X xx October 15 1 Notice QUALCOMM Incorporated grants a free, irrevocable license to 3GPP2 and its Organizational Partners to incorporate text or other copyrightable material contained in the contribution and any modifications thereof in the creation of 3GPP2 publications; to copyright and sell in Organizational Partner’s name any Organizational Partner’s standards publication even though it may include all or portions of this contribution; and at the Organizational Partner’s sole discretion to permit others to reproduce in whole or in part such contribution or the resulting Organizational Partner’s standards publication. QUALCOMM Incorporated is also willing to grant licenses under such contributor copyrights to third parties on reasonable, non-discriminatory terms and conditions for purpose of practicing an Organizational Partner’s standard which incorporates this contribution. This document has been prepared by QUALCOMM Incorporated to assist the development of specifications by 3GPP2. It is proposed to the Committee as a basis for discussion and is not to be construed as a binding proposal on QUALCOMM Incorporated. QUALCOMM Incorporated specifically reserves the right to amend or modify the material contained herein and nothing herein shall be construed as conferring or offering licenses or rights with respect to any intellectual property of QUALCOMM Incorporated other than provided in the copyright statement above. Title:Femto Cell Support for Emergency Services in CDMA 1X Networks Source:Kirk Burroughs and Stephen Edge QUALCOMM Incorporated, TCS {kirkb, Date:September 29 th, 2008 Recommendation:Review and Adopt

X xx Emergency Services Network Reference Model Base Station location (latitude/longitude) and serving cell ids are provisioned in the Call Routing DB (CRDB) and Base Station Almanac (BSA) to support call routing and geopositioning Key BSA – Base Station Almanac CRDB – Call Routing DB MPC – Mobile Positioning Center PDE – Position Determination Entity PSAP – Public Safety Answering Point

X xx Emergency Services Call Flow

X xx Femto Cell Architectural Assumptions  Legacy 1X mobile stations shall be supported  Femto Cells will not have pre-provisioned serving cell IDs and locations in the CRDB / BSA  If such data could be reliably provisioned in the CRDB / BSA then no special work would be required  Femto Cells’ locations are known to the “Femto Cell System”  This is necessary to ensure they only operate in properly licensed spectrum  Locations could be obtained after a Femto cell powers up and might be periodically re-obtained thereafter to improve accuracy and detect movement  Locations can be stored in the Femtocell and possibly in the OAM&P center and/or MAP Femto Interworking Function (MFIF)

X xx Femto Cell Network Reference Model – extended for Emergency Services

X xx MFIF / Femto Cell IDs – MSC ID and Serving cell ID  The MFIF is assigned its own unique MSC ID to support X.S0002 interactions  Each Femtocell is assigned a serving cell ID after initialization (i.e. after powering on and being successfully authenticated and authorized)  The serving cell ID is associated with the MFIF MSC ID and used for 1x access  The serving cell ID is generally not provisioned in the CRDB or BSA

X xx Femto Cell Emergency Services Call Routing  Problem: For a macrocell, emergency services call routing is based on a CRDB lookup using the MSC ID and serving cell ID  For a emergency services call from a Femto cell, this approach fails as the MSC ID / serving cell ID is not provisioned in the CRDB  Solution: To route an emergency services call from a Femto, the Femto geographic location can be used  This implies the need for a geographic CRDB to determine the PSAP  PSAP selection could occur either (a) when the Femto location is first determined (e.g. at Femto initialization) or (b) when an emergency services call occurs  (b) is proposed because It is already defined as an option in J-STD-036B (e.g. needed signaling is already defined) once a geographic CRDB is supported for Femtos, the same CRDB can be used later to improve routing for emergency services calls from macrocells via interim positioning (another option in J-STD-036) without much additional impact It avoids the need to complicate Femto initialization which now only needs location to authorize Femto transmission in a licensed carrier area It enables operator control of PSAP routing – e.g. avoids vendor specific routing support via O&M at Femto initialization It allows Femto location to be verified again at the time of an emergency services call for cases where the initial Femto location may have changed or may not be reliable (e.g. where an initially coarse location estimate was accurate enough to authorize Femto transmission but not accurate enough to determine a PSAP)

X xx Femto Emergency Services Call Flow A – Femto Location is dispatch accurate and reliable

X xx Emergency Services Call Flow A Steps  Step a: Femto receives a 1x Emergency Services call from the MS  Step b: Femtocell forwards the Emergency Services call request to the MFIF (e.g. in a SIP INVITE) and includes the MSID, MEID/ESN, GEO_LOC_TYPE, and serving cell ID.  Step c: The MFIF sends an X.S0002 Origination Request (ORREQ) to the MPC including the MSID, MEID/ESN, MSC ID, MPCAP, and serving cell ID received in step a.  Step d: The MPC determines the call is from a Femto either by recognizing the MFIF MSC ID or by querying the serving cell ID in the CRDB (e.g. serving cell ID not found or found with a Femto indication). The MPC then, based on the position capabilities of the MS, sends a Geo Position Request (GPOSREQ) to a PDE containing these capabilities (MPCAP) and the MSID, MEID/ESN, MSC ID and serving cell ID received in step c. The MPC indicates that an initial position is required.  Step e: The PDE determines the call is from a Femto either by recognizing the MFIF MSC ID or by querying the serving cell ID in the BSA (e.g. serving cell ID not found or found with a Femto indication). If the serving cell ID is found in the BSA and the associated location is considered reliable (e.g. was updated in the BSA recently due to a previous Femto location request), the PDE may proceed to step i. The PDE sends an SMS Delivery Point to Point (SMDPP) message to the MFIF containing an C.S0022 positioning PDMM and the MSID, MEID/ESN and serving cell ID received in step d. The C.S0022 PDDM minimally requests the already known Femto location. The PDE also indicates Base Station Location in the Service Indicator parameter using a new X.S0002 value.  Step f: The MFIF recognizes the X.S0002 Base Station Location value for the Service Indicator and, as a result:  Either 1) sends the contents of the SMDPP message received in step e to the Femtocell inside a Femto Location Request message (or some other suitable message). The MFIF determines the Femtocell from the serving cell ID or MSID received in step e.  Or 2) if the MFIF has the Femto location, it can create the Femto C.S0022 response that is otherwise originated in step g and proceed to step h.  Step g: the Femto returns a Location Response to the MFIF carrying the MSID, ESN/MEID and serving cell received in step f. The Femto also includes an C.S0022 response. If the Femto does not support C.S0022, it returns a standard (fixed format) C.S0022 unsolicited response containing the already known Femto location. If the Femto does support C.S0022, it returns the correct C.S0022 response containing its known location or some equivalent (e.g. measurements from which the PDE can determine location) The Femto location may comprise the precise coordinates of the Femto and the uncertainty of these coordinates – e.g. expressed using a circle, ellipse or 3D ellipsoid geographic shape. The uncertainty may be modified to include the wireless coverage area of the Femtocell and thereby indicate the possible locations of the MS.  Step h: the MFIF forwards the Femto response to the PDE in an SMDPP message.  Step i: The PDE may optionally instigate further steps similar to e, f, g and h if the Femto location was not provided in step h but the Femto supports C.S0022 – e.g. the PDE could invoke AFLT using C.S0022 to obtain the Femto location. The PDE then returns the Femto location to the MPC. The PDE may also update the BSA with the Femto location for use in some subsequent location request.  Step j: the MPC uses the CRDB to determine the correct PSAP for the location received in step i. The MPC assigns an ESRK or determines the ESRD for the selected PSAP. The MPC returns the ESRK or ESRD to the MFIF.  Step k: The MFIF routes the call to the PSAP based on the received ESRD or ESRK  Step l: The PSAP determines the MPC from the ESRK or ESRD received in step k and sends an Emergency Services Position Request (ESPOSREQ) to the MPC containing the ESRK or the ESRD + MDN  Step m: The MPC determines that the position received in step i is accurate enough to provide to the PSAP as the initial MS location and returns it to the PSAP.

X xx Femto Emergency Services Call Flow B Part 1 – Femto Location is not dispatch accurate or not reliable

X xx Femto Emergency Services Call Flow B Part 2 – Femto Location not dispatch accurate or not reliable

X xx Emergency Services Call Flow B Steps – Part 1  Step a: Femto receives a 1x Emergency Services call from the MS  Step b: Femtocell forwards the Emergency Services call request to the MFIF (e.g. in a SIP INVITE) and includes the MSID, MEID/ESN, GEO_LOC_TYPE, and serving cell ID.  Step c: The MFIF sends an X.S0002 Origination Request (ORREQ) to the MPC including the MSID, MEID/ESN, MSC ID, MPCAP, and serving cell ID received in step a.  Step d: The MPC determines the call is from a Femto either by recognizing the MFIF MSC ID or by querying the serving cell ID in the CRDB (e.g. serving cell ID not found or found with a Femto indication). The MPC then, based on the position capabilities of the MS, sends a Geo Position Request (GPOSREQ) to a PDE containing these capabilities (MPCAP) and the MSID, MEID/ESN, MSC ID and serving cell ID received in step c. The MPC indicates that an initial position is required.  Step e: The PDE determines the call is from a Femto either by recognizing the MFIF MSC ID or by querying the serving cell ID in the BSA (e.g. serving cell ID not found or found with a Femto indication). If the serving cell ID is found in the BSA and the associated location is considered reliable (e.g. was updated in the BSA recently due to a previous Femto location request), the PDE may proceed to step i. The PDE sends an SMS Delivery Point to Point (SMDPP) message to the MFIF containing an C.S0022 positioning PDMM and the MSID, MEID/ESN and serving cell ID received in step d. The C.S0022 PDDM minimally requests the already known Femto location. The PDE also indicates Base Station Location in the Service Indicator parameter using a new X.S0002 value.  Step f: The MFIF recognizes the X.S0002 Base Station Location value for the Service Indicator and, as a result:  Either 1) sends the contents of the SMDPP message received in step e to the Femtocell inside a Femto Location Request message (or some other suitable message). The MFIF determines the Femtocell from the serving cell ID or MSID received in step e.  Or 2) if the MFIF has the Femto location, it can create the Femto C.S0022 response that is otherwise originated in step g and proceed to step h.  Step g: the Femto returns a Location Response to the MFIF carrying the MSID, ESN/MEID and serving cell received in step f. The Femto also includes an C.S0022 response. If the Femto does not support C.S0022, it returns a standard (fixed format) C.S0022 unsolicited response containing the already known Femto location. If the Femto does support C.S0022, it returns the correct C.S0022 response containing its known location or some equivalent (e.g. measurements from which the PDE can determine location). The Femto location may comprise the precise coordinates of the Femto and the uncertainty of these coordinates – e.g. expressed using a circle, ellipse or 3D ellipsoid geographic shape. The uncertainty may be modified (e.g. by the Femto) to include the wireless coverage area of the Femtocell and thereby indicate the possible locations of the MS.  Step h: the MFIF forwards the Femto response to the PDE in an SMDPP message.  Step i: The PDE may optionally instigate further steps similar to e, f, g and h if the Femto location was not provided in step h but the Femto supports C.S0022 – e.g. the PDE could invoke AFLT using C.S0022 to obtain an approximate location. Assuming the Femto location is accurate enough for routing but not for emergency services dispatch, the PDE returns the Femto location to the MPC in an Geo Position Directive (GPOSDIR), as defined in J-STD-036B for support of interim location. The PDE may also update the BSA with the Femto location for use in some subsequent location request.  Step j: the MPC acknowledges the GPOSDIR.  Step k: the MPC uses the CRDB to determine the correct PSAP for the location received in step i. The MPC then assigns an ESRK or determines the ESRD for the selected PSAP. The MPC returns the ESRK or ESRD to the MFIF.  Step l: The MFIF routes the call to the PSAP based on the received ESRD or ESRK

X xx Emergency Services Call Flow B Steps – Part 2  Step m: The PSAP determines the MPC from the ESRK or ESRD received in step l and sends an Emergency Services Position Request (ESPOSREQ) to the MPC containing the ESRK or the ESRD + MDN  Step n: if the Femto supports C.S0022 (e.g. if the PDE received an C.S0022 response or Provide MS Info message or any other C.S0022 message in step h that was not an unsolicited response), the PDE may obtain an accurate location for the Femto by instigating steps similar to steps e, f, g and to h for a new C.S0022 session in which accurate positioning is used by the Femto – e.g. A-GPS and/or AFLT. If the resulting position is accurate enough, the PDE may skip steps o to t and proceed to step u. If steps o to t are performed, they may occur after step n, before step n or in parallel to step n.  Step o: if step n was not performed or if the Femto location resulting from step n may not be accurate enough, or if the PDE needs to obtain both the position of the femto cell and the MS then the PDE may instigate an C.S0022 positioning session with the MS based on the positioning capabilities (MPCAP) received from the MPC in step d. The PDE begins by transferring an C.S0022 message to the MFIF in an SMS Delivery Point to Point (SMDPP) message which also carries the MSID, ESN/MEID and serving cell ID received in step d. A Service Indicator is also included that indicates CDMA Positioning as defined in J-STD-036B.  Step p: The MFIF recognizes the CDMA Positioning value for the Service Indicator and, as a result, sends the contents of the SMDPP message received in step o to the Femtocell inside an SMS associated message. The MFIF determines the Femtocell from the serving cell ID or MSID received in step o. The MFIF should verify that the MS is still served by the Femtocell with the indicated serving cell ID. If that is not the case (e.g. call forwarding has occurred), the MFIF forwards the SMS message (not shown) to either the new Femtocell if call forwarding occurred to a new Femtocell supported by this MFIF or to the new serving MSC or new serving MFIF if call forwarding was to a new macrocell or new Femtocell not supported by this MFIF, respectively.  Step q: the Femto forwards the C.S0022 message received in step o to the MS in a 1x Data burst message.  Step r: the MS performs any positioning that may have been requested in the C.S0022 message and returns an C.S0022 response to the Femtocell in a 1x Databurst message. The response provides any positioning measurements or positioning related information that were requested by the PDE plus a possible request for information and assistance data from the PDE.  Step s: the Femto forwards the C.S0022 message to the MFIF together with the MSID, ESN/MEID and serving cell.  Step t: Part 1: the MFIF forwards the C.S0022 message to the PDE in an SMDPP message which carries the MSID, ESN/MEID and serving cell received in step s and the MSC ID and a service indicator set to a value indicating CDMA Positioning. Part 2: the PDE may instigate further steps similar to steps o, p and q to request more information and/or measurements from the MS using C.S0022 and the MS may instigate further steps similar to steps r, s and part 1 of t to provide further measurements and information to the PDE and request further information (e.g. assistance data) from the PDE using C.S0022.  Step u:. once steps n to t are completed, the PDE determines the MS location using any location results obtained for the MS in steps o to t and/or any location obtained for the Femto in step n and/or steps e to h. For example, the Femto location obtained in step n and/or in steps e to h may be used to help validate the MS location obtained in steps o to t or vice versa. In addition, the various location results may be combined – e.g. may be averaged The resulting MS location is returned to the MPC in a GPOSREQ return result.  Step v: The MPC returns the location estimate to the PSAP

X xx Location of Femtocells at Initialization and at Periodic Intervals  Initial location could be obtained in association with OAM&P as part of Femto authorization following power on and authentication – e.g. to ensure that the Femto is located in a licensed operator area  At periodic intervals, location can be updated to improve accuracy (e.g. reduce earlier errors) and detect any movement of the Femto  Initial and updated location can be obtained using one or more of the following  A GPS receiver in the Femto  Observed macrocells, Femtocells and/or WiFi access points whose locations are known by OAM&P  Subscription address for the user  Public IP address assigned to the Femto by the access provider (e.g. cable or DSL provider)  A location or address entered by the user on the Femto  MT C.S0022 Procedure in association with A-GPS and/or AFLT positioning in the Femto  MT C.S0022 Procedure  Only applicable for Femtos that support C.S0022 and A-GPS and/or AFLT  Can use the same C.S0022 procedure defined for Call Flows A and B – e.g. no extra implementation required in the Femto and reduced impacts in the MFIF and PDE

X xx MT C.S0022 Procedure for Femto Location

X xx Femto MT C.S0022 Procedure Steps  Step a: Femto sends a location request to the MFIF and provides its C.S0022 location capabilities (A-FLT and/or A-GPS), its MEID and serving cell ID.  Step b: The MFIF emulates an MPC and sends a Geo Position Request (GPOSREQ) to a PDE carrying the MPCAP and MSC ID and the Femto MEID and serving cell ID received in step a. The Position Request Type parameter carries a new X.S0002 value indicating Femto location.  Step c: The PDE recognizes the request for Femto location from the Position Request Type value. The PDE starts an C.S0022 session with the Femto by sending an SMS Delivery Point to Point (SMDPP) message to the MFIF containing an C.S0022 positioning PDDM and the Femto MEID and serving cell ID. The C.S0022 PDDM can instigate AFLT and/or A-GPS positioning.. The PDE also indicates Base Station Location in the Service Indicator using a new X.S0002 parameter value.  Step d: The MFIF recognizes the Base Station Location value for the Service Indicator and, as a result, sends the contents of the SMDPP message received in step c to the Femtocell inside a Femto Location Request message (or some other suitable message). The MFIF determines the Femtocell from the serving cell ID or Femto MEID received in step c.  Step e: the Femto performs whatever positioning measurements were requested by the PDE in the C.S0022 message received in step d and returns a Location Response to the MFIF carrying the Femto MEID and serving cell ID. The Femto also includes an C.S0022 response. The response provides any positioning measurements and/or positioning related information results requested by the PDE.  Step f: the MFIF forwards the C.S0022 response to the PDE in an SMDPP message.  Step g: the PDE may optionally instigate further steps similar to steps c and d to request more information and/or measurements from the Femto using C.S0022 and the Femto may instigate further steps similar to steps e and f to provide further measurements and information to the PDE and request further information (e.g. assistance data) from the PDE using C.S0022. The PDE then returns the calculated Femto location to the MFIF. The location estimate might be encrypted and/or digitally signed by the PDE using a key known to OAM&P but not known to the Femtocell and possibly using other key related data (e.g. current date and time and Femto MEID) to prevent spoofing using either old location results or results for other Femtos. Alternatively, the location may be unciphered and unsigned. The PDE may also update the BSA with the Femto location for use in some subsequent location request. Alternatively, the Femto location may be updated in the BSA by OAM&P following step h.  Step h: The MFIF returns the location estimate to the Femtocell. The Femtocell may then provide the location estimate to OAM&P. If the location estimate was encrypted and/or digitally signed, OAM&P can decrypt it and/or authenticate it and thereby verify that the location was obtained for this Femto by the PDE. This will prevent spoofing of location by a third party with access to the Femtocell. In addition, for later provision of a location estimate to a PDE for an emergency services call (e.g. where the PDE did not store the Femto location in the BSA), the original encrypted and/or digitally signed location can be used to enable the PDE to authenticate it.

X xx Geolocation following Handoff  The geolocation procedures in emergency call Flows A and B are applicable to handoff situations as follows:  A. For emergency call Femto origination and subsequent handoff to a macrocell  The MPC still obtains the location of the originating Femtocell (e.g. Call Flows A for the origination)  The originating Femto location (including macro cell location) can be used for both routing and as an initial location for dispatch  After handoff to a macrocell, the MPC and PDE should obtain the location of the MS rather than the Femto using the appropriate Inter-MSC update procedures (J-STD-036 figure 4-11 or figure 4-21)  B. For emergency call Macrocell origination and subsequent handoff to a Femtocell  The emergency call can be routed using the original macrocell serving cell ID  For accurate initial and updated macro location, the PDE can instigate a normal C.S0022 geolocation session with the MS  After handoff to a femtocell, the MPC should initiate appropriate inter-MSC update procedures. The new serving Femtocell may be used as the MS location or the MPC may initiate C.S0022 geolocation procedures  C. For emergency call Femto origination and subsequent handoff to another Femto  The PDE still obtains the location of the originating Femtocell (e.g. Call Flow A)  The originating Femto location can be used for both routing and as an initial location for dispatch  After handoff to another femtocell, the MPC should initiate appropriate inter-MSC update procedures. The new serving Femtocell may be used as the MS location or the MPC may initiate C.S0022 geolocation procedures