Advanced triggers for location-based service applications in a wireless location system

ADVANCED TRIGGERS FOR LOCATION-BASED SERVICE APPLICATIONS IN A WIRELESS LOCATION SYSTEM

CROSS reference

[0001] This application claims priority to U.S. Application No. 11/150,414, filed June 10,2005, entitled “Advanced Triggers for Location-Based Service Applications in a Wireless Location System, which is a coniinuation-m-part of U. S. Application No. 10/768,587, filed January 29,2004, entitled “Monitoring of Call Information in a Wireless Location System”, now pending, which is a continuation of U.S. Application No. 09/909,221, filed July 18,2001, entitled ‘Monitoring of Call in a Wireless Location System,”[,] now U.S. Patent No. 6,782,264 B2, which is a continuation-in-part of U.S. Application No. 09/539,352, filed March 31,2000, entitled “Centralized Database for a Wireless Location System,” now U.S. Patent No. 6,317,604 Bl, which is a continuation of U.S. Application No. 09/227,764, filed Τ^ηητγ 8,1999, entitled “Calibration for Wireless Location System”, now U.S. Patent No. 6,184,829Bl.

FIELD OF THE INVENTION

[0002] The present invention relates generally to methods and apparatus for locating wirelegs devices, also called mobile stations (MS), such as those used in analog or digital cellular systems, personal communications systems (PCS), enhanced specialized mobile radios (ESMRs), and other types of wireless communications systems. More particularly, but not exclusively, the present invention relates to the use of prescribed network message sequences in initiating, or triggering, location-based service applications and re-use of existing radio interface parameters within such message sequences to provide low-accuracy location or to allow tuning of specialized receivers for High accuracy location for a particular subscriber.

PCT/USiW/01*863

WO 20&6/135542 BACKGROUND OF THE INVENTION

[0003] Early work relating to Wireless Location Sterns is described in U.S. Pai. No. 5.327.144. Jul. 5, 1994.- Cellular Telephone Location System, which discloses a system for locating cellular telephones using time difference of arrival (TDOA) techniques. Further enhancements of the system disclosed in the '144 patent are disclosed in U.S. Pat No. 5,608,410, Mar. 4,1997, System for Locating a Source of Bursty Transmissions. Both of these patents are assigned to TruePosition, Inc., the assignee of the present invention. TruePosition has continued to develop significant enhancements to the original inventive concepts.

[0004] Over the past few years, the cellular industry has increased the number of air interface protocols available for use by wireless telephones, increased the number of frequency bands in which wireless or mobile telephones may operate, and expanded the number of־terms that refer or relate to mobile telephones to include personal oommunications services, wireless, and others. The air interface protocols now used in the wireless industry include AMPS, N-AMPS, TDMA, CDMA, GSM, TACS, ESMR, GPRS, EDGE, UMTS WCDMA, and others.

[0005] The viability and value of Wireless Location System technology has been extensively demonstrated. In 2004 and 2005, TruePosition (the assignee of the present invention) installed E-911 Wireless Location Systems in more than 40,000 Base Transceiver Stations (BTS), providing emergency location coverage for wireless subscribers across the continental United States.

[0006] The wireless ηητητττπηί cations industry has acknowledged the value and importance of the Wireless Location System. In June 1996, the Federal Communications Commission issued requirements for the wireless communications industry to deploy location systems for use in locating wireless 9-11־ callers. Widespread deployment of these systems can reduce emergency response time, save lives, and save enormous costs because of reduced use of emergency response resources. In addition, surveys and studies have concluded that various wireless applications, such as location sensitive billing, fleet. management, and others, will have great commercial value in the coming years.

[0007] As mentioned, the wireless communications industry uses numerous air interface protocols in differ mt frequency bands, both in fee U.S. and internationally. In general, neither fee air interface nor the frequency bands impact fee Wireless Location System’s effectiveness at locating wireless telephones.

[0008] AH sir interface protocols use two categories of channels, where a channel is defined as one of multiple transmission paths within a single link between

WO 2006/135542 PCT/USZOOS/OlSSeS points ze a wireless network A channel may be defined by frequency, by bandwidth, by synchronized time slots, by encoding, shift keying, modulation scheme, or by any .combination. of these parameters.

[00&9] lhe first category, called control or access channel, is used to convey information about the wireless telephone or transmitter, for initiating or terminating calls, or for trCTgferring bursty data. For example, some types of short messaging services transfer data over the control channel. Different air interfaces use different terminology to describe control channels but the function of the control channels in each air interface is similar.

[0010] The second category of channel, known as voice or traffic channel, typically conveys voice or data nommimi cations over the air interface. Traffic channels come intn use once a call has been set up using the control channels. Voice and user data channelg typically use dedicated resources, i.e., the channel can be used only by a single mobile device, whereas control channels use shared resources, i.e., the channel can be accessed by multiple users. Voice channels generally do not cany identifying information about the wireless telephone or transmitter in file transmission. For some wireless location applications this distinction can make the use of control channels more cost effective than the use of voice channels, although for some applications location on the voice channel can be preferable.

[0011]. The following paragraphs discuss some of the differences in the air interface protocols:

[0012] AMPS — This is the original air interface protocol used for cellular communications in the U.S. and described in ΏΑ/ΕΙΑ Standard IS 553A. The AMPS system assigns separate dedicated channels for use by control channels (RCC), which are defined according to frequency and bandwidth and are used for transmission from, the BTS to the mobile phone A reverse voice channel (RVC), used for transmission from the mobile phone to the BTS, may occupy any channel that is not assigned to a control charm&l.

[0013] N-AMPS - This air interface is an expansion of the AMPS air interface protocol, and is defined in EIA/TIA standard IS-88. It uses substantially the same control channels as are used in AMPS but different voice channels with different bandwidth and modulation schemes.

[0014] TDMA - This interface, also known as D-AMPS and defined in EIA/TIA standard IS-136, is characterized by the use of both frequency and time separation. Digital Control Channels (DCCH) are transmitted in bursts in assigned

WO 2OTS/135542 PCT/nS2M6/019863 timeslots that may occur anywhere in ths frequency band. Digital Traffic Channels (DTQ may occupy the same frequency assignments as DCCH channels but not the same timeslot assignment in a given frequency assignment In the cellular band, a carrier may uss both the AMPS and TDMA protocols, as long as the frequency assignments for each protocol are kept separated.

[0015] CDMA - This air interface, defined by ΕΙΑ/ΠΑ standard IS-95 A is characterized by the use of both frequency and code separation Because adjacent cell sites may use the same frequency sets, CDMA must operate under very careful power control, producing a situation known to those skilled in the art as the near-far problem, makes it difficult for most methods of wireless location to achieve an accurate location (but see U.S. Patent No. 6,047,192, April 4, 2000, Robust, Efficient, Localization System, for a solution to this problem). Control channels (known in CDMA as Access Channels) and Traffic Channels may share the same frequency band but are separated by code.

[0016] GSM - This air interface, defined by the international standard Global System for Mobile Communications, is characterized by the use of both frequency and time separation. GSM distinguishes between physical channels (the timeslot) and logical channels (the information carried by the physical channels). Several recurring timeslots on a carrier constitute a physical channel, which are used by different logical channels to transfer information ־ both user data and signaling.

[0017] Control channels (CCH), which include broadcast control channels (BCCH), Common Control Channels (CCCH), and Dedicated Control Channels (DCCH), are transmitted in bursts in assigned timeslots for use by CCH. CCH may be assigned anywhere in. the frequency band Traffic Channels (TCH) and CCH may occupy the same frequency assignments but not the same timeslot assignment in a given frequency assignment CCH and TCH use the same modulation scheme, known as GMSK. The GSM General Packet Radio Service (GPRS) and Enhanced Data rates for GSM Evolution (EDGE) systems reuse the GSM channel structure, but can use multiple modulation schemes and data compression to provide higher data throughput GSM, GPRS, and EDGE radio protocols are subsumed by the category known as GERAN or GSM Edge KaHin Access Network.

[0018] UMTS - Properly known as UTRAN (UMTS Terrestrial Radio Access Network), is an air interface defined by the international standard third Generation Partnership program as a successor to the GERAN protocols. UMTS is also sometimes known as WCDMA (or W-CDMA), which stands for Wideband Code Division Multiple

WO 20&6/135542 PCT/US20&6/0L9863 iroc-ess. WCDMA. is direct spread technology, which means that it ־will spread its transmissions over a wide, 5MHz earner.

[0019] The WCDMA FDD (Frequency Division Duplexed) UMTS air interface (the U- interface) separates physical channels by both frequency and code. The WCDMA TDD (Time Division Duplexed) UMTS air interface separates physical channels by the use of frequency, time, and code.

[0020] All variants of the UMTS radio interface contain logical channels that are mapped to transport channels, which are again mapped to W-CDMA FDD or TDD physical channels. Because adjacent cell sites may use the same frequency sets, WCDMA also uses very careful power control to counter the near-far problem common to all CDMA systems.

[0021] Control ch arm els in UMTS are known as Access Channels whereas data or voice channels are known as Traffic Channels. Access and Traffic Channels may share the same frequency band and modulation scheme but are separated by code. Within this specification, a general reference to control and access channels, or voice and data channels, shall refer to all types of control or voice and data channels, whatever the preferred terminology for a particular air interface. Moreover, given the many types of air interfaces (e.g., IS-95 CDMA, CDMA 2000, UMTS, and W-CDMA) used throughout the world, this specification does not exclude any air interface from the inventive concepts described herein. Those skilled in the art will recognize other interfaces used elsewhere are derivatives of or similar in class to those described above.

[0022] GSM networks present a number of potential problems to existing Wireless Location Systems. First, wireless devices connected to a GSM/GPRS/UMTS network rarely transmit when the traffic channels are in use. The use of encryption on the traffic channel and the use of temporary nicknames (Temporary Mobile Station Identifiers (TMSI)) for security render radio network monitors of limited usefulness for triggering or tasking wireless location systems. Wireless devices connected, to such a GSM/GPRS/UMTS radio network merely periodically “listen” for a transmission to the wireless device and do not transmit signals to regional receivers except during call setup, voice/data operaiion, and call breakdown. This reduces the probability of detecting a wireless device connected to a GSM network. It may be possible to overcome this limitation by actively “pinging all wireless devices in a region. However, this method places large stresses on the capacity of the wireless network. In addition, active pinging of wireless devices may alert mobile device users to the use of the location system, which can reduce ths effectiveness or increase the annoyance of a polling location-based Epp ij cation.

SUMMARY OF THE INVENTION

[0023] The following summary provides an overview of various aspects of exemplary implemsatations of the invention. This summary is not intended to provide an exhaustive description of all of the important aspects of the invention, or to define the scope of the invention. Rather, this summary is intended to serve as m introduction to the following description of illustrative embodiment?

[0024] Method and systems in accordance with the present invention are employed by a wireless location system (WLS) for locating a ־wireless device operating in a geographic area served by a wireless communications system. An exemplary method includes monitoring a set of signaling links of the wireless communications system, and detecting at least one predefined signaling transaction occurring on at least one of the predefined signaling links- Then, in response to the detection of the at least one predefined network transaction, at least one predefined location service is triggered

[0025] For example, in accordance with the present invention, a Link Monitoring System (IMS) maintains tables of Abis, A and GSM-MAP interface traffic on a subscriber-by-subscriber basis. U.S. Patent No. 6,782,264 B2, August 24, 2004, Monitoring of Call Information in a Wireless Location System, discloses how an AMS, an early incarnation of the present LMS, can be used advantageously to initiate location services and schedule radio resources in a Wireless Location System. In the context of the present invention, this retained subscriber information can allow the location of wireless devices to be determined while a subscriber is placing a call, on a call, or even idle. The retained network infoimation can allow for the location of subscribers in an area or in proximity to another specified mobile device. In accordance with the present invention, a scries of triggers can be used to effectively locate wireless devices, and this ability to locate wireless devices can be leveraged for possible security-related functions. The series of triggers can include a called-number trigger, MSISDN and IMSI triggering, idle mobile location trigger, list of all mobile devices recently in set of cells (CGI) triggering, background location of all subscribers in set of cells (CGI) triggering, and smart proximity identification triggering. (Those skilled in the art will appreciate that a cell is the area given radio coverage by one base transceiver station, or BTS, and that the rf-andarti GSM network identifies each cell via the cell global identity (CGI) number assigned to each cell. A location area (LA) is defined in GSM parlance as a group of

WOMWUSMi ?CT/US2MM1S8S3 cells, and is the area m which the subscriber is paged. Each LA xs served by one or more base station controllers, or BSCs, and is assigned a location area identity (LAI) number.)

[0026] For examole, a wireless device can be located based on the number called by the wireless device. The system can be tasked with a dialled digit trigger at the Link Monitoring System (LMS) in accordance with an aspect of the present invention. (As described below, an LMS in accordance with the present invention may be viewed as an enhannftH version of an Abis Monitoring System.) Once the trigger is tasked, the system can automatically locate any wireless device in the service area dialling the specified “trigger” number. For example, when the specified “trigger” number is dialled by another wireless device, the Wireless Location System can identify and locate the wireless device that called the specified “trigger” number. Further, existing AMS tTiggp!r/taciting tables support international dialling lengths, and therefore even international numbers can be used as the “trigger” number. (U.S. Patent No. 6,519,465 B2, Feb™ ary 11,2003, Modified Transmission Method for Improving Accuracy for E911 Calls, describes that an E911 “trigger” may be stored in a phone and employed to cause the phone to transmit a special signal when the user dials 911. The special signal assists the WLS in locating the phone.)

[0027] A system in accordance with the present invention may be configured to locate a wireless device by its International Mobile Station Identity (IMSI). An IMSI or list of IMSIs can be loaded into the LMS. The LMS can scan the Abis and A messaging tiffin until the IMSI-to־TMSI correlation can be verified and retained. The IMSI-TMSI association is updated with changes when the LMS notifies the Serving Mobile Location Center (SMLC). The discovered IMSI is then set as a trigger so that the mobile device of interest can be located at a later time.

[0028] The system may also be configured to locate idle mobile devices in a network by requesting the Gateway Mobile Location Center (GMLC) to submit Any Time Interrogation (AH) queries to the HLR Submission of ATI queries to the HLR can result in a call being placed to the wireless device by the network, using supplementary services. The call placed to the wireless device by the network can page and authenticate the wireless device without placing the wireless device on a traffic channel or otherwise notifying the subscriber of the call. During the paging and authentication messaging, the system can use U-TDOA io process and accurately determine the location of the wireless device. A lower accuracy CGI+TA location is automatically generated by this transaction. Acting as a GSM Service Control Function (gsmSCF), the GMLC may use ATI to request information (e.g., subscriber state and location information) from the HLR

WOMO«l־SMi . PCT/US2006/«1^3 at any time. The ATI procedure can be used to transition the MS from an idle state to an active signaling state which then, can be located with high-accuracy by the wireless location system.

[0029] Wireless devices may also be identified and located based on their presence in a defined geographic area. This feature can be accomplished by loading a location area, defined as a set of cells (CGIs), into the IMS. The IMS then develops a list of IMSIs, MSISDNs, and associated TMSIs that imtiaie a network transaction in the geographic area of interest. A network transaction for this feature may be defined as a call origination or termination, a SMS exchange, and a location update (i.e., a GSM MAP “location” update for the purposes of roaming as opposed to a U-TDOA location event). .

[0030] Mobile devices can also be identified and located based on their historical presence in a pre-defined geographic area. The background location feature can allow an operator to define an area of interest, collect the IMSI/TMSI information for mobiles that had a network transaction in the area of interest, and locate the identified mobiles on later network transactions.

[0031] Mobile devices can also be identified and located on the basis Of proximity to another mobile device using Smart Proximity Identification. The Smart Proximity Identification feature can be used to allow an operator to obtain a list of wireless derices operating in the same area as a mobile device of interest For example, a set of wireless devices operating in an area near a known wireless device of interest can be located The known wireless device can be located ria its known mobile ID. Subsequently, a complete list of mobile devices in the same area can be det&u !lined The mobiles found in the same geographic area as the mobile of interest can then be queried via Anytime Interrogation (ATI) and the supplementary services and the locations produced can be used to determine proximity to the mobile of interest.

[0032] Additional features and advantages of the invention will be made apparent from the following detailed description of illustrative embodiments.

brief description of the drawings

[0033] The foregoing summary, as ־well as the following detailed description, is better understood when read in conjunction with the appended drawings. For the purpose of illustrating the invention, there is shown in the drawings exemplary constructions of the invention; however, the invention is not limited to the specific methods and inntrumentailties disclosed. In the drawings:

S

WO 2006/135542 PCWS2OOM19S53

[0034] Figure 1 illustrates an exemplary architecture for a GERAN/UIRAN network reference in accordance with, foe present invention;

[0035] Figure 1A illustrates foe CGI7CI location for omni cells in accordance wifo foe present invention;

[0036] Figure IB illustrates foe CGI/CI location for sectored cells in accordance ?idfo foe present invention;

[0037] Figure IC illustrates foe CGI+TA location for omni cells in accordance with foe present invention;

[0038] Figure ID illustrates foe CGI+TA location for sectored cells in accordance the present invention;

[0039] Figure IE illustrates Enhanced Cell ID (ECID) with grid mapping in a sectored cell in accordance with foe present invention;

[0040] Figure 2 depicts an exemplary method for foe MSC to obtain foe IMEI of a mobile station in accordance with foe present invention;

[0041] Figure 3 A depicts an exemplary method for an LMS to determine the identity of a mobile station in accordance with foe present invention;

[0042] Figure 3B illustrates an exemplary method of foe SMS origination trigger in accordance with foe present invention;

[0043] Figure 3C illustrates an exemplary method of foe SMS termination trigger in accordance with the present invention;

[0044] Figure 3D illustrates an exemplary method of foe Mobile Origination trigger in accordance with foe present invention;

[0045] Figure 3E illustrates an exemplary method of the Mobile Termination trigger in accordance with foe present invention;

[0046] Figure 4 depicts an exemplary method of dialed digit triggering in accordance with the present invention;

[0047] Figure 5A depicts an exemplary method of MSID triggering in ar-cordance with foe present invention;

[0048] Figure 5B depicts an exemplary method of using AnyTimelnteiTogation (ATI) in accordance with the present invention;

[0049] Figure 5C depicts an exemplary method of using SMS ping in accordance with foe present invention;

[0050] Figure 6 depicts an exemplary method of using historical cell location in accordance with foe present invention;

Figure 7 depicts an exemplary

PCT/US2£K»6/01?863 method of using Cell ID triggers in accordance with the present invention;

[0052] Figure 8A depicts an exemplary method for detection of mobiles oased on location and time m accordance with the present invention;

[0053] Figures 8B, SC and SD illustrate an exemplary method of Smart Proximity Location in accordance with the present invention;

[0054] Figure 8E illustrates a the Location Area Identity code in accordance with, the present invention;

[0055] Figure 8F is a flowchart of an exemplary process for detecting an idle mobile with a statin LAC in accordance with the present invention;

[0056] Figure 8G is a flowchart of an exemplary process for detecting a mobile during handover in accordance with the present invention;

[0057] Figure 81 is a flowchart of an exemplary process for detecting a mobile using proximity detection in accordance with the present invention;

[0058] Figure 81 is a flowchart of an exemplary process for dynamically detecting a mobile using geo-fencing in accordance with the present invention;

[0059] Figures 8K, 8L, 8M, 8N, 80, and 8P illustraie exemplary cell non figurations in accordance with the present invention; and

[0060] Figure 9 is a flowchart of an exemplary process for detecting a mobile using calling number triggering in accordance with the present invention.

DETAILED DESCRIPTION OF ILLUSTRATIVE EMBODIMENTS

A- Overview

[0061] The inventive system, described herein may be viewed as a substantial extension of the system described in U. S. Application No. US20040007685S7, and its parent, U.S. Patent No. 6,782,264 (Anderson). For example, while the ‘264 patent describes a system that monitors mwmunications between a base transceiver station and base station controller, and forwards mobile station (MS) information to a Wireless Location System for emergency call location, the advanced location-based services applications described herein utilize additional network messages as triggering events and information sources for a wide variety of location-based services.

[0062] It should be noted that many of the acronyms and abbreviations used herein are taken from Technical Report GSM 01.04 V8.0.0 (2000-05), Digital cellular telecommunications system (Phase 2+); version 8.0.0 (Release 1999); Abbreviations and acronvms.Tbe terminology and nomenclature used to describe this invention are yTO 2W6/15SM1 PCT/US200«0m6J to be uou-touitmg ־ad ־r־ b־s־d □n th־ GSM d־&־itions pubUsted by 4!־ GSM Association in Tenns & Acronyms״ This publication is available at ^.//^.^0Γ'Η^^ο'ο»/?10=^־π-5ίίη1 H־>w־v־r, although GSM-centric _m used, th־ concepts embodied in the subject matter described herein apply m otherwireless radio communications networks.

[0063] in Universal Mobile Telecommunications System (UMTS), the planned successor to GSM, the wideband Code Division Multiple Access (W-CDMA) radio iuterfta will benefit ftom use of wideband radio network monitor (RNM) receivers for passive radio monitormg. Wideband locarion measuring units IJMtt) ™y be used for higb-accuracy U-TDOA and Α0Α location. Changes to the interface and interoperability by a־ Third Generation Partnership Program (3GPP) mean that some of the acronyms and naming conventions change, but foe operations performed in Ih־ radio control network and intelligent services network remain substantively the same. Thus, m this specification, these items can be viewed as equivalents:

<td> ׳־ יי ' ־ל. .ל '</td><td> .־.' Lז &gt;־ lt lL W.A־ l.v. δ wj.</td>

<td> Cell Global Identifier (CGI)________</td><td> Cell ID (Cl)_________________</td>

<td> Timing Advance (TA)__</td><td> ________¹/a Round-Trip-Time (R.11)_________ Tub Interface</td>

<td> Abis Interface____ A Interface</td><td> lu-CS (circuit Switched) or Iu־PS (Packet _______Switched)________________</td>

<td> Abis Monitor ([L] AMS)________</td><td> ______lub Monitor (IMS)___________</td>

<td> Base transceiver station (B1 b)</td><td> Node-B______________</td>

<td> Rmcf* ctatinn Controller (BSC)</td><td> Radio Network Controller (RNC)</td>

<td> _____Mobile Station (MS) ________</td><td> User Equipment (UE)__________,</td>

<td> Subscriber Information Module (SIM)___</td><td> User Service Identity Moanie (USIMJ</td>

[0064] Figure 1 shows the architecture of an illustrative GERAN/UTRAN network reference model 10 with a Radio Network Monitor (RNM) 82 and a Link Monitoring System (IMS) 11 Ike RNM 82 is effectively a bank of narrowband receivers tonable to both the uplink and downlmk channels anywhere in the frequency band. The RNM was initially implemented on the TmePosition® AnyPhone™ location Measuring Unit (LMU) radio receiver platform (the present LMU was previously described in US Patent No. 6,782,264 as the alternative narrowband embodiment of the receiver module for the SCS). The IMS is an improvement to the Abis monitor described in US Patent No. 6,782,264 and is able to monitor not only the Abis and A interfaces, but also the GSM-MAP, lub, lu-PS and lu-CS interfaces. The LMS can be implemented, with modifications, on the same hardware/software chassis as the Abis Monitor (a set of

WO 2006/13542־ __ _ PCT/US2006/019863 custom applications with unmodified Agilent Access? software application running on a cluster of Intel TSEMT2 or TSRLT2 UNIX servers).

[0065] The network 10 further includes a .Serving Mobile Location Center (SMLC) 12. The RNM S2 is the primary component that can be deployed at a earner's cell sites. The RNM §2 is preferably implemented as a distributed network of radio receivers capable of receiving RACH and SDCCH messages for autonomous generation of location services. The RNM 82 tunes to directed frequencies to gather data for the system. The RNM 82 can then forward the collected data to the SMLC 12. All RNMs 82 in a network are preferably time-and frequency-synchronized through the use of the Global Positioning Satellite (GPS) constellation (not shown).

[0066] The SMLC 12 is preferably a high volume location-processing platform. The SMLC 12 c-nntsing U-TDOA and multipath mitigation algorithms for computing location, confidence interval, speed, and direction of travel. The SMLC 12 can also determine which wireless phones to locate based upon triggering from the Link Monitoring System (LMS) 11 or requests from the 1¾ interface 54 to an infrastructure vendor’s Base Station Controller (BSC) 96 (or MSC 50 in some cases). The SMLC 12 is typically co-located at the operator’s BSC 96 but can also be remotely distributed The primary functions of the SMLC 12 are to receive reports on signal detection from the RNMs 82, to perform location processing, and to calculate the location estimate for each signal. The SMLC 12 manageR the network and provides carries־ access to location records. The SMLC 12 is responsible for the collection and distribution of location records. The SMLC 12 also maintains configuration information and supports network management

[0067] The IMS 11 continuously monitors all Abis signaling Imks 76 (and in some cases A.-interface links 52 and GSM Mobile Application Protocol (GSM-MAP) 48 interface) in a network 10 to which the LMS 11 is connected The function of the LMS 11 is to capture messages in the call (e.g., a GSM voice conversation or a GPRS data session) and SMS setup procedure, mid-call control messages, and call termination and release messages for MSs 80. The LMS 11 then forwards the data contained in those messages to the SMLC 12 for subsequent location processing.

[0068] The GSM service control function (gsmSCF) 20, also called a service control point (SCP), contains database and logical rules for providing non-call oriented services to a subscriber. The GSM Mobile Application Protocol (GSM-MAP) 48 is the communications medium for call-related control services on the wired part of a wireless network. The GSM-MAP 48 exists to provide services like automatic roaming, smhentication, location services intersystem hand-off; and short message service routing on a GSM or UMTS network All wireless network elements such as the MSC 50, BLR 34, VLR (in the MSC 50), GMSC 44 , EIR 32, GMLC 98, and gsmSCF 20 use this merging protocol to commumoaie among each other. The GSM-MAl.48 ׳ resides on the international Signaling System 7 network (SS7).

[0069] The Gateway Mobile Location Center (GMLC) 98 is defined by 3GPP standards as the clearinghouse for location records in a GSM/GPRS/UMTS network. ׳!he GMLC 98 serves as a buffer between the tightly controlled SS7 network (the GSM-MAP network) 48 and the public internet Authentication, access control, accounting, and authorization functions for location-based services are commonly resident on or controlled by the GMLC 9 8.

[0070] The Le interface 24 is an IP-based XML interface originally developed by the Location Interoperability Forum (LIF) and then later standardized by the 3rd Generation Partnership Program (3GPP) for GSM (GERAN) and UMTS (UTRAK). The Location-based services (LBS) client 22 is also known as a LCS (Location Services). The 55¾¾ 3-nH lcs 22 are software applications and services uniquely enabled to use the location of a mobile device.

[0071] The E5+interface 18 is a modification of the B5 interface defined in the Joint ANSI/ETSI Standard 036 for North American E9-1-1. The E5+ interface 18 connects the SMLC 12 and GMLC 98 nodes directly allowing for push operations when LMS 11 or RNM 82 triggers are used by the wireless location system with either network acquired information (cell-ID, NMR, TA, etc) or via TOO A and/or Α0Α (angle of arrival) performed by specialized receivers.

[0072] User equipment (UE) 88 can be defined as equipment such as a UMTS mobile device. NodeB 86 is the Universal Mobile Telephony System Radio Access Network (UTRAN) network interface to the UMTS radio interface. The Radio Network Controller (RNC) 70 enables autonomous radio resource management (RRM) by UTRAN. The RNC 70 performs the same functions as the GSM BSC, providing central control for the RNS elements (RNC and Node Bs). The RNC 70 handles protocol exchanges between In, lur, and Tub interfaces and is responsible for centralized operation and marntmance of the entire radio network system.

[0073] The Serving GPRS Support Node (SGSN) 68 monitors the location of individual GPRS capable Mobile Stations 80 and performs basic security functions and access control functions. The SGSN 68 can serve both the Global System for Mobility (GSM) radio access network (GERAN) and UMTS radio networks.

[0074] The Gateway GPRS Support Node (GGSN) 46 acts as a system routing gateway for the GPRS networic. The GGSN 46 is a connection to external packet data networks (e.g., public internet) and performs the task of biffing, routing, security and access filtering . The Gateway MSC (GMSC) 44 acts as a bridge for roaming subscribers to visited MSCs in other operator’s networks. Both control signaling and traffic tranks are setup via the GMSC 44.

[0075] The Um 15 is the GSM radio interface. The Uu 17 is the UMTS radio interface. The lub interface 90 is located on a UMTS network and is found between the RNC (Radio Network Controller) 70 and the NodeB 86. The lupc 72 interconnects the UMTS RNC 70 with the SMLC (also called lhe SAS) in the UMTS network for location generation. The lu-CS (Circuit Switched) interface 62 connects the UMTS RNC 70 with the circuit switched communications oriented network (the MSC) 50. The lu-PS (Packet Switched) interface 74 connects the UMTS RNC 70 with the packet switched communications oriented network (SGSN) 68. The Gb interface 66 interconnects the BSC 96 with the SGSN 68 allowing for routing of GPRS rnrrtmu-ni cations.

[0076] The Gn interface 60 is a GPRS packet interface which is located between the SGSN 68 and GGSN 46. The Gs interface 64 is a GPRS system interface located between the SGSN 68 and the MSC 50. The Gr interface is a GSM-MAP interface which is located between the SGSN 68 and the Home Location Register (HLR) 34.

[0077] As described in U.S. Patent 6,782,264, it is possible to monitor the base transceiver station (BTS) to base station controller (BSC) link (e.g., the Abis link) for triggering messages and information fields. A passive network monitor, called the AMS (Abis Monitoring System) in the ‘264 patent and exemplified by monitoring the GSM Abis interface, has been extended in accordance with the present invention and is dow called the Link Monitoring System, or LMS. The Link Monitoring System (IMS) can monitor multiple cellular network data links simultaneously, scanning for data of interest, and can detect particular messages or data fields within messages. Setting or tasking of messages or data fields of interest can take place at any time. When a match occurs, the LMS may be further triggered to perform a pre-set action, such as a write to storage memory or forwarding of the triggering message and (or) data fields to another system node.

[0078] The Radio Network Monitor extends the concept of passive monitoring for location triggering information and messaging to the radio air interface. The RNM _W0 M0M3S542 . FCT/USMK/01^3 _־־n dstect and monitor bof^link (mobil־ device to BTS or Node®) and ־יסס^ radio communications.

[0079] The illustrative system employs information from both the wireless netwo-k and the wired (or landline) network. In advance of national or international standardization efforts for location-based services in such organizations as 3GPP, BTSI and ANSI, the LMS has been developed to assist in acquiring the certain radio, call and caller inform «firm for the immediate deployment of location-based services. All attributes and abilities of the LMS can be incorporated into other nodes of the wireless and wired communications networks. This approach is applicable to all digital cellular and like wireless networks, including but not limited to TDMA, CDMA, and OFDM-based wireless networks. (OFDM stands for Orthogonal Frequency Division Modulation, a spread spectrum method used for earner modulation in digital transmissions). The GSM system is used to describe the inventive concepts underlying the present invention, but the differing naming systems and acronym conventions used does not preclude application of the invention to the GPRS and UMTS system

[0080] The Link Monitoring System allows for passive, non-intrusive monitoring of, for example, the GSM, GSM-R, GPRS, and UTMS systems. In the exemplary case of a GSM system, the LMS can passively receive data streams from the Abis (BTS-BSC) interface, the A (BSC-MSC) interface, and the GSM MAP interface (MSC-mR, MSC-GMLC, MSC-GMSC and MSC-gsmSCF). The term GSM MAP (where MAP stands for Mobile Application Part) is used to refer to lhe global SS7 network and includes the C, D, E, F, H, Go, Gfi Gr, Lh, and Lg interfaces.

[0081] In the exemplary case of a GPRS system, the LMS can passively receive data streams from the Abis (BTS-BSC or BTS-PCU) interface, the Gb (PCU-SGSN) interface, and the GSM MAP interface (SGSN-HLR, SGSN-GMLC and SGSNgsmSCF). In the exemplary case of a UMTS system, the LMS can passively receive data streams from the lub (Node B-RNC) interface, lu-CS (RNC-MSC) interface, the InPS (RNC-SGSN) interface, and the GSM MAP interface (MSC-HLR, MSC-GMLC and MSC-gsmSCF, SGSN-HLR, SGSN-GMLC and SGSN-gsmSCF).

[0082] The LMS can search received data for particular messages or data fields within messages. Setting or tasking of messages or data fields of interest can take place at any time. When a match occurs, the LMS is further triggered to perform a pre-set action, normally a write to storage memory or forwarding of the triggering message and (or) data fields to another system node.

WO 2006/135542 PCT7US2006/01R863

[0083] Once the Q® has been triggered, a variety of information may be obtained from the triggering message or subsequent data messaging. Information gleaned from this method can include event-related information, mobile or subscriber account information, conversation-related information. serving cell information, and radio environment information.

[0084] Event-related iufoimaiion can include the triggering event, accumulated radio interface and cellular system data, subscriber data, the monitored data link ־where the triggering data was received as well as internally developed LMS timestamp and indering information. Mobile or subscriber account mfonnation can include inform atinn available from the handset over the radio interface and from the carrier HLR. Both the 1MEI from the handset and the IMSI from the SIM could be acquired, as well as the calling or called MS-ISDN, dependent on the 1 foies monitored and the messages scanned. Conversation-related information can include the calling number and the called number for both the mobile originating and mobile terminating cases. These numbers are sometimes also called the SMS PINS, but would still be included in the conversationrelated information.

[0085] Serving cell mfonnation can include the Cell ID (CGI for GERAN networks or CI for UMTS networks), the Tim fog Advance (TA in GSM/GPRS) or Round-Trip-Time (RTT in UMTS), the Radio Frequency (Absolute Radio Frequency Channel Number (ARFCN)), the Base Station Identity Code (BSIC), the Terminal Endpoint Identifier (TEI), and Location Area Code (LAC). Prior Cell information is available during a handover event and includes the same data set as the current serving cell.

[0086] Radio-related information gathered by the system can include the uplink (MS to BTS, or UE to Node-B) and the downlink (BTS to MS or Node-B to UE) power and quality levels, and the Beacon or Broadcast Control Channel (BCCH) ARFCN, power, and quality. The Network Measurement Report (NMR) with channel and power levels to potential handoff candidates sectors or cells can also be collected wheat available.

[008η We will now describe the use of radio transactions, network events, and filters in accordance with various aspects of the present invention.

B. Radio Transactions, Network Events and Filters

[0088] The network monitor allows the wireless location system to passively monitor the traffic between the mobile phone and the BTS on both the uplink and downlink. The Radio Network Monitor (RNM) 82, a wideband receiver or bank of

WO 2006-/135542 PCT/US2006/Q19863 narrowband receivers locatecTwithin the area of interest, scans and discovers, or is pre-set TO-fth frequency, timeslot, codes and/or hopping sequence, to monitor the Random Access Channels (RACH), Access Grant Channels (AGCH) and control channels (SDCCH in GSM/GPRS) for messages of interest. Since the RNM 82 has no capability to decrypt encrypted information the message transactions of interest will be restricted to: (1) call originatinns, (2) call terminations, (3) short message service (SMS) originations, (4) SMS tsn-ninations, and (5) location update requests.

[0089] Wireless devices can be located without physical connection to the wireless carrier’s infrastructure through the use of the RNM 82 by receiving the Access Grant Channels (AGCH) on the downlink transmissions from the BTS and accessing the messaging information contained therein which includes the timing advance (TA), channel reference number and frame number. This information is obtained by detecting, demodulating and decoding the unencrypted AGCHs from the BTS’s downlink transmissions. This is used as a network-autonomous trigger for the wireless location, system enabling it to locate the wireless device with UTDOA by receiving subsequent uplink transmissions from the mobile devices on SDCCH. The wireless device’s location can also be estimated, albeit with much less accuracy than UTDOA or Ao A, with CGI+TA. The CGI+TA can be improved with other information from the AGCH as well as other a priori information about the wireless network. Demodulating and decoding the initial SDCCH transmissions from the mobile device will provide identifying information about the mobile device, specifically the TMSI or IMSL If ciphering is not enabled in the wireless network further demodulation and decoding of SDCCH transmissions from the wireless device will provide other identifying information such as IMEI, MSISDN as well as calling number or called number.

C. Network Triggers and Events

[0090] The IMS 11 may be set to trigger on call connection events or radio interface events. These events may comprise a single message or a series of messages, each, related to the call connection or radio event These events include: (1) Network Measurement Report Received, (2) Mobile Originated Call Placed, (3) Mobile Terminated Call Received, (4) Mobile Originated SMS Sent, (5) Mobile Terminated SMS Received, (6) Handover (Begins), (7) Handover (Completed), (8) Location Update, (9) RP Channel Assignment, (10) IMSI Attach, (11) IMSI Detach, (12) Mobile Originated Call Disconnect (13) Mobile Terminated Call Disconnect, (14) Identify Equipment Response, and (15) Call Failure.

WO M06/13554I PCT/USM0OT1SW3

[0091]”' The mvenfive system described herein uses more than the call setup messaging iTTmeaarinns previously described in US Patent 6.782,264 (Anderson). In to the call setup information employed for location system triggering and tacking, advanced location-based services triggering appEcations may utilize additional T-adin interface, Abis, A. and GSM-MAP interface messages, transactions and data. The term “mm sachem” refers to a message or message sequence potentially useful to the advanced trigger invention- The term “filter” refers to pre-set rules in the LMS for analysis of the monitored data within the transaction. Filters can include MS jdmtification, cell identification, location area codes, or differences between the monitored and expected pre-set information.

[0092] The following procedures are used for location triggering by the Radio Network Monitor (RNM) and/or Link Monitoring System (LMS). A trigger for wireless location consists of a transaction and a filter. If a transaction occurs and the filtering matches, then a location trigger is generated. Each procedure contains the messaging needed for d«termination if a potential location-triggering event has occurred. The description of each message includes the fields for filtering by the preset rules for positive determination of the occurrence of a location trigger.

[0093] In the interest of brevity, descriptions of some common call message sequences are grouped as procedures.

Tnitial Channel Assignment Procedure

[0094] The initial channel assignment procedure described below is common to (1) mobile originated calls, (2) SMS originations, and (3) location updates.’ In the initial channel assignment procedure, no messaging is encrypted over the radio interface and therefore-all Mobile to BTS and Mobile to BSC communications are available to the RNM as well as to the LMS.

[0095] The mobile device sends a CHANNEL REQUEST [3GPP 44.018,9.1,8] to the BTS via the ^,Random Access Channel (RACK) and the BTS then sends a CHANNEL REQUIRED message [3GPP TS 48.058, 8.5.3] to the BSC. The BSC will first respond with a CHANNEL ACTIVATION [3GPP TS 48.058, 8.4.1] message to the BTS, The BTS (if sufficient radio resources are available) will respond to the BSC with a CHANNEL ACTUATION ACKNOWLEDGE message [3GPP TS 48.058, 8.4.2], This message pair is linked via the contained Channel Number.

[0096] Once the BSC has confirmed the reservation of the channel for the Mobile device, the BSC will order the Mobile via the BTS with a IMMEDIATE

ASSIGNMENT COMMAM message [3GPP TS 48.058, 8.5.6] on the downlink CCCH (the

Access Grant Channel (AGCH).

[0097] The IMMEDIATE ASSIGNMENT COMMAND consists of one of three possible Radio Resource (RR) assignment commands in the Full Imm Assign Info element. The relevant immediate assignment message is as defined in 3GPP TS 04.08 (IMMEDIATE ASSIGNMENT [3GPP TS 24.008,9.1.18], or IMMEDIATE ASSIGNMENT EXTENDED [3GPP TS 24.008, 9.1.19] or IMMEDIATE ASSIGNMENT REJECT [3GPP TS 24.008, 9.1.20]) with the Page Mode element set to the value no change.

[0098] The IMMEDIATE ASSIGNMENT COMMAND messages are all associated to the original CHANNEL REQUIRED message on the Abis link via the Request Reference parameter [3GPP TS 48.058,9.3.19 and 3GPP TS 44.018,10.5.2.30]. This Request Reference parameter identifies the access request and access reason.

[0099] By linking the Establishment Cause Value [3 GPP TS 44.018, Table 9.1.8] of the original CHANNEL REQUEST and CH ANNEL REQUIRED messages with the Channel

Number carried in the IMMEDIATE ASSIGNMENT COMMAND, the RNM or LMS can follow the ongoing call origination, SMS origination, or location update to the S-DCCH where mobile and subscriber identification will become available.

[0100] The RNM and LMS will collect the cause value and the S-DCCH assignment, storing both in local memory. If the cause value is part of a location trigger for call origination, 20 SMS origination, or location update event, the RNM or LMS may inform the wireless location system of the event for scheduling, initialization of a new historical call record, updating of an existing call record or the keeping of statistics on such network access events. The RNM and LMS will also collect originating cell site information such as cell ID or CGI.

1, Location Update

[0101] In order for the MS to make mobile-terminated calls, the wireless network should know the location of the MS, regardless of its movement. Thus, the MS periodically reports its location to the network using the Location Update procedure. The Location Update procedure is performed when: (1) the MS has been switched off and wants to become active; (2) the MS is active but not involved in a call, and it moves from one location area to another; or (3) after a regular predetermined time interval. During a Location Update procedure and the processing of a mobile call, certain numbers are used including the Mobile Station ISDN Number (MSISDN), the Mobile Subscriber Roaming womo«3s« . _FCTras־w6m5w (MSRN), β® Istemffional Mobile Subscriber Identity (MSI), file Temporary Mobile Subscriber Identity (TMSI), and the Local Mobile Station Idemity (LMSI) described above.

[0102] The Mobile Station ISDN Number (MSISDN) is the directory number allocated to th־־ mobile subscriber. The MSISDN is dialed to make a telephone call to the mobile subscriber. The number consists of Country Code (CC) of the country in which the mobile station is registered (for example, Germany is 49, and Brunei is 673), followed by a national mobile number which consists of Network Destination Code (NDC) and Subscriber Number (SN). A Network Destination Code is allocated to each GSM PLMN. The cm-nposition of the MSISDN is such that it can be used as a global title address in the Signaling Connection Control Part (SCCP) for routing messages to the HLR of the mobile subscriber.

[0103] The Mobile Station Roaming Number (MSRN) is the number required by toe gateway MSC to route an incoming call to a MS that is not currently under toe gateway’s control. Using toe MSISDN, a mobile-terminated call is routed to toe gateway MSC. Based on this MSISDN, toe gateway MSC can request for a MSRN to route toe call to toe current visited MSC.

[0104] The International Mobile Subscriber Identity (IMSI) is embodied in toe SIM of toe mobile equipment The MS provides toe IMSI any time toe MS accesses toe network. The IMSI code has three components including toe Mobile Country Code (MCC), which has toe same meaning and format as in the LAI, Mobile Network Code (MNC), which also has toe same meaning and. format as in toe LAI, and toe Mobile Subscriber Identification Number (MS IN), which is toe code that identifies toe mobile subscriber a GSM PLMN. The overall number of digits in an IMSI code does not exceed 15.

[0105] The Temporary Mobile Subscriber Identity (TMSI) is an identity alias toai is used instead of toe IMSI when possible. The use of a TMSI ensures that the true identity of toe mobile subscriber remains confidential by eliminating toe need, to transfer an IMSI code enciphered over a radio link. A Visitor Location Registry (VLR) allocates a unique TMSI code to each mobile subscriber that is operating in its area. This code, which is valid only wifr»n the area supervised by toe VLR, is used to identify toe subscriber in messages to and from toe MS. When a change of location area also involves a change of VLR area, a new TMSI code is allocated and communicated to toe MS. The MS stores the TMSI on its SIM.

[0106] The LocaTMbbile Station Identity (LMSI) is temporary subscriber data Use of the LMSI is, however, optional. In order to speed up ths search for subscriber data in the VLR, a supplementary Local Mobile Station Identity (LMSI) can be defined. The LMSI is allocated by the VLR at location updating and is sent to the Home Location Register (SLR.) together with the IMSL The HLR makes no use of the LMSI, but includes it together with the IMSI in all messages seat to the concerning that MS.

[0107] Vthsu the GSM or UMTS mobile station (i.e., wireless device) detects a change in the Location Area Index (LAI) earned by the serving cells BCCH, a location update procedure can be invoked. A GSM or UMTS mobile can perform a Location Area Update (LAU) when in the Idle state. The LAU can be triggered when the mobile crosses a LA (Location Area) boundary, or periodically (the periodicity being set by the carrier network). A LAU can also be performed when the mobile is powered on. If the change in LAI occurs mid-call (either due to carrier changes to the LAC or fro movement of the Mobile), the mobile station can perform the Location Update procedure once the call has completed and the mobile has returned to idle state.

[0108] Similarly _a GPRS mobile can perform a Routing Area Update in the Ready and Standby state. The RAU can be triggered when the mobile crosses a RA (Routing Area) boundary, or periodically (the periodicity being set by the carrier network). A RAU can also be performed when the mobile moves from the Idle to the Standby state as will typically happen when ־the mobile is powered on. Execution of a RAU caused by crossing a LAC boundary can be accompanied by a LAU for mobile devices with both packet data (GPRS) and voice capability (GSM/UMTS).

[0109] The Location Update procedure uses the initial channel assignment procedure described above with the CHANNEL REQUIRED message’s cause value [3GPP TS 24.008,9.1.8] bit sequence set for ״Location Updating”

[0110] Once assigned to an S-DCCH, the mobile device sends the Mobility Management (MM) message LOCATION UPDATE REQUEST [3GPP TS 24.008, 9.2.15] to theBTS which echoes back the LOCATION UPDATE REQUEST. The BTS then passes the LOCATION UPDATE REQUEST to the BSC. lhe LOCATION UPDATE REQUEST will contain either the mobile device’s static International Mobile Station Identifier (IMSI) [3GPP TS 23.003,2.2] di the locally assigned Temporary Mobile Station Identifier (TMSI) [3GPP TS 23.003,2.4] depending on the registration status of the mobile. A newly powered-on mobile will initiate the LOCATION UPDATE REQUEST with the IMSI, while those mobile devices already registered with the

WO 2006/135542 PCT/US 2006/01986 3 network., or one just entering the LA will usefd] the TMSI for identification durmg the

LOCATION UPDATE REQUEST.

[0111] The network will then authenticate the mobile device, set ciphering, could check the IMEI of the mobile device via the Identity Request procedure, could set a new TMSI via the TMSI reallocation procedure, complete the location update procedure, and then use the Release procedure to free up the reserved S-DCCH channel for other uses.

[0112] The completion of the successfill Location Update procedure requires that the LOCATION UPDATING ACCEPT [3GPP 24.008,9.2.13] be sent by the MSC via the BSC and BTS to the mobile. The LMS may collect the mobile’s current location area identification (LAI) [3GPP TS 24.008,10.5.1.3] at this time.

[0113] During the location update procedure, the RNM or LMS can collect the TMSI to IMSI association for the newly registered mobile, collect the TMSI associated to both the collected location areas and collected serving cells (current and prior), and can trigger the wireless location system to perform either a low accuracy (Cell-ID and CellID with timing advance are both available) or high accuracy (U-TDOA and/or Ao A based) location estimate while the mobile is on the S-DCCH.

[0114] A high accuracy location usually involves using TDOA or Α0Α for a more accurate location of a wireless device than is available via cell ID techniques. The high accuracy location is more accurate than cell-based location techniques and is typically better than 250 meters in accuracy. In the United States, high accuracy has been defined by the Federal Communications Commission (FCC) in the E9-1-1 phase Π mandate as 100 meters or less 67% of the time, and less than 300 meters 95%. of the time. In contrast, a low accuracy location uses cell-ID based location techniques such as CGI/CL, CGI/CI with TA/RTT, and Enhanced Cell ID (ECID). These low accuracy location techniques have highly variable non-uniform location accuracies that are not as accurate as the high accuracy techniques discussed above.

[0115] The ECID technique relies on the mobile device’s ability to record the power levels (RXLev) of multiple potential handover candidate/neighbor cells. This technique adds a power-difference-of-arrival (PDOA) measurement, derived from the gating GSM Network Measurement Report (NMR), in an attempt to improve a

CGI+TA-based location estimate.

[0116] The PDOA value is based on the received signal levels (RXLEV) collected by the mobile for the serving cell and at least three neighboring cells. Since the PDOA data collection requires visibility to three or more neighbor cell sites, yield will be

PCIW S2006/01&amp;863 less than 100%.The arfEcts όϊ RF multipafh, mobile receiver quality, and granularity of the 7-bit RxLEV measurement act to reduce location accuracy.

[0117] Since ECID uses PDOA muiti-lateration, the geographic layout of the neighbor cells also affects the quality of the location through geographic dilution of precision. The limitation of only 6 neighbor cell RxLEV measurements present in the NMR limits accuracy by limiting potential GDOP reduction though site selection.

[011S] Since the PDOA measurement requires averaging over multiple samples (NMR is sent every 480 ms during an active call), latency is much higher then for other cell-ID based techniques.

[0119] Figures la and lb illustrate the CGI/CI location for omm and sectored cells respectively. Figures 1c and Id illustrate the CG1+TA (omni) and CGI+TA (sectored) location processes Figure le illustrates Enhanced Cell ID (ECID) with grid mapping in a sectored cell. Figures la-le are shown in accordance with the present invention and are as used in wireless telecommunications industry conventions and standards.

[0120! The location update is detectable over the GSM, GPRS, or UMTS air interface using the SDCCH Radio Network Monitor (RNM) 82. The Location Update is also detectable over the Abis interface as a Location Update Request mobility management message. The Location Update event will trigger the IMS 11 to collect additional information for both low accuracy locations (CGI, CGI+TA, and CGI+TA+NMR) and radio frequency information for tasking Location Measuring Units (LMUs) 92 emplaced in the carrier local area for high accuracy TDOA or Α0Α location

2. Routing Update

[0121] A GPRS mobile will perform a Routing Area Update (RAU) in the Ready and Standby state. The RAU is triggered when the mobile crosses a Routing Area (RA) boundary, or periodically, the periodicity set by the carrier network. A RAU is also performed when the mobile moves from the Idle to the Standby state. This will typically happen when the mobile is powered on.

3. Handover

[0122] A typical handover occurs between traffic channels mid-session when a wireless phone is handed from one cell or sector to the next in order to maintain a radio connection with the network. Handovers between control channels are also possible. The variables that dictate a handover depend on the type of cellular system. In CDMA based systems, interference requirements are the limiting factor for handover. In FDMA and TDMA systems such as GSM the main limiting factor is the signal quality available to

WO 2066/135542 PCT7US2006/019W the Mobile Station CMS). Other factors include: distance from the antenna (Timing Adv^nr-ji in GSM, Round Trip Time in UMTS); local load; and received signal strength or path loss levels.

[0123] Handover messaging takes place on the Fast Associated Control Channel CFACCH). The Fast Associated Control Channel appears in place of the traffic channel when lengthy signaling is required between a GSM mobile and the network while the mobile is in call The GSM Handover is detectable over the Abis interface as a Handover Command RR BSSMAP message. The Handover Command cannot be normally detected by the RNM 82 unless encryption key sharing is enabled.

[0124] The handover procedure starts with the HANDOVER COMMAND [3GPP TS 44.018, 9.1.15] issued by the BSC to the BTS. The HANDOVER COMMAND contains the current Cell ID [3GPP 23.003, 4.3.1], the current TCH [3GPP TS 44.018,10.5.2.5] and fixture TCH [3GPP TS 44.018,10.5.2.5a], the Timing Advance [3GPP TS 44.018, 10.5.2.40] and the Handover Reference [3GPP TS 44.018,10.5.2.15],

[0125] The handover procedure completes with the HANDOVER COMPLETE [3GPP TS 44.018, 9.1.16] message between the BTS and BSC. This message exists to ennfirm the handover was successful. The LMS can use this message for the same purpose.

[0126] The LMS can collect all the information fields available in the listed messages for local storage, location triggering and for following the TCH reassignment for the current call. The LMS may forward the collected information and accumulated call record to the WLS for a low-accuracy location based on the newly collected, cell-ID and timing advance data The LMS may forward the collected information and accumulated call record to the WLS for a high accuracy U-TDOA or Α0Α location on the newly assigned Traffic Channel.

4. Call Release

[0127] Call Release refers to the end-of-call or end-of-data session when channel resources currently reserved for use are freed for reuse and reassignment An established call session can. be terminated by the calling party, the called party, or by radio interference and signal loss.

[0128] Release [3GPP TS 24.008,9.3.18] message contents vary dependent on the release initiation party. RELEASE for the network to mobile station direction is detailed in 3GPP TS 24.008, 9.3.18.1. RELEASE for the mobile station to network direction is detailed in 3GPP TS 24.008,9.3.18.2. RELEASE for signal loss is the same as, for the network to mobile station direction.

for me netware to mobile station direction, the RELEASE message is sent to indicate that the network intends to release the transaction identifier, and feat fee receiving equipment shall release fee transaction identifier after sending RELEASE

COMF1 .־RTF. [3GPP TS 24.00S 9.3.19.1] specific to fee network to mobile station direction.

[0130] For fee mobile to network direction, fee RELEASE message is sent from fee mobile station to fee network to indicate that the mobile station intends to release the transaction identifier, and that fee receiving equipment shall release fee transaction identifier after sending RELEASE COMPLETE [3GPP TS 24.008, 9.3.19.2]

[0131] The LMS monitors for fee RELEASE and RELEASE COMPLETE messages to determine fee end of fee monitored call session and for completing fee historical, accumulated call record. The LMS may also store fee release Cause [3 GPP TS 24.008,10.5.4.11] if available for later analysis.

[0132] Th® LMS may forward the RELEASE message event to the wireless location system wife the total accumulated call record. The WLS may generate a final low-accuracy estimation based on fee last recorded cell-ED, timing advance, and measurement report or may attempt a final high-accuracy U-TDOA or Ao A location on the remaining mobile transmissions.

[0133] Since corresponding radio messages for the Release procedure take place on fee encrypted FACCH, fee RNM 82 normally cannot be used to detect the Release event trigger.

5. Paging

[0134] When the network has an incoming call, fee mobile station is paged in fee common Paging channel (PCH) when in the idle state. The mobile* s response to a page, cnmmnnly called a page response, is to request a SDDCH from fee wireless network via a Padin Resource Channel Request [3GPP 44.018, 9.1.8] with cause value set to binary OOOlxxxx, OOlOxxxx, OOllxwc or lOtaxxxx where “x” is used.to indicate a “don’t-care bit where that bit and be either a one or a zero without effecting the cause value. To minimize the traffic caused by paging, a page request is typically first sent to fee Location Area (LA) where fee mobile last had a radio transaction with fee wireless network as stored in fee subscriber’s home location register (BLR) or fee visitor location register (VLR) of fee currently listed service area (Public Land Mobile Network (PLNM).

[0135] Both the RNM 82 and LMS 11 can detect a Paging Response by monitoring the Padin Resource Channel Request message for fee noted cause values. The

WO 2006/135541 PCT7US2006/01S863

RNM 82 can demodulate tins unencrypted message sent on the RACH. The IMS 11 can detect the page response either in the initial Channel Enquired [3GPP 48.058, 8.5.3] message or in the subsequent Radio Resource Page Response message.

[0136] ־Paging can also be forced when no call is incoming via use of the GSMMAP Anytime Interrogation procedure and use of supplementary sendees at the MSC. This page will not alert the user and can be used for location-applications requiring periodic location updating of an idle mobile. The same non-alerting page is also possible in some system by sending an SMS message to the mobile device □f interest with no alphanumeric content.

[0137] Thft ־Paging procedure is used when there is a terminating call to a mobile device. A mobile fwmmatinn call is routed towards toe operator’s gateway MSC, the Gateway MSC consults BLR, toe HLR request paging from visited MSC. The visited MSC toe pages toe handset based on toe last known Location Area. When a page response is received, toe HLR is informed. The HLR then sends toe visiting MSC address to toe gateway MSC tost then routes toe call to visited MSC and toe mobile terminating call is established.

[0138] The paging of an MS is initiated by BSC sending a PAGING COMMAND [3GPP TS 48.058, 8.5.5] message to BTS. The message contains toe MS identity (TMSI or IMSI), toe paging population number of toe MS, optionally an i-nftication for toe MS about which combination of channels will be needed for toe subsequent transaction related to toe paging and optionally an indication of the priority of toecalL

[0139] The PAGING REQUEST [3GPP TS 44.018, 9.1.22 &amp; 9.1.23 &amp; 9.1.24] messages to be sent on toe dedicated paging channel (PCH) radio path are built and sent by BTS.

[0140] Successful paging of toe mobile device results vi toe PAGING REQUEST message in a page response procedure, that is toe use of the initial channel assignment procedure with toe CHANNEL REQUIRED message’s cause value [3GPP TS 24.008,9.1.8] bit sequence set for “page response”. At toe end of a successfill paging procedure, toe Mobile-Tenninated Call Establishment procedure is entered.

[0141] During toe paging procedure, toe LMS can collect toe TMSI or IMSI used in toe BSC-to-BTS PAGING COMMAND along with toe Location Area Index (LAI) where the mobile last had a successful Location Update. The RNM can collect toe mobile identity information from toe PAGING REQUEST message. This collected

WO 2WM35542 ?CT/nS2006/«m63 information is storeti locally or forwarded to other nodes for resorrrce scheduling ourposes or statistical data analysis.

6. Identity Response

[0142] The Identity Response is sent only in response to an Identity Request, ־which is_} according to 3 GPP standards, generated in the GSM-MAP network by the Equipment Identity Register. The Identity Request and Response messages are delivered on the SDCCH, but after encryption so the RNM 82 cannot be used to detect the response without encryption key sharing. The IMS 11 can detect the Identity Response on the BTS-BSC interface. The Identity response will include the International Mobile Equipment Identity QMEI) an electronic serial number that uniquely identifies the mobile device. The Identity Response can also include the subscriber’s International Mobile Station Identifier (IMSI) and the Temporary Mobile Station Identity (IMSI).

[0143] The Identify Equipment Procedure can be performed when the mobile device is on the S-DCCH. The MSC initiates the procedure with a Mobility Management Direct Transfer Application Part (DTAP) Identity Request [3GPP TS 24.008,9.2.10] sent via the BSC and BTS to the mobile device. The mobile device responds with a Mobility Management Identity Response [3GPP TS 24.008,9.2.11] containing the International Mobile Equipment Identifier (IMEI) and possibly the IMSI and/or IMSI of the mobile device.

[0144] Since the Identify Equipment Procedure is typically used after ciphering has been set, the RNM cannot typically monitor this procedure for IMEI collection. Ihe LMS can monitor this procedure and collect the IMEI for local memory storage or transfer to another system node.

[0145] Figure 2 depicts an exemplary method for the MSC to obtain the IMEI of a mobile station in accordance with the present invention. Initially, a mobile identity check is elected at step 210. The MSC then will send an Identity Request to the mobile device via the BSC at step 215. The BSC will forward the Identity Request without other processing to the BTS at step 220. The BTS will then transmit the Identity Request to the mobile device at step 225. As a result of the received Identity Request at step 225, the mobile station will respond by transmitting its IMEI back to the BTS in an Identity Response message at step 230. Further, if the IMSI and IMSI are required by the identity check parmeters, the mobile station will also transmit the IMSI and TMSI back to the BTS at step 230. Dependent on what the BTS receives from the mobile station, the BTS ^,will forward any IMEI, IMSI, or TMSI infonnation in the Identity Response message back to the BSC at step 235. The BSC can then forward the Identity Response message

WO 2006/135542 PCT7US2006/019863 containing the identity information to the MSC at 240. The MSC will then send a CheckIMEI to the EIR for further analysis of the mobile at step 245.

[0146] As a result of the Identity Response message from the mobile station at step 230, the LMS can obtain a copy of the Identity Response message and contents from passive monitoring of the Abis or A interface and collect the MEI, .IMSI, and IMSI information at step 250 pending on what is sent from the mobile station at step 230. The IMS can store the MEL MSI, and TMSI information in local memory at step 255. The IMS can also forward the MEL, MSI, and TMSI information, if available, to a LBS application for further analysis at step 260.

7. Measurement Report

[0147] The Measurement Report (MR) is sent periodically during an active voice or data session. The MR is used by the mobile device to inform the wireless network of the mobile device’s potential need for a handover and contains downlink (base station to mobile device) measurements on neighboring transmitters (sector antennae or omni directional cell antennae). This technique, called mobile-assistedhandoff (ΜΑΉΟ), is common to most cellular radio networks including US TDMA (IS136), CDMA, GSM, and UMTS. During a voice or data session, the mobile device uses idle time to retime its receiver to monitor the broadcast channels (also known as beacons) of nearby base station antennae. For the serving cell, the mobile measures both the beacon receive level and the receive quality, for all other neighbors in the measurement report, only receive level is available. In some spread-spectrum technologies, the pathloss measurement is returned rather than the received beacon strength.

[0148] The measurement request is only available during an active (encrypted) session on the FACCH and thus the RNM 82 cannot be used without key sharing. The LMS 11 can detect the measurement report on the Abis, or BTS-BSC, interface. Since the measurement report is periodic, the IMS 11 can determine call duration. Since the measurement report contains power levels, the wireless location system can use the measurement report, timing advance, serving cell and sector information with knowledge of the beacon broadcast power levels to perform a hybrid Cell-ID with power-differenceof-airival once beacon powers (or path-losses) have been normalized.

[0149] The measurement report procedure contains a single message of interest for this invention. The MEASUREMENT RESULT [3GPP TS 48.058 8.4.8] message from BTS to BSC is used to report to BSC the results of radio channel measurements made by BTS (uplink) and to convey the measurement reports from MS received on SACCH and in the LI headers. The MEASUREMENT RESULT contains the TCH

W0 2006/135542 PCT/OS2006/019863

Charms Number [SGFPTS48.058,9.3.1־], Uplink Measurements [3GPP TS 48.058,

9.3.25] and the Base Station Power [3GPP TS 48.058, 9.3.4] and possibly the MS Power

[3GPP TS 04.058, 9.3.13], Timing Advance [3GPP TS 48.058, 9.3.24]. and MS liming

Offset [3GPP TS 48.058,9.3.3η.

[0150] The LMS can detect the MEASUREMENT RESULT and reference to an LMS-internal call record by the TCH Channel Number. The LMS may then store the collected information locally or forward the event type, call record information and newly collected information to the wireless location system for use in generation of an enhanced Cell-ID location using the cell-ID, timing advance, uplink measurements and the MS Timing Offset The WLS may also use the MEASUREMENT RESULT event as a trigger to perform a high accuracy (U-TDOA and/or Α0Α based) location estimate on the TCH.

[0151] Figure 3A depicts an exemplary method for an LMS 11 to determine the identity of a mobile station in accordance with the present invention. At step 310a mobile station is on a traffic channel. The mobile station will periodically measure nei^tboring CGI beacons to determine their signal strength for handover potential at step 320. When the mobile station performs the measuring of the signal beacon signal strength at step 320, the mobile station also will report such measuring to the BTS at step 325. The BTS then will report the measurement report to the BSC at step 330. Assuming the LMS 11 is pre-set to detect measurement reports at step 315, the LMS 11 will detect the reporting of the measurement report al step 335. While the BSC uses the measurement report for handover purposes at step 340, the LMS 11 can evaluate the measurement report and channel to determine the identity of the mobile station at step 345. If the measurement report corresponds to a mobile station of interest based on the filter analysis performed in step 345, the LMS 11 can forward the event, the mobile station identification information, and measurement report to a LBS application for farther analysis at step 350.

8. SMS Origination

[0152] An Short Message Service session is originally detectable by both the RNM and the LMS in the initial call setup procedure when the CHANNEL REQUIRED message [3GPP TS 48.058, 8.5.3] is sent to the BSC via the Random Access Channel (RACK). The CHANNEL REQUIRED message Cause Value [3GPP TS 24.008,9.1.8] field identifies the initial establishment as being for an SMS-MO.

[0153] For SMS-MO, the initial channel assignment procedure is followed by the mobile device sending a CM SERVICE REQUEST [3GPP 24.008, 9.2.9] message on

PCT/US2006/019S63 ±e S-DCCH to the Bf&amp;^&amp;^TS will forward the CM SERVICE REQUEST to the

BSC with then forwards the message to the MSC. The CM SERVICE REQUEST contains the CM senfoe type [3GPP TS 24.008, 10.5.3.3], which indicates service is being requested for a SMS-MO.

[0154] The Chi SERVICE REQUEST contains the Mobile Identity field, the nrst time in a mobile origination that the mobile identity [3GPP 24.008,10.0.1.4] is available to the RNM and UMS. The mobile identity will be either the TMSI or the IMSI only if TMSI is unavailable. The CM Service Request also contains the Mobile Station ClassMark [3GPP TS 44.018,10.5.1.6]. At this point, the LMS or RMS may trigger the wireless location system to perform a location using either cell-TD methods based on collected Cell-ID and Timing advance data or using a TDOA or Α0Α technique by harnessing the geographically distributed receiver network (the LMU or SCS netwotic) to locate on the radio energy transmitted on the S-DCCH or by following the current call session to a Traffic channel (TCH) and using the radio energy transmitted from the mobile device during the conversation or data exchange.

[0155] Typically, the mobile device will undergo authentication, ciphering, ׳!MSI reallocation and possibly equipment identification procedures while remaining on the S-DCCH

[0156] Figure 3B illustrates an exemplary method of the SMS origination trigger in accordance with the present invention. At step 351, the wireless location system (WLS) sets the SMS origination trigger in the IMS. The IMS can then begin to monitor for any SMS originations at step 352. When a mobile device begins the SMS origination at step 353, the mobile device and wireless network exchange data to setup the SMS exchange delivery session at step 354. The LMS canthen detect the SMS origination and begin collecting the Cell-ID, Timing Advance, MSID, and frequency assignment at step 355, Concurrently a channel can be assigned to the mobile device and the SMS delivery can begin at step 356. The SMS delivery to the wireless netwoik will subsequently end at step 357 and the mobile device and wireless network can exchange data to tear down the session and release the resources at step 358.

[0157] Based on the collection of information at step 3 55, the LMS can then store the informsrinn locally and forward the information to a WLS at step 359. The WLS can then use the collected information to generate either a low or high accuracy location of the wireless device at step 360.

£ SMS'Termnnifibir

[0158] The SMS - Mobile Terminated (SMS-MT) is initially indicated in the paging of the mobile device. The paging of an MS for SMS-MT is initiated by BSC sending a PAGING COMMAND [3GPP TS 48.058, 8.5.5] message to BTS. The message cryntafos the MS identity (TMSI or IMSI), the paging population number of the MS, optionally an indication for the MS about which combination of channels will be needed for the subsequent transaction related to the paging and optionally an indication of the priority of the call.

[0159] The PAGING REQUEST [3GPP TS 44.018, 9.1.22 &amp; 9.1.23 &amp; 9.1.24] messages to be sent on the dedicated paging channel (PCH) radio path are built and sent by BTS.

[0160] During the paging procedure, the LMS can collect the TMSI or IMSI used in the BSC-to-BTS PAGING COMMAND along with the Location Area Index (LAI) where the mobile last had a successful Location Update. This collected information is stored locally or forwarded to other nodes for resource scheduling purposes or statistical data analysis.

[0161] Successful paging of the mobile device results vi the PAGING REQUEST message in a page response procedure, that is the use of the initial channel assignment procedure with the CHANNEL REQUIRED message’s cause value [3GPP TS 24.008,9.1.8] bit sequence set for “page response”.

[0162] Upon receipt of a SDCCH assignment via the Immediate Assigment Message, the MS sends a PAGING RESPONSE [3GPP 44.018, 9.1.25], This message contains the Mobile Identity field, which would include the TMSI, IMSI, or 1MEL The Mobile identity can be used to identify a subscriber cr MS and trigger a location.

[0163] Figure 3C illustrates an exemplary method of the SMS termination trigger in accordance with the present invention. At step 361, the wireless location system (WLS) sets the SMS termination trigger in the LMS. The LMS can then begin to monitor for any SMS terminations at step 362. When a mobile device is paged for the SMS termination at step 363, the mobile device and wireless network exchange data to setup the SMS delivery session at step 364. The LMS can then detect the SMS termination and begin collecting the Cell-ID, Timing Advance, MSID, and frequency assignment at step 365. Concurrently a channel can be assigned to the mobile device and the SMS delivery can begin at step 366. The SMS delivery to the ־wireless network will subsequently end at step 367 and the mobile device and wireless network can exchange data to tear down the session and release the resources at step 368.

PCT/OS20Q6/019S63

[0164]'' SSsed'ontne collection of information at step 365, the U4S can then store the information locally and forward the information to a WLS at step 369. Ihe WLS can then use the collected information to generate either a low or high accuracy location of the wireless device at step 370.

10, Message-type, Message-content, and Complex Triggers

[0165] LMS triggers include message-type triggers, when the message itself is the location triggering event, and tiiggers based on the contents of monitored messages where a network transaction and a filter are both necessary. By combining these triggers with LMS stored information, a third type of trigger, the complex trigger, can be produced. Any of the three types of triggers can be set to cause (trigger)a !ocation estimation procedure. In general, message-type triggers are tripped in response to a mobile station transmission. Message type triggers include: (1) Mobile Origination (CM Service Request); (2) Mobile Termination (CM Service Request); (3) Identity Response; (4) Location Update; Page Response; (5) Handover, and (6) Release (Channel Release). The IMS 11 can also analyze, in real-time, the contents of specific message fields within the triggers. Other such triggers include: (1) CaUing-number Trigger, (2) Called-number _Trigger. ₍₃₎ Mobile Identity (MSISDN, MEI. MSI,and IMSI) Triggering; (4) CGI/CellID triggering; and (5) LAC triggering.

[0166] The LMS maintains tables of Abis, A, and GSM-MAP interface traffic on a per subscriber basis. Ihe LMS 11 may be set to trigger on call connection events or radio interface events. These events include: _____

<td> Network Measurement Report Received</td><td> Mobile Originated Call Placed j</td>

<td> Mobile Terminated Call Received</td><td> Mobile Originated SMS Sent_______</td>

<td> Mobile Terminated SMS Received</td><td> ___________Handover (Begins)___________</td>

<td> Handover (Completed)</td><td> Location Update</td>

<td> PF Channel Assignment</td><td> _______ IMSI Attach_________</td>

<td> IMSI Detach</td><td> Mobile Originated Call Disconnect</td>

<td> Mobile Terminated Call Disconnect</td><td> Identity Response</td>

Table 1 - LMS Detected Network Transactions

Retained network information allows for location of subscribers in a specific area or in proximity to another mobile that is being monitored.

11. Mobile Origination

[0167] Mobile Origination is the act of a mobile device placing a call to the wireless network to begin a conversation or data session. Mobile Originations are detectable over the radio interface via a radio network monitor (RNM) and by the Link Monitor System. Both high accuracy and low accuracy location is possible during the

PCT/US2OO6/0L9863

Mobile Crfginationfransacnon with cell-id and timing advance available as well as the frscmsncy f!bcigramsnt for the S-DCCH for use by specialized receivers.

[0168] Using the LMS, the Mobile Origination may be followed to the traffic channel Once the mobile is on the traffic charnel, the LMS provides the frequency for subsequent location estimates. Once on the traffic channel the mobile may experience handover which is covered in a following section.

[0169] For a Mobile-Originated call establishment, the initial channel aggign-ment procedure is followed by the mobile device sending a CM SERVICE REQUEST [3GPP 24.008, 9.2.9] message on the S-DCCH to the BTS. The BTS will forward the CM SERVICE REQUEST to the BSC with then forwards the message to the MSC. The CM SERVICE REQUEST contains the CM service type [3GPP TS 24.008,

10.5.3.3], which indicates service is bring requested for a Mobile Originated Call

[0170] The CM SERVICE REQUEST contains the Mobile Identity field, the first Httip. in a mobile origination that the mobile identity [3GPP 24.008,10.5.1.4] is available to the RNM and LMS. The mobile identity will be either the TMSI or the IMSI only if TMSI is unavailable. The CM Service Request also contains the Mobile Station ClassMark [3 GPP TS 24.088,10.5.1.5,10.5.1.6 &amp; 10.5.1.7 ] allowing for classes ofLBS services based on mobile manufacturer or model At this point, the LMS or RMS may trigger the wireless location system to perform a location using either cell-ID methods based on collected Cell-LD and Timing advance data or using a TDOA or Α0Α technique by hamessing the geographically distributed receiver network (the LMU or SCS network) to locate on the radio energy transmitted on the S-DCCH or by following the current call session to a Traffic channel (TCH) and using the radio energy transmitted from the mobile device during the conversation or data exchange,

[0171] Typically, the mobile device will undergo authentication, ciphering, IMSI reallocation and possibly equipment identification procedures while remaining on the S-DCCH. After completion of these procedures the mobile device will transmit the SETUP [3GPP TS 24.008,9.3.23.2] (for mobile originating call establishment) message on the S-DCCH. In the mobile originating call establishment case, the SETUP message carries the dialed digits. The RNM and/or LMS can detect the SETUP message and collect the dialed digits. The dialed digits can then be compared to pre-set lists of phone numbers or SMS pins of interest If the dialed digits matches a number of interest the RNM or LMS can forward the cell ID, timing advance, Mobile Identity (IMSI and/or IMSI), S-DCCH channel assignment, and the nature of the trigger with the digit string io the wireless location system. The wireless location system can then perform either a low accuracy (Cell-ID md CelHD with timing advance are both available) or higi accuracy (U-TDOA and/or Α0Α based) location estimate while the mobile is on the S-DCCH.

[0172] The network will then authenticate the mobile device, set ciphering, could check the IMEI of the mobile device via the Identity Request procedure, and could set a new TMSI via the TMSI reallocation procedure.

[0173] The next message of significance to this invention in the MobileOriginated call establishment is the ASSIGNMENT COMMAND [3GPP TS 44.018, 9.1.2]. The ASSIGNMENT COMMAND carries the Channel Description 2 [3GPP TS 44.018, 10.5.2.5a] for the TCH assignment. The LMS can note TCH assignment and link that information to the previously collected event type (in this case a call origination, a . GPRS data session origination or an SMS origination), the TMSI, the IMSI (if collected), the IMEI (if collected), storing that information locally and forward this information to the wireless location system The wireless location system can then perform a low accuracy (Cell־ID and Cell-ID with timing advance are both available) or high accuracy (U-TDOA and/or Α0Α based) location estimate once the mobile moves to the newly assigned ־traffic channel.

[0174] Figure 3D illustrates an exemplary method of the Mobile Origination trigger in accordance with the present invention. At step 371, the WLS stes the mobile origination trigger in the LMS. The LMS can then begin monitoring for mobile origination at step 372. When a mobile device places a call at step 373, the mobile device and the wireless network exchange data to setup the call at step 374. The LMS can detect the call origination and can begin collecting the Cell-ID, Timing Advance, MSID, and frequency assignment at step 375. Also, a traffic channel is assigned and conversation Wins on the mobile at step 376. The conversation will end at step 377 and the mobile device and wireless network exchange data to tear down the call and release resources at step 381.

[0175] The LMS can store the collected information locally and forward the collected information to a WLS for further analysis at step 378. The WLS can use the collected in formation to perform a high or low accuracy location of the mobile at step 379. The LMS may also continue to collect information for other set triggers at step 380.

12. Mobile Termination

[0176] Mobile termination is the act of a mobile device receiving a call from the wireless network to begin a conversation or data session. Beginning with a page and page response sequence, the Mobile Termination is detectable over the radio interface ria a radio network monitor (RNM) and by the Link Monitor System (LMS). Both high

PCWS2006/019863 accuracv and 1cm,⁷ accuracy location is possible du! mg the hiobile Termination transaction with cell-id and timing advance available as well es the frequency assignment for the S-DC'CH for use by specialized receivers.

[0177] Using the LMS, the Mobile Termination may be followed to the traffic channel where subsequent location estimates may be made.

[0178] The Call Establishment procedure is used when a mobile ¹wants to initiate a voice .or data call or respond to a page request

[0179] Following the Initial channel assignment procedure, the mobile device will send a CM SERVICE REQUEST [3GPP 24.008, 9.2.9] message on the S-DCCH to the BTS. The BTS will forward the CM SERVICE REQUEST to the BSC with then forwards the message to the MSC. The CM SERVICE REQUEST contains the Mobile Tri entity field, the first time in a mobile origination that the mobile identity [3GPP 24.008,

10.5.1.4] is available to the RNM and LMS. The mobile identity (MSID) will be either the TMSI or the IMSI only if TMSI is unavailable.

[0180] For mobile terminated call establishment the mobile station shall select the came mobile identity type as received from the network in the PAGING REQUEST message.

[0181] For a Mobile-Originated call establishment, initial paging procedure is followed by the initial channel assignment procedure. Once on the S-DCCH, the paged mobile device transmits a PAGE RESPONSE [3GPP TS 44.018,9.1.25] with both Mobile Station ClassMark [3GPP TS 44.018,10.5.1.6] and Mobile Identity (MSID) [3GPP TS 44.018,10.5.1.4]. Both the MSID and Station ClassMark canbe collected by the RNM or LMS. The PAGE RESPONSE is then forwarded to the BSC and then to the MSC. Both the MSID and Station ClassMark can be collected by the RNM or LMS. The RNM or LMS may then store the collected information (Cell-ID, LAL S-DCCH assignment, Timing Advance, Page Response Event, MSID, StationClassMafk) or forward the collected information to the wireless location system. The WLS may then perform a low accuracy (Cell-ID and Cell-ID with timing advance are both available) or high accuracy (U-TDOA and/or Α0Α based) location estimate while the mobile is still on the S-DCCH or by following the current call session to a Traffic channel (TCH) and using the radio energy transmitted from the mobile device during the conversation or data exchange.

[0182] The network will then authenticate the mobile device, set ciphering, could check the MEI of the mobile device via the Identity Request procedure, and could set a new TMSI via the TMSI reallocation procedure.

[Uiw! me next message of significance to this invention in the Mobileterminated call establishment is foe SETUP [3GPP TS 24.008,9.3.23.1 message (for mobile terminated call establishment), The SETUP message may contain foe call’s priority level [3GPP TS 24.008,10.5.1.11), foe calling party’s number [3GPP TS 24.008, 10.5.4.9], and the called party (foe mobile subscriber) number F3GPP TS 24.008, 10.5.4.7]. The LMS can note foe SETUP information and link that information to the previously collected event type (in this case a call origination, a GPRS data session origination or an SMS origination), the ׳IMSI, foe IMSI (if collected), foe IMEI (if collected)) storing that information locally and forwarding this information to the wireless location system. The wireless location system can then perform a low accuracy (Cell-ID and Cell-ID with fo-rtrng advance are both available) or high accuracy (U-TDOA and/or Ao A based) location estimate once foe mobile moves to foe assigned traffic channel collected from foe ASSIGNMENT COMMAND [3GPP TS 44.018, 9.1.2].

[0184] The next message of significance to this invention in foe Mobileterminated call establishment is foe ASSIGNMENT COMMAND [3GPP TS 44.018, 9 1.2). The ASSIGNMENT COMMAND carries foe Channel Description 2 [3GPP TS 44.018,10.5.2.5a] for the TCH assignment The LMS can note TCH assignment and link that information to foe previously collected event type (in this case a call origination, a GPRS data session origination or an SMS origination), the TMSI, foe IMSI (if collected), the lM־F-T-(if collected), storing that information locally and forward this information to the ־wireless location system. The wireless location system can then perform a low accuracy (Cell-ID and Cell-ID with timing advance are both available) or high accuracy (U-TDOA ard/nr Α0Α based) location estimate once foe mobile moves to the newly aRgigped traffic channel.

[0185] Figure 3E illustrates an exemplary method of foe Mobile Termination trigger in accordance with foe present invention. At step 382, foe WLS stes foe mobile termination trigger in the LMS. The LMS can then begin monitoring for mobile terminations at step 383. When a mobile device receives a page at step 384, the mobile device and foe wireless network exchange data to setup the call at step 386. The LMS can detect the SMS termination ai step 385 and can begin collecting foe Cell-ID, Timing Advance, MSID, and frequency assignment at step 387. Also, a traffic channel is assigned and conversation begins on foe mobile at step 388. The conversation or data session will end at step 389 and the mobile device and wireless network exchange data to tear down foe call and release resources at step 392.

. 36

WO 2006/125542 . PCT7US2006/019S63

[0186] ⁷The IMS' can store the collected information locally and forward the collected mfryrmatirm to a WLS for furthsr analysis at step 390. The WLS can _Hse the collected information to perform a high or low accuracy location of the mobile at

391.

D. Advanced Triggers

[0187] Advanced triggers allow for radio or network events (corresponding to specific messages or groups of messages detectable by the LMS 11 or RNM 82) to generate high ²^d low accuracy location estimates. A triggering event, one that initiates a location estimation, may be a detection of a particular message or a field within a specific message. Network events (also called network transactions) include: (1) Mobile origmations/teanmations; (2) SMS origmations/terminations; (3) GPRS Mobile Afrach/Detach events; (4) Location/Routing Update (that is, a GSM “location” update for file purposes of mobility and roaming as opposed to aU־TDOA location event); (5) Handovers; and (6) Call Releases.

1. Dialed Digit Triggering

[0188] The wireless location system can locate a mobile based on the number called This number can be a mobile number, a fixed number, a local number, or national/mtemational number of any length. The wireless location system (WLS) can be taskfd with my dialled digit trigger at the LMS. Once the trigger is tasked, toe system will automatically locate any mobile in toe service area dialling toe specified number.

[0189] For example, toe telephone number of toe railway safety director may be entered into toe LMS 11 system and from that point forward any mobile that dials those numbers will be automatically located with, high accuracy (and if moving, toe speed and direction of travel can be determined) if within an LMU equipped area or with lower accuracy if outside an LMU equipped area where only Cell ID techniques are available.

[0190] Figure 4 depicts aa exemplary method of dialed digit triggering in accordance with toe present invention. Initially, at step 410, toe dialed digits of interest can be entered into toe wireless location system. The number of interest can, for example, be toe cell phone of a missing person or toe family member of a missing person. The LMS is set to detect all network transactions and a filter is installed to focus on transactions relating to toe dialed digits of interest at step 415. When a mobile initiates a call or SMS session with toe dialed digits of interest at step 420, toe LMS will detect toe call origination at step 425. The LMS can then collect toe MSID, cell information, and radio information form the start-of-call messaging and store the information in memory at step 430. ARgnming the dialed digit string matches the filter value, or in this case, toe

WO 2006/135542 PCT/US2006/01^863 dialed digit filter, the LMS will then task the wireless location system (WLS) with the radio information, MSID, dialed digits, and cell information at step 435. The WLS can perform a high-accuracy location on the mobile or it can convert the cell and radio information into a low accuracy location estimate pending the request at step 440. The WLS can then send the location estimate (high accuracy or low accuracy) to the location application for further analysis at step 450. Further, the radio information, MSID, dialed digits, a-nd cell informatirm can be forwarded on to the location application at step 445 for further analysis. Sometime after the call was originated at step 430, the mobile will complete the call or SMS session ai step 455.

2. MSID Triggering

[0191] The wireless location system can also locate a mobile device by its irtRntifinatirm- A firnr-tirming mobile or user element will have an associated MSISDN, an International Mobile Station Identity (IMSI) from the SIM, and an International Mobile Equipment Identifier (IMEI) from the terminal. An IMSI or list of IMSIs can be loaded into the LMS via file or location based service application. The LMS wifi, then scan Ahis messaging traffic until the IMSI-to-TMSI correlation can be verified and retained. The IMSI-TMSI association can be updated with changes when a subsequent TMSI is issued. Tn either case, the LMS notifies the SMLC of the IMSI to TMSI correlation.

[0192] An MSISDN or list of MSISDNs can be loaded into the LMS via file or location based service application. The LMS can then scan Abis and A interface messaging traffic, until the MSISDN-to-IMSI and the IMSI-to-TMSI correlations can be discovered and retained. The MSISDN-IMSI-TMSI association can be updated with changes when a subsequent IMSI is issued. In any case, the IMS can notify the SMLC of the MSISDN to IMSI to TMSI correlation.

[0193] Ad IMF! or list of IMEIs can be loaded into the LMS via file or location based service application. The LMS wifi then scan Abis messaging traffic until the IMEIto-IMSI-to-TMSI correlation can be verified and retained. The 1MEI-IMSI-TMSI association can be updated with changes when a subsequent TMSI is issued. In either case, the LMS can notify the SMLC of the IEMI to IMSI to TMSI correlation.

[0194] Regardless of the original IMEI, IMSI, or MSISDN originally used for identification, the discovered TMSI wifi be set as a LMS trigger so that the mobile of interest can be located. For example, the MS-ISDN(s), IMEI(s), or IMSI(s) of an individual or group of railway workers, may be entered into the system and from that time forward any network transaction those mobiles make can initiate a high accuracy location for location and mapping purposes. Thus, being able to locate using the IMEI

WO 2&amp;06/135542 PCT/US2006/019&amp;63 enables the ^tireless location system to find SIM-less phones and devices as well as detecting SIM cbangeR to a particular terminal or user equipment.

[0195־] Figure 5 A depicts an exemplary method of MSID triggering in ar-r-nrf1qnr.fi with the present invention. At step 510, the IMSI, affil, or MSISDN of interest are entered into the system. The IMS can be set to detect all network transactions and filter on IMSI, ΣΜΕΙ, or MSISDN at step 515. When a mobile initiates a network transaction at step 520, the IMS can detect the network transaction at step 525. The IMS can collect the MSID, Cell, and radio information from the transaction message and store . it in memory at step 530. The mobile will subsequently complete the network transaction at step 555.

[0196] When the IMSI, IMEI, or MSISDN matohes 1he filter value entered at step 510, the IMS can transfer the MSID, Cell, and radio information to a WLS at step 535'. The WLS can then perform a high or low accuracy location of the mobile at step 540 and send the location estimate to the Location Application at step 545. The Location Application can coJlect the information received from the WLS and the information from the IMS for further evaluation and analysis at step 550.

3. Idle Mobile Location

[0197] The wireless location system can also locate idle mobiles and devices if the IMEI, MSISDN or IMSI of the device is known. The wireless location Systran can locate idle mobile devices in two ways. First, an idle mobile can be located by entering the IMSI of the mobile device to be located into the IMS 11 system and then by sending a NULL value SMS to that mobile. The mobile device will acknowledge the receipt of the SMS message and can be located with high accuracy. The wireless earner can set the host wireless network system parameters so that the mobile will not be alerted when the NULL value SMS is received by the mobile. Further, updates to the mobile location may be made by siding a NULL value SMS at any time to meet the requirements of the LBS application. These SMS messages can be automatically sent by the LBS application, for fyample, and may be set based on quality of service parameters.

[0198] An alternate method of idle mobile triggering requires the LBS application to request the GMLC to submit CAMEL ‘Any-Time-Inteirogation’ (ATI) queries to the HLR. This can result in a network page being sent to the. mobile. The MSC using standardized Supplementary Services, pages and authenticates the mobile without actually placing the mobile on a traffic channel or otherwise notifying the subscriber. During the paging and authentication messaging, the wireless location system uses UTDOA or Α0Α to process and accurately locate the mobile. A lower accuracy CGI+TA

WO 3006/135542 __ . , PCT/US 2006/019863 location is automatically generated by this transaction. The GSM Service Control Function (gsmSCF) can also be used to cause the GLfLC to issue an Anytime

Interrogation to request information (e.g., subscriber state and location) from foe HLR at any time. The ATI procedure can be used to transition foe MS from the IDLE to Active Signaling State.

[0199] For example, foe IMSI of an asset (e.g., pet) tracking device may be entered, into foe Wireless location system and any time the asset owner wishes to know foe location of that mobile. A NULL value SMS may be sent to the mobile or foe asset finder location services application can initiate an ΑΉ message to foe GMLC to initiate foe location process. Within seconds foe asset tracker device will be located with high accuracy (and if moving, foe speed and direction of travel) if within an LMU equipped area or with lower accuracy if outside an LMU equipped area where only Cell ID techniques are available. ׳

[0200] The preferred method for updating subscriber location from the GMLC is foe AnyTimelnterrogation (ATI) message and procedure defined for CAMEL Phase 3 and. 4. With foe CAMEL Phase 3/4 ATI parameter ‘current location' set to ^ltrue\ foe GMLC can signal foe HLR to initiate (force) paging via the MSC’s supplemental services. For networks with non-CAMEL 3&amp;4 compliant GMLC and HLR clusters, a silent SMS based position update may be possible.

[0201] According to the specifications, for silently paging user with SMS the GMLC will send foe SMSC (via SMPP interface) a ¹Submit SM’ message using a Data Coding scheme value of ‘ 11110110’ (Dec value = 246). Delivery of this message type should not trigger foe MS to alert foe user either by some visual or audible notification. Uris SMS message has zero user data length

[0202] We suggest that carriers verify a selection of their existing phones behavior to foe ¹silent’ SMS. A carrier should also check with MSC and SMSC manufacturers as to the operation of foe MSC when given foe ‘Submit SM' message using a Data Coding scheme value of‘11110110’.

[0203] If the ATI is unavailable and the silent SMS cannot be performed with the existing mobiles or infrastructure, an alternative may exist The Provide Subscriber Information (PSI) message, launched from the GMLC to foe MSC with ‘force paging’ set to “true”, wifi page the mobile without alerting ־the subscriber.

[0204] Figure 5B depicts an exemplary method of using AnyTimelritsrogation (ATI) in accordance with foe present invention. Initially, the Location Application sends a location request for low accuracy with MSID to foe GMLC at step 560. The GMLC queries the wireless network at step 562. The wireless network then may find that the mobile is idle at step 564. The wireless network can use the ATI and supplementary services to page the mobile at step 566. The LMS can then detect the page procedure at step 572. The mobile will receive the page and reply with a page response at step 570. The LMS can then detect the page response at step 568 and have the WLS perform a high accuracy location at step 580. The WLS can then send the location estimate to the GMLC or LCS application for further use at step 582. The wireless network can update the HLR/VLR records and replies to the GMLC with the low accuracy location at step 574. The GMLC can pass the low accuracy location to the LCS application at step 576. The Location Application receives the low accuracy location at step 578 10 from the GMLC and the high accuracy location at step 584.

[0205] Figure 5C depicts an exemplary method of using SMS ping in accordance with the present invention. At step 585, the Location Application send a location request for low accuracy with MSID to the GMLC. The GMLC queries the wireless network at step 586. The wireless network then may find that the mobile is idle at step 587. The wireless network then will return 15 the last known low accuracy location at step 588. The GMLC will pass the low accuracy location to the LCS application at step 589. The Location Application then receives the low accuracy location at step 590. The GMLC issues a SMS to the mobile at step 591. The wireless network pages the mobile for the SMS termination at step 592. The LMS detects the paging at step 593. The mobile will receive the page and can reply with a page response at step 594. The LMS will 20 then detect the page response at step 595. The WLS can then perform a high accuracy location at step 596. The WLS can then send the location estimate to the GMLC at step 597. The GMLC receives the high accuracy location and send it to the LCS application at step 598. The Location application receives the high accuracy location at step 599 and may further evaluate or store the location for further use.

4. Historical Cell Location

[0206] Mobile phones may be identified and located on the basis of historical, past presence in a defined geographic area as bounded by a covered by a sector, a cell or group of cells. The background location feature allows the operator to define an area based on cells (CGIs), collect IMSI/TMSI information for mobiles that had a network transaction in the area of 30 interest, and locate the identified mobiles on later network transactions. First, the cells or CGI are loaded into the Wireless location system. After that point in time an LBS application desires to know all the mobile numbers (and thus the identity) of mobiles that were in a specific area during a specific period of time !,Mb is queried. 'L'he LMLS vrill produce all mobile

PCT/TJS2&amp;06/019&amp;63 identifiers known (MSI, MSISDN,

ΙΜΕΓ) to the application. By tasking the LMS with the collected mobile identifiers, the mobiles will then be tracked with high accuracy as they leave the area of interest

[0207] For example. after a tsunami or hurricane, a group of search and rescue personnel, equipped with mobiles or mobile devices, may be identified automatically at a rally point and be added automatically to a high accuracy U-TDOA fracking list for further fracking and oversight within the stricken area.

[0208] Figure 6 depicts an exemplary method of using historical cell location in accord annc with the present invention At step 610, events are set to all network tT-angactirms The LMS is set to detect all network transactions ai step 615. When a mobile initiates a network transaction at step 620, the LMS detects the network transaction ai step 625 and collects the MSID, Cell, and radio information from the transaction and stores the information in. memory at step 630. Filers can be then set in the LMS for CGIs of interest ai step 640. The LMS can then filter local memory for the CGIs of interest at step 645. The LMS can then send MSID, Cell, and radio information to the WLS for mobiles of interest The WLS can convert the Cell and radio information into a location estimate ai step 655. The WLS can then send the MSID, Cell, and radio information along with the location estimate to the Location Application ai step 660. The Location Application can then evaluate and store the information for further use at step 665. At same point trie mobile will complete the network transaction at step 63 5.

5. Cell ID Triggers

[0209] Mobile phones may be identified and then located on the basis of a cell ID monitored by the LMS. If a mobile makes a network transaction (call origination, call termination, SMS origination, SMS termination, location update, measurement report or handover) then it will be located in the CGI of interest by the monitoring LMS.

[0210] Both cell-ID based and high accuracy location is supported for the CellID trigger. The Cell ID based location may be the Cell-ID or cell-ID and timing advance (or 1/2RTT). ECID location is possible when the mobile is on a traffic channel. Highaccuracy location is possible in areas with deployed LMUs whenever the mobile’s channel information becomes available to the LMS.

[0211] Figure 7 depicts an exemplary method of using Cell ID triggers in accordance with the present invention At step 710, the CGI or CI of interest is entered into the system. The LMS is set to detect all network transactions and filter on CGI or CI at step 715. When a mobile initiates a network transaction at 720, the LMS can detect the

..׳. ״> PCT/US2006/0 19863 aerwonc ransactiou at step 725. The IMS cm then collect the MSID, Cell, and radio information from the transaction and store the information in memory at step 730.

[0212] When the CGI or CI matches a filter value, the LMS can transfer the MSID, Cell, and r^din information to the VT׳S at step 735. The WLS can then determine foe location of the mobile through a high or low accuracy location at step 740. The WLS can then send the location to the Location Application at step 745 for further evaluation and storage. The T-rtcariryn Application cm receive the information from the WLS and the IMS at step 750. At some point, the mobile will complete the network transaction at step 655.

6. Wide-Area Localization Application

[0213] Mobile devices can also be identified and located on the basis of presence in a defined geographic area under radio coverage by a sector, a cell or group of cells. This historical location feature is accomplished by loading an area, defined as a set of cells (CGI, CI), into the IMS. The IMS 11 can then develop a list of IMSIs, MSISDNs, and associated IMSIs that initiate a network transaction (e.g., handover, location update, etc.) in the geographic area of interest The identification and location can also be further filtered by designating a specific time period Thus, mobile devices will only be identified and located if they were in the designated location al the designated time period.

[0214] This application could be used, for example, to determine the identity of all mobile devices in a designated area during a designated time period associated with a fire or emergency event Cell IDs of interest (CGI or CI) can be loaded into the IMS 11 system that correspond to a particular part of a city where a fire or an emergency event occurred. After that point in time if the authorities desire to know all the mobile numbers (and thus the identity) of individuals that were in a specific area during a specific period (i.e., the period of time that the fire occurred), the list can be available within seconds of the request This may be particularly useful in obtaining evidence or witnesses to an event, for example,

[0215] Figure SA depicts an exemplary method for detection of mobiles based on location and time in accordance with the present invention. At step 801, the events are set to all network transactions. The LMS is set to detect all network transactions at step 802. When a mobile initiates a network transaction at 803, the LMS can detect the network transaction at step 804. The LMS can then collect the MSID, Cell, and radio information from the transaction and store the information in memory at step 805.

WO 2&amp;06/135542 PCT/US2006/019B63

[0216] Filters ™יי be'set to the CGI of interest and for a specific time period at step §08. The LMS can then filter local the local memory for CGIs of interest for the specified time period at step 807. The LMS can then send the resulting MSID, Cell, and radio information to the WLS for location at step 809. The WLS can then determine the location of the mobile at step 810. The WLS can then send the MSH>, Cell, radio information, and location to the Location Application at step 811 for further evaluation and storage. The Location Application can receive the information from the WLS at step 812. At some point, the mobile will complete the network transaction at step 806.

7. Background Location of AH Subscribers

[0217] Mobile devices can also be identified and located on the basis of historical or past presence in a defined geographic area as bounded by a covered by a sector, a cell, or group of cells. The background location feature can allow an operator to define an area based on cells (CGIs), collect IMSI/TMSI information for mobiles that had a network transaction in the area of interest, and locate the identified mobiles on later network transactions.

[021S] To begin the location, the cells or CGI are loaded mto the Wireless Location System. After that point in time, if an LBS application desires to know all the mobile numbers (and thus the identity) of mobiles that were in a specific area during a specific period of time, the LMS 11 is queried. The IMS 11 will produce all mobile identifiers known (MSI, MSISDN, MEI) to the application. By tasking the LMS 11 with the collected mobile identifiers, the mobiles will then be tracked with high accuracy as they leave the area of interest For example, after a tsunami or hurricane, a group of search and rescue personnel, equipped with mobiles or mobile devices, may be identified automatically at a rally point and be added automatically to a high accuracy U-TDOA franking list for further tracking and oversight within the stricken area-

8. Smart Proximity Location

[0219] Smart proximity identification allows mobile devices to be identified and located on the basis of proximity to another mobile device. The smart proximity identification feature allows the operator to obtain a list of ah users in the same area as a mobile device of interest In an avalanche zone, for example, a mobile of a missing skier can be located A complete list of mobile devices in the same area can also be determined The niobiles belonging to search and rescue personnel found in the same geographic area to the mobile of interest wifi, be queried via Anytime Interrogation (ATI) or NULL value SMS and the high-accuracy locations produced will be used to determine proximity to the mobile of interest Tb־ rescuers cm then be directed to the missing or distresSd skier.

[0220] Figures 8B-8D illustrate an exemplary method of Smart Proximity Location in accordance with the present invention. At step 813, all network events can be entered into the 5 system with a MSID filter. The LMS can be set to detect all network transactions at step 814. When a mobile initiates a network transaction at step 815, the LMS can detect the transaction at step 816 and collect MSID, Cell, and radio information as a result of thd transaction and can store it in memory at step 817. Sometime subsequent to the-network transaction, the mobile will complete the transaction at step 818. When a MSID matches a predetermined filter value, the

LMS can transfer the MSID, Cell, and radio information to the WLS at step 819. The WLS can perform a low or high accuracy location of the mobile at step 820. The LMS and the WLS will transfer all available information, including the location estimate and Cell DD to a Location Application at steps 819 and 822 respectively. The Location Application can then set Cell ID in the LMS at step 821.

₅ ן [Q221 ] The LMS can then search the memory for MSIDs in Cell ID of interest at step

824. The LMS can then send all the collected MSIDs found to the Location Application at step

825. The Location Application can then set the LMS event to page response and filter on any collected MSID at step 826. The LMS can then be set to detect page response and filter on any of the collected MSID at step 828. The Location Application also can send a series of location requests with the collected MSIDs at step 829. As a result, the GMLC can perform AnyTimelnterrogations (ATT) for the collected MSIDs at step 830. If the mobile is idle, the mobile can respond to the ATI induced page at step 831. The LMS can then detect the page response and match to the collected MSIDs at step 832.

[0222] The LMS then can task the WLS with MSID, Cell, and radio information at step 25 833. The WLS can then perform a low or high accuracy location of the mobile at step 834 and sent the location estimate to the Location Application at step 835. The LMS can also send the MSID, Cell, and radio information to the Location Application at step 833. The Location Application will collect all the information at step 836 for further use. At some point in time, the mobile will complete the ATI-induced page response or call at step 837.

9. Geo-Fencing

[0223] Mobile devices can also be identified and then located with high accuracy, on the basis of a cell ID-based location as generated by the LMS. The fenced

WO 2006/135=42 correspotidfe ffifKB of*־־ ־U (CGI)«־“״ ״׳״«” ^b> ^&'־ ^d־fc>Ki by a cell and ־־־tor combined wi* timing advance (ΤΑ). The Geo-tobg &־־*־ ahows tte operator to ־at specific areas or “restricted ־onesbased on 011־ area or sector areas that initiate high-ar־o־rany locations on mobiles entering the area or *at get too close to those defined restricted zones.

[0224! For example, *־ CGI serving an area adjacent to *־ restricted zone can be loaded into *e wireless location system. From that time forward any mobile *al enters or leaves *al area will be located by high accuracy U-TDOA so that a security sendee, for example, W investigate *e incident Th־ service may also continue to locate *al mobile or if *־ trespass is found to be innocent terminate *־ location. In Other embodiments, an individual subscriber may benotified, for example, by ־tarn, rib־ leaves or arrives to a pretietenmned Geo-faced area 1־ a time not scheduled.

[0225] Mobile devices, regardless of *־ air interface in use, are deseed to ״״vimire battery life. For *is reason, the power-consuming radio transmitter md receiver are kept * a powered down or standby state unless the user places a call initiates a data session or an mteraal timer expires. Expiration of an internal timer may cans־ the phone to transmit or may singly activate *־ receiver to listen for incoming messagmg. Timing messages may be addressed directly to the mobile device (as in a page) or broadcast by *־wireless system to all wireless devices. For purposes of *is specification, transmissions by a mobile device are referred to as “radio netwotk events

[0226] As previously mentioned, *e mobile device may be quiescent for *ng durations, rendering problematic its use as avehicle for location ortradring. This invention relies on *־use of unmodified, standardized mobile phones in standard, unaltered operation, a passive network monitoring device, and the designation of geographical zones or boundaries to enable*־ class of location-based services collectively called “geo-fencing'.

[0227] Automatic' geo-fencing takes advantage of existing wireless network parameters and configurations used to control radio traffic. The lx>cation Area (LA), the Location Area Code (LAC), and the Location Area Index (LAI), and their non-GSM equivalents, are already in use to control delivery of control messaging, data, and voice calls to the mobile device by limiting the paging traffic to a geographic area defined by the wireless operator.

[0228] Automatic geo-fencing requires the operator to designate specific areas of interest or zones based on wireless service parameters such as cell, sector, paging area, _ar״_ _M other ser־־״ ar־» Once an area has been designated, *־wireless

WO 2906/135542 . PCT/OS 2006/019863 location's^trai can l^cFaB§. locate wireless devices and alert others that wireless devices have entered defined restricted zones or attempted to travel out of the defined zones, A mobile phone also may cause an alarm if it leaves or am^es at pie-determined ־teo-fenced area at a tims when it is not expected or scheduled, for example. Adjustment of wireless network parameters such as the LAC and establishment of the geo-fenced zones of interest could potentially have a non-optimri effect on overall wireless system radio and network traffic such as the creation of higher paging volumes. Geo-fencing is seen as a high-value Location-based service worth of perturbing the wireless network. Geo-fencing using wireless system paging configurations was not possible before recent emergency services projects for both low-accuracy (cell-id based) and high-accuracy (UTDOA, Α0Α) network-based location systems.

[0229] In addition to the Α0Α and TDOA location methods described in the listed patents, the wireless location system supports lower accuracy location methods include those based mapping to a serving cell-ID, serving sector, or a combination of serving cell, sector and handover candidate measurements called Enhanced Cell ID (ECID)

[0230] The passive monitoring devices (radio network monitors (RNM 82) included in this invention allows for low-accuracy location of mobile phones using !»χί sting radin network messaging and information. Additional deployment of overlaid passive receivers covering the geo-fenced area or modification to existing cell-site receivers, will allow for high-accuracy (TDOA, Α0Α) location of any radio network events.

A״ Detailed Description of Geo-fencing

Geo-Fenced Area

[0231] All base stetinn radio transmitters in a PLMN broadcast, via a control channel, a Location Area Identity (LAI) code to identify the Location Area (LA) that the base station transmitter serves. When a mobile device is not engaged in a call, it automatically scans the control channel broadcasts transmitted by the base stations in the locality and selects a channel delivering the strongest signal. The LAI code broadcast by the selected channel identifies the location area in which the MS is currently situated. The LAI code is stored in the Subscriber Identity Module (SIM) of the mobile equipment. As the MS moves through the network area, the signal received from the selected control 1-,harm al gradually diminishes in strength and anew stronger signal is determined. The MS can re-tune to the newly dominant channel and can examine the LAI code that the new channel is broadcasting. If the received LAI code differs from that stored on the

Slid, then the MS Sas'entetbiTtinotfier location area and initiates a location update proryvivre to report the change to the Mobile Switching Center (MSC), At the end of the nrocedure the LAI code in the SIM is updated[0232] The Location Area Identity code identifies the location area in a PLMN. The LAI code has three components including a Mobile Country Code (MCC), a Mobile Network Code (MNC), and a Location Area Code (LAC), as shown in Figure 8E. The MCC is a 3-digit code that can uniquely identify the country of domicfie of the mobile subscriber (e.g., Germany is 262, and Brunei is 528). The MCC is assigned by the International Telecommunications Union (ITU-T) an international standards organization under the auspices of the United Nations). The MNC is a 2-digit code that identifies the home GSM PLMN of the mobile subscriber. If more than one GSM PLMN exist in a country, a unique MNC is assigned to each of them. The government of each country assigns the MNC 2-digit code.

[0233] The LAC component identifies a location area within a PLMN. The LAC has a fixed length of 2 octets and can be coded using hexadecimal representation. The operator assigns the LAC component of the LAL Figure 8E depicts an exemplary Location Area Identity (LAT) code.

Static Geo-fenced Area

[0234] A static geo-fenced area is defined by a concatenated set of areas covered by a defined group of CGI or CL The LMS or RNM can use these CGI or CI groups to filter network event triggers. Entry into, movement between cells and sectors, and exit out of the covered geographic areas can be detected for both idle mobile and those in a voice or data session. Size of the geo-fenced area is generally limited by the geographic distribution of RNM or by the area monitored by the LMS.

[0235] A static geo-fenced area is created, by setting a common Location Area Code (LAC) in cells or sectors that cover a geo-fenced area; this creates a uniquely identified LA (Location Area) within the Public Land Mobile Network (PLMN). Thousands of these geo-fenced areas may be created per GSM wireless network, covering areas from a single sector or microcell to clusters up to national or continental size. Entry into and exit out of the covered geographic areas can be detected even if the mobile is idle. The LAC can be used by the LMS or RNM to network event triggers and limit triggering events only to the area of interest.

[0236] Figure 8F is a flowchart of an exemplary process for detecting a idle mobile ^,with a static LAC in accordance with the present invention. To begin with, the LAC is set in the BCCH of selected CGIs to cover a “fenced area at step 838. In addition, the LMS tagger־ are set for CGIs in the area of interest and for any location update transactions at step 835. At step 840, a exemplary mobile, that is id!־, enters the fenced area.

The exemplary mobile will detect the new location area broadcast (i.e., the LAC) in the BCCH at step 841. At step 842, the mobile can initiate a location update transaction with the wireless network. The LMS will detect the location update event at step 843 and will collect and deliver mobile identity data, the CGL and RF channel to location to a location application, for example. The location application can then, at step 844, evaluate using, for example, a rules set, and store the mobile identity and CGI, in a database. Concurrently, the IMS can task, pending request type a Wireless Location System (WLS) with KF channel information to complete a high accuracy location of the exemplary ־״־״־ «״P ⁸⁴⁵^{At s}°“ P^{0int Sub5־qU־nt} *״ ^Λ״ ^־°^Μ־initiating at location update transaction at step 842, the mobile can complete the location update with the wireless network and return to an idle state at step 847. Further, once the WLS completes the high accuracy location of*־ mobile and defines the position of the mobile to the location application at step 846, the location application will evaluate and store the high accuracy position at 848. If further tracking of the mobile is required, the LMS can continue to task the WLS to complete high accuracy locations on the identified mobile (not shown).

[0237] Figure 8G is a flowchart of an exemplary process for detecting a mobile during handover in accordance with the present invention. To begin with, the LAC is Set in the BCCH of selected CGIs to cover a fenced area at step 849. hi addition, the LMS triggers are set for CGIs 20 in the area of interest and triggers for handover at step 850. At step 851, a exemplary mobile comes on call. The when the mobile enters the proximity of the fenced CGIs at step 852, the mobile will perform a handover to a CGI within the fenced area at step 853. The mobile can then remain on call in the new CGI at step 855.

[0238] The LMS, however, detects the handover event at 854 and can send the CGL 25 Timing Advance, and the Network Measurement Report (NMR) to the SMLC at step 856. The SMLC can calculate the Enhanced Cell Site E<)> (ECK)) position of the mobile station at step 857. The Location Application can evaluate and store the mobile identity ECED at step 858. The LMS can task the WLS with the KF channel information and request type at step 859. The WLS can complete a high accuracy location and return the position of the mobile to the Location

Application at step 860. The Location Application can then evaluate and store the high accuracy position at step 861. If further tracking of the mobile is required, the LMS can continue to task the WLS to complete high accuracy locations on the identified mobile (not shown).

WO M0M35M! . PCT/OSi»M19«3

Ί020&Γ ’Figure 51׳ Is ^flowchart of an exemplary process for detecting a mobile using proximity detection in momdmo־ wit She pr־־mt invention. Initially, the LAC is set fo the BCCH of selected CGIs to cover a “fenced area 1־ step 862. In addition, the TVS triggers are set for CGIs in the area of mteest for NMRs at stq> 863. At step 864, a exemplary mottle is on call. When the mobile enters the proximity of the fenced CGIs al step 865 the mobile will add a CGI tom ihe fenced group to ihe NMR at step 866. The mobile can then remam on call at step 868. The LMS, however, detect־ the NMR list containing fl» fenced CGI at 867 and. can send the CGL Timing Advance, and foe Network Measurement Report (NMR) to ihe SMLC at step 869. The SMLC cm calculate the Enhanced Cell Site ID (BCID) position of the mobile station at step 870. The Location Application can evaluate and store the mobile identity BCID al step 871 The LMS cm task the WLS wiih the RF channel information and request type at step 872. The WLS cm complete a bigh accuracy location and return foe position of foe mobile to ihe Location Application at step 873. The Location Application cm then evaluate and store the high accuracy position at step 874. If further traddag of foe mobile is required, . the IMS cm continue to task the WLS to complete high accuracy locations on foe identified mobile (not shown).

Djmamic

[0240] Dynamic changes to a cell’s location area code (LAC) can be used to provoke idle mobiles to transmit and thus create a low-accuracy, cell ID-based location estimate or, in areas with installed overlay receivers, create the opportunity for a highaccuracy netwoik-based (U-TDOA, Α0Α or Hybid U-IDOA/AoA) location estimate. As a result of the changes in the LAC, mobiles currently in conversation can experience a handoff or can be released but allowed to redial and resume conversation in short ords:.

[02411 An alternate embodiment of the dynamic LAC allocation occurs where a high power, possibly mobile, standalone BTS with a unique LAC is used to provoke the mobiles in the cell's coverage area into performing a Location Update. Detrimental effects on 1he wireless system can be expected, but can be confined to the coverage area of the standalone BTS and the surrounding cells.

[0242] Figme 8 J is a flowchart of an exemplary process for dynamically detecting a mobile using geo-fencing in accordance with the present invention. Initially, an original LAC is set in the BCCH for all CGIs in the system at step 875. Ihe sought mobile is idle in the selected area at step 876. The LAC can then be changed in the BCCH for selected CGIs of the fenced area of interest at step 877. Also, the LMS triggers can be set for location update transactions optionafiy with selected CGIs as a filter at step

»5 ״

PCWS2006/019863

88S. The idle mobile in rhefraced area then will detect the new location area broadcast in the BCCH at step 889. The mobile will initiate a location update transaction with the network at step 890. The LMS can detect the location update event and collect and deliver mobile identity data, CGI, and RF channel information to a location application at step 891. Subsequently, the mobile will complete the location update transaction and return to an idle state in the fenced area at step 894.

[0243] The Location Application can evaluate, store, or forward the mobile jdmtity and CGI to an LBS application at step 892. Further, the LMS can task a wireless location system with RF channel information and request type at step 893. The WLS can complete a high accuracy location and return the position to the Location Application at step 895. The location Application can evaluate, store, and/or forward the high accuracy position on to a LBS application at step 896. The IBS application can then evaluate the information collected at step 897. If further tracking of the mobile is required, the LMS can continue to task the WLS to complete high accuracy locations on the identified mobile (not shown).

Geo-fencing Option 1

[0244] In Figure 8K, receivers (LMUs) are installed at existing cell site or standalone locations with a central processing node (the SMLC) serving the deployed LMUs. The LMUs can determine the local BCCH, establishing the timing and framing of the BCCH. The LMU can then determine the local Access Channels or can be preset to scan a ־range of access channels. The LMU can detect mobile attempting to use the RACK (or other uplink channels) to access the local GSM network. Once detected, the LMUs in the immediate area can be tasked to locate the accessing mobile.

[0245] This geo-fencing application would therefore not be able to detect idle mobiles or those that move into die geo-fenced area while on a call. Identity of the mobitp; or the subscriber could not be determined by this system, but interface to nonlocation nodes could provide the necessary TMSI-IMSI-MSIDN mapping.

[0246] Standalone receivers can be used to improve the coverage and geometry of the covered area. Geometry of network can be used to minimize the effects of Geometric Dilution of Precision (GDOP) present in all TDOA-based location systems or maximize the signal to noise ratio. Improvements in GDOP or SNR would yield a more accurate location estimate.

[0247] InFigure 8K,BTS’s 10, II, 12,13,14 are equipped with RNMs 82 thus setting the size and shape of the geo-fenced area.

tjeo-leacmg cfpLjc/avz

[0248] In Figure 8L. receivers (RNMs) can be installed at existing cell site o~ standalone locations with a central'processing node (the SMLC) serving the deployed

RNMs. 'The Location Area Code (the LAC) is set to be unique in the geo-fenced area with all BCCHs in the geo-fenced area using the same LAC.

[0249] The RNMs can determine the local BCCH, establishing the timing and frying _of foe BCCH. The RNM can then determine the local Access Charnels or can be preset to scan a range of access channels. The RNM can detect mobiles attempting to use the RACH (or other uplink channels) to access the local GSM network. Once detected, ihe RNMs in the immediate area would be tasked to locate the accessing mobile.

[0250] Since the LAC is unique to the geo-fenced area, idle mobiles would perform a Location Update- upon moving into the geo-fenced area. An on-call mobile would perform a Location Update on completion of the call. In either case, the monitoring RNMs would detect the Location Update and perform a location estimate on lhe triggering Mobile.

[0251] Standalone, receivers can be used to improve the coverage and geometry of the covered area. Network geometry can be used to minimize the effects of Geometric Dilution of Precision (GDOP) present in all TDOA-based location systems or maximize the SNR Improvements in GDOP or SNR would yield a more accurate location estimate. Identity of the mobile or the subscriber could not be determined by this system, but interface to non-location nodes (MSC/VLR or HLR) could provide the necessary TMSIIMSI-MSIDN mapping.

[0252] In Figure 8L, cells 7, 8,14,15,16,18 and 19 are equipped with RNMs. Cell 15 has been set to broadcast a locally unique Location Area Code on the Broadcast Control Channel (BCCH). It is the LAC that defines the geo-fenced are size and boundaries

Geo-fencing Option 3

[0253] As depicted in Figure 8M, Geo-fencing using the Links Monitor (LMS) (or similar facility built into the base station controller (BSC) or Radio Network Controller(RNC)) is possible with the LMS set to trigger on mobile network transactions, These network transactions include Mobile Originations, Mobile Terminations, Location Update Short-Message-Service originations, and SMS terminations as well as other control channel procedures such as handover.

[0254] By monitoring the links between the base station (BTS) and BSC, the LMS can detect these events. By link-selective monitoring, or by filtering the triggers

WO 2006/135542 PCT7US2006/019^63 wa on 3־־inD,־thmS S^e used to create arbitrary geo-fenced areas baaed on ced or sector coverage areas. . .

[0255) The LMS can then determine a location estimate for a triggering mo e ^^information available cm to Abis (or») link. Using to information eoUected by to IMS, to wireless location system (WLS) can compute low-accuracy Cell-ID based locations,

[025¢) The lowest accuracy, CGI or CI method, is simply to reporting of to latitode and lonpmde of to serving cell tower or to ־־to of to serving ־־־tor. Amor־ «Ctoe location estimate canbe computed using both to cell-ID (CGI m GSM or Om UMTS) _mdtot_mmgad־.m־־^A)(al־o-־-imLWS as 1/2 Round-trip-time (RTT) . originally tod by to wireless system to synchronize to mobile's uplmk message Conversion of to Timing Advance to distance (multiplying by the speed-of-hght in air) yields a range estimate from to cell tower to to mobile device.

[0257] Using the CGI+TA (or CI+RTT) location technique, to reported location!־ to intersection of to area formed by timing granularity ofthe timing advance measurement (554 met־־־ in GMS, 39 meters in UMTS) and to bisector ofthe serving sector into case of an omni-directional single ־־ctor ־־Π, to reported location for to CGI+TA or CI+RTT method is the latitude and longitude ofthe serving cell tower.

[0258] The potentially most accurate eeH-ID based location technique, called Btomced Cell ID (BCID), uses LMS collected information on the serving cell, servmg sector and timing advance combined with beacon power measurements taken by 4־ mobile station normally used for to determination of handover candidates. By combining the cell-ID, to״ information, and timing advance with a power-rirfferenceof-arrival calculation based on to IMS collected power measurements (or path-!□־־ measurements inUMTS) ftom neighboring cells beacons, to WLS can potentially compute a more accurate location then to use of cell-ID or cell-ID wi* timing advance alone. Factors such as geometry of to neighboring cells, to RF environment and to number of measured beacons can limit to usefulness of BCID.

_md «tote location for mobiles on-call, entering (or exiting) the area and toergomg th־ handover procedure. Identification of the mobile or the subscriber cannot be ju^nteed by to system, but interface to non-loeation nodes, such as the MSC/VLR or ffiR could provide the necessary TMSI-IMSI-MSIDN mapping.

S3

WO 2006/135542 PCI7US2006/019863

[0260] In Figure KMf the LMS has been preset v+fh triggers for radio network tTymRactirms and uses filters to limit forwarded events to the wireless location system. It is the use of filtering that defines the geo-fenced area to cells 7, 8 and 15

Geo-fencing Option 4

[0261 ] As depicted in Figure 8N, Geo-fencing using the Abis Monitor (LMS) (or similar facility built-info the base station controller (BSC) or Radio Network Controller (RNC)) is possible with the LMS set to trigger on mobile network transactions. These network transactions include Mobile Originations, Mobile Terminations, Location Updates, Short-Message-Service originations, and SMS terminations as well as other control channel procedures such as handover and page response. The inclusion of a Gateway Mobile Location Center (GMLC) allows the system to both periodically re-locate triggering mobiles. The GMLC also allows the collection of identity information based on HLR lookups for triggering mobiles.

[0262] By monitoring the links between the BTS and BSC, the LMS can detect these events. By link selective monitoring, or by filtering the triggers based on cell ID, the LMS can be used to create arbitrary geo-fenced areas based on cell or sector coverage areas. The LMS would then determine a location estimate for a triggering mobile using the information available on the Abis (or lub) link. Using the information collected by the LMS, the wireless location system (WLS) can compute low-accuracy Cell-ID based locations. The lowest accuracy, CGI or CI method, is simply the reporting of the latitude and longitude of the serving cell tower or the center of the serving sector. A more accurate location estimate can be computed using both the cell-ID (CGI in GSM or CI in UMTS) and the timing advance (TA) (also used in UMTS as 1/2 Round-trip-time (RTT) originally used by the wireless system to synchronize the mobile's uplink messaging. Conversion of the Timing Advance to distance (multiplying by the speed-of-tight in air) yields a range estimate from the cell tower to the mobile device.

[0263] Using the CGI+TA (dt CI+RTT) location technique, the reported location is the intersection of the area formed by timing granularity of the timing advance measurement (554 meters in GMS, 39 meters in UMTS)and the bisector of the serving sector. In the case of an omni-directional, single sector cell, the reported location for the CGI+TA or CI+RTT method is the latitude and longitude of the serving cell tower.

[0264] The potentially most accurate cell-ID based location technique, called Enhanced Cell ID (EC'LD), uses LMS collected information on the serving cell, serving sector and timing advance combined with beacon power measurements taken by the mobile station normally used for the deterrnination. of handover candidates. By combining the cell-ID, sector information, and timing advance with a power-differenceof-arrival calculation based on the LMS collected power measurements()?? path-loss measurements in UMTS) from neighboring ceils beacons, the WLS caa potentially compute a more accurate location then the use of cell-ID or cell-ID with timing advance alone. Factors such as geometry of the neighboring cells, the RF environment and the number of measured beacons can limit the usefulness of ECID.

[0265] The GMLC can be tasked by the SMLC node to query the HLR for identity in form art rm on LMS detected mobiles as well as being tasked to issue Any Time Interrogation (ATI) messages to the Mobile Switching Center (MSC) to cause the mobile to transmit a Page Response message sequence over the radio interface.

[0266] ^,This geo-fencing application would not be able to detect idle mobiles but can detect and estimate location for mobiles on-call, entering (or exiting) the area and undergoing the handover procedure. Identification of the mobile or the subscriber could not be guaranteed by this system, but interface to non-location nodes could provide the necessary TMSI-IMSI-MSIDN mapping.

[0267] In Figure 8N, the LMS monitors cells 1-21 and has been preset with triggers for radio network transactions and uses filters to hmit forwarded events to the wireless location system. It is the use of filtering that defines the geo-fenced area to cells 7, 8 and 15. The addition of the GMLC allows for periodic low-accuracy location anywhere in the LMS coverage area (cells 1-21).

Geo-fencing Option 5

[0268] As depicted in Figure 80, Geo-fencing an aibitary gerograpbic area,using the I -ink Monitoring System (LMS) (or similar facility built-into the base station controller (BSC) or Radio Network ControllertRNQ) can occur with the LMS set to trigger on mobile network transactions. These network transactions include Mobile Driginatinns, Mobile Terminations., Location Updates, Short-Message-Service originations, and SMS terminations as well as other control channel procedures such as handover and page response.

[0269] By monitoring the links between the base station (BTS) and BSC, the LMS can detect these events. By link selective monitoring, or by filtering the triggers based on cell ID, the LMS can be used to create arbitrary geo-fenced areas based on cell or sector coverage areas. By setting the LAC to be unique to the geo-fenced area, the LMS can be triggered for the Location Update generated by each mobile entering the geo-fenced area. The LMS ־would then determine a location estimate for any triggering

WO 2006/135S42 PCT/US 2996/019863 mobile using the inibrmation available on the Abis (or Tub) link. Using the information collected by the LMS, the wireless location system (WLS) can compute low-accuracy

Ceil־© based locations.

[0270] The lowest accuracy, CGI or CI method, is simply the reporting of the latitude and longitude of the serving cell tower or the center of the serving sector. A more accurate location estimate can be computed using both the cell-© (CGI m GSM or CI in UMTS) and foe timing advance (TA) (also used in UMTS as 1/2 Round-trip-time (RTT) originally used by the wireless system to synchronize the mobile's uplink messaging. Conversion of foe Timing Advance to distance (multiplying by foe speed-0f-light in air) yields a range estimate from foe cell tower to foe mobile device.

[0271] Using foe CGI+TA (or CI+RTT) location technique, the reported location is the intersection of foe area formed by timing granularity of the timing advance measurement (554 meters in GMS, 39 meters in UMTS)and foe bisector of foe serving sector. In foe case of an omni-directional, single sector cell, the reported location for the CGI+TA or CI+RTT method is the latitude and longitude of the serving cell tower.

[0272] The potentially most accurate cell-© based location technique, called Enhanced Cell © (EC©), uses LMS collected information on foe serving cell, serving sector and timing advance combined with beacon power measurements taken by foe mobile station normally used for the determination of handover candidates. By combining the cell-©, sector information, and timing advance with a power-differenceof-arrival calculation based on foe LMS collected power measurements(□! path-loss measurements in UMTS) from neighboring cells beacons, foe WLS can potentially compute a more accurate location then the use of cell-© or cel.© with timing advance alone. Factors such as geometry of the neighboring cells, the RF environment and the number of measured beacons can limit foe usefiilness of EC©.

[0273] For mobiles entering foe geo-fenced area, the change in the LAC would cause foe mobiles to perform a Location Update procedure. Since identification information (the IMSI and usually foe ΣΜΕΓ) is exchanged during the Location Update procedure, the LMS would then have a location estimate and mobile and subscriber information.

[0274] This geo-fencing application would not be able to detect idle mobiles but can detect and estimate location for mobiles on-call, entering (or exiting) the area and undergoing the handover procedure if foe link monitoring system (LMS) is available.

[0275] In Figure 80, foe LMS monitors cells 1-21 and has been preset with triggers for radio network transactions and uses filters to limit forwarded events to the

WO 2066/135542 PCT/US2006/01&amp;863 wireless location systemAFaSi^tion, cells 7,12, and 1 כ Lave been set to broadcast a locally unique Location Area Code on the Broadcast Control Charnel (BCCH). It is the LAC that defines the geo-fenced area size, shape and boundaries. Once detected in the geo-fenced area, the mobile can then be located to low accuracy when transmitting in any of the cells 1-21.

Geo-fencing Option 6

[0276] As depicted in Figure 8P, Geo-fencing an arbitrary geographic area, can be combined with a high-accuracy U-TDOA system based on geographically distributed receivers (LMUs), a central processing node (the SMLC), and Link Monitoring System . (the LMS) and a Gateway Mobile Location Center (GMLC).

[0277] With the LMS (or similar facility built-mto the base station controller (BSC) or Badin Network Controller (RNQ), it is possible within the IMS to set triggers for mobile network transactions. These network transactions include Mobile Originations, Mobile Terminations, Location Updates, Short-Message-Service originations, and SMS terminations as well as other control channel procedures such as handover and page response.

[0278] By monitoring the links between the base station (BTS) and BSC, the LMS can detect these events. By link selective monitoring, or by filtering the triggers based on cell ID, the LMS can be used to create arbitrary geo-fenced areas based on cell or sector coverage areas. By setting the LAC to be unique to the geo-fenced area, the LMS can be triggered for the Location Update generated by each mobile entering the geo-fenced area. The LMS would then determine a location estimate for any triggering mobile using the information available on the Abis (or lub) link. Using the information collected by the LMS, the wireless location system (WLS) can compute low-accuracy Cell-ID based, locations.

[0279] The lowest accuracy, CGI or CI method, is simply the reporting of the latitude and longitude of the serving cell tower or the center of the serving sector. A more accurate location estimate can be computed using both the cell-ID (CGI in GSM or CI in UMTS) and the timing advance (TA) (also used in UMTS as 1/2 Round-trip-time (R.TT) originally used by the wireless system to synchronize the mobile's uplink messaging. Conversion of the Timing Advance to distance (multiplying by the speed-0f-ligbt in air) yields a range estimate from the cell tower to the mobile device.

[0280] Using the CGI+TA (or CI+RTT) location technique, the reported location is the intersection of the area formed by timing granularity of the timing advance measurement (554 meters in GMS, 39 meters in UMTSIand the bisector of the serving sector. In the case of an omni-directional, single sector cell, the reported location for the CGI+TA or CI+RTT method is the latitude and longitude of the serving cell tower.

[0281] The potentially most accurate cell-ID based location technique, called Enhanced Cell ID (ECID), uses IMS collected information on the serving cell, serving sector and timing advance combined with beacon power measurements taken by the mobile station normally used for the determination of handover candidates. By combining the cell-ID, sector information, and timrog advance ־with a power-differenceof-arrival calculation based on the IMS collected power measurements(or path-loss measurements in UMTS) from neighboring cells beacons, the WLS can potentially compute a more accurate location then the use of cell-ID or cell-ID with timing advance alone. Factors such as geometry of the neighboring cells, the RF environment and the number of measured beacons can limit the usefulness of ECID.

[0282] The LMS can also determined RF channel infonnation from the monitored messaging and deliver such information to the SMLC. The SMLC will fa sir the local RNMs to collect TDOA information on the sign a J of interest from the triggering mobile, resulting in a high-accuracy location.

[0283] The GMLC can be tasked by the SMLC node to query the HLR for identity information on LMS detected mobiles as well as being tasked to issue Any Time Interrogation (ATT) messages to the Mobile Switching Center (MSC) to cause the mobile to transmit a Page Response message sequence over the radio interface. This page response can in turn trigger an IMS-based, low accuracy [CGI, CGI+TA or ECID] location estimate or a high-accuracy U-TDOA location calculated by the SMLC and specialized receiver (LMU or SCS) network.

[0284] Figure 8P shows cells 7,12 and 15 have been set to send over the BCCH a locally unique Location Area Code (LAC). Cells 3,4,6,7,8,9,10,11,12,13,14,15,16,18,19 have all been equipped with RNMs. An IMS sendees all cells 1-21. While the geofenced area is defined by the LAC (cells 7,12, 15) and is able to locate mobiles in the geo-fenced area with high accuracy, a low accuracy location remains possible for all cells 1-21. The addition of a GMLC allows for future location estimates for mobiles that once entered into the geo-fenced area or left the geo-fenced area.

10. Emergency Alerts

[0285] The Emergency Alert location-based application allows for geographically targeted messaging to mobile devices in the case of an emergency similar to the United States radio and television Emergency Alert System. A TDOA and Ao A

WO 2006/135542 PCT/OS2006/Q19863

Systran Tigfog the RNM or LMS in accordance with the present invention prmrides for wide area localization and subsequent high volume, accurate location of mobile stations in the selected area. Once mobiles have been located in the area of interest, SMS messaging, MMS. or a recorded voice message can be used to warn and provide instructions to the targeted population

[0286] For extremely large areas where high-accuracy precision location is unnecessary or when extremely high affected populations need to be warned, the Finder wireless location system may use lower-accuracy cell-ID based location estimates to find the affected populations to alert

11. CaEuig Number Triggering

[0287] The WLS can locate a mobile based on the number calling the mobile. This number can be a mobile, fixed, local, and national or any length international number. The wireless location system can be tasked with any dialled digit trigger at the RNM or LMS. Once the trigger is tasked, the system will automatically locate any mobile in the service area called by the specified number.

[0288] Figure 9 is a flowchart of an exemplary process for detecting a mobile using calling number triggering in accordance with the present invention. Initially, at step 910, the MSISDN of interest is entered in the system. The LMS is set to detect all network transactions and filter on MSISDN of calling number at step 915. A mobile can then foitfofe a network transaction at step 920. The LMS can then detect the transaction at step 925 and collect the MSLD, Cell, and radio information from the transaction messaging and store that information into memory at step 930.

[0289] If the MSISDN matches the filter value MS ISDN, the LMS can transfer the MSID, Cell, and radio information to a WES at step 935. The WLS can then perform a high or low accuracy location at step 940. The WLS can then send the location to a Location Application at step 945. As some time subsequent to the mobile initiating a network transaction, the mobile will complete the transaction at step 955. The Location Application, will receive information from the WLS and the LMS and store for further evaluation at step 950.

E. Conclusion

[0290] The true scope the present invention is not limited to the illustrative and presently preferred embodiments disclosed herein For example, the foregoing disclosure of a Wireless Location System uses explanatory terms, such as LMU, LMS, RNM, BTS, BSC, SMLC, and the like, which should not be construed so as to limit the scope of protection of this application, or to otherwise imply that the inventive aspects of the

WO 2006/135542 PCT/US2006/019863 wireless Location System are limited to the particular methods 2nd apparatus disclosed. Moreover, as will be understood by those skilled in the art many of the inventive aspects disclosed, herein may be applied in location systems that are not based on TDOA or Ao A techniques. In such non-TDOA systems, the ShfLC described above would not be required to perform TDOA or Α0Α calculations. Similarly, the invention is not limited to systems employing LMUs, LMS, or RNM constructed in a particular manner; _or to systems employing specific types of receivers, computers, signal processors, etc. The LMUs, SMLC, etc., are essentially programmable data collection and processing devices that could take a variety of forms without departing from the inventive concepts disclosed herein. Given the rapidly declining cost of digital signal processing and other processing functions, it is easily possible, for example, to transfer the processing for a particular function from one of the functional elements (such as the SMLC) described herein to another fonctional element (such as the LMU) without changing the inventive operation of the system. In many cases, the place of implementation (i.e., the functional element) described herein is merely a designer’s preference apri not a hard requirement.

Accordingly, except as they may be expressly so limited, the scope of protection is not intended to be limited to the specific embodiments described above.

[0291] In addition, any reference herein to control ch annals or voice channels shall refer to all types of control or voice channels, whatever the preferred terminology for a particular air interface. Moreover, there are many more types of air interfaces (e.g., IS-95 CDMA, CDMA 2000, and UMTS WCDMA) used throughout the world, and, unless the contrary is indicated, there is no intent to exclude any air interface from the inventive concepts described within this specification. Indeed, those skilled in the art will recognize other interfaces used elsewhere are derivatives of or similar in class to those described above.