(12) INTERNATIONAL APPLICATION PUBLISHED UNDER THE PATENT COOPERATION TREATY (PCT)
`
`(I9) World Intellectual Property Organization
`International Bureau
`
` |l||l||l|l||l||||||l|llllllll||||||||l|||l|||l||||ll|lll|||||||||||||l||l|||l|
`
`(43) International Publication Date
`7 June 2001 (07.06.2001)
`PCT
`
`
`(I0) International Publication Num bcr
`
`(51) International Patent C|assification7:
`
`H06“) ‘H20
`
`(21) International Application Number:
`
`PCTt'GB00i(J457lJ
`
`(22) International Filing Date:
`30 November 2000 80.! 1.2000)
`
`FISCHER, Graham EGBIGB I: Orange Personal Commu-
`nications Services Limited. St. James Court. Great Park
`
`Road. Almondsbury Park. Bradley Stoke. Bristol BS1240]
`(GB). SHIITT. Stuart [C1B:"GBl; Orange Personal Com-
`munications Services Limited. St. James Court. Great Park
`Road, Almondsbury Park. Bradley Stoke. Bristol BSl2 4Q]
`(GB).
`
`(25) Filing Language:
`
`(26) Publication Language:
`
`English
`
`English
`
`(74) Agents: SPAARGAREN, Jerome et aI.: R.G.C. Jenkins
`at Co., 26 Caxton Street. London SW 1H OR] (GB).
`
`(30) Priority Data:
`99285223
`
`2 December 1999 (02.12.1999)
`
`GB
`
`(71) Applicant for all designated States except US): 0R-
`ANGE PERSONAL COMMUNICATIONS SER-
`VICES LIMITED IGBIGB]; St. James Court. Great Park
`Road. Almondsbury Park. Bradley Stoke, Bristol BSl2
`4Q] (GB).
`
`(72)
`(75)
`
`Inventors: and
`Inver|torst'AppIieants 0'03‘ US only): BAILEY, Richard,
`James [GBIGB]: Orange Personal Communications Ser-
`vices Limited. St.
`James Court, Great Park Road. Al-
`mondsbury Park. Bradley Stoke. Bristol BS12 40] (GB).
`
`(81) Designated States {rtatt'onat’): AE. AG, AL, AM. AT. AT
`(utility model). AU. AZ. BA, BB. BG. BR. BY, BZ. CA.
`CH. CN. CR, CU. C2. C2 (utility model). DE. DE (utility
`model), DK. DK (utility model). DM. DZ, EE. EE (utility
`model), ES. FI, Fl {utility model), GB. GD,C:E.Gl-1. GM.
`HR. HU, ID, IL. IN. IS, JP. KE. KG. KP. KR. KZ, LC. LK.
`LR. LS. LT, LU. LV. MA. MD. MG, MK. MN. MW. MX,
`M2. NO. NZ. PL. PT. RO, RU. SD, SE. SG. SI, SK. SK
`(utility model}. SL, TJ. TM, TR.'I'I‘. TZ, UA. UG. US. UZ.
`VN, YU. ZA. ZW.
`
`(34)
`
`Designated States (regional): ARIPO patent (GH, GM,
`KE, LS. MW, MZ. SD. SL, SZ. ‘I2. UG. ZW). Eurasian
`patent (AM, AZ, BY, KG. KZ. MD. RU. TJ. TM), European
`
`[Comimted on next page}
`
`
`(54) Title: SUBSCRIBER EQUIPMENT AND METHOD FOR A MOBILE COMMUNICATIONS SYSTEM
`
`
`
`
`
`1A1|ll|||||l|llll||l||||||l|l|||l|||||||||||||ll||l|||||||||||||l|l|||l|||||||||l|l
`
`r‘ (57) Abstract: A subscriber equipment set for use in a mobile communications system including a mobile communications net-
`“I work and a plurality of mobile stations, said network having a plurality of radio transceiving stations whereby said mobile stations
`1-1
`receive radio communications service from said network, said set including a firs station and a second station, wherein the first sta-
`V'*--.. tion com
`prises a first radio transceiver, memory means for storing first subscription data and means for registering with the mobile
`1-1
`communications network. to receive radio communications service from a radio transceiving station therein. by use of the first sub-
`scription data. wherein the second station cornprlses a second radio transceiver, memory means for storing second subscription data
`and means for registering with the mobile communications network. to receive radio communications service from a radio transceiv-
`ing station therein. by use of the second subscription data, and wherein the first station is connectable to the second station to receive
`service in the mobile communication system via the second station.
`
`3
`
`ZTE 1016-0001
`
`
`
`ZTE 1016-0001
`
`

`
`W0 01/41471 Al
`
`H||||||l|ll1||||||||||1l|||ll|||lllllllllllllllllllllll||l[|\|||fl||||l|||1i||
`
`patent (AT. BE. CH. CY, DE. DK. ES. Fl. FR. GB. GR, IE, — Before the expiration of the time finm‘ for umena':'r:g the
`IT. LU. MC. NL. PT, SE, TR), UAP] palcnl (B15. BJ. CF.
`cfaims and to be republished in the even: of receipt of
`CG, CI. CM. GA. GN, GW. ML, MR, NE. SN. TD. TG).
`amendmrmis.
`
`Published:
`--
`With fnternationaf Search report.
`
`For mo-lemzr codes and other abbrev:‘ar1'ons. refer In the "Gm'd~
`ante Nofes on Codes and/HJbrE1.»1'aI1'on: "appearing at the begin-
`nmg ofeach regufar issue ofrhe PC T Gazette.
`
`ZTE 1016-0002
`
`

`
`W0 01/414.”
`
`PCTfGB[Ii]llJ4570
`
`SUBSCRIBER EQUIPMENT AND METHOD FOR A MOBILE COMMUNICATIONS SYSTEM
`
`This
`
`invention relates
`
`to
`
`subscriber
`
`equipment
`
`for
`
`a mobile
`
`communications system, a mobile communications network and :1 method of
`
`controlling services in a mobile communications network.
`
`Subscriber equipment referred to as a “home base station" is known.
`
`The home base station is installed inside a building, for example the home of
`
`the subscriber owning a mobile station. for providing a cordless teiephony link
`
`to the mobile station when the mobile station is within its coverage area. The
`
`home base station is connected, via a fixed line connection,
`
`to a public
`
`services telephone network (PSTN). When outside the service area of the
`
`home base station,
`
`the mobile station receives service in a cellular mobile
`
`communications network. via a cellular radio interface.
`
`Global System for Mobile Communications (GSM) and Digital European
`
`Cordless Telephone (DECT) mobile station has been proposed for use with a
`
`DECT cordless base station. A further proposal is undergoing standardisation
`
`at the European Telecommunications Standard Institute, and is the subject ofa
`
`project entitled “GSM Cordless Telephony System (CTS)”, as detailed in
`
`Draft GSM Technical Specifications 03.52 (“Lower Layers of the CTS Radio
`
`ZTE 1016-0003
`
`

`
`W0 01__,.41 471
`
`PCT/GB00l04570
`
`2
`
`Interface“) and 03.56 (“CTS Architecture Description") and GSM Technical
`
`Specification 03.20. Annex E (“Security Related Network Functions”).
`
`Home base stations are considered to be desirable,
`
`since it
`
`is
`
`sometimes the case that cellular radio network coverage does not extend
`
`sufficiently within in-building environments. By providing a cordless radio
`
`communications link within the home of the subscriber, the coverage of the
`
`cellular network can be supplemented. Furthermore, the subscriber is able to
`
`use a single mobile station for twouway communications outside the home via
`
`the cellular radio network. and for two-way communications inside the home
`
`via a PSTN connection.
`
`However, there remain drawbacks to the home base stations proposed
`
`in the past.
`
`Firstly, a subscriber must maintain two separate telephony
`
`subscriptions; one subscription to the cellular radio network and a second
`
`subscription to the PSTN. Furthermore, the range of telecommunications
`
`services which are supported by a cellular communications network is
`
`generally different, and often greater, than that supported by a PSTN. Such
`
`services are, for example, the short message service (SMS) supported by, inter
`
`alia, the GSM system.
`
`In future, with third generation mobile radio systems,
`
`the range of services supported is to increase,
`
`thereby exacerbating the
`
`problem.
`
`In accordance with one aspect of the present
`
`invention there is
`
`provided a subscriber equipment set for use in a mobile communications
`
`system including a mobile communications network and a plurality of mobile
`
`ZTE 1016-0004
`
`

`
`W0 0ll4147l
`
`PCTlGBDO.’04570
`
`3
`
`stations, said network having a plurality of radio transceiving stations whereby
`
`said mobile stations receive radio communications service from said network,
`
`said set including a first station and a second station.
`
`wherein the first station comprises a first radio transceiver. memory
`
`means for storing first subscription data and means for registering with the
`
`mobile communications network,
`
`to receive radio communications service
`
`from a radio transceiving station therein, by use of the first subscription data,
`
`wherein the second station comprises a second radio transceiver.
`
`memory means for storing second subscription data and means for registering
`
`with the mobile communications network. to receive radio communications
`
`service from a radio transceiving station therein, by use of the second
`
`subscription data. and
`
`wherein the first station is connectable to the second station to receive
`
`service in the mobile communications system via the second station.
`
`The second station is able to receive radio communications service in a
`
`mobile communications network, whereby the first station is able to receive
`
`service. via the second station. from the mobile communications network.
`
`The second station itself carries voice or other data traffic via a radio link set
`
`up between the second station and the mobile communications network.
`
`The second station may be located, fixedly, inside a building, such as
`
`inside the roof space of the building, or to the exterior of the building, where
`
`mobile network coverage is available. The connection between the second
`
`station and the first station allows the first station when inside the building to
`
`ZTE 1016-0005
`
`

`
`W0 01,4147,
`
`PC'I‘!GB00!04570
`
`4
`
`receive service which may not be available through a direct radio link with the
`
`mobile communications network in the location of the first station.
`
`By providing that the second station itself stores subscription data to
`
`allow the radio transceiving apparatus to independently register for service
`
`with the mobile communications system, the second station is enabled with
`
`the capability of independently performing communications with the mobile
`
`communications system. For example, such communications may consist of
`
`the exchange of control messages necessary for the servicing of a first station
`
`via the second station. Such control messages may, for example.
`
`include
`
`instructions from the mobile communications network as to a set of one or
`
`more frequencies. within the frequency band or bands allocated to the mobile
`
`communications system for radio communications, at which the second
`
`station is authorised to conduct radio communications with a first station.
`
`A radio interface used between the first station and the second station
`
`may be identicai with. or a modified version of, a cellular radio interface
`
`already used by a mobile station for direct radio communications via mobile
`
`communications system. whilst interference caused by the second station is
`
`minimised
`
`by
`
`a
`
`frequency re-use
`
`plan
`
`controlled by
`
`the mobile
`
`communications network. The frequency re—use plan may be implemented by
`
`the sending of control messages directly via the radio link between the mobile
`
`communications network and the second station itself.
`
`The
`
`control messages may
`
`also include messages
`
`used for
`
`authentication of a first station wishing to register for service via the second
`
`ZTE 1016-0006
`
`

`
`W0 mM14.n
`
`PCT!GB00;‘0457|J
`
`5
`
`station. The second station may pass authentication challenges from the
`
`mobile communications network to the first station and authentication
`
`responses generated in
`
`the
`
`first
`
`station to the network.
`
`and receive
`
`confirmation of the authentication of the first station from the mobile network
`
`to judge whether the first station should receive service from it.
`
`Since the second station stores subscription data, and has the capability
`
`to authenticate with the mobile communications network itself, a secure
`
`encrypted communications session between the second station and the mobile
`
`communications network becomes possible. Once the second station has
`
`itself authenticated, by use of the subscription data it stores, with the mobile
`
`communications network,
`
`secure data,
`
`for example authenticating data
`
`allowing the radio transceiving apparatus to authenticate a first station
`
`directly, may be transmitted via an encrypted communications link from the
`
`mobile communications network to the radio transceiving apparatus to be
`
`stored securely thereon. The second station may include a secure storage
`
`module, such as a subscriber identity module (SIM), on which such secure
`
`data may be stored along with the subscription data for the second station
`
`itself.
`
`Furthennore, by allowing the second station to itself register with the
`
`mobile communications network.
`
`the radio interface between the second
`
`station and the mobile communications network may be the same as that used
`
`between standard mobile stations and the mobile communications network.
`
`The radio interface technology already used for the radio interface over which
`
`ZTE 1016-0007
`
`

`
`we 01m!47l
`
`PCTl'GB00.’04570
`
`6
`
`the mobile stations in the network receive service may thus be re-used for the
`
`radio interface between the second station and the mobile communications
`
`system. One or more of a range of services supported by that standard radio
`
`interface. and also the standard mobile stations, may thus be provided by
`
`communications via the radio transceiving apparatus.
`
`According to a further aspect of the invention there is provided a
`
`method of controlling services in a mobile communications system including
`
`a mobile communications network having a plurality of network entitles
`
`providing services to a plurality of radio stations which include mobile
`
`stations, said method comprising:
`
`providing a radio station having a radio communications interface,
`
`means for storing subscription data whereby said radio station is to register for
`
`service with said communications network via said radio communications
`
`interface, and a local communications interface for communicating with one
`
`or more external devices.
`
`allowing an external device to register with said radio station,
`
`storing service data in a network entity indicating that said external
`
`device is registered with said radio station. to allow said network entity to
`
`provide service to said external device via said radio station.
`
`The network entity may thus communicate, or control communications
`
`with, the external device via the radio station.
`
`According to a further aspect of the invention there is provided a
`
`subscriber station comprising a radio interface for communicating with a
`
`ZTE 1016-0008
`
`

`
`wo ou41471
`
`PCT/GBO[|l04570
`
`7
`
`mobile communications network, a local device interface for communicating
`
`with one or more local devices. and a portable storage module arranged to
`
`hold authentication data for authenticating said one or more local devices.
`
`A portable storage module may thus be used to securely store the
`
`authentication data for a local device in the subscriber station.
`
`According to a further aspect of the invention there is provided a
`
`subscriber station comprising a radio interface for communicating with a
`
`mobile
`
`communications
`
`network
`
`and
`
`a
`
`local
`
`device
`
`interface
`
`for
`
`communicating with one or more local devices, wherein said subscriber
`
`station is adapted to intermediate between said mobile communications
`
`network and said one or more local devices in a process or processes whereby
`
`said one or more local devices are authenticated in said network.
`
`Authentication of a local device may thus be performed in the mobile
`
`communications network.
`
`According to a further aspect of the invention there is provided a
`
`mobile communications network adapted to transmit authentication data to a
`
`subscriber station communicating with said mobile communications network
`
`via a radio interface, said authentication data being for one or more devices
`
`local to a subscriber station, whereby said subscriber station is made capable
`
`of authenticating said one or more devices.
`
`Authentication data for a local device may thus be transmitted over-
`
`the—air to the subscriber station.
`
`ZTE 1016-0009
`
`

`
`W0 0l!4l-471
`
`04570
`PCTIGBBW
`
`8
`
`According to a further aspect of the invention there is provided a
`
`mobile communications network adapted to communicate with a subscriber
`
`station which is authenticated with the network, and to conduct authentication
`
`of one or more devices local to said subscriber station, by transmission of
`
`control messages over a radio interface between said network and said
`
`subscriber station.
`
`Authentication of a local device may thus be performed in the mobile
`
`communications network.
`
`According to a further aspect of the invention there is provided a fixed
`
`station for use in a cellular communications system including a cellular
`
`communications network and a plurality of mobile stations, said fixed station
`
`comprising:
`
`memory means for storing subscription data;
`
`radio communications means whereby the fixed station is capable of
`
`registering
`
`for
`
`radio
`
`communications
`
`service
`
`from the
`
`cellular
`
`communications network;
`
`local communications means for forming communications links with a
`
`plurality of home appliances; and
`
`interworking means operating between the radio communications
`
`means
`
`and the
`
`local communications means
`
`for detecting incoming
`
`communications from the cellular communications network via said radio
`
`communications means, and in response thereto selectively communicating
`
`ZTE 1016-0010
`
`

`
`wo 01/4147]
`
`1=c'ricBooro4s7o
`
`9
`
`with one of said plurality oi" home appliances via said local communications
`
`means.
`
`Control of and/or reading of data from individual home appliances
`
`may thus be performed via the fixed station and the cellular communications
`
`system.
`
`According to a further aspect of the invention there is provided a home
`
`base
`
`station
`
`including means
`
`for
`
`registering
`
`and
`
`receiving
`
`radio
`
`communications service in a mobile communications system.
`
`A fixed line link is thus not required for the receipt of service via the
`
`home base station, whilst if the home base station is correctly positioned. the
`
`home base station can provide service not otherwise available to a mobile
`
`station capable of operating in the mobile communications system.
`
`Further features and advantages of the present invention will become
`
`apparent with reference to the following description of preferred embodiments
`
`of the invention, made with reference to the accompanying drawings:
`
`Figure I
`
`is a schematic illustration of a cellular radio network
`
`arrangement in accordance with an embodiment of the present invention:
`
`Figure 2 is a schematic illustration of a standard mobile station used in
`
`the cellular radio network illustrated in Figure 1;
`
`Figure 3
`
`shows
`
`a
`
`schematic
`
`illustration of
`
`radio transceiving
`
`apparatus, used in the cellular radio network of Figure 1;
`
`Figure 4 shows a mobile stationfcordless station used in the cellular
`
`radio network illustrated in Figure 1; and
`
`ZTE 1016-0011
`
`

`
`W0 D1/414."
`
`PCTlGBl]0lfl45‘70
`
`10
`
`Figure 5 shows a home appliance/cordless station used in the cellular
`
`radio network illustrated in Figure I.
`
`A cellular radio network, also referred to as a public land mobile
`
`network (PLMN). in accordance with an embodiment of the present invention,
`
`is schematically illustrated in Figure I.
`
`In this embodiment the PLMN is a GSM network. A mobile switching
`
`centre (MSC) 2 is connected via communication links to a base station
`
`controller (BSC) 4. The BSC 4 is one of a number of BSCS dispersed
`
`geographically across areas served by the mobile switching centre 2. The
`
`BSC 4 controls a plurality of public radio transceiving stations 6, referred to
`
`as base transceiver stations (BT55), located remote from. and connected by
`
`further communication links to, the BSC 4. The BTS 6 transmits radio signals
`
`to, and receives radio signals from, cellular mobile stations 8 which are in an
`
`area served by that BTS. That area is referred to as a “cell". A PLMN is
`
`provided with a large number of such cells, which are ideally contiguous to
`
`provide continuous coverage over the whole network territory. The radio
`
`signals are transmitted via a standard radio interface 9, having a cellular
`
`protocol, which is standardised both at the physical layer level and the logical
`
`layer level.
`
`The mobile switching centre 2 is also connected via communications
`
`links to other mobile switching centres in the remainder of the PLMN, and to
`
`other networks such as a public service telephone network (PSTN) 10, which
`
`provides service to fixed line terminals. such as a Fixed telephone (PT) 11.
`
`ZTE 1016-0012
`
`

`
`W0 01!-1147!
`
`PCTIGBGO/04570
`
`11
`
`The mobile switching centre 2 is connected via a signalling link to a
`
`home location register (l-ILR) 12 which is a database permanently storing
`
`subscriber data for subscriptions with the PLMN,
`
`including,
`
`for each
`
`subscription.
`
`the international mobile subscriber identity {EMSI}, which is
`
`unique to each mobile station in the GSM system and service data associated
`
`with the subscription. The HLR I2 is connected via a signalling link to an
`
`authentication centre (ALIC) 13, which securely stores an authentication key
`
`(Ki) against each IMSI, and provides authentication functions to the PLMN.
`
`The [M31 and the Ki for a subscription are also secureiy stored along with
`
`other subscription specific information in the mobile station in a subscriber
`
`identity module (SIM) (to be described below), also referred to as a smart
`
`card. The SIM is removable such that the stored data is portable between
`
`mobile stations.
`
`The mobile switching centre is connected to, or combined with, a
`
`visitor location register (VLR), not shown. which is a database temporarily
`
`storing subscriber data for mobile stations registered for service in its area.
`
`In addition, the MSC 2 and each BSC 4 are connected via signalling
`
`links to a cordless telephone service node (CSN) 14, to be described in further
`
`detail below.
`
`Referring now to Figure 2. a standard, known cellular mobile station 8
`
`used in the PLMN comprises a transmitlreceive aerial 16, a radio frequency
`
`transceiver 18, a voice coder/decoder (codec) 20 connected to a loudspeaker
`
`22 and a microphone 24. a digital processor 26 and its associated memory 28
`
`ZTE 1016-0013
`
`

`
`W0 011,414-,1
`
`PCTfGB0l]!04570
`
`12
`
`(which includes ROM storing the operating system of the mobile station), a
`
`display 30 and a manual input port (e.g. a keypad) 32. The mobile station is
`
`connected to a removable SIM 34 via electrical contacts 35.
`
`The SIM 34 connected to the mobile station is a standard component
`
`of the PLMN system, and may be inserted in any similarly standardised
`
`mobile station. The SIM 34 includes a digital processor 36 and SIM memory
`
`38, which includes for example mask-programmed ROM containing the SIM
`
`operating system,
`
`read/write EEPROM for
`
`the non—volatile
`
`storage of
`
`subscriber data and RAM for use by the SIM processor 36 during operations.
`
`The SIM is issued to a subscriber on taking out a subscription with the
`
`PLMN. The SIM 34 is used for authentication functions and the storage and
`
`retrieval of data items by the processor 26 of the mobile station 8. The
`
`command set, data file
`
`structure
`
`and data coding format
`
`for data
`
`communicated via the interface between the mobile station processor 26 and
`
`the SIM processor 36 are all standardised (see for example GSM technical
`
`specification 11.1 1).
`
`As far as authentication is concerned, the SIM 34 stores an encryption
`
`algorithm (A3), and the subscriber’s authentication key (Ki), which it applies
`
`to a random challenge issued by the PLMN and passed to it by the mobile
`
`station 8, in order to generate a response. The response should be verifiably
`
`related to that computed in the AuC 13 of the PLMN,
`
`in order for
`
`authentication to be successful. Once authentication is complete, the mobile
`
`station 8 is granted service in the PLMN and is issued with a temporary
`
`ZTE 1016-0014
`
`

`
`W0 0114147]
`
`PCTIGBIJ 0104570
`
`13
`
`identity (TIMSD whereby the mobile station 8 is identified (for example in
`
`paging messages broadcast
`
`in the PLMN] during the subsequent access
`
`session.
`
`Referring now to Figure 3, a home base station. referred to herein as a
`
`fixed part (FP) 40 forms part of the mobile communications system in this
`
`embodiment of the invention. The FP 40 is capable of communicating via a
`
`standard PLMN radio interface 9 with a BTS 6 of the PLMN. The FP 40 is
`
`also capable of communicating via a cordless radio interface 41 with a mobile
`
`station/cordless station (MSXCS) 42 and a home appliance/cordless station
`
`(HA/CS) 43, to be described in further detail below.
`
`The FP 40 comprises a cellular radio transmitlreceive aerial 44, a
`
`cellular
`
`radio frequency transceiver 46, a digital processor 48 and its
`
`associated memory 50 (which includes ROM storing the operating system of
`
`the FP 40), whereby the FP 40 interfaces with the PLMN.
`
`The FP
`
`communicates with the BT55 6 of the PLMN directly using the standard radio
`
`interface 9 of the PLMN.
`
`The FP 40 also includes a cordless radio
`
`transmit/receive aerial 62 and a cordless radio frequency transceiver 60 which
`
`is controlled by the digital processor 43 of the FP 40. These components
`
`provide a two—way radio link via the cordless radio interface 41. The cordless
`
`radio interface may be a modified version of the GSM radio interface, such as
`
`that described in Draft GSM 03.52 as referred to above.
`
`As the FP 40 is designed to be fixedly sited, the FP 40 includes an in-
`
`built
`
`transformer whereby the FP 40 may be powered directly from an
`
`ZTE 1016-0015
`
`

`
`W0 01,414-71
`
`PCT/GB00t'04570
`
`I4
`
`electrical mains supply. and no battery power pack is required. The FF 40
`
`includes a power lead (not shown) which includes a plug adapted to be
`
`connected to a socket of the electrical mains suppiy, whereby the FP 40 has a
`
`permanent source of power when fixedly sited for operational use.
`
`In order to
`
`provide functionality for subscribers having no PLMN coverage, even at
`
`rooftop level, the FP 40 may also include a fixed line interface (not shown) for
`
`performing voice and/or data communications via a fixed iine network (e.g. a
`
`PSTN), for example a digitai subscriber line (DSL) interface to provide high
`
`speed data communications via the fixed line network. The PF 40 may also
`
`include a satellite transceiver {not shown), whereby higher data rates are made
`
`available for services such as (near) video on demand, video streaming, large
`
`file transfers, etc.
`
`In such a case. the satellite link may be used as a high speed
`
`data downlink whilst the radio interface 9 is used as a data uplink for carrying
`
`control messages, thereby enabling interactive video and multimedia services.
`
`The I-‘P 40 is also connected to a removable SIM 52 via electrical
`
`contacts 54. The SIM 52 provides all SlM—related functions required in order
`
`for the FP to receive radio communications service, in a similar manner as a
`
`mobile station 8, within the PLMN via the standard radio interface 9 of the
`
`PLMN. The SIM 52 may be a standard SIM as used in a standard mobile
`
`station 8. The SIM 52 includes a digital processor 56 and SIM memory 58,
`
`which includes for example rnask—programmed ROM containing the SIM
`
`operating system,
`
`read/write EEPROM for
`
`the non-volatile storage of
`
`subscriber data and RAM for use by the SIM processor 56 during operations.
`
`ZTE 1016-0016
`
`

`
`W0 0] M1471
`
`PCTa'GB00!04570
`
`15
`
`The SIM 52 is used for authentication functions and the storage and
`
`retrieval of data items by the processor 48 of the FE‘ 40. The SIM is issued
`
`when an FP subscription is taken out by a subscriber. and subscription data
`
`corresponding to that stored in the SIM 52 is stored in the HLR I2 and AuC
`
`13 of the PLMN.
`
`As far as authentication is concerned. the SIM 52 stores an encryption
`
`algorithm (A3). and an authentication key (Ki) of the FP 40, which it applies
`
`to a random challenge issued by the PLMN and passed to it by the F? 40, in
`
`order to generate a response. The response should be verifiably related to that
`
`computed in the AuC 13 of the PLMN. in order for authentication of the FP to
`
`be successful. Once authentication is complete, the FP 40 is granted service
`
`in the PLMN and is issued with a temporary identity (TIMSI) whereby the FP
`
`40 is identified (for example in paging messages broadcast in the PLMN) over
`
`the PLMN radio interface 9 during the subsequent access session. The mobile
`
`station 8 also has a session key resulting from the authentication procedure,
`
`whereby to encrypt and decrypt radio communications with the PLMN.
`
`During both the authentication phase and the subsequent access session, the
`
`FP 40 communicates with a BTS of the PLMN using the standard radio
`
`interface 9 of the PLMN.
`
`The digital processor 48 of the FP 40 provides digital processing and
`
`control functions supporting the individual setting up, and functioning, of
`
`radio links via the radio frequency transceivers 46 and 60. For the cellular
`
`radio interface 9, these processing and control functions are similar to that
`
`ZTE 1016-0017
`
`

`
`W0 01,414.“
`
`PCT/GB00{0457lJ
`
`16
`
`used in a standard mobile station 8. For the cordless radio interface 41, those
`
`processing and control functions are similar to that used in a base station of
`
`the PLMN.
`
`In addition, the digital processor 43 provides an interworlcing
`
`function between the radio interfaces 9 and 4i, which will be described in
`
`further detail below. The interworking function processes control messages
`
`received over either one of the radio interfaces 9, 41 and reacts by transmitting
`
`control messages over the other of the radio interfaces 4!, 9.
`
`In addition, the
`
`interworking function relays traffic data, such as voice traffic data or data
`
`traffic data, received over one of the radio interfaces 9, 41, to the other of the
`
`radio interfaces 4!, 9.
`
`The MS/CS 42, as illustrated in Figure 4. preferably includes all of the
`
`components of a standard mobile station 8. For conciseness,
`
`it
`
`is to be
`
`understood that
`
`in this embodiment
`
`the MS/CS 42 includes all of the
`
`components described in relation to the mobile station 8. and that in Figure 4
`
`those components are referenced with the same reference numerals as those
`
`used in Figure 2, although incremented by 100.
`
`In addition, the MS/CS 42
`
`includes functionality, programmed in the software used by the digital
`
`processor 126 and stored in memory 128. which allows the MS/CS 42 to
`
`communicate via the cordless radio interface 41 directly with the FP 40.
`
`The HA/CS 43, as illustrated in Figure 5, preferably includes all of the
`
`components and functionality of the MS/CS 42 as described above, except for
`
`the man machine interface components (the speaker 122, the display 130, the
`
`keypad 132 and the microphone
`
`124). and the voice codec 120.
`
`For
`
`ZTE 1016-0018
`
`

`
`W0 01l4147l
`
`PCT/GB00l04570
`
`17
`
`conciseness.
`
`it
`
`is to be understood that the components of the HNCS 43
`
`illustrated in Figure 5 which are the same as those of the MS/CS 42 of Figure
`
`4 are referenced with the same reference numerals as those used in Figure 4,
`
`although incremented by 100. The HA/CS may have only the capability to
`
`transmit anclfor receive data (i_e. not voice) traffic data to andfor from the
`
`PLMN via the FP 40 over a cordless radio interface 41 which is preferably
`
`substantially identical with the cordless radio interface 41 between the MSJCS
`
`42 and the Fl’ 40. The capability to communicate directly with the PLMN via
`
`a cellular radio interface is not provided for the HAICS 43, since the device is
`
`intended to be permanently located in the vicinity of the home of the
`
`subscriber, thereby allowing all communications to occur via the FP 40.
`
`The I-IAICS 43 shown is a module to be connected to a home
`
`appliance by means of a data inputfoutput port 240. Alternatively, the I-IAJCS
`
`43 may be built into a home appliance. Examples of appliances which may be
`
`connected to, or include, a HA/CS 43 include a lighting control module,
`
`:1
`
`video tape recorder, a heating and/or air conditioning control module, a
`
`refrigerator, an electricity or gas meter. :1 personal computer, etc. The HAJCS
`
`43 may also take the fonn of a cordless telephone. in which case it is provided
`
`with all of the man machine interface components illustrated in Figure 4 and a
`
`voice codec and the capability to transmit and receive voice data.
`
`The HA/CS 43 provides the capability to control
`
`the appliance
`
`remotely andfor receive data remotely from the appliance, via the PLMN, by
`
`means of the FF 40. The FP 40 may act as a hub for communications with a
`
`ZTE 1016-0019
`
`

`
`W0 01;41471
`
`PCT."GB00l04570
`
`18
`
`plurality of l-{A/CS5 43, which may each individually send data messages to a
`
`receiving unit (such as a mobile station) serviced by the PLMN via the FP 40
`
`andfor individually receive data messages from a transmitting unit (such as a
`
`mobile station) serviced by the PLMN. A selective forwarding function. to be
`
`described below, may be used for the forwarding of data to an individual
`
`HAJCS 43 by the FP 40.
`
`In the following description, reference is made to a “CS", which
`
`reference is intended to apply to both an MSICS 42 and a HA/CS 43. Where
`
`reference is to be made to one of these types of station specifically. such
`
`speci