EP1295496A1

EP1295496A1 - Cellular radiocommunication system with means for locating faulty terminals

Info

Publication number: EP1295496A1
Application number: EP01949543A
Authority: EP
Inventors: Pierre Lescuyer; Thierry Lucidarme
Original assignee: Nortel Networks Ltd
Current assignee: Nortel Networks Ltd
Priority date: 2000-06-30
Filing date: 2001-06-27
Publication date: 2003-03-26
Also published as: FR2811191B1; AU2001270674A1; FR2811191A1; US20040038678A1; WO2002001899A1

Abstract

The invention concerns a cellular system comprising a network core (10) including switches (11-13) and subscriber management means (14) and a radio access network (20) connected to the network core and including base stations (21) capable of radio communication with mobile stations (30) comprising each a terminal (31) associated with a subscriber identification module, for sending to the network core a warning message identifying a mobile station for which a dysfunction has been detected. When such an warning message identifying a mobile station is received, the network core queries the mobile station, so as to find out the identity of its terminal which is then recorded in a database of the network.

Description

CELLULAR RADIO COMMUNICATION SYSTEM WITH MEANS FOR LOCATING DEFECTIVE TERMINALS

The present invention relates to cellular radio networks. Today's cellular networks distinguish between subscribers and the terminals they use.

A mobile station communicating with the network is the association of a non-subscriber-specific terminal and a subscriber identification module (SIM) inserted in the terminal. This SIM module contains data which, with corresponding data stored in a network database called HLR (“Home Location Register”), make it possible to identify the subscriber and render the services to which he has subscribed. This data includes in particular a subscriber number called the International Mobile Subscriber Identity (IMSI).

The terminal also has an equipment number called the International Mobile Equipment Identity (IMEI). The structure of the IMEIs is described in the technical specification 3G TS 22.016, version 3.1.0 published in December 1999 by the 3GPP (3 ^rd Generation Partnership Project). Regardless of the subscriber associated with it, the terminal stores its IMEI and communicates it to the network on request. To establish a communication, the option may be provided to designate the mobile station by the IMEl of its terminal. But in general, it is the subscriber identity (IMSI) which is used by the network to address a mobile station, which makes it possible to provide network services to subscribers regardless of the equipment they use. .

Cellular networks of the GPRS (“General Packet Radio Service”) and UMTS (“Universal Mobile Telecommunications System”) types may include an optional database called EIR (“Equipment Identity Register”), in which IMEIs are stored. The EIR, which can be viewed by network switches, contains a “white list” of IMEl for which use is permitted, a “black list” of prohibited IMEl (for example stolen terminals), and possibly a “gray list From IMEl that the operator can follow in the network. An object of the present invention is to allow operators to cellular networks to detect and take into account operational problems which the terminals can be affected, while the mobile stations are identified on the basis of the identities of subscribers and not on the basis of the terminals. The invention thus proposes a cellular radio communication system comprising on the one hand a core network comprising switches and subscriber management means, and on the other hand at least one radio access network connected to at least one switch of the core network and comprising base stations capable of communicating by radio with mobile stations, each mobile station comprising a terminal associated with a subscriber identification module. The core network includes means for interrogating a mobile station through the access network to obtain an identity of the terminal of the interrogated mobile station. According to the invention, the access network includes means for detecting malfunctions of mobile stations, for sending to the core network an alert message identifying a mobile station for which a malfunction has been detected. The interrogation means are controlled to interrogate a mobile station in order to obtain the identity of its terminal in response to the reception of an alert message identifying said mobile station. Malfunctions are detected in the access network, which does not necessarily have the means to obtain the identities of the terminals in question. With the proposed system, the core network collects information allowing the identification of defective terminals, and can carry out all kinds of actions as a result: warning the holders of defective terminals, preventing them from using these terminals in the event of a problem. likely to seriously disturb the communications of other subscribers, warn the manufacturers in the event of problems noted on a series of terminals, etc.

In a preferred embodiment, the core network comprises at least one faulty terminal database containing records relating to terminals whose identity has been obtained by the interrogation means in response to the reception of a message from alert. These records may include other elements contained in the alert message such as a subscriber identity used to identify the mobile station, an indication of the type or level of severity of the detected malfunction, etc. The detected malfunctions relate in particular to the power emitted by the mobile stations. They may also relate to other aspects such as errors in the implementation of the communication protocols used between the radio access network and the mobile stations or an excessive use, by a mobile station, of radio resources shared with other stations. mobile.

Another aspect of the invention relates to a core network for a cellular radio communication system, comprising switches and subscriber management means, the switches being connected to at least one radio access network comprising base stations. capable of communicating by radio with mobile stations, each mobile station comprising a terminal associated with a subscriber identification module. The core network includes means for interrogating a mobile station through the access network to obtain an identity of the terminal of the interrogated mobile station. These interrogation means are controlled to interrogate a mobile station in order to obtain the identity of its terminal in response to the reception of an alert message identifying said mobile station.

A third aspect of the invention relates to a radio access network for a cellular radio communication system, comprising base stations capable of communicating by radio with mobile stations and radio network controllers linked to switches of a core. network, which supervise the base stations and ensure the control of radio resources in the access network. This access network according to the invention comprises means for detecting malfunctions of mobile stations, for sending to the core network an alert message identifying a mobile station for which a malfunction has been detected.

Other particularities and advantages of the present invention will appear in the description below of nonlimiting exemplary embodiments, with reference to the appended drawings, in which: - Figure 1 is a general diagram of a radiocommunication system architecture cell according to the invention;

- Figure 2 is a diagram illustrating messages exchanged in a system according to the invention;

- Figure 3 is a diagram showing communication protocols used in different parts of the system.

The cellular radio system shown in Figure 1 includes a UMTS-type extended coverage cellular network. This cellular network, or PLMN (“Public Land Mobile Network”), is conventionally divided into a core network 10, comprising interconnected switches, and one or more access networks 20 providing the radio links with the mobile stations 30 called UE ("User Equipment").

Each UE 30 consists of terminal equipment 31 associated with a subscriber identification module (SIM) 32. The SIM 32 includes a processor and a memory in which data relating to the subscriber, in particular his IMSI identity. Each terminal 31 also has an international mobile equipment identity (IMEI).

The access network 20, called RAN (“Radio Access Network”), comprises units called “node B” 21 distributed over the network coverage area and each comprising one or more base stations for communicating by radio (Uu interface ) with mobile stations 30. In the remainder of this description, a base station will be assimilated to its “node B” 21. Radio network controllers (RNC, “Radio Network Controller”) 22 connected to the core network 10 supervise the base stations 21 through interfaces called Iub. Some RNC 22 are connected to each other through interfaces called lur. The access network considered here is of the UTRAN type ("UMTS

Terrestrial RAN ”) standardized by 3GPP. It will be noted that the invention described is also applicable to other types of access networks, in particular to BRANs ("Broadband RAN").

The core network 10 is connected to fixed networks comprising a public switched telephone network (PSTN) 8 and one or more packet transmission networks using respective protocols such as X.25 or IP ("Internet Protocol"). In the example illustrated by the drawings, there is a packet transmission network 9 constituted by the Internet network.

The core network 10 includes mobile service switching centers 11 (MSC, “Mobile Switching Center”), associated with visitor location registers (VLR, “Visitor Location Register”). These MSCs 11 provide circuit switching for telephone or circuit mode data transfer communications. Some MSCs serve as a gateway with fixed networks, in particular with the switched network 8. Each RNC 22 is connected to one or more MSCs 11 by an interface read.

For packet mode, the switches of the core network 10 are called GSN ("GPRS Support Node"), and they communicate with each other through an interface called Gn.

The packet switches 12 connected to the RNCs 22 of the access network 20 by an interface lu are called SGSN ("Serving GSN"). Some of them can communicate with MSCs via a Gs interface to coordinate mobility between circuit and packet modes.

Other packet switches 13 of the core network 10, called GGSN (“Gateway GSN”), serve as a gateway with the packet networks, in particular with the Internet network 9. These gateways 13 are connected to the SGSN 12 to allow the UEs 30 to access the Internet.

The MSC 11 and SGSN 12 incorporate call control units for exchanging information with the UE 30 through the RAN 20, in particular within the framework of the establishment and end of session procedures. In particular, the switch has the possibility of interrogating the UE so that the latter returns its IMEI to it.

The core network 10 comprises a nominal location register 14 (HLR) communicating with the MSCΛ / LR, SGSN and GGSN through standardized interfaces respectively called D, Gc and Gr. The HLR is a database, located in one or several places, containing all the data specific to PLMN subscribers, in particular their subscription parameters, mobility and their contexts, in order to allow the processing of all service requests concerning these subscribers.

The core network 10 further comprises a faulty terminal register 15 which is a database in which the IMEIs of terminals 31 are recorded for which the access network 20 has observed malfunctions. This register 15 is here called CMC (“Crazy Mobile Center”). When the core network 20 includes an EIR, the CMC and the EIR can be located in separate network equipment or in the same equipment. In the latter case, the two databases will generally be kept separately. One could however envisage that the functionality of the CMC proceeds by enriching the EIR database and the corresponding protocols. The CMC 15 can also be located in the same network equipment as the HLR 14.

The process of creating a record in the CMC 15 is illustrated in FIG. 2, the entities of the system brought into play by this process being shown in FIG. 3, in the form of logic modules applying the relevant protocols.

It is assumed that the UE 30 and a switch of the core network 10

(MSC 11 for circuit mode or SGSN 12 for packet mode) have conventionally exchanged session establishment signaling during a call control procedure, this signaling allowing the exchange to associate the EU IMSI at the open session.

When the RAN 20 detects a malfunction of the UE 30 during the session, it alerts the switch in a STATUS_REPORT message having fields containing: - the subscriber IMSI, which is known to the RNC 22;

- a "CAUSE" indication of the type of malfunction detected;

- an indication "NSV" of the level of severity of dysfunction detected.

This STATUS_REPORT message can be integrated into the radio access network application protocol (RANAP, “Radio Access Network Application Part”), defined on the interface read (Figure 3). This RANAP protocol is described in the technical specification 3G TS 25.413, version 3.1.0 published in December 1999 by 3GPP.

On receipt of this STATUS_REPORT message, the switch 11 or 12 interrogates the UE (message IDENTIFICATION_REQUEST) to request its IMEI, which is returned by the UE in the response message IDENTIFICATION_RESPONSE. These IDENTIFICATION_REQUEST and IDENTIFICATION_RESPONSE messages belong to the mobility management protocols (MM, “Mobility Management” for circuit mode and GMM, “GPRS MM” for packet mode), and are relayed transparently by the RAN 20, as shown Figure 3.

The switch 11 or 12 then sends an update command to the database 15 (message UPDATE), supplying the IMEl and the IMSI of the mobile station 30, as well as the indications CAUSE and NSV. The UPDATE message is acknowledged and a record is created in the database 15 with the IMEI, IMSI, CAUSE and NSV data.

This UPDATE message can be integrated into the mobility application protocol (MAP, “Mobile Application Part”) described in the technical specification 3G TS 29.002, version 3.4.0 published in April 1999 by 3GPP. If the CMC is confused with an EIR, the interface F 'between the MSC and the CMC can consist of the standardized interface F between the MSC and the EIR, and the interface Gf between the SGSN and the CMC may consist of the standardized Gf interface between the SGSN and the EIR. Otherwise, these interfaces F 'and Gf' can be produced in a similar manner to the standardized interfaces F and Gf.

The management of the CMC 15 database by the cellular network operator can include one or more of the following actions:

1 / send a message to the holder of a defective terminal to report the problem and / or invite him to come and change his terminal. This can in particular be done by means of a short message server 16

(SMS: "Short Message Service") present in the core network 10. If this is not done upon receipt of the alert message, the IMSI is retrieved from database 15 and before sending the message Warning, the switch queries the UE again to verify that there is still the same IMEI / IMSI association. Otherwise, the warning message is not sent. 2 / prevent the UE whose terminal is registered in the database 15 from communicating via the RAN 20.

This can be done by ending the current session with the EU. The switch can also register the IMEl of the defective terminal in the HLR 14, in conjunction with the IMSI appearing in the database 15. In this case, when a network service is required for the subscriber in question, the MSC or SGSN interrogates the UE to obtain its IMEI and to determine whether the subscriber is still using his faulty terminal identified in the HLR. If so, the service may be refused.

3 / report to manufacturers of defective terminal lots, identified according to the IMEIs listed in the CMC 15.

These actions can be selected or modulated according to the CAUSE and / or NSV parameters found in the records, or according to the number of records of which a given IMEI has been the subject of in the CMC 15. According to a variant of embodiment in which there is not necessarily a register of defective terminals, the reception of the message ID_RESPONSE by the switch triggers the recording in the HLR of the IMEl of the defective terminal in relation to the associated IMSI.

Then, in the processing of a registration request (IMSI_ATTACH) received through the radio access network 20 from a UE 30 identified by this

IMSI, the HLR will ask switch 11 or 12 to interrogate this UE in order to to get his IMEI. The IMEl thus recovered is compared to that stored in the HLR, and in the event of a match, one of actions 1 / and 2 / above can be performed, namely to warn the subscriber that he is using a terminal whose the network has detected malfunctions or rejected the registration request to prevent the EU from communicating via the RAN 20.

A malfunction of mobile terminals which is of particular importance for cellular operators is that of excessive transmission power. This problem can indeed disrupt communications involving other subscribers. UMTS standards provide for regulation of the transmit power of terminals, but a faulty terminal may not follow this regulation.

Such a malfunction is detectable in the access network 20 from the power control loops.

This power control is supervised by the RNC 22 module which is responsible for the radio resource control protocol (RRC, "Radio

Resource Control ”). This defines a signal-to-interferer ratio setpoint (SIR _target ), which it communicates to node B 21 serving the UE 30. The node B evaluates whether the signal-to-interferer ratio (SIR, “Signal- to-lnterferer

Ratio ”), measured by the channel equalizer in the physical layer (PHY), is higher or lower than the SIR _target setpoint, and therefore commands the UE to decrease or increase its transmit power (see technical specification 3G TS 25.214, version 3.1.1 published in December 1999 by the 3GPP). This regulation between node B and the UE is called an internal loop. It is relatively fast since the UE can take into account a command to decrease or increase power every 0.666 ms. The values of SIR estimated by node B 21 are fed back to RNC 22 which uses them to adjust the value of SIR _target in a slower external loop (technical specification 3G TS 25.331 on the RRC layer, version 3.2.0 published in March 2000 by 3GPP). The UTRAN 20 uses a code division multiple access (CDMA) technique, according to which a communication channel between a base station 21 and a mobile station 30 is defined by a code d spreading modulating the sequence of information symbols to be transmitted. The orthogonality of the different spreading codes allows the receiver to extract the signal intended for it. Power control is performed code by code. The measurements made by the UEs and the B nodes are detailed in the technical specification 3G TS 25.215, version 3.2.0 published in March by the 3GPP:

- the UTRAN_code_power parameter, measured by node B, represents the power transmitted by the base station to the EU on a given code. The RRC protocol allows the RNC to have this measurement transmitted;

- the parameter CPICH_RSCP, measured by the UE, represents the power received by the UE from the base station on a pilot code. The RRC protocol allows the RNC to have this measurement transmitted; - the UE_TX_power parameter, measured by the UE, represents the power emitted by the UE. The RRC protocol also allows the RNC to have this measurement transmitted;

- the RSCP (“Received Signal Code Power”) parameter, measured by node B, represents the power received by the base station from the UE on a code;

- the ISCP (“Interference Signal Code Power”) parameter, measured by node B, represents the interference power received by the base station on a code.

In the current state of the specifications with regard to UMTS in frequency duplex mode (FDD), the RSCP and ISCP powers are measured by node B, but are not reported to the RNC (the value reported in the external loop is the SIR, given by (RSCP / ISCP) χSF, where

SF is the channel spreading factor). We can therefore plan to enrich the signaling on the Iub interface (3G TS 25.433 technical specification, version 3.1.0 published in December 1999 by the 3GPP) so that node B also upgrades the RSCP and ISCP powers. A corresponding modification can be made on the lur interface in the case where the node B serving the terminal is not directly connected to the RNC where the RRC task (SRNC) is executed. The SRNC can then estimate the power PE emitted by the UE, given by: PE = RSCP - (CPICH_RSCP - UTRAN_code_power)

Otherwise, it can be based on the value PE '= UE_TX_power that the UE transmits to it in the RRC layer.

With the RSCP and ISCP powers and the SIR _target setpoint it has assigned to node B, the RNC can estimate the transmit power control bits (TPC, “Transmit Power Control”) which are supplied by node B to the EU. By filtering these TPC bits, the RNC 22 can determine whether node B is in a phase where it requests the terminal to decrease or increase its transmission power, on average. By observing the evolution of the parameter PE (or PE ') and by comparing it with the estimated TPC bits, possibly filtered, the RRC layer can detect terminals which do not respond adequately to power control. For example, if the UE receives for a certain time (for example of the order of a few seconds) the instruction to lower its transmission power and if nevertheless the estimated transmission power PE does not decrease or continues to increase , the RNC can diagnose that the power regulation is not working well in the terminal.

As a variant, node B could send the RSCP parameter and the TPC bits supplied to the UE back to the RNC (or a filtered value of these TPC bits).

In the case where the UE communicates in macrodiversity with several base stations, the above detection proceeds by combining the TPC bits estimated for the different stations. A malfunction can thus be diagnosed if the UE receives for a certain time from each of the base stations the instruction to lower its transmission power and if nevertheless the estimated transmission power PE does not decrease or continues to increase. The decision to classify a defective terminal in terms of transmission power could also be taken at the level of nodes B.

Other types of terminal malfunctions can be detected by the RAN. In particular, the terminal may have problems in the implementation of one or more of the protocols used on the Uu interface, such as the layer 2 protocols RLC ("Radio Link Control") and MAC ("Medium Access Control") ). These protocols are respectively described in the technical specifications 3G TS 25.322, version 3.2.0 and 3G TS 25.321, version 3.3.0 published in March 2000 by 3GPP. The RNC 22, which comprises the RLC and MAC modules in relation to those present in the UE 30 (FIG. 3), can detect protocol errors such as for example erroneous formats in the protocol data units (PDU) transmitted by the EU.

Protocol errors can also be detected in the RRC protocol. For example, a faulty terminal may ignore or misinterpret instructions from the RNC to adopt given states or configurations. The RNC will then note the inability of the EU to behave in accordance with the expected state. The RNC can still detect UEs which make excessive use of radio resources shared with other mobile stations, such as for example common channels provided for random network accesses.

Claims

1. Cellular radiocommunication system comprising on the one hand a core network (10) comprising switches (11-13) and subscriber management means (14), and on the other hand at least one access network radio (20) connected to at least one switch of the core network and comprising base stations (21) capable of communicating by radio with mobile stations (30), each mobile station comprising a terminal (31) associated with a module subscriber identification (32), in which the core network comprises means for interrogating a mobile station through the access network in order to obtain an identity of the terminal of the interrogated mobile station, characterized in that the access network includes means for detecting malfunctions of mobile stations, for sending an alert message to the core network identifying a mobile station for which a malfunction has been detected, and in that the interrogation means are controlled to interrogate a mobile station in order to obtain the identity of its terminal in response to the reception of an alert message identifying said mobile station.

2. The system as claimed in claim 1, in which the core network (10) comprises at least one faulty terminal database (15) containing records relating to terminals (31) whose identity has been obtained by the means interrogation in response to the receipt of an alert message.

The system of claim 2, wherein the alert message includes a subscriber identity to identify the mobile station (30), and said subscriber identity is included in the registration of the faulty terminal database (15) relating to the terminal (31) whose identity is obtained by the interrogation means in response to the reception of said alert message.

4. The system as claimed in claim 2 or 3, in which the alert message includes an indication of the type of detected malfunction, and said indication of type is included in the recording of the database of defective terminals (15) relating to the terminal (31) whose identity is obtained by the interrogation means in response to the reception of said alert message.

5. System according to any one of claims 2 to 4, in which the alert message includes an indication of severity level of the detected malfunction, and said indication of severity level is included in the recording of the database. defective terminals (15) relating to the terminal (31) whose identity is obtained by the interrogation means in response to the reception of said alert message.

6. System according to any one of claims 2 to 5, in which the core network (10) comprises means (16) for sending a warning message, through the radio access network (20), to at least one mobile station (30) whose terminal (31) is registered in the database of defective terminals (15).

7. System according to any one of claims 2 to 6, in which the core network (10) comprises inhibiting means to prevent at least one mobile station (30) whose terminal (31) is the subject of registration in the faulty terminal database (15) to communicate via the radio access network (20).

8. System according to any one of the preceding claims, in which the subscriber management means comprise at least one subscriber database (14) respectively containing records relating to the subscriber identification modules (32), and wherein the terminal identity obtained by the interrogation means in response to the reception of an alert message identifying a mobile station (30) is included in the registration of the subscriber database relating to the module subscriber identification of said mobile station.

9. The system of claim 8, wherein the subscriber management means (14) are arranged to process registration requests received from mobile stations through the radio access network (20), the processing of a registration request comprising, for a mobile station (30) comprising a subscriber identification module (32) whose registration in the subscriber database includes a defective terminal identity, a control interrogation means for interrogating said mobile station in order to obtain the identity of its terminal, and a comparison between the terminal identity thus obtained and said defective terminal identity.

10. The system as claimed in claim 9, in which the subscriber management means (14) are arranged to control the sending of a warning message to said mobile station (30) through the radio access network ( 20) when said comparison reveals identical terminal identities.

11. The system of claim 9 or 10, wherein the subscriber management means (14) are arranged to reject the registration request when said comparison reveals identical terminal identities.

12. System according to any one of the preceding claims, in which the malfunction detection means comprise means for detecting implementation errors, by a mobile station, of communication protocols used between the radio access network (20 ) and mobile stations (30).

13. System according to any one of the preceding claims, in which the malfunction detection means comprise means for detecting excessive use, by a mobile station, of radio resources shared with other mobile stations.

14. System according to any one of the preceding claims, in which the means for detecting malfunctions include means for monitoring the power transmitted by the mobile stations (30).

15. The system as claimed in claim 14, in which the radio access network (20) uses a code division multiple access technique according to which a communication channel between a base station and a mobile station is defined by a code. respective spreading, the access network comprising radio network controllers connected to switches of the core network, which supervise the base stations and ensure the control of the radio resources in the access network,

16. Core network for cellular radiocommunication system, comprising switches (11 -13) and subscriber management means (14), the switches being connected to at least one radio access network (20) comprising base stations (21) capable of communicating by radio with mobile stations (30), each mobile station comprising a terminal (31) associated with a subscriber identification module (32), the core network (10) comprising means for interrogating a mobile station through the access network to obtain an identity of the terminal of the interrogated mobile station , characterized in that the interrogation means are controlled to interrogate a mobile station in order to obtain the identity of its terminal in response to the reception of an alert message identifying said mobile station.

17. The core network according to claim 16, further comprising at least one faulty terminal database (15) containing records relating to terminals (31) whose identity has been obtained by the means of interrogation in response. upon receipt of an alert message.

18. Radio access network for cellular radiocommunication system, comprising base stations (21) capable of communicating by radio with mobile stations (30) and radio network controllers (22) connected to switches (11, 12) d '' a core network, which supervises the base stations and ensures the control of radio resources in the access network (20), characterized in that it includes means for detecting malfunctions of mobile stations, for addressing to the core network (10) an alert message identifying a mobile station for which a malfunction has been detected.