Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 1 of 27
`
`EXHIBIT 25
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 2 of 27
`
`US 8472955—Claim 1
`A method of selecting a
`public land mobile
`network (PLMN) for a
`mobile station, the
`method comprising:
`
`receiving a plurality of
`Mobile Country Code
`(MCC) and Mobile
`Network Code (MNC)
`pairs corresponding to a
`plurality of available
`PLMNs available to the
`mobile station;
`
`3GPP Specifications
`3GPP TS 23.122 – V8.12.0:
`4.4.3.1.1 Automatic Network Selection Mode Procedure
`The MS selects and attempts registration on other PLMN/access technology combinations, if available and allowable,
`in the following order:
`3GPP TS 22.011 – V8.11.0:
`1.2 Definitions and abbreviations
`In addition to those below, abbreviations used in this 3GPP TS are listed in 3GPP TR 21.905.
`PLMN A Public Land Mobile Network (PLMN) is a network established and operated by an Administration or RPOA
`for the specific purpose of providing land mobile communication services to the public. It provides communication
`possibilities for mobile users. For communications between mobile and fixed users, interworking with a fixed
`network is necessary.
`…
`
`3GPP TS 23.122 – V8.12.0:
`1.2 Definitions and abbreviations
`…
`Registration Area:
`…
`The PLMN to which a cell belongs (PLMN identity) is given in the system information transmitted on the BCCH (MCC
`+ MNC part of LAI).
`In a shared network a cell belongs to all PLMNs given in the system information transmitted on the BCCH.
`
`3GPP TS 36.331 – V8.21.0:
`
`[…]
`
`1
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 3 of 27
`
`6.3.4 Mobility control information elements
`[…]
`
`–
`PLMN-Identity
`The IE PLMN-Identity identifies a Public Land Mobile Network. Further information regarding how to set the IE are
`specified in TS 23.003 [27].
`
`3GPP TS 23.122 – V8.12.0:
`4.2 Registration on a PLMN
`…
`An MS successfully registers on a PLMN if:
`a) The MS has found a suitable cell of the PLMN to camp on; and
`
`
`…
`3GPP TS 24.301 – V8.10.0:
`
`
`
`2
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 4 of 27
`
`[…]
`8.2
`EPS mobility management message
`Attach accept
`8.2.1
`8.2.1.1 Message definition
`This message is sent by the network to the UE to indicate that the corresponding attach request has been accepted.
`See table 8.2.1.1.
`
`
`
`
`
`Message type: ATTACH ACCEPT
`Significance: dual
`Direction:
`network to UE
`
`Table 8.2.1.1: ATTACH ACCEPT message content
`
`IEI
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`50
`
`13
`
`23
`
`53
`
`3
`
`
`
`
`
`Information Element
`Protocol discriminator
`
`Security header type
`
`EPS attach result
`
`Spare half octet
`
`T3412 value
`
`TAI list
`
`ESM message container
`
`GUTI
`
`Type/Reference
`Protocol discriminator
`9.2
`Security header type
`9.3.1
`Attach accept message identity Message type
`9.8
`EPS attach result
`9.9.3.10
`Spare half octet
`9.9.2.9
`GPRS timer
`9.9.3.16
`Tracking area identity list
`9.9.3.33
`ESM message container
`9.9.3.15
`EPS mobile identity
`9.9.3.12
`Location area identification
`9.9.2.2
`Mobile identity
`9.9.2.3
`EMM cause
`9.9.3.9
`
`Location area identification
`
`MS identity
`
`EMM cause
`
`Presence
`M
`
`Format Length
`V
`1/2
`
`M
`
`M
`
`M
`
`M
`
`M
`
`M
`
`M
`
`O
`
`O
`
`O
`
`O
`
`V
`
`V
`
`V
`
`V
`
`V
`
`LV
`
`LV-E
`
`TLV
`
`TLV
`
`TLV
`
`TLV
`
`1/2
`
`1
`
`1/2
`
`1/2
`
`1
`
`7-97
`
`2-n
`
`13
`
`6
`
`7-10
`
`2
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 5 of 27
`
`17
`
`59
`
`4A
`
`34
`
`64
`
`F-
`
`T3402 value
`
`T3423 value
`
`Equivalent PLMNs
`
`Emergency number list
`
`EPS network feature support
`
`Additional update result
`
`GPRS timer
`9.9.3.16
`GPRS timer
`9.9.3.16
`PLMN list
`9.9.2.8
`Emergency number list
`9.9.3.37
`EPS network feature support
`9.9.3.12A
`Additional update result
`9.9.3.0A
`
`O
`
`O
`
`O
`
`O
`
`O
`
`O
`
`TLV
`
`TLV
`
`TLV
`
`TLV
`
`TLV
`
`TLV
`
`2
`
`2
`
`5-47
`
`5-50
`
`3
`
`1
`
`
`[…]
`
`Tracking area identity
`9.9.3.32
`The purpose of the Tracking area identity information element is to provide an unambiguous identification of
`tracking areas within the area covered by the 3GPP system.
`The Tracking area identity information element is coded as shown in figure 9.9.3.32.1 and table 9.9.3.32.1.
`The Tracking area identity is a type 3 information element with a length of 6 octets.
`8
`7
`6
`5
`4
`3
`2
`1
`octet 1
`Tracking area identity IEI
`octet 2
`MCC digit 1
`octet 3
`MCC digit 3
`octet 4
`MNC digit 1
`octet 5
`TAC
`octet 6
`TAC (continued)
`Figure 9.9.3.32.1: Tracking area identity information element
`[…]
`Tracking area identity list
`9.9.3.33
`The purpose of the Tracking area identity list information element is to transfer a list of tracking areas from the
`
`MCC digit 2
`MNC digit 3
`MNC digit 2
`
`4
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 6 of 27
`
`network to the UE.
`The coding of the information element allows combining different types of lists. The lists of type "000" and "001"
`allow a more compact encoding, when the different TAIs are sharing the PLMN identity.
`The Tracking area identity list information element is coded as shown in figure 9.9.3.33.1, figure 9.9.3.33.2, figure
`9.9.3.33.3, figure 9.9.3.33.4 and table 9.9.3.33.1.
`The Tracking area identity list is a type 4 information element, with a minimum length of 8 octets and a maximum
`length of 98 octets. The list can contain a maximum of 16 different tracking area identities.
`
`
`3GPP TS 23.122 – V8.12.0:
`4.4.3.1.1 Automatic Network Selection Mode Procedure
`The MS selects and attempts registration on other PLMN/access technology combinations, if available and allowable,
`in the following order:
`i) [..];
`iv) other PLMN/access technology combinations with received high quality signal in random order;
`
`5
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 7 of 27
`
`v) other PLMN/access technology combinations in order of decreasing signal quality.
`
`3GPP TS 36.331 – V8.21.0:
`
`6
`Protocol data units, formats and parameters (tabular & ASN.1)
`6.1
`General
`The contents of each RRC message is specified in sub-clause 6.2 using ASN.1 to specify the message syntax and using
`tables when needed to provide further detailed information about the information elements specified in the
`message syntax. The syntax of the information elements that are defined as stand-alone abstract types is further
`specified in a similar manner in sub-clause 6.3.
`[…]
`
`
`SystemInformationBlockType1
`SystemInformationBlockType1 contains information relevant when evaluating if a UE is allowed to access a cell and
`defines the scheduling of other system information.
`
`
`
`Signalling radio bearer: N/A
`RLC-SAP: TM
`Logical channel: BCCH
`Direction: E-UTRAN to UE
`
`SystemInformationBlockType1 message
`
`
`
`
`
`6
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 8 of 27
`
`
`
`7
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 9 of 27
`
`performing matching
`procedure which includes
`comparing a received
`MCC and MNC pair of an
`available PLMN with an
`entry in a home PLMN
`(HPLMN) list of the mobile
`station, the HPLMN list
`identifying a plurality of
`HPLMNs of the mobile
`station which are
`equivalent to a home
`PLMN of the mobile
`station, the matching
`procedure being done
`until a match is found or
`all matches fail;
`
`3GPP TS 23.122 – V8.12.0:
`Annex A (normative):
`HPLMN Matching Criteria
`With the introduction of PCS1900 with the regulatory mandate to allocate 3-digit MNC codes, additional functionality
`is required to identify the HPLMN.
`…
`Definitions and abbreviations
`BCCH-MCC The MCC part of the LAI read from System Information type 3 messages broadcast on the BCCH
`by the network.
`BCCH-MNC The MNC part of the LAI read from System Information type 3 messages broadcast on the BCCH
`by the network.
`SIM-MCC The MCC part of the IMSI or of additional entries in the EHPLMN list read from the SIM.
`SIM-MNC The MNC part of the IMSI or of additional entries in the EHPLMN list read from the SIM.
`
`
`HPLMN Matching Criteria in mobiles which don’t support PCS1900 for NA:
`Figure A.1 illustrates the logic flow described below. The text below is normative. Figure A.1 is informative.
`(1)
`The MS shall compare using all 3 digits of the SIM-MCC with the BCCH-MCC. If the values do not
`match, then the HPLMN match fails.
`NOTE: If the MCC codes match, then the number of digits used for the SIM-MNC must be the same as the
`number of digits used for the BCCH-MNC.
`(2) The MS shall read the 3rd digit of the BCCH-MNC. If the 3rd digit is Hex F, then proceed to step (4).
`(3) The MS shall compare using all 3 digits of the SIM-MNC with the BCCH-MNC. If the values match, then
`the HPLMN match succeeds, otherwise the HPLMN match fails.
`(4) The MS shall compare using just the 1st 2 digits the SIM-MNC with the BCCH-MNC. If the values match,
`then the HPLMN match succeeds, otherwise the HPLMN match fails.
`This matching procedure shall be done for the MCC/MNC of the IMSI and for all entries in the EHPLMN list, until a
`
`8
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 10 of
` 27
`
`match is found or all matches fail.
`
`1.2 Definitions and abbreviations
`…
`EHPLMN: Any of the PLMN entries contained in the Equivalent HPLMN list.
`Equivalent HPLMN list: To allow provision for multiple HPLMN codes, PLMN codes that are present within this list
`shall replace the HPLMN code derived from the IMSI for PLMN selection purposes. This list is stored on the USIM and
`is known as the EHPLMN list. The EHPLMN list may also contain the HPLMN code derived from the IMSI. If the
`HPLMN code derived from the IMSI is not present in the EHPLMN list then it shall be treated as a Visited PLMN for
`PLMN selection purposes.
`GPP TS 31.102 – V8.11.0:
`4.2.84 EFEHPLMN (Equivalent HPLMN)
`…
`This EF contains the coding for n EHPLMNs. The usage of EHPLMN is defined in TS 23.122 [31]. This data field may
`contain the HPLMN code derived from the IMSI as an EHPLMN entry.
`…
`- EHPLMN
`
`Contents:
` Mobile Country Code (MCC) followed by the Mobile Network Code (MNC)
`-
`
`3GPP TS 22.011 – V8.11.0:
`3.2 Network selection
`3.2.2 Procedures
`3.2.2.1 General
`In the following procedures the UE selects and attempts registration on PLMNs.
`In this TS, the term "PLMN Selection" defines an UE based procedure, whereby candidate PLMNs are chosen, one at
`a time, for
`attempted registration.
`3GPP TS 23.122 – V8.12.0:
`
`when at least one of the
`received MCC and MNC
`pairs matches an entry in
`the HPLMN list, selecting
`and registering with an
`available PLMN that
`matches a HPLMN of the
`HPLMN list; and
`
`9
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 11 of
` 27
`
`Annex A (normative):
`…
`This matching procedure shall be done for the MCC/MNC of the IMSI and for all entries in the EHPLMN list, until a
`match is found or all matches fail.
`
`
`4.4 PLMN selection process
`4.4.3.1.1 Automatic Network Selection Mode Procedure
`
`The MS selects and attempts registration on other PLMN/access technology combinations, if available and allowable,
`in the following order:
`i)
`either the HPLMN (if the EHPLMN list is not present or is empty) or the highest priority EHPLMN that
`is available (if the EHPLMN list is present) ;
`ii)
`each PLMN/access technology combination in the "User Controlled PLMN Selector with Access
`Technology" data file in the SIM (in priority order);
`iii)
`each PLMN/access technology combination in the "Operator Controlled PLMN Selector with Access
`Technology" data file in the SIM (in priority order);
`
`
`3GPP TS 23.122 – V8.12.0:
`Annex A (normative):
`…
`This matching procedure shall be done for the MCC/MNC of the IMSI and for all entries in the EHPLMN list, until a
`match is found or all matches fail.
`
`
`4.4 PLMN selection process
`4.4.3.1.2 Automatic Network Selection Mode Procedure
`
`The MS selects and attempts registration on other PLMN/access technology combinations, if available and allowable,
`in the following order:
`i)
`either the HPLMN (if the EHPLMN list is not present or is empty) or the highest priority EHPLMN that
`
`when none of the
`received MCC and MNC
`pairs matches an entry in
`the HPLMN list, selecting
`and registering with an
`available PLMN that
`corresponds to a
`preferred PLMN of a
`preferred PLMN list of the
`mobile station, the
`preferred PLMN list
`identifying a plurality of
`preferred PLMNs of the
`mobile station; and
`
`10
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 12 of
` 27
`
`is available (if the EHPLMN list is present) ;
`ii)
`each PLMN/access technology combination in the "User Controlled PLMN Selector with Access
`Technology" data file in the SIM (in priority order);
`iii)
`each PLMN/access technology combination in the "Operator Controlled PLMN Selector with Access
`Technology" data file in the SIM (in priority order);
`other PLMN/access technology combinations with received high quality signal in random order;
`iv)
`other PLMN/access technology combinations in order of decreasing signal quality.
`v)
`GPP TS 31.102 – V8.11.0:
`4.2.53 EFOPLMNwACT (Operator controlled PLMN selector with Access Technology)
`
`…This EF contains the coding for n PLMNs where n is determined by the operator. This information is determined by
`the operator and defines the preferred PLMNs in priority order.
`
`PLMN.
`Contents:
`-Mobile Country Code (MCC) followed by the Mobile Network Code (MNC)
`Coding:
`-according to TS 24.008 [9].
`-Access Technology Identifier:
`Coding:
`See EFPLMNwACT for coding
`5.1.1.2 USIM initialization
`[..]
`Afterwards, the ME runs the following procedures if the ME and the USIM support the related services:
`- [..];
`- Operator controlled PLMN selector with Access Technology [...a preferred PLMN list ...] request;
`- [..];
`3GPP TS 22.101 – V8.15.0:
`
`displaying a network
`name corresponding to
`
`11
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 13 of
` 27
`
`the registered PLMN.
`
`US 8472955—Claim 2
`The method of claim 1,
`wherein the HPLMN list
`includes a MCC and MNC
`for each HPLMN identified
`in the HPLMN list.
`
`US 8472955—Claim 3
`The method of claim 2,
`further comprising:
`comparing the received
`MCC and MNC pair of the
`available PLMN with the
`plurality of MCC and MNC
`pairs in the HPLMN list.
`
`A.3 Country/PLMN indication
`The country/PLMN indicator shows in which PLMN the UE is currently registered. This indicator is necessary so that
`the user knows when "roaming" is taking place and that the choice of PLMN is correct. Both the country and PLMN
`will be indicated. When more than one visited PLMN is available in a given area such information will be indicated.
`
`
`3GPP Specifications
`GPP TS 31.102 – V8.11.0:
`4.2.84 EFEHPLMN (Equivalent HPLMN)
`…
`This EF contains the coding for n EHPLMNs. The usage of EHPLMN is defined in TS 23.122 [31]. This data field may
`contain the HPLMN code derived from the IMSI as an EHPLMN entry.
`…
`- EHPLMN
`
`Contents:
`- Mobile Country Code (MCC) followed by the Mobile Network Code (MNC)
`
`3GPP Specifications
`3GPP TS 23.122 – V8.12.0:
`Annex A (normative):
`HPLMN Matching Criteria
`With the introduction of PCS1900 with the regulatory mandate to allocate 3-digit MNC codes, additional functionality
`is required to identify the HPLMN.
`…
`Definitions and abbreviations
`BCCH-MCC The MCC part of the LAI read from System Information type 3 messages broadcast on the BCCH by the
`network.
`BCCH-MNC The MNC part of the LAI read from System Information type 3 messages broadcast on the BCCH by the
`network.
`SIM-MCC The MCC part of the IMSI or of additional entries in the EHPLMN list read from the SIM.
`SIM-MNC The MNC part of the IMSI or of additional entries in the EHPLMN list read from the SIM.
`
`
`12
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 14 of
` 27
`
`HPLMN Matching Criteria in mobiles which don’t support PCS1900 for NA:
`Figure A.1 illustrates the logic flow described below. The text below is normative. Figure A.1 is informative.
`The MS shall compare using all 3 digits of the SIM-MCC with the BCCH-MCC. If the values do not match, then the
`HPLMN match fails.
`NOTE: If the MCC codes match, then the number of digits used for the SIM-MNC must be the same as the number of
`digits used for the BCCH-MNC.
`The MS shall read the 3rd digit of the BCCH-MNC. If the 3rd digit is Hex F, then proceed to step (4).
`The MS shall compare using all 3 digits of the SIM-MNC with the BCCH-MNC. If the values match, then the HPLMN
`match succeeds, otherwise the HPLMN match fails.
`The MS shall compare using just the 1st 2 digits the SIM-MNC with the BCCH-MNC. If the values match, then the
`HPLMN match succeeds, otherwise the HPLMN match fails.
`This matching procedure shall be done for the MCC/MNC of the IMSI and for all entries in the EHPLMN list, until a
`match is found or all matches fail.
`
`
`3GPP Specifications
`
`The mobile station is configured for communications in accordance with at least one of the Global System for Mobile
`Communications (GSM).
`
`3GPP Specifications
`As used herein the accused instrumentality includes a mobile station.
`
`US 8472955—Claim 10
`
`The method of claim 1,
`wherein the mobile
`station is configured for
`communications in
`accordance with at least
`one of Global System for
`Mobile Communications
`(GSM) and General Packet
`Radio Service (GPRS)
`standards, Enhanced Data
`rates for GSM Evolution
`(EDGE) and Universal
`Mobile
`Telecommunications
`System (UMTS).
`US 8472955—Claim 12
`A mobile station,
`comprising:
`
`13
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 15 of
` 27
`
`a wireless transceiver;
`
`As used herein the accused instrumentality includes a wireless transceiver.
`
`As used herein the accused instrumentality includes a display.
`3GPP TS 22.101 – V8.15.0:
`A.3 Country/PLMN indication
`The country/PLMN indicator shows in which PLMN the UE is currently registered. This indicator is necessary so that
`the user knows when "roaming" is taking place and that the choice of PLMN is correct. Both the country and PLMN
`will be indicated. When more than one visited PLMN is available in a given area such information will be indicated.
`
`As used herein the accused instrumentality includes a controller.
`
`3GPP TS 23.122 – V8.12.0:
`1.2 Definitions and abbreviations
`…
`Registration Area:
`…
`The PLMN to which a cell belongs (PLMN identity) is given in the system information transmitted on the BCCH (MCC
`+ MNC part of LAI).
`In a shared network a cell belongs to all PLMNs given in the system information transmitted on the BCCH.
`
`3GPP TS 36.331 – V8.21.0:
`
`[…]
`6.3.4 Mobility control information elements
`[…]
`
`a display;
`
`a controller coupled to the
`wireless transceiver and
`the display;
`the controller being
`configured to:
`
`receive a plurality of
`Mobile Country Code
`(MCC) and
`Mobile Network Code
`(MNC) pairs
`corresponding to a
`plurality of available
`public land mobile
`networks
`(PLMNs) available to the
`mobile station;
`
`14
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 16 of
` 27
`
`–
`PLMN-Identity
`The IE PLMN-Identity identifies a Public Land Mobile Network. Further information regarding how to set the IE are
`specified in TS 23.003 [27].
`
`
`
`3GPP TS 23.122 – V8.12.0:
`4.2 Registration on a PLMN
`…
`An MS successfully registers on a PLMN if:
`a) The MS has found a suitable cell of the PLMN to camp on; and
`
`
`…
`3GPP TS 24.301 – V8.10.0:
`[…]
`8.3
`
`EPS mobility management message
`
`15
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 17 of
` 27
`
`Attach accept
`8.2.1
`8.2.1.1 Message definition
`This message is sent by the network to the UE to indicate that the corresponding attach request has been accepted.
`See table 8.2.1.1.
`
`
`
`
`
`Message type: ATTACH ACCEPT
`Significance: dual
`Direction:
`network to UE
`
`Table 8.2.1.1: ATTACH ACCEPT message content
`
`IEI
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`
`50
`
`13
`
`23
`
`53
`
`17
`
`59
`
`16
`
`
`
`
`
`Information Element
`Protocol discriminator
`
`Security header type
`
`EPS attach result
`
`Spare half octet
`
`T3412 value
`
`TAI list
`
`Type/Reference
`Protocol discriminator
`9.2
`Security header type
`9.3.1
`Attach accept message identity Message type
`9.8
`EPS attach result
`9.9.3.10
`Spare half octet
`9.9.2.9
`GPRS timer
`9.9.3.16
`Tracking area identity list
`9.9.3.33
`ESM message container
`9.9.3.15
`EPS mobile identity
`9.9.3.12
`Location area identification
`9.9.2.2
`Mobile identity
`9.9.2.3
`EMM cause
`9.9.3.9
`GPRS timer
`9.9.3.16
`GPRS timer
`9.9.3.16
`
`ESM message container
`
`GUTI
`
`Location area identification
`
`MS identity
`
`EMM cause
`
`T3402 value
`
`T3423 value
`
`Presence
`M
`
`Format Length
`V
`1/2
`
`M
`
`M
`
`M
`
`M
`
`M
`
`M
`
`M
`
`O
`
`O
`
`O
`
`O
`
`O
`
`O
`
`V
`
`V
`
`V
`
`V
`
`V
`
`LV
`
`LV-E
`
`TLV
`
`TLV
`
`TLV
`
`TLV
`
`TLV
`
`TLV
`
`1/2
`
`1
`
`1/2
`
`1/2
`
`1
`
`7-97
`
`2-n
`
`13
`
`6
`
`7-10
`
`2
`
`2
`
`2
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 18 of
` 27
`
`4A
`
`34
`
`64
`
`F-
`
`Equivalent PLMNs
`
`Emergency number list
`
`EPS network feature support
`
`Additional update result
`
`PLMN list
`9.9.2.8
`Emergency number list
`9.9.3.37
`EPS network feature support
`9.9.3.12A
`Additional update result
`9.9.3.0A
`
`O
`
`O
`
`O
`
`O
`
`TLV
`
`TLV
`
`TLV
`
`TLV
`
`5-47
`
`5-50
`
`3
`
`1
`
`
`[…]
`
`Tracking area identity
`9.9.3.32
`The purpose of the Tracking area identity information element is to provide an unambiguous identification of
`tracking areas within the area covered by the 3GPP system.
`The Tracking area identity information element is coded as shown in figure 9.9.3.32.1 and table 9.9.3.32.1.
`The Tracking area identity is a type 3 information element with a length of 6 octets.
`8
`7
`6
`5
`4
`3
`2
`1
`octet 1
`Tracking area identity IEI
`octet 2
`MCC digit 1
`octet 3
`MCC digit 3
`octet 4
`MNC digit 1
`octet 5
`TAC
`octet 6
`TAC (continued)
`Figure 9.9.3.32.1: Tracking area identity information element
`[…]
`Tracking area identity list
`9.9.3.33
`The purpose of the Tracking area identity list information element is to transfer a list of tracking areas from the
`network to the UE.
`The coding of the information element allows combining different types of lists. The lists of type "000" and "001"
`
`MCC digit 2
`MNC digit 3
`MNC digit 2
`
`17
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 19 of
` 27
`
`allow a more compact encoding, when the different TAIs are sharing the PLMN identity.
`The Tracking area identity list information element is coded as shown in figure 9.9.3.33.1, figure 9.9.3.33.2, figure
`9.9.3.33.3, figure 9.9.3.33.4 and table 9.9.3.33.1.
`The Tracking area identity list is a type 4 information element, with a minimum length of 8 octets and a maximum
`length of 98 octets. The list can contain a maximum of 16 different tracking area identities.
`
`
`3GPP TS 23.122 – V8.12.0:
`4.4.3.1.1 Automatic Network Selection Mode Procedure
`The MS selects and attempts registration on other PLMN/access technology combinations, if available and allowable,
`in the following order:
`i) [..];
`iv) other PLMN/access technology combinations with received high quality signal in random order;
`v) other PLMN/access technology combinations in order of decreasing signal quality.
`
`18
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 20 of
` 27
`
`3GPP TS 36.331 – V8.21.0:
`
`7
`Protocol data units, formats and parameters (tabular & ASN.1)
`7.1
`General
`The contents of each RRC message is specified in sub-clause 6.2 using ASN.1 to specify the message syntax and using
`tables when needed to provide further detailed information about the information elements specified in the
`message syntax. The syntax of the information elements that are defined as stand-alone abstract types is further
`specified in a similar manner in sub-clause 6.3.
`[…]
`
`
`SystemInformationBlockType1
`SystemInformationBlockType1 contains information relevant when evaluating if a UE is allowed to access a cell and
`defines the scheduling of other system information.
`
`
`
`
`
`
`
`
`
`19
`
`
`
`
`
`Signalling radio bearer: N/A
`RLC-SAP: TM
`Logical channel: BCCH
`Direction: E-UTRAN to UE
`
`SystemInformationBlockType1 message
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 21 of
` 27
`
`
`
`20
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 22 of
` 27
`
`perform a matching
`procedure which includes
`comparing a received
`MCC and MNC pair of an
`available PLMN with an
`entry in a home PLMN
`(HPLMN) list of the mobile
`station, the HPLMN list
`identifying a plurality of
`HPLMNs of the mobile
`station which are
`equivalent to a home
`PLMN of the mobile
`station, the matching
`procedure being done
`until a match is found or
`all matches fail;
`
`3GPP TS 23.122 – V8.12.0:
`Annex A (normative):
`HPLMN Matching Criteria
`With the introduction of PCS1900 with the regulatory mandate to allocate 3-digit MNC codes, additional functionality
`is required to identify the HPLMN.
`…
`Definitions and abbreviations
`BCCH-MCC The MCC part of the LAI read from System Information type 3 messages broadcast on the BCCH
`by the network.
`BCCH-MNC The MNC part of the LAI read from System Information type 3 messages broadcast on the BCCH
`by the network.
`SIM-MCC The MCC part of the IMSI or of additional entries in the EHPLMN list read from the SIM.
`SIM-MNC The MNC part of the IMSI or of additional entries in the EHPLMN list read from the SIM.
`
`
`HPLMN Matching Criteria in mobiles which don’t support PCS1900 for NA:
`Figure A.1 illustrates the logic flow described below. The text below is normative. Figure A.1 is informative.
`(5) The MS shall compare using all 3 digits of the SIM-MCC with the BCCH-MCC. If the values do not match,
`then the HPLMN match fails.
`NOTE: If the MCC codes match, then the number of digits used for the SIM-MNC must be the same as the
`number of digits used for the BCCH-MNC.
`(6) The MS shall read the 3rd digit of the BCCH-MNC. If the 3rd digit is Hex F, then proceed to step (4).
`(7) The MS shall compare using all 3 digits of the SIM-MNC with the BCCH-MNC. If the values match, then
`the HPLMN match succeeds, otherwise the HPLMN match fails.
`(8) The MS shall compare using just the 1st 2 digits the SIM-MNC with the BCCH-MNC. If the values match,
`then the HPLMN match succeeds, otherwise the HPLMN match fails.
`This matching procedure shall be done for the MCC/MNC of the IMSI and for all entries in the EHPLMN list, until a
`
`21
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 23 of
` 27
`
`match is found or all matches fail.
`1.2 Definitions and abbreviations
`…
`EHPLMN: Any of the PLMN entries contained in the Equivalent HPLMN list.
`Equivalent HPLMN list: To allow provision for multiple HPLMN codes, PLMN codes that are present within this list
`shall replace the HPLMN code derived from the IMSI for PLMN selection purposes. This list is stored on the USIM and
`is known as the EHPLMN list. The EHPLMN list may also contain the HPLMN code derived from the IMSI. If the
`HPLMN code derived from the IMSI is not present in the EHPLMN list then it shall be treated as a Visited PLMN for
`PLMN selection purposes.
`GPP TS 31.102 – V8.11.0:
`4.2.84 EFEHPLMN (Equivalent HPLMN)
`…
`This EF contains the coding for n EHPLMNs. The usage of EHPLMN is defined in TS 23.122 [31]. This data field may
`contain the HPLMN code derived from the IMSI as an EHPLMN entry.
`…
`- EHPLMN
`
`Contents:
` Mobile Country Code (MCC) followed by the Mobile Network Code (MNC)
`-
`
`3GPP TS 22.011 – V8.11.0:
`3.2 Network selection
`3.2.2 Procedures
`3.2.2.1 General
`In the following procedures the UE selects and attempts registration on PLMNs.
`In this TS, the term "PLMN Selection" defines an UE based procedure, whereby candidate PLMNs are chosen, one at
`a time, for
`attempted registration.
`3GPP TS 23.122 – V8.12.0:
`Annex A (normative):
`
`when at least one of the
`received MCC and MNC
`pairs matches an entry in
`the HPLMN list, select and
`register with an available
`PLMN that matches a
`HPLMN of the HPLMN list;
`and
`
`22
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 24 of
` 27
`
`…
`This matching procedure shall be done for the MCC/MNC of the IMSI and for all entries in the EHPLMN list, until a
`match is found or all matches fail.
`
`
`4.4 PLMN selection process
`4.4.3.1.3 Automatic Network Selection Mode Procedure
`
`The MS selects and attempts registration on other PLMN/access technology combinations, if available and allowable,
`in the following order:
`i)
`either the HPLMN (if the EHPLMN list is not present or is empty) or the highest priority EHPLMN that
`is available (if the EHPLMN list is present) ;
`ii)
`each PLMN/access technology combination in the "User Controlled PLMN Selector with Access
`Technology" data file in the SIM (in priority order);
`iii)
`each PLMN/access technology combination in the "Operator Controlled PLMN Selector with Access
`Technology" data file in the SIM (in priority order);
`
`
`3GPP TS 23.122 – V8.12.0:
`Annex A (normative):
`…
`This matching procedure shall be done for the MCC/MNC of the IMSI and for all entries in the EHPLMN list, until a
`match is found or all matches fail.
`
`
`4.4 PLMN selection process
`4.4.3.1.4 Automatic Network Selection Mode Procedure
`
`The MS selects and attempts registration on other PLMN/access technology combinations, if available and allowable,
`in the following order:
`i)
`either the HPLMN (if the EHPLMN list is not present or is empty) or the highest priority EHPLMN that
`
`when none of the
`received MCC and MNC
`pairs matches an entry in
`the HPLMN list, select and
`register with an available
`PLMN that corresponds to
`a preferred PLMN of a
`preferred PLMN list of the
`mobile station, the
`preferred PLMN list
`identifying a plurality of
`preferred PLMNs of the
`mobile station; and
`
`23
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 25 of
` 27
`
`is available (if the EHPLMN list is present) ;
`ii)
`each PLMN/access technology combination in the "User Controlled PLMN Selector with Access
`Technology" data file in the SIM (in priority order);
`iii)
`each PLMN/access technology combination in the "Operator Controlled PLMN Selector with Access
`Technology" data file in the SIM (in priority order);
`other PLMN/access technology combinations with received high quality signal in random order;
`iv)
`other PLMN/access technology combinations in order of decreasing signal quality.
`v)
`GPP TS 31.102 – V8.11.0:
`4.2.53 EFOPLMNwACT (Operator controlled PLMN selector with Access Technology)
`
`…This EF contains the coding for n PLMNs where n is determined by the operator. This information is determined by
`the operator and defines the preferred PLMNs in priority order.
`
`PLMN.
`Contents:
`-Mobile Country Code (MCC) followed by the Mobile Network Code (MNC)
`Coding:
`-according to TS 24.008 [9].
`-Access Technology Identifier:
`Coding:
`See EFPLMNwACT for coding
`5.1.1.2 USIM initialization
`[..]
`Afterwards, the ME runs the following procedures if the ME and the USIM support the related services:
`- [..];
`- Operator controlled PLMN selector with Access Technology [...a preferred PLMN list ...] request;
`- [..];
`
`24
`
`
`
`
`
`

`

`Case 1:20-cv-20813-RNS Document 34-25 Entered on FLSD Docket 03/25/2020 Page 26 of
` 27
`
`display a network name
`corresponding to the
`registered PLMN.
`
`US 8472955—Claim 13
`The mobile station of
`claim 12, wherein the
`HPLMN list includes a
`MCC and MNC for each
`HPLMN identified in the
`HPLMN list.
`
`US 8472955—Claim 14
`The mobile station of
`claim 13, the controller
`being further configured
`to:
`
`compare a received MCC
`and MNC pair of an
`available PLMN with one
`or more of the plurality of
`MCC and MNC pairs in the
`HPLMN list.
`
`25
`
`
`
`
`
`3GPP TS 22.101 – V8.15.0:
`A.3 Country/PLMN indication
`The country/PLMN indicator shows in which PLMN the UE is currently registered. This indicator is necessary so that
`the user knows when "roaming" is taking place and that the choice of PLMN is correct. Both the country and PLMN
`will be indic