HANDOVER COMPLETE to indicate that the handover process has been completed from its perspective. It switches the user from the UTRAN user plane to the GAN user plane. The target GANC 8110 (in step 16) uses a relocation complete message to indicate that the handover is complete. If it has not done so before, CN8115 will switch the user plane from the source RNC8120 to the target GANC 8110. Finally, CN8115 (in step 17) uses the Iu release command to disconnect the source RNC8120. The source RNC 8120 (in step 18) uses the Iu Release Complete message to confirm that the UTRAN resources allocated for this call have been released.

ii) GANC terminates Iu UP packet. Figure 82 shows an alternative procedure for the CS handover procedure from UTRAN to GAN using the RRC protocol in some embodiments. The description of the handover process from UTRAN to GAN assumes that the following conditions are true: (1) The UE is in a valid call using UTRAN; (2) The UE has been ordered by the RNC to make inter-frequency measurements (that is, the GAN cell has been When assigned to a frequency value different from the frequency value used in UTRAN), (a) If the UE is in the preferred GAN mode and event 2A is configured, the UE handles event 2A in a specific GAN manner for EGAN reporting (B) When the UE is in the preferred GERAN/UTRAN mode and event 2A has been configured for the GAN cell, the UE should only send the measurement results about the GAN cell. When this event is triggered and there is no information from the UEs neighbor cell list When the UTRAN cell meets the triggering conditions of this event (as described in 3GPP TS 25.331); (3) UTRAN provides information about neighboring cells so that one of the cells in the neighbor list matches the cell related to GANC, as obtained from GANC As provided in the section about AS in the system information.

As shown in Figure 82, the UE starts to put information about the GAN cell in the measurement report message sent to the RNC 8215 (in step 1). UE 8205 reports the highest signal level of the GAN cell. This is not the signal level actually measured in the GAN, but the artificially set value that allows the UE 8205 to indicate the preference for the GAN.

According to the UE measurement report and other internal algorithms, RNC 8215 decides to start the GAN cell

200780032892.1 The first switching operation. RNC 8215 starts the preparation phase of the relocation process by sending (in step 2) a message requesting relocation to the core network CN and identifying the target (GAN) cell.

Next, perform steps 3 to 5 in Figure 82 in a similar manner to steps 3 to 5 of the CSRGERAN to GAN handover procedure in the sub-chapter "GANC Terminates Iu UP Packet" described above, but the message in Figure 82 is RRC Message (not CSR). The target GANC 8210 (in step 6) confirms the handover request message with a relocation request confirmation message indicating that the GANC can support the requested handover, and includes indicating the radio to which the UE should be directed The physical channel reconfiguration message of the channel.

Next, the core network CN 8220 (in step 7) sends a relocation command message to the RNC 8215 to complete the relocation preparation. RNC 8215 (in step 8) sends a PHYSICAL CHANNEL RECONFIGURATION message to UE 8205 to initiate the handover operation to GAN. The UE will not switch its audio path from UTRAN to GAN until the handover is completed (that is, before it sends the GA-RRC HANDOVER COMPLETE message) to maintain a short audio interruption.

Next, perform steps 9 to 16 in Fig. 82 in a similar manner to steps 9 to 16 of the CSR GERAN to GAN handover procedure in the sub-chapter "GANC terminates Iu UP packet" described above, but step 9 in Fig. 82 Up to 16 uses the RRC protocol instead of the CSR protocol. Next, the core network CN 8220 (in step 17) uses the Iu release command to tear down the connection to the source RNC. Finally, the source RNC 8215 (in step 18) uses the Iu release complete message to confirm that the UTRAN resources allocated for the call have been released.

c) CS handover from GAN to GERAN The description in this section assumes that the following conditions are true: (1) UE is in an active call using EGAN; and (2) GERAN becomes available, and (i) UE mode selection is preferred GERAN/UTRAN, or (ii) UE mode selection is the preferred GAN, and the UE starts to leave GAN coverage based on its local measurement results, received RTCP reports, and any uplink quality indications received from GANC.

The handover process from GAN to GERAN is always triggered by the UE.

Figure 83 shows the CS handover process from GAN to GERAN in some embodiments. If there is a problem with the uplink quality of the ongoing call, GANC 8310 may (in step 1) send GA-RRC UPLINK QUALITY INDICATION. The uplink quality indicator is the uplink quality threshold in the uplink direction sent by the GANC 8310 to the UE 8305.

200780032892.1 The information of the intersection of the first value. Whenever UE8305 receives an indication of poor quality, it should start the handover process, as described in the next step. Alternatively, the UE 8305 may use its local measurement results or the received RTCP report to decide to start the handover process.

(In step 2) UE 8305 sends GA-RRC HANDOVER INFORMATION message to GANC 8310, and puts in the message the received signal strength of each identified GERAN cell. The GA-RRC HANDOVER INFORMATION message indicates the channel mode and A list of target GERAN cells identified by CGI, which are sorted in order of handover priority (for example, sorted according to C1 path loss parameters). This list is the latest information available from the CSMRR subsystem. In addition, the GA-RRC HANDOVER INFORMATION message may include a list of target UTRAN cells sorted in order of handover priority, and the received signal strength of each identified UTRAN cell.

If the serving GANC 8310 selects the target GERAN cell, the process of handover to GERAN is performed. The service GANC 8310 uses (in step 3) a relocation request message to notify CN 8315 that handover is required and puts the GERAN cell list provided by UE 8305 in the message to start handover preparations. GANC 8310 can only put a subset of the cell list provided by UE 8305 in the message.

CN8315 selects the target GERAN cell and (in step 4) uses the handover request packet to request it to allocate the necessary resources. The target GERAN constructs a handover command message, which provides information about the allocated channel, and the target GERAN (in step 5) sends the message to CN 8315 via a handover request confirmation message.

CN 8315 (in step 6) uses a relocation command message to notify GANC 8310 to switch UE 8305 to GERAN, thus ending the handover preparation phase. GANC 8310 (in step 7) sends a GA-RRC HANDOVER COMMAND to UE 8305. This message includes the details of the target resource allocation sent by GERAN. The UE 8305 (in step 8) sends Um: handover access, which contains the handover reference element, allowing the target GERAN to associate this handover access with the handover command message previously sent to CN 8315 in response to the handover request message.

The target GERAN (in step 9) uses the handover detection message to confirm the detection of the handover to CN 8315 process. CN 8315 can switch the user plane to the target BSS = GERAN (in step 11) at this time (in step 10) to provide physical information (ie, Timing Advance) to UE 8305 to allow UE 8305 to communicate with GERAN Phase synchronization. The UE 8305 (in step 12) uses the handover complete message to notify the GERAN that the handover is complete.

200780032892.1 No.

GERAN (in step 13) confirms to CN 8315 that the handover is complete through a handover complete message. For the purpose of charging, CN8315 can use the target CGI used in the handover process. At this time (in step 14) two-way voice traffic is transmitted between UE 8305 and CN 8315 via GERAN.

After receiving the confirmation of the completion of the handover, CN 8315 (in step 15) instructs GANC 8310 to release all resources allocated to UE 8305 through the Iu release command. GANC 8310 (in step 16) uses the GA-RRC RELEASE message to order the UE 8305 to release resources. GANC 8310 (in step 17) uses Iu release complete message to confirm to CN 8315 the source of the resource&lt;

The UE 8305 (in step 18) uses the GA-RRC RELEASE COMPLETE message to confirm the release of the resources to the GANC 8310. The UE 8305 can finally (in step 19) use the GA-RC DEREGISTER message to deregister from the GANC 8310.

d) The CS handover from GAN to UTRAN The description of the process in this chapter assumes that the following conditions are true: (1) The UE is in a valid call using GAN; (2) The UE can operate in GAN mode, GERAN mode and UTRAN mode. Three modes work; (3) UTRAN becomes available, and (i) UE is in the preferred GERAN/UTRAN mode, or (ii) the UE mode is selected as preferred GAN, and according to its local measurement results and received RTCP reports, And any uplink quality indication received from the GANC starts to leave the GAN coverage area.

Figure 84 shows the CS handover process from GAN to UTRAN in some embodiments. The process of handover from GAN is always triggered by UE 8405. If there is a problem with the uplink quality for the ongoing call, GANC 8410 may (in step 1) send a GA-RRC UPLINK QUALITY INDICATION message. The uplink quality indicator is information sent by the GANC 8410 to the UE 8405, which indicates the intersection of the uplink quality threshold in the uplink direction. Whenever UE8405 receives an indication of poor quality, it should start the handover process, as described in the next step. Alternatively, the UE 8405 can use its local measurement result or the received RTCP report to determine whether to start the handover process.

The UE 8405 (in step 2) sends a GA-RRC HANDOVER INFORMATION message to the serving GANC 8410, and puts the received signal strength of each identified cell in the message. The GA-RRC HANDOVER INFORMATION message indicates the channel mode and the priority of switching Sorted list of candidate target UTRAN and GERAN cells. UTRAN cells are identified by PLMN ID, LAC, and 3G cell identity (defined in 3GPPTS 25.331).

If the service GANC 8410 selects UTRAN as the target RAT, perform handover to

200780032892.1 No.

UTRAN process. The service GANC 8410 informs the CN 8415 of the need for handover by (in step 3) the relocation request message and the UTRAN cell list provided by the UE 8405 in the message, and then starts the handover preparation. GANC 8410 can only put a subset of the cell list provided by UE 8405 in the message.

CN 8415 starts the handover process to the target RNC 8420 identified by the serving GANC 8410. CN 8415 (in step 4) uses a relocation request message to request the target RNC 8420 to allocate the necessary resources. The target RNC 8420 constructs a physical channel reconfiguration message that provides information about the allocated UTRAN resources. The target RNC 8420 also (in step 5) sends this message to the CN 8415 via a relocation request confirmation message.

CN 8415 (in step 6) uses a relocation command message (which includes a physical channel reconfiguration message) to notify the service GANC 8410 to switch the UE 8405 to UTRAN, thus ending the handover preparation phase. The service GANC 8410 (in step 7) sends a GA-RRC HANDOVER COMMAND message to the UE 8405, which includes the details of the target resource allocation sent by UTRAN.

The target RNS (in step 8) uses the Uu interface to achieve uplink synchronization. The target RNC 8420 (in step 9) uses the relocation detection message to confirm to CN 8415 that a handover to CN 8415 has been detected. CN 8415 can switch the user plane to the target RNS at this time (in step 10). The UE 8405 (in step 11) informs UTRAN that the handover is complete with a handover to UTRAN complete message.

UTRAN (in step 12) confirms the completion of the handover operation to CN 8415 through a relocation complete message. If the user plane is not switched in step 10, CN8415 will switch the user plane to the target RNSo. At this time, the two-way voice traffic (in step 13) is transmitted between UE 8405 and CN 8415 via UTRAN.

After receiving the confirmation that the handover has been completed, CN 8415 (in step 14) instructs the serving GANC 8410 to release all resources allocated to UE 8405 through the Iu release command. The serving GANC 8410 (in step 15) uses the GA-RRC RELEASE message to order the UE 8405 to release resources.

The service GANC 8410 (in step 16) uses the Iu Release Complete message to confirm the resource release to CN 8415. The UE 8405 (in step 17) uses the GA-RRC RELEASE COMPLETE message to confirm the resource release to the serving GANC 8410. The UE 8405 may finally (in step 18) use the GA-RC DEREGISTER message to deregister from the service GANC 8410.

200780032892.1 No.

9. GA-RRC packet transmission channel management process

The GA-RRC Packet Transport Channel (GA-RRC PTC) provides the connection between the UE and the network, so as to transmit GPRS user data through the Up interface (ie, through the GAN in the Iu mode). PTC uses the GTP-U protocol running on the UDP transport protocol. The PTC endpoint address is identified by the IP address and UDP port assigned to the UE and the PTC in the network during the PTC activation process. The UDP port number of GTP-U is as defined in 3GPP TS 25.414. The same endpoint address can be used to enable multiple PTC instances between the UE and the network at the same time. During the activation process, each PTC instance is assigned a unique GTP-U tunnel endpoint ID (one for the UE and one for the network). The UE and the GANC manage the activation and deactivation of the PTC instance based on the request for data transmission and a configurable PTC timer.

a) The state of the GA-RRC packet transmission channel. The UE in the GA-RRC-CONNECTED state can be in one of the two PTC sub-states, namely PTC-STANDBY or PTC-ACTIVE. PTC-STANDBY: This is the initial/default PTC sub-state of the UE when in the GA-RRC-CONNECTED state of the GAN mode. The UE cannot send GPRS user data to the network, nor can it receive such data from the network. Before sending any GPRS user data, the UE needs to enable PTCo. When the UE successfully establishes a PTC, the UE changes to the PTC-ACTIVE sub-state. PTC-ACTIVE: The UE is in the GA-RRC-CONNECTED state, and the PTC is valid between the UE and the network, and the UE can send GPRS user data to the network and receive GPRS user data from the network. The following are the possible situations that trigger GA-RRC PTC activation on the UE side: (1) UE starts uplink user data transmission, and (2) GANC starts the PTC activation process; that is, UE receives GA-RRC from GANC- ACTIV ATE-PTC-REQUEST message.

After successfully performing the PTC enabling operation and proceeding in parallel with the operation of transitioning to the PTC-ACTIVE sub-state, the UE starts the PTC timer. When the PTC timer expires, the UE sends a message to the GANC to start the PTC deactivation operation. After successfully performing the PTC deactivation operation, the UE transitions to the PTC-STANDBY sub-state. At any time during the GA-RRC-CONNECTED state and the PTCACTIVE sub-state, the UE can receive a GA-RRC RELEASE message. In addition to requesting to release the RRC session, this is also interpreted by the UE as an implicit PTC deactivation command. At any time during the GAN mode, if the serving RR entity is switched to GSMRR/JTRAN-RRC, GA-RRC disconnects from the GPRS SAP, and the UE enters GERAN/UTRAN mode. At the same time, the UE will release the relevant information regardless of the status of the PTC timer

200780032892.1 No. PTC. The UE GA-RRC entity maintains a PTC for each valid PDP context »Whenever any uplink user data packet related to the PDP context is sent or the downlink user data packet related to the PDP context is received, it is turned on again PTC timer. As part of the GAN registration process (ie, in the form of a GA-RC REGISTER ACCEPT message), the value of the PTC timer is provided to the UE.

b) PTC initial activation Figure 85 shows the initial activation process of the packet transmission channel of some embodiments. In some embodiments, the following description assumes that the UE 8505 is in the GA-RRC-IDLE state. (In step 1), perform the GA-RRC connection establishment process as described above in the section UE-initiated GA-RRC connection establishment process. UE 8505 transitions to U GA-RRC-CONNECTED state and PTC-STANDBY sub-state. (In step 2) Perform additional PS signaling procedures.

CN 8510 (SGSN) (in step 3) starts the RAB allocation process, and puts the RAE-ID of the user data, the CN transport layer address (IP address) and the CN Iu transmission link (GTP-U terminal) in the sent message Endpoint identifier TEID). GANC 8515 (in step 4) sends a GA-RRC ACTIVATE PTC REQUEST message to UE 8505 to request the activation of the packet transmission channel. The message includes RAE-ID, CN IP address, and TEID to allow UE 8505 to directly send PTC packets (ie, GTP-U message) to the SGSN.

(In step 5) UE 8505 confirms the activation of PTC and provides the transport layer address (IP address) and Iu transmission link (GTP-U TEID) of the UE side that identifies the PTC. The UE 8505 transitions to the PTC-ACTIVE sub-state and starts the PTC timer.

After receiving the confirmation message, GANC 8515 (in step 6) sends a RAB allocation response message to CN 8510 to complete the RAB allocation process, and puts the UE IP address and GTP-U TEID in the message »(in step 7 ) Perform an additional PS signaling process; examples of performing this process are described in the PDP context activation and network request PDP context activation subsections below. (In step 8) UE 8505 initiates uplink user data transmission through the established PTC, and CN 8510 (SGSN) can use the same transmission channel to send downlink user data packets.

c) PTC data transmission FIG. 86 shows the transmission of GPRS user data packets through the GAN packet transmission channel in some embodiments. If needed, (in step 1) GNPTC is established as specified above in Subsection VIII.B.9.b: "PTC Initiation Operation". After the GA-RRC PTC is established, the UE 8605 enters the PTC-ACTIVE sub-state and starts the PTC timer.

200780032892.1 (in step 2) UE 8605 starts the transmission operation of using the standard GTP-U protocol as defined in 3GPP TS 29.060 to transmit uplink user data packets, and restarts the PTC timer.

CN8615 (SGSN) (in step 3) uses the same PTC related to the specific PDP context to transmit downlink user data packets. Downlink user data packets are transmitted using the GTP-U protocol defined in 3GPP TS 29.060. After receiving the downlink data packet, the UE restarts the related PTC timer. (In step 4), additional uplink and downlink user data packets are transmitted through the same PTC as described in steps 2 and 3, respectively. After each transmission or reception operation, the UE 8605 restarts the PTC timer d) UE-initiated PTC deactivation operation FIG. 87 shows when the UE deactivates the packet transmission channel after the PTC timer expires in some embodiments Scene. UE 8705 (in step 1) is in GA-RRC-CONNECTED state and PTC-ACTIVE sub-state. The PTC timer associated with one of the valid packet transmission channels expires.

The UE 8705 (in step 2) sends a GA-RRC DEACTIVATE PTC REQUEST message to the GANC 8710, which includes the RAB-ID used to identify the PTC and indicates normal release as a reason for deactivation. (In step 3) GANC 8710 sends a RAB release request message to CN (SGSN) 8715 to request the related RAE to be released. (In step 4) CN (SGSN) 8715 responds with a RAB allocation request message indicating release.

(In step 5) GANC 8710 responds to UE 8705 with a GA-RRC DEACTIVATE PTC ACK message to confirm the successful deactivation. UE 8705 transitions to the PTC-STANDBY sub-state. (In step 6) GANC 8710 sends RAB allocation response message to inform SGSN 8715 that the RAB release process is complete.

e) UE-initiated PTC re-enablement FIG. 88 shows a scenario when the UE initiates the packet transmission channel re-enablement operation in some embodiments. The UE is in the GA-RRC-CONNECTED and PMM-CONNECTED states; for example, in some embodiments, there is a PS signaling connection and a valid PDP context between the UE 8805 and CN 8815, but the PTC was previously due to the expiration of the PTC timer It is disabled by UE 8805. UE 8805 is in GA-RRC-CONNECTED state and PTC-STANDBY sub-state. The UE 8805 is in the PMM-CONNECTED state (ie, there is a PS signaling connection and a valid PDP context).

The UE 8805 has PDUs that need to be sent. (In step 1) UE 8805 sends a service request message to GANC 8810 in the form of a GA-RRC UL DIRECT TRANSFER message (its service

200780032892.1 The value of the first type is data"). (In step 2) GANC 8810 uses RANAP to guide the transmission message to forward the service request to CN 8815 through the existing signaling connection.

CN 8815 can start the safe mode control process described in Subsection VIII. B.3: "Safe Mode Control" as needed (in step 3). CN 8815 (in step 4) responds with a service acceptance message. GANC 8810 (in step 5) forwards this message to UE8805.

(In step 6) UE 8805, GANC 8810 and CN 8815 establish GA-RRC packet transmission channel (PTC XUE The 8805 transitions to the PTC-ACTIVE sub-state and starts the PTC timer. The UE 8805 (in step 7) sends an uplink PDU. Additional data transmission is possible.

f) Network-initiated PTC deactivation FIG. 89 shows a scenario when the network initiates the deactivation operation of the packet transmission channel in some embodiments. UE8905 is in GA-RRC-CONNECTED state and PTC-ACTIVE sub-state.

Optionally, for example, due to the error handling process, the GANC 8910 can initiate the PTC deactivation process. If so, GANC 8910 (in step 1) sends a RAB release request message to CN 8915. CN (SGSN) 8915 (in step 2) sends an RAB allocation request message to request that the related RAB be released. The release request may involve one or more RABs.

(In step 3) GANC 8910 requests the deactivation of related GA-RRC PTC by sending a GA-RRC DEACTIVATE PTC REQUEST message to UE 8905. UE 8905 transitions to the PTC-STANDBY sub-state, stops the PTC timer, and (in step 4) sends back an acknowledgement to GANC 8910. Repeat steps 3 and 4 for each additional RAB/PTC that needs to be released. (In step 5) GANC 8910 informs CN (SGSN) 8915 that the release has been successful.

g) Network-initiated PTC re-enablement FIG. 90 shows a scenario when the network-initiated re-enablement of the packet transmission channel in some embodiments. The UE 9005 is in the GA-RRC-CONNECTED and PMM-CONNECTED states; for example, in some embodiments, there is a PS signaling connection and a valid PDP context between the UE and the CN, but the PTC was previously disabled. UE 9005 is in GA-RRC-CONNECTED state and PTC-STANDBY sub-state. The UE 9005 is in the PMM-CONNECTED state (that is, there is a PS signaling connection and a valid PDP context).

CN 9015 has PDUs that need to be sent to UE 9005. CN 9015 can start the above sub-chapter VIII.B.3 as needed (in step 1):^uThe safe mode control process described in "Safe Mode Control". As described above in subsection VIII.B.9.b: "PTC Initial Activation" in steps 3-6

200780032892.1 First, UE 9005, GANC 9010 and CN 9015 (in step 2) establish a GA-RRC packet transmission channel (PTC). UE 9005 transitions to the PTC-ACTIVE sub-state and starts the PTC timer. CN9015 (in step 3) sends a downlink PDU. Additional data transfers can occur.

h) Implicit PTC deactivation process due to UE deregistration FIG. 96 shows a process regarding implicit PTC deactivation in some embodiments. As part of the GAN de-registration process, the GANC needs to release all the resources allocated to the UE9605. If it is detected that the signaling connection has been lost, the UE 9605 can explicitly or the GANC 9610 implicitly initiate the GAN de-registration process. Initially, one or more GA-RRC PTCs related to UE 9605 are in PTC-ACTIVE state.

(In step 1) Either UE9605 or GANC 9610 initiates the GAN de-registration process for UE 9605. Optionally, (in step 2) release any remaining resources related to the CS domain. Optionally, if there are any resources related to the PS domain that still exist, GANC 9610 (in step 3) initiates the Iu release process to release the corresponding RAB» CN (SGSN) 9615 (in step 4) release with Iu The command responds. After receiving the Iu release command, GANC 9610 (in step 5) locally disables all relevant PTCs, and (in step 6) responds to the core network (SGSN) 9615 with an Iu release complete message.

10. PDP context activation FIG. 91 illustrates a UE-initiated PDP context activation process that is successfully performed under the assumption that the UE is in the GA-RRC-IDLE mode in some embodiments. (In step 1) The GA-RRC connection establishment process is performed as described in the GA-RRC connection establishment process initiated by the UE in the sub-chapter. If the GA-RRC connection already exists (for example, there is an ongoing CS call), skip this step.

When there is a request from the upper layer, the UE 9105 (in step 2) sends a service request message (its service type value is "signaling") to the GANC 9110 in the form of a GA-RRC INITIAL DIRECT TRANSFER message. GANC 9110 establishes an SCCP connection to CN 9115, and (in step 3) forwards the service request to CN9115 with a RANAP initial UE message. The subsequent NAS messages between the UE9105 and the core network 9115 will be sent between the GANC 9110 and CN9115 using the RANAP guided transmission message.

CN 9115 (in step 4) may use standard UTRAN authentication procedures to authenticate UE 9105 as needed. CN 9115 (in step 5) can start the safe mode control process described above in subsection VIIIB3: "safe mode control" as needed.

200780032892.1 The first (in step 6) CN (SGSN) 9115 responds with a service acceptance message. GANC 9110 (in step 6) forwards the message to UE 9105. UE 9105 (in step 7) sends a PDP context enable request message to CN9115, which provides details about the PDP context. This message is contained in the GA-RRC UL DIRECT TRANSFER message transmitted between UE 9105 and GANC 9110. GANC 9110 (in step 7) forwards the PDP context activation request message to CN9115» As described above in sub-section VIII.B.9.b: "PTC initial activation" in steps 3-6, UE9105, GANC 9110 and CN9115 (in step 8) establish a GA-RRC packet transmission channel (PTC). (in step 9) CN 9115 uses the Enable PDP Context Accept message to indicate to GANC 9110 that the PDP context establishment process is complete. GANC (in step 9) forwards this message to UE 9105 in the form of a GA-RRC DL DIRECT TRANSFER message. (In step 10) UE 9105 and CN9115 exchange user data through the established PTC.

11. Network-requested PDP context activation FIG. 92 illustrates a successful network-requested PDP context activation process assuming that the UE is in the GA-RRC-IDLE mode in some embodiments. Initially, CN (SGSN) 9215 receives the downlink user data to be transmitted to the UE, and the related RAB has not been established. The UE is in the PMM-IDLE state.

(In step 1) CN (SGSN) 9215 sends a RANAP paging message to UE 9205 via GANC 9210 to locate the user. The paging request indicates a paging for PS domain signaling. (In step 2) GANC 9210 forwards the paging information to UE 9205 in the form of a GA-RRC PAGING REQUEST message.

(In step 3) UE 9205 responds to SGSN 9215 with a service request message (service type value is "Paging Response") through GANC 9210. This message is encapsulated in the GA-RRC INITIAL DIRECT TRANSFER message. GANC 9210 (in step 4) forwards the service request message encapsulated in the RANAP initial UE message to SGSN 9215.

(In step 5) CN 9215 can use standard UTRAN authentication process to authenticate UE 9205 as needed. CN 9215 can start the safe mode control process described above in subsection VIII.B.3: Safe mode control as needed (in step 6).

(In step 7) CN 9215 sends a request PDP context activation message to GANC 9210.

(In step 7) GANC 9210 forwards this message to UE 9205 in the form of a GA-RRC DL DIRECT TRANSFER message.

100

200780032892.1 No.

UE9205 (in step 8) sends a PDP Context Enable Request message to CN 9215, which provides details about the PDP context. This message is contained in the GA- RRC UL DIRECT TRANSFER message transmitted between UE 9205 and GANC 9210. GANC (in step 8) forwards the PDP context enable request message to CN9215. As above in sub-chapter VIII.B.9.b:

As described in steps 3 to 6 of "PTC initial activation", UE9205, GANC 9210 and CN 9215 (in step 9) establish a GA-RRC packet transmission channel (PTC).

CN9215 (in step 10) uses the Enable PDP Context Accept message to indicate to GANC 9210 that the PDP context establishment process is complete. GANC (in step 10) forwards this message to UE 9205 in the form of a GA-RRC DL DIRECT TRANSFER message. UE 9205 and CN 9215 (in step 11) exchange user data through the established PTC.

12. Utilize a valid CS session for PDP context activation. FIG. 93 shows the successful PDP context activation process initiated by the UE under the assumption that the UE 9305 is in the GA-RRC-CONNECTED mode (for example, there is a CS session) in some embodiments. . As described above in the GA-RRC connection establishment procedure initiated by the UE in sections, the GA-RRC connection establishment procedure is performed. If there is already a GA-RRC connection (for example, there is an ongoing CS call), skip this step.

When there is a request from the upper layer, UE 9305 (in step 1) sends a service request message (its service type value is "signaling") in the form of a GA-RRC INITIAL DIRECT TRANSFER message to GANC9130H in step 2) GANC9310 Establish the SCCP connection to CN9315, and use the RANAP initial UE message to forward the service request to the CN. The subsequent NAS messages between the UE 9305 and the core network 9315 will be sent between the GANC 9310 and CN9315 using the RANAP guided transfer message.

CN 9315 (in step 3) can use the standard UTRAN authentication process to authenticate UE9305 as needed» CN 9315 (in step 4) can be activated as needed in sub-chapter VIII.B.3: ^&lt;£The safe mode control process described in Safe Mode Control.

(In step 5) CN (SGSN) 9315 responds with a service acceptance message. GANC 9310 (in step 5) forwards the message to UE 9305_o The UE 9305 (in step 6) sends a PDP Context Enable Request message to CN9315, which provides details about the PDP context. This message is contained in the GA-RRC UL DIRECT TRANSFER message transmitted between UE 9305 and GANC 9310. GANC (in step 6) forwards the PDP Context Enable Request message to CN 9315ο

101

200780032892.1 As described above in steps 3-6 in subsection VIII.B.9.b: "PTC initial activation", UE 9305, GANC 9310 and CN 9315 (in step 7) establish GA-RRC grouping Transmission channel (PTC). (In step 8) CN 9315 uses the Enable PDP Context Accept message to indicate to GANC 9310 that the PDP context establishment process is complete. GANC (in step 8) forwards this message to UE 9305 in the form of a GA-RRC DL DIRECT TRANSFER message. (In step 9) UE 9305 and CN 9315 exchange user data through the established PTC.

13. SRNS relocation is a UE in the PMM-CONNECTED state to perform a serving RNS relocation process to connect the RAN connection point from the old RNC to the new RNC. The following two scenarios will be considered: (1) SRNS relocation from RNC to GANC; that is, from UTRAN to GAN, and (2) SRNS relocation from GANC to RNC; that is, from GAN to UTRAN. Depending on the support for the Iur interface and lossless SRNS relocation, these procedures include several options. Assume that in this version of the GAN specification, the Iur interface is not supported. In addition, it is assumed that in order to optimize data transmission, the PDCP protocol is not included in the GAN solution, and it is assumed that lossless SRNS relocation is not supported.

a) SRNS relocation from UTRAN to GAN FIG. 94 shows the SRNS relocation process from UTRAN to GAN for the UE in the PMM connected state in some embodiments. It is assumed that the Iur interface and the lossless SRNS relocation process are not supported. Initially, the UE 9405 has registered for the GAN service and is in the PMM connection state. At least one PDP context is valid, and its maximum bit rate is greater than zero.

After detecting the GAN coverage area and successfully registering for the GAN service, the UE 9405 (in step 1) sends a measurement report to the RNC 9410 to indicate the highest signal level for the GAN cell. RNC 9410 (in step 2) sends a relocation request message to the core network (SGSN) 9420 to initiate the SRNS relocation process. This message indicates GANC 9415 as the target RNC 9410 and includes information necessary for relocation coordination.

The core network (SGSN) 9420 (in step 3) forwards this request to GANC 9415. The message includes a list of RABs that need to be set and related information. According to the relocation request message, as defined in the GA-RRC packet transmission channel management process subsection above, CN 9420 and GANC 9415 (in step 4) establish the requested RAB and related PS transmission channel.

(In step 5) GANC 9415 responds to the core network 9420 with a confirmation, which includes the transport container (Transport Container) from the target RNC 9410 to the source RNC. (In step 6) The core network (SGSN) 9420 performs relocation by sending a relocation command to the old RNC,

102

200780032892.1 This relocation command includes the transfer container from the target RNC to the source RNC.

(In step 7) RNC 9410 starts forwarding data to UE 9405 for RAB to undergo forwarding. The forwarding is only performed for the downlink user data, and the forwarding operation is based on the transport layer address received from the GANC 9415 and the Iu transmission link.

RNC 9410 (in step 8) sends a PHYSICAL CHANNEL RECONFIGURATION message to UE 9405 to initiate the relocation operation to the GAN. The RNC 9410 forwards the SRNS context information to the GANC 9415 via the core network (SGSN) 9420 (in step 9) to continue the relocation operation. (In step 10) the core network (SGNS) 9420 forwards the SRNS context to GANC 9415. GANC 9415 (in step 11) responds with a relocation detection message.

(In step 12) UE 9405 sends a GA-RRC relocation complete message to GANC 9415 to indicate that the relocation was successfully performed. (In step 13) GANC 9415 sends a relocation complete message to the core network (SGSN) 9420 to complete the process.

After receiving the relocation complete message, the core network (SGSN) 9420 switches the user plane from the RNC 9410 to the GANC (UE), and (in step 14) starts the Iu release process to the RNC 9410. After the data forwarding timer expires and the related resources are released, the RNC 9410 (in step 15) responds to the core network (SGSN) 9420 with an Iu release complete message.

14. Short Message Service

GAN provides support for circuit switched and packet switched SMS services. A UE connected to GAN and supporting GPRS can send and receive SMS messages via GAN.

a) SMS based on CS

The mechanism based on the SMS support of CS in GAN is the same as the mechanism used for CS mobility management and call control. On the UE side, the SMS layer (including the function of supporting the CM sublayer) uses the services of the MM layer to transmit SMS messages in accordance with the standard circuit-switched UMTS implementation. By using the GA-RRC message from the UE to the GANC, the SM-CP protocol can be effectively encapsulated (tunnel) between the UE and the CN, where GANC relays the SM-CP to RANAP message for transmission using the Iu-cs interface . Due to the mobility management and call control process, secure IPSec tunnels and TCP sessions are used for secure and reliable SMS delivery over IP networks.

2. PS-based SMS The PS-based SMS messaging is based on the same mechanism as the PS mobility management and session management signaling message. On the UE side, the SMS layer (including the supported CM sublayer

103

200780032892.1 function) Use the services of the RRC layer (that is, the GA-RRC layer) to deliver SMS messages in accordance with the standard packet-switched UMTS implementation. With mobility management and session management signaling, secure IPSec tunnels and TCP sessions are used for secure and reliable PS-based SMS delivery over IP networks.

IX. Computer System FIG. 95 schematically shows a computer system utilized to implement some embodiments of the present invention. The computer system 9500 includes: a bus 9505, a processor 9510, a system memory 9515, a read-only memory 9520, a permanent storage device 9525, an input device 9530, and an output device 9535.

The bus 9505 generally represents all systems, peripheral devices, and chipset buses that support communication between the internal devices of the computer system 9500. For example, the bus 9505 communicably connects the processor 9510 with the read-only memory 9520, the system memory 9515, and the permanent storage device 9525.

In order to execute various processes of the present invention, the processor obtains instructions to be executed and data to be processed from these various memory units. In some embodiments, the processor includes a field programmable gate array (FPGA), ASIC, or various other electronic components for executing instructions. Read only memory (ROM) 9520 stores static data and instructions required by the processor 9510 and other modules of the computer system. On the other hand, the permanent storage device 9525 is a read-write memory device. This device is a non-volatile memory unit that stores instructions and data even when the computer system 9500 is turned off. Some embodiments of the present invention utilize a mass storage device (such as a magnetic disk or optical disc and its corresponding drive) as the permanent storage device 9525. Some embodiments utilize one or more removable storage devices (flash cards or flash sticks) as permanent storage devices.

Like the permanent storage device 9525, the system memory 9515 is a read-write memory device. However, unlike the storage device 9525, the system memory is a volatile read-write memory, such as a random access memory. The system memory stores part of the instructions and data required by the processor at runtime.

Instructions and/or data required to perform processing in some embodiments are stored in the system memory 9515, the permanent storage device 9525, the read-only memory 9520, or a combination of the three. For example, according to some embodiments, various memory units contain instructions for processing multimedia information. In order to perform processing in some embodiments, the processor 9510 obtains instructions to be executed and data to be processed from these various processors.

The bus 9505 is also connected to the input device 9530 and the output device 9535. The input device enables the user to transmit information to the computer system and select commands to be input into the computer system. Input device

104

200780032892.1 No.

9530 includes alphanumeric keyboards and cursor controller. The output device 9535 displays images generated by the computer system. Output devices include printers and display devices, such as cathode ray tube (CRT) displays or liquid crystal displays (LCD)_oFinally, as shown in Figure 95, the bus 9505 also connects the computer 9500 to the network 9565 through a network adapter (not shown). In this way, the computer may become part of a computer network (such as a local area network ("LAN"), a wide area network ("WAN"), or an intranet), or one of multiple networks (such as the Internet).

Those of ordinary skill in the art will understand that any or all of the components of the computer system 9500 can be used with the present invention. For example, some components or all components of the computer system described with reference to FIG. 95 include some specific forms of UE, FAP, GANC, and other devices described above. In addition, those of ordinary skill in the art should also understand that any other system configuration can also be used with the present invention or the components of the present invention.

X. Definitions and abbreviations The following is a list of definitions and abbreviations used in this article

<td>AAA</td><td>Authentication, Authorization and Accounting</td>

<td>AKA</td><td>Authentication and Key Agreement</td>

<td>AP</td><td>Access Point</td>

<td>AS</td><td>Access Stratum</td>

<td>BSC</td><td>Base Station Controller</td>

<td>BSS</td><td>Base Station Subsystem (Base Station Subsystem)</td>

<td>BSSGP</td><td>Base Station System GPRS Protocol (Base Station System GPRS Protocol)</td>

<td>BSSMAP</td><td>Base Station System Management Application Part (Base Station System Management Application Part)</td>

<td>CC</td><td>Call Control</td>

<td>CGI</td><td>Cell Global Identification</td>

<td>CM</td><td>Connection Management</td>

<td>CN</td><td>Core Network</td>

<td>CS</td><td>Circuit Switched</td>

<td>CTM</td><td>Cellular Text Telephone Modem</td>

<td>DNS</td><td>Domain Name System (Domain Name System)</td>

<td>DTM</td><td>Dual Transfer Mode (Dual Transfer Mode)</td>

105

200780032892.1 No.

ΕΑΡ

GA-CSR

GA-PSR

GA-RC

GAN

GANC

ETSI

FCC

FQDN

GAD

GERAN

GGSN

GMM/SM

GPRS

GSM

GSN

HLR

HPLMN

IETF

IKE

IKEv2

IMEISV

IMSI

IP

LA

LAI Extensible Authentication Protocol Generic Access-Circuit Switched Resources (Generic Access-Circuit Switched Resources) Generic Access-Packet Switched Resources (Generic Access-Packet Switched Resources) Generic Access-Resource Control (Generic Access- Resource Control) Generic Access Network (Generic Access Network) Generic Access Network Controller (European Telecommunications Standards Institute) U.S. Federal Communications Commission (US Federal Communications Commission) Full domain name (Fully) Qualified Domain Name) Geographical Area Description

GSM EDGE Radio Access Network (GSM EDGE Radio Access Network) Gateway GPRS Support Node (Gateway GPRS Support Node)

GPRS Mobility Management and Session Management (GPRS Mobility Management and Session Management) General Packet Radio Service (General Packet Radio Service) Global System for Mobile Communications (Global System for Mobile communications) GPRS Support Node (GPRS Support Node) Home Location Register (Home Location) Register) Belonging to PLMN (Home PLMN) Internet Engineering Task Force (Internet Engineering Task Force) Internet Key Exchange (Internet Key Exchange)

IKE Version 2 (IKE Version 2) International Mobile Station Equipment Identity and Software Version number (International Mobile Station Equipment Identity and Software Version number) International Mobile Subscriber Identity (International Mobile Subscriber Identity) Internet Protocol (Internet Protocol) Location Area Location Area Identity

106

200780032892.1 No.

LLC

MAC

MAC

MM

MS

MSC

MTP1

MTP2

MTP3

NAS

PDP

PDU

PLMN

PSAP

PSTN

P-TMSI

QoS

RA

RAC

RAI

RAT

RLC

RNC

RNS

RTCP

RTP

SCCP

SEGW

SGSN Logical Link Control (Logical Link Control) Medium Access Control (Message Authentication Code) Mobility Management (Mobile Station) Mobile Switching Center (Mobile Switching Center) Message Transmission Part of the first layer (Message Transfer Part layer 1) Message Transfer Part layer 2 (Message Transfer Part layer 2) Message Transfer Part layer 3 (Message Transfer Part layer 3) Non-Access Stratum (Non-Access Stratum) Packet Data Protocol (Packet Data Protocol) Protocol Data Unit (Public Land Mobile Network) Public Safety Answering Point-PSAP is an emergency service network unit responsible for answering emergency calls (Public Safety Answering Point-A PSAP) is an emergency services network element that is responsible for answering emergency calls) Public Switched Telephone Network (Public Switched Telephone Network) Packet-TMSI (Packet-TMSI) Quality of Service (Routing Area) Routing Area Code (Routing) Area Code) Routing Area Identity (Routing Area Identity) Radio Access Technology (Radio Access Technology) Radio Link Control (Radio Link Control) Radio Network Controller (Radio Network Controller) Radio Network Subsystem (Radio Network Subsystem) Real-time Control Protocol (Real Time Control Protocol) Real Time Protocol (Signaling Connection Control Part) Security Gateway (SEcurity GateWay) Serving GPRS Support Node (Serving GPRS Support Node)

107

200780032892.1 No.

<td>SIMSMLCSMSSNDCP</td><td>Subscriber Identity Module (Subscriber Identity Module) Service Mobile Location Center (Serving Mobile Location Center) Short Message Service (Short Message Service) and Sub-Network Dependent Convergence Protocol (Sub-Network Dependent Convergence Protocol)</td>

<td>TBFTCTCPTFOTMSITrFOTTYUEUDPUMTSUTPvAN</td><td>Temporary Block Flow (Transport Channel) Transmission Control Protocol (Tandem Free Operation) Temporary Mobile Subscriber Identity (Temporary Mobile Subscriber Identity) Operation without Transcoder ( Transcoder Free Operation) Text Telephone or Telex (Text Telephone or TeletYpewriter) User Equipment (User Equipment) User Datagram Protocol (User Datagram Protocol) Universal Mobile Telecommunication System UMTS Terrestrial Radio Access Network (UMTS terrestrial) Radio Access Network)</td>

<td>Up</td><td>Up is the interface between UE and GANC (Up is the Interface between UE and GANC)</td>

<td>VLRVPLMN</td><td>Visited Location Register (Visited Public Land Mobile Network)</td>

Although the present invention has been described with reference to many specific details, those of ordinary skill in the art will recognize that the present invention can also be implemented in other specific forms without departing from the spirit of the present invention. For example, the specific sequence of the described process and its related attributes can be modified. In this way, those of ordinary skill in the art will understand that the present invention is not limited by the foregoing illustrative details, but is defined by the appended claims.

108

200780032892.1