Femtocell integration into the macro network

First

Cross-reference of Femtocell to related applications for integration in the macro network This application claims the priority of the following patent applications: filed on February 26, 2007 entitled

Methods for Unauthorized User Equipment Rejection as a Component of the Generic Access to the Iu Interface for Femtocells^,J U.S. Provisional Patent Application 60/891,583; Filed on March 2, 2007, entitled Methods For Cell Planning as a Component of the Generic Access to the IU Interface for Femtocells, U.S. Provisional Patent Application 60/892,800; July 13, 2007 U.S. provisional patent application 60/949,826 filed on August 17, 2007, entitled Generic Access to the Iu Interface; and U.S. provisional patent application 60/956,669 filed on August 17, 2007, entitled Femtocell Integration Into the Macro Network. The content of the patent application is incorporated herein by reference.

TECHNICAL FIELD The present invention relates to telecommunications. More specifically, the present invention relates to a technology for seamlessly integrating voice and data telecommunication services in a licensed wireless system (licensed wireless system), an unlicensed wireless system (unlicensed wireless system), and a general access network such as the Internet.

Background Art Authorized wireless systems provide mobile wireless communications for individuals using wireless transceivers. An authorized wireless system refers to a public cellular telephone system and/or a personal communication service (PCS) telephone system. Wireless transceivers include cellular phones, PCS phones, personal digital assistants with wireless functions, and wireless modems.

Authorize wireless systems to use government-licensed wireless signal frequencies. In order to obtain the right to use these frequencies, high fees must be paid. To support communications on licensed frequencies, expensive base station (BS) equipment is used. Base stations (e.g., cell towers in a cellular network) are usually installed about one mile apart from each other. The wireless transmission mechanism and frequency adopted by a typical authorized wireless system limit the data transmission rate and range. As a result, the quality of service (voice quality and data transfer speed) in authorized wireless systems is far inferior to that provided by landline (wired) connections. In this way, authorized wireless system

200880005462.5 No. users pay relatively high fees for relatively low-quality services.

The land line (wired) connection has a wide deployment range and usually provides higher-quality voice and higher-speed data services at a lower cost. The problem with land line connection is that it limits the mobility of users. Traditionally, a physical connection to the land line is required.

In recent years, the technology of using unlicensed wireless communication systems to facilitate mobile access to networks based on land lines has been rapidly developed. For example, such an unlicensed wireless system can support wireless communication based on the IEEE 802.11a, b, or g standard (WiFi) or the Bluetooth® standard. The range of movement associated with such systems is usually about 100 meters or less. A typical unlicensed wireless communication system includes a base station, which includes a wireless access point (AP), which has a physical connection to a land-based network (for example, coaxial cable, twisted pair, or optical cable) . AP. It has an RF transceiver to communicate with wireless handsets working within a moderate distance from the AP. The data transmission rate supported by WiFi and Bluetooth@ standards is much higher than the data transmission rate supported by the above-mentioned authorized wireless system . Therefore, this approach provides a higher quality service at a lower cost, but this service only extends to a moderate distance from the base station.

However, in order to communicate seamlessly in both an unauthorized system and an authorized system, such an unauthorized wireless communication system requires improved user equipment or dual-mode user equipment. Therefore, there is a need to provide the benefits of low cost and quality of service of an unauthorized wireless system without changing the user equipment. Therefore, technologies are being developed to integrate short-range authorized wireless base stations that emulate components of authorized wireless systems with authorized wireless systems in a seamless manner. This seamless integration should enable the user to access the short-range authorized wireless system (ie, femtocell system) via a single handset (ie, user equipment) when within the range of such a system, and the user authorized the wireless system at a short distance It is possible to access authorized wireless systems via a single handset when outside.

In order to perform this integration, it is necessary to share the limited authorized wireless system resources and some multiple messaging functions required to communicate with the authorized wireless system. Therefore, there is a need for a solution that can overcome the problem of limited resources available. In addition, when implementing this solution, there should be no need to change the user equipment used to access the network, nor the various components of the network itself, so as to provide a completely transparent integrated communication system.

SUMMARY OF THE INVENTION Some embodiments of the present invention provide a communication system including a first communication network, a second communication network, and a core network, wherein the core network is communicatively coupled to the first and second communication networks. The second communication network includes the network

200880005462.5 The first network controller and a group of two or more access areas, which are communicatively coupled to the core network by the network controller. Some embodiments provide a method for receiving a first area identifier associated with a first access area of a first communication network from a user equipment (UE) in a specific access area of a second communication network. Before a connection is formed between the UE and the core network, the second area identifier is sent to the core network. The second area identifier represents a group of two or more area identifiers of the group of two or more access areas of the second communication network.

Some embodiments also include an access point for establishing an access area of the second communication network. In some such embodiments, the access point receives a message with a first area identifier that identifies the access area established by the access point. The access point replaces the first area identifier with the second area identifier, and passes the message to the network controller for routing operations to the core network.

Within the communication system, some embodiments provide methods for receiving requests from UEs. The request is used to access the second network through a specific access area of the second network. Some such embodiments determine whether the UE is authorized to access the second network through the specific access area. If the IE is not authorized to access the second network through the specific access area, some embodiments repeatedly deliver a set of messages to the UE, so that the UE stops requesting the service of accessing the second network.

Some embodiments provide a method for receiving a request from a UE for accessing a second network through a specific access area of the second network. The specific access area has an associated area identifier. Some embodiments determine whether the UE is authorized to access the second network through the specific access area. If the UE is not authorized to access the second network through the specific access area, some embodiments pass a message to restrict the UE from accessing any access area that specifies the area identifier associated with the specific access area .

BRIEF DESCRIPTION OF THE DRAWINGS The novel features of the invention are set forth in the appended claims. However, for the sake of explanation, several embodiments of the present invention are shown in the following drawings.

Fig. 1 shows the structure of an integrated communication system (ICS) and the basic elements of a femtocell system according to some embodiments of the present invention.

Figure 2 shows the various components of the macro network involved in the execution of mobility management.

Figure 3 shows the identifier used when communicating between the macro network and the core network.

Figure 4 shows the transparent operation of multiple FAPs of the femtocell system within the location area (LA) of the macro network.

200880005462.5 The processing in Figure 5 conceptually shows several operations performed by the FAP to realize the conversion from the local LAC to the super LAC when the UE roams into the coverage area of the FAP.

The process of FIG. 6 conceptually shows several operations performed by the GANC in order to implement the translation of the local LAC to the super LAC in combination with the process of FIG. 5.

Fig. 7 shows the conversion process from local LAC to super LAC combining Fig. 5 and Fig. 6.

Figure 8 shows subsequent message exchanges between multiple UEs and multiple core networks through the femtocell system after the UE has successfully camped on the FAP of the femtocell system.

The process of FIG. 9 conceptually shows several operations performed by INC of GANC for logical allocation of super LAC.

Figure 10 shows an open access mode FAPo according to some embodiments of the present invention. Figure 11 shows a closed access mode FAP according to some embodiments of the present invention.

Figure 12 shows a closed access mode FAP that allows access to unauthorized users trying to establish emergency service requests.

The process of FIG. 13 conceptually shows several operations performed in order to reject an unlicensed UE while ensuring that such rejection will not affect any other authorized FAP UE services.

The process of FIG. 14 conceptually illustrates several operations performed by the GANC in order to reject an unlicensed UE and prevent the UE from attempting to reconnect to a specific FAP in the future.

The process of FIG. 15 conceptually illustrates several processes performed by the GANC in order to reject an unauthorized UE using authentication-based UE rejection.

Figure 16 conceptually illustrates a computer system used to implement some embodiments.

DETAILED DESCRIPTION In the following detailed description of the present invention, many details, examples and embodiments of the present invention are presented and described. However, it is clear and obvious to those skilled in the art that the implementation of the present invention is not limited to the embodiments described herein, and it can also be implemented without using some of the specific details and examples discussed. Realize the present invention.

Some embodiments of the present invention provide a communication system including a first communication network, a second communication network, and a core network communicably coupled with the first and second communication networks. The second communication network includes a network controller and a set of two or more access areas, and these access areas are communicatively coupled to the core network through the network controller. Some embodiments provide a method for receiving a first connection with a first communication network from a user equipment (UE) in a specific access area of a second communication network.

200880005462.5 The method of the first area identifier associated with the first entry area. Before a connection is formed between the UE and the core network, the second area identifier is sent to the core network. The second area identifier represents a set of two or more area identifiers of the set of two or more access areas of the second communication network.

Some embodiments further include an access point for establishing an access area of the second communication network. In some such embodiments, the access point receives a message with a first area identifier that identifies the access area established by the access point. The access point replaces the first area identifier with the second area identifier, and passes the message to the network control for pathfinding to the core network.

Within the communication system, some embodiments provide a method for receiving a request from a UE. The request is a request for accessing the second network through a specific access area of the second network. Some such embodiments determine whether the UE is authorized to access the second network through the specific access area. If the UE is not authorized to access the second network through the specific access area, some embodiments repeatedly deliver a set of messages to the UE, so that the UE stops requesting services for accessing the second network.

Some embodiments provide a method for receiving a request from a UE to access a second network through a specific access area of the second network. The specific access area has an associated area identifier. Some embodiments determine whether the UE is authorized to access the second network through the specific access area. If the UE is not authorized to access the second network through the specific access area, some embodiments pass a message to restrict the UE from accessing any access area that specifies the area identifier associated with the specific access area.

Several more specific embodiments of the invention are described in the following sections. Chapter I describes the entire integrated communication system (ICS) incorporating some embodiments, and includes a discussion of the system structure of the femtocell system. Next, Section II describes the mobility management functions of femtocells in some embodiments. Femtocell service access control is discussed in Chapter III. After that, Section IV describes the computer system used in implementing some embodiments of the present invention. Finally, Appendix I shows a list of abbreviations used in this article.

I. System architecture

A. Overview of the architecture of the system FIG. 1 shows an integrated communication system (ICS) architecture 100 according to some embodiments of the present invention. The ICS architecture 100 enables the user equipment (UE) 105 to access the voice and data network 125 through (1) the authorized air interface 106 or through (2) the ICS access interface 107. The ICS access interface 107 connects the UE 105 to the wireless femtocell system 117. The wireless femtocell system 117 includes a low-power femtocell 160, and the low-power femtocell 160 then accesses the network through a general IP

200880005462.5 No.

115 communicatively couples UE 105 to GANC 110. Alternatively, the UE 105 accesses various components of the core network (CN) 125 through the femtocell system 117. More specifically, the communication session between the UE 105 and the endpoint is established by the various components of the CN 125. In some embodiments, the communication session conducted through any one interface includes voice service, data service, or both services.

The core network 125 includes one or more home location registers (HLR) and a database 175 for user authentication and authorization. Once authorized, the UE 105 can access the voice and data services of the core network 125. To provide such services, the core network 125 includes a mobile switching center (MSC) 130 for providing access to voice services. The data service is provided through a combination of the service GPRS (General Packet Radio Service) Support Section A (SGSN) 135 and a gateway such as a Gateway GPRS Support Node (GGSN) (not shown).

The SGSN 135 is generally responsible for transferring data packets from the GGSN and user equipment in the geographic service area of the SGSN 135, and transfers data packets to the GGSN and user equipment in the geographic service area of the SGSN 135. In addition, the SGSN 135 may perform functions such as mobility management, storing user profiles, and storing location information. However, the actual interface from the core network 125 to various external data packet service networks (for example, the public Internet) is implemented by the GGSN. Because data packets originating from user equipment are usually not structured into the format used when accessing external data networks, the task of GGSN is to act as a gateway into this packet service network.

In the illustrated embodiment, the authorized wireless network represents a common component of a cellular network based on the UMTS Terrestrial Radio Access Network (UTRAN). This cellular network includes a plurality of nodes called Node B 180 (for the sake of brevity, the figure Only one Node B) is shown in the base station, and Node B implements wireless communication services for each user equipment 105 via each user equipment 105's authorized radio link 106 (for example, a radio link using a radio frequency within the authorized bandwidth) . However, those of ordinary skill in the art will recognize that, in some embodiments, authorized wireless networks may include other authorized wireless networks, such as GSM/GPRS, GERAN, etc. (just to name a few).

The authorized wireless channel 106 may include any protocol with a specified UTRAN or base station subsystem (BSS) interface protocol for voice/data networks (for example, Iu-cs and Iu-ps interfaces for UTRAN, or A and Gb for GSM). Interface) authorized wireless service. UTRAN 190 generally includes at least one Node B 180 and a radio network controller (RNC) 185 for managing the collection of Node B 180. Generally, multiple Node Bs 180 are configured in a cellular configuration covering a wide service area (one for each cell). These components of the Node Bλ Radio Access Network (RAN) can also be called macro

200880005462. 5th network (MN), and provide UE with a communication interface to access the core network (CN). It is obvious to a person of ordinary skill in the art that, according to the scope of these components, these components can be referred to as a pico network or a pico network.

Each RNC 185 communicates with various components of the core network 125 through a standard radio network controller interface such as the Iu-cs interface and the Iu-ps interface shown in FIG. 1. For example, the RNC 185 communicates with the MSC 130 through the UTRAN Iu-cs interface for circuit-switched voice services. In addition, the RNC 185 communicates with the SGSN 135 through the UTRAN Iu-ps interface for packet data services. In addition, those of ordinary skill in the art will recognize that in some embodiments, other networks with other standard interfaces may be applied. For example, replacing the RNC 185 in the GSM/GPRS network with a base station controller (BSC), the BSC transmits voice to the MSC 130 via the A interface, and the BSC transmits data to the SGSN 135 via the Gb interface of the GSM/GPRS network.

In some embodiments of the ICS architecture 100, the user equipment 105 is connected to the core network (CN) 125 via a second communication network, which is controlled by the ICS access interface 107 and the general access network of the femtocell system 117 (GANC) 110 (also known as Global Network Controller or UNC). In some embodiments, voice and data services through the ICS access interface 107 are implemented via a femtocell access point (FAP) 160 that is communicatively coupled to the broadband IP network 115. The FAP 160 creates a femtocell system access area for implementing short-range authorized wireless communication sessions. The working process of this short-range authorized wireless communication session is independent of the authorized communication session 106. In the case of the femtocell system 117, the UE 105 passes through the FAP 160 The created short-range authorized wireless network access area is connected to the femtocell system 117. The signal from FAP 160 is then sent through a universal access IP network 115 such as a broadband network connection.

The signaling from the UE 105 is delivered to the GANC 110 through the ICS access interface 107 and the general IP access network 115. After the GANC 110 uses the authorization, authentication, and accounting (AAA) server 140 to authenticate and authorize the user, the GANC 110 uses the radio network controller interface to communicate with the various components of the core network 125, and the radio network controller interface communicates with the aforementioned UTRAN's radio network controller interfaces are the same or similar. For example, the GANC 110 of some embodiments includes an Iu-cs interface for circuit-switched voice services and a UTRAN Iu-ps interface for packet data services (eg, GPRS).

In some embodiments, the GANC 110 communicates with other system components of the ICS system 100 through one or more of several other interfaces. The several other interfaces are: (1) Up", (2) "Wm", ( 3) "D'/Gr'", (4) "Gn"' and (5) "SI". The "Up" interface is used to connect the UE 105

200880005462.5 The standard interface for the management of sessions with GANC 110. The "Wm" interface is a standardized interface between the GANC 110 and the AAA server 140, and the AAA server 140 is used to authenticate and authorize the UE 105 entering the femtocell system 117. The "D/GF" interface is a standard interface leading to the HLR. Optionally, some embodiments utilize a "Gn" interface, which is an improved interface for direct communication with a data service gateway (for example, GGSN) of the core network.

Some embodiments optionally include an "S1" interface. In these embodiments, the "S1" interface provides an authorization and authentication interface from the GANC 110 to the AAA server 140. In some embodiments, the AAA server 140 supporting the S1 interface and the AAA server 140 supporting the Wm interface may be the same server. Submitted on February 6, 2006 entitled^uService Access Control Interface for an Unlicensed Wireless Communication System^5,More details of the S1 interface are described in the U.S. Patent Application 11/349,025 of. In addition, in some embodiments, the GANC 110 communicates with a serving mobile location center (SMLC) 150 for supporting location services through a lu-pc interface and a cell broadcast center (CBC) 155, where the cell broadcast center (CBC) 155 is used for Support cell broadcast monthly service through the interface lu-bc interface.

In some embodiments, the UE 105 must register with the GANC 110 before accessing the femtocell system 117. The registration information of some embodiments includes the users international mobile subscriber identity (IMSI), medium access control (MAC) address, and service set identifier (SSID) of the service access point, as well as the camp on from the UE 105 The cell identity of the GSM or UTRAN cell. In some embodiments, the GANC 110 may pass this information to the AAA server 140 in order to authenticate the user and determine the services (eg, voice and data) available to the user. If the AAA 140 agrees to access, the GANC 110 will allow the UE 105 to access the voice and data services of the femtocell system 117. These voice and data services are seamlessly provided by the femtocell system 117 to the UE 105 via the various interfaces described above. The ICS architecture 100 is further described in U.S. Provisional Patent Application 60/949,826, which is incorporated herein by reference.

B. Wireless Femtocell communication system As shown in FIG. 1, the femtocell system of some embodiments includes a Femtocell Access Point (FAP) 160, and the FAP 160 communicatively couples the UE 105 to the GANC HO through the universal IP access network 115., In Figure 1, the interface between UE 105 and FAP160 is called Uu interface. The UE 105 and the FAP 160 communicate through a short-range wireless air interface using authorized wireless frequencies. The secure remote access tunnel starting from FAP 160 ends at the security gateway (SeGW) 120 component of GANC 110, which provides interactive authentication, encryption, and data integrity for signaling, voice, and data services.

200880005462.5 No.

Femtocell Access Point (FAP) Management System (AMS) 170 is used to manage a large number of FAPs. The functions of the AMS 170 include configuration, fault management, diagnosis, monitoring and software upgrades. The interface between AMS 170 and SeGW 120 is called an S3 interface. The S3 interface provides FAP with secure access to femtocell access point management services. All communications between FAP and AMS are exchanged via the femtocell secure tunnel established between FAP and SeGW 120. As shown in the figure, AMS 170 is connected to AP/user database (femtocell DB) 175. The AP/user database (femtocell DB) 175 provides centralized data storage facilities for FAP and user information. Multiple femtocell system components can access femtocell DB via AAA server_O

The IP network controller (INC) 165 component of the GANC 110 is connected to the AAA/proxy server 140 through the S1 interface, which is used to provide FAP-related information and service access control. As shown in FIG. 1, the AAA/proxy server 140 is also connected to the AP/user database 175 through an interface.

1. Functional entity

i. User Equipment (UE)

The UE 105 has functions required to access the femtocell system 117. UE 105 can support Bluetooth® or IEEE 802.11 protocols. In some embodiments, the UE 105 supports an IP interface connected to an access point. In these embodiments, the IP connection originating from the GANC 110 extends all the way to the UE 105.

In some embodiments, UE 105 is a standard 3G handset device operating on the provider's licensed spectrum. In some embodiments, the UE 105 includes a cellular phone, a smart phone, a personal digital assistant, or a computer equipped with a Subscriber Identity Module (SIM) card for communicating over authorized and unauthorized wireless networks. In addition, in some embodiments, a computer equipped with a SIM card communicates through a wired communication network.

Alternatively, in some embodiments, the UE 105 includes a fixed wireless device that provides a set of terminal adapter functions for connecting Integrated Services Digital Network (ISDN), Session Initiation Protocol (SIP), or plain old telephone The service (POTS) terminal is connected to ICSo and the present invention is applied to this type of equipment, so that the wireless service provider can provide the user with a so-called land service even when the users location is not fully covered by the authorized wireless network. Take the line instead of service. In addition, although alternative embodiments of the terminal adapter provide equivalent functions for connecting through an unauthorized wireless network or an authorized wireless network, some embodiments of the terminal adapter are used to connect ISDN, SIP, or POTS terminals to different communication networks. (For example, IP network) fixed wired equipment.

ii. Femtocell Access Point (FAP)

The FAP 160 is an authorized access point that provides a standard radio interface (Uu) for UE connectivity.

200880005462.5 No.

The FAP 160 uses an improved version (Up) of the standard GAN interface to provide the UE 105 with radio access network connectivity. The FAP 160 generates a short-distance authorized wireless signal that the UE 105 can detect when the UE 105 is within the signal range generated by the FAP 160. Generally, this range spans a range of tens of meters, while a macro cell of a macro network spans a range of tens of kilometers. In other words, the coverage area generated by the FAP is a micro cell, and the range of such a micro cell is 100 times, 1000 times, or more times smaller than the macro cell of the macro network. For the UE 105, the signal of the FAP 160 is displayed as a signal from a new cell of the macro network. Therefore, the UE 105 cannot distinguish the FAP 160 from other Node Bs 180 or base stations of the macro network. In some embodiments, FAP 160 is equipped with a standard 3G USIM or 2G SIM.

According to some embodiments, the FAP 160 will be placed in a fixed building, such as a home or office building. In some embodiments, the service area of the FAP 160 includes an indoor part of a building, but it is understood that the service area may include an outdoor part of a building or a campus. In such areas, some macro networks may not provide sufficient signal strength or quality of service. However, by placing the FAP 160 in such an area, the FAP 160 can expand the serviceable coverage area available to the UE 105 without affecting the macro network or the core network.

iii. General Access Network Controller (GANC)

GANC 110 is in 3GPP TS 43.318 document Generic access to the A/Gb interface; Stage 2ⁿAn enhanced version of GANC defined in. For the core network, the GANC 110 behaves like a UTRAN Radio Network Controller (RNC). The GANC 110 includes a security gateway (SeGW) 120 and an IP network controller (INC) 165. In some embodiments, the GANC further includes a GANC signaling gateway, a GANC media gateway (MGW), and/or an ATM gateway (not shown).

SeGW 120 provides functions defined in the 3GPP document titled "Generic access to the A/Gb interface; Stage 2" and in the 3GPP TS 44.318 document titled Generic access to the A/Gb interface; Stage 3. The secure access tunnel that starts from the FAP ends at SeGW 120, and SeGW 120 provides interactive authentication, encryption, and data integrity for signaling, voice, and data services. SeGW 120 is required to support EAP-SIM and EAP-AKA authentication of FAP 160.

INC165 is the core GANC component. In some embodiments, the front end of the INC 165 is connected to a load balancing router/switching subsystem, which connects the INC 165 to other GAN systems; for example, a GANC security gateway, a local or remote management system, etc.

iv. Generic IP Access Network The Generic IP Access Network 115 represents all elements that collectively support the IP connectivity between the GANC Security Gateway (SeGW) 120 function and the FAP 160. This includes: (1) Other consumer premises

200880005462.5 No. (for example, DSL/cable modem, WLAN switch, residential gateway/router, switch, hub, WLAN access point), (2) broadband access technology dedicated network system (for example, DSLAM or CMTS), (3 ) ISPIP network system (edge router, core router, firewall), (4) wireless service provider (WSP) IP network system (edge router, core router, firewall), and (5) network address translation (NAT) function, the The function is either independent of the above-mentioned system or integrated into one or more of the above-mentioned systems.

V.AP Management System (AMS)

AMS 170 is used to manage a large number of FAP 160, including configuration, fault management, diagnosis, monitoring and software upgrades. Access to the AMS function is provided via the GANC SeGW 120 through a secure interface.

Some embodiments of the above mentioned devices, such as user equipment 105, FAP 160 or GANC 110, include electronic components such as a microprocessor and memory (not shown) that will execute wireless protocols for managing voice and data services The computer program instructions are stored in a machine-readable medium or a computer-readable medium, which will be further described in the section entitled "Computer System" below. Examples of machine-readable media or computer-readable media include, but are not limited to, magnetic media such as hard disks, memory modules, magnetic tapes, etc., optical media such as CD-ROMs and holographic devices, and magneto-optical media such as optical disks. , And hardware devices specifically configured to store and execute program codes, such as application-specific integrated circuits (ASIC), programmable logic devices (PLD), ROM and RAM devices, etc. Examples of computer programs or computer codes include machine codes such as those generated by a compiler, and files containing high-level codes executed by computers, electronic components, or microprocessors using translation programs.

II. FEMTOCELL mobility management In some embodiments, FAP enables the UE to access the operator core network through the femtocell system in a transparent manner for the UE. In other words, when the UE communicates through the femtocell system to reach the operator core network, it does not need to distinguish whether the communication session is conducted through the femtocell system or directly through UTRAN. In addition, in order to enable the UE to access the operator core network through the femtocell system, there is no need to change the UE. Therefore, the FAP works transparently in the same or similar manner as Node B or other base stations of various macro networks.

Transparent work allows the femtocell system to use core network components to establish and route communication sessions for user equipment authorized to directly communicate with the authorized network. The MSC of the core network establishes and routes circuit switching services for the femtocell system, and creates a physical connection to and from the service area of the femtocell system and the destination endpoint located outside the service area. The SGSN of the core network is a femtocell system

200880005462.5 The system establishes and routes packet switching services, and creates physical connections to and from the service area of the femtocell system and destination endpoints.

In some embodiments of the present invention, a UE roaming from the service area of the macro network to the service area of the femtocell system will use the same MSC or SGSN of the core network as when the UE is located in the service area of the macro network only. Route UE communication. The following will describe in detail the processing for judging whether the MSC or SGSN of the core network should route the communication of the UE when the UE is located in the service area of the femtocell system.

GANC's mission is to act as a network controller to help establish a communication session that communicatively couples the service area of the femtocell system to core network components. Specifically, the GANC routes the communication session to the MSC or SGSN, and then the MSC or SGSN forwards the communication session to the destination through the established connection. In this way, the service area of the femtocell system continues to work outside the core network and works independently of the core network, but the core network provides the actual circuit switching or packet switching service establishment, and the core network provides the connection to the destination. For those of ordinary skill in the art, it is obvious that even if circuit switching and packet switching services are established and provided by the core network, the various control signaling used by the UE to establish such communication sessions can be changed to the FAP of the femtocell system. Or GANC to deal with.

A. Location area, routing area, and service area identification. Some embodiments adopt various mobility management features of the macro network and integrate these mobility management features into the FAP and other components of the femtocell system (such as in the GANC) to establish this Transparency. By dividing the coverage area of the macro network into logical registration areas called the location area (used in the circuit switched domain, that is, the CS domain) and the routing area (used in the packet switched domain, that is, the PS domain), in order to facilitate the UMTS macro network Implement mobile management within. When the UE roams into any such location area (LA) or routing area (RA), the UE performs a series of expected actions, such as performing a location update to notify the network of its location.

Figure 2 shows the various components of the macro network involved when performing mobility management in the case of the UE and the core network. In FIG. 2, the LA or RA 220 generally includes a group of Node Bs (such as 230), or other base stations representing a group of cells within the LA or RA 220. Cells within LA or RA 220 communicate with a single RNC 240 or other base transceiver station (BTS). As described with reference to FIG. 1, the RNC or BTS forwards the communication or service request from the cell to the appropriate MSC 250 for circuit-switched service, or to the SGSN 260 for packet-switched service. Therefore, a single MSC 250 serves one or more LAs, and a single SGSN 260 serves one or more RAs...

200880005462.5 By using the last known LA (for the CS domain) or RA (for the PS domain) of the UE 210, regardless of whether the UE 210 is in idle mode or whether the UE 210 does not have any valid RRC connection, the macro network can be used in the UE When 210 passes through different cells in LA or RA 220, the location of UE 210 is recognized. When no valid radio connection is available, the macro network will use the last known LA and RA to page the UE 210. However, if the UE 210 traverses into a new LA or RA, the mobility management requires the UE 210 to initiate a location update message to notify the macro network of its movement.

The mobility management feature of the macro network identifies each LA by associating the location area identifier (LAI) with the LA. The MSC/VLR of the core network uses LAI to identify and route communications from a specific LA to the core network and back to a specific LA. Similarly, associate each RA with a routing area identifier (RAI). The SGSN of the core network uses RAI to identify and route data from a specific RA to the core network and data back to the specific RA.

LAI includes mobile country code (MCC), mobile network code (MNC) and location area code (LAC). MCC identifies the country where the macro network is located, and is usually the same three-digit value found in the International Mobile Subscriber Identity (IMSI) of UESIM. MNC identifies the macro network in the country designated by the MCC. The MNC also adopts the same value as the two-digit or three-digit MNC found in the IMSI of the UE SIM. The LAC is a dedicated field in the LAI, which is used to uniquely identify the LA to distinguish the LA from other LAs served by the MSC. The LAC typically includes a two-octet fixed length code used to identify the LA. According to the LAC parameters, the MSC determines the current location or previous location of the UE in the macro network.

RAI includes the MCC, MNC, and LAC parameters described above with respect to LAI, but RAI also includes additional fields for specifying the routing area code (RAC). The RAC usually includes a single octet fixed length code used to identify the RA within a specific LA.

As mentioned above, LA or RA represents the identification used by the RNC or other base transceiver station to communicate with the MSC or SGSN. However, when specific cells in the LA communicate directly with IE, each cell is assigned a cell identity (CI). When communicating with RNC or other base transceiver stations, the cell uses this parameter. CI is an identifier that uniquely identifies a cell in the LA where the cell is located.

In addition, some macro networks specify a service area identifier (SAI) to identify an area including one or more cells belonging to the same LA. SAI is a subset of the location area and can be used to indicate the location of the UE to the macro network. SAI can also be used for emergency call routing and charging purposes. SAI includes public land mobile network identifier (PLMN-Id), LAC and service area code (SAC). The PLMN-Id uniquely identifies the macro network. PLMN-Id is usually a splicing of MCC and MNC, so

200880005462.5 No.

SAI includes LAI and 16-bit SAC.

Figures 2 and 3 show that the macro network uses part or all of this identifier to perform mobility management and transfer communications (for example, voice calls), data requests (for example, SMS messaging, text messaging, access to the Internet, etc.) And other services delivered to the UE. In Figure 2, UE 210 can traverse different cells within LA 220 of the macro network. When the signal strength of the neighboring cell increases and the signal strength of the current cell decreases, the UE 210 will initiate cell reselection. Cell reselection allows UE 210 to operate via the cell with the strongest signal. The procedure for cell reselection is provided in the 3GPP TS 25.304 document entitled User Equipment (UE) procedures in idle mode and procedures for cell reselection in connected mode. Therefore, in FIG. 2, the UE 210 is connected to the cell of the LA 220 with the strongest available signal, such as the Node B 230. The Node B 230 passes the service request to the RNC 240 serving the specific LA 220 where the Node B 230 is located. The RNC 240 then passes the service request to the associated MSC 250 or SGSN 260 in the core network for further processing.

Fig. 3 shows the identifier used in the communication between the macro network and the core network. In the communication between the RNC 240 and the MSC 250, the specific identifier used by the MSC 250 to identify the originating RNC 240 is the LAC parameter. The LAC identifies the specific LA that made the request for the MSC 250, and the corresponding RNC 240 of the LA. Similarly, the SGSN 260 uses the RAC parameter to identify the originating RA, so when communicating with the SGSN 260, the RAC parameter is provided together with the LAC. The additional identifier is usually passed along with the LAC and RAC. For example, the RNC 240 transfers the service area identifier (SAI) to the MSC 250. SAI includes MCC, MNC, LAC, and two octet service area codes (SAC λ SAI identifies the area in the LA that includes one or more cells belonging to the same LA. SAC is defined by the service operator and is in the RNC Set within.

Therefore, in order to enable the femtoce H system to transparently provide functions for the UE, the FAP of some embodiments utilizes a mobility management and identification scheme similar to that of the macro network. As a result, the UE will not be able to distinguish between the FAP of the femtoce 11 system and the base station of the macro network. Therefore, there is no need to make any changes to the UE and to provide services to the UE through the femtocell system without making any changes to the components of the macro network or the core network. The following section B describes femtocell mobility management in detail.

B. Femtocell system mobility management Figure 4 shows the transparent operation of multiple FAPs of the femtocell system in the location area (LA) of the macro network. Figure 4 shows the components of the macro network and the core network, such as Node B, RNC, MSC, and SGSN. Figure 4 also includes components of the femtoce 11 system, such as FAP 420-440 and GANC 470, which are seamlessly integrated into the core network.

200880005462.5 The first interface into the seamlessly integrated femtocell system is provided via FAP 420-440. The FAP 420-440 generates a short-distance authorized wireless coverage area through the same or similar signals as those of the Node B in the LA410. When the UE 450 passes through the LA 410, the UE 450 detects the femtocell coverage area created by the FAP 420-440. When the UE 450 approaches the coverage area of the FAP 430, the signal strength increases.

In Figure 4, the UE 450 is close enough to the FAP 430. At the FAP 430, the UE 450 can continue to perform communication and data services through the femtoce 11 system instead of the macro network. In order to connect to the femtocell system, the cell reselection of the UE triggers a series of mobility management operations between the FAP430 and the UE 450. In some embodiments, this cell reselection causes the macro network to perform service handover. After the handover, the communication and data propagate from UE 450 to FAP 430, and propagate into the core network via GANC 470, instead of propagating via section AB 460 of the macro network.

In some embodiments, the UE FAP selection (ie, roaming into the FAP coverage area) can be improved through the following two feasible mechanisms: (1) The FAP cell can be in a different HPLMN (equivalent PLMN list), and will pass the preferred The equivalent PLMN is selected to select the FAP cell. This mechanism assumes that the macro cell currently occupied by the UE is not in the equivalent PLMN list, and (2) the macro network will broadcast system information so that as long as the FAP meets certain minimum parameters, the UE will be compared with other cells in the macro network. FAP will be preferred. The broadcast information from the macro network may include various biasing parameters that make the UE 450 select FAP 430 and not select other base stations of the macro network.

In some embodiments, femtocell mobility management occurs when the UE is working in idle mode. If there is no such idle mode mobility management, those UEs working in idle mode can roam to a specific FAP through their internal cell selection logic without knowing the FAP and camp on the specific FAP. When the UE returns to the operating mode to perform various functions, the FAP only becomes aware of the existence of the UE. As a result, the UE can preempt the FAP that it is not authorized to access (that is, the UE is not within the service access control of the FAP), and it will not be until the UE returns to the operating mode and tries to register with the FAP or initiate a service request to the FAP A rejection to the UE occurred. For those of ordinary skill in the art, it is obvious that this kind of UE idle mode preemption may occur when the UE switches from a cell of a macro network to a FAP of a femtocell system and when the UE switches from one FAP to an adjacent FAP.

In order to trigger the initial message from the UE in idle mode, the FAP of some embodiments is allocated to a location area different from that of the neighboring macro cell and other neighboring FAPs. By assigning different LAs to the FAP, the UE will start the message exchange with the FAP whenever the UE camps on the FAP. This message exchange is because the UE must update the core network because it thinks it has entered a new LA.

200880005462.5 The new position occurred.

However, the number of available LACs is limited. This is because in the 3GPP TS 23.003 document Numbering, addressing and identification^5,The maximum number of available LACs is 65,536 (that is, 16-bit LAC attributes). As a result, some embodiments of the femtocell system provide an LAC allocation scheme that maximizes the number of LACs that can be allocated to the femtocell system while minimizing the number of LACs used when integrating the femtocell system with the core network. Thus, some embodiments of the femtocel 1 system can provide a transparent and scalable solution that only has a minimal impact on the available resources of the macro network and/or core network.

i. Some embodiments of the super LA/RA mobility management femtocell system utilize a two-tiered LAC allocation scheme to maximize the number of femtocells supported by different LAs, while making the entire femtocell system suitable for UEs, macro networks, and The core network is transparent. The two-layer LAC allocation scheme of some embodiments stipulates: (1) The first layer is about a large group of local LACs managed by the FAP/AMS used when communicating with the UE, and (2) the second layer is Regarding a group of super LACs managed by INC used to communicate with each component of the core network (for example, MSC and SGSN) (for example: one super LAC for each "Iu" interface). Some embodiments perform local LAC to super LAC translation before sending communication or data to the core network. In this way, the macro network and/or the core network do not know the local LAC assigned to the FAP. In contrast, the macro network and/or the core network see the translated super LAC shared between several FAPs operating through a single GANC.

In some embodiments, the first group of local LACs is used by FAP/AMC to allocate a unique LAC to each FAP, so that it at least meets the following requirements: (1) It is unique with respect to neighboring macro cells and other FAPs , In order to ensure that the UE can send the initial message after selecting the femtocell and roaming into the cell, and (2) when multiple FAPs sharing the same LAC are not adjacent but the multiple FAPs are accessed by the same UE , To resolve the conflict of shared LAC, so as to allow the use of LA not allowed for UE rejection operations, or other appropriate rejection codes using the LOCATION UPDATING REJECT message, as described in Section IV below That way. Since these local LACs will never be exposed to the core network, and multiple non-adjacent FAPs can share these local LACs, the GANC serving FAPs can support a lot of FAPs (because of the sharing of local LACs, Supports more than 65K FAPs). The actual number of local LACs and super LACs available to the femtocell system will depend on various configurations (may need to consider several factors, such as the LAC being used by the operators existing macro coverage area, for macro coverage

200880005462.5 The number of LACs reserved for future expansion of the zone, the number of FAPs to be used, etc.).

In some embodiments, the selection of different local LACs occurs at the moment when the FAP registers with the femtocell system. During the registration process, FAP receives a set of unused and available local LACs from FAP AMS_OFAPAMS maintains the centralized list and updates the list whenever FAP is added or removed from the femtocell system. Specifically, when the FAP tries to connect to or disconnect from the specific GANC of the femtocell system.

The FAP of some embodiments selects from the received group a unique local LAC that does not conflict with local LACs allocated to other neighboring FAPs or macro network cells. For example, the FAP of some embodiments detects LACs advertised by the macro network cell and other neighboring FAPs, thereby selecting non-conflicting local LACs based on the detected neighboring LACs. If it is found that the local LAC does not conflict with any advertised LAC, the FAP assigns the local LAC to itself and reports the assignment to the FAP AMS.

However, it is obvious to those of ordinary skill in the art that the selection of the local LAC for the FAP can be performed by different other components of the femtocell system. For example, in some embodiments, the GANC or AAA server of the femtocell system performs local LAC selection. In addition, in some embodiments, assigning a different LAC to each FAP also stipulates that each FAP is assigned a different RAC. In some embodiments, when the FAP is successfully registered, a set of available LACs and RACs are sent to the FAP as part of the "system information".

In some embodiments, the second group of super LACs (a much smaller group) are managed within each INC. The key requirements are as follows: (1) Minimize the impact on existing macro network and core network components (for example, , Minimal configuration, minimal operational impact or minimal resource utilization), (2) seamlessly integrate existing functions for routing emergency calls into the appropriate PSAP, and (3) seamlessly integrate for generating appropriate The existing function of Call Detail Recording (CDR) in order to perform charging services.

In order to meet the above requirements for the second group of super LACs, the INC of some embodiments represents a "super LA" for a given Iu interface (ie, MSC + SGSN interface). This means that the MSC/SGSN can be configured with separate Super LAI/Super RAI information for the INC. More specifically, a single super LAI/super RAI information can be used to configure the MSC/SGSN for all FAPs served by a particular INC. However, it is obvious to a person of ordinary skill in the art that, in some embodiments, multiple super LAIs/super RAIs can be allocated if necessary, so as to further subdivide the area served by a single INC into multiple geographic areas.

Super LAI/RAI information is provided by INC to each connected FAP. In some embodiments, the INC provides the FAP to the FAP when it is registered (ie, the FAP is powered on and trying to connect to the femtocell system).

200880005462.5 Provides Super LAI/RAI information. In some embodiments, the FAP is expected to provide super LAC/RAC replacement in the message transmitted from the femtocell network to the UE. For example, the FAP must replace the "Super LAC/RAC" contained in the relevant message from the network with the locally appropriately allocated LAC/RAC information in the message sent to the UE camping on the FAP. In addition, after the UE has preempted the FAP and completed the initial message exchange (ie, location update) between the UE and the femtocell system, the FAP of some embodiments performs local LAC/ for all subsequent message exchanges between the UE and the core network. Conversion from RAC to Super LAC/RAC. For example, the FAP replaces the local LAC/RAC information with the super LAC/RAC information in the message received from the UE that passes the FAP and is routed to the destination in the core network, and the FAP replaces the local LAC/RAC information with the slave core that passes through the FAP and is routed to the UE. The local LAC/RAC information in the message received by the network replaces the super LAC/RAC information.

By utilizing the local LAC to super LAC conversion, the FAP of a given GANC no longer has to compete with the entire area served by the MSC when assigning a local LAC. On the contrary, GANC is the interface of most FAPs to the core network. The super LAC allocated by GANC must remain different from other components communicating with the MSC (ie, other GANC). Since the MSC will not know the local LAC, the FAP only needs to compete with the neighboring FAP and the neighboring cells of the macro network. In this way, the available pool of local LACs that can be allocated to the FAP is greatly increased. In addition, since all such FAPs served by a single GANC use GANC's single shared super LAC when communicating with the MSC of the core network, the utilization of resources of the macro network and/or core network (for example, LAC allocation) is greatly reduced .

It is obvious to a person of ordinary skill in the art that the message transfer between the GANC and the core network may include additional identifiers or parameters. Specifically, in some embodiments, the INC allocates SAI (ie, LAI and Service Area Code (SAC)) in the messaging between it and the core network. Some such embodiments utilize additional parameters for routing emergency calls to the appropriate PSAP, and also for charging purposes. In some of these embodiments, the SAI is relayed to the CN by the INC in the "Initial UE Message" (used to deliver the initial L3 message from the UE to the CN).

Figure 5 shows a process 500, which conceptually shows several operations performed by the FAP in order to implement translation from the local LAC to the super LAC when the UE roams into the coverage area of the FAP. When the FAP initially establishes (510) the IPSec tunnel and registers with the GANC of the femtocell system, the process 500 starts. FAP registration is to meet the following purposes: (1) to inform the INC of GANC that the FAP is now connected and the FAP is available at a specific IP address, (2) to allow the femtocell system to provide service access control and billing functions ( For example, FAP restriction and redirection (redirection), and (3) provide FAP with femtocell services at the current location

200880005462.5 The associated operating parameters (such as super LAC, Cell-Id, etc. assigned to INC). Such operating parameters can be passed to the FAP via system information in a "REGISTRATION ACCEPT (registration acceptance)" message. The FAP of some embodiments uses this information to send the system parameters to the UE through the broadcast control channel (BCCH).

The process (at 520) determines for the FAP a local LAC that does not conflict with the neighboring FAP or the neighboring cell of the macro network. As described above, the FAP receives a pool of available local LACs, and selects from the pool a local LAC that is different from the LACs of other detected neighboring macro cells and the local LACs of other FAPs within the current FAP range. The FAP broadcasts the local LAC to all UEs in the FAP coverage area (at 530). If the UE roams into the coverage area of the FAP, the UE will identify the local LAC broadcast by the FAP. By performing location update, the UE records the broadcast local LAC and confirms that it is now working in the new location area. The location update message sent from the UE includes the previous LAI (ie, MCC, MNC, and LAC). The process receives the location update message (at 540) and forwards the message to the GANC.

After the GANC has processed it, the process (at 550) receives the location update acceptance response from the GANC. The response includes the super LAC used by the GANC to communicate with the core network. The acceptance response includes the temporary mobile user identity (TMSI) in addition to the IMSI of the UE, or includes the temporary mobile user identity (TMSI) but does not include the IMSL of the UE. This process will be included in the response message before delivering the location update acceptance response to the UE The found Super LAC is converted to FAP's local LAC (at 560). In some embodiments, when the FAP is registered, the GANC will already provide the FAP with a super LAC identifier.

When receiving the response message, the UE will update its current location area internally, and the subsequent communication and message exchange will continue through the femtocell until the UE roams out of the coverage area of the FAP. Therefore, the femtocell mobility management solution used in some embodiments of the present invention allows the UE to transparently connect to the core network through the femtocell system, while making this connection indistinguishable from other macro network connections. The UE connects to the femtocell system using the same messaging and identification scheme that it usually uses to connect to macro network cells.

FIG. 6 shows a process 600, which conceptually illustrates several operations performed by the GANC in order to implement the translation of a local LAC to a super LAC in combination with the process of FIG. 5. Similar to 510 in Figure 5, process 600 starts with establishing an IPSec tunnel between FAP and GANC (at 610). This process (at 615) sends the super LAC to the FAP for the FAP to use when converting the local LAC to the super LAC in the subsequent message exchange, as described in Figure 8 below.

200880005462.5 as stated in the first. Then, the process (at 620) receives a service request from the FAP through a specific TCP port that is allocated for communication between a specific UE and a specific FAP. As described above, when the UE initially roams into the coverage area of the FAP, the initial service request is a location update request message. The UE's location update request message will contain the identifier of the LA last visited by the UE (ie, LAC).

When the message is received, the process (at 630) identifies the IMSL associated with the UE that initiated the service request. The process maps the IMSI to a specific FAP and the TCP port from which the service request originated, so that the source of the specific IMSI is specified The response of the core network can be routed back to the correct FAP serving the UE. Before forwarding the monthly service request to the MSC/SGSN of the core network, the GANC (at 640) attaches the super LAC to the service request so that the core network will be able to route the response back to the GANCo. When the communication and data from the core network are routed, the super LAC effectively replaces the local LAC, because the core network only uses the super LAC. As mentioned above, the super LAC of the GANC is different from other location areas served by the MSC/SGSN of the core network. In addition, the super LAC allows the message routing between GANC and the core network to be transparently performed, because the core network cannot distinguish GANC from the core networks own RNC or base transceiver station (that is, for the core network, GANC behaves like another Same as an RNC).

This process forwards the service request attached with the super LAC to the core network for processing. The process (at 650) receives the response from the core network. Then, the process (at 660) identifies the IMSI in the response and determines the specific FAP serving the UE with the associated IMSI. This process maps the response to a specific TCP port associated with the FAP and IMSI, and forwards the response to the specific FAP (at 670).

Fig. 7 shows a conversion process from a local LAC to a super LAC combining the processes in Fig. 5 and Fig. 6. Specifically, FIG. 7 shows various identifiers used when communicating with UE 710 and 750, FAP 720 and 760, GANC 730, and MSC 740 of the core network. In Figure 7, UE 710 camps on FAP 720. The FAP 720 announces the local LAC_X to the UE 710. The UE 710 detects the local LAC_X and notices that it is now working in the new location area. Therefore, the UE 710 issues a location update request, which includes the LAI of the LA last visited by the UE 710 (ie, MCC, MNC, and LAC). The FAP 720 forwards the message to the GANC 730, and the GANC 730 attaches the super LAC_Z to the location update message before passing the message to the core network component (ie, the MSC 740). The core network responds with a location update accept message including Super LAC Z, which is used to identify the GANC 730 of the femtocell system and is used to route the message back to the GANC

200880005462.5 No.

730„

GANC 730 forwards the response with Super LAC_Z to FAP 720» Then, FAP 720 converts Super LAC_Z into local LAC_X which is broadcast to UE 710. The FAP 720 uses the local LAC_X to pass the local update acceptance response back to the UE 710. The UE 710 receives the message, and internally changes its location area to the local LAC_X of the FAP 720. In this way, without making any changes to the UE 710 or the components of the core network (ie, the MSC or SGSN), the UE 710 and the core network can communicate with the femtoce 11 system seamlessly. For example, the UE 710 works in the same or similar way as it only works with the macro network, because each FAP in the femtocell system behaves like a different location area of the macro network. Similarly, the MSC of the core network works in the same or similar manner as a single RNC or other base transceiver station, because all FAPs of the femtocell system served by a single GANC behave like a single location of the core network The area is the same.

To further illustrate the repeated use of the super LAC, a second UE 750 connected to a second FAP 760 is shown in FIG. 7, where the second FAP 760 is served by the same GANC 730 serving the FAP 720. FAP 760 broadcasts a local LAC_Y that is different from the local LAC broadcast by FAP 720. When the UE 750 receives the local LAC_Y, it sends a location update request to notify the core network that the UE 750 has entered a new location area. As mentioned above, the FAP 760 transmits the location update to the GANC 730, and the GANC 730 attaches the shared super LAC_Z to the message before transmitting the location update message to the component of the core network (ie, the MSC 740). GANC 730 received a location update acceptance message with super LAC_Z from the core network. As described with reference to FIG. 6, the GANC 730 determines that the message is to be sent to the UE 750 by identifying the IMSI found in the message. GANC 730 delivers this message through the TCP port used by FAP760 serving UE 750. In some embodiments, the IMSI routing scheme allows GANC 730 to recognize independent FAP 720 and FAP 760 serving as independent UE710 and UE 750, and also allows GANC 730 to share a single super LAC when communicating with the core network » Before forwarding the message to UE750, FAP760 converts super LAC_Z into its own local LAC_Y«. Therefore, as shown in Figure 7, even if UE 710 and 750 work through different FAPs 720 and 760 assigned to different LACs, the core network is also It is considered that the service requests from UE 710 and 750 originate from the same LA.

Figure 5-7 describes the local LAC to super LAC conversion process performed when the UE initially roams into the coverage area of the FAP. Figure 8 shows the subsequent cancellation between multiple UEs and multiple core networks through the femtocell system after the UE has successfully preempted the FAP of the femtocell system.

200880005462.5 First interest exchange. Therefore, in FIG. 8, it is assumed that the UEs 870 and 880 have completed the location update procedure described above with reference to FIG. 7.

As shown in Figure 8, a single GANC 810 of the femtocell system is connected to two MSCs working in two independent core networks 820 and 830 through interfaces. When communicating with independent core networks 820 and 830, different super LACs are used. In this way, the FAP 840-860 provided by the GANC810 can be distributed in the entire femtocell system to provide femtocell services via the core network 820 or 830.

During the initial FAP registration with the femtocell system, or when the UE initially rove-in and triggers the location update procedure described with reference to Figure 7, the FAP 840 that provides access to the core network 820 through the femtocell system The super LAC associated with the core network 820 will have been identified. The FAP 840 utilizes the super LAC allocated for communication with the core network 820 to perform the conversion of the super LAC to the local LAC. Therefore, before passing subsequent messages received from the UE 870 to the GANC 810, the FAP 840 will replace the local LAC found in these messages with the super LAC allocated for communication with the core network 820. Similarly, before passing subsequent messages received from the core network 820 to the UE 870, the FAP 840 will replace the super LAC found in these messages with the local LAC.

The FAP860, which provides access to the core network 830 through the femtocell system, will also have identified the super LAC associated with the core network 830. The FAP 860 utilizes the super LAC allocated for communication with the core network 830 to perform the conversion of the super LAC to the local LAC. Like FAP 840, before passing subsequent messages received from UE 880 to GANC 810, FAP 860 will replace the local LAC found in these messages with the super LAC allocated for communication with the core network 830, similar to Specifically, before passing subsequent messages received from the core network 830 to the UE 880, the FAP 860 will replace the super LAC found in these messages with the local LAC.

Since the GANC 810 is connected to two core networks, FAP 840 and 860 can choose to be configured or reconfigured to access one core network 820 or the other core network 830. By switching the super LAC they use when the LAC of the FAP is converted, this Two FAPs can be seamlessly converted and provide access to any core network. Those of ordinary skill in the art should recognize that this conversion in some embodiments requires additional configuration steps. For example, when switching from providing access to the core network 820 to providing access to the core network 830, the FAP may have to search for a new local LAC that does not conflict with the LAC allocated by the core network 830.

ii. Allocation of Super LA/RA

200880005462.5 In some embodiments, the logical allocation of super LA/RA addressing in order to communicate with the core network is performed by leveraging the information provided by nearby macro networks. Some embodiments use this information to ensure that Super LA/RA addressing (ie, Super LAC/RAC) is unique. In addition, some embodiments use this information to allocate a super LAC/RAC that can be used to optimally route traffic through the core network. FIG. 9 shows a process 900 that conceptually illustrates several operations performed by INC of the GANC in order to perform logical allocation to the super LAC.

When the INC receives a report from the FAP on whether the macro coverage area in the coverage area of the FAP is available (at 910), the process 900 starts. If the macro coverage area is available, the INC (at 915) maps the reported macro coverage area information (ie, macro LAI, macro 3G cell identity) to the super LAL. In some embodiments, this mapping further allows service-based provisioning Mapping multiple macro LAI/3G-CIs to the same super LAI or different super LAIs. Then, the process (at 920) provides the mapped super LAI to the FAP for execution at the FAP Used for translation between local LAC and super LAC.

In some embodiments, the process 900 can also identify the serving MSC for the specific LA of the reported macro coverage area. In some embodiments, the MSC is identified by the FAP using the information broadcast by the macro network, or via a UE that previously worked in the macro network but has roamed into the coverage area of the FAP. The identified information is passed to the GANC so that the GANC can forward the service request with the super LAC to the specific MSC of the core network, which is the MSC serving the nearest location area of the macro network. In this way, routing is optimized because service requests arrive at the nearest available MSC, and delays and traffic between MSCs are reduced, because only a minimum number of hops (hops) are required to route service requests to their destinations. ). Alternatively, the reported macro coverage area can be used to identify the nearest GANC used to communicate with the nearest available MSC. For example, during the initial FAP registration, the location of the FAP may be unknown, so a default GANC can be assigned to serve the FAP. However, the default GANC may be located in a sub-optimal position that serves the FAP (for example, an additional jump is required between FAP and GANC). Therefore, when receiving the reported macro coverage area, the femtocell system can identify the location of the FAP and redirect the FAP It is served by the closer and better-located GANC. In the following embodiments, GANC is pre-configured to work with the nearest MSC or SGSN, so by identifying the nearest GANC, the femtocell system automatically recognizes the nearest MSC or SGSN.

However, if the FAP cannot detect the macro coverage area, the process must include logic for assigning the default super LAC. This lack of knowledge of neighboring macro networks and the default super

200880005462.5 No.

The use of LAC may lead to sub-optimal routing, because GANC may forward service requests to the default MSC of the core network further away. To reach the farther MSC, the service request needs to go through an extra hop along the core network to reach its destination. This extra hop experience will cause delays in the process of processing service requests, and will also generate additional traffic during such hops. In other cases, such hops can be avoided by the above-mentioned optimized routing scheme. It can also cause other required services to be unavailable. For example, when the UE sends an emergency service request, the MSC cannot route the emergency service request to the nearest MSCo. As a result, the core network will not be able to determine the appropriate Public Safety Answering Point (PSAP) for responding to the emergency service request.

Therefore, some embodiments include additional logic for performing optimal routing to the macro network while at the same time allocating non-conflicting super LACs for communication with core network components. In order to achieve this, the process (at 930) queries the AAA server through the S1 interface for information about the "prescribed macro coverage area" of a given FAP IMSI. The information stored in the user database is used to determine whether such prescribed macro coverage area information is available. If the processing (at 935) determines that the information is available, the processing uses the information (at 940) to map the super LAC and identify nearby MSCs in order to route the service request to the core network, as described at 920 above.

However, if the processing (at 935) determines that no information is available through the query to the AAA server at 930, then some embodiments (at 950) map the default Super LAC, but perform additional steps 955-970 to avoid the allocation due to The default super LAC leads to sub-optimal routing. At 955, the process determines whether the UE has roamed into the coverage area of the "uncovered" FAP. In the case where no UE roams in, the process continues (at 980) to assign a default LAC to map the FAP to the super LAC. However, in the case of a UE roaming in, the FAP can collect information about the neighboring macro network from the UE's messaging. For example, the process (at 960) requests from the UE's initial LU to receive the last LAL camped on by the UE. Then, the process uses the received information (at 965) to construct "derived" macro coverage information. FAP reports the exported macro coverage in the "REGISTER UPDATE UPLINK" message to GANC. Based on the derived macro coverage information, the process determines the mapping (at 970) for the FAP to the super LAC. This process reports the assigned super LAC to the FAP in the GA-RC registration update downlink message (at 920). In addition, in some embodiments, INC also reports 3G small Area ID, the 3G cell ID contains 12-bit RNC-id statically assigned to each INC and 16-bit dummy cell identity to be used by FAP.

III. FEMTOCELL service access control

200880005462.5 In combination with the above-mentioned mobility management function, some embodiments of the present invention can provide a complete set of service access control for the femtocell system. In some embodiments, service access control is used to restrict access to the femtocell system by unauthorized UEs that are not authorized to obtain the femtocell service of the specific FAP. In addition, in some embodiments, femtocell service access control includes discovery, registration, and redirection functions, as well as enhanced service access control functions, such as restrictions based on reported FAP MAC addresses or neighboring macro network UMTS cell information Femtocell service access.

Some embodiments implement femtocell service access control through the following operations: (1) local service access control performed by FAP, (2) basic service access control performed by FAP and INC, or (3) enhanced service access Control, which uses the S1 interface to distribute service access control functions to the AAA server. For those of ordinary skill in the art; obviously, some features or new features of one access control method can be combined into another service access control design method, and other features can be designed from other service access control at the same time. Omitted in the method.

In the most accessible state, the FAP works in an open access mode. In this open access mode, the UE can access the femtocell function through a specific FAP. Figure 10 shows an open access mode FAP according to some embodiments of the present invention. In FIG. 10, a group of UEs 1010-1050 are in the coverage area of FAP 1060. UE 1010-1050 camps on FAP 1060 and uses FAP 1060 to exchange service requests with ICS. By using some of the above-mentioned various location update messages and other re-registration message delivery, the group of UEs 1010-1050 gain access to the core network through the FAP and GANC of the femtocell system. However, in some embodiments, the FAP only restricts those The access of the UE served by femtoce 11 has been reserved. This FAP is called a closed access mode FAP. Figure 11 shows a closed access mode FAPo according to some embodiments of the present invention. In Figure 11, a group of UEs 1010-1050 try to access femtocell services through FAP 1160. As part of its service access control, FAP 1160 includes a list of allowed IMSIs of UEs that are authorized or allowed to access the femtocell service. In some embodiments, the allowed UE is stored and maintained in the AP/user database managed by the center. IMSI list, each component of the femtocell system can access the AP/user database managed by the center. For example, some embodiments of FAP 1160 access the allowed UE IMSI list stored in the AP/user database via AMS. In other embodiments , the AAA server or INC accesses the allowed UE IMSI list via AAA to perform network-based service access control on behalf of the FAP.

The allowed IMSI list stipulates that UEs 1010-1030 are users and are allowed to access with a specific FAP 1160. Because UE 1040 and 1050 are not authorized to use FAP 1160 to obtain services, they will

200880005462.5 was rejected. However, it is obvious to a person of ordinary skill in the art that such a UE may be allowed to access certain other FAPs, such as a FAP located in the home location of the UE. Therefore, the refusal causes the UEs 1040 and 1050 to determine the location of the service via the alternative device. In FIG. 11, the UE 1050 can receive services by connecting to the macro network 1180. However, the UE 1040 may not be a user of the femtocell service or a user of the specific macro network 1180, so the UE 1040 cannot receive the service.

Some embodiments include an additional working access mode of FAP. For example, in some embodiments, the FAP operates in a semi-open or semi-closed access mode, whereby unauthorized UEs can receive incoming service requests, but they are prohibited from making outgoing services request. For those of ordinary skill in the art, it is obvious that a service provider can create conditions for a variety of different services through a semi-open or semi-closed working access mode.

In addition to the requirements specified by the service provider, some embodiments of the femtocell service must provide minimal functions regardless of whether the UE is a user of the femtocell service. One such requirement is to allow any UE to be able to issue emergency service requests while in the coverage area of the FAP. Figure 12 shows a closed access mode FAP, which allows access to unauthorized users trying to establish emergency service requests.

In FIG. 12, neither UE 1040 nor 1050 is in the FAP 1260 allowed IMSI list. Therefore, FAP 1260 sends a rejection to UE 1040. However, the FAP 1260 allows the UE 1050 to be connected because the UE 1050 is trying to issue an emergency service request. In some embodiments, the emergency service request is indicated by the establishment reason field of the RRC message. RRC messaging is described in the 3GPPTS 25.331 document entitled Radio Resource Control (RRC) protocol specifϊcation^^. Therefore, some embodiments provide multiple UE rejection mechanisms that allow for emergency service requests through FAP without macro coverage. However, for those of ordinary skill in the art, it is obvious that various other requirements different from the provision of services related to emergency service requests may be required as part of the service access control of the FAP.

In addition, some embodiments provide multiple UE rejection mechanisms to ensure that UE rejection on one FAP will not affect the service of the UE on any other authorized FAP. As mentioned above, some femtocell mobility management requires that each FAP is allocated to LAC/RAC. As part of the LAC/RAC allocation requirements, any adjacent FAP or macro network cell should not have the same LAC/RAC. However, two non-adjacent FAPs or non-adjacent macro network cells and FAPs can share the same LAC. Therefore, when the UE tries to access the service through an unauthorized FAP or cell,

200880005462.5 No.

The UE will be rejected, and the UE will store the LAC/RAC of the rejected FAP in the LAC/RAC prohibited list on the SIM. If the UE enters the coverage area where any LAC/RAC identifier in the barred list is specified, the UE will no longer try to access any LAC/RAC in the barred list. The UE can return to the authorized FAP that it should be allowed to access. , But if different non-adjacent FAPs or cells contain similar forbidden LAC/RAC, the UE will no longer try to access this FAP. Therefore, the UE rejection mechanism of some embodiments includes security measures to ensure that valid LAC/RAC identifiers will not be incorrectly prohibited.

Figure 13 shows a process 1300 that conceptually illustrates several operations performed to reject an unauthorized UE while ensuring that such rejection does not affect the service of the UE on any other authorized FAP. In some embodiments, the processing 1300 is all performed by the FAP of the femtocell system, but in other embodiments, the FAP performs the processing in FIG. 13 together with the GANC or AAA server. When the UE enters the coverage area of the FAP and initiates an RRC connection with a specified reason code (at 1305), the process 1300 starts. The process (at 1307) determines whether the specified reason code specifies an emergency service request. If the reason code specifies an emergency service request, the process will (at 1315) allow the UE to access the femtocell system regardless of whether the UE is authorized to access the femtocell system in order to establish the emergency service request. In this case, the service access control process is bypassed. For those of ordinary skill in the art, it is obvious that if the process determines that the UE is not authorized to access and further determines the availability of the macro system coverage, then in some such cases, the process 1300 performs the UE's rejection operation in order to pass the core The net establishes an emergency service request. In addition, some embodiments of the process 1300 allow the UE to access the femtocell system based on a specified reason code other than the emergency service request, regardless of whether the UE is authorized to access.

If the process (at 1307) determines that the reason code does not specify an emergency service request, the process waits for the UE (at 1310) to initiate a service request message, such as a location update message, to the FAP. When the processing service request message is received, the processing (at 1320) determines whether the UE is allowed to access the FAP by searching the service access control of the FAP. In some embodiments, the judgment at 1320 is performed based on whether the UE IMSI is in the allowed list of UE IMSI. However, as discussed above, some embodiments provide network-based service access control, where UE IMSI authentication is performed together with the AAA server or INC of the femtocell system.

If the process determines that the UE is authorized to access (at 1320), the UE is allowed to continue to issue a location update request (at 1330), and the UE can register with the FAP and femtocell system and utilize the services provided by the FAP and femtocell system. However, if you deal with FAP-based service access

200880005462.5 First entry control, determine that the UE is not authorized to access (at 1320), then process (at 1340) to determine whether the UE has been denied a specified number of times. In some embodiments, the determination at 1340 is used to determine what type of rejection is suitable for the UE_OIn addition, processing includes making a judgment to identify whether macro coverage is available (at 1350). In some cases, more persistent denials are needed to prevent the UE from constantly trying to re-access the FAP. This rejection is suitable to prevent the UE from constantly moving back and forth between a network and the femtocell system (ie, if macro coverage is available). In other cases, a more temporary rejection of the UE is sufficient. For example, if the UE briefly moves through the coverage area of the FAP, and the UE will not return, nor will it continuously request service from a specific FAP of the femtocell system, then the temporary rejection is sufficient to make the UE try other optional accesses. Access point or network to obtain service.

If the UE has reached the threshold number of allowed rejections, the process (at 1360) will perform a network-based rejection (ie, a more permanent rejection) to prevent further access attempts by the UE. The network-based rejection is described in more detail below with reference to FIG. 14. If the UE has not reached the threshold number of allowed rejections, the process (at 1370) performs authentication-based UE rejection. Then, the process (at 1380) determines whether the authentication-based UE rejection is successful. If it succeeds, the process ends, and the UE will not try to connect to the FAP again. However, an unsuccessful authentication-based UE rejection may indicate that additional or alternative forms of rejection may be required. In some embodiments, when some UEs do not correctly respond to the authentication-based UE rejection, an alternative form of rejection is required because the authentication-based UE rejection requires mutual authentication between the UE and the FAP. However, the UE with 2G SIM only performs one-way communication, so when it is applied to the UE with 2G SIM, the authentication-based UE rejection will not succeed. The UE rejection based on authentication is described in more detail below with reference to FIG. 15.

In FIG. 13, the process 1300 also includes operations 1390 and 1395 for performing an alternative type of UE rejection for a UE with a 2G SIM (ie, there is no global SIM (USIM)). At 1390, the process triggers an "RRC CONNECTION RELEASE" message with a redirection message (REL-6) to redirect the UE to the identified macro network. Alternatively, at 1390, the process may issue an "RRC CONNECTION RELEASE" message, and then issue an RRC CONNECTION REJECT (RRC connection rejection) message with redirection information to redirect unauthorized UEs to the macro cell. Then, the UE that received the release message (at 1395) attempts to camp on the appropriate cell at the re-directed frequency. In some embodiments, the re-directed frequency is the same as that used when transferring data to and from the femtocell system The frequency is different from the frequency. However, if the processing cannot locate the co-location used to redirect the UE

200880005462.5 The most suitable macro network can alternatively deal with releasing the RRC connection, and then reject the UE within the maximum waiting time.

For those of ordinary skill in the art, it is obvious that due to certain bias parameters advertised by the FAP, or due to the unavailability of the redirected macro network, the UE may reconnect to the FAP, which may lead to unsuccessful redirection of the UE. In this case, the determination at 1340 allows a specified number of reconnection attempts before the more permanent network-based rejection at 1360 is performed.

FIG. 14 shows a process 1400 that intentionally shows several operations performed by the GANC in order to reject an unauthorized UE and prevent the UE from further attempting to connect to a specific FAP again. When the GANC receives from the FAP a request for network-based rejection of the designated UE IMSI (at 1410), the process 1400 begins. The process then retrieves (at 1420) the list of FAPs associated with the specified UE IMSI from the AAA server. In some embodiments, the retrieved list specifies the FAP through which the UE is authorized to receive the service. If the processing (at 1430) determines that the retrieved FAP list is empty, the UE is considered to be not a user of a specific femtocell service provider Therefore, at 1440, the process returns the location area disallowed rejection code to the UE through the "LOCATION UPDATING REJECT" message. It is obvious to those of ordinary skill in the art that the rejection code designation of some embodiments leads to Some other appropriate reason codes for LA being forbidden. When receiving the LA not allowed rejection code, the UE will store the LAC associated with the FAP in the forbidden list in its SIM, and the UE will try to camp on a different LA Different cells within the FAP. Because of the FAPs LAC Currently in the UE's LA prohibition list, as long as the FAP is allocated to the prohibited LAC and the UE is not restarted, the UE will not try to connect to the FAP again. If the UE is located in the coverage area of the macro network, it is possible that the UE will locate and connect through the location area of the macro network.

However, if the process determines that the retrieved FAP list is not empty (at 1430), the process performs additional checks to ensure that the operation of issuing the LA disallowed denial code does not prevent the UE from accessing other FAPs that the UE is authorized to access. . Therefore, the process (at 1450) performs a check to determine whether any FAP that the UE is authorized to access is not assigned to the same LAC as the specific FAP that is trying to deny the UE. If the process (at 1460) does not identify any conflicts, then it is safe to issue (at 1480) the LA disallowed rejection code or other appropriate reason code that caused the LA to be banned. When receiving the LA not allowed rejection code, the UE will store the LAC associated with the LA in its forbidden list, and the UE will terminate any subsequent attempts to reconnect to any specific FAP with the forbidden LAC. If the processing (at 1460) identifies a conflicting LAC, or the processing cannot be detected

200880005462.5 The FAP list is retrieved, then the process (at 1470) allocates a new conflict-free LAC for the FAP that the UE is not authorized to access. In this way, the UE can return to any other FAP that it is authorized to access, and still get a connection through such FAP.

In some embodiments, the newly allocated conflict-free LAC is allocated from the LAC reserved pool reserved for such conflicts. The re-allocated FAP receives the newly allocated LAC through the revised "system information" carried in the GA-RC REGISTER UPDATE DOWNLINK (GA-RC registration update downlink) message, and the newly allocated LAC remains valid for a fixed period of time After this period of time, the FAP will be re-allocated with its original LAC, or a different one from the available LAC pool

Although LAC has described the rejection mechanism specified in 1400 relative to LAC, it is obvious to those of ordinary skill in the art that when unauthorized RAI (because LAC is part of LAI, and LAI is part of RAI) is When used to access the femtoce 11 system through FAP, some embodiments perform a similar form of UE rejection.

As described with respect to 1350 and 1370 of FIG. 13, some embodiments may implement UE rejection instead of having to prohibit LACo associated with rejecting FAP. In some such embodiments, authentication-based UE rejection is used. Figure 15 shows a process 1500, which conceptually illustrates several operations performed by the FAP to reject unauthorized UEs using authentication-based UE rejection. Process 1500 begins with sending (at 1510) a UMTS AKA challenge message such as "AUTHENTICATION REQUEST" to the UE. However, this message will omit the AUTN parameter. The rejected UE will receive the inquiry message and will recognize the lack of AUTN parameters. In response, the UE will send an "AUTHENTICATION FAILURE" message, which is received by process 1500 (at 1520). The process (at 1530) sends a second similar UMTS AICA inquiry message to the UE. As mentioned earlier, because the AUTN parameter is omitted, the process will receive an AUTHENTICATION FAILURE message from the UE (at 1540). The third such exchange occurred (at 1550 and 1560).

When the UE receives the failed third "AUTHENTICATION REQUEST" and responds to the authentication request, the UE's mobility management layer will ban the current cell and release the RRC connection with the FAP. Moreover, the UE performs cell reselection and will try to camp on the cell of the macro network. For those of ordinary skill in the art, it is obvious that different mobility management layers may require a smaller number of invalid "AUTHENTICATIONREQUEST" messages. In addition, if the UE contains 2G SIM, then the UE will not use "AUTHENTICATION FAILURE

200880005462.5 The first message to respond to invalid "AUTHENTICATIONREQUEST", this rejection mechanism will not work. Therefore, the process (at 1570) checks whether the UE has disabled the FAP cell. If not, the process determines that the UE contains a 2G SIM, and (at 1580) performs UE rejection as described with reference to 1390 and 1390 of FIG. 13.

IV. Computer System FIG. 16 conceptually shows a computer system used in implementing some embodiments of the present invention. The computer system 1600 includes a bus 1605, a processor 1610, a system memory 1615, a read-only memory 1620, a permanent storage device 1625, an input device 1630, and an output device 1635.

The bus 1605 collectively represents all system buses, peripheral buses, and chipset buses that support communication between the internal devices of the computer system 1600. For example, the bus 1605 communicably connects the processor 1610 with the read-only memory 1620, the system memory 1615, and the permanent storage device 1625.

The processor 1610 obtains instructions to be executed and data to be processed from these various storage units to execute the processing of the present invention. In some embodiments, the processor includes a field programmable gate array (FPGA), ASIC, or various other electronic components for executing instructions. Read only memory (ROM) 1620 stores static data and instructions required by the processor 1610 and other modules of the computer system. On the other hand, the permanent storage device 1625 is a read-write storage device. This device is a non-volatile storage unit that stores instructions and data even when the computer system 1600 is powered off. Some embodiments of the present invention use mass storage devices (such as magnetic or optical disks and their corresponding drives) as permanent storage devices 1625. Some embodiments use one or more removable storage devices (flash cards or memory sticks) as permanent storage devices.

Similar to the permanent storage device 1625, the system memory 1615 is a read-write storage device. However, unlike the storage device 1625, the system memory is a volatile read-write memory, such as a random access memory. The system memory stores a part of instructions and data needed by the processor at runtime.

Instructions and/or data required to perform the processing of some embodiments are stored in the system memory 1615, the permanent storage device 1625, the read-only memory 1620, or any combination of the three. For example, various memory units contain instructions for processing multimedia items according to some embodiments. The processor 1610 obtains instructions to be executed and data to be processed from these various storage units, so as to perform the processing of some embodiments.

The bus 1605 is also connected to an input device 1630 and an output device 1635. The input device enables the user to transmit information and selection commands to the computer system. Input device 1630 includes an alphanumeric keyboard

200880005462.5 No. and cursor controller. The output device 1635 displays images generated by the computer system. The output device includes a printer and a display device, such as a cathode ray tube (CRT) or a liquid crystal display (LCD). Finally, as shown in Figure 16, the bus 1605 also couples the computer 1600 to the network 1665 through a network adapter (not shown). In this way, the computer can be a computer network (such as a local area network ("LAN")), a wide area network (" WAN") or intranet), or one of multiple networks (such as the Internet). Those of ordinary skill in the art should recognize that any or all of the components of the computer system 1600 can be used in conjunction with the present invention. For example, a part or all of the components of the computer system described with reference to Figure 16 include some embodiments of the aforementioned UE, FAP, GANC, and GGSN. In addition, a person of ordinary skill in the art will understand that any other system configuration may also be compatible with the present invention or the present invention. The components of the invention are used together.

For the purpose of explanation, the above description uses specific terminology to provide a thorough understanding of the present invention. However, it is obvious to those skilled in the art that it is not necessary to satisfy those specific details to realize the present invention. Therefore, the foregoing description of the specific embodiments of the present invention is provided for the purpose of illustration and description. They are not exhaustive, nor do they limit the invention to the exact form disclosed; it is obvious that many modifications and variations can be made based on the above teachings. The various embodiments are selected and described in order to best explain the principles of the present invention and its practical applications. Therefore, they enable other skilled in the art to make the best use of the present invention in various modifications suitable for specific application scenarios. And various embodiments. In addition, although the present invention has been described with reference to numerous specific details, those of ordinary skill in the art will recognize that the present invention can be implemented in other specific forms without departing from the spirit of the present invention.

In some examples and figures, two components may be described or shown as being connected to each other. This connection can be a direct wire connection, or it can be through other components or through a wireless or broadband link to communicatively couple the two components to each other. Therefore, those of ordinary skill in the art will understand that the present invention is not limited by the details described above, but is defined by the appended claims.

Appendix I-Abbreviations

AAA authorization, authentication and accounting (Authorization, Authentication and Accounting

Accounting)

AMS FAP Management System (FAP Management System)

AP access point (Access Point)

200880005462.5 No.

ASIC

ATM

BSC

BSS

BTS

CBC

CGI

CI

CMTS

CN cs

DB

DSL

DSLAM

EAP

EDGE

FAP

GAN

GANC

GERAN

GGSN

GMLC

GMM/SM

GPRS

GSM

HPLMN

HLR

ICS Application Specific Integrated Circuit Asynchronous Transfer Mode Base Station Controller Base Station Subsystem Base Transceiver Station Cell Broadcast Center ) Cell Global Identification, Cell Identifier, Cable Modem Termination Services, Core Network, Circuit Switched, Database, Digital Subscriber Line ) Digital Subscriber Line Access Multiplexer (Digital Subscriber Line Access Multiplexer) Extensible Authentication Protocol (Extensible Authentication Protocol) Protocol) Enhanced Data Rates for GSM Evolution

Femtocell Access Point (Generic Access Network) GAN Network Controller (GAN Network Controller) GSM EDGE Radio Access Network (GSM EDGE Radio Access Network) Gateway GPRS Support Node (Gateway GPRS Support Node) Gateway Mobile Location Center GPRS Mobility Management and Session Management General Packet Radio Service (Global System for Mobile communications) Home PLMN (Home PLMN) ) Home Location Register (Home Location Register) Integrated Communication System (Integrated Communication System)

200880005462.5 No.

IMSI

INC

IP

IPSec

ISDN

ISP

LA

LAC

LAI

LU

MAC

MCC

MG or MGW

MM

MN

MNC

MS

MSC

NAT

PCS

PLD

PLMN

POTS

PS

PSAP

PSTN

RA

RAC

RAI

RAM International Mobile Subscriber Identity (International Mobile Subscriber Identity)

IP Network Controller (IP Network Controller) Internet Protocol (Internet Protocol) Internet Protocol Security (IP Security) Integrated Services Digital Network (Integrated Services Digital Network) Internet Service Provider (Internet Service Provider) Location Area (Location Area) Location Area Code (Location Area Code) Location Area Identifier (Location Update) Media Access Control or Message Authentication Code (Medium Access Control or Message Authentication Code) Mobile Country Code (Mobile Country Code) Media Gateway (Media Gateway) ) Mobility Management (Mobility Management) Macro Network (Macro Network) Mobile Network Code (Mobile Network Code) Mobile Station (Mobile Station) Mobile Switching Center (Mobile Switching) Center) Network Address Translation (Network Address Translation) Personal Communications Services (Personal Communications Services) Programmable Logic Device (Programmable Logic Device) Public Land Mobile Network (Public Land Mobile Network) Plain Old Telephone Service (Plain Old Telephone Service) Packet Switching ( Packet Switched) Public Safety Answering Point (Public Safety Answering Point) Public Switched Telephone Network (Routing Area) Routing Area Code (Routing Area Code) Routing Area Identity (Routing Area Identity) Random Access Memory ( Random Access Memory)

200880005462.5 No.

RNC

ROM

RRC

SAC

SAI

SEGW

SGSN

SIM

SIP

SMLC

SMS

SSID

TCP

UE

UMTS

UNC

UTRAN

VLR

WLAN Radio Network Controller Read Only Memory Radio Resource Control Radio Resource Control Service Area Code Service Area Identifier GANC Security Gateway (GANC Security Gateway) ) Serving GPRS Support Node (Serving GPRS Support Node) Subscriber Identity Module (Session Initiation Protocol) Serving Mobile Location Center (Serving Mobile Location Center) Short Message Service (Short Message Service) Service Set Identifier ( Service Set Identifier) (also known as Network Name") Transmission Control Protocol (User Equipment) Universal Mobile Telecommunication System (Universal Mobile Telecommunication System) Global Network Controller (Universal Network Controller)

UMTS Terrestrial Radio Access Network (UMTS Terrestrial Radio Access Network) Visited Location Register (Wireless Local Area Network)

200880005462.5