1. MS Resident User Plane LBS Roaming Summary LBS Roaming Summit – Denver Jan 18 2007 Export of this technology may be controlled by the United States Government. Diversion contrary to U.S. law prohibited. QUALCOMM Incorporated 5775 Morehouse Drive San Diego, CA 92121-1714 U.S.A. Copyright © 2006 QUALCOMM Incorporated. All rights reserved.

2. Jab 2007 Page 2 Contents Summary of Trusted User Plane Roaming Options Summary of Non-trusted User Plane Roaming Options Summary of Roaming Between Trusted, Nontrusted, and Proprietary Architectures LBS Roaming summary matrix

3. Jab 2007 Page 3 Summary Of Trusted Model Roaming Options The chart below discusses the various roaming options for MS Resident Trusted user plane The trusted roaming options below are discussed in detail in document 80- VC718 – E. This document can be found on the LBS WiKi page CDG IRT: http://210.54.118.1/wiki/LBS_Roaming_Documents http://210.54.118.1/wiki/LBS_Roaming_Documents

4. Jab 2007 Page 4 Summary Of Trusted Model Roaming Options (Cont.) The details and Pros and Cons analysis for all the user plane LBS roaming options was done in previous LBS Roaming summit meetings in Chicago and San Francisco Based on the discussions in previous meetings certain options such as IP Redirection were dropped, and general consensus was built around the following 3 options: – Sharing BSAs »In this option the BSA information of Visited network resides in the H-PDE. This solution is straightforward and it does not need any protocol or infrastructure changes. – DNS »For this option a new LBS roaming solution is needed – PDE interconnection using an IS-801 Transaction Based Service. »For this option a new LBS roaming protocol is needed

5. Jab 2007 Page 5 IS-801 Transaction-Based Service On Inter-PDE Connection Home operator Visited operator Network connection AAA RAN PDSN PCF AAA RAN PDSN FA H-PDE HA V-PDE IS-801 traffic H-PDE detects the MS is roaming and sends IS-801 primitive service requests to V-PDE. RPC-like interface Internet Internet RPC-like interface that enables a transaction-based service MIP/L2TP tunnel The roaming MS always goes to its H-PDE The H-PDE sends transaction requests to the V-PDE on as needed basis to service the IS-801 call flow between the MS and H-PDE The H-PDE detects that the MS is roaming based on SID/NID information in IS-801 messages. The SID/NID information is present in the following:  Unsolicited Provide Systems Parameters Info message  Unsolicited Provide PPM message PCF

6. Jab 2007 Page 6 Pros And Cons Analysis Pros For this solution, LBS devices will work the same in both roaming and nonroaming scenarios Carriers do not need to share BSAs Carriers do not need to share their PDE IP/port numbers; MS always connects to the Home PDE assuming data roaming works; V-PDE needs to provide only one IP/port per carrier Operator retains complete control since the Home LBS system continues to act as an IS-801 end-point, and Home LBS system is always used to provide the location application controls: – Security and authentication – User privacy – Billing Cons Multiple short sessions may be consumed on V-PDE for one session on H-PDE Development work on PDE is needed for location transaction service requests/response exchange between the H-PDE and V-PDE Nominal latency will be added due to the transaction request/response exchange There may be scalability issues on H-PDE as number of roaming partners increase; H-PDE will need to maintain SID/NID tables for each roaming partner

7. Jab 2007 Page 7 Proposed DNS Solution Illustration MS receives SID value from radio network MS creates LBS specific SID-based DNS FQDN (SID.Local.PDE) MS resolves DNS FQDN to V-PDE IP address via DNS server MS accesses V-PDE PDSN IP address = 66.3.3.34 Visited Operator V-PDE DNS SID=10856 URL=10856.Local.PDE 10856.Local.PDE = 66.3.3.34 IS-801- 1

8. Jab 2007 Page 8 DNS Solution with Mobile IP or L2TP Roaming Internet Internet Home Operator RAN PDSN PCF Visited Operator PDSN/FA/LAC H-DNS Server HA/LNS V-PDE BSA V-DNS Server IS-801 signaling Network connection MIP/L2TP tunnel Many roaming implementations use Mobile IP or L2TP Industry direction is Mobile IP (CDG resolution) In these cases, data traffic is tunneled back to the home operator H-DNS server or V-DNS server might be used (inconsistent between implementations) MS accesses V-PDE from home operator (security issue?)

9. Jab 2007 Page 9 PROs And CONs Analysis PROS No PDE changes required Provisioning of DNS information is relatively minor If no MS changes required, then DNS solution is fastest to market CONS MS Behavior – Can MS/application use network broadcast information to create a DNS FQDN? – Need to verify with application/handset/chipset providers – If new MS behavior is required: »Long delay in getting new MS behavior implemented »Issue with legacy mobiles Inconsistent MS access of DNS server (home vs. visited) – In some roaming implementations, visited operator DNS accessed – In some roaming implementations, home operator DNS accessed

10. Jab 2007 Page 10 PROs And CONs Analysis CONS (Cont.) V-PDE Port Issue – Could require significant coordination and configuration »Some LBS applications are configured to require PDE access via a unique port. For the DNS solution, these applications will try and access the V-PDE via this unique port number » The V-PDE must be configured to accept connections for roaming MS applications on these particular ports. There could be ongoing operational requirements to reconfigure the V-PDE as new applications come on line LBS and DNS server operational considerations – LBS operations usually separate from DNS operations. Requires significant coordination between two separate groups Security issues – Operators must expose PDEs directly to roaming mobiles. If Mobile IP or L2TP used, there are additional security issues »Must expose PDE to all mobiles serviced by home operator HA/LNS »This includes non-roaming mobiles in the home operator network No home operator awareness of V-PDE access – No home operator logging possible. Hinders any financial settlement process between operators

11. Jab 2007 Page 11 Other Roaming Scenarios: Non-Trusted to Trusted Roaming For LBS roaming between a nontrusted (home) and a trusted (visiting) carrier, the H-MPC can allocate the V-PDE address (based on a SID/NID to V-PDE mapping). This case is illustrated in the figure below. Internet Internet Home operator – Nontrusted LBS model AAA RAN PDSN PCF Visited operator – Trusted LBS model AAA RAN PDSN FA PCF H-PDE HA V-PDE BSA H-MPC Services layer signaling on MS-MPC interface. V-PDE allocation by H-MPC BSA Positioning layer (IS-801) signaling between MS and V-PDE Network connection MIP tunnel

12. Jab 2007 Page 12 Other Roaming Scenarios: Trusted to Non-Trusted Roaming For LBS roaming between a trusted (home) and a nontrusted (visiting) carrier, both DNS and PDE Interconnection solutions should work. For the DNS solution, the visited carrier’s PDE should allow the roaming partner’s devices to access the visited PDE via a new trusted port.  Once the LBS application resolves the V-PDE’s IP address (via DNS), it will attempt to access the V-PDE on the new trusted port. For the PDE interconnection solution, the V-PDE should allow the H-PDE to send location requests over a unique IP/port.  The H-PDE and V-PDE are interconnected using standard solutions, such as VPN. This is a controlled interface on which the roaming partner provides a wholesale LBS service.  User level authentication is not the responsibility of V-PDE. The V-PDE will serve the incoming location requests in a trusted manner with the assumption that all the authentication checks have been successfully performed at the Home LBS system.

13. Jab 2007 Page 13 Roaming Scenarios Summary Table Visited operator TrustedV1/V2 nontrusted Proprietary trusted 1 Proprietary nontrusted 2 Home operator Trusted Sharing BSA PDE interconnection DNS Sharing BSA PDE interconnection DNS Sharing BSA PDE interconnection DNS Sharing BSA PDE interconnection DNS V1/V2 nontrusted Sharing BSA PDE interconnection MPC allocates V-PDE Sharing BSA PDE interconnection MPC interconnection Sharing BSA PDE interconnection MPC interconnection Sharing BSA PDE interconnection MPC interconnection Proprietary nontrusted Sharing BSA PDE interconnection MPC allocates V-PDE Sharing BSA PDE interconnection MPC interconnection Sharing BSA PDE interconnection MPC interconnection Sharing BSA PDE interconnection MPC interconnection Proprietary trusted Sharing BSA PDE interconnection Sharing BSA PDE interconnection Sharing BSA PDE interconnection Sharing BSA PDE interconnection 1 Proprietary trusted LBS carrier is a carrier that uses a custom scheme for TCP/IP wrapper for IS-801 signaling. 2 Proprietary nontrusted LBS carrier is a carrier that is architecturally similar to V1/V2 nontrusted and uses an MPC, but such a carrier uses additional custom interfaces to address special needs.