(12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT)
`
`(19) World Intellectual Property Organization
`International B ureau
`
` ||l||l||l||||l||||||1|lllllllll||||||||l|||l|||l||||ll|lll||||||||||||||||||||l|
`
`(l0) International Publication Number
`(43) International Publication Date
`7 June 2001 (07.06.2001)
`PCT
`WO 01/41471 A1
`
`
`(51) International Patent Classification":
`
`H04Q 72’20
`
`(21) International Application N umber:
`
`PCTIGBOOKMSTU
`
`(22) International Filing Date:
`30 November 2000 (30.! 1.2000)
`
`FISCHER, Graham [GBIGB I: Orange Personal Commu-
`nications Services Limited. St. James Court. Great Park
`
`Road. Almondsbury Park. Bradley Stoke. Bristol BS 1 240]
`(GB). SHIITT. Stuart [GBt’GBI: Orange Personal Com-
`munications Services Limited. St. James Court. Great Park
`Road. Almondsbury Park. Bradley Stoke. Bristol 3512 4Q]
`(GB).
`
`(25) Filing Language:
`
`(26) Publication Language:
`
`English
`
`English
`
`(74) Agents: SPAARGAREN, Jerome ct 3L: R.G.C. Jenkins
`8:, Co.. 26 Caxton Street. London SW 1H 0R] (GB).
`
`(30) Priority Data:
`99285223
`
`2 December 1999612121999)
`
`GB
`
`(71) Applicant 6‘0)- at’l designated States except US): 012-
`ANGE PERSONAL COMMUNICATIONS SER-
`VICES LIMITED [GBIGB]; St. James Court. Great Park
`Road. Almondsbury Park. Bradley Stoke, Bristol BSIZ
`4Q] (GB).
`
`(72)
`(75)
`
`Inventors: and
`lnvcntorstApplicants 0'0:- US only): BAILEY, Richard,
`James [GBIGB]: Orange Personal Communications Ser-
`vices Limited. St.
`James Court, Great Park Road. Al—
`mondsbury Park. Bradley Stoke. Bristol B812 40] (GB).
`
`(81} Designated States (notional): AE. AG, AL. AM. AT. AT
`(utility model). AU. AZ. BA, BB. BG. BR. BY. BZ. CA.
`CH. CN. CR, CU. C2. C2 (utility model). DE. DE (utility
`model), DK, DK (utility model). DM. DZ, EE. EE (utility
`model), ES. FI, Fl {utility model), GB. GD, GE. GH. GM,
`HR. HU. ID, IL. IN. IS, JP. KE. KG. KP. KR. KZ. LC. LK.
`LR. LS. LT. LU. LY. MA. MD. MG, MK. MN. MW. MX,
`M2. NO. NZ. PL. PT. RC), RU, SD, SE. SG. 51. SK. SK
`(utility model). SL, TJ. TM. TR.’I'I‘. TZ, UA. UG. US. UZ.
`VN, YU. ZA. 2W.
`
`(34)
`
`Designated States (regionafl: ARIPO patent (GI-I, GM,
`KE, LS. MW. MZ. SD. SL, 32. TZ. UG. ZW). Eurasian
`patent (AM, AZ. BY. KG. KZ. MD. RU. TJ. TM), European
`
`[Continued on next page}
`
`
`(54) Title: SUBSCRIBER EQUIPMENT AND METHOD FOR A MOBILE COMMUNICATIONS SYSTEM
`
`
`
`llI|||||llll|l|||||||||l|l|||l||ll||l|||||||l||l|||||||||||||l|||||l|||||||||||l
`
`1A1
`
`r“ (57) Abstract: A subscriber equipment set for use in a mobile communications system including a mobile communications net—
`work and a plurality of mobile stations. said network having a plurality of radio Lransceiving stations whereby said mobile stations
`3 receive radio communications service from said network, said set including a firs station and a second station, wherein the first sta-
`"--.. tion comprises a first radio transceiver, memory means for storing first subscription data and means for registering with the mobile
`H communications network. to receive radio communications service from a radio transceiving station therein. by use of the first sub—
`scription data. wherein the second station comprises a second radio transceiver, memory means for storing second subscription data
`and means for registering with the mobile communications network. to receive radio communications service from a radio transceiv-
`g ing station therein. by use of the second subscription data. and wherein the first station is connectable to the second station to receive
`service in the mobile communication System via the second station.
`
`
`
`PETITIONERS 1065-0001
`
`|PR2016—OO758
`
`
`
`PETITIONERS 1065-0001
`IPR2016-00758
`
`

`

`Published:
`--
`With internationm’ search report.
`
`* Before the expiration of the time tt'mt't for amending the
`datum and m be republished tn the event of receipt of
`amendments.
`
`For two-letter codes and other abbreviations. refer to the "Guid-
`ance Notes on Codes and Abbreviations " appearing at the begin-
`
`W0 01/4147] A]
`
`HIIIIIIIIIIHIIIIIH||1I|||l||||||||l|l||||l|||l||l|||1|||\|\l||l|||||l|||1l||
`
`palcm (AT. BE. CH. CY. DE. DK. ES. Fl. FR. GB. GR, IE.
`IT. LU. MC. NL. PT. SE, TR), GAP] palcnl (813.3]. CF.
`CG, CI. CM. GA. GN GW. ML. MR. NE. SN. TD. TG).
`
`ning ofeach regattar issue ofth PCT Gazette.
`
`PETITIONERS 1065-0002
`IPR2016-00758
`
`

`

`WO 01141471
`
`PCTIGBflflifl-fi‘m
`
`SUBSCRIBER EQUIPMENT AND METHOD FOR A MOBILE COMMUNICATIONS SYSTEM
`
`Draft GSM Technical Specifications 03.52 (“Lower Layers of the CTS Radio
`
`Global System for Mobile Communications (GSM) and Digital European
`
`This
`
`invention relates
`
`to
`
`subscriber
`
`equipment
`
`for
`
`a mobile
`
`communications syStem, a mobile communications network and a method of
`
`controlling services in a mobile communications network.
`
`Subscriber equipment referred to as a “home base station“ is known.
`
`The home base station is installed inside a building, for example the home of
`
`the subscriber owning a mobile station. for providing a cordless telephony link
`
`to the mobile station when the mobile station is within its coverage area. The
`
`home base station is connected. via a fixed line connection,
`
`to a public
`
`services telephone network (PSTN). When outside the service area of the
`
`home base station,
`
`the mobile station receives service in a cellular mobile
`
`communications network. via a cellular radio interface.
`
`Cordless Telephone (DECT) mobile station has been proposed for use with a
`
`DECT cordless basc station. A further pmposal is undergoing standardisation
`
`at the European Telecommunications Standard Institute, and is the subject ofa
`
`project entitled “GSM Cordless Telephony System (CTS)”, as detailed in
`
`PETITIONERS 1065-0003
`IPR2016-00758
`
`

`

`W0 01f4147l
`
`PCT/G300/04570
`
`2
`
`Interface“) and 03.56 (“CTS Architecture Description") and GSM Technical
`
`Specification 03.20. Annex E (“Security Related Network Functions”).
`
`Home base stations are considered to be desirable,
`
`since it
`
`is
`
`sometimes the case that cellular radio network coverage does not extend
`
`sufficientiy within in-building environments. By providing a cordless radio
`
`communications link within the home of the subscriber, the coverage of the
`
`cellular network can be supplemented. Furthermore, the subscriber is able to
`
`use a single mobile station for two-way communications outside the home via
`
`the cellular radio network. and for two-way communications inside the home
`
`via a PSTN connection.
`
`However, there remain drawbacks to the home base stations proposed
`
`in the past.
`
`Firstly, a subscriber must maintain two separate telephony
`
`subscriptions; one subscription to the cellular radio network and a second
`
`subscription to the PSTN. Furthermore, the range of telecommunications
`
`services which are supported by a cellular communications network is
`
`generally different, and often greater, than that supported by a PSTN. Such
`
`system including a mobile communications network and a plurality of mobile
`
`services are, for example, the short message service (SMS) supported by, inter
`
`alia. the GSM system.
`
`In future, with third generation mobile radio systems.
`
`the range of services supported is to increase,
`
`thereby exacerbating the
`
`problem.
`
`In accordance with one aspect of the preSent
`
`invention there is
`
`provided a subscriber equipment set for use in a mobile communications
`
`PETITIONERS 1065-0004
`IPR2016-00758
`
`

`

`W0 Oll41471
`
`PCTIGBDOI04570
`
`3
`
`stations, said network having a plurality of radio transceiving stations whereby
`
`station and the first station allows the first station when inside the building to
`
`said mobile stations receive radio communications service from said network,
`
`said set including a first station and a second station.
`
`wherein the first station comprises a first radio transceiVer. memory
`
`means for storing first subscription data and means for registering with the
`
`mobile communications network,
`
`to receive radio communications service
`
`from a radio transceiving station therein. by use of the first subscription data,
`
`wherein the second station comprises a second radio transceiver.
`
`memory means for storing second subscription data and means for registering
`
`with the mobile communications network. to receive radio communications
`
`service from a radio transceiving station therein, by use of the second
`
`subscription data. and
`
`wherein the first station is connectable to the second station to receive
`
`service in the mobile communications system via the second station.
`
`The second station is able to receive radio communications service in a
`
`mobile communications network, whereby the first station is able to receive
`
`service. via the second station. from the mobile communications network.
`
`The second station itself carries voice or other data traffic via a radio link set
`
`up betvveen the second station and the mobile communications network.
`
`The second station may be located. fixedly, inside a building, such as
`
`inside the roof space of the building. or to the exterior of the building, where
`
`mobile network coverage is available. The connection between the second
`
`PETITIONERS 1065-0005
`IPR2016-00758
`
`

`

`receive service which may not be available through a direct radio link with the
`
`mobile communications network in the location of the first station.
`
`By providing that the second station itself stores subscription data to
`
`allow the radio transceiving apparatus to independently register for service
`
`with the mobile communications system, the second station is enabled with
`
`the capability of independently performing communications with the mobile
`
`communications system. For example, such communications may consist of
`
`the exchange of control messages necessary for the servicing of a first station
`
`via the second station. Such control messages may, for example.
`
`include
`
`instructions from the mobile communications network as to a set of one or
`
`more frequencies. within the frequency band or bands allocated to the mobile
`
`communications system for radio communications. at which the second
`
`station is authorised to conduct radio communications with a first station.
`
`A radio interface used between the first station and the second station
`
`may be identical with, or a modified version of, a cellular radio interface
`
`already used by a mobile station for direct radio communications via mobile
`
`communications system. whilst interference caused by the second station is
`
`minimised
`
`by
`
`a
`
`frequency re-use
`
`plan
`
`controlled by
`
`the mobile
`
`the sending of control messages directly via the radio link between the mobile
`
`communications network and the second station itself.
`
`The
`
`control messages may
`
`also include messages
`
`used for
`
`W0 01I4147l
`
`PCTIGBOWMSTO
`
`4
`
`authentication of a first station wishing to register for service via the second
`
`communications network. The frequency re—use plan may be implemented by
`
`PETITIONERS 1065-0006
`IPR2016-00758
`
`

`

`W0 01141471
`
`PCTIGBOOIMSW
`
`5
`
`station. The second station may pass authentication challenges from the
`
`mobile communications network to the first station and authentication
`
`responses generated in
`
`the
`
`first
`
`station to the network.
`
`and receive
`
`continuation of the authentication of the first station from the mobile network
`
`to judge whether the first station should receive service from it.
`
`Since the second station stores subscription data, and has the capability
`
`to authenticate with the mobile communications network itself, a secure
`
`encrypted communications session between the second station and the mobile
`
`communications network becomes possible. Once the second station has
`
`itself authenticated, by use of the subscription data it stores, with the mobile
`
`communications network,
`
`secure data,
`
`for example authenticating data
`
`allowing the radio transceiving apparatus to authenticate a first station
`
`directly, may be transmitted via an encrypted communications link from the
`
`mobile communications network to the radio transceiving apparatus to be
`
`The radio interface technology already used for the radio interface over which
`
`stored securely thereon. The second station may include a secure storage
`
`module, such as a subscriber identity module (SIM), on which such secure
`
`data may be stored along with the subscription data for the second station
`
`itself.
`
`Furthermore, by allowing the second station to itself register with the
`
`mobiie communications network.
`
`the radio interface between the second
`
`station and the mobile communications network may be the same as that used
`
`between standard mobile stations and the mobile communications neIWork.
`
`PETITIONERS 1065-0007
`IPR2016-00758
`
`

`

`W0 01.031471
`
`PC TIGBIJOIMS'IO
`
`6
`
`the mobile stations in the network receive service may thus be re-used for the
`
`radio interface between the second station and the mobile communications
`
`system. One or more of a range of services supported by that standard radio
`
`interface. and also the standard mobile stations, may thus be provided by
`
`communications via the radio transceiving apparatus.
`
`According to a further aspect of the invention there is provided a
`
`method of controlling services in a mobile communications system including
`
`subscriber station comprising a radio interface for communicating with a
`
`a mobile communications network having a piurality of network entities
`
`providing services to a plurality of radio stations which include mobiie
`
`stations, said method comprising:
`
`providing a radio station having a radio communications interface.
`
`means for storing subscription data whereby said radio station is to register for
`
`service with said communications network via said radio communications
`
`interface, and a local communications interface for communicating with one
`
`or more external devices.
`
`allowing an external device to register with said radio Station,
`
`storing service data in a network entity indicating that said external
`
`device is- registered with said radio station. to allow said network entity to
`
`provide service to said external device via said radio station.
`
`The network entity may thus communicate, or control communications
`
`with, the external device via the radio station.
`
`According to a further aspect of the invention there is provided a
`
`PETITIONERS 1065-0008
`IPR2016-00758
`
`

`

`W0 01f4147l
`
`PCT/(3300104570
`
`7
`
`mobile communications network, a local device interface for communicating
`
`with one or more local devices. and a portable storage module arranged to
`
`hold authentication data for authenticating said one or more local devices.
`
`A portable storage module may thus be used to securely store the
`
`authentication data for a local device in the subscriber station.
`
`According to a further aspect of the invention there is provided a
`
`subscn'ber station comprising a radio interface for communicating with a
`
`mobile
`
`communications
`
`network
`
`and
`
`a
`
`local
`
`device
`
`interface
`
`for
`
`communicating with one or more local devices, wherein said subscriber
`
`station is adapted to intermediate between said mobile communications
`
`network and said one or more local devices in a process or processes whereby
`
`said one or more local devices are authenticated in said network.
`
`Authentication of a local device may thus be performed in the mobile
`
`communications network.
`
`the—air to the subscriber station.
`
`local to a subscriber station, whereby said subscriber station is made capable
`
`According to a further aspect of the invention there is provided a
`
`mobile communications network adapted to transmit authentication data to a
`
`subscriber station communicating with said mobile communications network
`
`via a radio interface, said authentication data being for one or more devices
`
`of authenticating said one or more devices.
`
`Authentication data for a local device may thus be transmitted over-
`
`PETITIONERS 1065-0009
`IPR2016-00758
`
`

`

`W0 01f41471
`
`PCTIGBOOI'MS'J'B
`
`8
`
`According to a further aspect of the invention there is pr0vided a
`
`mobile communications network adapted to communicate with a subscriber
`
`station which is authenticated with the network, and to conduct authentication
`
`of one or more devices local to said subscriber station, by transmission of
`
`control messages over a radio interface between said network and said
`
`subscriber station.
`
`Authentication of a local device may thus be performed in the mobile
`
`communications network.
`
`According to a further aspect of the invention there is provided a fixed
`
`station for use in a cellular communications system including a cellular
`
`communications means, and in response thereto selectively communicating
`
`communications network and a plurality of mobile stations, said fixed station
`
`comprising:
`
`memory means for storing subscription data;
`
`radio communications means whereby the fixed station is capable of
`
`registering
`
`for
`
`radio
`
`communications
`
`service
`
`from the
`
`cellular
`
`communications network;
`
`local communications means for forming communications links with a
`
`plurality of home appliances; and
`
`interworking means operating between the radio communications
`
`means
`
`and the
`
`local communications means
`
`for detecting incoming
`
`communications from the cellular communications network via said radio
`
`PETITIONERS 1065-0010
`IPR2016-00758
`
`

`

`W0 01Ml471
`
`PCTIGBOOM4570
`
`9
`
`with one of said plurality oi home appliances via said local communications
`
`radio network illustrated in Figure l; and
`
`means.
`
`Control of andfor reading of data from individual home appliances
`
`may thus be performed via the fixed station and the cellular communications
`
`system.
`
`According to a further aspect of the invention there is provided a home
`
`base
`
`station
`
`including means
`
`for
`
`registering
`
`and
`
`receiving
`
`radio
`
`communications service in a mobile communications system.
`
`A fixed line link is thus not required for the receipt of service via the
`
`home base station, whilst if the home base station is correctly positioned. the
`
`home base station can provide service not otherwise available to a mobile
`
`station capable of Operating in the mobile communications system.
`
`Further features and advantages of the present invention will become
`
`apparent with reference to the following description of preferred embodiments
`
`of the invention, made with reference to the accompanying drawings:
`
`Figure l
`
`is a schematic illustration of a cellular radio neIWork
`
`arrangement in accordance with an embodiment of the present invention;
`
`Figure 2 is a schematic illustration of a standard mobile station used in
`
`the cellular radio network illustrated in Figure 1;
`
`Figure 3
`
`shows
`
`a
`
`schematic
`
`illustration of
`
`radio transceiving
`
`apparatus, used in the cellular radio network of Figure 1;
`
`Figure 4 shows a mobile stationfcordiess station used in the cellular
`
`PETITIONERS 1065-0011
`IPR2016-00758
`
`

`

`Figure 5 shows a home appliance/cordless station used in the cellular
`
`radio network illustrated in Figure l.
`
`A cellular radio network, also referred to as a public land mobile
`
`network [PLMN). in accordance with an embodiment of the present invention,
`
`is schematically illustrated in Figure I.
`
`In this embodiment the PLMN is a GSM network. A mobile switching
`
`centre (MSC) 2 is connected via communication links to a base station
`
`geographically across areas served by the mobile switching centre 2. The
`
`BSC 4 controls a plurality of public radio transceiving stations 6, referred to
`
`as base transceiver stations (BTSs), located remote from. and connected by
`
`further communication links to, the BSC 4. The BTS 6 transmits radio signals
`
`to, and receives radio signals from. cellular mobile stations 8 which are in an
`
`area served by that BTS. That area is referred to as a “cell”. A PLMN is
`
`provided with a large number of such cells, which are ideally contiguous to
`
`provide continuous coverage over the whole network territory. The radio
`
`signals are transmitted via a standard radio interface 9, having a cellular
`
`protocol, which is standardised both at the physical layer level and the logical
`
`layer level.
`
`The mobile switching centre 2 is also connected via communications
`
`links to other mobile switching centres in the remainder of the PLMN, and to
`
`other networks such as a public service telephone network (PSTN) 10, which
`
`W0 Ill/41471
`
`PCTlGBflll/M570
`
`10
`
`controller (BSC) 4. The BSC 4 is one of a number of BSCs dispersed
`
`provides service to fixed line terminals. such as a fixed telephone (FT) ll.
`
`PETITIONERS 1065-0012
`IPR2016-00758
`
`

`

`W0 01l41471
`
`PCTIGBIIIIIMS‘N
`
`11
`
`The mobile switching centre 2 is connected via a signalling link to a
`
`home location register (HLR) 12 which is a database permanently storing
`
`subscriber data for subscriptions with the PLMN.
`
`including.
`
`for each
`
`subscription.
`
`the international mobile subscriber identity {EMSI}, which is
`
`unique to each mobile station in the GSM system and service data associated
`
`with the subscription. The HLR I2 is connected via a signalling link to an
`
`authentication centre (AuC) 13. which securely stores an authentication key
`
`(Ki) against each IMSI, and provides authentication functions to the PLMN.
`
`The [M81 and the Ki for a subscription are also securely stored along with
`
`other subscription specific information in the mobile station in a subscriber
`
`identity module (SIM) (to be described below), also referred to as a smart
`
`card. The SIM is removable such that the stored data is portable betWeen
`
`mobile stations.
`
`22 and a microphone 24. a digital processor 26 and its associated memory 28
`
`transceiver 18, a voice coder/decoder (codec) 20 connected to a loudspeaker
`
`The mobile Switching centre is connected to, or combined with, a
`
`visitor location register (VLR), not shown. which is a database temporarily
`
`storing subscriber data for mobile stations registered for service in its area.
`
`In addition, the MSC 2 and each BSC 4 are connected via signalling
`
`links to a cordless telephone service node (CSN) 14, to be described in further
`
`detail below.
`
`Referring now to Figure 2. a standard, knewn cellular mobile station 8
`
`used in the PLMN comprises a transmitlreceive aerial 16, a radio frequency
`
`PETITIONERS 1065-0013
`IPR2016-00758
`
`

`

`WO 01141471
`
`PCTIGBOIJIO4S70
`
`12
`
`(which includes ROM storing the operating system of the mobile Station), a
`
`display 30 and a manual input port (cg. a keypad) 32. The mobile station is
`
`connected to a removable SIM 34 via electrical contacts 35.
`
`The SIM 34- connected to the mobile station is a standard component
`
`of the PLMN system, and may be inserted in any similarly standardised
`
`mobile station. The SIM 34 includes a digital processor 36 and SIM memory
`
`station 8 is granted service in the PLMN and is issued with a temporary
`
`38, which includes for example mask-programmed ROM containing the SIM
`
`operating system,
`
`read/write EEPROM for
`
`the non—volatile
`
`storage of
`
`subscriber data and RAM for use by the SIM processor 36 during operations.
`
`The SIM is issued to a subscriber on taking out a subscription with the
`
`PLMN. The SIM 34 is used for authentication functions and the storage and
`
`retrieval of data items by the processor 26 of the mobile station 8. The
`
`command set, data file
`
`structure
`
`and data coding format
`
`for data
`
`communicated via the interface between the mobile station processor 26 and
`
`the SIM processor 36 are all standardised (see for example GSM technical
`
`specification 11.1 1).
`
`As far as authentication is concerned, the SIM 34 stores an encryption
`
`algorithm (A3), and the subscriber’s authentication key (Ki), which it applies
`
`to a random challenge issued by the PLMN and passed to it by the mobile
`
`station 8. in order to generate a response. The response should be verifiany
`
`related to that computed in the AuC 13 of the PLMN,
`
`in order for
`
`authentication to be successful. Once authentication is complete, the mobile
`
`PETITIONERS 1065-0014
`IPR2016-00758
`
`

`

`W0 01141471
`
`PCTIGBUWMS'IO
`
`13
`
`identity (TIMSI) whereby the mobile station 8 is identified (for example in
`
`transformer whereby the FP 40 may be powered directly from an
`
`paging messages broadcast
`
`in the PLMN] during the subsequent access
`
`session.
`
`Referring now to Figure 3, a home base station. referred to herein as a
`
`fixed part (FP) 40 forms part of the mobile communications system in this
`
`embodiment of the invention. The FP 40 is capable of communicating via a
`
`standard PLMN radio interface 9 with a BTS 6 of the PLMN. The PF 40 is
`
`also capable of communicating via a cordless radio interface 41 with a mobile
`
`Station/cordless station (MSJCS) 42 and a home appliance/Cordless station
`
`(HA/CS) 43, to be described in further detail below.
`
`The FP 40 comprises a cellular radio transmitlreceive aerial 44, a
`
`cellular
`
`radio frequency transceiver 46, a digital processor 48 and its
`
`associated memory 50 (which includes ROM storing the operating sysrem of
`
`the FP 40), whereby the FP 40 interfaces with the PLMN.
`
`The FP
`
`communicates with the BT53 6 of the PLMN directly using the standard radio
`
`interface 9 of the PLMN.
`
`The PF 40 also includes a cordless radio
`
`transmitfreceive aerial 62 and a cordless radio frequency transceiver 60 which
`
`is controlled by the digital processor 43 of the F? 40. These components
`
`provide a two-way radio link via the cordless radio interface 41. The cordless
`
`radio interface may be a modified version of the GSM radio interface, such as
`
`that described in Draft GSM 03.52 as referred to above.
`
`As the PF 40 is designed to be fixedly sited, the FP 40 includes an in—
`
`built
`
`PETITIONERS 1065-0015
`IPR2016-00758
`
`

`

`W0 011'41471
`
`PCT/GBflflr'045‘70
`
`l4
`
`electrical mains supply. and no battery power pack is required. The FF 40
`
`includes a power lead (not shown) which includes a plug adapted to be
`
`connected to a socket of the electrical mains supply, whereby the FF 40 has a
`
`permanent source of power when fixedly sited for operational use.
`
`In order to
`
`provide functionality for subscribers having no PLMN coverage, even at
`
`rooftop level, the F? 40 may also include a fixed line interface (not sh0wn) for
`
`performing voice and/or data communications via a fixed line network (cg. a
`
`subscriber data and RAM for use by the SIM processor 56 during operations.
`
`PSTN). for example a digital subscriber line (DSL) interface to provide high
`
`speed data communications via the fixed line network. The FF 40 may also
`
`include a satellite transceiver {not shown), whereby higher data rates are made
`
`available for services such as (near) video on demand, video streaming. large
`
`file transfers, etc.
`
`In such a case. the satellite link may be used as a high speed
`
`data downlink whilst the radio interface 9 is used as a data uplink for carrying
`
`control messages. thereby enabling interactive video and multimedia services.
`
`The F? 40 is also connected to a removable SIM 52 via electrical
`
`contacts 54. The SIM 52 provides all SIM-related functions required in order
`
`for the FP to receive radio communications service. in a similar manner as a
`
`mobile station 8, within the PLMN via the standard radio interface 9 of the
`
`PLMN. The SIM 52 may be a standard SIM as used in a standard mobile
`
`station 8. The SIM 52 includes a digital processor 56 and SIM memory 58,
`
`which includes for example mask-programmed ROM containing the SM
`
`operating system,
`
`readfwrite EEPROM for
`
`the non-volatile storage of
`
`PETITIONERS 1065-0016
`IPR2016-00758
`
`

`

`W0 01 $4147]
`
`PCTIGBGOIO4570
`
`15
`
`The SIM 52 is used for authentication functions and the storage and
`
`retrieval of data items by the processor 48 of the F? 40. The SIM is issued
`
`when an FP subscription is taken out by a subscriber. and subscription data
`
`corresponding to that stored in the SIM 52 is stored in the HLR 12 and AuC
`
`13 of the PLMN
`
`As far as authentication is concerned. the SIM 52 stores an encryption
`
`algorithm (A3). and an authentication key (Ki) of the PF 40, which it applies
`
`radio interface 9, these processing and control functions are similar to that
`
`to a random challenge issued by the PLMN and passed to it by the PF 40, in
`
`order to generate a response. The response should be verifiably related to that
`
`computed in the AuC 13 of the PLMN. in order for authentication of the FP to
`
`be successful. Once authentication is complete, the PF 40 is granted service
`
`in the PLMN and is issued with a temporary identity (TIMSI) whereby the FF
`
`40 is identified (for example in paging messages broadcast in the PLMN) over
`
`the PLMN radio interface 9 during the subsequent access session. The mobile
`
`station 8 also has a session key resulting from the authentication procedure,
`
`whereby to encrypt and decrypt radio communications with the PLMN.
`
`During both the authentication phase and the subsequent access session, the
`
`FP 40 communicates with a BTS of the PLMN using the standard radio
`
`interface 9 of the PLMN.
`
`The digital processor 48 of the PF 40 provides digital processing and
`
`control functions supporting the individual setting up, and functioning, of
`
`radio links via the radio frequency transceivers 46 and 60. For the cellular
`
`PETITIONERS 1065-0017
`IPR2016-00758
`
`

`

`W0 01l4147l
`
`PCT/GBOOIMS'FIJ
`
`[6
`
`used in a stande mobile station 8. For the cordless radio interface 41, those
`
`processing and control functions are similar to that used in a base station of
`
`the PLMN.
`
`In addition, the digital processor 43 provides an interworking
`
`function between the radio interfaces 9 and 4t, which will be described in
`
`further detail below. The interworking function processes control messages
`
`received over either one of the radio interfaces 9. 41 and reacts by transmitting
`
`For
`
`control messages over the other of the radio interfaces 4!, 9.
`
`In addition, the
`
`interworking function reiays traffic data, such as voice traffic data or data
`
`traffic data, received over one of the radio interfaces 9, 41, to the other of the
`
`radio interfaces 4!, 9.
`
`The MS/CS 42, as illustrated in Figure 4. preferably includes all of the
`
`components of a standard mobile station 8. For conciseness,
`
`it
`
`is to be
`
`understood that
`
`in this embodiment
`
`the MS/CS 42 includes all of the
`
`components described in relation to the mobile Station 8. and that in Figure 4
`
`those components are referenced with the same reference numerals as those
`
`used in Figure 2, although incremented by 100.
`
`In addition, the MS/CS 42
`
`includes functionality, programmed in the software used by the digital
`
`processor 126 and stored in memory 128. which allows the MS/CS 42 to
`
`communicate via the cordless radio interface 41 directly with the PF 40.
`
`The HA/CS 43, as illustrated in Figure 5, preferably includes all of the
`
`components and functionality of the MS/CS 42 as described above, except for
`
`the man machine interface components (the speaker 122, the display 130, the
`
`keypad 132 and the microphone
`
`[24), and the voice codec 120.
`
`PETITIONERS 1065-0018
`IPR2016-00758
`
`

`

`W0 01l4147l
`
`PCT/GBOO/MS'JO
`
`l7
`
`conciseness.
`
`it
`
`is to be understood that the components of the HNCS 43
`
`illustrated in Figure 5 which are the same as those of the MS/CS 42 of Figure
`
`4 are referenced with the same reference numerals as those used in Figure 4,
`
`although incremented by 100. The HA/CS may have only the capability to
`
`transmit andfor receive data (i_e. not voice) traffic data to and/or from the
`
`PLMN via the FP 40 over a cordless radio interface 41 which is preferably
`
`means of the FF 40. The F? 40 may act as a hub for communications with a
`
`substantially identical with the cordless radio interface 41 between the MSJCS
`
`42 and the FF 40. The capability to communicate directly with the PLMN via
`
`a cellular radio interface is not provided for the HAJCS 43, since the device is
`
`intended to be permanently located in the vicinity of the home of the
`
`subscriber, thereby allowing all communications to occur via the FP 40.
`
`The HAJCS 43 showu is a module to be connected to a home
`
`appliance by means of a data inputioutput port 240. Alternatively, the HAJCS
`
`43 may be built into a home appliance. Examples of appliances which may be
`
`connected to, or include, a HA/CS 43 include a lighting control module, a
`
`video tape recorder, a heating andlor air conditioning control module, a
`
`refrigerator, an electricity or gas meter. :1 personal computer, etc. The HAJCS
`
`43 may also take the form of a cordless telephone, in which case it is provided
`
`with all of the man machine interface components illustrated in Figure 4 and a
`
`voice codec and the capability to transmit and receive voice data.
`
`The HA/CS 43 provides the capability to control
`
`the appliance
`
`remotely andfor receive data remotely from the appliance, via the PLMN, by
`
`PETITIONERS 1065-0019
`IPR2016-00758
`
`

`

`W0 01(41471
`
`PCTIGBOOIMS'IO
`
`18
`
`plurality of HA/CSs 43. which may each individually send data messages to a
`
`BTSs within its range. and Selects the strongest signal. The PF 40 then
`
`reCeiving unit (such as a m